@integrity-labs/agt-cli 0.28.565 → 0.28.567

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-I6EWKBSV.js";
+} from "../chunk-IALXJ6H3.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -182,17 +182,17 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-TOGADVFR.js";
+} from "../chunk-FSWAPB5J.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
-import { createHash as createHash16 } from "crypto";
-import { readFileSync as readFileSync22, writeFileSync as writeFileSync13, mkdirSync as mkdirSync10, existsSync as existsSync12, rmSync as rmSync5, readdirSync as readdirSync8, statSync as statSync7, copyFileSync } from "fs";
+import { createHash as createHash17 } from "crypto";
+import { readFileSync as readFileSync26, writeFileSync as writeFileSync14, mkdirSync as mkdirSync11, existsSync as existsSync14, rmSync as rmSync5, readdirSync as readdirSync9, statSync as statSync8, copyFileSync } from "fs";
 import { execFileSync as syncExecFile } from "child_process";
-import { join as join29, dirname as dirname8, delimiter as pathDelimiter } from "path";
-import { homedir as homedir12 } from "os";
+import { join as join33, dirname as dirname9, delimiter as pathDelimiter } from "path";
+import { homedir as homedir15 } from "os";
 import { fileURLToPath } from "url";
 
 // src/lib/claude-code-upgrade-throttle.ts
@@ -3503,14 +3503,804 @@ async function reportSkip2(api2, agentId, conversationId, log2, codeName) {
   }
 }
 
-// src/lib/activity-cache-monitor.ts
-import { existsSync as existsSync3, readFileSync as readFileSync11 } from "fs";
+// src/lib/tool-call-audit.ts
+import { homedir as homedir9 } from "os";
+import { join as join17 } from "path";
+
+// src/lib/tool-call-path-salt.ts
+import { randomBytes } from "crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync11, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join14 } from "path";
-var MIN_CHECK_INTERVAL_MS6 = 6e4;
-var STATS_CACHE_PATH = join14(homedir7(), ".claude", "stats-cache.json");
+import { dirname as dirname5, join as join14 } from "path";
+var SALT_BYTES = 32;
+var SALT_RE = /^[0-9a-f]{64}$/;
+function pathSaltPath(codeName, homeDir) {
+  const home = homeDir ?? (process.env["HOME"]?.trim() || homedir7());
+  const key = agentRuntimeKey(codeName, homeDir);
+  return join14(home, ".augmented", key, "tool-call-path-salt");
+}
+function readToolCallPathSalt(codeName, homeDir) {
+  let file;
+  try {
+    file = pathSaltPath(codeName, homeDir);
+  } catch {
+    return null;
+  }
+  try {
+    if (existsSync3(file)) {
+      const existing = readFileSync11(file, "utf-8").trim();
+      if (SALT_RE.test(existing)) return existing;
+    }
+  } catch {
+  }
+  const salt = randomBytes(SALT_BYTES).toString("hex");
+  const tmp = `${file}.tmp.${process.pid}`;
+  try {
+    mkdirSync5(dirname5(file), { recursive: true, mode: 448 });
+    writeFileSync6(tmp, `${salt}
+`, { encoding: "utf-8", mode: 384 });
+    renameSync3(tmp, file);
+  } catch {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    return null;
+  }
+  return salt;
+}
+
+// src/lib/tool-call-scan.ts
+import { statSync as statSync4 } from "fs";
+
+// src/lib/host-archive-address.ts
+import { readFileSync as readFileSync12 } from "fs";
+var DEFAULT_ARCHIVE_ADDRESS_PATH = "/var/lib/augmented/session-archive-address.json";
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+var cache = /* @__PURE__ */ new Map();
+function str(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readHostArchiveAddress(path) {
+  const file = path ?? process.env["ARCHIVE_ADDRESS_FILE"]?.trim() ?? process.env["AGT_SESSION_ARCHIVE_ADDRESS_FILE"]?.trim() ?? DEFAULT_ARCHIVE_ADDRESS_PATH;
+  const now = Date.now();
+  const hit = cache.get(file);
+  if (hit && now - hit.at < CACHE_TTL_MS) return hit.value;
+  let value = null;
+  try {
+    const raw = readFileSync12(file, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const obj = parsed;
+      const bucket = str(obj["bucket"]);
+      const keyPrefix = str(obj["key_prefix"]);
+      if (bucket && keyPrefix) {
+        value = {
+          bucket,
+          region: str(obj["region"]),
+          instanceId: str(obj["instance_id"]),
+          keyPrefix
+        };
+      }
+    }
+  } catch {
+    value = null;
+  }
+  cache.set(file, { at: now, value });
+  return value;
+}
+
+// src/lib/tool-call-extractor.ts
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync13, readSync, readdirSync as readdirSync4 } from "fs";
+import { basename, join as join15, relative } from "path";
+import { StringDecoder } from "string_decoder";
+
+// src/lib/tool-call-redaction.ts
+import { createHmac } from "crypto";
+
+// ../../packages/core/dist/tool-calls/input-hash.js
+import { createHash as createHash7 } from "crypto";
+function hashToolInput(input) {
+  if (input === void 0)
+    return null;
+  try {
+    return createHash7("sha256").update(canonicalJson2(input)).digest("hex");
+  } catch {
+    return null;
+  }
+}
+function canonicalJson2(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson2).join(",")}]`;
+  const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson2(v)}`).join(",")}}`;
+}
+
+// src/lib/tool-call-redaction.ts
+var REDACTION_RULE_VERSION = "r2";
+var REDACTED_TARGET_SHAPES = {
+  argv0: /^[A-Za-z0-9._+-]{1,64}$/,
+  mcp_tool: /^[A-Za-z0-9._+-]{1,64}$/,
+  path_hash: /^[0-9a-f]{32}$/,
+  url_host: /^[A-Za-z0-9.-]{1,253}$/
+};
+var NONE = { target: null, kind: "none" };
+var SAFE_IDENTIFIER_RE = /^[A-Za-z0-9._+-]{1,64}$/;
+var ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
+function hashPath(path, salt) {
+  if (!salt) return null;
+  return createHmac("sha256", salt).update(path).digest("hex").slice(0, 32);
+}
+function parseArgv0(command) {
+  const firstLine = command.split("\n", 1)[0] ?? "";
+  const tokens = firstLine.trim().split(/\s+/).filter(Boolean);
+  let i = 0;
+  while (i < tokens.length && ENV_ASSIGNMENT_RE.test(tokens[i])) i++;
+  const token = tokens[i];
+  if (!token) return { name: null, isPath: false };
+  if (token.includes("/")) return { name: token, isPath: true };
+  return { name: SAFE_IDENTIFIER_RE.test(token) ? token : null, isPath: false };
+}
+function stringField(input, field) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const v = input[field];
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function parseMcpTool(toolName) {
+  const m = /^mcp__[^_]+(?:_[^_]+)*?__(.+)$/.exec(toolName);
+  const tool = m?.[1];
+  return tool && SAFE_IDENTIFIER_RE.test(tool) ? tool : null;
+}
+function redactToolTarget(toolName, input, ctx) {
+  const out = redactToolTargetInner(toolName, input, ctx);
+  if (out.kind === "none") return out.target === null ? out : NONE;
+  return out.target !== null && REDACTED_TARGET_SHAPES[out.kind].test(out.target) ? out : NONE;
+}
+function redactToolTargetInner(toolName, input, ctx) {
+  if (ctx.hashOnly) return NONE;
+  if (toolName.startsWith("mcp__")) {
+    const tool = parseMcpTool(toolName);
+    return tool ? { target: tool, kind: "mcp_tool" } : NONE;
+  }
+  switch (toolName) {
+    case "Bash": {
+      const command = stringField(input, "command");
+      if (!command) return NONE;
+      const { name, isPath } = parseArgv0(command);
+      if (!name) return NONE;
+      if (isPath) {
+        const hashed = hashPath(name, ctx.pathHashSalt);
+        return hashed ? { target: hashed, kind: "path_hash" } : NONE;
+      }
+      const scrubbed = scrubSensitive(name);
+      return SAFE_IDENTIFIER_RE.test(scrubbed) ? { target: scrubbed, kind: "argv0" } : NONE;
+    }
+    // `MultiEdit`, `NotebookEdit` and `NotebookRead` are allowlisted WITHOUT
+    // having been observed — 0 occurrences each across 81 real transcripts,
+    // where only `Edit` appears. Normally that is exactly the speculative
+    // widening this module refuses to do, so the exception is worth stating: the
+    // sole disclosure on this arm is a keyed hash. If one of these names turns
+    // out to belong to some unrelated future tool, the row carries an unreadable
+    // digest of whatever its path field held — no content escapes either way.
+    // Against that, omitting a real file tool is a SILENT audit gap, which is
+    // the costlier error. (CodeRabbit.)
+    case "Read":
+    case "Write":
+    case "Edit":
+    case "MultiEdit": {
+      const path = stringField(input, "file_path");
+      if (!path) return NONE;
+      const hashed = hashPath(path, ctx.pathHashSalt);
+      return hashed ? { target: hashed, kind: "path_hash" } : NONE;
+    }
+    case "NotebookEdit":
+    case "NotebookRead": {
+      const path = stringField(input, "notebook_path");
+      if (!path) return NONE;
+      const hashed = hashPath(path, ctx.pathHashSalt);
+      return hashed ? { target: hashed, kind: "path_hash" } : NONE;
+    }
+    case "WebFetch": {
+      const url = stringField(input, "url");
+      if (!url) return NONE;
+      try {
+        const host = new URL(url).hostname;
+        return host ? { target: host, kind: "url_host" } : NONE;
+      } catch {
+        return NONE;
+      }
+    }
+    default:
+      return NONE;
+  }
+}
+
+// src/lib/tool-call-extractor.ts
+var EXTRACTOR_VERSION = "e1";
+function enumerateSessionTranscripts(transcriptDir, sessionId, projectsRoot) {
+  const files = [];
+  const mainAbs = join15(transcriptDir, `${sessionId}.jsonl`);
+  files.push({
+    absPath: mainAbs,
+    relPath: relative(projectsRoot, mainAbs),
+    ref: "main",
+    isSubagent: false,
+    subagentId: null
+  });
+  const subDir = join15(transcriptDir, sessionId, "subagents");
+  let entries;
+  try {
+    entries = readdirSync4(subDir);
+  } catch {
+    return files;
+  }
+  for (const name of entries) {
+    if (!name.endsWith(".jsonl")) continue;
+    const abs = join15(subDir, name);
+    const stem = basename(name, ".jsonl");
+    files.push({
+      absPath: abs,
+      relPath: relative(projectsRoot, abs),
+      ref: `subagent:${stem}`,
+      isSubagent: true,
+      subagentId: stem.startsWith("agent-") ? stem.slice("agent-".length) : stem
+    });
+  }
+  return files;
+}
+function scanLines(lines, file, opts) {
+  const pending2 = /* @__PURE__ */ new Map();
+  const ordered = [];
+  for (const [lineOffset, rawLine, byteStart] of lines) {
+    const trimmed = rawLine.trim();
+    if (trimmed.length === 0) continue;
+    let record;
+    try {
+      record = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (typeof record !== "object" || record === null) continue;
+    const message = record.message;
+    const blocks = message && typeof message === "object" && Array.isArray(message.content) ? message.content : null;
+    if (!blocks) continue;
+    for (const raw of blocks) {
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+      const block = raw;
+      if (block.type === "tool_use") {
+        const id = typeof block.id === "string" ? block.id : null;
+        const name = typeof block.name === "string" ? block.name : null;
+        if (!id || !name) continue;
+        const { target, kind } = redactToolTarget(name, block.input, opts.redaction);
+        const occurredAt = typeof record.timestamp === "string" ? record.timestamp : null;
+        const built = {
+          tool_use_id: id,
+          tool_name: name,
+          occurred_at: occurredAt,
+          session_id: typeof record.sessionId === "string" ? record.sessionId : null,
+          transcript_rel_path: file.relPath,
+          transcript_ref: file.ref,
+          line_offset: lineOffset,
+          // The FILE is the sole authority, deliberately — not `record.isSidechain`.
+          //
+          // These three fields are one fact stated three ways and must not be
+          // able to contradict each other: `is_subagent` true iff
+          // `transcript_ref` starts with `subagent:` iff `subagent_id` is set.
+          // Letting `record.isSidechain` raise `is_subagent` on its own could
+          // produce is_subagent=true with transcript_ref='main' and a null
+          // subagent_id — a row claiming a delegated worker made the call while
+          // addressing the parent's transcript. `transcript_ref` is an EVIDENCE
+          // ADDRESS: it must name the file the line actually lives in, so the
+          // file has to win and the other two follow it. (CodeRabbit.)
+          //
+          // Nothing is lost today: no main-transcript record in the measured
+          // corpus carried isSidechain on a tool_use, and every sidecar record
+          // did. If Claude Code ever inlines sidechain turns into the main file,
+          // record-level sidechain-ness needs its own field rather than
+          // overloading this one.
+          is_subagent: file.isSubagent,
+          subagent_id: file.isSubagent ? typeof record.agentId === "string" && record.agentId ? record.agentId : file.subagentId : null,
+          is_error: null,
+          // resolved on pairing below
+          input_sha256: hashToolInput(block.input),
+          redacted_target: target,
+          redacted_target_kind: kind,
+          extractor_version: EXTRACTOR_VERSION,
+          redaction_rule_version: REDACTION_RULE_VERSION,
+          archive_bucket: opts.archive?.bucket ?? null,
+          archive_region: opts.archive?.region ?? null,
+          host_instance_id: opts.archive?.instanceId ?? null,
+          archive_key_prefix: opts.archive?.keyPrefix ?? null
+        };
+        ordered.push(built);
+        pending2.set(id, { record: built, byteStart });
+        continue;
+      }
+      if (block.type === "tool_result") {
+        const id = typeof block.tool_use_id === "string" ? block.tool_use_id : null;
+        if (!id) continue;
+        const call = pending2.get(id);
+        if (!call) continue;
+        call.record.is_error = "is_error" in block && block.is_error === null ? null : block.is_error === true;
+        pending2.delete(id);
+      }
+    }
+  }
+  return { records: ordered, pending: pending2 };
+}
+var WINDOW_CHUNK_BYTES = 64 * 1024;
+function extractTranscriptWindow(file, opts, from) {
+  let fd;
+  try {
+    fd = openSync(file.absPath, "r");
+  } catch {
+    return {
+      records: [],
+      endByte: from.byteOffset,
+      endLine: from.lineOffset,
+      unpaired: [],
+      missing: true,
+      rewound: false
+    };
+  }
+  let startByte = from.byteOffset;
+  let startLine = from.lineOffset;
+  let rewound = false;
+  try {
+    const { size } = fstatSync(fd);
+    if (startByte > size) {
+      startByte = 0;
+      startLine = 0;
+      rewound = true;
+    }
+  } catch {
+  }
+  const decoder = new StringDecoder("utf8");
+  const buf = Buffer.allocUnsafe(WINDOW_CHUNK_BYTES);
+  let position = startByte;
+  let runningByte = startByte;
+  let lineOffset = startLine;
+  let carry = "";
+  const pairs = [];
+  try {
+    for (; ; ) {
+      const bytesRead = readSync(fd, buf, 0, WINDOW_CHUNK_BYTES, position);
+      if (bytesRead <= 0) break;
+      position += bytesRead;
+      carry += decoder.write(buf.subarray(0, bytesRead));
+      let nl;
+      while ((nl = carry.indexOf("\n")) !== -1) {
+        const line = carry.slice(0, nl);
+        pairs.push([lineOffset, line, runningByte]);
+        runningByte += Buffer.byteLength(line, "utf8") + 1;
+        lineOffset += 1;
+        carry = carry.slice(nl + 1);
+      }
+    }
+  } catch {
+  } finally {
+    try {
+      closeSync(fd);
+    } catch {
+    }
+  }
+  const { records, pending: pending2 } = scanLines(pairs, file, opts);
+  const unpaired = [...pending2.values()].map((p) => ({
+    toolUseId: p.record.tool_use_id,
+    byteStart: p.byteStart,
+    lineOffset: p.record.line_offset
+  })).sort((a, b) => a.byteStart - b.byteStart);
+  return { records, endByte: runningByte, endLine: lineOffset, unpaired, missing: false, rewound };
+}
+
+// src/lib/tool-call-cursor.ts
+import { existsSync as existsSync4, readFileSync as readFileSync14 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join16 } from "path";
+var COVERAGE_DISPOSITIONS = [
+  "ok",
+  "not_entitled",
+  "ingest_failed",
+  "batch_rejected",
+  "agent_unbound",
+  "transcript_missing"
+];
+function mayAdvance(outcome) {
+  switch (outcome.kind) {
+    case "ingested":
+      return true;
+    // Definitive: nothing will EVER be collected for this org. Holding would
+    // re-offer the same lines forever against an answer that cannot change.
+    case "not_entitled":
+      return true;
+    // A producer bug. Retrying is futile and holding wedges every later call
+    // behind it, so step over — loudly, and counted.
+    case "batch_rejected":
+      return true;
+    case "agent_unbound":
+      return false;
+    case "ingest_failed":
+      return false;
+  }
+}
+function dispositionFor(outcome) {
+  switch (outcome.kind) {
+    case "ingested":
+      return "ok";
+    case "not_entitled":
+      return "not_entitled";
+    case "batch_rejected":
+      return "batch_rejected";
+    case "agent_unbound":
+      return "agent_unbound";
+    case "ingest_failed":
+      return "ingest_failed";
+  }
+}
+var UNPAIRED_GRACE_MS = 30 * 60 * 1e3;
+var KEY_SEP = "\0";
+function cursorKey(sessionId, transcriptRef) {
+  return `${sessionId ?? ""}${KEY_SEP}${transcriptRef}`;
+}
+function parseCursorKey(key) {
+  const i = key.indexOf(KEY_SEP);
+  if (i < 0) return { sessionId: null, transcriptRef: key };
+  const sessionId = key.slice(0, i);
+  return { sessionId: sessionId.length > 0 ? sessionId : null, transcriptRef: key.slice(i + 1) };
+}
+function cursorStatePath(codeName, homeDir) {
+  const home = homeDir ?? (process.env["HOME"]?.trim() || homedir8());
+  const key = agentRuntimeKey(codeName, homeDir);
+  return join16(home, ".augmented", key, "tool-call-cursors.json");
+}
+function loadCursors(path) {
+  const out = /* @__PURE__ */ new Map();
+  if (!existsSync4(path)) return out;
+  try {
+    const parsed = JSON.parse(readFileSync14(path, "utf-8"));
+    if (!parsed || parsed.version !== 1 || typeof parsed.files !== "object") return out;
+    for (const [k, v] of Object.entries(parsed.files)) {
+      if (!v || typeof v !== "object") continue;
+      const offsetsOk = ["byteOffset", "lineOffset", "startedFromLine", "callsExtracted"].every((f) => {
+        const n = v[f];
+        return n === void 0 || typeof n === "number" && Number.isSafeInteger(n) && n >= 0;
+      });
+      if (typeof v.byteOffset !== "number" || typeof v.lineOffset !== "number" || !offsetsOk) continue;
+      out.set(k, {
+        byteOffset: v.byteOffset,
+        lineOffset: v.lineOffset,
+        startedFromLine: typeof v.startedFromLine === "number" ? v.startedFromLine : 0,
+        callsExtracted: typeof v.callsExtracted === "number" ? v.callsExtracted : 0,
+        unpairedSince: typeof v.unpairedSince === "string" ? v.unpairedSince : null,
+        lastDisposition: COVERAGE_DISPOSITIONS.includes(v.lastDisposition) ? v.lastDisposition : "ok",
+        lastScanAt: typeof v.lastScanAt === "string" ? v.lastScanAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+        firstScanAt: typeof v.firstScanAt === "string" ? v.firstScanAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+        transcriptRelPath: typeof v.transcriptRelPath === "string" ? v.transcriptRelPath : null
+      });
+    }
+  } catch {
+  }
+  return out;
+}
+function saveCursors(path, cursors) {
+  const files = {};
+  for (const [k, v] of cursors) files[k] = v;
+  atomicWriteFileSync(path, JSON.stringify({ version: 1, files }, null, 2));
+}
+function nextCursor(args) {
+  const { previous, endByte, endLine, earliestUnpaired, outcome, nowMs } = args;
+  const nowIso = new Date(nowMs).toISOString();
+  const disposition = dispositionFor(outcome);
+  if (!mayAdvance(outcome)) {
+    return { ...previous, lastDisposition: disposition, lastScanAt: nowIso };
+  }
+  const callsExtracted = previous.callsExtracted + args.callsExtracted;
+  if (!earliestUnpaired) {
+    return {
+      ...previous,
+      byteOffset: endByte,
+      lineOffset: endLine,
+      callsExtracted,
+      unpairedSince: null,
+      lastDisposition: disposition,
+      lastScanAt: nowIso
+    };
+  }
+  const since = previous.unpairedSince ?? nowIso;
+  const waited = nowMs - Date.parse(since);
+  if (!Number.isFinite(waited) || waited >= UNPAIRED_GRACE_MS) {
+    return {
+      ...previous,
+      byteOffset: endByte,
+      lineOffset: endLine,
+      callsExtracted,
+      unpairedSince: null,
+      lastDisposition: disposition,
+      lastScanAt: nowIso
+    };
+  }
+  return {
+    ...previous,
+    byteOffset: Math.max(previous.byteOffset, Math.min(endByte, earliestUnpaired.byteStart)),
+    lineOffset: Math.max(previous.lineOffset, Math.min(endLine, earliestUnpaired.lineOffset)),
+    callsExtracted,
+    unpairedSince: since,
+    lastDisposition: disposition,
+    lastScanAt: nowIso
+  };
+}
+function initialCursor(args) {
+  const iso = new Date(args.nowMs).toISOString();
+  return {
+    byteOffset: args.startByte,
+    lineOffset: args.startLine,
+    startedFromLine: args.startLine,
+    callsExtracted: 0,
+    unpairedSince: null,
+    lastDisposition: "ok",
+    lastScanAt: iso,
+    firstScanAt: iso,
+    transcriptRelPath: args.transcriptRelPath
+  };
+}
+function coverageRowFor(key, cursor, versions) {
+  const { sessionId, transcriptRef } = parseCursorKey(key);
+  return {
+    session_id: sessionId,
+    transcript_ref: transcriptRef,
+    transcript_rel_path: cursor.transcriptRelPath,
+    through_line: cursor.lineOffset,
+    through_byte: cursor.byteOffset,
+    started_from_line: cursor.startedFromLine,
+    calls_extracted: cursor.callsExtracted,
+    last_disposition: cursor.lastDisposition,
+    extractor_version: versions.extractor,
+    redaction_rule_version: versions.redaction
+  };
+}
+
+// src/lib/tool-call-scan.ts
+var MAX_CALLS_PER_POST = 500;
+var MAX_COVERAGE_ROWS_PER_POST = 200;
+function classifyIngestResult(result, error) {
+  if (error) {
+    if (error instanceof ApiError) {
+      if (error.status === 404) return { kind: "agent_unbound" };
+      if (error.status === 400 && error.body?.["code"] === "batch_too_large") {
+        return { kind: "ingest_failed", reason: `oversize batch (HTTP 400): ${error.message}` };
+      }
+      if (error.status >= 400 && error.status < 500) {
+        return { kind: "batch_rejected", reason: `HTTP ${error.status}: ${error.message}` };
+      }
+      return { kind: "ingest_failed", reason: `HTTP ${error.status}: ${error.message}` };
+    }
+    return { kind: "ingest_failed", reason: String(error?.message ?? error) };
+  }
+  const body = result ?? {};
+  if (body["entitled"] === false) return { kind: "not_entitled" };
+  if (body["ok"] === false) {
+    return { kind: "ingest_failed", reason: String(body["message"] ?? "ok:false") };
+  }
+  return { kind: "ingested" };
+}
+function chunk(items, size) {
+  const out = [];
+  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+  return out;
+}
+function endOfFile(absPath) {
+  try {
+    return { byteOffset: statSync4(absPath).size, lineOffset: 0 };
+  } catch {
+    return null;
+  }
+}
+async function scanAgentToolCalls(args) {
+  const now = args.now ?? Date.now;
+  const log2 = args.log;
+  const summary = {
+    filesScanned: 0,
+    callsExtracted: 0,
+    callsIngested: 0,
+    filesHeld: 0,
+    coverageReported: 0,
+    notEntitled: false
+  };
+  const path = args.cursorPath ?? cursorStatePath(args.codeName, args.homeDir);
+  const cursors = loadCursors(path);
+  const extractOpts = {
+    transcriptDir: args.transcriptDir,
+    archive: readHostArchiveAddress(),
+    redaction: { pathHashSalt: args.pathHashSalt, hashOnly: args.hashOnly }
+  };
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const sessionId of args.sessionIds) {
+    for (const f of enumerateSessionTranscripts(args.transcriptDir, sessionId, args.projectsRoot)) {
+      const key = cursorKey(sessionId, f.ref);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      files.push({ key, file: f });
+    }
+  }
+  const touched = [];
+  for (const { key, file } of files) {
+    let cursor = cursors.get(key);
+    if (!cursor) {
+      const end = endOfFile(file.absPath);
+      if (!end) continue;
+      cursor = initialCursor({
+        startByte: args.backfill ? 0 : end.byteOffset,
+        startLine: 0,
+        transcriptRelPath: file.relPath,
+        nowMs: now()
+      });
+      cursors.set(key, cursor);
+      touched.push(key);
+      if (!args.backfill && end.byteOffset > 0) {
+        log2(
+          `[tool-call-scan] first-seen ${file.relPath} ref=${file.ref} \u2014 starting at byte ${end.byteOffset} (scan-from-now; set backfill to include the existing ${end.byteOffset}B)`
+        );
+      }
+      if (!args.backfill) continue;
+    }
+    const window = extractTranscriptWindow(file, extractOpts, {
+      byteOffset: cursor.byteOffset,
+      lineOffset: cursor.lineOffset
+    });
+    summary.filesScanned += 1;
+    if (window.missing) {
+      cursors.set(key, { ...cursor, lastDisposition: "transcript_missing", lastScanAt: new Date(now()).toISOString() });
+      touched.push(key);
+      continue;
+    }
+    if (window.rewound) {
+      log2(`[tool-call-scan] ${file.relPath} ref=${file.ref} shrank below the cursor \u2014 re-reading from 0`);
+    }
+    summary.callsExtracted += window.records.length;
+    const unpairedIds = new Set(window.unpaired.map((u) => u.toolUseId));
+    const sendable = window.records.filter((r) => !unpairedIds.has(r.tool_use_id));
+    let outcome = { kind: "ingested" };
+    let attempted = false;
+    let ingested = 0;
+    for (const batch of chunk(sendable, MAX_CALLS_PER_POST)) {
+      attempted = true;
+      const res = await postCalls(args.api, args.agentId, batch);
+      outcome = res.outcome;
+      ingested += res.ingested;
+      if (outcome.kind === "not_entitled") summary.notEntitled = true;
+      if (outcome.kind !== "ingested" && outcome.kind !== "not_entitled") break;
+    }
+    summary.callsIngested += ingested;
+    const computed = nextCursor({
+      previous: cursor,
+      endByte: window.endByte,
+      endLine: window.endLine,
+      earliestUnpaired: window.unpaired[0] ?? null,
+      outcome,
+      callsExtracted: sendable.length,
+      nowMs: now()
+    });
+    const advanced = attempted ? computed : { ...computed, lastDisposition: cursor.lastDisposition };
+    if (advanced.byteOffset === cursor.byteOffset && outcome.kind === "ingest_failed") {
+      summary.filesHeld += 1;
+      log2(
+        `[tool-call-scan] HOLDING cursor for ${file.relPath} ref=${file.ref} at byte ${cursor.byteOffset}: ${outcome.reason}`
+      );
+    }
+    cursors.set(key, advanced);
+    touched.push(key);
+    if (outcome.kind === "agent_unbound") {
+      log2(`[tool-call-scan] host is not bound to agent ${args.agentId} \u2014 stopping this tick`);
+      break;
+    }
+  }
+  saveCursors(path, cursors);
+  summary.coverageReported = await reportCoverage(args, cursors, touched, log2);
+  return summary;
+}
+async function postCalls(api2, agentId, calls) {
+  try {
+    const res = await api2.post(
+      "/host/tool-calls",
+      { agent_id: agentId, calls }
+    );
+    const outcome = classifyIngestResult(res);
+    return { outcome, ingested: typeof res?.ingested === "number" ? res.ingested : 0 };
+  } catch (err) {
+    return { outcome: classifyIngestResult(void 0, err), ingested: 0 };
+  }
+}
+async function reportCoverage(args, cursors, touched, log2) {
+  const rows = [];
+  for (const key of new Set(touched)) {
+    const c = cursors.get(key);
+    if (c) rows.push(coverageRowFor(key, c, { extractor: EXTRACTOR_VERSION, redaction: REDACTION_RULE_VERSION }));
+  }
+  if (rows.length === 0) return 0;
+  let reported = 0;
+  for (const batch of chunk(rows, MAX_COVERAGE_ROWS_PER_POST)) {
+    try {
+      await args.api.post("/host/tool-calls/coverage", { agent_id: args.agentId, coverage: batch });
+      reported += batch.length;
+    } catch (err) {
+      log2(`[tool-call-scan] coverage report failed (${batch.length} rows): ${String(err)}`);
+      break;
+    }
+  }
+  return reported;
+}
+
+// src/lib/tool-call-audit.ts
+var MIN_CHECK_INTERVAL_MS6 = 10 * 6e4;
+var ENTITLEMENT_RECHECK_MS = 30 * 6e4;
+var state5 = /* @__PURE__ */ new Map();
+function entitlementLatch(entry, nowMs) {
+  if (!entry?.notEntitledAt) return false;
+  return !hasElapsed(entry.notEntitledAt, nowMs, ENTITLEMENT_RECHECK_MS);
+}
+function hasElapsed(sinceMs, nowMs, windowMs) {
+  const delta = nowMs - sinceMs;
+  if (!Number.isFinite(delta) || delta < 0) return true;
+  return delta >= windowMs;
+}
+async function maybeScanToolCalls(args) {
+  const { api: api2, codeName, agentId, log: log2 } = args;
+  const nowFn = args.now ?? Date.now;
+  const nowMs = nowFn();
+  try {
+    const existing = state5.get(codeName);
+    if (existing && !hasElapsed(existing.lastCheckedAt, nowMs, MIN_CHECK_INTERVAL_MS6)) return;
+    if (entitlementLatch(existing, nowMs)) {
+      state5.set(codeName, { lastCheckedAt: nowMs, notEntitledAt: existing?.notEntitledAt ?? null });
+      return;
+    }
+    state5.set(codeName, { lastCheckedAt: nowMs, notEntitledAt: existing?.notEntitledAt ?? null });
+    const salt = readToolCallPathSalt(codeName, args.homeDir);
+    if (!salt) {
+      log2(`[tool-call-audit] ${codeName}: no path-hash salt available \u2014 file targets withheld`);
+    }
+    const home = args.homeDir ?? (process.env["HOME"]?.trim() || homedir9());
+    const projectsRoot = args.projectsRoot ?? join17(home, ".claude", "projects");
+    const transcriptDir = args.transcriptDir ?? sessionTranscriptDir(getProjectDir(codeName));
+    const current = peekCurrentSession(codeName);
+    const sessionIds = current ? [current.sessionId] : [];
+    const summary = await scanAgentToolCalls({
+      api: api2,
+      agentId,
+      codeName,
+      transcriptDir,
+      projectsRoot,
+      sessionIds,
+      pathHashSalt: salt ?? "",
+      ...args.hashOnly === void 0 ? {} : { hashOnly: args.hashOnly },
+      log: log2,
+      now: nowFn,
+      ...args.homeDir === void 0 ? {} : { homeDir: args.homeDir },
+      ...args.cursorPath === void 0 ? {} : { cursorPath: args.cursorPath }
+    });
+    if (summary.notEntitled) {
+      state5.set(codeName, { lastCheckedAt: nowMs, notEntitledAt: nowMs });
+    } else if (summary.callsIngested > 0) {
+      state5.set(codeName, { lastCheckedAt: nowMs, notEntitledAt: null });
+    }
+  } catch (err) {
+    log2(`[tool-call-audit] ${codeName}: scan failed: ${err.message}`);
+  }
+}
+
+// src/lib/activity-cache-monitor.ts
+import { existsSync as existsSync5, readFileSync as readFileSync15 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join18 } from "path";
+var MIN_CHECK_INTERVAL_MS7 = 6e4;
+var STATS_CACHE_PATH = join18(homedir10(), ".claude", "stats-cache.json");
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
-var state5 = { lastObservedDate: null, lastCheckedAt: 0 };
+var state6 = { lastObservedDate: null, lastCheckedAt: 0 };
 function selectNewDailyRows(raw, lastObservedDate) {
   let parsed;
   try {
@@ -3549,24 +4339,24 @@ async function maybeReportActivityCache(args) {
   const { api: api2, log: log2 } = args;
   const now = args.now ?? /* @__PURE__ */ new Date();
   const nowMs = now.getTime();
-  if (nowMs - state5.lastCheckedAt < MIN_CHECK_INTERVAL_MS6) return;
-  state5.lastCheckedAt = nowMs;
-  if (!existsSync3(STATS_CACHE_PATH)) {
+  if (nowMs - state6.lastCheckedAt < MIN_CHECK_INTERVAL_MS7) return;
+  state6.lastCheckedAt = nowMs;
+  if (!existsSync5(STATS_CACHE_PATH)) {
     return;
   }
   let raw;
   try {
-    raw = readFileSync11(STATS_CACHE_PATH, "utf-8");
+    raw = readFileSync15(STATS_CACHE_PATH, "utf-8");
   } catch (err) {
     log2(`[activity-cache] readFileSync failed: ${err.message}`);
     return;
   }
-  const rows = selectNewDailyRows(raw, state5.lastObservedDate);
+  const rows = selectNewDailyRows(raw, state6.lastObservedDate);
   if (rows.length === 0) return;
   for (const row of rows) {
     try {
       await api2.post("/host/activity-observations", row);
-      state5.lastObservedDate = row.date;
+      state6.lastObservedDate = row.date;
     } catch (err) {
       log2(
         `[activity-cache] POST /host/activity-observations failed for date=${row.date}: ${err.message}`
@@ -3741,7 +4531,7 @@ function bundleFingerprint(files) {
 }
 
