@integrity-labs/agt-cli 0.28.658 → 0.28.660

package/dist/{chunk-QIOFZ6EP.js → chunk-ESEOTR5J.js}

@@ -8,7 +8,7 @@ import {
   isolationMode,
   log,
   parseEnvIntegrations
-} from "./chunk-LAYT5BNW.js";
+} from "./chunk-Y63W2XP5.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -55,7 +55,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-RASKCVAA.js";
+} from "./chunk-VR3VB3FR.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -469,9 +469,9 @@ function mergeEnvIntegrationsContent(existing, args) {
 }
 
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, existsSync as existsSync3, chmodSync as chmodSync3, readdirSync, rmSync, copyFileSync, lstatSync, realpathSync, symlinkSync, readlinkSync, renameSync as renameSync3, opendirSync } from "fs";
-import { join as join2, relative, dirname as dirname2 } from "path";
-import { homedir as homedir2 } from "os";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync4, chmodSync as chmodSync4, readdirSync, rmSync as rmSync2, copyFileSync, lstatSync, realpathSync, symlinkSync, readlinkSync, renameSync as renameSync4, opendirSync } from "fs";
+import { join as join3, relative, dirname as dirname3 } from "path";
+import { homedir as homedir3 } from "os";
 import { execFile } from "child_process";
 
 // ../../packages/core/dist/integrations/xurl-config.js
@@ -636,6 +636,255 @@ function writeXurlStoreForIntegrations(integrations, filePath = getXurlStorePath
   return filePath;
 }
 
+// ../../packages/core/dist/integrations/framer-credentials.js
+import { chmodSync as chmodSync3, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync3, rmSync, statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+var FRAMER_PROJECTS_CONFIG_VERSION = 2;
+var BARE_PROJECT_ID = /^[A-Za-z0-9]{20}$/u;
+var SLUGGED_PROJECT_ID = /^.+--([A-Za-z0-9]+)/u;
+function parseFramerProjectId(projectUrlOrId) {
+  const input = projectUrlOrId.trim();
+  if (!input)
+    return null;
+  if (BARE_PROJECT_ID.test(input))
+    return input;
+  try {
+    const segments = new URL(input, "https://framer.com").pathname.split("/").filter(Boolean);
+    const marker = segments.findIndex((s) => s.toLowerCase() === "projects");
+    if (marker < 0)
+      return null;
+    const raw = segments[marker + 1];
+    if (raw === void 0)
+      return null;
+    const decoded = decodeURIComponent(raw);
+    const candidate = decoded.match(SLUGGED_PROJECT_ID)?.[1] ?? decoded;
+    return BARE_PROJECT_ID.test(candidate) ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+function parseExistingConfig(existing) {
+  if (!existing || !existing.trim())
+    return { kind: "empty" };
+  let parsed;
+  try {
+    parsed = JSON.parse(existing);
+  } catch {
+    return { kind: "empty" };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { kind: "empty" };
+  }
+  const candidate = parsed;
+  if (candidate.version !== FRAMER_PROJECTS_CONFIG_VERSION) {
+    return { kind: "unsupported" };
+  }
+  const projects = candidate.projects;
+  if (typeof projects !== "object" || projects === null || Array.isArray(projects)) {
+    return { kind: "empty" };
+  }
+  return { kind: "ok", projects: { ...projects } };
+}
+function mergeFramerProjectsConfig(existing, inputs, options = {}) {
+  const parsed = parseExistingConfig(existing);
+  const written = [];
+  const skipped = [];
+  const removed = [];
+  if (parsed.kind === "unsupported") {
+    return { content: null, written, skipped: [...inputs], removed, unsupported: true };
+  }
+  const projects = parsed.kind === "ok" ? { ...parsed.projects } : {};
+  for (const input of inputs) {
+    const projectId = parseFramerProjectId(input.projectUrlOrId);
+    if (!projectId || !input.apiKey) {
+      skipped.push(input);
+      continue;
+    }
+    const previous = projects[projectId];
+    projects[projectId] = {
+      // Preserve vendor-managed bookkeeping (userId, lastUsedAt) the CLI wrote
+      // itself — dropping them would make every provisioning pass look to Framer
+      // like a brand new client.
+      ...previous,
+      apiKey: input.apiKey,
+      ...input.name ? { name: input.name } : {}
+    };
+    written.push(projectId);
+  }
+  const stillManaged = new Set(written);
+  for (const id of options.previouslyManagedIds ?? []) {
+    if (!stillManaged.has(id) && id in projects) {
+      delete projects[id];
+      removed.push(id);
+    }
+  }
+  if (written.length === 0 && removed.length === 0) {
+    return { content: null, written, skipped, removed, unsupported: false };
+  }
+  const config = {
+    version: FRAMER_PROJECTS_CONFIG_VERSION,
+    projects
+  };
+  return {
+    content: `${JSON.stringify(config, null, "	")}
+`,
+    written,
+    skipped,
+    removed,
+    unsupported: false
+  };
+}
+var FRAMER_FILE_MODE = 384;
+var MANAGED_SIDECAR_NAME = ".augmented-managed-projects.json";
+function sidecarPathFor(projectsPath) {
+  return join2(dirname2(projectsPath), MANAGED_SIDECAR_NAME);
+}
+function readManagedIds(projectsPath) {
+  try {
+    const raw = readFileSync3(sidecarPathFor(projectsPath), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed))
+      return [];
+    return parsed.filter((v) => typeof v === "string");
+  } catch {
+    return [];
+  }
+}
+function writeManagedIds(projectsPath, ids) {
+  const target = sidecarPathFor(projectsPath);
+  try {
+    if (ids.length === 0) {
+      try {
+        unlinkSync3(target);
+      } catch {
+      }
+      return;
+    }
+    writeFileSync3(target, `${JSON.stringify([...ids].sort(), null, "	")}
+`, {
+      mode: FRAMER_FILE_MODE
+    });
+  } catch {
+  }
+}
+var LOCK_STALE_MS = 3e4;
+var LOCK_RETRY_WAIT_MS = 20;
+var LOCK_MAX_ATTEMPTS = 50;
+function withStoreLock(projectsPath, fn) {
+  const lockDir = `${projectsPath}.lock`;
+  try {
+    mkdirSync2(dirname2(projectsPath), { recursive: true, mode: 448 });
+  } catch {
+  }
+  let held = false;
+  for (let attempt = 0; attempt < LOCK_MAX_ATTEMPTS && !held; attempt++) {
+    try {
+      mkdirSync2(lockDir);
+      held = true;
+    } catch {
+      try {
+        if (Date.now() - statSync(lockDir).mtimeMs > LOCK_STALE_MS) {
+          rmSync(lockDir, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, LOCK_RETRY_WAIT_MS);
+    }
+  }
+  if (!held) {
+    process.stderr.write(`[framer-credentials] [lock-unavailable] skipped this pass; another writer holds ${lockDir}
+`);
+    return { acquired: false };
+  }
+  try {
+    return { acquired: true, value: fn() };
+  } finally {
+    try {
+      rmSync(lockDir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function asString2(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function getFramerProjectsPath() {
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  if (xdg)
+    return join2(xdg, "framer", "projects.json");
+  const home = process.env["HOME"] ?? process.env["USERPROFILE"] ?? homedir2();
+  return join2(home, ".config", "framer", "projects.json");
+}
+function buildFramerCredentialInputs(integrations) {
+  const inputs = [];
+  for (const integration of integrations) {
+    if (integration.definition_id !== "framer")
+      continue;
+    if (integration.credentialDelivery === "broker")
+      continue;
+    const apiKey = asString2((integration.credentials ?? {})["api_key"]);
+    const cfg = integration.config ?? {};
+    const projectUrlOrId = asString2(cfg["project_url"]) ?? asString2(cfg["project_id"]);
+    if (!apiKey || !projectUrlOrId)
+      continue;
+    inputs.push({
+      projectUrlOrId,
+      apiKey,
+      ...asString2(cfg["project_name"]) ? { name: asString2(cfg["project_name"]) } : {}
+    });
+  }
+  return inputs;
+}
+function writeFramerStoreForIntegrations(integrations, filePath = getFramerProjectsPath()) {
+  const inputs = buildFramerCredentialInputs(integrations);
+  const outcome = withStoreLock(filePath, () => {
+    const previouslyManagedIds = readManagedIds(filePath);
+    if (inputs.length === 0 && previouslyManagedIds.length === 0)
+      return null;
+    let existing = null;
+    if (existsSync3(filePath)) {
+      try {
+        existing = readFileSync3(filePath, "utf-8");
+      } catch {
+        return null;
+      }
+    }
+    const { content, written, removed, unsupported } = mergeFramerProjectsConfig(existing, inputs, { previouslyManagedIds });
+    if (unsupported) {
+      process.stderr.write("[framer-credentials] [unsupported-store-version] left projects.json untouched\n");
+      return null;
+    }
+    if (!content)
+      return null;
+    mkdirSync2(dirname2(filePath), { recursive: true, mode: 448 });
+    const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+    writeFileSync3(tmpPath, content, { mode: FRAMER_FILE_MODE });
+    try {
+      renameSync3(tmpPath, filePath);
+    } catch (err) {
+      try {
+        unlinkSync3(tmpPath);
+      } catch {
+      }
+      throw err;
+    }
+    try {
+      chmodSync3(filePath, FRAMER_FILE_MODE);
+    } catch {
+    }
+    writeManagedIds(filePath, written);
+    if (removed.length > 0) {
+      process.stderr.write(`[framer-credentials] [revoked] removed ${removed.length} disconnected project credential(s)
+`);
+    }
+    return filePath;
+  });
+  return outcome.acquired ? outcome.value : null;
+}
+
 // ../../packages/core/dist/crypto/envelope.js
 import { createHash } from "crypto";
 
