@integrity-labs/agt-cli 0.28.593 → 0.28.595

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-BYCE4V7Q.js";
+} from "../chunk-RC6V6QN2.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -61,12 +61,60 @@ import {
   markTaskFired,
   syncTasksToScheduler
 } from "../chunk-3HLECXMI.js";
+import {
+  ChildProcessError,
+  agentRuntimeKey,
+  buildEgressAllowlist,
+  checkChannelInputs,
+  creditWatchdogGiveUpCount,
+  egressMode,
+  execFilePromiseLong,
+  getLastFailureContext,
+  getOpencodeActivityAgeSeconds,
+  getOpencodeSessionState,
+  getOpencodeTurnHealth,
+  getProjectDir,
+  getSessionState,
+  hashFile,
+  injectMessage,
+  injectMessageWithStatus,
+  injectOpencodeMessage,
+  isOpencodeSessionHealthy,
+  isSessionHealthy,
+  isolationMode,
+  log,
+  mergeOpencodeConfigArtifact,
+  paneLogPath,
+  parseEnvIntegrations,
+  prepareForRespawn,
+  readChannelServerEnv,
+  readDirectChatSessionState,
+  readOpencodePaneLogTail,
+  readPaneLogTail,
+  readProvisionedOpencodeModel,
+  reloadEgressSidecar,
+  resetRestartCount,
+  resolveClaudeBinary,
+  restartEgressSidecar,
+  rotatePaneLogForDayRollover,
+  rotateSessionForWedge,
+  sha256,
+  sharedBusyBuckets,
+  startOpencodeSession,
+  startPersistentSession,
+  stopAllSessionsAndWait,
+  stopOpencodeSession,
+  stopPersistentSession,
+  takeWatchdogGiveUpCount,
+  takeZombieDetection,
+  toOpencodeModel,
+  writeEgressAllowlist
+} from "../chunk-6NVRWZ5W.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
   CLAUDE_MD_MAX_CHARS,
   CONVERSATION_FAILURE_CATEGORIES,
-  ChildProcessError,
   DEFAULT_FRAMEWORK,
   DEFAULT_NEIGHBOURHOOD_MS,
   FLAGS_SCHEMA_VERSION,
@@ -82,24 +130,18 @@ import {
   SUPPRESS_SENTINEL,
   StreamEncoder,
   UNKNOWN_RATE_LIMIT,
-  agentRuntimeKey,
   appendDmFooter,
   attributeTranscriptUsageByRun,
-  buildEgressAllowlist,
   buildFailureCategoryPromptLines,
   buildScheduledTaskContextBlocks,
-  checkChannelInputs,
   classifyActor,
   classifyCursorAdvance,
   classifyOutput,
   classifyTranscriptRateLimit,
   coerceOnboardingState,
-  creditWatchdogGiveUpCount,
   cursorAdvanceCounterKey,
   describeOnboardingChannel,
-  egressMode,
   estimateActiveTasksTokens,
-  execFilePromiseLong,
   extractFrontmatter,
   extractQualifyingTurns,
   findRunMarker,
@@ -109,16 +151,6 @@ import {
   formatRunMarker,
   getFramework,
   getIntegration,
-  getLastFailureContext,
-  getOpencodeActivityAgeSeconds,
-  getOpencodeSessionState,
-  getOpencodeTurnHealth,
-  getProjectDir,
-  getSessionState,
-  hashFile,
-  injectMessage,
-  injectMessageWithStatus,
-  injectOpencodeMessage,
   isAgentIdle,
   isAgentTimezoneOverrideExpired,
   isBareAck,
@@ -129,69 +161,39 @@ import {
   isEmptyTotals,
   isForcedUpdatePastDeadline,
   isOnboardingArea,
-  isOpencodeSessionHealthy,
   isParseError,
   isResolveError,
   isSelfCompletion,
-  isSessionHealthy,
   isStaleForToday,
   isSystemInjectedContent,
   isUnsetTimezone,
   isVacuousDeliverReason,
-  isolationMode,
   laneTagFragment,
-  log,
-  mergeOpencodeConfigArtifact,
   minutesSinceLocalMidnight,
-  paneLogPath,
   parseDeliverAssertion,
   parseDeliveryTarget,
-  parseEnvIntegrations,
   parseTranscriptUsage,
   parseUsageBanner,
   peekCurrentSession,
   pickNewerClassification,
-  prepareForRespawn,
-  readChannelServerEnv,
-  readDirectChatSessionState,
-  readOpencodePaneLogTail,
-  readPaneLogTail,
-  readProvisionedOpencodeModel,
-  reloadEgressSidecar,
   remoteMcpServerKey,
-  resetRestartCount,
   resolveAgentTimezone,
   resolveAvatarEnvUrl,
   resolveChannels,
-  resolveClaudeBinary,
   resolveDmTarget,
-  restartEgressSidecar,
-  rotatePaneLogForDayRollover,
-  rotateSessionForWedge,
   serializeAccountEnforcementMarker,
   sessionTranscriptDir,
-  sha256,
-  sharedBusyBuckets,
-  startOpencodeSession,
-  startPersistentSession,
-  stopAllSessionsAndWait,
-  stopOpencodeSession,
-  stopPersistentSession,
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
-  takeWatchdogGiveUpCount,
-  takeZombieDetection,
-  toOpencodeModel,
-  transcriptActivityAgeSeconds,
-  writeEgressAllowlist
-} from "../chunk-TKWDYMM3.js";
+  transcriptActivityAgeSeconds
+} from "../chunk-3PNRUCHD.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
 import { createHash as createHash17 } from "crypto";
-import { readFileSync as readFileSync27, writeFileSync as writeFileSync14, mkdirSync as mkdirSync11, existsSync as existsSync14, rmSync as rmSync5, readdirSync as readdirSync9, statSync as statSync8, copyFileSync } from "fs";
+import { readFileSync as readFileSync28, writeFileSync as writeFileSync14, mkdirSync as mkdirSync11, existsSync as existsSync15, rmSync as rmSync5, readdirSync as readdirSync9, statSync as statSync8, copyFileSync } from "fs";
 import { execFileSync as syncExecFile } from "child_process";
 import { join as join34, dirname as dirname9, delimiter as pathDelimiter } from "path";
 import { homedir as homedir16 } from "os";
@@ -7576,6 +7578,147 @@ function stopPaneOccupancySampler() {
   timer = null;
 }
 
+// src/lib/pid-pressure-sampler.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync12, readFileSync as readFileSync24 } from "fs";
+var SAMPLE_INTERVAL_MS2 = 3e4;
+function warnFraction() {
+  const raw = Number(process.env.AGT_PID_PRESSURE_WARN_FRACTION);
+  if (!Number.isFinite(raw) || raw <= 0 || raw > 1) return 0.8;
+  return raw;
+}
+function configuredCeiling() {
+  const raw = Number(process.env.AGT_ISOLATION_PIDS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 512;
+}
+function readTextReal(path) {
+  try {