 // src/lib/channel-config-hash.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 var DERIVED_PRINCIPAL_ID_LIST_KEYS = [
   "allowed_users",
   "diagnostic_chat_ids",
@@ -3762,7 +4552,7 @@ function normalizeChannelConfigForHash(config2) {
 }
 var CHANNEL_WRITE_VERSION = 9;
 function computeChannelConfigHash(input) {
-  return createHash7("sha256").update(
+  return createHash8("sha256").update(
     canonicalJson({
       writeVersion: CHANNEL_WRITE_VERSION,
       cliVersion: input.cliVersion,
@@ -3781,18 +4571,18 @@ function computeChannelConfigHash(input) {
 }
 
 // src/lib/channel-hash-cache.ts
-import { existsSync as existsSync4, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
+import { join as join19 } from "path";
 var CACHE_FILENAME = "channel-hash-cache.json";
 function getChannelHashCacheFile(configDir) {
-  return join15(configDir, CACHE_FILENAME);
+  return join19(configDir, CACHE_FILENAME);
 }
 function loadChannelHashCache(target, configDir) {
   const path = getChannelHashCacheFile(configDir);
-  if (!existsSync4(path)) return;
+  if (!existsSync6(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(path, "utf-8"));
+    parsed = JSON.parse(readFileSync16(path, "utf-8"));
   } catch {
     return;
   }
@@ -3806,14 +4596,14 @@ function saveChannelHashCache(source, configDir) {
   const obj = {};
   for (const [key, value] of source) obj[key] = value;
   try {
-    writeFileSync6(path, JSON.stringify(obj, null, 2));
+    writeFileSync7(path, JSON.stringify(obj, null, 2));
   } catch {
   }
 }
 