@@ -1325,27 +1574,27 @@ var VALID_CODE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var SECRET_FILE_MODE = 384;
 function writeEnvIntegrationsForAgent(codeName, args) {
   const agentDir = getAgentDir(codeName);
-  const envPath = join2(agentDir, ".env.integrations");
+  const envPath = join3(agentDir, ".env.integrations");
   let existing = null;
   try {
-    existing = readFileSync3(envPath, "utf-8");
+    existing = readFileSync4(envPath, "utf-8");
   } catch {
   }
   if (existing === null && Object.keys(args.updates).length === 0)
     return;
   const content = mergeEnvIntegrationsContent(existing, args);
-  writeFileSync3(envPath, content, { mode: SECRET_FILE_MODE });
+  writeFileSync4(envPath, content, { mode: SECRET_FILE_MODE });
   try {
-    chmodSync3(envPath, SECRET_FILE_MODE);
+    chmodSync4(envPath, SECRET_FILE_MODE);
   } catch {
   }
   try {
     const projectDir = getProjectDir(codeName);
-    mkdirSync2(projectDir, { recursive: true });
-    const dest = join2(projectDir, ".env.integrations");
-    writeFileSync3(dest, content, { mode: SECRET_FILE_MODE });
+    mkdirSync3(projectDir, { recursive: true });
+    const dest = join3(projectDir, ".env.integrations");
+    writeFileSync4(dest, content, { mode: SECRET_FILE_MODE });
     try {
-      chmodSync3(dest, SECRET_FILE_MODE);
+      chmodSync4(dest, SECRET_FILE_MODE);
     } catch {
     }
   } catch (err) {
@@ -1363,16 +1612,16 @@ var MIGRATABLE_FIELD_TO_ENV_VAR = {
   AGT_API_KEY: "AGT_API_KEY"
 };
 function migrateExistingLiteralSecrets(codeName) {
-  const mcpJsonPath = join2(getAgentDir(codeName), "provision", ".mcp.json");
+  const mcpJsonPath = join3(getAgentDir(codeName), "provision", ".mcp.json");
   let config;
   try {
-    config = JSON.parse(readFileSync3(mcpJsonPath, "utf-8"));
+    config = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
   } catch {
     return;
   }
   let existingEnvKeys = /* @__PURE__ */ new Set();
   try {
-    existingEnvKeys = new Set(parseEnvFileEntries(readFileSync3(join2(getAgentDir(codeName), ".env.integrations"), "utf-8")).keys());
+    existingEnvKeys = new Set(parseEnvFileEntries(readFileSync4(join3(getAgentDir(codeName), ".env.integrations"), "utf-8")).keys());
   } catch {
   }
   const updates = {};
@@ -1449,7 +1698,7 @@ function assertSafeRelativePath(relativePath) {
   }
 }
 function getHomeDir() {
-  return process.env["HOME"] ?? process.env["USERPROFILE"] ?? homedir2();
+  return process.env["HOME"] ?? process.env["USERPROFILE"] ?? homedir3();
 }
 var ID_KEYED_LAYOUT_ENABLED = false;
 var VALID_AGENT_ID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
@@ -1471,8 +1720,8 @@ function ensureIdKeyedLayout(codeName, agentId) {
   assertValidCodeName(codeName);
   assertValidAgentId(agentId);
   const home = getHomeDir();
-  const codeNamePath = join2(home, ".augmented", codeName);
-  const idPath = join2(home, ".augmented", agentId);
+  const codeNamePath = join3(home, ".augmented", codeName);
+  const idPath = join3(home, ".augmented", agentId);
   let state;
   try {
     state = lstatSync(codeNamePath).isSymbolicLink() ? "symlink" : "realdir";
@@ -1487,20 +1736,20 @@ function ensureIdKeyedLayout(codeName, agentId) {
     if (target !== agentId) {
       throw new Error(`Codename symlink ${codeNamePath} points at "${target}", expected "${agentId}"; refusing to provision over a mismatched id-keyed layout.`);
     }
-    mkdirSync2(idPath, { recursive: true });
+    mkdirSync3(idPath, { recursive: true });
     return idPath;
   }
-  mkdirSync2(idPath, { recursive: true });
+  mkdirSync3(idPath, { recursive: true });
   symlinkSync(agentId, codeNamePath);
   return idPath;
 }
 function stagedMigrationLinkPath(home, codeName) {
-  return join2(home, ".augmented", `.${codeName}.migrating`);
+  return join3(home, ".augmented", `.${codeName}.migrating`);
 }
 function cleanupStaleStagedLink(staged) {
   try {
     if (lstatSync(staged).isSymbolicLink())
-      rmSync(staged, { force: true });
+      rmSync2(staged, { force: true });
   } catch {
   }
 }
@@ -1515,8 +1764,8 @@ function migrateAgentDirToIdKeyed(codeName, agentId, opts = {}) {
   assertValidCodeName(codeName);
   assertValidAgentId(agentId);
   const home = opts.home ?? getHomeDir();
-  const codeNamePath = join2(home, ".augmented", codeName);
-  const idPath = join2(home, ".augmented", agentId);
+  const codeNamePath = join3(home, ".augmented", codeName);
+  const idPath = join3(home, ".augmented", agentId);
   const staged = stagedMigrationLinkPath(home, codeName);
   let codeNameKind;
   try {
@@ -1524,7 +1773,7 @@ function migrateAgentDirToIdKeyed(codeName, agentId, opts = {}) {
   } catch {
     codeNameKind = "absent";
   }
-  const idExists = existsSync3(idPath);
+  const idExists = existsSync4(idPath);
   if (codeNameKind === "symlink") {
     const target = readlinkSync(codeNamePath);
     if (target !== agentId) {
@@ -1534,7 +1783,7 @@ function migrateAgentDirToIdKeyed(codeName, agentId, opts = {}) {
   }
   if (codeNameKind === "absent" && idExists) {
     if (isSymlinkTo(staged, agentId)) {
-      renameSync3(staged, codeNamePath);
+      renameSync4(staged, codeNamePath);
     } else {
       cleanupStaleStagedLink(staged);
       symlinkSync(agentId, codeNamePath);
@@ -1548,21 +1797,21 @@ function migrateAgentDirToIdKeyed(codeName, agentId, opts = {}) {
   }
   cleanupStaleStagedLink(staged);
   symlinkSync(agentId, staged);
-  renameSync3(codeNamePath, idPath);
-  renameSync3(staged, codeNamePath);
+  renameSync4(codeNamePath, idPath);
+  renameSync4(staged, codeNamePath);
   return "migrated";
 }
 function getAgentDir(codeName) {
   assertValidCodeName(codeName);
-  return resolveRealAgentPath(join2(getHomeDir(), ".augmented", codeName));
+  return resolveRealAgentPath(join3(getHomeDir(), ".augmented", codeName));
 }
 var migratedCodeNames = /* @__PURE__ */ new Set();
 function migrateLegacyClaudecodeDir(codeName, log2) {
   assertValidCodeName(codeName);
   if (migratedCodeNames.has(codeName))
     return;
-  const legacyRoot = join2(getHomeDir(), ".augmented", codeName, "claudecode");
-  if (!existsSync3(legacyRoot)) {
+  const legacyRoot = join3(getHomeDir(), ".augmented", codeName, "claudecode");
+  if (!existsSync4(legacyRoot)) {
     migratedCodeNames.add(codeName);
     return;
   }
@@ -1572,33 +1821,33 @@ function migrateLegacyClaudecodeDir(codeName, log2) {
   };
   try {
     const walkAndMigrate = (srcDir, destDir) => {
-      mkdirSync2(destDir, { recursive: true });
+      mkdirSync3(destDir, { recursive: true });
       for (const entry of readdirSync(srcDir, { withFileTypes: true })) {
-        const src = join2(srcDir, entry.name);
-        const dest = join2(destDir, entry.name);
+        const src = join3(srcDir, entry.name);
+        const dest = join3(destDir, entry.name);
         if (entry.isDirectory()) {
           walkAndMigrate(src, dest);
           continue;
         }
-        if (entry.name === ".mcp.json" && existsSync3(dest)) {
+        if (entry.name === ".mcp.json" && existsSync4(dest)) {
           try {
-            const oldCfg = JSON.parse(readFileSync3(src, "utf-8"));
-            const newCfg = JSON.parse(readFileSync3(dest, "utf-8"));
+            const oldCfg = JSON.parse(readFileSync4(src, "utf-8"));
+            const newCfg = JSON.parse(readFileSync4(dest, "utf-8"));
             const merged = { mcpServers: { ...oldCfg.mcpServers ?? {}, ...newCfg.mcpServers ?? {} } };
-            writeFileSync3(dest, JSON.stringify(merged, null, 2));
+            writeFileSync4(dest, JSON.stringify(merged, null, 2));
             emit(`[migrate] '${codeName}' merged .mcp.json (${Object.keys(merged.mcpServers).length} servers)`);
           } catch (err) {
             throw new Error(`Failed merging .mcp.json (${src} \u2192 ${dest}): ${err.message}`);
           }
           continue;
         }
-        if (!existsSync3(dest)) {
+        if (!existsSync4(dest)) {
           copyFileSync(src, dest);
           continue;
         }
         try {
-          const srcStat = readFileSync3(src);
-          const destStat = readFileSync3(dest);
+          const srcStat = readFileSync4(src);
+          const destStat = readFileSync4(dest);
           if (!srcStat.equals(destStat)) {
           }
         } catch (err) {
@@ -1607,7 +1856,7 @@ function migrateLegacyClaudecodeDir(codeName, log2) {
       }
     };
     walkAndMigrate(legacyRoot, newRoot);
-    rmSync(legacyRoot, { recursive: true, force: true });
+    rmSync2(legacyRoot, { recursive: true, force: true });
     emit(`[migrate] '${codeName}': collapsed ~/.augmented/${codeName}/claudecode/ into ~/.augmented/${codeName}/`);
     migratedCodeNames.add(codeName);
   } catch (err) {
@@ -1615,25 +1864,25 @@ function migrateLegacyClaudecodeDir(codeName, log2) {
   }
 }
 function syncGitHubBrokerCredentialTooling(projectDir, enabled) {
-  const binDir = join2(projectDir, GITHUB_BROKER_BIN_DIR);
+  const binDir = join3(projectDir, GITHUB_BROKER_BIN_DIR);
   if (!enabled) {
-    rmSync(binDir, { recursive: true, force: true });
+    rmSync2(binDir, { recursive: true, force: true });
     return {};
   }
-  const helperPath = join2(binDir, GIT_CREDENTIAL_HELPER_BASENAME);
-  const shimPath = join2(binDir, GH_SHIM_BASENAME);
-  mkdirSync2(binDir, { recursive: true });
-  writeFileSync3(helperPath, renderGitCredentialHelper(), { mode: BROKER_SCRIPT_MODE });
-  chmodSync3(helperPath, BROKER_SCRIPT_MODE);
-  writeFileSync3(shimPath, renderGhShim(), { mode: BROKER_SCRIPT_MODE });
-  chmodSync3(shimPath, BROKER_SCRIPT_MODE);
+  const helperPath = join3(binDir, GIT_CREDENTIAL_HELPER_BASENAME);
+  const shimPath = join3(binDir, GH_SHIM_BASENAME);
+  mkdirSync3(binDir, { recursive: true });
+  writeFileSync4(helperPath, renderGitCredentialHelper(), { mode: BROKER_SCRIPT_MODE });
+  chmodSync4(helperPath, BROKER_SCRIPT_MODE);
+  writeFileSync4(shimPath, renderGhShim(), { mode: BROKER_SCRIPT_MODE });
+  chmodSync4(shimPath, BROKER_SCRIPT_MODE);
   return buildGitCredentialEnv(helperPath);
 }
 function getProjectDir(codeName) {
-  return join2(getAgentDir(codeName), "project");
+  return join3(getAgentDir(codeName), "project");
 }
 function getScratchDir(codeName) {
-  return join2(getAgentDir(codeName), "scratch");
+  return join3(getAgentDir(codeName), "scratch");
 }
 function sweepScratchDir(codeName, now = Date.now()) {
   const scratchDir = getScratchDir(codeName);
@@ -1646,11 +1895,11 @@ function sweepScratchDir(codeName, now = Date.now()) {
   }
   const cutoff = now - SCRATCH_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
   for (const entry of entries) {
-    const full = join2(scratchDir, entry);
+    const full = join3(scratchDir, entry);
     try {
       if (isFreshWithin(full, cutoff))
         continue;
-      rmSync(full, { recursive: true, force: true });
+      rmSync2(full, { recursive: true, force: true });
       removed += 1;
     } catch {
     }
@@ -1686,7 +1935,7 @@ function isFreshWithin(path, cutoff) {
         const child = dir.readSync();
         if (child === null)
           break;
-        queue.push(join2(current, child.name));
+        queue.push(join3(current, child.name));
         budget -= 1;
       }
     } catch {
@@ -1703,18 +1952,18 @@ function isFreshWithin(path, cutoff) {
 function syncMcpToProject(codeName) {
   const agentDir = getAgentDir(codeName);
   const projectDir = getProjectDir(codeName);
-  const provisionMcpPath = join2(agentDir, "provision", ".mcp.json");
-  const projectMcpPath = join2(projectDir, ".mcp.json");
+  const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
+  const projectMcpPath = join3(projectDir, ".mcp.json");
   try {
-    const content = readFileSync3(provisionMcpPath, "utf-8");
-    mkdirSync2(projectDir, { recursive: true });
-    writeFileSync3(projectMcpPath, content, { mode: MCP_FILE_MODE });
+    const content = readFileSync4(provisionMcpPath, "utf-8");
+    mkdirSync3(projectDir, { recursive: true });
+    writeFileSync4(projectMcpPath, content, { mode: MCP_FILE_MODE });
     try {
-      chmodSync3(projectMcpPath, MCP_FILE_MODE);
+      chmodSync4(projectMcpPath, MCP_FILE_MODE);
     } catch {
     }
     try {
-      const mismatches = mcpMirrorParityErrors(JSON.parse(content), JSON.parse(readFileSync3(projectMcpPath, "utf-8")));
+      const mismatches = mcpMirrorParityErrors(JSON.parse(content), JSON.parse(readFileSync4(projectMcpPath, "utf-8")));
       for (const m of mismatches) {
         process.stderr.write(`${formatMirrorMismatch(m)} agent=${codeName}
 `);
@@ -1728,19 +1977,19 @@ function syncMcpToProject(codeName) {
 }
 var INTEGRATIONS_SUMMARY_FILE = "integrations-summary.json";
 function integrationsSummaryPath(codeName) {
-  return join2(getAgentDir(codeName), "provision", INTEGRATIONS_SUMMARY_FILE);
+  return join3(getAgentDir(codeName), "provision", INTEGRATIONS_SUMMARY_FILE);
 }
 function writeIntegrationsSummaryForAgent(codeName, summaries) {
   const target = integrationsSummaryPath(codeName);
   try {
-    mkdirSync2(dirname2(target), { recursive: true });
-    writeFileSync3(target, JSON.stringify(summaries, null, 2));
+    mkdirSync3(dirname3(target), { recursive: true });
+    writeFileSync4(target, JSON.stringify(summaries, null, 2));
   } catch {
   }
 }
 function readIntegrationsSummaryForAgent(codeName) {
   try {
-    const raw = readFileSync3(integrationsSummaryPath(codeName), "utf-8");
+    const raw = readFileSync4(integrationsSummaryPath(codeName), "utf-8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed) ? parsed : [];
   } catch {
@@ -1750,10 +1999,10 @@ function readIntegrationsSummaryForAgent(codeName) {
 function renderChannelMessageHandlerForAgent(codeName) {
   const agentDir = getAgentDir(codeName);
   const projectDir = getProjectDir(codeName);
-  const provisionMcpPath = join2(agentDir, "provision", ".mcp.json");
+  const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
   let mcpServerKeys;
   try {
-    const config = JSON.parse(readFileSync3(provisionMcpPath, "utf-8"));
+    const config = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
     mcpServerKeys = Object.keys(config.mcpServers ?? {});
   } catch {
     return;
@@ -1761,10 +2010,10 @@ function renderChannelMessageHandlerForAgent(codeName) {
   const integrations = readIntegrationsSummaryForAgent(codeName);
   const content = buildChannelMessageHandlerAgent({ mcpServerKeys, integrations });
   for (const baseDir of [agentDir, projectDir]) {
-    const target = join2(baseDir, ".claude", "agents", "channel-message-handler.md");
+    const target = join3(baseDir, ".claude", "agents", "channel-message-handler.md");
     try {
-      mkdirSync2(dirname2(target), { recursive: true });
-      writeFileSync3(target, content);
+      mkdirSync3(dirname3(target), { recursive: true });
+      writeFileSync4(target, content);
     } catch {
     }
   }
@@ -1779,9 +2028,9 @@ function writeMcpJsonGuarded(codeName, path, config) {
   return true;
 }
 function readExistingMcpEnvVar(codeName, serverId, envKey) {
-  const mcpJsonPath = join2(getAgentDir(codeName), "provision", ".mcp.json");
+  const mcpJsonPath = join3(getAgentDir(codeName), "provision", ".mcp.json");
   try {
-    const raw = readFileSync3(mcpJsonPath, "utf-8");
+    const raw = readFileSync4(mcpJsonPath, "utf-8");
     const config = JSON.parse(raw);
     const server = config.mcpServers?.[serverId];
     if (!server || typeof server !== "object")
@@ -1810,9 +2059,9 @@ function resolveBrokerAgentId(codeName, fallback) {
 }
 function deployArtifactsToProject(codeName, provisionDir) {
   const projectDir = getProjectDir(codeName);
-  mkdirSync2(projectDir, { recursive: true });
+  mkdirSync3(projectDir, { recursive: true });
   try {
-    mkdirSync2(getScratchDir(codeName), { recursive: true });
+    mkdirSync3(getScratchDir(codeName), { recursive: true });
     sweepScratchDir(codeName);
   } catch (err) {
     process.stderr.write(`[scratch] [ensure-or-sweep-failed] agent=${codeName} error=${err.message}
@@ -1822,135 +2071,135 @@ function deployArtifactsToProject(codeName, provisionDir) {
   const SKILLS_START = "<!-- AGT:SKILLS_INDEX_START -->";
   const SKILLS_END = "<!-- AGT:SKILLS_INDEX_END -->";
   for (const file of artifactFiles) {
-    const src = join2(provisionDir, file);
-    const dest = join2(projectDir, file);
+    const src = join3(provisionDir, file);
+    const dest = join3(projectDir, file);
     try {
-      const srcContent = readFileSync3(src, "utf-8");
-      if (file === "CLAUDE.md" && existsSync3(dest)) {
-        const destContent = readFileSync3(dest, "utf-8");
+      const srcContent = readFileSync4(src, "utf-8");
+      if (file === "CLAUDE.md" && existsSync4(dest)) {
+        const destContent = readFileSync4(dest, "utf-8");
         const stripIndex = (s) => s.replace(new RegExp(`${SKILLS_START}[\\s\\S]*?${SKILLS_END}`), "").trimEnd();
         if (stripIndex(srcContent) === stripIndex(destContent))
           continue;
         const indexMatch = destContent.match(new RegExp(`${SKILLS_START}[\\s\\S]*?${SKILLS_END}`));
         if (indexMatch) {
-          writeFileSync3(dest, srcContent.trimEnd() + "\n\n" + indexMatch[0] + "\n");
+          writeFileSync4(dest, srcContent.trimEnd() + "\n\n" + indexMatch[0] + "\n");
           continue;
         }
       }
       if (file === ".mcp.json") {
-        writeFileSync3(dest, srcContent, { mode: MCP_FILE_MODE });
+        writeFileSync4(dest, srcContent, { mode: MCP_FILE_MODE });
         try {
-          chmodSync3(dest, MCP_FILE_MODE);
+          chmodSync4(dest, MCP_FILE_MODE);
         } catch {
         }
       } else {
-        writeFileSync3(dest, srcContent);
+        writeFileSync4(dest, srcContent);
       }
     } catch {
     }
   }
-  const skillsDir = join2(provisionDir, ".claude", "skills");
-  const destSkillsDir = join2(projectDir, ".claude", "skills");
+  const skillsDir = join3(provisionDir, ".claude", "skills");
+  const destSkillsDir = join3(projectDir, ".claude", "skills");
   try {
-    if (existsSync3(destSkillsDir)) {
-      const srcFolders = existsSync3(skillsDir) ? new Set(readdirSync(skillsDir)) : /* @__PURE__ */ new Set();
+    if (existsSync4(destSkillsDir)) {
+      const srcFolders = existsSync4(skillsDir) ? new Set(readdirSync(skillsDir)) : /* @__PURE__ */ new Set();
       for (const folder of readdirSync(destSkillsDir)) {
         if (folder.startsWith("knowledge-") || folder === "core-knowledge" && !srcFolders.has(folder)) {
           try {
-            rmSync(join2(destSkillsDir, folder), { recursive: true });
+            rmSync2(join3(destSkillsDir, folder), { recursive: true });
           } catch {
           }
         }
       }
     }
-    if (existsSync3(skillsDir)) {
+    if (existsSync4(skillsDir)) {
       for (const skillFolder of readdirSync(skillsDir)) {
-        const srcSkillFile = join2(skillsDir, skillFolder, "SKILL.md");
-        if (!existsSync3(srcSkillFile))
+        const srcSkillFile = join3(skillsDir, skillFolder, "SKILL.md");
+        if (!existsSync4(srcSkillFile))
           continue;
-        const destFolder = join2(destSkillsDir, skillFolder);
-        const destFile = join2(destFolder, "SKILL.md");
-        const srcContent = readFileSync3(srcSkillFile, "utf-8");
+        const destFolder = join3(destSkillsDir, skillFolder);
+        const destFile = join3(destFolder, "SKILL.md");
+        const srcContent = readFileSync4(srcSkillFile, "utf-8");
         try {
-          if (existsSync3(destFile) && readFileSync3(destFile, "utf-8") === srcContent)
+          if (existsSync4(destFile) && readFileSync4(destFile, "utf-8") === srcContent)
             continue;
         } catch {
         }
-        mkdirSync2(destFolder, { recursive: true });
-        writeFileSync3(destFile, srcContent);
+        mkdirSync3(destFolder, { recursive: true });
+        writeFileSync4(destFile, srcContent);
       }
     }
   } catch {
   }
-  const agentsDir = join2(provisionDir, ".claude", "agents");
-  const destAgentsDir = join2(projectDir, ".claude", "agents");
+  const agentsDir = join3(provisionDir, ".claude", "agents");
+  const destAgentsDir = join3(projectDir, ".claude", "agents");
   try {
-    if (existsSync3(agentsDir)) {
+    if (existsSync4(agentsDir)) {
       const sourceAgentFiles = new Set(readdirSync(agentsDir).filter((f) => f.endsWith(".md")));
-      if (existsSync3(destAgentsDir)) {
+      if (existsSync4(destAgentsDir)) {
         for (const destFile of readdirSync(destAgentsDir)) {
           if (!destFile.endsWith(".md"))
             continue;
           if (sourceAgentFiles.has(destFile))
             continue;
           try {
-            rmSync(join2(destAgentsDir, destFile));
+            rmSync2(join3(destAgentsDir, destFile));
           } catch {
           }
         }
       }
       for (const agentFile of sourceAgentFiles) {
-        const srcPath = join2(agentsDir, agentFile);
-        const destPath = join2(destAgentsDir, agentFile);
-        const srcContent = readFileSync3(srcPath, "utf-8");
+        const srcPath = join3(agentsDir, agentFile);
+        const destPath = join3(destAgentsDir, agentFile);
+        const srcContent = readFileSync4(srcPath, "utf-8");
         try {
-          if (existsSync3(destPath) && readFileSync3(destPath, "utf-8") === srcContent)
+          if (existsSync4(destPath) && readFileSync4(destPath, "utf-8") === srcContent)
             continue;
         } catch {
         }
-        mkdirSync2(destAgentsDir, { recursive: true });
-        writeFileSync3(destPath, srcContent);
+        mkdirSync3(destAgentsDir, { recursive: true });
+        writeFileSync4(destPath, srcContent);
       }
     }
   } catch {
   }
-  const workflowsDir = join2(provisionDir, ".claude", "workflows");
-  const destWorkflowsDir = join2(projectDir, ".claude", "workflows");
+  const workflowsDir = join3(provisionDir, ".claude", "workflows");
+  const destWorkflowsDir = join3(projectDir, ".claude", "workflows");
   try {
-    const sourceWorkflowFiles = existsSync3(workflowsDir) ? new Set(readdirSync(workflowsDir).filter((f) => f.endsWith(".js"))) : /* @__PURE__ */ new Set();
-    if (existsSync3(destWorkflowsDir)) {
+    const sourceWorkflowFiles = existsSync4(workflowsDir) ? new Set(readdirSync(workflowsDir).filter((f) => f.endsWith(".js"))) : /* @__PURE__ */ new Set();
+    if (existsSync4(destWorkflowsDir)) {
       for (const destFile of readdirSync(destWorkflowsDir)) {
         if (!destFile.endsWith(".js"))
           continue;
         if (sourceWorkflowFiles.has(destFile))
           continue;
         try {
-          rmSync(join2(destWorkflowsDir, destFile));
+          rmSync2(join3(destWorkflowsDir, destFile));
         } catch {
         }
       }
     }
     for (const workflowFile of sourceWorkflowFiles) {
-      const srcPath = join2(workflowsDir, workflowFile);
-      const destPath = join2(destWorkflowsDir, workflowFile);
-      const srcContent = readFileSync3(srcPath, "utf-8");
+      const srcPath = join3(workflowsDir, workflowFile);
+      const destPath = join3(destWorkflowsDir, workflowFile);
+      const srcContent = readFileSync4(srcPath, "utf-8");
       try {
-        if (existsSync3(destPath) && readFileSync3(destPath, "utf-8") === srcContent)
+        if (existsSync4(destPath) && readFileSync4(destPath, "utf-8") === srcContent)
           continue;
       } catch {
       }
-      mkdirSync2(destWorkflowsDir, { recursive: true });
-      writeFileSync3(destPath, srcContent);
+      mkdirSync3(destWorkflowsDir, { recursive: true });
+      writeFileSync4(destPath, srcContent);
     }
   } catch {
   }
-  const agentMcpPath = join2(getAgentDir(codeName), "provision", ".mcp.json");
-  const projectMcpPath = join2(projectDir, ".mcp.json");
+  const agentMcpPath = join3(getAgentDir(codeName), "provision", ".mcp.json");
+  const projectMcpPath = join3(projectDir, ".mcp.json");
   try {
-    const agentMcp = JSON.parse(readFileSync3(agentMcpPath, "utf-8"));
+    const agentMcp = JSON.parse(readFileSync4(agentMcpPath, "utf-8"));
     let projectMcp;
     try {
-      projectMcp = JSON.parse(readFileSync3(projectMcpPath, "utf-8"));
+      projectMcp = JSON.parse(readFileSync4(projectMcpPath, "utf-8"));
     } catch {
       projectMcp = { mcpServers: {} };
     }
@@ -1961,9 +2210,9 @@ function deployArtifactsToProject(codeName, provisionDir) {
       return !(entry && typeof entry["url"] === "string" && entry["url"].startsWith("/"));
     }));
     projectMcp["mcpServers"] = { ...stripRelativeUrls(projectServers), ...stripRelativeUrls(agentServers) };
-    writeFileSync3(projectMcpPath, JSON.stringify(projectMcp, null, 2), { mode: MCP_FILE_MODE });
+    writeFileSync4(projectMcpPath, JSON.stringify(projectMcp, null, 2), { mode: MCP_FILE_MODE });
     try {
-      chmodSync3(projectMcpPath, MCP_FILE_MODE);
+      chmodSync4(projectMcpPath, MCP_FILE_MODE);
     } catch {
     }
   } catch {
@@ -1971,37 +2220,37 @@ function deployArtifactsToProject(codeName, provisionDir) {
   const agentDir = getAgentDir(codeName);
   for (const envFile of [".env", ".env.integrations"]) {
     try {
-      const content = readFileSync3(join2(agentDir, envFile), "utf-8");
-      const envDest = join2(projectDir, envFile);
-      writeFileSync3(envDest, content, { mode: SECRET_FILE_MODE });
+      const content = readFileSync4(join3(agentDir, envFile), "utf-8");
+      const envDest = join3(projectDir, envFile);
+      writeFileSync4(envDest, content, { mode: SECRET_FILE_MODE });
       try {
-        chmodSync3(envDest, SECRET_FILE_MODE);
+        chmodSync4(envDest, SECRET_FILE_MODE);
       } catch {
       }
     } catch {
     }
   }
   try {
-    const gitDir = join2(projectDir, ".git");
-    const hookSrc = join2(provisionDir, ".git-hooks", "pre-commit");
-    if (existsSync3(gitDir) && existsSync3(hookSrc)) {
-      const hooksDir = join2(gitDir, "hooks");
-      mkdirSync2(hooksDir, { recursive: true });
-      const hookDest = join2(hooksDir, "pre-commit");
-      const srcContent = readFileSync3(hookSrc, "utf-8");
-      const upToDate = existsSync3(hookDest) && readFileSync3(hookDest, "utf-8") === srcContent;
+    const gitDir = join3(projectDir, ".git");
+    const hookSrc = join3(provisionDir, ".git-hooks", "pre-commit");
+    if (existsSync4(gitDir) && existsSync4(hookSrc)) {
+      const hooksDir = join3(gitDir, "hooks");
+      mkdirSync3(hooksDir, { recursive: true });
+      const hookDest = join3(hooksDir, "pre-commit");
+      const srcContent = readFileSync4(hookSrc, "utf-8");
+      const upToDate = existsSync4(hookDest) && readFileSync4(hookDest, "utf-8") === srcContent;
       if (!upToDate)
-        writeFileSync3(hookDest, srcContent);
-      chmodSync3(hookDest, 493);
+        writeFileSync4(hookDest, srcContent);
+      chmodSync4(hookDest, 493);
     }
   } catch {
   }
 }
 function provisionStopHook(codeName) {
   const projectDir = getProjectDir(codeName);
-  const claudeDir = join2(projectDir, ".claude");
-  mkdirSync2(claudeDir, { recursive: true });
-  const hookScriptPath = join2(claudeDir, "agt-stop-hook.sh");
+  const claudeDir = join3(projectDir, ".claude");
+  mkdirSync3(claudeDir, { recursive: true });
+  const hookScriptPath = join3(claudeDir, "agt-stop-hook.sh");
   const hookScript = [
     "#!/bin/bash",
     "# Auto-generated by Augmented \u2014 captures persistent session task results.",
@@ -2032,8 +2281,8 @@ function provisionStopHook(codeName) {
     "esac",
     "exit 0"
   ].join("\n") + "\n";
-  writeFileSync3(hookScriptPath, hookScript, { mode: 493 });
-  const ghostHookPath = join2(claudeDir, "agt-ghost-reply-hook.sh");
+  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  const ghostHookPath = join3(claudeDir, "agt-ghost-reply-hook.sh");
   const jqNormalizeContent = '(.message.content // .content // []) | if type == "string" then [{type: "text", text: .}] elif type == "array" then . else [] end';
   const ghostHookScript = [
     "#!/bin/bash",
@@ -2905,12 +3154,12 @@ function provisionStopHook(codeName) {
     "fi",
     "exit 0"
   ].join("\n") + "\n";
-  writeFileSync3(ghostHookPath, ghostHookScript, { mode: 493 });
+  writeFileSync4(ghostHookPath, ghostHookScript, { mode: 493 });
   const backlogHookPath = provisionBacklogPullHook(codeName);
-  const settingsPath = join2(claudeDir, "settings.local.json");
+  const settingsPath = join3(claudeDir, "settings.local.json");
   let settings = {};
   try {
-    settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
   } catch {
   }
   const hooks = settings["hooks"] ?? {};
@@ -2924,21 +3173,21 @@ function provisionStopHook(codeName) {
     }
   ];
   settings["hooks"] = hooks;
-  writeFileSync3(settingsPath, JSON.stringify(settings, null, 2));
+  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
 }
 function provisionIsolationHook(codeName, agentId) {
   const projectDir = getProjectDir(codeName);
-  const claudeDir = join2(projectDir, ".claude");
-  mkdirSync2(claudeDir, { recursive: true });
+  const claudeDir = join3(projectDir, ".claude");
+  mkdirSync3(claudeDir, { recursive: true });
   const hasAgentId = agentId !== void 0;
   if (hasAgentId)
     assertValidAgentId(agentId);
   const homeDir = getHomeDir();
-  const augmentedBase = join2(homeDir, ".augmented");
+  const augmentedBase = join3(homeDir, ".augmented");
   const ownAgentDir = getAgentDir(codeName);
-  const logFile = join2(ownAgentDir, "isolation.log");
+  const logFile = join3(ownAgentDir, "isolation.log");
   const idAllowClause = hasAgentId ? ` && [ "$AGENT_DIR" != "${agentId}" ]` : "";
-  const hookScriptPath = join2(claudeDir, "agt-isolation-hook.sh");
+  const hookScriptPath = join3(claudeDir, "agt-isolation-hook.sh");
   const hookScript = [
     "#!/bin/bash",
     "# Auto-generated by Augmented \u2014 prevents cross-agent file access.",
@@ -2991,11 +3240,11 @@ function provisionIsolationHook(codeName, agentId) {
     "",
     "exit 0"
   ].join("\n") + "\n";
-  writeFileSync3(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join2(claudeDir, "settings.local.json");
+  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  const settingsPath = join3(claudeDir, "settings.local.json");
   let settings = {};
   try {
-    settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
   } catch {
   }
   const hooks = settings["hooks"] ?? {};
@@ -3010,13 +3259,13 @@ function provisionIsolationHook(codeName, agentId) {
     }
   ];
   settings["hooks"] = hooks;
-  writeFileSync3(settingsPath, JSON.stringify(settings, null, 2));
+  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
 }
 function provisionBacklogPullHook(codeName) {
   const projectDir = getProjectDir(codeName);
-  const claudeDir = join2(projectDir, ".claude");
-  mkdirSync2(claudeDir, { recursive: true });
-  const hookScriptPath = join2(claudeDir, "agt-backlog-pull-hook.sh");
+  const claudeDir = join3(projectDir, ".claude");
+  mkdirSync3(claudeDir, { recursive: true });
+  const hookScriptPath = join3(claudeDir, "agt-backlog-pull-hook.sh");
   const hookScript = `#!/usr/bin/env bash
 # Auto-generated by Augmented (CS-1549) \u2014 Stop hook: don't end a turn idle
 # beside a non-empty backlog. Fail-open on every path; blocks at most once per
@@ -3141,14 +3390,14 @@ If you genuinely should not pull it, say so in one line and why (it is deliberat
 jq -cn --arg r "$REASON" '{decision:"block", reason:$r}'
 exit 0
 `;
-  writeFileSync3(hookScriptPath, hookScript, { mode: 493 });
+  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
   return hookScriptPath;
 }
 function provisionAutoKanbanProgressHook(codeName) {
   const projectDir = getProjectDir(codeName);
-  const claudeDir = join2(projectDir, ".claude");
-  mkdirSync2(claudeDir, { recursive: true });
-  const hookScriptPath = join2(claudeDir, "agt-auto-kanban-progress-hook.sh");
+  const claudeDir = join3(projectDir, ".claude");
+  mkdirSync3(claudeDir, { recursive: true });
+  const hookScriptPath = join3(claudeDir, "agt-auto-kanban-progress-hook.sh");
   const hookScript = `#!/usr/bin/env bash
 # Auto-generated by Augmented (ENG-6179 / ENG-6241) \u2014 PostToolUse auto-progress.
 # Maps the agent's latest tool action onto its active in-thread kanban progress
@@ -3256,11 +3505,11 @@ BODY="$(jq -nc --arg a "$AGENT_ID" --arg s "$STEP" '{agent_id:$a, step:$s}' 2>/d
 