+    return readFileSync24(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+var cgroupDirCache = /* @__PURE__ */ new Map();
+var resolveRetryAfter = /* @__PURE__ */ new Map();
+var RESOLVE_RETRY_BACKOFF_MS = 5 * 6e4;
+function resolveCgroupDirReal(codeName, deps = {}) {
+  const exists = deps.exists ?? existsSync12;
+  const inspectId = deps.inspectId ?? inspectContainerId;
+  const now = deps.now ?? Date.now;
+  const cached = cgroupDirCache.get(codeName);
+  if (cached && exists(cached)) {
+    resolveRetryAfter.delete(codeName);
+    return cached;
+  }
+  const retryAt = resolveRetryAfter.get(codeName);
+  if (retryAt != null && now() < retryAt) return null;
+  if (cached) cgroupDirCache.delete(codeName);
+  const id = inspectId(codeName);
+  if (id == null || !/^[0-9a-f]{12,64}$/.test(id)) {
+    resolveRetryAfter.set(codeName, now() + RESOLVE_RETRY_BACKOFF_MS);
+    return null;
+  }
+  for (const dir of [
+    `/sys/fs/cgroup/system.slice/docker-${id}.scope`,
+    `/sys/fs/cgroup/docker/${id}`
+  ]) {
+    if (exists(dir)) {
+      cgroupDirCache.set(codeName, dir);
+      resolveRetryAfter.delete(codeName);
+      return dir;
+    }
+  }
+  resolveRetryAfter.set(codeName, now() + RESOLVE_RETRY_BACKOFF_MS);
+  return null;
+}
+function inspectContainerId(codeName) {
+  try {
+    return execFileSync2("docker", ["inspect", "-f", "{{.Id}}", `agt-${codeName}`], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function countDefunct(cgroupDir, readText) {
+  const procs = readText(`${cgroupDir}/cgroup.procs`);
+  if (procs == null) return 0;
+  let defunct = 0;
+  for (const line of procs.split("\n")) {
+    const pid = line.trim();
+    if (!pid) continue;
+    const stat2 = readText(`/proc/${pid}/stat`);
+    if (stat2 == null) continue;
+    const close = stat2.lastIndexOf(")");
+    if (close < 0) continue;
+    const state8 = stat2.slice(close + 1).trim().charAt(0);
+    if (state8 === "Z") defunct += 1;
+  }
+  return defunct;
+}
+function samplePidPressureFor(codeName, io = {}) {
+  const isolated = io.isolatedFor?.(codeName) ?? isolationMode(codeName) === "docker";
+  if (!isolated) return null;
+  const readText = io.readText ?? readTextReal;
+  const resolveDir = io.resolveCgroupDir ?? resolveCgroupDirReal;
+  const dir = resolveDir(codeName);
+  if (dir == null) return null;
+  const currentRaw = readText(`${dir}/pids.current`)?.trim();
+  if (currentRaw == null || currentRaw === "") return null;
+  const current = Number(currentRaw);
+  if (!Number.isFinite(current) || current < 0) return null;
+  const maxParsed = Number(readText(`${dir}/pids.max`)?.trim());
+  const max = Number.isFinite(maxParsed) && maxParsed > 0 ? maxParsed : null;
+  const ceiling = configuredCeiling();
+  const warnAt = Math.floor(ceiling * warnFraction());
+  return {
+    current,
+    max,
+    ceiling,
+    defunct: countDefunct(dir, readText),
+    warnAt,
+    overThreshold: current >= warnAt
+  };
+}
+var lastSample = /* @__PURE__ */ new Map();
+function samplePidPressureOnce(codeNames, io = {}) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const codeName of codeNames) {
+    seen.add(codeName);
+    const sample = samplePidPressureFor(codeName, io);
+    if (sample) lastSample.set(codeName, sample);
+    else lastSample.delete(codeName);
+  }
+  for (const codeName of [...lastSample.keys()]) {
+    if (!seen.has(codeName)) {
+      lastSample.delete(codeName);
+      cgroupDirCache.delete(codeName);
+      resolveRetryAfter.delete(codeName);
+    }
+  }
+}
+function pidPressureFor(codeName) {
+  return lastSample.get(codeName) ?? null;
+}
+var timer2 = null;
+function startPidPressureSampler(liveAgents) {
+  if (timer2) return;
+  timer2 = setInterval(() => {
+    try {
+      samplePidPressureOnce(liveAgents());
+    } catch {
+    }
+  }, SAMPLE_INTERVAL_MS2);
+  timer2.unref?.();
+}
+function stopPidPressureSampler() {
+  if (!timer2) return;
+  clearInterval(timer2);
+  timer2 = null;
+}
+
 // src/lib/opencode-slack-ingest.ts
 import { createHash as createHash14 } from "crypto";
 
@@ -8702,7 +8845,7 @@ async function fireOpencodeScheduledTask(agent, task) {
 
 // src/lib/opencode-telegram-ingest.ts
 import { createHash as createHash16 } from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync24, renameSync as renameSync5, unlinkSync as unlinkSync3, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync25, renameSync as renameSync5, unlinkSync as unlinkSync3, writeFileSync as writeFileSync11 } from "fs";
 import { randomUUID } from "crypto";
 import { join as join31 } from "path";
 
@@ -9261,7 +9404,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
     load() {
       if (!filePath) return 0;
       try {
-        const parsed = JSON.parse(readFileSync24(filePath, "utf-8"));
+        const parsed = JSON.parse(readFileSync25(filePath, "utf-8"));
         if (currentBotId != null && typeof parsed?.bot_id === "number" && parsed.bot_id !== currentBotId) {
           log2(`[telegram-ingest:${codeName}] offset cursor belongs to a different bot; ignoring (bot swap)`);
           return 0;
@@ -9294,7 +9437,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
       } catch (err) {
         log2(`[telegram-ingest:${codeName}] offset persist failed: ${err instanceof Error ? err.message : String(err)}`);
         try {
-          if (existsSync12(tmpPath)) unlinkSync3(tmpPath);
+          if (existsSync13(tmpPath)) unlinkSync3(tmpPath);
         } catch {
         }
       }
