@integrity-labs/agt-cli 0.28.714 → 0.28.716

package/dist/bin/agt.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   ApiError,
+  DRAIN_MANIFEST_FILENAME,
   LITERAL_SECRET_PATTERNS,
   PROD_AGT_HOST,
   api,
@@ -40,10 +41,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-FBYIO3Z6.js";
+} from "../chunk-OOYUWMTR.js";
 import {
+  getProjectDir,
+  isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-F6AZ6KPI.js";
+} from "../chunk-ILDRNSOB.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -69,15 +72,18 @@ import {
   lintAll,
   lintCharter,
   lintTools,
+  markDailySessionSpawn,
   renderTemplate,
   requiredMcpWildcard,
   resolveChannels,
-  serializeManifestForSlackCli
-} from "../chunk-FM63TWR3.js";
+  serializeManifestForSlackCli,
+  sessionFileExists,
+  sessionTranscriptDir
+} from "../chunk-LHYYO4NY.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 import { homedir as homedir12 } from "os";
 import { Command } from "commander";
 
@@ -741,11 +747,11 @@ async function lintCommand(path) {
       process.exitCode = 1;
       return;
     }
-    const { readdirSync: readdirSync7, statSync: statSync5 } = await import("fs");
+    const { readdirSync: readdirSync7, statSync: statSync6 } = await import("fs");
     const entries = readdirSync7(augmentedDir);
     for (const entry of entries) {
       const entryPath = join4(augmentedDir, entry);
-      if (statSync5(entryPath).isDirectory()) {
+      if (statSync6(entryPath).isDirectory()) {
         dirs.push({ name: entry, dir: entryPath });
       }
     }
@@ -4135,6 +4141,550 @@ function formatTimestamp(iso) {
   return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}`;
 }
 
+// src/lib/restore-transcripts-aws.ts
+import { spawn as spawn3 } from "child_process";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync8, renameSync as renameSync5, statSync as statSync2, unlinkSync as unlinkSync4 } from "fs";
+import { basename as basename2, dirname as dirname5 } from "path";
+
+// src/lib/restore-transcripts.ts
+import { basename, dirname as dirname4, join as join16 } from "path";
+var OFFLINE_OBJECT_ERROR_CODE = "InvalidObjectState";
+var OFFLINE_STORAGE_CLASSES = /* @__PURE__ */ new Set(["GLACIER", "DEEP_ARCHIVE"]);
+function isOfflineStorageClass(storageClass) {
+  return !!storageClass && OFFLINE_STORAGE_CLASSES.has(storageClass.toUpperCase());
+}
+function singleEncodedDir(keys) {
+  if (keys.length === 0) return null;
+  const dirs = new Set(keys.map((k) => dirname4(k)));
+  if (dirs.size !== 1) return null;
+  const names = keys.map((k) => basename(k));
+  if (new Set(names).size !== names.length) return null;
+  return [...dirs][0];
+}
+function safeDiscard(deps, tmpPath) {
+  try {
+    deps.discard(tmpPath);
+  } catch {
+  }
+}
+async function restoreAgentTranscripts(codeName, deps) {
+  const empty = { placed: 0, skipped: 0, dropped: 0, total: 0, pinRestored: false, pinnedSessionId: null };
+  if (deps.resumeDisabled()) {
+    deps.log(
+      `[restore] AGT_DISABLE_SESSION_RESUME is set on this host \u2014 '${codeName}' will spawn with a fresh session id regardless of what is restored, so this would be a guaranteed no-op. Refusing rather than reporting a success that delivers no continuity (ENG-9567).`
+    );
+    return { status: "resume-disabled", destDir: null, ...empty };
+  }
+  const manifest = deps.readManifest();
+  if (!manifest) {
+    deps.log(
+      `[restore] NO MANIFEST for '${codeName}' at the source address \u2014 nothing describes which objects belong to this agent or which session is live. Not restoring (ENG-9567).`
+    );
+    return { status: "no-manifest", destDir: null, ...empty };
+  }
+  const destDir = deps.resolveDestTranscriptDir(codeName);
+  const keys = manifest.keys ?? [];
+  if (!singleEncodedDir(keys) && keys.length > 0) {
+    deps.log(
+      `[restore] LAYOUT MISMATCH for '${codeName}': the manifest's ${keys.length} key(s) do not share a single encoded directory, or repeat a basename. Placing by basename could overwrite one conversation with another, so nothing is placed (ENG-9567).`
+    );
+    return { status: "layout-mismatch", destDir, ...empty, total: keys.length };
+  }
+  let placed = 0;
+  let skipped = 0;
+  let dropped = 0;