 exit 0
 `;
-  writeFileSync3(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join2(claudeDir, "settings.local.json");
+  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  const settingsPath = join3(claudeDir, "settings.local.json");
   let settings = {};
   try {
-    settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
   } catch {
   }
   const hooks = settings["hooks"] ?? {};
@@ -3272,13 +3521,13 @@ exit 0
     }
   ];
   settings["hooks"] = hooks;
-  writeFileSync3(settingsPath, JSON.stringify(settings, null, 2));
+  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
 }
 function provisionChannelProgressHook(codeName) {
   const projectDir = getProjectDir(codeName);
-  const claudeDir = join2(projectDir, ".claude");
-  mkdirSync2(claudeDir, { recursive: true });
-  const hookScriptPath = join2(claudeDir, "agt-channel-progress-hook.sh");
+  const claudeDir = join3(projectDir, ".claude");
+  mkdirSync3(claudeDir, { recursive: true });
+  const hookScriptPath = join3(claudeDir, "agt-channel-progress-hook.sh");
   const hookScript = `#!/usr/bin/env bash
 # Auto-generated by Augmented (ENG-6567 Phase 2) \u2014 PostToolUse channel-progress
 # heartbeat. Writes a throttled local {step, updated_at_ms} the channel MCP reads
@@ -3345,11 +3594,11 @@ else
 fi
 exit 0
 `;
-  writeFileSync3(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join2(claudeDir, "settings.local.json");
+  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  const settingsPath = join3(claudeDir, "settings.local.json");
   let settings = {};
   try {
-    settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
   } catch {
   }
   const hooks = settings["hooks"] ?? {};
@@ -3365,14 +3614,14 @@ exit 0
   }
   hooks["PostToolUse"] = groups;
   settings["hooks"] = hooks;
-  writeFileSync3(settingsPath, JSON.stringify(settings, null, 2));
+  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
 }
 function provisionOrientHook(codeName) {
   const projectDir = getProjectDir(codeName);
-  const claudeDir = join2(projectDir, ".claude");
-  mkdirSync2(claudeDir, { recursive: true });
+  const claudeDir = join3(projectDir, ".claude");
+  mkdirSync3(claudeDir, { recursive: true });
   const agentDir = getAgentDir(codeName);
-  const hookScriptPath = join2(claudeDir, "agt-orient-hook.sh");
+  const hookScriptPath = join3(claudeDir, "agt-orient-hook.sh");
   const hookScript = [
     "#!/bin/bash",
     "# Auto-generated by Augmented (ENG-5397) \u2014 SessionStart orientation hook.",
@@ -3522,11 +3771,11 @@ function provisionOrientHook(codeName) {
     "fi",
     "exit 0"
   ].join("\n") + "\n";
-  writeFileSync3(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join2(claudeDir, "settings.local.json");
+  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  const settingsPath = join3(claudeDir, "settings.local.json");
   let settings = {};
   try {
-    settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
   } catch {
   }
   const hooks = settings["hooks"] ?? {};
@@ -3546,15 +3795,15 @@ function provisionOrientHook(codeName) {
   }
   hooks["SessionStart"] = existingSessionStart;
   settings["hooks"] = hooks;
-  writeFileSync3(settingsPath, JSON.stringify(settings, null, 2));
+  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
 }
 function provisionPreCompactHook(codeName) {
   const projectDir = getProjectDir(codeName);
-  const claudeDir = join2(projectDir, ".claude");
-  mkdirSync2(claudeDir, { recursive: true });
+  const claudeDir = join3(projectDir, ".claude");
+  mkdirSync3(claudeDir, { recursive: true });
   const agentDir = getAgentDir(codeName);
   const jqNormalizeContent = '(.message.content // .content // []) | if type == "string" then [{type: "text", text: .}] elif type == "array" then . else [] end';
-  const hookScriptPath = join2(claudeDir, "agt-pre-compact-hook.sh");
+  const hookScriptPath = join3(claudeDir, "agt-pre-compact-hook.sh");
   const hookScript = [
     "#!/bin/bash",
     "# Auto-generated by Augmented (ENG-7339) - PreCompact courtesy notice.",
@@ -3658,12 +3907,12 @@ function provisionPreCompactHook(codeName) {
     'if [ "$WROTE" = "1" ]; then date +%s > "$NOTICE_MARKER" 2>/dev/null || true; fi',
     "exit 0"
   ].join("\n") + "\n";
-  writeFileSync3(hookScriptPath, hookScript, { mode: 493 });
-  chmodSync3(hookScriptPath, 493);
-  const settingsPath = join2(claudeDir, "settings.local.json");
+  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  chmodSync4(hookScriptPath, 493);
+  const settingsPath = join3(claudeDir, "settings.local.json");
   let settings = {};
   try {
-    settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
   } catch {
   }
   const hooks = settings["hooks"] ?? {};
@@ -3683,14 +3932,14 @@ function provisionPreCompactHook(codeName) {
   }
   hooks["PreCompact"] = existingPreCompact;
   settings["hooks"] = hooks;
-  writeFileSync3(settingsPath, JSON.stringify(settings, null, 2));
+  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
 }
 function provisionSessionStateHook(codeName) {
   const projectDir = getProjectDir(codeName);
-  const claudeDir = join2(projectDir, ".claude");
-  mkdirSync2(claudeDir, { recursive: true });
+  const claudeDir = join3(projectDir, ".claude");
+  mkdirSync3(claudeDir, { recursive: true });
   const agentDir = getAgentDir(codeName);
-  const hookScriptPath = join2(claudeDir, "agt-session-state-hook.sh");
+  const hookScriptPath = join3(claudeDir, "agt-session-state-hook.sh");
   const hookScript = `#!/usr/bin/env bash
 # Auto-generated by Augmented (ENG-6233 / ENG-6268) \u2014 SessionStart session-state
 # recorder. Writes the model + session origin (which only the agent's own
@@ -3767,11 +4016,11 @@ fi
 