@@ -9531,7 +9674,7 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync25, renameSync as renameSync6, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync26, renameSync as renameSync6, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "fs";
 import { homedir as homedir15 } from "os";
 import { join as join32 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
@@ -9543,12 +9686,12 @@ function flagPath(codeName) {
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
-  if (!existsSync13(dir)) return [];
+  if (!existsSync14(dir)) return [];
   const out = [];
   for (const entry of readdirSync7(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync25(join32(dir, entry), "utf8");
+      const raw = readFileSync26(join32(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -9566,7 +9709,7 @@ function readRestartFlags() {
 }
 function deleteRestartFlag(codeName) {
   const path = flagPath(codeName);
-  if (existsSync13(path)) {
+  if (existsSync14(path)) {
     rmSync4(path, { force: true });
   }
 }
@@ -9666,7 +9809,7 @@ async function sendError(flag, opts, text) {
 }
 
 // src/lib/restart-context.ts
-import { readdirSync as readdirSync8, readFileSync as readFileSync26, writeFileSync as writeFileSync13, mkdirSync as mkdirSync10, unlinkSync as unlinkSync4 } from "fs";
+import { readdirSync as readdirSync8, readFileSync as readFileSync27, writeFileSync as writeFileSync13, mkdirSync as mkdirSync10, unlinkSync as unlinkSync4 } from "fs";
 import { dirname as dirname8, join as join33 } from "path";
 var SLACK_PENDING_INBOUND_DIRNAME = "slack-pending-inbound";
 var SLACK_RESTART_CONTEXT_DIRNAME = "slack-restart-context";
@@ -9724,7 +9867,7 @@ function safeReaddir(dir) {
 }
 function readStrandedMarker(path) {
   try {
-    const parsed = JSON.parse(readFileSync26(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync27(path, "utf-8"));
     if (typeof parsed.channel === "string" && typeof parsed.thread_ts === "string") {
       return { channel: parsed.channel, thread_ts: parsed.thread_ts };
     }
@@ -10867,7 +11010,7 @@ function scheduleSessionRestart(codeName, delayMs, reason, breakerReason = "hot-
     clearTimeout(existing.timer);
     log(`[hot-reload] Coalesced restart for '${codeName}': replacing pending timer with ${reason}`);
   }
-  const timer2 = setTimeout(() => {
+  const timer3 = setTimeout(() => {
     pendingSessionRestarts.delete(codeName);
     const gate = restartGateFor(codeName, breakerReason);
     if (gate !== "bypass" && gate !== "proceed") {
@@ -10945,8 +11088,8 @@ function scheduleSessionRestart(codeName, delayMs, reason, breakerReason = "hot-
       void respawnAgentAfterMcpStop(codeName, reason);
     }
   }, delayMs);
-  timer2.unref?.();
-  pendingSessionRestarts.set(codeName, { timer: timer2, reason, breakerReason, beforeStop, auditDetail });
+  timer3.unref?.();
+  pendingSessionRestarts.set(codeName, { timer: timer3, reason, breakerReason, beforeStop, auditDetail });
 }
 function cancelPendingSessionRestart(codeName) {
   pendingRestartVerifications.delete(codeName);
@@ -11295,7 +11438,7 @@ var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync27(join34(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync28(join34(projectDir, ".mcp.json"), "utf-8");
     return createHash17("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
@@ -11303,7 +11446,7 @@ function projectMcpHash(_codeName, projectDir) {
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync27(join34(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync28(join34(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -11321,7 +11464,7 @@ function seedSessionLaunchBaselines(codeName, projectDir) {
   else runningMcpServerKeys.delete(codeName);
   let launchStructure = null;
   try {
-    const raw = readFileSync27(join34(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync28(join34(projectDir, ".mcp.json"), "utf-8");
     launchStructure = managedMcpStructureHashFromFile(
       JSON.parse(raw),
       isManagedMcpServerKey
@@ -11443,7 +11586,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   if (result && result.rebindCandidates.length > 0 && hostFlagStore().getBoolean("session-tool-rebind")) {
     let mcpJsonForRebind = null;
     try {
-      mcpJsonForRebind = JSON.parse(readFileSync27(join34(projectDir, ".mcp.json"), "utf-8"));
+      mcpJsonForRebind = JSON.parse(readFileSync28(join34(projectDir, ".mcp.json"), "utf-8"));
     } catch {
       mcpJsonForRebind = null;
     }
@@ -11588,7 +11731,7 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
 function projectChannelSecretHash(projectDir) {
   try {
     const entries = parseEnvIntegrations(
-      readFileSync27(join34(projectDir, ".env.integrations"), "utf-8")
+      readFileSync28(join34(projectDir, ".env.integrations"), "utf-8")
     );
     return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
   } catch {
@@ -11684,10 +11827,10 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.593" : "dev";
-function resolveBrewPath(execFileSync2) {
+var agtCliVersion = true ? "0.28.595" : "dev";
+function resolveBrewPath(execFileSync3) {
   try {
-    const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
+    const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
     if (out) return out;
   } catch {
   }
@@ -11697,19 +11840,19 @@ function resolveBrewPath(execFileSync2) {
     "/usr/local/bin/brew"
   ];
   for (const path of fallbacks) {
-    if (existsSync14(path)) return path;
+    if (existsSync15(path)) return path;
   }
   return null;
 }
-function claudeBinaryInstalled(execFileSync2) {
+function claudeBinaryInstalled(execFileSync3) {
   const canonical = [