+  for (const key of keys) {
+    const finalPath = join16(destDir, basename(key));
+    const tmpPath = `${finalPath}.restore-tmp`;
+    const localMs = deps.localMtimeMs(finalPath);
+    const archivedMs = Date.parse(manifest.writtenAt);
+    if (localMs !== null && (!Number.isFinite(archivedMs) || localMs >= archivedMs)) {
+      skipped += 1;
+      continue;
+    }
+    let res;
+    try {
+      res = await deps.download({ key, tmpPath });
+    } catch (err) {
+      dropped += 1;
+      safeDiscard(deps, tmpPath);
+      deps.log(
+        `[restore] download threw for '${codeName}' '${key}': ${err?.message ?? "unknown"} (ENG-9567)`
+      );
+      continue;
+    }
+    if (!res.ok && res.errorCode === OFFLINE_OBJECT_ERROR_CODE) {
+      safeDiscard(deps, tmpPath);
+      deps.log(
+        `[restore] ARCHIVE-TIERED object for '${codeName}': '${key}'${res.storageClass ? ` (${res.storageClass})` : ""} returned ${OFFLINE_OBJECT_ERROR_CODE} and must be restored to a readable tier before it can be fetched (ENG-9567).`
+      );
+      return {
+        status: "glacier",
+        destDir,
+        placed,
+        skipped,
+        dropped,
+        total: keys.length,
+        pinRestored: false,
+        pinnedSessionId: manifest.sessionPin?.currentSessionId ?? null
+      };
+    }
+    if (!res.ok) {
+      dropped += 1;
+      safeDiscard(deps, tmpPath);
+      deps.log(`[restore] download failed for '${codeName}' '${key}': ${res.detail} (ENG-9567)`);
+      continue;
+    }
+    let verified;
+    try {
+      verified = deps.verify(tmpPath);
+    } catch {
+      verified = false;
+    }
+    if (!verified) {
+      dropped += 1;
+      deps.discard(tmpPath);
+      deps.log(
+        `[restore] DROPPED '${key}' for '${codeName}' \u2014 downloaded but did not verify as a complete transcript. Leaving a clean gap rather than landing a torn file (ENG-5397/ENG-9567).`
+      );
+      continue;
+    }
+    const nowLocalMs = deps.localMtimeMs(finalPath);
+    if (nowLocalMs !== null && (!Number.isFinite(archivedMs) || nowLocalMs >= archivedMs)) {
+      skipped += 1;
+      safeDiscard(deps, tmpPath);
+      deps.log(
+        `[restore] SKIPPED '${key}' for '${codeName}' \u2014 the local transcript changed while the archived copy was downloading and is now at least as new. Keeping the local one (ENG-9567).`
+      );
+      continue;
+    }
+    try {
+      deps.commit(tmpPath, finalPath);
+    } catch (err) {
+      dropped += 1;
+      safeDiscard(deps, tmpPath);
+      deps.log(
+        `[restore] commit threw for '${codeName}' '${key}': ${err?.message ?? "unknown"} \u2014 the file did not land (ENG-9567)`
+      );
+      continue;
+    }
+    placed += 1;
+  }
+  const pinnedSessionId = manifest.sessionPin?.currentSessionId ?? null;
+  const base = { placed, skipped, dropped, total: keys.length, destDir, pinnedSessionId };
+  if (dropped > 0 && placed + skipped === 0) {
+    deps.log(
+      `[restore] FAILED for '${codeName}' \u2014 all ${dropped} file(s) were dropped; nothing was placed (ENG-9567).`
+    );
+    return { status: "failed", ...base, pinRestored: false };
+  }
+  if (!manifest.sessionPin) {
+    deps.log(
+      `[restore] NO PIN for '${codeName}' \u2014 the source could not READ its daily-session pin, so which conversation was live is unrecoverable. ${placed + skipped} file(s) are on disk as history; the next spawn starts fresh (ENG-9567).`
+    );
+    return { status: "no-pin", ...base, pinRestored: false };
+  }
+  if (!pinnedSessionId) {
+    deps.log(
+      `[restore] NO PIN for '${codeName}' \u2014 the source's pin was ${manifest.sessionPin.present ? "present but unparseable" : "genuinely absent (a fresh agent)"}, so there is no live session to resume. ${placed + skipped} file(s) are on disk as history${manifest.sessionPin.raw ? "; the raw pin bytes are in the manifest for manual recovery" : ""} (ENG-9567).`
+    );
+    return { status: "no-pin", ...base, pinRestored: false };
+  }
+  if (!deps.sessionFileExists(codeName, pinnedSessionId)) {
+    deps.log(
+      `[restore] PIN ORPHANED for '${codeName}' \u2014 the live session '${pinnedSessionId}' has no transcript on this host, so the spawner would rotate the pin away and start fresh. Not writing a pin that cannot resume (ENG-9567).`