 exit 0
 `;
-  writeFileSync3(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join2(claudeDir, "settings.local.json");
+  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  const settingsPath = join3(claudeDir, "settings.local.json");
   let settings = {};
   try {
-    settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
   } catch {
   }
   const hooks = settings["hooks"] ?? {};
@@ -3787,13 +4036,13 @@ exit 0
   }
   hooks["SessionStart"] = existingSessionStart;
   settings["hooks"] = hooks;
-  writeFileSync3(settingsPath, JSON.stringify(settings, null, 2));
+  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
 }
 function modifyJsonConfig(filePath, fn) {
   let originalContent;
   let config;
   try {
-    originalContent = readFileSync3(filePath, "utf-8");
+    originalContent = readFileSync4(filePath, "utf-8");
     config = JSON.parse(originalContent);
   } catch {
     return;
@@ -3804,7 +4053,7 @@ function modifyJsonConfig(filePath, fn) {
   const newContent = JSON.stringify(config, null, 2);
   if (newContent === originalContent)
     return;
-  writeFileSync3(filePath, newContent);
+  writeFileSync4(filePath, newContent);
 }
 var SECRETS_DENY_PERMISSIONS = [
   // Read blocks
@@ -3902,7 +4151,7 @@ function buildSettingsJson(input) {
   const projectDir = getProjectDir(agent.code_name);
   const agentDir = getAgentDir(agent.code_name);
   const homeDir = getHomeDir();
-  const codenameAliasDir = join2(homeDir, ".augmented", agent.code_name);
+  const codenameAliasDir = join3(homeDir, ".augmented", agent.code_name);
   settings["allowedDirectories"] = [
     .../* @__PURE__ */ new Set([
       projectDir,
@@ -3911,7 +4160,7 @@ function buildSettingsJson(input) {
       // Agent's config dir (.env, schedules, registration)
       codenameAliasDir,
       // Codename symlink alias (== agentDir for legacy agents)
-      join2(homeDir, ".augmented", "_mcp"),
+      join3(homeDir, ".augmented", "_mcp"),
       // Shared MCP binaries
       "/tmp"
       // Temp files
@@ -4029,10 +4278,10 @@ ${integrationsBlock}`;
 function renderAugmentedWorkerForAgent(codeName) {
   const agentDir = getAgentDir(codeName);
   const projectDir = getProjectDir(codeName);
-  const provisionMcpPath = join2(agentDir, "provision", ".mcp.json");
+  const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
   let mcpServerKeys;
   try {
-    const config = JSON.parse(readFileSync3(provisionMcpPath, "utf-8"));
+    const config = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
     mcpServerKeys = Object.keys(config.mcpServers ?? {});
   } catch {
     return;
@@ -4040,10 +4289,10 @@ function renderAugmentedWorkerForAgent(codeName) {
   const integrations = readIntegrationsSummaryForAgent(codeName);
   const content = buildAugmentedWorkerAgent({ mcpServerKeys, integrations });
   for (const baseDir of [agentDir, projectDir]) {
-    const target = join2(baseDir, ".claude", "agents", "augmented-worker.md");
+    const target = join3(baseDir, ".claude", "agents", "augmented-worker.md");
     try {
-      mkdirSync2(dirname2(target), { recursive: true });
-      writeFileSync3(target, content);
+      mkdirSync3(dirname3(target), { recursive: true });
+      writeFileSync4(target, content);
     } catch {
     }
   }
@@ -4069,8 +4318,8 @@ function buildPostizMcpEntry(integration) {
 }
 function buildMcpJson(input) {
   const mcpServers = {};
-  const turnInitiatorFile = join2(getAgentDir(input.agent.code_name), ".current-turn-initiator.json");
-  const localMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "index.js");
+  const turnInitiatorFile = join3(getAgentDir(input.agent.code_name), ".current-turn-initiator.json");
+  const localMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "index.js");
   mcpServers["augmented"] = {
     command: "node",
     args: [localMcpPath],
@@ -4122,7 +4371,7 @@ function buildMcpJson(input) {
   const xeroIntegration = input.integrations?.find((i) => i.definition_id === "xero");
   if (xeroIntegration) {
     const brokerMode = Boolean(xeroIntegration.id);
-    const localXeroMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "xero.js");
+    const localXeroMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "xero.js");
     mcpServers["xero"] = {
       command: "node",
       args: [localXeroMcpPath],
@@ -4162,7 +4411,7 @@ function buildMcpJson(input) {
         // getProjectDir (the ADR-0049 seam), not the MCP child's inherited
         // cwd, so the path stays correct if Claude Code ever spawns the
         // server from somewhere else.
-        XERO_EXPORT_DIR: join2(getProjectDir(input.agent.code_name), "xero-exports"),
+        XERO_EXPORT_DIR: join3(getProjectDir(input.agent.code_name), "xero-exports"),
         PATH: process.env["PATH"] ?? "",
         HOME: process.env["HOME"] ?? ""
       }
@@ -4173,8 +4422,8 @@ function buildMcpJson(input) {
     mcpServers["postiz"] = buildPostizMcpEntry(postizIntegration);
   }
   const remoteOAuthProxyPaths = {
-    proxyPath: join2(getHomeDir(), ".augmented", "_mcp", "remote-oauth-proxy.js"),
-    tokenFile: join2(getProjectDir(input.agent.code_name), ".env.integrations")
+    proxyPath: join3(getHomeDir(), ".augmented", "_mcp", "remote-oauth-proxy.js"),
+    tokenFile: join3(getProjectDir(input.agent.code_name), ".env.integrations")
   };
   for (const integration of input.integrations ?? []) {
     const connectionKey = integration.connection_key;
@@ -4240,7 +4489,7 @@ function buildMcpJson(input) {
   }
   const hasAdminDebug = input.integrations?.some((i) => i.definition_id === "augmented-admin") ?? false;
   if (hasAdminDebug) {
-    const localAdminMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "augmented-admin.js");
+    const localAdminMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-admin.js");
     mcpServers["augmented-admin"] = {
       command: "node",
       args: [localAdminMcpPath],
@@ -4254,7 +4503,7 @@ function buildMcpJson(input) {
   }
   const hasSupport = input.integrations?.some((i) => i.definition_id === "augmented-support") ?? false;
   if (hasSupport) {
-    const localSupportMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "augmented-support.js");
+    const localSupportMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-support.js");
     mcpServers["augmented-support"] = {
       command: "node",
       args: [localSupportMcpPath],
@@ -4268,7 +4517,7 @@ function buildMcpJson(input) {
   }
   const hasHelpKb = input.integrations?.some((i) => i.definition_id === "augmented-help-kb") ?? false;
   if (hasHelpKb) {
-    const localHelpKbMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "augmented-help-kb.js");
+    const localHelpKbMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-help-kb.js");
     mcpServers["augmented-help-kb"] = {
       command: "node",
       args: [localHelpKbMcpPath],
@@ -4282,7 +4531,7 @@ function buildMcpJson(input) {
   }
   const origamiIntegration = input.integrations?.find((i) => i.definition_id === "origami");
   if (origamiIntegration?.stdioMcp === true && origamiIntegration.id) {
-    const localOrigamiMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "origami.js");
+    const localOrigamiMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "origami.js");
     mcpServers["origami"] = {
       command: "node",
       args: [localOrigamiMcpPath],
@@ -4526,14 +4775,14 @@ ${sections}`
   },
   async getRegisteredAgents(_profile) {
     const homeDir = getHomeDir();
-    const augDir = join2(homeDir, ".augmented");
+    const augDir = join3(homeDir, ".augmented");
     const agents = /* @__PURE__ */ new Set();
     try {
       const entries = readdirSync(augDir);
       for (const entry of entries) {
         if (entry.startsWith("_") || entry.startsWith("."))
           continue;
-        const agentRoot = join2(augDir, entry);
+        const agentRoot = join3(augDir, entry);
         let st;
         try {
           st = lstatSync(agentRoot);
@@ -4542,11 +4791,11 @@ ${sections}`
         }
         if (st.isSymbolicLink() || !st.isDirectory())
           continue;
-        if (!existsSync3(join2(agentRoot, "registration.json")))
+        if (!existsSync4(join3(agentRoot, "registration.json")))
           continue;
         let codeName = entry;
         try {
-          const reg = JSON.parse(readFileSync3(join2(agentRoot, "registration.json"), "utf8"));
+          const reg = JSON.parse(readFileSync4(join3(agentRoot, "registration.json"), "utf8"));
           if (reg && typeof reg.code_name === "string" && reg.code_name) {
             codeName = reg.code_name;
           }
@@ -4565,9 +4814,9 @@ ${sections}`
       }
       const agentDir = getAgentDir(codeName);
       const projectDir = getProjectDir(codeName);
-      mkdirSync2(agentDir, { recursive: true });
-      mkdirSync2(projectDir, { recursive: true });
-      writeFileSync3(join2(agentDir, "registration.json"), JSON.stringify({
+      mkdirSync3(agentDir, { recursive: true });
+      mkdirSync3(projectDir, { recursive: true });
+      writeFileSync4(join3(agentDir, "registration.json"), JSON.stringify({
         code_name: codeName,
         agent_id: agentId ?? null,
         team_dir: teamDir,
@@ -4575,7 +4824,7 @@ ${sections}`
         framework: "claude-code",
         registered_at: (/* @__PURE__ */ new Date()).toISOString()
       }, null, 2));
-      if (existsSync3(teamDir)) {
+      if (existsSync4(teamDir)) {
         deployArtifactsToProject(codeName, teamDir);
       }
       return true;
@@ -4586,10 +4835,10 @@ ${sections}`
   async deregisterAgent(codeName) {
     try {
       const agentDir = getAgentDir(codeName);
-      const regFile = join2(agentDir, "registration.json");
-      if (existsSync3(regFile)) {
-        const { unlinkSync: unlinkSync4 } = await import("fs");
-        unlinkSync4(regFile);
+      const regFile = join3(agentDir, "registration.json");
+      if (existsSync4(regFile)) {
+        const { unlinkSync: unlinkSync5 } = await import("fs");
+        unlinkSync5(regFile);
       }
       return true;
     } catch {
@@ -4598,7 +4847,7 @@ ${sections}`
   },
   writeAuthProfiles(codeName, profiles) {
     const agentDir = getAgentDir(codeName);
-    mkdirSync2(agentDir, { recursive: true });
+    mkdirSync3(agentDir, { recursive: true });
     const envLines = ["# Augmented auth profiles \u2014 auto-generated, do not edit"];
     for (const p of profiles) {
       if (!p.api_key)
@@ -4612,9 +4861,9 @@ ${sections}`
       }
     }
     if (envLines.length > 1) {
-      const envPath = join2(agentDir, ".env");
-      writeFileSync3(envPath, envLines.join("\n") + "\n");
-      chmodSync3(envPath, SECRET_FILE_MODE);
+      const envPath = join3(agentDir, ".env");
+      writeFileSync4(envPath, envLines.join("\n") + "\n");
+      chmodSync4(envPath, SECRET_FILE_MODE);
     }
   },
   // Claude Code has no gateway process — methods intentionally omitted
@@ -4647,7 +4896,7 @@ ${sections}`
     const senderPolicyInternalOnly = options?.senderPolicy?.internal_only === true;
     const senderPolicyEnv = senderPolicyTeamId ? { AGT_TEAM_ID: senderPolicyTeamId } : {};
     const agentDir = getAgentDir(codeName);
-    mkdirSync2(agentDir, { recursive: true });
+    mkdirSync3(agentDir, { recursive: true });
     const isPersistent = options?.sessionMode === "persistent";
     const peerDisabledMode = options?.peerDisabled ?? (options?.telegramPeerDisabled === true ? "all" : "off");
     if (channelId === "telegram") {
@@ -4655,7 +4904,7 @@ ${sections}`
       if (!botToken)
         return;
       const allowedChats = config["allowed_chats"];
-      const localTelegramChannel = join2(getHomeDir(), ".augmented", "_mcp", "telegram-channel.js");
+      const localTelegramChannel = join3(getHomeDir(), ".augmented", "_mcp", "telegram-channel.js");
       const resolvedAgtHostForTelegram = process.env["AGT_HOST"]?.trim() || "https://api.augmented.team";
       const resolvedAgtApiKeyForTelegram = process.env["AGT_API_KEY"]?.trim();
       writeEnvIntegrationsForAgent(codeName, {
@@ -4670,7 +4919,7 @@ ${sections}`
         ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {},
         ...tzEnv,
         // ENG-6582 (D16): stamp the verified turn initiator for broker MCPs.
-        AGT_TURN_INITIATOR_FILE: join2(getAgentDir(codeName), ".current-turn-initiator.json")
+        AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json")
       };
       if (allowedChats && allowedChats.length > 0) {
         telegramEnv.TELEGRAM_ALLOWED_CHATS = allowedChats.join(",");
@@ -4730,11 +4979,11 @@ ${sections}`
         args: [localTelegramChannel],
         env: telegramEnv
       };
-      const provisionMcpPath = join2(agentDir, "provision", ".mcp.json");
-      mkdirSync2(dirname2(provisionMcpPath), { recursive: true });
+      const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
+      mkdirSync3(dirname3(provisionMcpPath), { recursive: true });
       let mcpConfig2 = { mcpServers: {} };
       try {
-        mcpConfig2 = JSON.parse(readFileSync3(provisionMcpPath, "utf-8"));
+        mcpConfig2 = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
         if (!mcpConfig2.mcpServers)
           mcpConfig2.mcpServers = {};
       } catch {
@@ -4747,13 +4996,13 @@ ${sections}`
       return;
     }
     if (isPersistent && (channelId === "discord" || channelId === "slack")) {
-      const channelDir = join2(getHomeDir(), ".claude", "channels", channelId);
+      const channelDir = join3(getHomeDir(), ".claude", "channels", channelId);
       if (channelId === "discord")
-        mkdirSync2(channelDir, { recursive: true });
+        mkdirSync3(channelDir, { recursive: true });
       if (channelId === "discord") {
         const botToken = config["bot_token"];
         if (botToken) {
-          writeFileSync3(join2(channelDir, ".env"), `DISCORD_BOT_TOKEN=${botToken}
+          writeFileSync4(join3(channelDir, ".env"), `DISCORD_BOT_TOKEN=${botToken}
 `);
         }
       } else if (channelId === "slack") {
@@ -4819,11 +5068,11 @@ ${sections}`
               ...appToken ? { SLACK_APP_TOKEN: appToken } : {}
             }
           });
-          const localSlackChannel = join2(getHomeDir(), ".augmented", "_mcp", "slack-channel.js");
+          const localSlackChannel = join3(getHomeDir(), ".augmented", "_mcp", "slack-channel.js");
           const slackAvatarEnvUrl = resolveAvatarEnvUrl(options?.agentAvatarUrl).url;
           const slackEntry = {
-            command: existsSync3(localSlackChannel) ? "node" : "npx",
-            args: existsSync3(localSlackChannel) ? [localSlackChannel] : ["-y", "@augmented/claude-code-channel-slack"],
+            command: existsSync4(localSlackChannel) ? "node" : "npx",
+            args: existsSync4(localSlackChannel) ? [localSlackChannel] : ["-y", "@augmented/claude-code-channel-slack"],
             env: {
               SLACK_BOT_TOKEN: "${SLACK_BOT_TOKEN}",
               ...appToken ? { SLACK_APP_TOKEN: "${SLACK_APP_TOKEN}" } : {},
@@ -4905,14 +5154,14 @@ ${sections}`
               ...pingAllowedUsers.length > 0 ? { SLACK_PING_ALLOWED_USERS: pingAllowedUsers.join(",") } : {},
               // ENG-6563 (D16): stamp the verified turn initiator so broker MCPs
               // can forward it when the agent files an approval mid-turn.
-              AGT_TURN_INITIATOR_FILE: join2(agentDir, ".current-turn-initiator.json")
+              AGT_TURN_INITIATOR_FILE: join3(agentDir, ".current-turn-initiator.json")
             }
           };
-          const provisionMcpPath = join2(agentDir, "provision", ".mcp.json");
-          mkdirSync2(dirname2(provisionMcpPath), { recursive: true });
+          const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
+          mkdirSync3(dirname3(provisionMcpPath), { recursive: true });
           let mcpConfig2 = { mcpServers: {} };
           try {
-            mcpConfig2 = JSON.parse(readFileSync3(provisionMcpPath, "utf-8"));
+            mcpConfig2 = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
             if (!mcpConfig2.mcpServers)
               mcpConfig2.mcpServers = {};
           } catch {
@@ -4922,10 +5171,10 @@ ${sections}`
             return;
           }
           syncMcpToProject(codeName);
-          const staleChannelsPath = join2(getProjectDir(codeName), ".mcp-channels.json");
-          if (existsSync3(staleChannelsPath)) {
+          const staleChannelsPath = join3(getProjectDir(codeName), ".mcp-channels.json");
+          if (existsSync4(staleChannelsPath)) {
             try {
-              rmSync(staleChannelsPath, { force: true });
+              rmSync2(staleChannelsPath, { force: true });
             } catch {
             }
           }
@@ -4933,11 +5182,11 @@ ${sections}`
       }
       return;
     }
-    const mcpJsonPath = join2(agentDir, "provision", ".mcp.json");
-    mkdirSync2(dirname2(mcpJsonPath), { recursive: true });
+    const mcpJsonPath = join3(agentDir, "provision", ".mcp.json");
+    mkdirSync3(dirname3(mcpJsonPath), { recursive: true });
     let mcpConfig;
     try {
-      mcpConfig = JSON.parse(readFileSync3(mcpJsonPath, "utf-8"));
+      mcpConfig = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
     } catch {
       mcpConfig = { mcpServers: {} };
     }
@@ -4956,7 +5205,7 @@ ${sections}`
       const appToken = config["app_token"];
       if (!botToken)
         return;
-      const localSlackChannel = join2(getHomeDir(), ".augmented", "_mcp", "slack-channel.js");
+      const localSlackChannel = join3(getHomeDir(), ".augmented", "_mcp", "slack-channel.js");
       const slackThreadAutoFollow = config["thread_auto_follow"];
       const slackAutoFollowEnv = slackThreadAutoFollow && slackThreadAutoFollow !== "off" ? { SLACK_THREAD_AUTO_FOLLOW: slackThreadAutoFollow } : {};
       const slackChannelResponseMode = config["channel_response_mode"];
@@ -5031,7 +5280,7 @@ ${sections}`
         }
       });
       const slackAvatarEnvUrl = resolveAvatarEnvUrl(options?.agentAvatarUrl).url;
-      if (isPersistent && existsSync3(localSlackChannel)) {
+      if (isPersistent && existsSync4(localSlackChannel)) {
         mcpServers["slack"] = {
           command: "node",
           args: [localSlackChannel],
@@ -5049,7 +5298,7 @@ ${sections}`
             ...slackAgtAuthEnv,
             ...tzEnv,
             // ENG-6563 (D16): stamp the verified turn initiator for broker MCPs.
-            AGT_TURN_INITIATOR_FILE: join2(getAgentDir(codeName), ".current-turn-initiator.json"),
+            AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json"),
             // ENG-6155: avatar URL → bot Slack profile photo (see persistent
             // branch above). Mirrored here so oneshot-mode agents get it too.
             // ENG-6245: slackAvatarEnvUrl is null for data-URI / oversized values.
@@ -5074,7 +5323,7 @@ ${sections}`
             ...slackAgtAuthEnv,
             ...tzEnv,
             // ENG-6563 (D16): stamp the verified turn initiator for broker MCPs.
-            AGT_TURN_INITIATOR_FILE: join2(getAgentDir(codeName), ".current-turn-initiator.json"),
+            AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json"),
             // ENG-6155: avatar URL → bot Slack profile photo (see persistent
             // branch above). Mirrored here so oneshot-mode agents get it too.
             // ENG-6245: slackAvatarEnvUrl is null for data-URI / oversized values.
@@ -5087,12 +5336,12 @@ ${sections}`
       const clientSecret = config["client_secret"];
       if (!appId || !clientSecret)
         return;