     "/home/linuxbrew/.linuxbrew/bin/claude",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude"
   ];
-  if (canonical.some((path) => existsSync14(path))) return true;
+  if (canonical.some((path) => existsSync15(path))) return true;
   try {
-    execFileSync2("which", ["claude"], { timeout: 5e3 });
+    execFileSync3("which", ["claude"], { timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -11743,9 +11886,9 @@ async function ensureToolkitCli(toolkitSlug) {
   }
   const { binary, installer, package: pkg, script } = integration.cli_tool;
   const resolvedInstaller = installer ?? "manual";
-  const { execFileSync: execFileSync2, execSync } = await import("child_process");
+  const { execFileSync: execFileSync3, execSync } = await import("child_process");
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
     toolkitCliFailureCount.delete(toolkitSlug);
@@ -11766,14 +11909,14 @@ async function ensureToolkitCli(toolkitSlug) {
         return;
       }
       log(`[toolkit-install] ${toolkitSlug}: installing via npm (${pkg})\u2026`);
-      execFileSync2("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
+      execFileSync3("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
     } else if (resolvedInstaller === "brew") {
       if (!pkg) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but no package declared`);
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      const brewPath = resolveBrewPath(execFileSync2);
+      const brewPath = resolveBrewPath(execFileSync3);
       if (!brewPath) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but Homebrew not available \u2014 install manually: brew install ${pkg}`);
         toolkitCliEnsured.add(toolkitSlug);
@@ -11783,9 +11926,9 @@ async function ensureToolkitCli(toolkitSlug) {
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
-        execFileSync2("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
+        execFileSync3("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
       } else {
-        execFileSync2(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
+        execFileSync3(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
       }
     } else if (resolvedInstaller === "script") {
       if (!script) {
@@ -11807,7 +11950,7 @@ async function ensureToolkitCli(toolkitSlug) {
     process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
   }
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     log(`[toolkit-install] ${toolkitSlug}: installed \u2014 ${binary} now on PATH`);
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
@@ -11855,16 +11998,16 @@ async function ensureIsolationImage(imageUri) {
   }
   isolationImageInFlight.add(imageUri);
   try {
-    const { execFileSync: execFileSync2 } = await import("child_process");
+    const { execFileSync: execFileSync3 } = await import("child_process");
     try {
-      execFileSync2("which", ["docker"], { timeout: 5e3, stdio: "pipe" });
+      execFileSync3("which", ["docker"], { timeout: 5e3, stdio: "pipe" });
     } catch {
       recordIsolationImageFailure(imageUri, `'docker' not found on host - required to pull the isolation image (install it, then the manager retries)`);
       return;
     }
     const hasAws = (() => {
       try {
-        execFileSync2("which", ["aws"], { timeout: 5e3, stdio: "pipe" });
+        execFileSync3("which", ["aws"], { timeout: 5e3, stdio: "pipe" });
         return true;
       } catch {
         return false;
@@ -11873,11 +12016,11 @@ async function ensureIsolationImage(imageUri) {
     if (isPublic) {
       if (hasAws) {
         try {
-          const password = execFileSync2("aws", ["ecr-public", "get-login-password", "--region", "us-east-1"], {
+          const password = execFileSync3("aws", ["ecr-public", "get-login-password", "--region", "us-east-1"], {
             timeout: 3e4,
             stdio: ["ignore", "pipe", "pipe"]
           }).toString().trim();
-          execFileSync2("docker", ["login", "--username", "AWS", "--password-stdin", "public.ecr.aws"], {
+          execFileSync3("docker", ["login", "--username", "AWS", "--password-stdin", "public.ecr.aws"], {
             input: password,
             timeout: 3e4,
             stdio: ["pipe", "pipe", "pipe"]
@@ -11892,11 +12035,11 @@ async function ensureIsolationImage(imageUri) {
         return;
       }
       try {
-        const password = execFileSync2("aws", ["ecr", "get-login-password", "--region", privRegion], {
+        const password = execFileSync3("aws", ["ecr", "get-login-password", "--region", privRegion], {
           timeout: 3e4,
           stdio: ["ignore", "pipe", "pipe"]
         }).toString().trim();
-        execFileSync2("docker", ["login", "--username", "AWS", "--password-stdin", registry], {
+        execFileSync3("docker", ["login", "--username", "AWS", "--password-stdin", registry], {
           input: password,
           timeout: 3e4,
           stdio: ["pipe", "pipe", "pipe"]
@@ -11977,7 +12120,7 @@ function runAsync(cmd, args, opts) {
       let stdout = "";
       let stderr = "";
       let settled = false;
-      const timer2 = setTimeout(() => {
+      const timer3 = setTimeout(() => {
         child.kill("SIGTERM");
         if (settled) return;
         settled = true;
@@ -11998,13 +12141,13 @@ function runAsync(cmd, args, opts) {
       child.on("error", (err) => {
         if (settled) return;
         settled = true;
-        clearTimeout(timer2);
+        clearTimeout(timer3);
         reject(err);
       });
       child.on("close", (code) => {