 // src/lib/sender-policy-baseline.ts
-import { existsSync as existsSync5, readFileSync as readFileSync13 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync17 } from "fs";
+import { join as join20 } from "path";
 var BASELINE_FILENAME = "sender-policy-baseline.json";
 var SENDER_POLICY_BASELINE_VERSION = 1;
 var BASELINE_CONCERNS = ["senderPolicy", "slackBehaviour", "msteamsBehaviour"];
@@ -3825,14 +4615,14 @@ function createDeliveryBaselineMaps() {
   };
 }
 function getSenderPolicyBaselineFile(configDir) {
-  return join16(configDir, BASELINE_FILENAME);
+  return join20(configDir, BASELINE_FILENAME);
 }
 function loadSenderPolicyBaseline(target, configDir, log2) {
   const path = getSenderPolicyBaselineFile(configDir);
-  if (!existsSync5(path)) return;
+  if (!existsSync7(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync13(path, "utf-8"));
+    parsed = JSON.parse(readFileSync17(path, "utf-8"));
   } catch (err) {
     log2?.(
       `[sender-policy] discarding corrupt ${BASELINE_FILENAME} (${err.message}) - restrictive-policy agents will take one fail-closed restart`
@@ -4355,37 +5145,37 @@ function planGlobalSkillSync(globalSkills, prevIds, hashOf, knownHash, options)
 }
 
 // src/lib/manager/integration-skill-cache.ts
-import { join as join17 } from "path";
+import { join as join21 } from "path";
 function integrationSkillHashKey(agentId, skillId) {
   return `plugin-skill:${agentId}:${skillId}`;
 }
-function shouldWriteIntegrationSkill(cache2, agentId, skillId, contentHash) {
-  return cache2.get(integrationSkillHashKey(agentId, skillId)) !== contentHash;
+function shouldWriteIntegrationSkill(cache3, agentId, skillId, contentHash) {
+  return cache3.get(integrationSkillHashKey(agentId, skillId)) !== contentHash;
 }
-function rememberIntegrationSkill(cache2, agentId, skillId, contentHash) {
-  cache2.set(integrationSkillHashKey(agentId, skillId), contentHash);
+function rememberIntegrationSkill(cache3, agentId, skillId, contentHash) {
+  cache3.set(integrationSkillHashKey(agentId, skillId), contentHash);
 }
-function forgetIntegrationSkill(cache2, agentId, skillId) {
-  cache2.delete(integrationSkillHashKey(agentId, skillId));
+function forgetIntegrationSkill(cache3, agentId, skillId) {
+  cache3.delete(integrationSkillHashKey(agentId, skillId));
 }
 function removeIntegrationSkillFolder(opts) {
   forgetIntegrationSkill(opts.cache, opts.agentId, opts.entry);
   for (const dir of opts.dirs) {
-    opts.removeDir(join17(dir, opts.entry));
+    opts.removeDir(join21(dir, opts.entry));
   }
 }
 
 // src/lib/manager/managed-skill-manifest.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname5, join as join18 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname6, join as join22 } from "path";
 var MANIFEST_VERSION = 1;
 function managedSkillManifestPath(agentRootDir) {
-  return join18(agentRootDir, "managed-skills.json");
+  return join22(agentRootDir, "managed-skills.json");
 }
 function readManagedSkillManifest(path) {
   try {
-    if (!existsSync6(path)) return /* @__PURE__ */ new Set();
-    const parsed = JSON.parse(readFileSync14(path, "utf-8"));
+    if (!existsSync8(path)) return /* @__PURE__ */ new Set();
+    const parsed = JSON.parse(readFileSync18(path, "utf-8"));
     const ids = Array.isArray(parsed?.globalSkillIds) ? parsed.globalSkillIds : [];
     return new Set(ids.filter((id) => typeof id === "string" && id.length > 0));
   } catch {
@@ -4394,12 +5184,12 @@ function readManagedSkillManifest(path) {
 }
 function writeManagedSkillManifest(path, ids) {
   try {
-    mkdirSync5(dirname5(path), { recursive: true });
+    mkdirSync6(dirname6(path), { recursive: true });
     const body = {
       version: MANIFEST_VERSION,
       globalSkillIds: [...ids].sort()
     };
-    writeFileSync7(path, JSON.stringify(body, null, 2));
+    writeFileSync8(path, JSON.stringify(body, null, 2));
   } catch {
   }
 }
@@ -4497,9 +5287,9 @@ function resolveModelChain(refreshData) {
 }
 
 // src/lib/manager/claude-auth.ts
-import { existsSync as existsSync7, rmSync as rmSync3 } from "fs";
-import { join as join19 } from "path";
-import { homedir as homedir8 } from "os";
+import { existsSync as existsSync9, rmSync as rmSync3 } from "fs";
+import { join as join23 } from "path";
+import { homedir as homedir11 } from "os";
 async function applyClaudeAuthToEnv(childEnv, label) {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -4511,10 +5301,10 @@ async function applyClaudeAuthToEnv(childEnv, label) {
       throw new Error("claude_auth_mode=api_key but /host/exchange returned no decrypted key");
     }
     childEnv.ANTHROPIC_API_KEY = exchange.anthropicApiKey;
-    const claudeDir = join19(homedir8(), ".claude");
+    const claudeDir = join23(homedir11(), ".claude");
     for (const filename of [".credentials.json", "credentials.json"]) {
-      const p = join19(claudeDir, filename);
-      if (existsSync7(p)) {
+      const p = join23(claudeDir, filename);
+      if (existsSync9(p)) {
         try {
           rmSync3(p, { force: true });
           log(`[${label}] Removed ${p} (api_key mode \u2014 preventing OAuth fallback)`);
@@ -4595,8 +5385,8 @@ function heartbeatRuntimeAuthFields(probeVerdict) {
 }
 
 // src/lib/manager/kanban/parsers.ts
-import { existsSync as existsSync8, readFileSync as readFileSync15 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync19 } from "fs";
+import { join as join24 } from "path";
 var STANDUP_TEMPLATES = /* @__PURE__ */ new Set(["daily-standup", "end-of-day-summary"]);
 var TASK_UPDATE_TEMPLATES = /* @__PURE__ */ new Set(["hourly-status", "task-update"]);
 var PLAN_TEMPLATES = /* @__PURE__ */ new Set(["morning-plan"]);
@@ -4632,21 +5422,21 @@ function nudgeIntervalForCount(nudgeCount, fullCadenceMs, maxCadenceMs) {
   const exponent = Math.max(0, Math.min(nudgeCount - 1, 8));
   return Math.min(fullCadenceMs * 3 ** exponent, Math.max(maxCadenceMs, fullCadenceMs));
 }
-function shouldNudgeUnchangedBoard(signature, state7, now, fullCadenceMs, maxCadenceMs = fullCadenceMs) {
-  if (!state7) return true;
-  if (state7.signature !== signature) return true;
-  return now - state7.nudgedAt >= nudgeIntervalForCount(state7.nudgeCount ?? 1, fullCadenceMs, maxCadenceMs);
+function shouldNudgeUnchangedBoard(signature, state8, now, fullCadenceMs, maxCadenceMs = fullCadenceMs) {
+  if (!state8) return true;
+  if (state8.signature !== signature) return true;
+  return now - state8.nudgedAt >= nudgeIntervalForCount(state8.nudgeCount ?? 1, fullCadenceMs, maxCadenceMs);
 }
 function failureRetryIntervalForCount(failureCount, baseMs, maxMs) {
   const exponent = Math.max(0, Math.min(failureCount - 1, 8));
   return Math.min(baseMs * 3 ** exponent, Math.max(maxMs, baseMs));
 }
 var KANBAN_NOTICE_BREAKER_THRESHOLD = 5;
-function shouldAttemptNoticeEnqueue(state7, now, baseMs, maxMs, breakerThreshold = KANBAN_NOTICE_BREAKER_THRESHOLD) {
-  const failures = state7?.failureCount ?? 0;
+function shouldAttemptNoticeEnqueue(state8, now, baseMs, maxMs, breakerThreshold = KANBAN_NOTICE_BREAKER_THRESHOLD) {
+  const failures = state8?.failureCount ?? 0;
   if (failures <= 0) return { attempt: true, breakerOpen: false };
   const breakerOpen = failures >= breakerThreshold;
-  const failedAt = state7?.failedAt;
+  const failedAt = state8?.failedAt;
   const due = failedAt === void 0 || failedAt > now || now - failedAt >= failureRetryIntervalForCount(failures, baseMs, maxMs);
   return { attempt: due, breakerOpen };
 }
@@ -4748,12 +5538,12 @@ function getBuiltInSkillContent(skillId) {
   if (builtInSkillCache.has(skillId)) return builtInSkillCache.get(skillId);
   try {
     const candidates = [
-      join20(process.cwd(), "skills", skillId, "SKILL.md"),
-      join20(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "..", "..", "skills", skillId, "SKILL.md")
+      join24(process.cwd(), "skills", skillId, "SKILL.md"),
+      join24(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "..", "..", "skills", skillId, "SKILL.md")
     ];
     for (const candidate of candidates) {
-      if (existsSync8(candidate)) {
-        const content = readFileSync15(candidate, "utf-8");
+      if (existsSync10(candidate)) {
+        const content = readFileSync19(candidate, "utf-8");
         const files = [{ relativePath: "SKILL.md", content }];
         builtInSkillCache.set(skillId, files);
         return files;
@@ -4894,19 +5684,19 @@ function formatBoardForPrompt(items, template) {
 }
 
 // src/lib/manager/kanban/nudge-state-cache.ts
-import { existsSync as existsSync9, readFileSync as readFileSync16, writeFileSync as writeFileSync8 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "fs";
+import { join as join25 } from "path";
 var CACHE_FILENAME2 = "kanban-nudge-state.json";
 var KANBAN_NUDGE_STATE_VERSION = 1;
 function getKanbanNudgeStateFile(configDir) {
-  return join21(configDir, CACHE_FILENAME2);
+  return join25(configDir, CACHE_FILENAME2);
 }
 function loadKanbanNudgeState(target, configDir) {
   const path = getKanbanNudgeStateFile(configDir);
-  if (!existsSync9(path)) return;
+  if (!existsSync11(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync16(path, "utf-8"));
+    parsed = JSON.parse(readFileSync20(path, "utf-8"));
   } catch {
     return;
   }
@@ -4936,15 +5726,15 @@ function loadKanbanNudgeState(target, configDir) {
 function saveKanbanNudgeState(source, configDir) {
   const path = getKanbanNudgeStateFile(configDir);
   const agents = {};
-  for (const [codeName, state7] of source) agents[codeName] = state7;
+  for (const [codeName, state8] of source) agents[codeName] = state8;
   try {
-    writeFileSync8(path, JSON.stringify({ version: KANBAN_NUDGE_STATE_VERSION, agents }, null, 2));
+    writeFileSync9(path, JSON.stringify({ version: KANBAN_NUDGE_STATE_VERSION, agents }, null, 2));
   } catch {
   }
 }
 
 // src/lib/manager/kanban/notify.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 async function enqueueKanbanNotice(opts) {
   try {
     const res = await api.post(
@@ -4959,7 +5749,7 @@ async function enqueueKanbanNotice(opts) {
     return res.ok === true;
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash9("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[kanban] notice enqueue failed for agent_id=${opts.agentId} error_id=${errId}`);
     return false;
   }
@@ -4974,7 +5764,7 @@ async function cancelKanbanNotice(agentId) {
     return typeof res.cancelled === "number" ? res.cancelled : 0;
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash9("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[kanban] notice cancel failed for agent_id=${agentId} error_id=${errId}`);
     return null;
   }
@@ -5380,7 +6170,7 @@ function deriveScheduledTaskNotify(task) {
 }
 
 // src/lib/manager/scheduler/runs.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 async function startRun(opts) {
   try {
     const res = await api.post(
@@ -5395,7 +6185,7 @@ async function startRun(opts) {
     };
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash9("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash10("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] start failed for agent_id=${opts.agent_id} source_type=${opts.source_type} error_id=${errId}`);
     return { run_id: null, kanban_item_id: null };
   }
@@ -5434,7 +6224,7 @@ async function finishRun(runId, outcome, options = {}) {
       return;
     } catch (err) {
       const errText = err instanceof Error ? err.message : String(err);
-      const errId = createHash9("sha256").update(errText).digest("hex").slice(0, 12);
+      const errId = createHash10("sha256").update(errText).digest("hex").slice(0, 12);
       const status = err instanceof ApiError ? err.status : 0;
       if (isRetryableFinishError(err) && attempt < maxRetries) {
         log(
@@ -5463,7 +6253,7 @@ async function fetchPriorScheduledRuns(agentId, taskId) {
     return rows.filter((r) => typeof r.output_text === "string" && r.output_text.length > 0).map((r) => ({ startedAt: r.started_at, output: r.output_text }));
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash9("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash10("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] prior-runs lookup failed for task_id=${taskId} error_id=${errId}`);
     return [];
   }
@@ -5512,13 +6302,13 @@ function closeScheduledRunsForCode(codeName, outcome, reason) {
 }
 
 // src/lib/manager/scheduler/kanban-route.ts
-import { createHash as createHash11 } from "crypto";
-import { writeFileSync as writeFileSync9, renameSync as renameSync3, mkdirSync as mkdirSync6, readFileSync as readFileSync17, unlinkSync } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join22, dirname as dirname6 } from "path";
+import { createHash as createHash12 } from "crypto";
+import { writeFileSync as writeFileSync10, renameSync as renameSync4, mkdirSync as mkdirSync7, readFileSync as readFileSync21, unlinkSync as unlinkSync2 } from "fs";
+import { homedir as homedir12 } from "os";
+import { join as join26, dirname as dirname7 } from "path";
 
 // src/lib/manager/scheduler/notify.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 async function enqueueScheduledTaskNotice(opts) {
   try {
     const res = await api.post(
@@ -5535,7 +6325,7 @@ async function enqueueScheduledTaskNotice(opts) {
     return res.ok === true;
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash10("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash11("sha256").update(errText).digest("hex").slice(0, 12);
     log(
       `[scheduled-kanban] notice enqueue failed for agent_id=${opts.agentId} task_id=${opts.taskId} error_id=${errId}`
     );
@@ -5765,8 +6555,8 @@ async function runScheduledCardDelivery(codeName, agentId, cardId, completedBy,
     markScheduledCardDeliveryComplete(cardId);
     return "terminal";
   }
-  const state7 = claudeSchedulerStates.get(codeName) ?? loadSchedulerState(codeName);
-  const task = state7.tasks[card.source_ref];
+  const state8 = claudeSchedulerStates.get(codeName) ?? loadSchedulerState(codeName);
+  const task = state8.tasks[card.source_ref];
   if (!task) {
     log(`[scheduled-kanban] delivery: no scheduler task for source_ref=${card.source_ref} on '${codeName}' \u2014 skipping`);
     markScheduledCardDeliveryComplete(cardId);
@@ -5874,21 +6664,21 @@ function resolveScheduledSlackTarget(task) {
 }
 function stampScheduledTurnMarker(codeName, taskId, target) {
   try {
-    const file = join22(homedir9(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+    const file = join26(homedir12(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
     const marker = { ts: Date.now(), task_id: taskId, ...target ? { target } : {} };
     const tmp = `${file}.tmp`;
-    writeFileSync9(tmp, JSON.stringify(marker), "utf8");
-    renameSync3(tmp, file);
+    writeFileSync10(tmp, JSON.stringify(marker), "utf8");
+    renameSync4(tmp, file);
   } catch (err) {
     log(`[scheduled-kanban] scheduled-turn marker write failed for '${codeName}': ${err.message}`);
   }
 }
 function clearScheduledTurnMarkerForTask(codeName, taskId) {
-  const file = join22(homedir9(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+  const file = join26(homedir12(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
   try {
-    const raw = JSON.parse(readFileSync17(file, "utf8"));
+    const raw = JSON.parse(readFileSync21(file, "utf8"));
     if (typeof raw?.task_id !== "string" || raw.task_id !== taskId) return;
-    unlinkSync(file);
+    unlinkSync2(file);
     log(`[scheduled-kanban] scheduled-turn marker cleared for '${codeName}' (task ${taskId} complete)`);
   } catch {
   }
@@ -5946,9 +6736,9 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt, dura
       return false;
     }
     try {
-      const doorbell = directChatDoorbellPath(agentId, homedir9());
-      mkdirSync6(dirname6(doorbell), { recursive: true });
-      writeFileSync9(doorbell, String(Date.now()));
+      const doorbell = directChatDoorbellPath(agentId, homedir12());
+      mkdirSync7(dirname7(doorbell), { recursive: true });
+      writeFileSync10(doorbell, String(Date.now()));
     } catch (err) {
       log(`[scheduled-kanban] doorbell ring failed for '${codeName}': ${err.message} (notice still queued)`);
     }
@@ -6014,24 +6804,24 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
       const assertion = parseDeliverAssertion(rawOutput);
       if (!assertion.deliver) {
         const trimmed = (rawOutput ?? "").trim();
-        const outputHash = trimmed.length === 0 ? "empty" : createHash11("sha256").update(trimmed).digest("hex").slice(0, 12);
+        const outputHash = trimmed.length === 0 ? "empty" : createHash12("sha256").update(trimmed).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed by delivery_policy=conditional for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 ${assertion.vacuous ? "deliver marker had a vacuous reason" : "no deliver marker"}; output_len=${trimmed.length} output_hash=${outputHash}`);
         if (delivery?.mode === "announce" && delivery.to) {
           await reportDeliveryStatus(agentId, delivery.taskId, { status: "skipped", error_code: "SUPPRESSED_BY_POLICY" });
         }
         return { ok: true };
       }
-      const reasonHash = createHash11("sha256").update(assertion.reason ?? "").digest("hex").slice(0, 12);
+      const reasonHash = createHash12("sha256").update(assertion.reason ?? "").digest("hex").slice(0, 12);
       log(`[claude-scheduler] Delivering conditional run for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 agent asserted a concrete trigger (reason_len=${(assertion.reason ?? "").length} reason_hash=${reasonHash})`);
       rawOutput = assertion.deliverable;
     }
     const classification = classifyOutput(rawOutput);
     if (classification.action === "suppress") {
       const trimmed = (rawOutput ?? "").trim();
-      const outputHash = trimmed.length === 0 ? "empty" : createHash11("sha256").update(trimmed).digest("hex").slice(0, 12);
+      const outputHash = trimmed.length === 0 ? "empty" : createHash12("sha256").update(trimmed).digest("hex").slice(0, 12);
       log(`[claude-scheduler] Suppressing delivery for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 output_len=${trimmed.length} output_hash=${outputHash}`);
       if (classification.suppressedNotes) {
-        const notesHash = createHash11("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
+        const notesHash = createHash12("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed notes for '${codeName}' (task=${delivery?.taskId ?? "n/a"}) \u2014 notes_len=${classification.suppressedNotes.length} notes_hash=${notesHash}`);
       }
       if (delivery?.mode === "announce" && delivery.to) {
@@ -6097,13 +6887,13 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
 }
 