-      const localTeamsChannel = join2(getHomeDir(), ".augmented", "_mcp", "teams-channel.js");
+      const localTeamsChannel = join3(getHomeDir(), ".augmented", "_mcp", "teams-channel.js");
       const agentDirMs = getAgentDir(codeName);
       try {
-        mkdirSync2(join2(agentDirMs, "msteams-pending-inbound", ".markers"), { recursive: true });
-        mkdirSync2(join2(agentDirMs, "msteams-pending-interactions"), { recursive: true });
-        mkdirSync2(join2(agentDirMs, "msteams-recovery-outbox"), { recursive: true });
+        mkdirSync3(join3(agentDirMs, "msteams-pending-inbound", ".markers"), { recursive: true });
+        mkdirSync3(join3(agentDirMs, "msteams-pending-interactions"), { recursive: true });
+        mkdirSync3(join3(agentDirMs, "msteams-recovery-outbox"), { recursive: true });
       } catch {
       }
       const tenantId = config["tenant_id"] ?? "common";
@@ -5154,7 +5403,7 @@ ${sections}`
         ...senderPolicyInternalOnly ? { MSTEAMS_INTERNAL_ONLY: "true" } : {},
         ...senderPolicyInternalOnly && tenantId !== "common" ? { MSTEAMS_HOME_TENANT_ID: tenantId } : {}
       };
-      if (isPersistent && existsSync3(localTeamsChannel)) {
+      if (isPersistent && existsSync4(localTeamsChannel)) {
         mcpServers["msteams"] = {
           command: "node",
           args: [localTeamsChannel],
@@ -5170,7 +5419,7 @@ ${sections}`
     }
     if (channelId === "whatsapp") {
       const provider = config["provider"] ?? "kapso";
-      const localWhatsappChannel = join2(getHomeDir(), ".augmented", "_mcp", "whatsapp-channel.js");
+      const localWhatsappChannel = join3(getHomeDir(), ".augmented", "_mcp", "whatsapp-channel.js");
       if (provider === "baileys") {
         mcpServers["whatsapp"] = {
           command: "node",
@@ -5189,7 +5438,7 @@ ${sections}`
       const phoneNumberId = config["phone_number_id"];
       if (projectApiKey && phoneNumberId) {
         try {
-          mkdirSync2(join2(getAgentDir(codeName), "whatsapp-pending-inbound"), { recursive: true });
+          mkdirSync3(join3(getAgentDir(codeName), "whatsapp-pending-inbound"), { recursive: true });
         } catch {
         }
         writeEnvIntegrationsForAgent(codeName, {
@@ -5217,11 +5466,11 @@ ${sections}`
     }
   },
   hasChannelCredentials(codeName, channelId) {
-    const provisionMcpPath = join2(getAgentDir(codeName), "provision", ".mcp.json");
-    if (!existsSync3(provisionMcpPath))
+    const provisionMcpPath = join3(getAgentDir(codeName), "provision", ".mcp.json");
+    if (!existsSync4(provisionMcpPath))
       return false;
     try {
-      const parsed = JSON.parse(readFileSync3(provisionMcpPath, "utf-8"));
+      const parsed = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
       return Boolean(parsed.mcpServers?.[channelId]);
     } catch {
       return false;
@@ -5229,7 +5478,7 @@ ${sections}`
   },
   removeChannelCredentials(codeName, channelId) {
     const agentDir = getAgentDir(codeName);
-    const mcpJsonPath = join2(agentDir, "provision", ".mcp.json");
+    const mcpJsonPath = join3(agentDir, "provision", ".mcp.json");
     modifyJsonConfig(mcpJsonPath, (config) => {
       const mcpServers = config["mcpServers"];
       if (!mcpServers || !(channelId in mcpServers))
@@ -5241,7 +5490,7 @@ ${sections}`
   },
   async updateAgentModel(codeName, model) {
     const agentDir = getAgentDir(codeName);
-    const settingsPath = join2(agentDir, "provision", "settings.json");
+    const settingsPath = join3(agentDir, "provision", "settings.json");
     let changed = false;
     modifyJsonConfig(settingsPath, (config) => {
       config["model"] = model;
@@ -5259,20 +5508,20 @@ ${sections}`
   seedProfileConfig(codeName) {
     const agentDir = getAgentDir(codeName);
     const projectDir = getProjectDir(codeName);
-    mkdirSync2(join2(agentDir, "provision"), { recursive: true });
-    mkdirSync2(projectDir, { recursive: true });
+    mkdirSync3(join3(agentDir, "provision"), { recursive: true });
+    mkdirSync3(projectDir, { recursive: true });
   },
   syncScheduledTasks(codeName, tasks) {
     const agentDir = getAgentDir(codeName);
-    const schedulesPath = join2(agentDir, "schedules.json");
+    const schedulesPath = join3(agentDir, "schedules.json");
     const mapped = mapScheduledTasks(tasks);
-    mkdirSync2(agentDir, { recursive: true });
-    writeFileSync3(schedulesPath, JSON.stringify({ schedules: mapped }, null, 2));
+    mkdirSync3(agentDir, { recursive: true });
+    writeFileSync4(schedulesPath, JSON.stringify({ schedules: mapped }, null, 2));
     return Promise.resolve();
   },
   writeIntegrations(codeName, integrations, agentId, options) {
     const agentDir = getAgentDir(codeName);
-    mkdirSync2(agentDir, { recursive: true });
+    mkdirSync3(agentDir, { recursive: true });
     const summariesForSidecar = integrations.map((i) => {
       const def = INTEGRATION_REGISTRY.find((d) => d.id === i.definition_id);
       return {
@@ -5351,6 +5600,7 @@ ${sections}`
       updates: envUpdates
     });
     writeXurlStoreForIntegrations(decryptedIntegrations);
+    writeFramerStoreForIntegrations(decryptedIntegrations);
     for (const integration of decryptedIntegrations) {
       const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
       if (!def?.nativeMcp)
@@ -5388,7 +5638,7 @@ ${sections}`
         xeroEnv.AGT_AGENT_ID = agentId;
         xeroEnv.AGT_INTEGRATION_ID = xeroIntegration.id;
       }
-      const localXeroMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "xero.js");
+      const localXeroMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "xero.js");
       this.writeMcpServer(codeName, "xero", {
         command: "node",
         args: [localXeroMcpPath],
@@ -5400,8 +5650,8 @@ ${sections}`
       this.writeMcpServer(codeName, "postiz", buildPostizMcpEntry(postizIntegration));
     }
     const remoteOAuthProxyPaths = {
-      proxyPath: join2(getHomeDir(), ".augmented", "_mcp", "remote-oauth-proxy.js"),
-      tokenFile: join2(getProjectDir(codeName), ".env.integrations")
+      proxyPath: join3(getHomeDir(), ".augmented", "_mcp", "remote-oauth-proxy.js"),
+      tokenFile: join3(getProjectDir(codeName), ".env.integrations")
     };
     for (const integration of integrations) {
       const connectionKey = integration.connection_key;
@@ -5442,7 +5692,7 @@ ${sections}`
             // ENG-6586 (D16): keep incremental cloud-broker wiring in sync with
             // buildMcpJson so agents that add cloud-broker post-provision still
             // forward the per-turn initiator.
-            AGT_TURN_INITIATOR_FILE: join2(getAgentDir(codeName), ".current-turn-initiator.json"),
+            AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json"),
             PATH: process.env["PATH"] ?? "",
             HOME: process.env["HOME"] ?? ""
           }
@@ -5466,7 +5716,7 @@ ${sections}`
             // ENG-6563 (D16): keep incremental xero-broker wiring in sync with
             // buildMcpJson so agents that add xero-broker post-provision still
             // forward the per-turn initiator.
-            AGT_TURN_INITIATOR_FILE: join2(getAgentDir(codeName), ".current-turn-initiator.json"),
+            AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json"),
             PATH: process.env["PATH"] ?? "",
             HOME: process.env["HOME"] ?? ""
           }
@@ -5475,7 +5725,7 @@ ${sections}`
     }
     const hasAdminDebug = integrations.some((i) => i.definition_id === "augmented-admin");
     if (hasAdminDebug) {
-      const localAdminMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "augmented-admin.js");
+      const localAdminMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-admin.js");
       this.writeMcpServer(codeName, "augmented-admin", {
         command: "node",
         args: [localAdminMcpPath],
@@ -5489,7 +5739,7 @@ ${sections}`
     }
     const hasSupport = integrations.some((i) => i.definition_id === "augmented-support");
     if (hasSupport) {
-      const localSupportMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "augmented-support.js");
+      const localSupportMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-support.js");
       this.writeMcpServer(codeName, "augmented-support", {
         command: "node",
         args: [localSupportMcpPath],
@@ -5503,7 +5753,7 @@ ${sections}`
     }
     const hasHelpKb = integrations.some((i) => i.definition_id === "augmented-help-kb");
     if (hasHelpKb) {
-      const localHelpKbMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "augmented-help-kb.js");
+      const localHelpKbMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-help-kb.js");
       this.writeMcpServer(codeName, "augmented-help-kb", {
         command: "node",
         args: [localHelpKbMcpPath],
@@ -5519,7 +5769,7 @@ ${sections}`
     const origamiStdioAgentId = resolveBrokerAgentId(codeName) ?? agentId;
     const origamiStdioExpected = Boolean(origamiStdio?.stdioMcp === true && origamiStdio.id);
     if (origamiStdioExpected && origamiStdioAgentId) {
-      const localOrigamiMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "origami.js");
+      const localOrigamiMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "origami.js");
       this.writeMcpServer(codeName, "origami", {
         command: "node",
         args: [localOrigamiMcpPath],
@@ -5636,9 +5886,9 @@ ${sections}`
       }
     }
     const projectDir = getProjectDir(codeName);
-    const claudeMdPath = join2(projectDir, "CLAUDE.md");
+    const claudeMdPath = join3(projectDir, "CLAUDE.md");
     try {
-      const existing = readFileSync3(claudeMdPath, "utf-8");
+      const existing = readFileSync4(claudeMdPath, "utf-8");
       const renderSection = options?.renderClaudeMdSection === true;
       const newSection = renderSection ? buildIntegrationsSection(summariesForSidecar) : "";
       const sentinelStart = INTEGRATIONS_SECTION_START.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -5655,15 +5905,15 @@ ${sections}`
         updated = existing;
       }
       if (updated !== existing)
-        writeFileSync3(claudeMdPath, updated);
+        writeFileSync4(claudeMdPath, updated);
       const agentDir2 = getAgentDir(codeName);
-      const envSrc = join2(agentDir2, ".env.integrations");
+      const envSrc = join3(agentDir2, ".env.integrations");
       try {
-        const envContent = readFileSync3(envSrc, "utf-8");
-        const envDest = join2(projectDir, ".env.integrations");
-        writeFileSync3(envDest, envContent, { mode: SECRET_FILE_MODE });
+        const envContent = readFileSync4(envSrc, "utf-8");
+        const envDest = join3(projectDir, ".env.integrations");
+        writeFileSync4(envDest, envContent, { mode: SECRET_FILE_MODE });
         try {
-          chmodSync3(envDest, SECRET_FILE_MODE);
+          chmodSync4(envDest, SECRET_FILE_MODE);
         } catch {
         }
       } catch {
@@ -5675,11 +5925,11 @@ ${sections}`
   },
   writeMcpServer(codeName, serverId, config) {
     const agentDir = getAgentDir(codeName);
-    const mcpJsonPath = join2(agentDir, "provision", ".mcp.json");
-    mkdirSync2(join2(agentDir, "provision"), { recursive: true });
+    const mcpJsonPath = join3(agentDir, "provision", ".mcp.json");
+    mkdirSync3(join3(agentDir, "provision"), { recursive: true });
     let mcpConfig;
     try {
-      mcpConfig = JSON.parse(readFileSync3(mcpJsonPath, "utf-8"));
+      mcpConfig = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
     } catch {
       mcpConfig = { mcpServers: {} };
     }
@@ -5723,7 +5973,7 @@ ${sections}`
     }
   },
   getMcpPath(codeName) {
-    return join2(getAgentDir(codeName), "provision", ".mcp.json");
+    return join3(getAgentDir(codeName), "provision", ".mcp.json");
   },
   /**
    * ENG-7994: the declared servers from `provision/.mcp.json`. Mirrors what the
@@ -5734,7 +5984,7 @@ ${sections}`
   readMcpServers(codeName) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync3(join2(getAgentDir(codeName), "provision", ".mcp.json"), "utf-8"));
+      parsed = JSON.parse(readFileSync4(join3(getAgentDir(codeName), "provision", ".mcp.json"), "utf-8"));
     } catch {
       return {};
     }
@@ -5747,10 +5997,10 @@ ${sections}`
   },
   removeMcpServer(codeName, serverId) {
     const agentDir = getAgentDir(codeName);
-    const mcpJsonPath = join2(agentDir, "provision", ".mcp.json");
+    const mcpJsonPath = join3(agentDir, "provision", ".mcp.json");
     let mcpConfig;
     try {
-      mcpConfig = JSON.parse(readFileSync3(mcpJsonPath, "utf-8"));
+      mcpConfig = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
     } catch {
       return;
     }
@@ -5769,27 +6019,27 @@ ${sections}`
     const READ_WRITE_MODE = 420;
     const agentDir = getAgentDir(codeName);
     const projectDir = getProjectDir(codeName);
-    for (const baseDir of [join2(agentDir, "skills"), join2(projectDir, ".claude", "skills")]) {
-      const skillDir = join2(baseDir, skillId);
-      mkdirSync2(skillDir, { recursive: true });
+    for (const baseDir of [join3(agentDir, "skills"), join3(projectDir, ".claude", "skills")]) {
+      const skillDir = join3(baseDir, skillId);
+      mkdirSync3(skillDir, { recursive: true });
       for (const file of files) {
         assertSafeRelativePath(file.relativePath);
-        const filePath = join2(skillDir, file.relativePath);
+        const filePath = join3(skillDir, file.relativePath);
         const rel = relative(skillDir, filePath);
         if (rel.startsWith("..") || rel === "") {
           throw new Error(`Path traversal detected: ${file.relativePath} resolves outside ${skillDir}`);
         }
-        mkdirSync2(join2(filePath, ".."), { recursive: true });
-        if (isPluginManaged && existsSync3(filePath)) {
+        mkdirSync3(join3(filePath, ".."), { recursive: true });
+        if (isPluginManaged && existsSync4(filePath)) {
           try {
-            chmodSync3(filePath, READ_WRITE_MODE);
+            chmodSync4(filePath, READ_WRITE_MODE);
           } catch {
           }
         }
-        writeFileSync3(filePath, file.content);
+        writeFileSync4(filePath, file.content);
         if (isPluginManaged) {
           try {
-            chmodSync3(filePath, READ_ONLY_MODE);
+            chmodSync4(filePath, READ_ONLY_MODE);
           } catch {
           }
         }
@@ -5798,11 +6048,11 @@ ${sections}`
   },
   installPlugin(codeName, pluginId, pluginPath, pluginConfig) {
     const agentDir = getAgentDir(codeName);
-    const pluginsJsonPath = join2(agentDir, "plugins.json");
-    mkdirSync2(agentDir, { recursive: true });
+    const pluginsJsonPath = join3(agentDir, "plugins.json");
+    mkdirSync3(agentDir, { recursive: true });
     let pluginsConfig;
     try {
-      pluginsConfig = JSON.parse(readFileSync3(pluginsJsonPath, "utf-8"));
+      pluginsConfig = JSON.parse(readFileSync4(pluginsJsonPath, "utf-8"));
     } catch {
       pluginsConfig = { plugins: {} };
     }
@@ -5815,7 +6065,7 @@ ${sections}`
       installed_at: (/* @__PURE__ */ new Date()).toISOString(),
       ...pluginConfig ? { config: pluginConfig } : {}
     };
-    writeFileSync3(pluginsJsonPath, JSON.stringify(pluginsConfig, null, 2));
+    writeFileSync4(pluginsJsonPath, JSON.stringify(pluginsConfig, null, 2));
   },
   /**
    * Full plugin provisioning: install scripts, register hooks, apply permissions,
@@ -5831,11 +6081,11 @@ ${sections}`
     assertValidCodeName(codeName);
     assertValidCodeName(plugin.slug);
     const projectDir = getProjectDir(codeName);
-    const claudeDir = join2(projectDir, ".claude");
-    mkdirSync2(claudeDir, { recursive: true });
+    const claudeDir = join3(projectDir, ".claude");
+    mkdirSync3(claudeDir, { recursive: true });
     const sourceSpec = options?.scriptSource ?? `augmented-plugin:${plugin.slug}`;
     this.installPlugin(codeName, plugin.slug, sourceSpec, contextValues);
-    const installedDir = join2(projectDir, ".claude", "plugins", plugin.slug);
+    const installedDir = join3(projectDir, ".claude", "plugins", plugin.slug);
     for (const skill of plugin.skills) {
       const skillId = skill.id;
       assertValidCodeName(skillId);
@@ -5847,10 +6097,10 @@ ${sections}`
     }
     const scriptsConfig = plugin.scripts;
     if (scriptsConfig?.hooks) {
-      const settingsPath = join2(claudeDir, "settings.local.json");
+      const settingsPath = join3(claudeDir, "settings.local.json");
       let settings = {};
       try {
-        settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
       } catch {
       }
       const existingHooks = settings["hooks"] ?? {};
@@ -5884,13 +6134,13 @@ ${sections}`
         }
       }
       settings["hooks"] = existingHooks;
-      writeFileSync3(settingsPath, JSON.stringify(settings, null, 2));
+      writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
     }
     if (plugin.allowed_tools.length > 0) {
-      const settingsPath = join2(claudeDir, "settings.local.json");
+      const settingsPath = join3(claudeDir, "settings.local.json");
       let settings = {};
       try {
-        settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
       } catch {
       }
       const existingPerms = settings["permissions"] ?? {};
@@ -5902,20 +6152,20 @@ ${sections}`
       }
       existingPerms["allow"] = allowList;
       settings["permissions"] = existingPerms;
-      writeFileSync3(settingsPath, JSON.stringify(settings, null, 2));
+      writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
     }
     if (contextValues && Object.keys(contextValues).length > 0) {
-      const configDir = join2(projectDir, `.${plugin.slug}`);
-      mkdirSync2(configDir, { recursive: true });
-      writeFileSync3(join2(configDir, "config.json"), JSON.stringify(contextValues, null, 2));
+      const configDir = join3(projectDir, `.${plugin.slug}`);
+      mkdirSync3(configDir, { recursive: true });
+      writeFileSync4(join3(configDir, "config.json"), JSON.stringify(contextValues, null, 2));
     }
   },
   executePluginHook(ctx) {
     assertValidCodeName(ctx.codeName);
-    const agentRootDir = join2(getHomeDir(), ".augmented", ctx.codeName);
+    const agentRootDir = join3(getHomeDir(), ".augmented", ctx.codeName);
     const projectDir = getProjectDir(ctx.codeName);
-    mkdirSync2(agentRootDir, { recursive: true });
-    mkdirSync2(projectDir, { recursive: true });
+    mkdirSync3(agentRootDir, { recursive: true });
+    mkdirSync3(projectDir, { recursive: true });
     const startedAt = Date.now();
     return new Promise((resolve) => {
       const child = execFile("bash", ["-c", ctx.script], {
@@ -5951,7 +6201,7 @@ ${sections}`
   },
   writeTokenFile(codeName, integrations) {
     const agentDir = getAgentDir(codeName);
-    mkdirSync2(agentDir, { recursive: true });
+    mkdirSync3(agentDir, { recursive: true });
     const tokens = {};
     for (const integration of integrations) {
       if (integration.auth_type !== "oauth2" && integration.auth_type !== "github_app")
@@ -5968,9 +6218,9 @@ ${sections}`
     }
     if (Object.keys(tokens).length === 0)
       return;
-    const tokenPath = join2(agentDir, ".tokens.json");
-    writeFileSync3(tokenPath, JSON.stringify(tokens, null, 2));
-    chmodSync3(tokenPath, SECRET_FILE_MODE);
+    const tokenPath = join3(agentDir, ".tokens.json");
+    writeFileSync4(tokenPath, JSON.stringify(tokens, null, 2));
+    chmodSync4(tokenPath, SECRET_FILE_MODE);
   }
 };
 registerFramework(claudeCodeAdapter);
@@ -5992,14 +6242,14 @@ function jsonOutput(data) {
 }
 