         if (settled) return;
         settled = true;
-        clearTimeout(timer2);
+        clearTimeout(timer3);
         resolve({ code: code ?? -1, stdout, stderr });
       });
     }).catch(reject);
@@ -12016,8 +12159,8 @@ function claudeManagedSettingsPath() {
 function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
   try {
     let settings = {};
-    if (existsSync14(path)) {
-      const raw = readFileSync27(path, "utf-8").trim();
+    if (existsSync15(path)) {
+      const raw = readFileSync28(path, "utf-8").trim();
       if (raw) {
         let parsed;
         try {
@@ -12045,11 +12188,11 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
 }
 var OPENCODE_NPM_VERSION = "1.18.3";
 async function ensureOpencodeBinary() {
-  const { execFileSync: execFileSync2 } = await import("child_process");
+  const { execFileSync: execFileSync3 } = await import("child_process");
   const bin = process.env["AGT_OPENCODE_BIN"]?.trim() || "opencode";
   const probe = () => {
     try {
-      execFileSync2(bin, ["--version"], { stdio: "ignore", timeout: 1e4 });
+      execFileSync3(bin, ["--version"], { stdio: "ignore", timeout: 1e4 });
       return true;
     } catch {
       return false;
@@ -12070,7 +12213,7 @@ async function ensureOpencodeBinary() {
     return false;
   }
   try {
-    const prefix = execFileSync2("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 1e4 }).trim();
+    const prefix = execFileSync3("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 1e4 }).trim();
     if (prefix) {
       const npmBin = join34(prefix, "bin");
       const current = (process.env.PATH ?? "").split(pathDelimiter);
@@ -12102,8 +12245,8 @@ async function ensureFrameworkBinary(frameworkId) {
   }
   frameworkBinaryChecked.add(frameworkId);
   lastManagedSettingsStatus = ensureClaudeManagedSettings();
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) {
     log("Homebrew not found (no `brew` on PATH, no /home/linuxbrew/.linuxbrew/bin/brew). Cannot auto-install Claude Code. Install manually: https://claude.ai/download");
     return;
@@ -12116,7 +12259,7 @@ async function ensureFrameworkBinary(frameworkId) {
     }
     return runAsync(brewPath, args, opts);
   };
-  const claudeExists = claudeBinaryInstalled(execFileSync2);
+  const claudeExists = claudeBinaryInstalled(execFileSync3);
   if (!claudeExists) {
     log(`Claude Code binary not found \u2014 installing via Homebrew${isRoot ? " (as ec2-user via sudo)" : ""}...`);
     try {
@@ -12133,7 +12276,7 @@ async function ensureFrameworkBinary(frameworkId) {
     if (!process.env.PATH?.split(":").includes(brewBinDir)) {
       process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
     }
-    if (existsSync14("/home/linuxbrew/.linuxbrew/bin/claude")) {
+    if (existsSync15("/home/linuxbrew/.linuxbrew/bin/claude")) {
       log("Claude Code installed successfully");
     } else {
       log("Claude Code install completed but binary not found at expected path \u2014 check brew logs");
@@ -12151,13 +12294,13 @@ async function maybeUpgradeClaudeCode() {
   }
   claudeCodeUpgradeInFlight = true;
   stampClaudeCodeUpgradeMarker();
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) {
     claudeCodeUpgradeInFlight = false;
     return;
   }
-  if (!claudeBinaryInstalled(execFileSync2)) {
+  if (!claudeBinaryInstalled(execFileSync3)) {
     claudeCodeUpgradeInFlight = false;
     return;
   }
@@ -12241,8 +12384,8 @@ async function checkAndUpdateCli(opts) {
   }
 }
 async function checkAndUpdateCliViaBrew(force = false) {
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) return "noop";
   {
     const brewPinRaw = resolveAgtCliPinRaw();
@@ -12269,13 +12412,13 @@ async function checkAndUpdateCliViaBrew(force = false) {
   }
   let metadataFresh = true;
   try {
-    execFileSync2(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
+    execFileSync3(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
   } catch (err) {
     metadataFresh = false;
     log(`[self-update] brew update failed (continuing with stale cache): ${err.message}`);
   }
   try {
-    const outdated = execFileSync2(brewPath, ["outdated", "--json=v2"], {
+    const outdated = execFileSync3(brewPath, ["outdated", "--json=v2"], {
       timeout: 3e4,
       encoding: "utf-8"
     });
@@ -12308,7 +12451,7 @@ async function checkAndUpdateCliViaBrew(force = false) {
       }
       log(`[self-update] agt CLI update available: ${installed} \u2192 ${latest}. Upgrading via brew${force ? " (forced \u2014 Update CLI now)" : ""}...`);
       try {
-        execFileSync2(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
+        execFileSync3(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
           timeout: 12e4,
           stdio: "pipe"
         });
@@ -12485,7 +12628,7 @@ async function fetchUrgentDistTagVersion() {
   }
 }
 async function installAgtCliViaNpm(version, reasonLabel) {
-  const { execFileSync: execFileSync2 } = await import("child_process");
+  const { execFileSync: execFileSync3 } = await import("child_process");
   const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
   const cmd = isRoot ? "npm" : "sudo";
   const installArgs = [
@@ -12496,14 +12639,14 @@ async function installAgtCliViaNpm(version, reasonLabel) {
   ];
   const args = isRoot ? installArgs : ["-n", "npm", ...installArgs];
   try {
-    execFileSync2(cmd, args, { timeout: 18e4, stdio: "pipe" });
+    execFileSync3(cmd, args, { timeout: 18e4, stdio: "pipe" });
   } catch (err) {
     log(`[self-update] npm upgrade failed: ${err.message}`);