+    );
+    return { status: "pin-orphaned", ...base, pinRestored: false };
+  }
+  const pinRestored = deps.restorePin(codeName, pinnedSessionId);
+  if (!pinRestored) {
+    deps.log(
+      `[restore] NO PIN restored for '${codeName}' \u2014 ${placed} file(s) are on disk but the pin could not be written, so the next spawn will start fresh (ENG-9567).`
+    );
+    return { status: "no-pin", ...base, pinRestored: false };
+  }
+  if (manifest.complete === false) {
+    deps.log(
+      `[restore] PARTIAL for '${codeName}' \u2014 resumable, but the source flush reported ${manifest.missing?.length ?? 0} file(s) it could not ship, so earlier history is incomplete (ENG-9566/ENG-9567).`
+    );
+  }
+  const status = dropped > 0 || manifest.complete === false ? "partial" : "restored";
+  return { status, ...base, pinRestored };
+}
+
+// src/lib/restore-transcripts-aws.ts
+var AWS_TIMEOUT_MS = 12e4;
+var AWS_META_TIMEOUT_MS = 3e4;
+function awsEnv(src) {
+  const env = { ...process.env };
+  delete env["AWS_PROFILE"];
+  delete env["AWS_DEFAULT_PROFILE"];
+  env["AWS_ACCESS_KEY_ID"] = src.credentials.accessKeyId;
+  env["AWS_SECRET_ACCESS_KEY"] = src.credentials.secretAccessKey;
+  env["AWS_SESSION_TOKEN"] = src.credentials.sessionToken;
+  return env;
+}
+function collectUtf8(stream, onChunk) {
+  if (!stream) return;
+  stream.setEncoding("utf8");
+  stream.on("data", (d) => onChunk(typeof d === "string" ? d : d.toString("utf8")));
+}
+function awsErrorCode(stderr) {
+  return /An error occurred \(([A-Za-z0-9_]+)\)/.exec(stderr)?.[1] ?? null;
+}
+function runAws(args, src, timeoutMs) {
+  return new Promise((resolve2) => {
+    const argv = src.region ? [...args, "--region", src.region] : args;
+    const child = spawn3("aws", argv, { env: awsEnv(src), stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (r) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve2(r);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish({ ok: false, stdout: "", detail: `aws timed out after ${timeoutMs}ms`, errorCode: null });
+    }, timeoutMs);
+    collectUtf8(child.stdout, (chunk) => {
+      stdout += chunk;
+    });
+    collectUtf8(child.stderr, (chunk) => {
+      stderr += chunk;
+    });
+    child.on(
+      "error",
+      (err) => finish({ ok: false, stdout: "", detail: err.message, errorCode: null })
+    );
+    child.on(
+      "close",
+      (code) => finish(
+        code === 0 ? { ok: true, stdout, detail: "", errorCode: null } : {
+          ok: false,
+          stdout,
+          detail: stderr.trim().slice(0, 500) || `aws exited with code ${code ?? "null"}`,
+          errorCode: awsErrorCode(stderr)
+        }
+      )
+    );
+  });
+}
+function parseObjectListing(stdout) {
+  try {
+    const parsed = JSON.parse(stdout || "{}");
+    if (parsed.IsTruncated === true || parsed.NextContinuationToken) {
+      return {
+        ok: false,
+        objects: [],
+        detail: 'the listing came back truncated, so it cannot be treated as the complete set of archived objects (a missing manifest would read as "nothing archived")'
+      };
+    }
+    const objects = (parsed.Contents ?? []).filter((o) => typeof o.Key === "string").map((o) => ({ key: o.Key, storageClass: o.StorageClass ?? null }));
+    return { ok: true, objects, detail: "" };
+  } catch (err) {
+    return { ok: false, objects: [], detail: `unparseable listing: ${err.message}` };
+  }
+}
+async function listSourceObjects(src) {
+  const res = await runAws(
+    [
+      "s3api",
+      "list-objects-v2",
+      "--bucket",
+      src.bucket,
+      // Trailing slash so `<prefix>` cannot also enumerate a sibling
+      // `<prefix>-other/…`. The session policy anchors on `${prefix}/*` for the
+      // same reason.
+      "--prefix",
+      // Trailing separators stripped first. The API normalises what it returns,
+      // but `--key-prefix` is operator-supplied and a `RestoreSource` can be
+      // built directly, and `prefix//` matches no key at all — the listing then
+      // succeeds with zero objects and the run reports `no-manifest`, the exact
+      // misleading verdict the note above is about.