 // src/lib/manager/scheduler/execution.ts
-import { createHash as createHash12 } from "crypto";
-import { homedir as homedir10 } from "os";
-import { join as join24 } from "path";
+import { createHash as createHash13 } from "crypto";
+import { homedir as homedir13 } from "os";
+import { join as join28 } from "path";
 
 // src/lib/agent-serving-probe.ts
-import { readFileSync as readFileSync18, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync22, readdirSync as readdirSync5, statSync as statSync5 } from "fs";
+import { join as join27 } from "path";
 var RATE_LIMIT_WINDOW_MS = 6 * 60 * 60 * 1e3;
 function probeRateLimit(args) {
   const now = args.now ?? /* @__PURE__ */ new Date();
@@ -6112,23 +6902,23 @@ function probeRateLimit(args) {
   const dir = args.transcriptDir ?? sessionTranscriptDir(args.projectDir);
   let entries;
   try {
-    entries = readdirSync4(dir);
+    entries = readdirSync5(dir);
   } catch {
     return UNKNOWN_RATE_LIMIT;
   }
   let newest = UNKNOWN_RATE_LIMIT;
   for (const name of entries) {
     if (!name.endsWith(".jsonl")) continue;
-    const path = join23(dir, name);
+    const path = join27(dir, name);
     try {
-      const st = statSync4(path);
+      const st = statSync5(path);
       if (!st.isFile() || st.mtimeMs < startMs) continue;
     } catch {
       continue;
     }
     let content;
     try {
-      content = readFileSync18(path, "utf-8");
+      content = readFileSync22(path, "utf-8");
     } catch {
       continue;
     }
@@ -6190,7 +6980,7 @@ function shouldLogUsageCapDeferral(site, codeName, limitedUntil) {
 
 // src/lib/manager/scheduler/execution.ts
 function claudePidFilePath() {
-  return join24(homedir10(), ".augmented", "manager-claude-pids.json");
+  return join28(homedir13(), ".augmented", "manager-claude-pids.json");
 }
 var inFlightClaudePids = /* @__PURE__ */ new Map();
 function registerClaudeSpawn(record) {
@@ -6210,24 +7000,24 @@ function unregisterClaudeSpawn(pid) {
 }
 async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData, durableScheduledNudge = false) {
   const codeName = agent.code_name;
-  const stableTasksHash = createHash12("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-  const boardHash = boardItems.length > 0 ? createHash12("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+  const stableTasksHash = createHash13("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const boardHash = boardItems.length > 0 ? createHash13("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
   const resolvedModels = resolveModelChain(refreshData);
-  const modelsHash = createHash12("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+  const modelsHash = createHash13("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
   const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (combinedHash !== prevHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
-    const state8 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
-    claudeSchedulerStates.set(codeName, state8);
+    const state9 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
+    claudeSchedulerStates.set(codeName, state9);
     agentState.knownTasksHashes.set(agent.agent_id, combinedHash);
     log(`[claude-scheduler] Tasks synced for '${codeName}' (${taskInputs.length} task(s))`);
   }
   if (!claudeSchedulerStates.has(codeName)) {
     claudeSchedulerStates.set(codeName, loadSchedulerState(codeName));
   }
-  const state7 = claudeSchedulerStates.get(codeName);
-  const ready = getReadyTasks(state7, inFlightClaudeTasks);
+  const state8 = claudeSchedulerStates.get(codeName);
+  const ready = getReadyTasks(state8, inFlightClaudeTasks);
   if (ready.length === 0) return;
   const limitedUntil = readUsageCapUntil({ codeName, projectDir: getProjectDir(codeName) });
   if (limitedUntil) {
@@ -6260,19 +7050,19 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
 }
 
 // src/lib/occupancy-gate.ts
-import { closeSync, openSync, readdirSync as readdirSync5, readSync, statSync as statSync5 } from "fs";
-import { join as join25 } from "path";
+import { closeSync as closeSync2, openSync as openSync2, readdirSync as readdirSync6, readSync as readSync2, statSync as statSync6 } from "fs";
+import { join as join29 } from "path";
 var TAIL_BYTES = 256 * 1024;
 var MAX_RECORD_ALIGN_BYTES = 8 * 1024 * 1024;
 var GATE_MAX_BUCKET_AGE_MS = 30 * 6e4;
 var TRANSCRIPT_MTIME_WINDOW_MS4 = GATE_MAX_BUCKET_AGE_MS + DEFAULT_NEIGHBOURHOOD_MS + 6e4;
-var cache = /* @__PURE__ */ new Map();
+var cache2 = /* @__PURE__ */ new Map();
 function readAlignedTail(path, tailBytes, maxAlignBytes) {
   let fd = null;
   try {
-    const size = statSync5(path).size;
+    const size = statSync6(path).size;
     if (size <= 0) return { content: "", complete: true, truncated: false };
-    fd = openSync(path, "r");
+    fd = openSync2(path, "r");
     let readStart = Math.max(0, size - tailBytes);
     if (readStart > 0) {
       const scanFloor = Math.max(0, readStart - maxAlignBytes);
@@ -6283,7 +7073,7 @@ function readAlignedTail(path, tailBytes, maxAlignBytes) {
         const from = Math.max(scanFloor, pos - CHUNK);
         const len2 = pos - from;
         const b = Buffer.allocUnsafe(len2);
-        if (readSync(fd, b, 0, len2, from) !== len2) return null;
+        if (readSync2(fd, b, 0, len2, from) !== len2) return null;
         const idx = b.lastIndexOf(10);
         if (idx !== -1) {
           boundary = from + idx + 1;
@@ -6301,14 +7091,14 @@ function readAlignedTail(path, tailBytes, maxAlignBytes) {
     }
     const len = size - readStart;
     const buf = Buffer.allocUnsafe(len);
-    if (readSync(fd, buf, 0, len, readStart) !== len) return null;
+    if (readSync2(fd, buf, 0, len, readStart) !== len) return null;
     return { content: buf.toString("utf-8", 0, len), complete: true, truncated: readStart > 0 };
   } catch {
     return null;
   } finally {
     if (fd != null) {
       try {
-        closeSync(fd);
+        closeSync2(fd);
       } catch {
       }
     }
@@ -6340,26 +7130,26 @@ function candidateTranscriptPaths(dir) {
   const paths = [];
   let top;
   try {
-    top = readdirSync5(dir);
+    top = readdirSync6(dir);
   } catch {
     return { paths, complete: false };
   }
   let complete = true;
   for (const name of top) {
     if (name.endsWith(".jsonl")) {
-      paths.push(join25(dir, name));
+      paths.push(join29(dir, name));
       continue;
     }
-    const subDir = join25(dir, name, "subagents");
+    const subDir = join29(dir, name, "subagents");
     let subs;
     try {
-      subs = readdirSync5(subDir);
+      subs = readdirSync6(subDir);
     } catch (err) {
       if (!isAbsentDirError(err)) complete = false;
       continue;
     }
     for (const sub of subs) {
-      if (sub.endsWith(".jsonl")) paths.push(join25(subDir, sub));
+      if (sub.endsWith(".jsonl")) paths.push(join29(subDir, sub));
     }
   }
   return { paths, complete };
@@ -6369,7 +7159,7 @@ function collectQualifyingTurns(codeName, nowMs, opts = {}) {
   const tailBytes = opts.tailBytes ?? TAIL_BYTES;
   const maxAlignBytes = opts.maxAlignBytes ?? MAX_RECORD_ALIGN_BYTES;
   const sinceMs = nowMs - TRANSCRIPT_MTIME_WINDOW_MS4;
-  const agentCache = cache.get(codeName) ?? /* @__PURE__ */ new Map();
+  const agentCache = cache2.get(codeName) ?? /* @__PURE__ */ new Map();
   const nextCache = /* @__PURE__ */ new Map();
   const all = /* @__PURE__ */ new Set();
   let transcriptsRead = 0;
@@ -6382,7 +7172,7 @@ function collectQualifyingTurns(codeName, nowMs, opts = {}) {
   for (const path of paths) {
     let st;
     try {
-      st = statSync5(path);
+      st = statSync6(path);
     } catch (err) {
       if (!isAbsentDirError(err)) complete = false;
       continue;
@@ -6418,7 +7208,7 @@ function collectQualifyingTurns(codeName, nowMs, opts = {}) {
     }
     for (const t of turns) all.add(t);
   }
-  cache.set(codeName, nextCache);
+  cache2.set(codeName, nextCache);
   return { turns: [...all].sort((a, b) => a - b), transcriptsRead, complete, coveredFromMs };
 }
 function qualifyBuckets(buckets, qualifying, mode, nowMs, neighbourhoodMs = DEFAULT_NEIGHBOURHOOD_MS) {
@@ -6454,14 +7244,14 @@ function qualifyBuckets(buckets, qualifying, mode, nowMs, neighbourhoodMs = DEFA
 }
 
 // src/lib/pane-occupancy-sampler.ts
-import { statSync as statSync6 } from "fs";
+import { statSync as statSync7 } from "fs";
 var SAMPLE_INTERVAL_MS = 1e4;
 var IDLE_GAP_MS = 12e4;
 var POST_IDLE_CREDIT_MS = 6e4;
 var lastMtimeMs = /* @__PURE__ */ new Map();
 function paneMtimeMs(codeName) {
   try {
-    return statSync6(paneLogPath(codeName)).mtimeMs;
+    return statSync7(paneLogPath(codeName)).mtimeMs;
   } catch {
     return null;
   }
@@ -6507,7 +7297,7 @@ function stopPaneOccupancySampler() {
 }
 
 // src/lib/opencode-slack-ingest.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 
 // ../../packages/core/dist/channels/slack-rich-text.js
 var MAX_DEPTH = 12;
@@ -7458,7 +8248,7 @@ function startSlackIngest(config2) {
 // src/lib/opencode-slack-ingest.ts
 var ingests = /* @__PURE__ */ new Map();
 function fingerprint(params) {
-  return createHash13("sha256").update(
+  return createHash14("sha256").update(
     JSON.stringify({
       appToken: params.appToken,
       botToken: params.botToken,
@@ -7539,7 +8329,7 @@ function stopAllOpencodeSlackIngests(log2) {
 }
 
 // src/lib/manager/opencode-scheduler.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 var MAX_OPENCODE_SCHED_CONCURRENCY = 2;
 var opencodeSchedulerStates = /* @__PURE__ */ new Map();
 var inFlightOpencodeTasks = /* @__PURE__ */ new Set();
@@ -7553,19 +8343,19 @@ function shouldDeliver(task, reply) {
 }
 async function syncAndCheckOpencodeScheduler(agent, tasks, refreshData) {
   const codeName = agent.code_name;
-  const tasksHash = createHash14("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const tasksHash = createHash15("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   if (knownOpencodeTaskHashes.get(agent.agent_id) !== tasksHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
-    const state8 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
-    opencodeSchedulerStates.set(codeName, state8);
+    const state9 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
+    opencodeSchedulerStates.set(codeName, state9);
     knownOpencodeTaskHashes.set(agent.agent_id, tasksHash);
     log(`[opencode-scheduler] tasks synced for '${codeName}' (${taskInputs.length} task(s))`);
   }
   if (!opencodeSchedulerStates.has(codeName)) {
     opencodeSchedulerStates.set(codeName, loadSchedulerState(codeName));
   }
-  const state7 = opencodeSchedulerStates.get(codeName);
-  const ready = getReadyTasks(state7, inFlightOpencodeTasks);
+  const state8 = opencodeSchedulerStates.get(codeName);
+  const ready = getReadyTasks(state8, inFlightOpencodeTasks);
   if (ready.length === 0) return;
   if (!isOpencodeSessionHealthy(codeName)) {
     log(`[opencode-scheduler] '${codeName}' has ${ready.length} due task(s) but no healthy serve yet - deferring`);
@@ -7631,10 +8421,10 @@ async function fireOpencodeScheduledTask(agent, task) {
 }
 
 // src/lib/opencode-telegram-ingest.ts
-import { createHash as createHash15 } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync19, renameSync as renameSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync10 } from "fs";
+import { createHash as createHash16 } from "crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync23, renameSync as renameSync5, unlinkSync as unlinkSync3, writeFileSync as writeFileSync11 } from "fs";
 import { randomUUID } from "crypto";
-import { join as join26 } from "path";
+import { join as join30 } from "path";
 
 // src/lib/telegram-ingest.ts
 import https2 from "https";
@@ -8167,7 +8957,7 @@ function anySignal(signals) {
 // src/lib/opencode-telegram-ingest.ts
 var ingests2 = /* @__PURE__ */ new Map();
 function fingerprint2(params) {
-  return createHash15("sha256").update(
+  return createHash16("sha256").update(
     JSON.stringify({
       botToken: params.botToken,
       allowedChats: [...params.allowedChats].sort(),
@@ -8182,7 +8972,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
   let filePath;
   try {
     dir = getFramework("opencode").getAgentDir(codeName);
-    filePath = join26(dir, "telegram-getupdates-offset-opencode.json");
+    filePath = join30(dir, "telegram-getupdates-offset-opencode.json");
   } catch {
     dir = null;
     filePath = null;
@@ -8191,7 +8981,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
     load() {
       if (!filePath) return 0;
       try {
-        const parsed = JSON.parse(readFileSync19(filePath, "utf-8"));
+        const parsed = JSON.parse(readFileSync23(filePath, "utf-8"));
         if (currentBotId != null && typeof parsed?.bot_id === "number" && parsed.bot_id !== currentBotId) {
           log2(`[telegram-ingest:${codeName}] offset cursor belongs to a different bot; ignoring (bot swap)`);
           return 0;
@@ -8209,8 +8999,8 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
       if (!filePath || !dir) return;
       const tmpPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
       try {
-        mkdirSync7(dir, { recursive: true, mode: 448 });
-        writeFileSync10(
+        mkdirSync8(dir, { recursive: true, mode: 448 });
+        writeFileSync11(
           tmpPath,
           JSON.stringify({
             offset,
@@ -8220,11 +9010,11 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
           }),
           { mode: 384 }
         );
-        renameSync4(tmpPath, filePath);
+        renameSync5(tmpPath, filePath);
       } catch (err) {
         log2(`[telegram-ingest:${codeName}] offset persist failed: ${err instanceof Error ? err.message : String(err)}`);
         try {
-          if (existsSync10(tmpPath)) unlinkSync2(tmpPath);
+          if (existsSync12(tmpPath)) unlinkSync3(tmpPath);
         } catch {
         }
       }
@@ -8440,10 +9230,10 @@ function recordWedgeForCards(states, inProgressCardIds, nowMs, config2) {
 function pruneCardStates(states, liveInProgressCardIds, nowMs, config2) {
   const live = liveInProgressCardIds instanceof Set ? liveInProgressCardIds : new Set(liveInProgressCardIds);
   const next = /* @__PURE__ */ new Map();
-  for (const [id, state7] of states) {
+  for (const [id, state8] of states) {
     if (!live.has(id)) continue;
-    if (nowMs - state7.lastWedgeAtMs > config2.cooldownMs) continue;
-    next.set(id, state7);
+    if (nowMs - state8.lastWedgeAtMs > config2.cooldownMs) continue;
+    next.set(id, state8);
   }
   return next;
 }
@@ -8461,24 +9251,24 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, readdirSync as readdirSync6, readFileSync as readFileSync20, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync11 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join27 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync24, renameSync as renameSync6, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "fs";
+import { homedir as homedir14 } from "os";
+import { join as join31 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 function restartFlagsDir() {
-  return join27(homedir11(), ".augmented", "restart-flags");
+  return join31(homedir14(), ".augmented", "restart-flags");
 }
 function flagPath(codeName) {
-  return join27(restartFlagsDir(), `${codeName}.flag`);
+  return join31(restartFlagsDir(), `${codeName}.flag`);
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
-  if (!existsSync11(dir)) return [];
+  if (!existsSync13(dir)) return [];
   const out = [];
-  for (const entry of readdirSync6(dir)) {
+  for (const entry of readdirSync7(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync20(join27(dir, entry), "utf8");
+      const raw = readFileSync24(join31(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -8496,7 +9286,7 @@ function readRestartFlags() {
 }
 function deleteRestartFlag(codeName) {
   const path = flagPath(codeName);
-  if (existsSync11(path)) {
+  if (existsSync13(path)) {
     rmSync4(path, { force: true });
   }
 }
@@ -8596,8 +9386,8 @@ async function sendError(flag, opts, text) {
 }
 