     return "failed";
   }
   let smokeOk = false;
   try {
-    const out = execFileSync2("agt", ["--version"], { timeout: 15e3, stdio: "pipe" }).toString();
+    const out = execFileSync3("agt", ["--version"], { timeout: 15e3, stdio: "pipe" }).toString();
     smokeOk = isAgtVersionSmokeOk(out, version);
     if (!smokeOk) {
       log(
@@ -12568,8 +12711,8 @@ function effectiveRuntimeAuthenticated() {
 async function maybeProbeClaudeRuntimeAuth() {
   if (runtimeAuthProbeInFlight) return;
   if (Date.now() - lastRuntimeAuthProbeAt < RUNTIME_AUTH_PROBE_INTERVAL_MS) return;
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  if (!claudeBinaryInstalled(execFileSync2)) return;
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  if (!claudeBinaryInstalled(execFileSync3)) return;
   runtimeAuthProbeInFlight = true;
   lastRuntimeAuthProbeAt = Date.now();
   try {
@@ -12670,7 +12813,7 @@ async function checkClaudeAuth() {
 }
 var evalEmptyMcpConfigPath = null;
 function ensureEvalEmptyMcpConfig() {
-  if (evalEmptyMcpConfigPath && existsSync14(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
+  if (evalEmptyMcpConfigPath && existsSync15(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
   const dir = join34(homedir16(), ".augmented");
   try {
     mkdirSync11(dir, { recursive: true });
@@ -12991,10 +13134,10 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-JLTLTQHQ.js");
+      const { collectDiagnostics } = await import("../persistent-session-BGMQQYW2.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
-        agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics)
+        agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
       });
     } catch (err) {
       log(`[restart] post-respawn diagnostics flush failed: ${err.message}`);
@@ -13024,7 +13167,7 @@ async function pollCycle() {
       getSlackToken: (codeName) => agentChannelTokens.get(codeName)?.slack ?? null,
       sendSlack: async (botToken, body) => {
         const controller = new AbortController();
-        const timer2 = setTimeout(() => controller.abort(), 5e3);
+        const timer3 = setTimeout(() => controller.abort(), 5e3);
         try {
           const res = await fetch("https://slack.com/api/chat.postMessage", {
             method: "POST",
@@ -13041,7 +13184,7 @@ async function pollCycle() {
           const isAbort = err.name === "AbortError";
           return { ok: false, error: isAbort ? "timeout" : err.message };
         } finally {
-          clearTimeout(timer2);
+          clearTimeout(timer3);
         }
       },
       // ENG-6399: report the restart to audit_log via POST /host/restart-event.
@@ -13099,9 +13242,9 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-JLTLTQHQ.js");
+      const { collectDiagnostics } = await import("../persistent-session-BGMQQYW2.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
-      const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics) : void 0;
+      const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor) : void 0;
       let tailscaleHostname;
       try {
         const { execSync: es } = await import("child_process");
@@ -13222,7 +13365,7 @@ async function pollCycle() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-4GJUK5GG.js");
+      } = await import("../responsiveness-probe-VAGPO5FZ.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -13313,7 +13456,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-4GJUK5GG.js");
+        } = await import("../responsiveness-probe-VAGPO5FZ.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -13402,11 +13545,11 @@ async function pollCycle() {
             );
             if (hostFlagStore().getBoolean("wedge-transient-notice")) {
               try {
-                const paneTail = readFileSync27(paneLogPath(codeName), "utf8").slice(-65536);
+                const paneTail = readFileSync28(paneLogPath(codeName), "utf8").slice(-65536);
                 const transient = detectTransientApiErrorInLog(paneTail);
                 if (transient) {
                   const wedgeHome = join34(homedir16(), ".augmented", codeName);
-                  if (existsSync14(wedgeHome)) {
+                  if (existsSync15(wedgeHome)) {
                     atomicWriteFileSync(
                       join34(wedgeHome, "watchdog-give-up.json"),
                       JSON.stringify({
@@ -13469,12 +13612,24 @@ async function pollCycle() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-CWFGB472.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
       for (const codeName of agentState.persistentSessionAgents) {
         const agentId = agentState.codeNameToAgentId.get(codeName);
         if (!agentId) continue;
+        try {
+          const authVerdict = probeSessionAuth({ projectDir: getProjectDir(codeName) });
+          if (authVerdict.state !== "ok" && lastSessionAuthDetail.get(codeName) !== authVerdict.detail) {
+            log(
+              `[session-auth] agent=${codeName} ${authVerdict.detail}${authVerdict.worst?.toolName ? ` tool=${authVerdict.worst.toolName}` : ""} \u2014 ${authVerdict.worst?.remedy ?? ""}`
+            );
+          }
+          lastSessionAuthDetail.set(codeName, authVerdict.detail);
+        } catch (err) {
+          log(`[session-auth] probe failed for ${codeName}: ${err.message}`);
+        }
         const tail = readPaneLogTail(codeName, 40);
         if (!tail) continue;
         if (modelApiErrorReportingOn) {
@@ -13777,7 +13932,7 @@ async function pollCycle() {
         // the watchdog, never fails the poll cycle.