+      `${src.keyPrefix.replace(/\/+$/, "")}/`,
+      "--output",
+      "json"
+    ],
+    src,
+    AWS_META_TIMEOUT_MS
+  );
+  if (!res.ok) return { ok: false, objects: [], detail: res.detail };
+  return parseObjectListing(res.stdout);
+}
+async function getObjectBody(src, key) {
+  const res = await runAws(
+    ["s3", "cp", `s3://${src.bucket}/${key}`, "-"],
+    src,
+    AWS_META_TIMEOUT_MS
+  );
+  return { ok: res.ok, body: res.stdout, detail: res.detail };
+}
+async function findDrainManifest(src, codeName, objects, getBody = (key) => getObjectBody(src, key)) {
+  const storageClassByKey = new Map(objects.map((o) => [o.key, o.storageClass]));
+  const candidates = objects.map((o) => o.key).filter((k) => basename2(k) === DRAIN_MANIFEST_FILENAME);
+  const found = [];
+  const unreadable = [];
+  for (const key of candidates) {
+    const res = await getBody(key);
+    if (!res.ok) {
+      unreadable.push({
+        key,
+        storageClass: storageClassByKey.get(key) ?? null,
+        detail: res.detail ?? ""
+      });
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(res.body);
+      if (parsed?.codeName === codeName && Array.isArray(parsed.keys)) found.push(parsed);
+    } catch {
+    }
+  }
+  if (found.length > 0) {
+    const at = (m) => {
+      const t = Date.parse(m.writtenAt);
+      return Number.isFinite(t) ? t : Number.NEGATIVE_INFINITY;
+    };
+    found.sort((a, b) => at(b) - at(a));
+    return { kind: "found", manifest: found[0] };
+  }
+  if (unreadable.length > 0) return { kind: "unavailable", unreadable };
+  return { kind: "absent" };
+}
+function describeUnreadableManifests(unreadable) {
+  return unreadable.map(
+    (u) => isOfflineStorageClass(u.storageClass) ? `'${u.key}' is in ${u.storageClass} and must be restored to a readable tier before it can be read` : `'${u.key}' could not be read${u.detail ? `: ${u.detail}` : ""}`
+  ).join("; ");
+}
+function verifyJsonlTranscript(path) {
+  let raw;
+  try {
+    raw = readFileSync8(path, "utf-8");
+  } catch {
+    return false;
+  }
+  if (raw.trim().length === 0) return false;
+  for (const line of raw.split("\n")) {
+    if (line.trim().length === 0) continue;
+    try {
+      JSON.parse(line);
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+function restoreTranscriptDeps(args) {
+  const storageClassByKey = new Map(args.objects.map((o) => [o.key, o.storageClass]));
+  return {
+    resolveDestTranscriptDir: (codeName) => sessionTranscriptDir(getProjectDir(codeName)),
+    readManifest: () => args.manifest,
+    download: async ({ key, tmpPath }) => {
+      const storageClass = storageClassByKey.get(key) ?? void 0;
+      mkdirSync7(dirname5(tmpPath), { recursive: true });
+      const res = await runAws(
+        ["s3", "cp", `s3://${args.src.bucket}/${key}`, tmpPath, "--only-show-errors"],
+        args.src,
+        AWS_TIMEOUT_MS
+      );
+      return { ok: res.ok, detail: res.detail, storageClass, errorCode: res.errorCode };
+    },
+    verify: verifyJsonlTranscript,
+    commit: (tmpPath, finalPath) => {
+      mkdirSync7(dirname5(finalPath), { recursive: true });
+      renameSync5(tmpPath, finalPath);
+    },
+    discard: (tmpPath) => {
+      try {
+        if (existsSync9(tmpPath)) unlinkSync4(tmpPath);
+      } catch {
+      }
+    },
+    localMtimeMs: (path) => {
+      try {
+        return statSync2(path).mtimeMs;
+      } catch {
+        return null;
+      }
+    },
+    sessionFileExists: (codeName, sessionId) => sessionFileExists(getProjectDir(codeName), sessionId),
+    restorePin: (codeName, sessionId) => {
+      try {
+        markDailySessionSpawn(codeName, sessionId, /* @__PURE__ */ new Date(), args.timezone);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    resumeDisabled: () => isSessionResumeDisabled(),
+    log: args.log
+  };
+}
+
+// src/commands/agent-restore-transcripts.ts
+function exitCodeFor(status) {
+  return status === "restored" ? 0 : status === "partial" ? 0 : 1;
+}
+function describeCredentialError(err) {
+  if (!(err instanceof ApiError)) {
+    return err?.message ?? "unknown error";
+  }
+  const body = err.body ?? {};
+  const code = body["error"] ?? `HTTP ${err.status}`;
+  const detail = body["message"];
+  const candidates = Array.isArray(body["candidates"]) ? body["candidates"].map(String) : [];
+  const parts = [code];
+  if (detail) parts.push(`
+
+${detail}`);
+  if (candidates.length > 0) parts.push(`
+
+Candidate hosts: ${candidates.join(", ")}`);
+  return parts.join("");
+}
+function restoreJsonPayload(result, messages) {
+  return { ok: exitCodeFor(result.status) === 0, ...result, messages };
+}
+function credentialExpiredDuringRun(expiration, nowMs) {
+  if (!expiration) return false;
+  const expMs = Date.parse(expiration);