 // src/lib/restart-context.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync21, writeFileSync as writeFileSync12, mkdirSync as mkdirSync9, unlinkSync as unlinkSync3 } from "fs";
-import { dirname as dirname7, join as join28 } from "path";
+import { readdirSync as readdirSync8, readFileSync as readFileSync25, writeFileSync as writeFileSync13, mkdirSync as mkdirSync10, unlinkSync as unlinkSync4 } from "fs";
+import { dirname as dirname8, join as join32 } from "path";
 var SLACK_PENDING_INBOUND_DIRNAME = "slack-pending-inbound";
 var SLACK_RESTART_CONTEXT_DIRNAME = "slack-restart-context";
 var MAX_TOPIC_CHARS = 140;
@@ -8606,13 +9396,13 @@ var RECONSTRUCT_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
 var WINDOW_PAD_MS3 = 5 * 6e4;
 var DEFAULT_MAX_MARKERS_PER_AGENT = 25;
 function augmentedAgentDir(codeName) {
-  return dirname7(getProjectDir(codeName));
+  return dirname8(getProjectDir(codeName));
 }
 function slackPendingInboundDir(codeName) {
-  return join28(augmentedAgentDir(codeName), SLACK_PENDING_INBOUND_DIRNAME);
+  return join32(augmentedAgentDir(codeName), SLACK_PENDING_INBOUND_DIRNAME);
 }
 function slackRestartContextDir(codeName) {
-  return join28(augmentedAgentDir(codeName), SLACK_RESTART_CONTEXT_DIRNAME);
+  return join32(augmentedAgentDir(codeName), SLACK_RESTART_CONTEXT_DIRNAME);
 }
 function sanitizeTopic(raw) {
   const cleaned = raw.replace(/\s+/g, " ").trim().replace(/[<>]/g, " ").replace(/\s+/g, " ").trim();
@@ -8647,14 +9437,14 @@ function computeRestartContextHints(markers, allTurns, nowMs, reconstruct = reco
 }
 function safeReaddir(dir) {
   try {
-    return readdirSync7(dir);
+    return readdirSync8(dir);
   } catch {
     return [];
   }
 }
 function readStrandedMarker(path) {
   try {
-    const parsed = JSON.parse(readFileSync21(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync25(path, "utf-8"));
     if (typeof parsed.channel === "string" && typeof parsed.thread_ts === "string") {
       return { channel: parsed.channel, thread_ts: parsed.thread_ts };
     }
@@ -8663,8 +9453,8 @@ function readStrandedMarker(path) {
   return null;
 }
 function writeHintFile(path, dir, hint) {
-  mkdirSync9(dir, { recursive: true, mode: 448 });
-  writeFileSync12(path, JSON.stringify(hint), { mode: 384 });
+  mkdirSync10(dir, { recursive: true, mode: 448 });
+  writeFileSync13(path, JSON.stringify(hint), { mode: 384 });
 }
 function pruneHintsExcept(codeName, freshFilenames) {
   const ctxDir = slackRestartContextDir(codeName);
@@ -8672,7 +9462,7 @@ function pruneHintsExcept(codeName, freshFilenames) {
     if (!filename.endsWith(".json")) continue;
     if (freshFilenames.has(filename)) continue;
     try {
-      unlinkSync3(join28(ctxDir, filename));
+      unlinkSync4(join32(ctxDir, filename));
     } catch {
     }
   }
@@ -8693,7 +9483,7 @@ function refreshSlackRestartContextHints(codeNames, opts = {}) {
       }
       const markers = [];
       for (const filename of markerFilenames.slice(0, cap)) {
-        const parsed = readStrandedMarker(join28(markerDir, filename));
+        const parsed = readStrandedMarker(join32(markerDir, filename));
         if (parsed) markers.push({ filename, channel: parsed.channel, thread_ts: parsed.thread_ts });
       }
       if (markers.length === 0) {
@@ -8707,7 +9497,7 @@ function refreshSlackRestartContextHints(codeNames, opts = {}) {
       const freshFilenames = /* @__PURE__ */ new Set();
       for (const { filename, hint } of hints) {
         try {
-          writeHintFile(join28(ctxDir, filename), ctxDir, hint);
+          writeHintFile(join32(ctxDir, filename), ctxDir, hint);
           freshFilenames.add(filename);
         } catch (err) {
           log2(`[restart-context] ${codeName}: hint write failed for ${filename}: ${err.message}`);
@@ -9329,8 +10119,8 @@ var KNOWN_SAFE_TAIL_SIGNATURES = /* @__PURE__ */ new Set(["session_id_in_use"]);
 function shouldSkipRevokedCleanup(previousKnownStatus) {
   return previousKnownStatus === "revoked";
 }
-function hasRevokedResiduals(state7) {
-  return state7.gatewayRunning || state7.portAllocated || state7.provisionDirExists;
+function hasRevokedResiduals(state8) {
+  return state8.gatewayRunning || state8.portAllocated || state8.provisionDirExists;
 }
 var pendingSessionRestarts = /* @__PURE__ */ new Map();
 var lastRestartWasExternal = /* @__PURE__ */ new Map();
@@ -9508,12 +10298,12 @@ function maybeClearStaleTrip(agent) {
   const marker = getAutoResumeMarker(codeName);
   const isSelfResume = marker !== void 0 && Date.now() - marker.autoResumedAt < AUTO_RESUME_SELF_WINDOW_MS;
   if (!isSelfResume) deleteAutoResumeMarker(codeName);
-  state6 = {
-    ...state6,
+  state7 = {
+    ...state7,
     circuitBreakerTrips: restartBreaker.serialize(),
     circuitBreakerAutoResumes: Object.fromEntries(autoResumeMarkers.entries())
   };
-  send({ type: "state-update", state: state6 });
+  send({ type: "state-update", state: state7 });
 }
 var autoResumeMarkers = /* @__PURE__ */ new Map();
 function autoResumeMarkerKey(codeName) {
@@ -9605,12 +10395,12 @@ function maybeAutoResume(agent) {
       restartBreaker.clear(codeName);
       reportedTrips.delete(codeName);
       dependencyRecoveryLedger.clear(codeName);
-      state6 = {
-        ...state6,
+      state7 = {
+        ...state7,
         circuitBreakerTrips: restartBreaker.serialize(),
         circuitBreakerAutoResumes: Object.fromEntries(autoResumeMarkers.entries())
       };
-      send({ type: "state-update", state: state6 });
+      send({ type: "state-update", state: state7 });
       log(`[auto-resume] agent=${codeName} resumed \u2014 re-trip within backoff window will stay paused (ENG-6088)`);
     } else {
       autoResumeStandDowns.add(`${codeName}:${trippedAt}`);
@@ -9719,12 +10509,12 @@ async function maybeResumeReconcile(agent) {
       restartBreaker.clear(codeName);
       reportedTrips.delete(codeName);
       dependencyRecoveryLedger.clear(codeName);
-      state6 = {
-        ...state6,
+      state7 = {
+        ...state7,
         circuitBreakerTrips: restartBreaker.serialize(),
         circuitBreakerAutoResumes: Object.fromEntries(autoResumeMarkers.entries())
       };
-      send({ type: "state-update", state: state6 });
+      send({ type: "state-update", state: state7 });
       log(`[resume-reconciler] agent=${codeName} resumed \u2014 a re-trip within the backoff window will latch unstable (ENG-6383)`);
     } else {
       autoResumeStandDowns.add(standDownKey);
@@ -9888,6 +10678,23 @@ function cancelPendingSessionRestart(codeName) {
   log(`[hot-reload] Cancelled pending restart timer for '${codeName}' (another teardown path is handling it)`);
 }
 var lastSpawnOutcomeByAgent = /* @__PURE__ */ new Map();
+var lastSpawnDecisionByAgent = /* @__PURE__ */ new Map();
+function recordSpawnOutcome(codeName, result) {
+  lastSpawnOutcomeByAgent.set(codeName, {
+    spawnAttempted: result.spawnAttempted,
+    sessionHealthyAfter: result.sessionHealthyAfter
+  });
+  if (result.decision) lastSpawnDecisionByAgent.set(codeName, result.decision);
+}
+function spawnOutcomeForDiagnostics(codeName) {
+  const last = lastSpawnOutcomeByAgent.get(codeName);
+  if (!last) return void 0;
+  return {
+    spawnAttempted: last.spawnAttempted,
+    sessionHealthyAfter: last.sessionHealthyAfter,
+    lastDecision: lastSpawnDecisionByAgent.get(codeName) ?? null
+  };
+}
 function spawnWasRefusedWithNoSession(codeName) {
   const last = lastSpawnOutcomeByAgent.get(codeName);
   if (!last) return false;
@@ -10057,7 +10864,7 @@ function performLazyDayRolloverReset(codeName, agentTimezone) {
 }
 function paneLogAgeSecondsFor(codeName) {
   try {
-    const mtimeMs = statSync7(paneLogPath(codeName)).mtimeMs;
+    const mtimeMs = statSync8(paneLogPath(codeName)).mtimeMs;
     return Math.max(0, Math.floor((Date.now() - mtimeMs) / 1e3));
   } catch (err) {
     if (err?.code === "ENOENT") return null;
@@ -10106,7 +10913,7 @@ function restartGateFor(codeName, reason) {
 }
 function isHostBusyForForcedUpdate(opts) {
   const now = /* @__PURE__ */ new Date();
-  for (const agent of state6.agents) {
+  for (const agent of state7.agents) {
     const decision = decideRestartGate({
       window: null,
       paneLogAgeSeconds: paneLogAgeSecondsFor(agent.codeName),
@@ -10139,7 +10946,7 @@ function runPendingForcedUpdate() {
     relaxed
   } = decidePendingForcedUpdate({
     requestedAt: requestedUpdateAt,
-    lastProcessedAt: state6.lastUpdateRequestProcessedAt ?? null,
+    lastProcessedAt: state7.lastUpdateRequestProcessedAt ?? null,
     deferStreak: forcedUpdateDeferStreak,
     nowMs: Date.now(),
     isHostBusy: (isRelaxed) => isHostBusyForForcedUpdate({ relaxed: isRelaxed })
@@ -10173,7 +10980,7 @@ function runPendingForcedUpdate() {
   log(
     forcedUpdate === "consume-deadline" ? `[self-update] WARN "Update CLI now" requested at ${requestedUpdateAt} has been pending ${describePendingFor(pendingForMs)} and the host still reads busy \u2014 running the window-bypassing self-update anyway (ENG-8449 hard deadline). A live turn may be interrupted; the operator asked for this update explicitly.` : `[self-update] "Update CLI now" requested at ${requestedUpdateAt} \u2014 running window-bypassing self-update now (host idle${relaxed ? ", relaxed gate" : ""}).`
   );
-  const prevProcessedAt = state6.lastUpdateRequestProcessedAt ?? null;
+  const prevProcessedAt = state7.lastUpdateRequestProcessedAt ?? null;
   void checkAndUpdateCli({ force: true }).then((outcome) => {
     if (!shouldConsumeForcedUpdate(outcome)) {
       log(
@@ -10184,11 +10991,11 @@ function runPendingForcedUpdate() {
     log(
       outcome === "updated" ? `[self-update] "Update CLI now" completed \u2014 upgrade installed; manager restart scheduled.` : `[self-update] "Update CLI now" completed \u2014 host was already on the latest in-channel build; nothing to install.`
     );
-    state6.lastUpdateRequestProcessedAt = requestedUpdateAt;
+    state7.lastUpdateRequestProcessedAt = requestedUpdateAt;
     try {
-      atomicWriteFileSync(getStateFile(), JSON.stringify(state6, null, 2));
+      atomicWriteFileSync(getStateFile(), JSON.stringify(state7, null, 2));
     } catch (err) {
-      state6.lastUpdateRequestProcessedAt = prevProcessedAt;
+      state7.lastUpdateRequestProcessedAt = prevProcessedAt;
       log(
         `[self-update] failed to persist update-request ack; retrying next poll: ${err.message}`
       );
@@ -10207,15 +11014,15 @@ var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync22(join29(projectDir, ".mcp.json"), "utf-8");
-    return createHash16("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
+    const raw = readFileSync26(join33(projectDir, ".mcp.json"), "utf-8");
+    return createHash17("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
   }
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync22(join29(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync26(join33(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -10233,7 +11040,7 @@ function seedSessionLaunchBaselines(codeName, projectDir) {
   else runningMcpServerKeys.delete(codeName);
   let launchStructure = null;
   try {
-    const raw = readFileSync22(join29(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync26(join33(projectDir, ".mcp.json"), "utf-8");
     launchStructure = managedMcpStructureHashFromFile(
       JSON.parse(raw),
       isManagedMcpServerKey
@@ -10343,7 +11150,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   if (result && result.rebindCandidates.length > 0 && hostFlagStore().getBoolean("session-tool-rebind")) {
     let mcpJsonForRebind = null;
     try {
-      mcpJsonForRebind = JSON.parse(readFileSync22(join29(projectDir, ".mcp.json"), "utf-8"));
+      mcpJsonForRebind = JSON.parse(readFileSync26(join33(projectDir, ".mcp.json"), "utf-8"));
     } catch {
       mcpJsonForRebind = null;
     }
@@ -10487,7 +11294,7 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
 function projectChannelSecretHash(projectDir) {
   try {
     const entries = parseEnvIntegrations(
-      readFileSync22(join29(projectDir, ".env.integrations"), "utf-8")
+      readFileSync26(join33(projectDir, ".env.integrations"), "utf-8")
     );
     return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
   } catch {
@@ -10528,7 +11335,7 @@ var STALE_TASK_THRESHOLD_MS = (() => {
 })();
 var taskDisplayInfo = /* @__PURE__ */ new Map();
 var activeChannels = /* @__PURE__ */ new Map();
-var state6 = {
+var state7 = {
   pid: process.pid,
   startedAt: (/* @__PURE__ */ new Date()).toISOString(),
   lastPollAt: null,
@@ -10583,7 +11390,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.565" : "dev";
+var agtCliVersion = true ? "0.28.567" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -10596,7 +11403,7 @@ function resolveBrewPath(execFileSync2) {
     "/usr/local/bin/brew"
   ];
   for (const path of fallbacks) {
-    if (existsSync12(path)) return path;
+    if (existsSync14(path)) return path;
   }
   return null;
 }
@@ -10606,7 +11413,7 @@ function claudeBinaryInstalled(execFileSync2) {
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude"
   ];
-  if (canonical.some((path) => existsSync12(path))) return true;
+  if (canonical.some((path) => existsSync14(path))) return true;
   try {
     execFileSync2("which", ["claude"], { timeout: 5e3 });
     return true;
@@ -10678,7 +11485,7 @@ async function ensureToolkitCli(toolkitSlug) {
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      brewBinDir = dirname8(brewPath);
+      brewBinDir = dirname9(brewPath);
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
@@ -10915,8 +11722,8 @@ function claudeManagedSettingsPath() {
 function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
   try {
     let settings = {};
-    if (existsSync12(path)) {
-      const raw = readFileSync22(path, "utf-8").trim();
+    if (existsSync14(path)) {
+      const raw = readFileSync26(path, "utf-8").trim();
       if (raw) {
         let parsed;
         try {
@@ -10932,8 +11739,8 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
     }
     if (settings.channelsEnabled === true) return "ok";
     settings.channelsEnabled = true;
-    mkdirSync10(dirname8(path), { recursive: true });
-    writeFileSync13(path, `${JSON.stringify(settings, null, 2)}
+    mkdirSync11(dirname9(path), { recursive: true });
+    writeFileSync14(path, `${JSON.stringify(settings, null, 2)}
 `);
     log(`[managed-settings] set channelsEnabled:true in ${path} (ENG-5786 \u2014 unblocks Claude Code channels)`);
     return "ok";
@@ -10971,7 +11778,7 @@ async function ensureOpencodeBinary() {
   try {
     const prefix = execFileSync2("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 1e4 }).trim();
     if (prefix) {
-      const npmBin = join29(prefix, "bin");
+      const npmBin = join33(prefix, "bin");
       const current = (process.env.PATH ?? "").split(pathDelimiter);
       if (!current.includes(npmBin)) {
         process.env.PATH = [npmBin, ...current.filter(Boolean)].join(pathDelimiter);
@@ -11028,11 +11835,11 @@ async function ensureFrameworkBinary(frameworkId) {
       log(`Claude Code install failed: ${err.message}`);
       return;
     }
-    const brewBinDir = dirname8(brewPath);
+    const brewBinDir = dirname9(brewPath);
     if (!process.env.PATH?.split(":").includes(brewBinDir)) {
       process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
     }
-    if (existsSync12("/home/linuxbrew/.linuxbrew/bin/claude")) {
+    if (existsSync14("/home/linuxbrew/.linuxbrew/bin/claude")) {
       log("Claude Code installed successfully");
     } else {
       log("Claude Code install completed but binary not found at expected path \u2014 check brew logs");
@@ -11088,7 +11895,7 @@ ${r.stderr}`;
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function selfUpdateAppliedMarkerPath() {
-  return join29(homedir12(), ".augmented", ".last-self-update-applied");
+  return join33(homedir15(), ".augmented", ".last-self-update-applied");
 }
 var selfUpdateUpToDateLogged = false;
 var selfUpdatePinnedLogged = false;
@@ -11117,7 +11924,7 @@ async function checkAndUpdateCli(opts) {
     const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
     if (!isBrewFormula && !isNpmGlobal) return "noop";
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-    const markerPath = join29(homedir12(), ".augmented", ".last-update-check");
+    const markerPath = join33(homedir15(), ".augmented", ".last-update-check");
     if (!force) {
       try {
         const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
@@ -11523,7 +12330,7 @@ async function runClaudeRuntimeAuthProbe() {
   ];
   try {
     const { stdout, stderr } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-      cwd: homedir12(),
+      cwd: homedir15(),
       timeout: RUNTIME_AUTH_PROBE_TIMEOUT_MS,
       stdin: "ignore",
       env: childEnv,
@@ -11569,14 +12376,14 @@ async function checkClaudeAuth() {
 }
 var evalEmptyMcpConfigPath = null;
 function ensureEvalEmptyMcpConfig() {
-  if (evalEmptyMcpConfigPath && existsSync12(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
-  const dir = join29(homedir12(), ".augmented");
+  if (evalEmptyMcpConfigPath && existsSync14(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
+  const dir = join33(homedir15(), ".augmented");
   try {
-    mkdirSync10(dir, { recursive: true });
+    mkdirSync11(dir, { recursive: true });
   } catch {
   }
-  const p = join29(dir, ".eval-empty-mcp.json");
-  writeFileSync13(p, JSON.stringify({ mcpServers: {} }));
+  const p = join33(dir, ".eval-empty-mcp.json");
+  writeFileSync14(p, JSON.stringify({ mcpServers: {} }));
   evalEmptyMcpConfigPath = p;
   return p;
 }
@@ -11601,7 +12408,7 @@ async function runEvalClaude(prompt, model) {
     ""
   ];
   const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-    cwd: homedir12(),
+    cwd: homedir15(),
     timeout: 12e4,
     stdin: "ignore",
     env: childEnv,
@@ -11613,6 +12420,9 @@ async function runEvalClaude(prompt, model) {
 function memoryExtractionEnabled() {
   return hostFlagStore().getBoolean("memory-extraction");
 }
+function toolCallAuditEnabled() {
+  return hostFlagStore().getBoolean("tool-call-audit");
+}
 function conversationScorerSuppressed() {
   return meteredScorerSuppressed(
     getCachedClaudeAuthMode(),
@@ -11667,10 +12477,10 @@ function resolveConversationEvalBackend() {
   return conversationEvalBackend;
 }
 function getStateFile() {
-  return join29(config?.configDir ?? join29(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
+  return join33(config?.configDir ?? join33(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
 }
 function channelHashCacheDir() {
-  return config?.configDir ?? join29(process.env["HOME"] ?? "/tmp", ".augmented");
+  return config?.configDir ?? join33(process.env["HOME"] ?? "/tmp", ".augmented");
 }
 function loadChannelHashCache2() {
   loadChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
@@ -11724,7 +12534,7 @@ function removeDeliveryBaselineEntries(agentId) {
 var _channelQuarantineStore = null;
 function channelQuarantineStore() {
   if (!_channelQuarantineStore) {
-    const dir = config?.configDir ?? join29(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join33(process.env["HOME"] ?? "/tmp", ".augmented");
     _channelQuarantineStore = new ChannelQuarantineStore(defaultQuarantinePath(dir));
   }
   return _channelQuarantineStore;
@@ -11741,7 +12551,7 @@ function claudeMdSizeFor(codeName) {
 var _hostFlagStore = null;
 function hostFlagStore() {
   if (!_hostFlagStore) {
-    const dir = config?.configDir ?? join29(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join33(process.env["HOME"] ?? "/tmp", ".augmented");
     _hostFlagStore = new HostFlagStore({ cachePath: defaultFlagsCachePath(dir), log });
   }
   return _hostFlagStore;
@@ -11814,13 +12624,13 @@ function parseSkillFrontmatter(content) {
   return out;
 }
 async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
-  const { readdirSync: readdirSync9, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync14 } = await import("fs");
-  const skillsDir = join29(configDir, codeName, "project", ".claude", "skills");
-  const claudeMdPath = join29(configDir, codeName, "project", "CLAUDE.md");
+  const { readdirSync: readdirSync10, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync15 } = await import("fs");
+  const skillsDir = join33(configDir, codeName, "project", ".claude", "skills");
+  const claudeMdPath = join33(configDir, codeName, "project", "CLAUDE.md");
   if (!ex(skillsDir) || !ex(claudeMdPath)) return;
   const entries = [];
-  for (const dir of readdirSync9(skillsDir).sort()) {
-    const skillFile = join29(skillsDir, dir, "SKILL.md");
+  for (const dir of readdirSync10(skillsDir).sort()) {
+    const skillFile = join33(skillsDir, dir, "SKILL.md");
     if (!ex(skillFile)) continue;
     try {
       const { name, description } = parseSkillFrontmatter(rfs(skillFile, "utf-8"));
@@ -11864,7 +12674,7 @@ ${SKILLS_INDEX_END}`;
     next = current.trimEnd() + "\n\n" + section + "\n";
   }
   if (next !== current) {
-    writeFileSync14(claudeMdPath, next, "utf-8");
+    writeFileSync15(claudeMdPath, next, "utf-8");
     log2(
       injectSkillList ? `Refreshed skills index in CLAUDE.md for '${codeName}' (${entries.length} skills)` : `Refreshed CLAUDE.md managed block for '${codeName}' (skill list suppressed by claude-md-skills-index=false; ${entries.length} skills on disk)`
     );
@@ -11887,10 +12697,10 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-MLLLDI5U.js");
+      const { collectDiagnostics } = await import("../persistent-session-DVTSZAPE.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
-        agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
+        agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics)
       });
     } catch (err) {
       log(`[restart] post-respawn diagnostics flush failed: ${err.message}`);
@@ -11984,7 +12794,7 @@ async function pollCycle() {
     const now = Date.now();
     if (now - lastVersionCheckAt > VERSION_CHECK_INTERVAL_MS) {
       try {
-        const firstAgent = state6.agents[0];
+        const firstAgent = state7.agents[0];
         const versionAdapter = firstAgent ? resolveAgentFramework(firstAgent.codeName) : getFramework(DEFAULT_FRAMEWORK);
         if (versionAdapter.getVersion) {
           cachedFrameworkVersion = await versionAdapter.getVersion();
@@ -11995,9 +12805,9 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-MLLLDI5U.js");
+      const { collectDiagnostics } = await import("../persistent-session-DVTSZAPE.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
-      const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
+      const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics) : void 0;
       let tailscaleHostname;
       try {
         const { execSync: es } = await import("child_process");
@@ -12025,10 +12835,10 @@ async function pollCycle() {
         claudeAuth = await detectClaudeAuth();
       } catch (err) {
         const errText = err instanceof Error ? err.message : String(err);
-        const errId = createHash16("sha256").update(errText).digest("hex").slice(0, 12);
+        const errId = createHash17("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
-      const hostHasClaudeCode = state6.agents.some(
+      const hostHasClaudeCode = state7.agents.some(
         (a) => agentFrameworkCache.get(a.codeName) === "claude-code"
       );
       if (hostHasClaudeCode) {
@@ -12078,7 +12888,7 @@ async function pollCycle() {
         // ENG-6692: ack the last consumed "Update CLI now" timestamp so the API