 // src/lib/config.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync4 } from "fs";
-import { join as join3 } from "path";
-import { homedir as homedir3 } from "os";
-var AUGMENTED_DIR = join3(homedir3(), ".augmented");
-var CONFIG_PATH = join3(AUGMENTED_DIR, "config.json");
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir4 } from "os";
+var AUGMENTED_DIR = join4(homedir4(), ".augmented");
+var CONFIG_PATH = join4(AUGMENTED_DIR, "config.json");
 function ensureAugmentedDir() {
-  if (!existsSync4(AUGMENTED_DIR)) {
-    mkdirSync3(AUGMENTED_DIR, { recursive: true });
+  if (!existsSync5(AUGMENTED_DIR)) {
+    mkdirSync4(AUGMENTED_DIR, { recursive: true });
   }
 }
 function reloadFromShellProfile() {
@@ -6008,11 +6258,11 @@ function reloadFromShellProfile() {
 function loadFromShellProfile(force = false) {
   if (!force && process.env["AGT_HOST"] && process.env["AGT_API_KEY"]) return;
   const shell = process.env["SHELL"] ?? "";
-  const home = homedir3();
-  const candidates = shell.includes("zsh") ? [join3(home, ".zshrc"), join3(home, ".zprofile")] : shell.includes("fish") ? [join3(home, ".config", "fish", "config.fish")] : [join3(home, ".bashrc"), join3(home, ".bash_profile")];
+  const home = homedir4();
+  const candidates = shell.includes("zsh") ? [join4(home, ".zshrc"), join4(home, ".zprofile")] : shell.includes("fish") ? [join4(home, ".config", "fish", "config.fish")] : [join4(home, ".bashrc"), join4(home, ".bash_profile")];
   for (const profile of candidates) {
     try {
-      const content = readFileSync4(profile, "utf-8");
+      const content = readFileSync5(profile, "utf-8");
       for (const key of ["AGT_HOST", "AGT_API_KEY", "AGT_TEAM"]) {
         if (!force && process.env[key]) continue;
         const match = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map(
@@ -6037,7 +6287,7 @@ function getApiKey() {
 }
 function getConfig() {
   try {
-    const raw = readFileSync4(CONFIG_PATH, "utf-8");
+    const raw = readFileSync5(CONFIG_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -6045,7 +6295,7 @@ function getConfig() {
 }
 function saveConfig(config) {
   ensureAugmentedDir();
-  writeFileSync4(CONFIG_PATH, JSON.stringify(config, null, 2));
+  writeFileSync5(CONFIG_PATH, JSON.stringify(config, null, 2));
 }
 function getActiveTeam() {
   const envTeam = process.env["AGT_TEAM"];
@@ -6092,7 +6342,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.658" : "dev";
+var agtCliVersion = true ? "0.28.660" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -6342,13 +6592,13 @@ async function getHostId() {
 }
 