+  return Number.isFinite(expMs) && nowMs >= expMs;
+}
+function missingCredentialFields(body) {
+  const missing = [];
+  if (typeof body?.bucket !== "string" || !body.bucket) missing.push("bucket");
+  if (typeof body?.key_prefix !== "string" || !body.key_prefix) missing.push("key_prefix");
+  const c = body?.credentials;
+  if (!c || typeof c !== "object") {
+    missing.push("credentials");
+    return missing;
+  }
+  for (const f of ["access_key_id", "secret_access_key", "session_token"]) {
+    if (typeof c[f] !== "string" || !c[f]) missing.push(`credentials.${f}`);
+  }
+  return missing;
+}
+async function agentRestoreTranscriptsCommand(codeName, opts = {}) {
+  const messages = [];
+  const log = (msg) => {
+    messages.push(msg);
+    if (!opts.json) console.log(msg);
+  };
+  let minted;
+  try {
+    minted = await api.post(
+      `/agents/${encodeURIComponent(codeName)}/restore-credentials`,
+      {
+        source_host: opts.from,
+        bucket: opts.bucket,
+        key_prefix: opts.keyPrefix,
+        region: opts.region
+      }
+    );
+  } catch (err) {
+    const detail = describeCredentialError(err);
+    if (opts.json) {
+      console.log(
+        JSON.stringify({ ok: false, status: "credentials_failed", detail, messages }, null, 2)
+      );
+    } else {
+      console.error(`Could not obtain restore credentials for '${codeName}': ${detail}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const missing = missingCredentialFields(minted);
+  if (missing.length > 0) {
+    const detail = `the API returned no usable credential (missing: ${missing.join(", ")})`;
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, status: "credentials_failed", detail, messages }, null, 2));
+    } else {
+      console.error(`Could not obtain restore credentials for '${codeName}': ${detail}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const src = {
+    bucket: minted.bucket,
+    keyPrefix: minted.key_prefix,
+    region: minted.region,
+    credentials: {
+      accessKeyId: minted.credentials.access_key_id,
+      secretAccessKey: minted.credentials.secret_access_key,
+      sessionToken: minted.credentials.session_token
+    }
+  };
+  log(`Reading s3://${src.bucket}/${src.keyPrefix}/ (address from ${minted.address_source})`);
+  const listing = await listSourceObjects(src);
+  if (!listing.ok) {
+    if (opts.json) {
+      console.log(
+        JSON.stringify(
+          { ok: false, status: "listing_failed", detail: listing.detail, messages },
+          null,
+          2
+        )
+      );
+    } else {
+      console.error(`Could not list the source prefix: ${listing.detail}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const lookup = await findDrainManifest(src, codeName, listing.objects);
+  if (lookup.kind === "unavailable") {
+    const detail = describeUnreadableManifests(lookup.unreadable);
+    if (opts.json) {
+      console.log(
+        JSON.stringify({ ok: false, status: "manifest_unavailable", detail, messages }, null, 2)
+      );
+    } else {
+      console.error(
+        `Could not read the drain manifest for '${codeName}', so whether it was archived here is unknown \u2014 this is NOT the same as nothing having been archived: ${detail}`
+      );
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const result = await restoreAgentTranscripts(
+    codeName,
+    restoreTranscriptDeps({
+      src,
+      objects: listing.objects,
+      manifest: lookup.kind === "found" ? lookup.manifest : null,
+      timezone: opts.timezone,
+      log
+    })
+  );
+  if ((result.dropped > 0 || result.status === "failed") && credentialExpiredDuringRun(minted.credentials?.expiration, Date.now())) {
+    log(
+      `[restore] the restore credential expired at ${minted.credentials.expiration} while this run was in progress, so the ${result.dropped} failed object(s) are most likely expired-token errors rather than a problem with the archive. Re-run to mint a fresh credential (ENG-9567).`
+    );
+  }
+  if (opts.json) {
+    console.log(
+      JSON.stringify(restoreJsonPayload(result, messages), null, 2)
+    );
+  } else {
+    log("");
+    log(`  status:  ${result.status}`);
+    log(`  placed:  ${result.placed}`);
+    log(`  skipped: ${result.skipped} (already current)`);
+    log(`  dropped: ${result.dropped}`);
+    log(`  of:      ${result.total} archived file(s)`);
+    log(`  pinned:  ${result.pinRestored ? result.pinnedSessionId ?? "yes" : "no"}`);
+    if (result.destDir) log(`  into:    ${result.destDir}`);
+    log("");
+    log(
+      result.status === "restored" ? `'${codeName}' will resume its previous conversation on the next spawn.` : `'${codeName}' will NOT fully resume \u2014 see the reason above.`
+    );
+  }
+  process.exitCode = exitCodeFor(result.status);
+}