         signalGiveUp: (codeName) => {
           const dir = join34(homedir16(), ".augmented", codeName);
-          if (!existsSync14(dir)) return;
+          if (!existsSync15(dir)) return;
           atomicWriteFileSync(
             join34(dir, "watchdog-give-up.json"),
             JSON.stringify({ gave_up_at: (/* @__PURE__ */ new Date()).toISOString() })
@@ -13975,7 +14130,7 @@ async function processAgent(agent, agentStates) {
       const residuals = {
         gatewayRunning: false,
         portAllocated: false,
-        provisionDirExists: existsSync14(agentDir)
+        provisionDirExists: existsSync15(agentDir)
       };
       if (!hasRevokedResiduals(residuals)) {
         agentStates.push({
@@ -14178,7 +14333,7 @@ async function processAgent(agent, agentStates) {
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
           const projectClaudeMd = join34(config.configDir, agent.code_name, "project", "CLAUDE.md");
-          const existing = readFileSync27(projectClaudeMd, "utf-8");
+          const existing = readFileSync28(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
           existingHash = null;
@@ -14196,7 +14351,7 @@ async function processAgent(agent, agentStates) {
         const generatorKeys = Object.keys(generatorServers);
         let existingRaw = "";
         try {
-          existingRaw = readFileSync27(filePath, "utf-8");
+          existingRaw = readFileSync28(filePath, "utf-8");
         } catch {
         }
         const existingServers = parseMcp(existingRaw);
@@ -14212,7 +14367,7 @@ async function processAgent(agent, agentStates) {
       } else if (artifact.relativePath === "opencode.json") {
         let existingRaw = null;
         try {
-          existingRaw = readFileSync27(filePath, "utf-8");
+          existingRaw = readFileSync28(filePath, "utf-8");
         } catch {
         }
         const mergeResult = mergeOpencodeConfigArtifact(artifact.content, existingRaw);
@@ -14228,7 +14383,7 @@ async function processAgent(agent, agentStates) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync14(join34(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync15(join34(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
@@ -14243,7 +14398,7 @@ async function processAgent(agent, agentStates) {
       }
       try {
         const provSkillsDir = join34(agentDir, ".claude", "skills");
-        if (existsSync14(provSkillsDir)) {
+        if (existsSync15(provSkillsDir)) {
           for (const folder of readdirSync9(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
@@ -14279,7 +14434,7 @@ async function processAgent(agent, agentStates) {
     if (Array.isArray(refreshData.workflows)) {
       try {
         const provWorkflowsDir = join34(agentDir, ".claude", "workflows");
-        if (existsSync14(provWorkflowsDir)) {
+        if (existsSync15(provWorkflowsDir)) {
           const expected = new Set(refreshData.workflows.map((w) => `${w.name}.js`));
           for (const file of readdirSync9(provWorkflowsDir)) {
             if (!file.endsWith(".js")) continue;
@@ -14364,7 +14519,7 @@ async function processAgent(agent, agentStates) {
   }
   let lastDriftCheckAt = now;
   const written = agentState.writtenHashes.get(agent.agent_id);
-  if (written && existsSync14(agentDir)) {
+  if (written && existsSync15(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
       const localHash = hashFile(join34(agentDir, file));
@@ -14784,7 +14939,7 @@ async function processAgent(agent, agentStates) {
       const projectMcpPath = join34(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
-        mcpConfig = JSON.parse(readFileSync27(provisionMcpPath, "utf-8"));
+        mcpConfig = JSON.parse(readFileSync28(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
@@ -14794,7 +14949,7 @@ async function processAgent(agent, agentStates) {
         const tz = directChatTeamSettings?.["timezone"];
         return typeof tz === "string" && tz.trim() !== "" ? tz.trim() : void 0;
       })();
-      if (existsSync14(localDirectChatChannel)) {
+      if (existsSync15(localDirectChatChannel)) {
         const directChatEnv = {
           AGT_HOST: requireHost(),
           // ENG-5901 Track D: templated — the manager exports the real
@@ -14835,7 +14990,7 @@ async function processAgent(agent, agentStates) {
         }
       }
       const staleChannelsPath = join34(projectDir, ".mcp-channels.json");
-      if (existsSync14(staleChannelsPath)) {
+      if (existsSync15(staleChannelsPath)) {
         try {
           rmSync5(staleChannelsPath, { force: true });
         } catch {
@@ -15051,7 +15206,7 @@ async function processAgent(agent, agentStates) {
         const envIntPath = join34(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
-          preWriteEnv = readFileSync27(envIntPath, "utf-8");
+          preWriteEnv = readFileSync28(envIntPath, "utf-8");
         } catch {
           preWriteEnv = void 0;
         }
@@ -15071,8 +15226,8 @@ async function processAgent(agent, agentStates) {
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
             const projectMcpPath = join34(projectDir, ".mcp.json");
-            const postWriteEnv = readFileSync27(envIntPath, "utf-8");
-            const mcpContent = readFileSync27(projectMcpPath, "utf-8");
+            const postWriteEnv = readFileSync28(envIntPath, "utf-8");
+            const mcpContent = readFileSync28(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
             const mcpJsonForReap = JSON.parse(mcpContent);
             const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
@@ -15347,7 +15502,7 @@ async function processAgent(agent, agentStates) {
           // install target but cheap to sweep.
           join34(agentDir, ".claude", "skills")
         ];
-        const existingDirs = candidateSkillDirs.filter((d) => existsSync14(d));
+        const existingDirs = candidateSkillDirs.filter((d) => existsSync15(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
         for (const dir of existingDirs) {
           try {
@@ -15366,7 +15521,7 @@ async function processAgent(agent, agentStates) {
             entry,
             dirs: existingDirs,
             removeDir: (p) => {
-              if (existsSync14(p)) {
+              if (existsSync15(p)) {
                 rmSync6(p, { recursive: true, force: true });
               }
             }
@@ -15414,7 +15569,7 @@ async function processAgent(agent, agentStates) {
             let prunedAny = false;
             for (const dir of globalSkillDirs) {
               const p = join34(dir, id);
-              if (existsSync14(p) && existsSync14(join34(p, "SKILL.md"))) {
+              if (existsSync15(p) && existsSync15(join34(p, "SKILL.md"))) {
                 rmSync5(p, { recursive: true, force: true });
                 prunedAny = true;
               }
@@ -15647,7 +15802,7 @@ async function processAgent(agent, agentStates) {
         let mcpJsonParsed = null;
         try {
           const mcpPath = join34(getProjectDir(agent.code_name), ".mcp.json");
-          mcpJsonParsed = JSON.parse(readFileSync27(mcpPath, "utf-8"));
+          mcpJsonParsed = JSON.parse(readFileSync28(mcpPath, "utf-8"));
         } catch {
         }