         // clears hosts.update_requested_at. Echoes our persisted dedup marker;
         // null until we've ever consumed one.
-        update_request_processed_at: state6.lastUpdateRequestProcessedAt ?? null
+        update_request_processed_at: state7.lastUpdateRequestProcessedAt ?? null
       });
       if (hbResp?.maintenance_window) {
         cachedMaintenanceWindow = hbResp.maintenance_window;
@@ -12118,7 +12928,7 @@ async function pollCycle() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-QMAIFW4P.js");
+      } = await import("../responsiveness-probe-KEFPJXQ6.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -12209,7 +13019,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-QMAIFW4P.js");
+        } = await import("../responsiveness-probe-KEFPJXQ6.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -12298,13 +13108,13 @@ async function pollCycle() {
             );
             if (hostFlagStore().getBoolean("wedge-transient-notice")) {
               try {
-                const paneTail = readFileSync22(paneLogPath(codeName), "utf8").slice(-65536);
+                const paneTail = readFileSync26(paneLogPath(codeName), "utf8").slice(-65536);
                 const transient = detectTransientApiErrorInLog(paneTail);
                 if (transient) {
-                  const wedgeHome = join29(homedir12(), ".augmented", codeName);
-                  if (existsSync12(wedgeHome)) {
+                  const wedgeHome = join33(homedir15(), ".augmented", codeName);
+                  if (existsSync14(wedgeHome)) {
                     atomicWriteFileSync(
-                      join29(wedgeHome, "watchdog-give-up.json"),
+                      join33(wedgeHome, "watchdog-give-up.json"),
                       JSON.stringify({
                         gave_up_at: wedgeNow.toISOString(),
                         reason: "transient_overload"
@@ -12434,7 +13244,7 @@ async function pollCycle() {
       const requested = agent.restart_requested_at ?? null;
       if (!requested) continue;
       if (restartInFlight.has(agent.agent_id)) continue;
-      const prev = state6.agents.find((a) => a.agentId === agent.agent_id);
+      const prev = state7.agents.find((a) => a.agentId === agent.agent_id);
       const lastProcessed = prev?.lastRestartProcessedAt ?? null;
       const alreadyServiced = lastProcessed != null && Date.parse(lastProcessed) >= Date.parse(requested);
       if (!alreadyServiced) {
@@ -12513,7 +13323,7 @@ async function pollCycle() {
     const processOrder = fastRespawn ? reorderRestartedFirst(agents, new Set(restartAcks.keys())) : agents;
     for (const agent of processOrder) {
       if (restartInFlight.has(agent.agent_id)) {
-        const existing = state6.agents.find((a) => a.agentId === agent.agent_id);
+        const existing = state7.agents.find((a) => a.agentId === agent.agent_id);
         if (existing) {
           agentStates.push(existing);
           continue;
@@ -12523,7 +13333,7 @@ async function pollCycle() {
         await processAgent(agent, agentStates);
       } catch (err) {
         log(`Error processing agent '${agent.code_name}': ${err.message}`);
-        const existing = state6.agents.find((a) => a.agentId === agent.agent_id);
+        const existing = state7.agents.find((a) => a.agentId === agent.agent_id);
         if (existing) {
           agentStates.push(existing);
         } else {
@@ -12552,12 +13362,12 @@ async function pollCycle() {
     void maybeReportActivityCache({ api, log });
     const restartAckStateChanged = applyRestartAcks({
       agentStates,
-      priorAgents: state6.agents,
+      priorAgents: state7.agents,
       restartAcks
     });
     if (restartAckStateChanged) {
       try {
-        const ackedState = { ...state6, agents: agentStates };
+        const ackedState = { ...state7, agents: agentStates };
         atomicWriteFileSync(getStateFile(), JSON.stringify(ackedState, null, 2));
       } catch (err) {
         log(`[restart] failed to persist ack immediately: ${err.message}`);
@@ -12579,13 +13389,13 @@ async function pollCycle() {
     } catch {
     }
     const currentIds = new Set(agents.map((a) => a.agent_id));
-    for (const prev of state6.agents) {
+    for (const prev of state7.agents) {
       if (!currentIds.has(prev.agentId)) {
         log(`Agent '${prev.codeName}' removed from host (deleted or unassigned)`);
         const adapter = resolveAgentFramework(prev.codeName);
         stopAgentRuntime2(prev.codeName, "removed-from-host");
         killAgentChannelProcesses(prev.codeName, { log });
-        const agentDir = join29(adapter.getAgentDir(prev.codeName), "provision");
+        const agentDir = join33(adapter.getAgentDir(prev.codeName), "provision");
         await cleanupAgentFiles(prev.codeName, agentDir);
         clearAgentCaches(prev.agentId, prev.codeName);
       }
@@ -12672,10 +13482,10 @@ async function pollCycle() {
         // pending-inbound marker. Best-effort: a write failure is logged by
         // the watchdog, never fails the poll cycle.
         signalGiveUp: (codeName) => {
-          const dir = join29(homedir12(), ".augmented", codeName);
-          if (!existsSync12(dir)) return;
+          const dir = join33(homedir15(), ".augmented", codeName);
+          if (!existsSync14(dir)) return;
           atomicWriteFileSync(
-            join29(dir, "watchdog-give-up.json"),
+            join33(dir, "watchdog-give-up.json"),
             JSON.stringify({ gave_up_at: (/* @__PURE__ */ new Date()).toISOString() })
           );
         }
@@ -12716,10 +13526,10 @@ async function pollCycle() {
       }
     } catch {
     }
-    state6 = {
-      ...state6,
+    state7 = {
+      ...state7,
       lastPollAt: (/* @__PURE__ */ new Date()).toISOString(),
-      pollCount: state6.pollCount + 1,
+      pollCount: state7.pollCount + 1,
       agents: agentStates,
       // ENG-5441: serialise trip state on every poll so manager restarts
       // never silently clear a tripped breaker. Cheap — only tripped
@@ -12733,9 +13543,9 @@ async function pollCycle() {
       consecutivePollFailures = 0;
     }
     verifyPendingRestarts(Date.now());
-    send({ type: "state-update", state: state6 });
+    send({ type: "state-update", state: state7 });
   } catch (err) {
-    state6.errorCount++;
+    state7.errorCount++;
     const message = err.message;
     log(`Poll error: ${message}`);
     send({ type: "error", message });
@@ -12820,10 +13630,18 @@ async function processAgent(agent, agentStates) {
         onModelCallError: (err) => reportManagerModelCallError("memory_extraction", err, memBackend.model ?? null)
       });
     }
+    if (toolCallAuditEnabled()) {
+      void maybeScanToolCalls({
+        api,
+        codeName: agent.code_name,
+        agentId: agent.agent_id,
+        log
+      });
+    }
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const adapter = resolveAgentFramework(agent.code_name);
-  let agentDir = join29(adapter.getAgentDir(agent.code_name), "provision");
+  let agentDir = join33(adapter.getAgentDir(agent.code_name), "provision");
   if (agent.status === "draft" || agent.status === "paused") {
     if (previousKnownStatus !== agent.status) {
       log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
@@ -12863,7 +13681,7 @@ async function processAgent(agent, agentStates) {
       const residuals = {
         gatewayRunning: false,
         portAllocated: false,
-        provisionDirExists: existsSync12(agentDir)
+        provisionDirExists: existsSync14(agentDir)
       };
       if (!hasRevokedResiduals(residuals)) {
         agentStates.push({
@@ -12920,11 +13738,11 @@ async function processAgent(agent, agentStates) {
       const marker = getAutoResumeMarker(agent.code_name);
       const isSelfResume = marker !== void 0 && Date.now() - marker.autoResumedAt < AUTO_RESUME_SELF_WINDOW_MS;
       if (!isSelfResume && deleteAutoResumeMarker(agent.code_name)) {
-        state6 = {
-          ...state6,
+        state7 = {
+          ...state7,
           circuitBreakerAutoResumes: Object.fromEntries(autoResumeMarkers.entries())
         };
-        send({ type: "state-update", state: state6 });
+        send({ type: "state-update", state: state7 });
         log(`[auto-resume] Cleared auto-resume marker for '${agent.code_name}' on operator resume \u2014 credit re-armed (ENG-6088)`);
       }
     }
@@ -12955,7 +13773,7 @@ async function processAgent(agent, agentStates) {
     });
   } catch (err) {
     log(`Refresh failed for '${agent.code_name}': ${err.message}`);
-    const existing = state6.agents.find((a) => a.agentId === agent.agent_id);
+    const existing = state7.agents.find((a) => a.agentId === agent.agent_id);
     agentStates.push(existing ?? {
       agentId: agent.agent_id,
       codeName: agent.code_name,
@@ -12997,7 +13815,7 @@ async function processAgent(agent, agentStates) {
   const frameworkId = refreshData.agent.framework ?? DEFAULT_FRAMEWORK;
   agentFrameworkCache.set(agent.code_name, frameworkId);
   const frameworkAdapter = getFramework(frameworkId);
-  agentDir = join29(frameworkAdapter.getAgentDir(agent.code_name), "provision");
+  agentDir = join33(frameworkAdapter.getAgentDir(agent.code_name), "provision");
   cacheAgentDeliveryMetadata(agent.code_name, refreshData);
   agentRestartTimezoneInputs.set(agent.code_name, {
     agentTimezone: typeof refreshData.agent.timezone === "string" ? refreshData.agent.timezone : null,
@@ -13019,7 +13837,7 @@ async function processAgent(agent, agentStates) {
   const charterVersion = refreshData.charter.version;
   const toolsVersion = refreshData.tools.version;
   const known = agentState.knownVersions.get(agent.agent_id);
-  let lastProvisionAt = state6.agents.find((a) => a.agentId === agent.agent_id)?.lastProvisionAt ?? null;
+  let lastProvisionAt = state7.agents.find((a) => a.agentId === agent.agent_id)?.lastProvisionAt ?? null;
   const quarantinedChannels = channelQuarantineStore().getQuarantinedKeys(agent.code_name);
   const currentChannelIds = setWithout(
     launchableChannelIds(refreshData.channel_configs),
@@ -13044,9 +13862,9 @@ async function processAgent(agent, agentStates) {
   try {
     const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter, renderIntegrationsSection);
     const changedFiles = [];
-    mkdirSync10(agentDir, { recursive: true });
+    mkdirSync11(agentDir, { recursive: true });
     for (const artifact of artifacts) {
-      const filePath = join29(agentDir, artifact.relativePath);
+      const filePath = join33(agentDir, artifact.relativePath);
       let existingHash;
       let newHash;
       let writeContent = artifact.content;
@@ -13065,8 +13883,8 @@ async function processAgent(agent, agentStates) {
         };
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
-          const projectClaudeMd = join29(config.configDir, agent.code_name, "project", "CLAUDE.md");
-          const existing = readFileSync22(projectClaudeMd, "utf-8");
+          const projectClaudeMd = join33(config.configDir, agent.code_name, "project", "CLAUDE.md");
+          const existing = readFileSync26(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
           existingHash = null;
@@ -13084,7 +13902,7 @@ async function processAgent(agent, agentStates) {
         const generatorKeys = Object.keys(generatorServers);
         let existingRaw = "";
         try {
-          existingRaw = readFileSync22(filePath, "utf-8");
+          existingRaw = readFileSync26(filePath, "utf-8");
         } catch {
         }
         const existingServers = parseMcp(existingRaw);
@@ -13100,7 +13918,7 @@ async function processAgent(agent, agentStates) {
       } else if (artifact.relativePath === "opencode.json") {
         let existingRaw = null;
         try {
-          existingRaw = readFileSync22(filePath, "utf-8");
+          existingRaw = readFileSync26(filePath, "utf-8");
         } catch {
         }
         const mergeResult = mergeOpencodeConfigArtifact(artifact.content, existingRaw);
@@ -13116,26 +13934,26 @@ async function processAgent(agent, agentStates) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync12(join29(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync14(join33(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
-        const filePath = join29(agentDir, file.relativePath);
-        mkdirSync10(dirname8(filePath), { recursive: true });
+        const filePath = join33(agentDir, file.relativePath);
+        mkdirSync11(dirname9(filePath), { recursive: true });
         if (file.relativePath === ".mcp.json") {
           safeWriteJsonAtomic(filePath, file.content, { mode: 384 });
         } else {
-          writeFileSync13(filePath, file.content);
+          writeFileSync14(filePath, file.content);
         }
       }
       try {
-        const provSkillsDir = join29(agentDir, ".claude", "skills");
-        if (existsSync12(provSkillsDir)) {
-          for (const folder of readdirSync8(provSkillsDir)) {
+        const provSkillsDir = join33(agentDir, ".claude", "skills");
+        if (existsSync14(provSkillsDir)) {
+          for (const folder of readdirSync9(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
-                rmSync5(join29(provSkillsDir, folder), { recursive: true });
+                rmSync5(join33(provSkillsDir, folder), { recursive: true });
               } catch {
               }
             }
@@ -13148,7 +13966,7 @@ async function processAgent(agent, agentStates) {
       const trackedFiles2 = frameworkAdapter.driftTrackedFiles();
       const hashes = /* @__PURE__ */ new Map();
       for (const file of trackedFiles2) {
-        const h = hashFile(join29(agentDir, file));
+        const h = hashFile(join33(agentDir, file));
         if (h) hashes.set(file, h);
       }
       agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -13166,14 +13984,14 @@ async function processAgent(agent, agentStates) {
     }
     if (Array.isArray(refreshData.workflows)) {
       try {
-        const provWorkflowsDir = join29(agentDir, ".claude", "workflows");
-        if (existsSync12(provWorkflowsDir)) {
+        const provWorkflowsDir = join33(agentDir, ".claude", "workflows");
+        if (existsSync14(provWorkflowsDir)) {
           const expected = new Set(refreshData.workflows.map((w) => `${w.name}.js`));
-          for (const file of readdirSync8(provWorkflowsDir)) {
+          for (const file of readdirSync9(provWorkflowsDir)) {
             if (!file.endsWith(".js")) continue;
             if (expected.has(file)) continue;
             try {
-              rmSync5(join29(provWorkflowsDir, file));
+              rmSync5(join33(provWorkflowsDir, file));
             } catch {
             }
           }
@@ -13252,10 +14070,10 @@ async function processAgent(agent, agentStates) {
   }
   let lastDriftCheckAt = now;
   const written = agentState.writtenHashes.get(agent.agent_id);
-  if (written && existsSync12(agentDir)) {
+  if (written && existsSync14(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
-      const localHash = hashFile(join29(agentDir, file));
+      const localHash = hashFile(join33(agentDir, file));
       if (localHash && localHash !== expectedHash) {
         driftedFiles.push(file);
       }
@@ -13266,7 +14084,7 @@ async function processAgent(agent, agentStates) {
       try {
         const localHashes = {};
         for (const file of driftedFiles) {
-          localHashes[file] = hashFile(join29(agentDir, file));
+          localHashes[file] = hashFile(join33(agentDir, file));
         }
         await api.post("/host/drift", {
           agent_id: agent.agent_id,
@@ -13468,15 +14286,15 @@ async function processAgent(agent, agentStates) {
     const addedChannels = [...restartDecision.added];
     const writeDmNoticeMarkers = isChannelAddRestart ? () => {
       try {
-        const agentAugmentedDir = join29(homedir12(), ".augmented", agent.code_name);
-        mkdirSync10(agentAugmentedDir, { recursive: true });
+        const agentAugmentedDir = join33(homedir15(), ".augmented", agent.code_name);
+        mkdirSync11(agentAugmentedDir, { recursive: true });
         const markerJson = JSON.stringify({
           version: 1,
           at: (/* @__PURE__ */ new Date()).toISOString(),
           added: addedChannels
         });
         for (const file of ["slack-channel-add-restart.json", "telegram-channel-add-restart.json"]) {
-          atomicWriteFileSync(join29(agentAugmentedDir, file), markerJson);
+          atomicWriteFileSync(join33(agentAugmentedDir, file), markerJson);
         }
       } catch (err) {
         log(`[hot-reload] channel-add DM-notice marker write failed for '${agent.code_name}' (non-fatal): ${err.message}`);
@@ -13552,7 +14370,7 @@ async function processAgent(agent, agentStates) {
       const behaviourSubset = extractMsTeamsBehaviourSubset(
         msteamsEntry?.config
       );
-      const behaviourHash = createHash16("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
+      const behaviourHash = createHash17("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
       const prevBehaviourHash = agentState.knownMsTeamsBehaviourHashes.get(agent.agent_id);
       const msteamsBehaviourRestrictive = isMsTeamsBehaviourRestrictive(behaviourSubset);
       const behaviourDecision = decideSenderPolicyRestart({
@@ -13608,7 +14426,7 @@ async function processAgent(agent, agentStates) {
       const slackBehaviourSubset = extractSlackBehaviourSubset(
         slackEntry?.config
       );
-      const slackBehaviourHash = createHash16("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
+      const slackBehaviourHash = createHash17("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
       const prevSlackBehaviourHash = agentState.knownSlackBehaviourHashes.get(agent.agent_id);
       const slackBehaviourRestrictive = isSlackBehaviourRestrictive(slackBehaviourSubset);
       const slackBehaviourDecision = decideSenderPolicyRestart({
@@ -13665,24 +14483,24 @@ async function processAgent(agent, agentStates) {
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK) === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
-      const projectDir = join29(homedir12(), ".augmented", agent.code_name, "project");
-      mkdirSync10(agentProvisionDir, { recursive: true });
-      mkdirSync10(projectDir, { recursive: true });
-      const provisionMcpPath = join29(agentProvisionDir, ".mcp.json");
-      const projectMcpPath = join29(projectDir, ".mcp.json");
+      const projectDir = join33(homedir15(), ".augmented", agent.code_name, "project");
+      mkdirSync11(agentProvisionDir, { recursive: true });
+      mkdirSync11(projectDir, { recursive: true });
+      const provisionMcpPath = join33(agentProvisionDir, ".mcp.json");
+      const projectMcpPath = join33(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
-        mcpConfig = JSON.parse(readFileSync22(provisionMcpPath, "utf-8"));
+        mcpConfig = JSON.parse(readFileSync26(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
-      const localDirectChatChannel = join29(homedir12(), ".augmented", "_mcp", "direct-chat-channel.js");
+      const localDirectChatChannel = join33(homedir15(), ".augmented", "_mcp", "direct-chat-channel.js");
       const directChatTeamSettings = refreshData.team?.settings;
       const directChatTz = (() => {
         const tz = directChatTeamSettings?.["timezone"];
         return typeof tz === "string" && tz.trim() !== "" ? tz.trim() : void 0;
       })();
-      if (existsSync12(localDirectChatChannel)) {
+      if (existsSync14(localDirectChatChannel)) {
         const directChatEnv = {
           AGT_HOST: requireHost(),
           // ENG-5901 Track D: templated — the manager exports the real
@@ -13702,7 +14520,7 @@ async function processAgent(agent, agentStates) {
           // ~/.augmented/<codeName>/.current-turn-initiator.json. Note getAgentDir
           // returns the agent root (NOT the /provision subdir `agentDir` points at),
           // so it byte-matches the broker readers' path.
-          AGT_TURN_INITIATOR_FILE: join29(
+          AGT_TURN_INITIATOR_FILE: join33(
             frameworkAdapter.getAgentDir(agent.code_name),
             ".current-turn-initiator.json"
           )
@@ -13722,8 +14540,8 @@ async function processAgent(agent, agentStates) {
           log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
         }
       }
-      const staleChannelsPath = join29(projectDir, ".mcp-channels.json");
-      if (existsSync12(staleChannelsPath)) {
+      const staleChannelsPath = join33(projectDir, ".mcp-channels.json");
+      if (existsSync14(staleChannelsPath)) {
         try {
           rmSync5(staleChannelsPath, { force: true });
         } catch {
@@ -13733,7 +14551,7 @@ async function processAgent(agent, agentStates) {
       log(`Failed to provision direct-chat channel for '${agent.code_name}': ${err.message}`);
     }
   }
-  let lastSecretsProvisionAt = state6.agents.find((a) => a.agentId === agent.agent_id)?.lastSecretsProvisionAt ?? null;
+  let lastSecretsProvisionAt = state7.agents.find((a) => a.agentId === agent.agent_id)?.lastSecretsProvisionAt ?? null;
   let secretsHash = agentState.knownSecretsHashes.get(agent.agent_id) ?? null;
   try {
     const secretsData = await api.post("/host/secrets", { agent_id: agent.agent_id });
@@ -13812,7 +14630,7 @@ async function processAgent(agent, agentStates) {
     }
     if (hostFlagStore().getBoolean("connectivity-probe")) {
       try {
-        const probeProjectDir = join29(homedir12(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join33(homedir15(), ".augmented", agent.code_name, "project");
         let probeSet = integrations;
         try {
           const quarantined = await api.post("/host/agent-integrations/quarantined", { agent_id: agent.agent_id });
@@ -13858,7 +14676,7 @@ async function processAgent(agent, agentStates) {
       const forceDue = attemptsLeft > 0;
       let probeRan = false;
       try {
-        const probeProjectDir = join29(homedir12(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join33(homedir15(), ".augmented", agent.code_name, "project");
         probeRan = await runAgentSessionToolBindProbes(agent, integrations, probeProjectDir, { forceDue });
       } catch (err) {
         log(`Session-tool-bind probe failed for '${agent.code_name}': ${err.message}`);
@@ -13935,11 +14753,11 @@ async function processAgent(agent, agentStates) {
       const intHash = computeIntegrationsHash(integrations);
       const prevIntHash = agentState.knownIntegrationHashes.get(agent.agent_id);
       if (intHash !== prevIntHash) {
-        const projectDir = join29(homedir12(), ".augmented", agent.code_name, "project");
-        const envIntPath = join29(projectDir, ".env.integrations");
+        const projectDir = join33(homedir15(), ".augmented", agent.code_name, "project");
+        const envIntPath = join33(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
-          preWriteEnv = readFileSync22(envIntPath, "utf-8");
+          preWriteEnv = readFileSync26(envIntPath, "utf-8");
         } catch {
           preWriteEnv = void 0;
         }
@@ -13958,9 +14776,9 @@ async function processAgent(agent, agentStates) {
         }
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
-            const projectMcpPath = join29(projectDir, ".mcp.json");
-            const postWriteEnv = readFileSync22(envIntPath, "utf-8");
-            const mcpContent = readFileSync22(projectMcpPath, "utf-8");
+            const projectMcpPath = join33(projectDir, ".mcp.json");