+
 // src/commands/kanban-recurring.ts
 import chalk15 from "chalk";
 import ora13 from "ora";
@@ -4331,8 +4881,8 @@ async function kanbanRecurringDisableCommand(titleOrId, opts) {
 }
 
 // src/commands/setup.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync8, mkdirSync as mkdirSync7, accessSync, constants as fsConstants } from "fs";
-import { join as join16, dirname as dirname4 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8, accessSync, constants as fsConstants } from "fs";
+import { join as join17, dirname as dirname6 } from "path";
 import { homedir as homedir7 } from "os";
 import chalk16 from "chalk";
 import ora14 from "ora";
@@ -4340,15 +4890,15 @@ function detectShellProfile() {
   const shell = process.env["SHELL"] ?? "";
   const home = homedir7();
   if (shell.includes("zsh")) {
-    return join16(home, ".zshrc");
+    return join17(home, ".zshrc");
   }
   if (shell.includes("fish")) {
-    const fishConfig = join16(home, ".config", "fish", "config.fish");
+    const fishConfig = join17(home, ".config", "fish", "config.fish");
     return fishConfig;
   }
-  const bashrc = join16(home, ".bashrc");
-  if (existsSync9(bashrc)) return bashrc;
-  return join16(home, ".bash_profile");
+  const bashrc = join17(home, ".bashrc");
+  if (existsSync10(bashrc)) return bashrc;
+  return join17(home, ".bash_profile");
 }
 function maybeWriteSystemWideEnv(apiUrl, apiKey, consoleUrl) {
   const empty = { etcEnvironment: false, profileD: false, bashrc: false };
@@ -4374,14 +4924,14 @@ function quoteForFishShell(value) {
 }
 function writeEtcEnvironment(apiUrl, apiKey, consoleUrl) {
   const envPath = "/etc/environment";
-  if (!existsSync9(envPath)) return false;
+  if (!existsSync10(envPath)) return false;
   try {
     accessSync(envPath, fsConstants.W_OK);
   } catch {
     return false;
   }
   try {
-    const current = readFileSync8(envPath, "utf-8");
+    const current = readFileSync9(envPath, "utf-8");
     const stripped = current.split(/\r?\n/).filter((line) => !/^\s*(?:export\s+)?AGT_(?:HOST|API_KEY|CONSOLE_URL)=/.test(line)).join("\n");
     const base = stripped.endsWith("\n") || stripped.length === 0 ? stripped : `${stripped}
 `;
@@ -4400,7 +4950,7 @@ function writeEtcEnvironment(apiUrl, apiKey, consoleUrl) {
 }
 function writeProfileDScript(apiUrl, apiKey, consoleUrl) {
   const profileD = "/etc/profile.d";
-  if (!existsSync9(profileD)) return false;
+  if (!existsSync10(profileD)) return false;
   try {
     accessSync(profileD, fsConstants.W_OK);
   } catch {
@@ -4423,14 +4973,14 @@ function writeProfileDScript(apiUrl, apiKey, consoleUrl) {
 }
 function ensureBashrcSourcesProfileD() {
   const bashrc = "/etc/bashrc";
-  if (!existsSync9(bashrc)) return false;
+  if (!existsSync10(bashrc)) return false;
   try {
     accessSync(bashrc, fsConstants.W_OK);
   } catch {
     return false;
   }
   try {
-    const current = readFileSync8(bashrc, "utf-8");
+    const current = readFileSync9(bashrc, "utf-8");
     const marker = "# Augmented (agt) \u2014 source system-wide AGT env";
     if (current.includes(marker)) return true;
     const snippet = [
@@ -4569,12 +5119,12 @@ async function setupCommand(token, options = {}) {
     );
   }
   const exportLines = buildExportLines(shell, finalApiUrl, setupResult.api_key, consoleUrl);
-  const profileDir = dirname4(profilePath);
-  if (!existsSync9(profileDir)) {
-    mkdirSync7(profileDir, { recursive: true });
+  const profileDir = dirname6(profilePath);
+  if (!existsSync10(profileDir)) {
+    mkdirSync8(profileDir, { recursive: true });
   }
   const marker = "# Augmented (agt) host configuration";
-  const current = existsSync9(profilePath) ? readFileSync8(profilePath, "utf-8") : "";
+  const current = existsSync10(profilePath) ? readFileSync9(profilePath, "utf-8") : "";
   let updated;
   if (current.includes(marker)) {
     updated = current.replace(
@@ -4605,7 +5155,7 @@ async function setupCommand(token, options = {}) {
   const managerSpinner = ora14({ text: "Starting manager daemon\u2026", isSilent: json });
   managerSpinner.start();
   try {
-    const configDir = join16(homedir7(), ".augmented");
+    const configDir = join17(homedir7(), ".augmented");
     const { pid } = startWatchdog({ intervalMs: 1e4, configDir, detached: true });
     managerSpinner.succeed(`Manager started (PID ${pid})`);
   } catch (err) {
@@ -4906,10 +5456,10 @@ async function kanbanDoneCommand(titleOrId, opts) {
 
 // src/commands/update.ts
 import { execFileSync, execSync } from "child_process";
-import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
+import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.714" : "dev";
+var cliVersion = true ? "0.28.716" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5013,7 +5563,7 @@ function performUpdate(version) {