 // src/lib/atomic-write.ts
-import { closeSync, fsyncSync, openSync, writeSync, renameSync as renameSync4, mkdirSync as mkdirSync4 } from "fs";
-import { dirname as dirname3 } from "path";
+import { closeSync, fsyncSync, openSync, writeSync, renameSync as renameSync5, mkdirSync as mkdirSync5 } from "fs";
+import { dirname as dirname4 } from "path";
 function atomicWriteFileSync(path, data) {
-  const dirPath = dirname3(path);
+  const dirPath = dirname4(path);
   const tmpPath = `${path}.tmp.${process.pid}.${Math.random().toString(36).slice(2, 8)}`;
   try {
-    mkdirSync4(dirPath, { recursive: true });
+    mkdirSync5(dirPath, { recursive: true });
   } catch {
   }
   const fd = openSync(tmpPath, "w", 420);
@@ -6361,7 +6611,7 @@ function atomicWriteFileSync(path, data) {
   } finally {
     closeSync(fd);
   }
-  renameSync4(tmpPath, path);
+  renameSync5(tmpPath, path);
   try {
     const dirFd = openSync(dirPath, "r");
     try {
@@ -6374,15 +6624,15 @@ function atomicWriteFileSync(path, data) {
 }
 
 // src/lib/feature-flags-host.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, statSync } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import { join as join5 } from "path";
 function defaultFlagsCachePath(configDir) {
-  return join4(configDir, "flags-cache.json");
+  return join5(configDir, "flags-cache.json");
 }
 function readFlagsCache(path) {
   try {
-    if (!existsSync5(path)) return null;
-    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    if (!existsSync6(path)) return null;
+    const parsed = JSON.parse(readFileSync6(path, "utf8"));
     if (!parsed || typeof parsed !== "object") return null;
     const obj = parsed;
     const flags = obj["flags"];
@@ -6408,7 +6658,7 @@ function flagsCacheAgeSeconds(cache, path, now = /* @__PURE__ */ new Date()) {
     return Math.max(0, (now.getTime() - fromRecorded) / 1e3);
   }
   try {
-    return Math.max(0, (now.getTime() - statSync(path).mtimeMs) / 1e3);
+    return Math.max(0, (now.getTime() - statSync2(path).mtimeMs) / 1e3);
   } catch {
     return null;
   }
@@ -8008,8 +8258,8 @@ function verdictForUnavailableMcpConfig(cause, ctx) {
 }
 