+            const postWriteEnv = readFileSync26(envIntPath, "utf-8");
+            const mcpContent = readFileSync26(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
             const mcpJsonForReap = JSON.parse(mcpContent);
             const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
@@ -14051,10 +14869,10 @@ async function processAgent(agent, agentStates) {
           desiredEntries.push({ serverId, url, headers: mcpHeaders, name: tk.toolkit_name });
         }
         const hashBasis = desiredEntries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => {
-          const headersHash = createHash16("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
+          const headersHash = createHash17("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
           return `${e.serverId}|${e.url}|${headersHash}`;
         }).join("\n");
-        const mcpHash = createHash16("sha256").update(hashBasis).digest("hex").slice(0, 16);
+        const mcpHash = createHash17("sha256").update(hashBasis).digest("hex").slice(0, 16);
         const prevMcpHash = agentState.knownManagedMcpHashes.get(agent.agent_id);
         const structureHash = managedMcpStructureHash(desiredEntries);
         const prevStructureHash = agentState.knownManagedMcpStructure.get(agent.agent_id);
@@ -14069,7 +14887,7 @@ async function processAgent(agent, agentStates) {
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
-            const urlHash = createHash16("sha256").update(e.url).digest("hex").slice(0, 12);
+            const urlHash = createHash17("sha256").update(e.url).digest("hex").slice(0, 12);
             log(`[managed-toolkit] ${agent.code_name}: wrote '${e.name}' (serverId=${e.serverId}, url_hash=${urlHash})`);
           }
           if (frameworkAdapter.removeMcpServer && frameworkAdapter.readMcpServers) {
@@ -14171,7 +14989,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installSkillFiles) {
       const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
       const installedIntegrationSkills = [];
-      const { createHash: createHash17 } = await import("crypto");
+      const { createHash: createHash18 } = await import("crypto");
       const refreshAny = refreshData;
       const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
@@ -14200,7 +15018,7 @@ async function processAgent(agent, agentStates) {
             )
           }));
           const bundle = buildIntegrationBundle(renderedScopes);
-          const contentHash = createHash17("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
+          const contentHash = createHash18("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
           if (!shouldWriteIntegrationSkill(
             agentState.knownSkillHashes,
             agent.agent_id,
@@ -14223,23 +15041,23 @@ async function processAgent(agent, agentStates) {
         }
       }
       try {
-        const { readdirSync: readdirSync9, rmSync: rmSync6 } = await import("fs");
-        const { homedir: homedir13 } = await import("os");
+        const { readdirSync: readdirSync10, rmSync: rmSync6 } = await import("fs");
+        const { homedir: homedir16 } = await import("os");
         const frameworkId2 = frameworkAdapter.id;
         const candidateSkillDirs = [
           // Claude Code — framework runtime tree
-          join29(homedir13(), ".augmented", agent.code_name, "skills"),
+          join33(homedir16(), ".augmented", agent.code_name, "skills"),
           // Claude Code — project tree
-          join29(homedir13(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+          join33(homedir16(), ".augmented", agent.code_name, "project", ".claude", "skills"),
           // Defensive: legacy provision-side path, not currently an
           // install target but cheap to sweep.
-          join29(agentDir, ".claude", "skills")
+          join33(agentDir, ".claude", "skills")
         ];
-        const existingDirs = candidateSkillDirs.filter((d) => existsSync12(d));
+        const existingDirs = candidateSkillDirs.filter((d) => existsSync14(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
         for (const dir of existingDirs) {
           try {
-            for (const entry of readdirSync9(dir)) {
+            for (const entry of readdirSync10(dir)) {
               if (entry.startsWith("plugin-") || entry.startsWith("integration-")) {
                 discoveredEntries.add(entry);
               }
@@ -14254,7 +15072,7 @@ async function processAgent(agent, agentStates) {
             entry,
             dirs: existingDirs,
             removeDir: (p) => {
-              if (existsSync12(p)) {
+              if (existsSync14(p)) {
                 rmSync6(p, { recursive: true, force: true });
               }
             }
@@ -14274,7 +15092,7 @@ async function processAgent(agent, agentStates) {
         const sharedSkillsPayload = refreshAny.shared_skills;
         const desiredResolved = globalSkillsPayload !== void 0 || sharedSkillsPayload !== void 0;
         const manifestPath = managedSkillManifestPath(
-          join29(homedir12(), ".augmented", agent.code_name)
+          join33(homedir15(), ".augmented", agent.code_name)
         );
         const prevIds = /* @__PURE__ */ new Set([
           ...agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
@@ -14283,7 +15101,7 @@ async function processAgent(agent, agentStates) {
         const plan = planGlobalSkillSync(
           [...globalSkillsPayload ?? [], ...sharedSkillsPayload ?? []],
           prevIds,
-          (content) => createHash17("sha256").update(content).digest("hex").slice(0, 12),
+          (content) => createHash18("sha256").update(content).digest("hex").slice(0, 12),
           (skillId) => agentState.knownSkillHashes.get(`global-skill:${agent.agent_id}:${skillId}`),
           { desiredResolved }
         );
@@ -14294,15 +15112,15 @@ async function processAgent(agent, agentStates) {
         }
         if (plan.removes.length) {
           const globalSkillDirs = [
-            join29(homedir12(), ".augmented", agent.code_name, "skills"),
-            join29(homedir12(), ".augmented", agent.code_name, "project", ".claude", "skills"),
-            join29(agentDir, ".claude", "skills")
+            join33(homedir15(), ".augmented", agent.code_name, "skills"),
+            join33(homedir15(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+            join33(agentDir, ".claude", "skills")
           ];
           for (const id of plan.removes) {
             let prunedAny = false;
             for (const dir of globalSkillDirs) {
-              const p = join29(dir, id);
-              if (existsSync12(p) && existsSync12(join29(p, "SKILL.md"))) {
+              const p = join33(dir, id);
+              if (existsSync14(p) && existsSync14(join33(p, "SKILL.md"))) {
                 rmSync5(p, { recursive: true, force: true });
                 prunedAny = true;
               }
@@ -14334,7 +15152,7 @@ async function processAgent(agent, agentStates) {
           const slug = hook.integration_slug ?? hook.plugin_slug;
           if (!slug) continue;
           try {
-            const scriptHash = createHash17("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const scriptHash = createHash18("sha256").update(hook.script).digest("hex").slice(0, 12);
             const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (agentState.knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
@@ -14349,9 +15167,9 @@ async function processAgent(agent, agentStates) {
             } else if (result.timedOut) {
               log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
-              const stderrHash = createHash17("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              const stderrHash = createHash18("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
-              const missingCmdHash = missingCmd ? createHash17("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
+              const missingCmdHash = missingCmd ? createHash18("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
                 `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
@@ -14504,10 +15322,7 @@ async function processAgent(agent, agentStates) {
     log(
       `[persistent-session-decision] agent=${agent.code_name} decision=${psResult.decision} spawn_attempted=${psResult.spawnAttempted} session_healthy_after=${psResult.sessionHealthyAfter}${detailSuffix}`
     );
-    lastSpawnOutcomeByAgent.set(agent.code_name, {
-      spawnAttempted: psResult.spawnAttempted,
-      sessionHealthyAfter: psResult.sessionHealthyAfter
-    });
+    recordSpawnOutcome(agent.code_name, psResult);
     const stuck = persistentSessionStuckTracker.record({
       codeName: agent.code_name,
       sessionHealthy: psResult.sessionHealthyAfter,
@@ -14537,8 +15352,8 @@ async function processAgent(agent, agentStates) {
         const sess = getSessionState(agent.code_name);
         let mcpJsonParsed = null;
         try {
-          const mcpPath = join29(getProjectDir(agent.code_name), ".mcp.json");
-          mcpJsonParsed = JSON.parse(readFileSync22(mcpPath, "utf-8"));
+          const mcpPath = join33(getProjectDir(agent.code_name), ".mcp.json");
+          mcpJsonParsed = JSON.parse(readFileSync26(mcpPath, "utf-8"));
         } catch {
         }
         reapMissingMcpSessions({
@@ -14968,10 +15783,10 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
     }
   }
   const trackedFiles = frameworkAdapter.driftTrackedFiles();
-  if (trackedFiles.length > 0 && existsSync12(agentDir)) {
+  if (trackedFiles.length > 0 && existsSync14(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
-      const h = hashFile(join29(agentDir, file));
+      const h = hashFile(join33(agentDir, file));
       if (h) hashes.set(file, h);
     }
     agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -14986,7 +15801,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
         refreshData.agent.onboarding_state
       );
       const obStep = obState.step;
-      const markerPath = join29(homedir12(), ".augmented", agent.code_name, "onboarding-drive.json");
+      const markerPath = join33(homedir15(), ".augmented", agent.code_name, "onboarding-drive.json");
       const marker = readOnboardingDriveMarker(markerPath);
       const decision = decideOnboardingDrive(obStep, marker, Date.now(), obState.generation ?? 0);
       if (decision.clearMarker) {
@@ -15074,7 +15889,7 @@ async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
   }
   stopOpencodeSlackIngest(codeName, log);
   stopOpencodeTelegramIngest(codeName, log);
-  const opencodeProjectDir = join29(getFramework("opencode").getAgentDir(codeName), "provision");
+  const opencodeProjectDir = join33(getFramework("opencode").getAgentDir(codeName), "provision");
   const serveEnv = {
     AGT_HOST: requireHost(),
     AGT_API_KEY: getApiKey() ?? void 0,
@@ -15129,8 +15944,8 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     });
   }
   const projectDir = getProjectDir(codeName);
-  const mcpConfigPath = join29(projectDir, ".mcp.json");
-  const claudeMdPath = join29(projectDir, "CLAUDE.md");
+  const mcpConfigPath = join33(projectDir, ".mcp.json");
+  const claudeMdPath = join33(projectDir, "CLAUDE.md");
   if (restartBreaker.isTripped(codeName)) {
     const trip = restartBreaker.getTrip(codeName);
     return {
@@ -15341,7 +16156,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       const ctx = getLastFailureContext(codeName);
       const recovery = prepareForRespawn(codeName);
       const tailSummary = !ctx.tail ? "" : KNOWN_SAFE_TAIL_SIGNATURES.has(ctx.signature) ? `; last pane output (${PANE_TAIL_PREVIEW_LINES} of ~20 lines):
-${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash16("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
+${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash17("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
       const sigSummary = ctx.signature !== "unknown" ? `; signature=${ctx.signature}` : "";
       const recoverySummary = recovery ? `; recovery=${recovery}` : "";
       log(
@@ -15355,7 +16170,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash16("sha256")
       );
       getHostId().then((hostId) => {
         if (!hostId) return;
-        const paneTailHash = zombie.paneTail ? `sha256:${createHash16("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
+        const paneTailHash = zombie.paneTail ? `sha256:${createHash17("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
         return api.post("/host/events", {
           host_id: hostId,
           agent_code_name: codeName,
@@ -15510,7 +16325,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash16("sha256")
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
-  const stableTasksHash = createHash16("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const stableTasksHash = createHash17("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
@@ -15521,9 +16336,9 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash16("sha256")
   } else if (!claudeSchedulerStates.has(codeName)) {
     claudeSchedulerStates.set(codeName, loadSchedulerState(codeName));
   }
-  const state7 = claudeSchedulerStates.get(codeName);
-  if (state7) {
-    const ready = getReadyTasks(state7, inFlightClaudeTasks);
+  const state8 = claudeSchedulerStates.get(codeName);
+  if (state8) {
+    const ready = getReadyTasks(state8, inFlightClaudeTasks);
     if (ready.length > 0) {
       log(`[persistent-session] ${ready.length} ready task(s) for '${codeName}': ${ready.map((t) => `${t.name}(next=${t.nextFireAt ? new Date(t.nextFireAt).toISOString() : "null"})`).join(", ")}`);
     }
@@ -15711,7 +16526,7 @@ function restartReasonStampsTiming(reason) {
   return reason === "integration-change";
 }
 async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
-  const prev = state6.agents.find((a) => a.agentId === agentId);
+  const prev = state7.agents.find((a) => a.agentId === agentId);
   const codeName = prev?.codeName;
   if (!codeName) return;
   const lastProcessed = prev?.lastRestartProcessedAt ?? null;
@@ -15754,6 +16569,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       [],
       refreshData
     );
+    recordSpawnOutcome(codeName, result);
     if (result.decision !== "spawn" || !result.sessionHealthyAfter) {
       log(`[restart-lane] respawn not confirmed for '${codeName}' (decision=${result.decision}) - leaving for slow poll`);
       return;
@@ -15761,10 +16577,10 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-MLLLDI5U.js");
+        const { collectDiagnostics } = await import("../persistent-session-DVTSZAPE.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
-          agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
+          agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics)
         });
       } catch (err) {
         log(`[restart-lane] post-respawn diagnostics flush failed for '${codeName}': ${err.message}`);
@@ -15772,7 +16588,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     })();
     prev.lastRestartProcessedAt = requestedAt;
     try {
-      atomicWriteFileSync(getStateFile(), JSON.stringify(state6, null, 2));
+      atomicWriteFileSync(getStateFile(), JSON.stringify(state7, null, 2));
     } catch (err) {
       log(`[restart-lane] failed to persist ack for '${codeName}': ${err.message}`);
     }
@@ -15782,7 +16598,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
   }
 }
 async function respawnAgentAfterMcpStop(codeName, reason) {
-  const prev = state6.agents.find((a) => a.codeName === codeName);
+  const prev = state7.agents.find((a) => a.codeName === codeName);
   if (!prev) return;
   const agentId = prev.agentId;
   if (restartInFlight.has(agentId)) return;
@@ -15803,6 +16619,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
       [],
       refreshData
     );
+    recordSpawnOutcome(codeName, result);
     if (result.decision !== "spawn" || !result.sessionHealthyAfter) {
       log(
         `[fast-mcp-respawn] respawn not confirmed for '${codeName}' (decision=${result.decision}) - leaving for slow poll`
@@ -15811,10 +16628,10 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-MLLLDI5U.js");
+      const { collectDiagnostics } = await import("../persistent-session-DVTSZAPE.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
-        agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
+        agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics)
       });
     } catch (err) {
       log(`[fast-mcp-respawn] post-respawn diagnostics flush failed for '${codeName}': ${err.message}`);
@@ -15919,7 +16736,7 @@ function ensureRealtimeKanbanStarted(agentStates) {
               );
             }
           }).catch((err) => {
-            const errId = createHash16("sha256").update(err instanceof Error ? err.message : String(err)).digest("hex").slice(0, 12);
+            const errId = createHash17("sha256").update(err instanceof Error ? err.message : String(err)).digest("hex").slice(0, 12);
             log(
               `[realtime] Work trigger enqueue threw for '${agent.codeName}' item_id=${item.id} error_id=${errId} \u2014 hybrid nudge will retry`
             );
@@ -16073,7 +16890,7 @@ async function processDirectChatMessageOpencode(agent, msg) {
         body
       });
       recordCursorAdvanceOutcome(
-        dirname8(paneLogPath(agent.codeName)),
+        dirname9(paneLogPath(agent.codeName)),
         "direct-chat-manager",
         "reply",
         verdict
@@ -16103,7 +16920,7 @@ async function processDirectChatMessageOpencode(agent, msg) {
     } catch (err) {
       if (!recorded) {
         recordCursorAdvanceOutcome(
-          dirname8(paneLogPath(agent.codeName)),
+          dirname9(paneLogPath(agent.codeName)),
           "direct-chat-manager",
           "reply",
           { outcome: "failed", error: err.message, expected: 1 }
@@ -16154,9 +16971,9 @@ async function processDirectChatMessage(agent, msg) {
     const useDoorbell = hostFlagStore().getBoolean("direct-chat-doorbell") || isolationMode(agent.codeName) === "docker";
     if (useDoorbell) {
       try {
-        const doorbell = directChatDoorbellPath(agent.agentId, homedir12());
-        mkdirSync10(dirname8(doorbell), { recursive: true });
-        writeFileSync13(doorbell, String(Date.now()));
+        const doorbell = directChatDoorbellPath(agent.agentId, homedir15());
+        mkdirSync11(dirname9(doorbell), { recursive: true });
+        writeFileSync14(doorbell, String(Date.now()));
         log(`[direct-chat] Doorbell rung for '${agent.codeName}' (msg=${msg.id}) \u2014 in-session MCP will pull via the cursor`);
         return;
       } catch (err) {
@@ -16205,10 +17022,10 @@ function getKanbanNudgeState(codeName) {
 function loadKanbanNudgeStateFromDisk() {
   loadKanbanNudgeState(kanbanNudgeStateByCode, channelHashCacheDir());
 }
-function setKanbanNudgeState(codeName, state7) {
+function setKanbanNudgeState(codeName, state8) {
   const key = kanbanNudgeStateKey(codeName);
   if (key !== codeName) kanbanNudgeStateByCode.delete(codeName);
-  kanbanNudgeStateByCode.set(key, state7);
+  kanbanNudgeStateByCode.set(key, state8);
   saveKanbanNudgeState(kanbanNudgeStateByCode, channelHashCacheDir());
 }
 function clearKanbanNudgeState(codeName) {
@@ -16283,9 +17100,9 @@ ${formatRunMarker(run_id)}` : KANBAN_CHECK_COMMAND;
   }
   if (run_id) openInjectedRunByCode.set(codeName, run_id);
   try {
-    const doorbell = directChatDoorbellPath(agentId, homedir12());
-    mkdirSync10(dirname8(doorbell), { recursive: true });
-    writeFileSync13(doorbell, String(Date.now()));
+    const doorbell = directChatDoorbellPath(agentId, homedir15());
+    mkdirSync11(dirname9(doorbell), { recursive: true });
+    writeFileSync14(doorbell, String(Date.now()));
   } catch (err) {
     log(`[kanban] doorbell ring failed for '${codeName}': ${err.message} (notice still queued)`);
   }
@@ -16389,7 +17206,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-63Y4MIMU.js");
+  } = await import("../claude-pair-runtime-4C5NQQHR.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -16643,8 +17460,8 @@ function parseMemoryFile(raw, fallbackName) {
   };
 }
 async function syncMemories(agent, configDir, log2) {
-  const projectDir = join29(configDir, agent.code_name, "project");
-  const memoryDir = join29(projectDir, "memory");
+  const projectDir = join33(configDir, agent.code_name, "project");
+  const memoryDir = join33(projectDir, "memory");
   const isFreshSync = pendingFreshMemorySync.has(agent.agent_id);
   if (isFreshSync) {
     log2(`[memory-sync] Fresh-sync requested for '${agent.code_name}' \u2014 pulling DB first`);
@@ -16655,15 +17472,15 @@ async function syncMemories(agent, configDir, log2) {
     }
     pendingFreshMemorySync.delete(agent.agent_id);
   }
-  if (existsSync12(memoryDir)) {
+  if (existsSync14(memoryDir)) {
     const prevHashes = memoryFileHashes.get(agent.agent_id) ?? /* @__PURE__ */ new Map();
     const currentHashes = /* @__PURE__ */ new Map();
     const changedMemories = [];
-    for (const file of readdirSync8(memoryDir)) {
+    for (const file of readdirSync9(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync22(join29(memoryDir, file), "utf-8");
-        const fileHash = createHash16("sha256").update(raw).digest("hex").slice(0, 16);
+        const raw = readFileSync26(join33(memoryDir, file), "utf-8");
+        const fileHash = createHash17("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
         const parsed = parseMemoryFile(raw, file.replace(/\.md$/, ""));
@@ -16687,7 +17504,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync22(join29(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync26(join33(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -16700,29 +17517,29 @@ async function syncMemories(agent, configDir, log2) {
   }
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
-  const localFiles = existsSync12(memoryDir) ? readdirSync8(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
-  const localListHash = createHash16("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
+  const localFiles = existsSync14(memoryDir) ? readdirSync9(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
+  const localListHash = createHash17("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
   try {
     const dbMemories = await api.post("/host/memories", {
       agent_id: agent.agent_id
     });
-    const responseHash = createHash16("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
+    const responseHash = createHash17("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
     if (!force && prevDownload && prevLocalHash === localListHash && lastDownloadHash.get(agent.agent_id) === responseHash) {
       return true;
     }
     lastDownloadHash.set(agent.agent_id, responseHash);
     lastLocalFileHash.set(agent.agent_id, localListHash);
     if (dbMemories.memories?.length) {
-      mkdirSync10(memoryDir, { recursive: true });
+      mkdirSync11(memoryDir, { recursive: true });
       let written = 0;
       let overwritten = 0;
       for (let i = 0; i < dbMemories.memories.length; i++) {
         const mem = dbMemories.memories[i];
         const rawSlug = mem.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "").slice(0, 60);
         const slug = rawSlug || `memory-${i}`;
-        const filePath = join29(memoryDir, `${slug}.md`);
+        const filePath = join33(memoryDir, `${slug}.md`);
         const desired = `---
 name: ${JSON.stringify(mem.name)}
 type: ${mem.type}
@@ -16731,23 +17548,23 @@ description: ${JSON.stringify(mem.content.slice(0, 200))}
 