 function detectBrewOwner() {
   for (const prefix of ["/home/linuxbrew/.linuxbrew", "/opt/homebrew", "/usr/local"]) {
     const cellar = `${prefix}/Cellar`;
-    if (!existsSync10(cellar)) continue;
+    if (!existsSync11(cellar)) continue;
     try {
       return execSync(`stat -c %U "${cellar}" 2>/dev/null || stat -f %Su "${cellar}"`, { encoding: "utf-8" }).trim() || null;
     } catch {
@@ -5210,11 +5760,11 @@ async function checkForUpdateOnStartup() {
 
 // src/commands/audit-subagents.ts
 import { homedir as homedir8 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 
 // src/lib/subagent-mcp-audit.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync2 } from "fs";
-import { join as join17 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { join as join18 } from "path";
 function parseFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match) return null;
@@ -5264,10 +5814,10 @@ function findSubagentFiles(dir, depth = 0) {
   const out = [];
   const isAgentsDir = dir.endsWith("/agents") || dir.endsWith("\\agents");
   for (const entry of entries) {
-    const full = join17(dir, entry);
+    const full = join18(dir, entry);
     let s;
     try {
-      s = statSync2(full);
+      s = statSync3(full);
     } catch {
       continue;
     }
@@ -5288,7 +5838,7 @@ function auditSubagentMcpBindings(rootDirs) {
       seen.add(file);
       let content;
       try {
-        content = readFileSync9(file, "utf-8");
+        content = readFileSync10(file, "utf-8");
       } catch {
         continue;
       }
@@ -5313,9 +5863,9 @@ function formatFinding(f) {
 function defaultRoots() {
   const home = homedir8();
   return [
-    join18(home, ".claude", "agents"),
-    join18(home, ".claude", "plugins"),
-    join18(process.cwd(), ".claude", "agents")
+    join19(home, ".claude", "agents"),
+    join19(home, ".claude", "plugins"),
+    join19(process.cwd(), ".claude", "agents")
   ];
 }
 async function auditSubagentsCommand(options = {}) {
@@ -5350,9 +5900,9 @@ async function auditSubagentsCommand(options = {}) {
 }
 
 // src/lib/mcp-render-allowlist-audit.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync4 } from "fs";
 import { homedir as homedir9 } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 function expectedWildcard(serverKey) {
   return requiredMcpWildcard(serverKey);
 }
@@ -5365,13 +5915,13 @@ function parseMcpWildcardsFromToolsLine(content) {
 }
 function readMcpServerKeys(mcpJsonPath) {
   try {
-    const config = JSON.parse(readFileSync10(mcpJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync11(mcpJsonPath, "utf-8"));
     return Object.keys(config.mcpServers ?? {});
   } catch {
     return null;
   }
 }
-function auditMcpRenderAllowlist(rootDir = join19(homedir9(), ".augmented")) {
+function auditMcpRenderAllowlist(rootDir = join20(homedir9(), ".augmented")) {
   const findings = [];
   let entries;
   try {
@@ -5380,24 +5930,24 @@ function auditMcpRenderAllowlist(rootDir = join19(homedir9(), ".augmented")) {
     return findings;
   }
   for (const entry of entries) {
-    const agentDir = join19(rootDir, entry);
+    const agentDir = join20(rootDir, entry);
     let s;
     try {
-      s = statSync3(agentDir);
+      s = statSync4(agentDir);
     } catch {
       continue;
     }
     if (!s.isDirectory() || entry.startsWith("_") || entry.startsWith(".")) continue;
     for (const scope of ["provision", "project"]) {
-      const mcpJsonPath = scope === "provision" ? join19(agentDir, "provision", ".mcp.json") : join19(agentDir, "project", ".mcp.json");
+      const mcpJsonPath = scope === "provision" ? join20(agentDir, "provision", ".mcp.json") : join20(agentDir, "project", ".mcp.json");
       const keys = readMcpServerKeys(mcpJsonPath);
       if (keys === null || keys.length === 0) continue;
       const expected = new Set(keys.map(expectedWildcard));
       for (const subagent of ["channel-message-handler", "augmented-worker"]) {
-        const mdPath = scope === "provision" ? join19(agentDir, ".claude", "agents", `${subagent}.md`) : join19(agentDir, "project", ".claude", "agents", `${subagent}.md`);
+        const mdPath = scope === "provision" ? join20(agentDir, ".claude", "agents", `${subagent}.md`) : join20(agentDir, "project", ".claude", "agents", `${subagent}.md`);
         let content;
         try {
-          content = readFileSync10(mdPath, "utf-8");
+          content = readFileSync11(mdPath, "utf-8");
         } catch {
           continue;
         }
@@ -5456,11 +6006,11 @@ async function auditMcpRenderCommand(options = {}) {
 
 // src/commands/audit-secrets.ts
 import { homedir as homedir10 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 
 // src/lib/secret-leak-audit.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync4 } from "fs";