 // src/lib/connectivity-probe-context.ts
-import { delimiter as pathDelimiter, join as join5 } from "path";
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { delimiter as pathDelimiter, join as join6 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
 
 // src/lib/mcp-stdio-probe.ts
 import { spawn } from "child_process";
@@ -8520,7 +8770,7 @@ function resolveHttpServerEntry(entry, env) {
 function readMcpHttpServerConfig(projectDir, serverKey, env) {
   let servers;
   try {
-    const raw = readFileSync6(join5(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
     servers = JSON.parse(raw).mcpServers ?? {};
   } catch {
     return { ok: false, cause: "file-unreadable" };
@@ -8532,7 +8782,7 @@ function readMcpHttpServerConfig(projectDir, serverKey, env) {
 }
 function resolveDeclaredServerKey(projectDir, definitionId, derivedKey) {
   try {
-    const raw = readFileSync6(join5(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
     const servers = JSON.parse(raw).mcpServers ?? {};
     const declared = Object.keys(servers);
     if (derivedKey !== definitionId && derivedKey !== sanitizeServerKey(definitionId)) {
@@ -8574,7 +8824,7 @@ function resolveStdioServerEntry(entry, env) {
 function readMcpStdioServerConfig(projectDir, serverKey, env) {
   let servers;
   try {
-    const raw = readFileSync6(join5(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
     servers = JSON.parse(raw).mcpServers ?? {};
   } catch {
     return { ok: false, cause: "file-unreadable" };
@@ -8600,9 +8850,9 @@ function deriveMcpServerKey(input) {
 function buildProbeEnv(projectDir, agentId) {
   const probeEnv = { ...process.env };
   try {
-    const envIntPath = join5(projectDir, ".env.integrations");
-    if (existsSync6(envIntPath)) {
-      Object.assign(probeEnv, parseEnvIntegrations(readFileSync6(envIntPath, "utf-8")));
+    const envIntPath = join6(projectDir, ".env.integrations");
+    if (existsSync7(envIntPath)) {
+      Object.assign(probeEnv, parseEnvIntegrations(readFileSync7(envIntPath, "utf-8")));
     }
   } catch {
   }
@@ -8610,8 +8860,8 @@ function buildProbeEnv(projectDir, agentId) {
     probeEnv.AGT_AGENT_ID = agentId.trim();
   }
   try {
-    const agentBinDir = join5(projectDir, ".claude", "agt-bin");
-    if (existsSync6(agentBinDir)) {
+    const agentBinDir = join6(projectDir, ".claude", "agt-bin");
+    if (existsSync7(agentBinDir)) {
       probeEnv.PATH = probeEnv.PATH ? `${agentBinDir}${pathDelimiter}${probeEnv.PATH}` : agentBinDir;
     }
   } catch {
@@ -8747,9 +8997,9 @@ function buildConnectivityProbeDeps(projectDir, probeEnv) {
 
 // src/lib/session-tool-bind-probe-host.ts
 import { execFileSync as syncExecFile } from "child_process";
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join6 } from "path";
-import { dirname as dirname4 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join7 } from "path";
+import { dirname as dirname5 } from "path";
 function deliveryFields(i) {
   const keys = ["source_type", "provider", "mcp_command", "mcp_url", "cli_binary", "cli_package"];
   const out = {};
@@ -8762,7 +9012,7 @@ async function gatherSessionToolBindProbe(agent, integrations, projectDir, opts)
   if (integrations.length === 0) return null;
   let mcpRaw = null;
   try {
-    mcpRaw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
+    mcpRaw = readFileSync8(join7(projectDir, ".mcp.json"), "utf-8");
   } catch {
     mcpRaw = null;
   }
@@ -8855,7 +9105,7 @@ var SLACK_MCP_SERVER_KEY = "slack";
 function readSlackTransportDownKeys(projectDir) {
   const none = /* @__PURE__ */ new Set();
   try {
-    const raw = readFileSync7(join6(dirname4(projectDir), SLACK_SOCKET_STATE_FILENAME), "utf-8");
+    const raw = readFileSync8(join7(dirname5(projectDir), SLACK_SOCKET_STATE_FILENAME), "utf-8");
     const state = parseSlackSocketState(raw, Date.now());
     return isSlackInboundTransportDown(state, SLACK_TRANSPORT_DOWN_AFTER_MS) ? /* @__PURE__ */ new Set([SLACK_MCP_SERVER_KEY]) : none;
   } catch {
@@ -8971,35 +9221,35 @@ function decidePin(opts) {
 
 // src/commands/manager.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync8, realpathSync as realpathSync2 } from "fs";
-import { join as join8 } from "path";
-import { homedir as homedir4, userInfo } from "os";
+import { existsSync as existsSync9, realpathSync as realpathSync2 } from "fs";
+import { join as join9 } from "path";
+import { homedir as homedir5, userInfo } from "os";
 import { spawn as spawn3 } from "child_process";
 
 // src/lib/watchdog.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, unlinkSync as unlinkSync3, existsSync as existsSync7, mkdirSync as mkdirSync5, openSync as openSync2, closeSync as closeSync2, chmodSync as chmodSync4 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, unlinkSync as unlinkSync4, existsSync as existsSync8, mkdirSync as mkdirSync6, openSync as openSync2, closeSync as closeSync2, chmodSync as chmodSync5 } from "fs";
+import { join as join8 } from "path";
 import { spawn as spawn2, execFileSync as execFileSync3 } from "child_process";
-var DEFAULT_CONFIG_DIR = join7(process.env["HOME"] ?? "/tmp", ".augmented");
+var DEFAULT_CONFIG_DIR = join8(process.env["HOME"] ?? "/tmp", ".augmented");
 function getManagerPaths(configDir) {
   return {
-    pidFile: join7(configDir, "manager.pid"),
-    stateFile: join7(configDir, "manager-state.json"),
-    logFile: join7(configDir, "manager.log")
+    pidFile: join8(configDir, "manager.pid"),
+    stateFile: join8(configDir, "manager-state.json"),
+    logFile: join8(configDir, "manager.log")
   };
 }
 function ensureDir(configDir) {
-  if (!existsSync7(configDir)) {
-    mkdirSync5(configDir, { recursive: true });
+  if (!existsSync8(configDir)) {
+    mkdirSync6(configDir, { recursive: true });
   }
 }
 function writePidFile(configDir, pid) {
   ensureDir(configDir);
-  writeFileSync5(getManagerPaths(configDir).pidFile, String(pid), { mode: 384 });
+  writeFileSync6(getManagerPaths(configDir).pidFile, String(pid), { mode: 384 });
 }
 function readPidFile(configDir) {
   try {
-    const raw = readFileSync8(getManagerPaths(configDir).pidFile, "utf-8").trim();
+    const raw = readFileSync9(getManagerPaths(configDir).pidFile, "utf-8").trim();
     const pid = parseInt(raw, 10);
     return isNaN(pid) ? null : pid;
   } catch {
@@ -9008,7 +9258,7 @@ function readPidFile(configDir) {
 }
 function removePidFile(configDir) {
   try {
-    unlinkSync3(getManagerPaths(configDir).pidFile);
+    unlinkSync4(getManagerPaths(configDir).pidFile);
   } catch {
   }
 }
@@ -9045,7 +9295,7 @@ function defaultPgrep() {
 }
 function readStateFile(configDir) {
   try {
-    const raw = readFileSync8(getManagerPaths(configDir).stateFile, "utf-8");
+    const raw = readFileSync9(getManagerPaths(configDir).stateFile, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -9053,7 +9303,7 @@ function readStateFile(configDir) {
 }
 function removeStateFile(configDir) {
   try {
-    unlinkSync3(getManagerPaths(configDir).stateFile);
+    unlinkSync4(getManagerPaths(configDir).stateFile);
   } catch {
   }
 }
@@ -9079,7 +9329,7 @@ function startWatchdog(opts) {
     const { logFile } = getManagerPaths(configDir);
     const logFd = openSync2(logFile, "a", 384);
     try {
-      chmodSync4(logFile, 384);
+      chmodSync5(logFile, 384);
     } catch {
     }
     const intervalSec = String(Math.max(Math.floor(opts.intervalMs / 1e3), 5));
@@ -9101,7 +9351,7 @@ function startWatchdog(opts) {
     const deadline = Date.now() + 5e3;
     const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
     while (Date.now() < deadline) {
-      if (existsSync7(pidFile)) {
+      if (existsSync8(pidFile)) {
         return { pid: child.pid };
       }
       if (child.exitCode !== null) {
@@ -9207,7 +9457,7 @@ function normalizePinInEnv(env) {
 function managerStartCommand(opts) {
   const json = isJsonMode();
   if (!process.env.HOME || !process.env.HOME.trim()) {
-    const fallback = homedir4();
+    const fallback = homedir5();
     process.env.HOME = fallback;
     if (!json) {
       info(`HOME was not set in the manager env \u2014 defaulting to ${fallback}.`);
@@ -9241,7 +9491,7 @@ function managerStartCommand(opts) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join8(homedir4(), ".augmented");
+  const configDir = opts.configDir ?? join9(homedir5(), ".augmented");
   if (opts.supervise) {
     if (json) {
       jsonOutput({ ok: false, error: "--supervise is not supported with --json" });
@@ -9337,7 +9587,7 @@ function runSupervisorLoop(intervalSec, configDir) {
 }
 async function managerStopCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join8(homedir4(), ".augmented");
+  const configDir = opts.configDir ?? join9(homedir5(), ".augmented");
   try {
     const result = await stopWatchdog(configDir);
     if (!result.stopped && !result.pid) {
@@ -9365,7 +9615,7 @@ async function managerStopCommand(opts = {}) {
 }
 function managerStatusCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join8(homedir4(), ".augmented");
+  const configDir = opts.configDir ?? join9(homedir5(), ".augmented");
   const status = getManagerStatus(configDir);
   if (!status) {
     if (json) {
@@ -9437,7 +9687,7 @@ function resolveStableAgtBin(rawPath) {
   if (!prefix || !formula) return rawPath;
   const candidates = [`${prefix}/bin/${formula}`, `${prefix}/bin/agt`];
   for (const candidate of candidates) {
-    if (!existsSync8(candidate)) continue;
+    if (!existsSync9(candidate)) continue;
     try {
       realpathSync2(candidate);
       return candidate;
@@ -9457,7 +9707,7 @@ async function managerInstallCommand(opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join8(homedir4(), ".augmented");
+  const configDir = opts.configDir ?? join9(homedir5(), ".augmented");
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -9468,9 +9718,9 @@ async function managerInstallCommand(opts = {}) {
   }
   const agtBin = resolveStableAgtBin(rawAgtBin);
   if (process.platform === "darwin") {
-    const home = homedir4();
+    const home = homedir5();
     const protectedRoots = ["Documents", "Downloads", "Desktop", "Movies", "Music", "Pictures"];
-    const offending = protectedRoots.map((r) => join8(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
+    const offending = protectedRoots.map((r) => join9(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
     if (offending) {
       const msg = `agt binary at ${agtBin} sits inside a macOS TCC-protected folder (${offending}). launchd-spawned processes cannot read files there and the manager would EPERM on startup. Either install agt globally (\`npm install -g @integrity-labs/agt-cli\`) or copy the dist outside protected folders before running this command.`;
       if (json) jsonOutput({ ok: false, error: msg });
@@ -9483,7 +9733,7 @@ async function managerInstallCommand(opts = {}) {
     AGT_HOST: getHost(),
     // ?? alone wouldn't catch `HOME=""` from a stripped systemd env.
     // Treat empty / whitespace-only as missing.
-    HOME: process.env.HOME?.trim() || homedir4(),
+    HOME: process.env.HOME?.trim() || homedir5(),
     USER: process.env.USER?.trim() || userInfo().username
   };
   const apiKey = getApiKey();
@@ -9539,7 +9789,7 @@ async function managerInstallSystemUnitCommand(opts = {}) {
     return;
   }
   const user = opts.user ?? "root";
-  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join8("/home", user, ".augmented"));
+  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join9("/home", user, ".augmented"));
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -9834,4 +10084,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-QIOFZ6EP.js.map
+//# sourceMappingURL=chunk-ESEOTR5J.js.map