 ${mem.content}
 `;
-        if (existsSync12(filePath)) {
+        if (existsSync14(filePath)) {
           let existing = "";
           try {
-            existing = readFileSync22(filePath, "utf-8");
+            existing = readFileSync26(filePath, "utf-8");
           } catch {
           }
           if (existing === desired) continue;
-          writeFileSync13(filePath, desired);
+          writeFileSync14(filePath, desired);
           overwritten++;
         } else {
-          writeFileSync13(filePath, desired);
+          writeFileSync14(filePath, desired);
           written++;
         }
       }
       if (written > 0 || overwritten > 0) {
-        const updatedFiles = readdirSync8(memoryDir).filter((f) => f.endsWith(".md")).sort();
-        lastLocalFileHash.set(agent.agent_id, createHash16("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
+        const updatedFiles = readdirSync9(memoryDir).filter((f) => f.endsWith(".md")).sort();
+        lastLocalFileHash.set(agent.agent_id, createHash17("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
     }
@@ -16758,7 +17575,7 @@ ${mem.content}
   }
 }
 async function cleanupAgentFiles(codeName, agentDir) {
-  if (existsSync12(agentDir)) {
+  if (existsSync14(agentDir)) {
     try {
       rmSync5(agentDir, { recursive: true, force: true });
       log(`Removed provision directory for '${codeName}'`);
@@ -16821,7 +17638,7 @@ async function driveArtifactStreaming() {
 }
 async function driveArtifactStreamingInner() {
   const liveIds = /* @__PURE__ */ new Set();
-  for (const agent of state6.agents) {
+  for (const agent of state7.agents) {
     if (!agent.agentId || !agent.codeName || agent.status !== "active") continue;
     liveIds.add(agent.agentId);
     let scanner = artifactScanners.get(agent.agentId);
@@ -16997,12 +17814,12 @@ function startManager(opts) {
   config = opts;
   try {
     const stateFile = getStateFile();
-    if (existsSync12(stateFile)) {
-      const raw = readFileSync22(stateFile, "utf-8");
+    if (existsSync14(stateFile)) {
+      const raw = readFileSync26(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
-        state6.agents = parsed.agents;
-        log(`[startup] rehydrated ${state6.agents.length} agent state(s) from ${stateFile}`);
+        state7.agents = parsed.agents;
+        log(`[startup] rehydrated ${state7.agents.length} agent state(s) from ${stateFile}`);
       }
       if (parsed.circuitBreakerTrips && typeof parsed.circuitBreakerTrips === "object") {
         restartBreaker.hydrate(parsed.circuitBreakerTrips);
@@ -17015,9 +17832,9 @@ function startManager(opts) {
         if (n > 0) log(`[startup] rehydrated ${n} auto-resume marker(s) (ENG-6088)`);
       }
       if (typeof parsed.lastUpdateRequestProcessedAt === "string" || parsed.lastUpdateRequestProcessedAt === null) {
-        state6.lastUpdateRequestProcessedAt = parsed.lastUpdateRequestProcessedAt;
-        if (state6.lastUpdateRequestProcessedAt) {
-          log(`[startup] rehydrated update-request ack at ${state6.lastUpdateRequestProcessedAt} (ENG-6692)`);
+        state7.lastUpdateRequestProcessedAt = parsed.lastUpdateRequestProcessedAt;
+        if (state7.lastUpdateRequestProcessedAt) {
+          log(`[startup] rehydrated update-request ack at ${state7.lastUpdateRequestProcessedAt} (ENG-6692)`);
         }
       }
     }
@@ -17025,7 +17842,7 @@ function startManager(opts) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
   }
   log(
-    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join29(homedir12(), ".augmented", "manager.log")}`
+    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join33(homedir15(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
@@ -17037,7 +17854,7 @@ function startManager(opts) {
     }
     try {
       refreshSlackRestartContextHints(
-        state6.agents.map((a) => a.codeName),
+        state7.agents.map((a) => a.codeName),
         { log }
       );
     } catch (err) {
@@ -17054,7 +17871,7 @@ async function reapOrphanedClaudePids() {
   const looksLikeClaude = (pid) => {
     if (process.platform !== "linux") return true;
     try {
-      const comm = readFileSync22(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
+      const comm = readFileSync26(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
       return comm.includes("claude");
     } catch {
       return false;
@@ -17151,18 +17968,18 @@ function restartRunningChannelMcps(basenames) {
   }
 }
 function deployMcpAssets() {
-  const targetDir = join29(homedir12(), ".augmented", "_mcp");
-  mkdirSync10(targetDir, { recursive: true });
-  const moduleDir = dirname8(fileURLToPath(import.meta.url));
+  const targetDir = join33(homedir15(), ".augmented", "_mcp");
+  mkdirSync11(targetDir, { recursive: true });
+  const moduleDir = dirname9(fileURLToPath(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
-    const candidate = join29(dir, "dist", "mcp");
-    if (existsSync12(join29(candidate, "index.js"))) {
+    const candidate = join33(dir, "dist", "mcp");
+    if (existsSync14(join33(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
-    const parent = dirname8(dir);
+    const parent = dirname9(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -17173,8 +17990,8 @@ function deployMcpAssets() {
   const changedBasenames = [];
   const fileHash = (p) => {
     try {
-      if (!existsSync12(p)) return null;
-      return createHash16("sha256").update(readFileSync22(p)).digest("hex");
+      if (!existsSync14(p)) return null;
+      return createHash17("sha256").update(readFileSync26(p)).digest("hex");
     } catch {
       return null;
     }
@@ -17245,9 +18062,9 @@ function deployMcpAssets() {
     // needs restarting to pick up a token rotation.
     "xero.js"
   ]) {
-    const src = join29(mcpSourceDir, file);
-    const dst = join29(targetDir, file);
-    if (!existsSync12(src)) continue;
+    const src = join33(mcpSourceDir, file);
+    const dst = join33(targetDir, file);
+    if (!existsSync14(src)) continue;
     const before = fileHash(dst);
     try {
       copyFileSync(src, dst);
@@ -17264,23 +18081,23 @@ function deployMcpAssets() {
     log(`[manager] Bundle(s) updated: ${changedBasenames.join(", ")} \u2014 signalling running instances to restart`);
     restartRunningChannelMcps(changedBasenames);
   }
-  const localMcpPath = join29(targetDir, "index.js");
+  const localMcpPath = join33(targetDir, "index.js");
   try {
-    const agentsDir = join29(homedir12(), ".augmented", "agents");
-    if (existsSync12(agentsDir)) {
-      for (const entry of readdirSync8(agentsDir, { withFileTypes: true })) {
+    const agentsDir = join33(homedir15(), ".augmented", "agents");
+    if (existsSync14(agentsDir)) {
+      for (const entry of readdirSync9(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
-          const mcpJsonPath = join29(agentsDir, entry.name, subdir, ".mcp.json");
+          const mcpJsonPath = join33(agentsDir, entry.name, subdir, ".mcp.json");
           try {
-            const raw = readFileSync22(mcpJsonPath, "utf-8");
+            const raw = readFileSync26(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
             const mcpConfig = JSON.parse(raw);
             const augServer = mcpConfig.mcpServers?.["augmented"];
             if (!augServer) continue;
             augServer.command = "node";
             augServer.args = [localMcpPath];
-            writeFileSync13(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
+            writeFileSync14(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
             log(`[manager] Patched ${entry.name}/${subdir}/.mcp.json: npx \u2192 node`);
           } catch {
           }