         reapMissingMcpSessions({
@@ -16078,7 +16233,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
     }
   }
   const trackedFiles = frameworkAdapter.driftTrackedFiles();
-  if (trackedFiles.length > 0 && existsSync14(agentDir)) {
+  if (trackedFiles.length > 0 && existsSync15(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
       const h = hashFile(join34(agentDir, file));
@@ -16158,6 +16313,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
 }
 var lastMcpFailedBannerCount = /* @__PURE__ */ new Map();
 var lastModelApiErrorSig = /* @__PURE__ */ new Map();
+var lastSessionAuthDetail = /* @__PURE__ */ new Map();
 var DAY_ROLLOVER_FORCE_GRACE_MIN = 30;
 var persistentSessionStuckTracker = new PersistentSessionStuckTracker();
 var claudeAuthTupleBySession = /* @__PURE__ */ new Map();
@@ -16884,10 +17040,10 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-JLTLTQHQ.js");
+        const { collectDiagnostics } = await import("../persistent-session-BGMQQYW2.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
-          agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics)
+          agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
         });
       } catch (err) {
         log(`[restart-lane] post-respawn diagnostics flush failed for '${codeName}': ${err.message}`);
@@ -16935,10 +17091,10 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-JLTLTQHQ.js");
+      const { collectDiagnostics } = await import("../persistent-session-BGMQQYW2.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
-        agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics)
+        agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
       });
     } catch (err) {
       log(`[fast-mcp-respawn] post-respawn diagnostics flush failed for '${codeName}': ${err.message}`);
@@ -17513,7 +17669,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-PBFR6UGJ.js");
+  } = await import("../claude-pair-runtime-5WB2FMIX.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -17779,14 +17935,14 @@ async function syncMemories(agent, configDir, log2) {
     }
     pendingFreshMemorySync.delete(agent.agent_id);
   }
-  if (existsSync14(memoryDir)) {
+  if (existsSync15(memoryDir)) {
     const prevHashes = memoryFileHashes.get(agent.agent_id) ?? /* @__PURE__ */ new Map();
     const currentHashes = /* @__PURE__ */ new Map();
     const changedMemories = [];
     for (const file of readdirSync9(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync27(join34(memoryDir, file), "utf-8");
+        const raw = readFileSync28(join34(memoryDir, file), "utf-8");
         const fileHash = createHash17("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
@@ -17811,7 +17967,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync27(join34(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync28(join34(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -17824,7 +17980,7 @@ async function syncMemories(agent, configDir, log2) {
   }
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
-  const localFiles = existsSync14(memoryDir) ? readdirSync9(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
+  const localFiles = existsSync15(memoryDir) ? readdirSync9(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
   const localListHash = createHash17("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
@@ -17855,10 +18011,10 @@ description: ${JSON.stringify(mem.content.slice(0, 200))}
 
 ${mem.content}
 `;
-        if (existsSync14(filePath)) {
+        if (existsSync15(filePath)) {
           let existing = "";
           try {
-            existing = readFileSync27(filePath, "utf-8");
+            existing = readFileSync28(filePath, "utf-8");
           } catch {
           }
           if (existing === desired) continue;
@@ -17882,7 +18038,7 @@ ${mem.content}
   }
 }
 async function cleanupAgentFiles(codeName, agentDir) {
-  if (existsSync14(agentDir)) {
+  if (existsSync15(agentDir)) {
     try {
       rmSync5(agentDir, { recursive: true, force: true });
       log(`Removed provision directory for '${codeName}'`);
@@ -17990,6 +18146,7 @@ function startPolling() {
   }, LIVENESS_HEARTBEAT_INTERVAL_MS);
   livenessTimer.unref();
   startPaneOccupancySampler(() => agentState.persistentSessionAgents);
+  startPidPressureSampler(() => agentState.persistentSessionAgents);
   void startCaffeinate();
   loadChannelHashCache2();
   loadSenderPolicyBaseline2();
@@ -18084,6 +18241,7 @@ async function stopPolling(opts = {}) {
     livenessTimer = null;
   }
   stopPaneOccupancySampler();
+  stopPidPressureSampler();
   const shutdownTimer = setTimeout(() => {
     log("Shutdown timeout exceeded (15s), forcing exit");
     process.exit(opts.forcedExitCode ?? 1);
@@ -18124,8 +18282,8 @@ function startManager(opts) {
   config = opts;
   try {
     const stateFile = getStateFile();
-    if (existsSync14(stateFile)) {
-      const raw = readFileSync27(stateFile, "utf-8");
+    if (existsSync15(stateFile)) {
+      const raw = readFileSync28(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
         state7.agents = parsed.agents;
@@ -18181,7 +18339,7 @@ async function reapOrphanedClaudePids() {
   const looksLikeClaude = (pid) => {
     if (process.platform !== "linux") return true;
     try {
-      const comm = readFileSync27(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
+      const comm = readFileSync28(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
       return comm.includes("claude");
     } catch {
       return false;
@@ -18285,7 +18443,7 @@ function deployMcpAssets() {
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
     const candidate = join34(dir, "dist", "mcp");
-    if (existsSync14(join34(candidate, "index.js"))) {
+    if (existsSync15(join34(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
@@ -18300,8 +18458,8 @@ function deployMcpAssets() {
   const changedBasenames = [];
   const fileHash = (p) => {
     try {
-      if (!existsSync14(p)) return null;
-      return createHash17("sha256").update(readFileSync27(p)).digest("hex");
+      if (!existsSync15(p)) return null;
+      return createHash17("sha256").update(readFileSync28(p)).digest("hex");
     } catch {
       return null;
     }
@@ -18374,7 +18532,7 @@ function deployMcpAssets() {
   ]) {
     const src = join34(mcpSourceDir, file);
     const dst = join34(targetDir, file);
-    if (!existsSync14(src)) continue;
+    if (!existsSync15(src)) continue;
     const before = fileHash(dst);
     try {
       copyFileSync(src, dst);
@@ -18394,13 +18552,13 @@ function deployMcpAssets() {
   const localMcpPath = join34(targetDir, "index.js");
   try {
     const agentsDir = join34(homedir16(), ".augmented", "agents");
-    if (existsSync14(agentsDir)) {
+    if (existsSync15(agentsDir)) {
       for (const entry of readdirSync9(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
           const mcpJsonPath = join34(agentsDir, entry.name, subdir, ".mcp.json");
           try {
-            const raw = readFileSync27(mcpJsonPath, "utf-8");
+            const raw = readFileSync28(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
             const mcpConfig = JSON.parse(raw);
             const augServer = mcpConfig.mcpServers?.["augmented"];