-import { join as join20 } from "path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync5 } from "fs";
+import { join as join21 } from "path";
 var SECRET_KEY_NAME_RE = /TOKEN|KEY|SECRET|BEARER|PASSWORD/i;
 function isTemplated(value) {
   return value.includes("${");
@@ -5477,7 +6027,7 @@ function octal(mode) {
 function scanMcpFile(file, agent2, findings) {
   let mode = null;
   try {
-    mode = statSync4(file).mode;
+    mode = statSync5(file).mode;
   } catch {
     return;
   }
@@ -5486,7 +6036,7 @@ function scanMcpFile(file, agent2, findings) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync11(file, "utf-8"));
+    parsed = JSON.parse(readFileSync12(file, "utf-8"));
   } catch {
     return;
   }
@@ -5513,7 +6063,7 @@ function scanMcpFile(file, agent2, findings) {
 function scanEnvIntegrations(file, agent2, findings) {
   let mode;
   try {
-    mode = statSync4(file).mode;
+    mode = statSync5(file).mode;
   } catch {
     return;
   }
@@ -5530,15 +6080,15 @@ function auditSecretLeaks(augmentedRoot) {
     return findings;
   }
   for (const agent2 of agents) {
-    const agentDir = join20(augmentedRoot, agent2);
+    const agentDir = join21(augmentedRoot, agent2);
     try {
-      if (!statSync4(agentDir).isDirectory()) continue;
+      if (!statSync5(agentDir).isDirectory()) continue;
     } catch {
       continue;
     }
-    scanMcpFile(join20(agentDir, "provision", ".mcp.json"), agent2, findings);
-    scanMcpFile(join20(agentDir, "project", ".mcp.json"), agent2, findings);
-    scanEnvIntegrations(join20(agentDir, ".env.integrations"), agent2, findings);
+    scanMcpFile(join21(agentDir, "provision", ".mcp.json"), agent2, findings);
+    scanMcpFile(join21(agentDir, "project", ".mcp.json"), agent2, findings);
+    scanEnvIntegrations(join21(agentDir, ".env.integrations"), agent2, findings);
   }
   return findings;
 }
@@ -5564,7 +6114,7 @@ function describe(f) {
   return `secret file is mode ${f.mode} (expected 0600)`;
 }
 async function auditSecretsCommand(options = {}) {
-  const root = options.root ?? join21(homedir10(), ".augmented");
+  const root = options.root ?? join22(homedir10(), ".augmented");
   const findings = auditSecretLeaks(root);
   if (options.json) {
     process.stdout.write(`${JSON.stringify({ findings, root }, null, 2)}
@@ -5688,7 +6238,7 @@ async function anchorOnboardCommand(profile, options) {
 
 // src/commands/integration.ts
 import { homedir as homedir11 } from "os";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 import chalk19 from "chalk";
 import ora17 from "ora";
 async function fetchAgents() {
@@ -5820,7 +6370,7 @@ async function integrationProbeCommand(agentCodeName, slug) {
       process.exitCode = 1;
       return;
     }
-    const projectDir = join22(homedir11(), ".augmented", agentCodeName, "project");
+    const projectDir = join23(homedir11(), ".augmented", agentCodeName, "project");
     const probeEnv = buildProbeEnv(projectDir, agent2.agent_id);
     const probeDeps = buildConnectivityProbeDeps(projectDir, probeEnv);
     const sourceType = integ.source_type ?? null;
@@ -6096,7 +6646,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.714" : "dev";
+var cliVersion2 = true ? "0.28.716" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {
@@ -6196,16 +6746,19 @@ host.command("pair <host-name>").description("Start an SSM port-forward + shell
   })
 );
 var manager = program.command("manager").description("Host config sync daemon \u2014 keeps local agent files in sync with API");
-manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
-manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).action(managerStopCommand);
-manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).action(managerStatusCommand);
-manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
-manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).action(managerInstallCommand);
+manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
+manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).action(managerStopCommand);
+manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).action(managerStatusCommand);
+manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
+manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).action(managerInstallCommand);
 manager.command("uninstall").description("Remove the OS-level supervisor (launchctl unload + delete plist on macOS). Idempotent.").action(managerUninstallCommand);
 manager.command("install-system-unit").description("Install a system-level systemd unit (Linux, root) so the manager auto-starts on every boot. For headless EC2 hosts \u2014 survives reboot without `loginctl enable-linger`. (ENG-4706)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files (defaults to /root/.augmented or /home/<user>/.augmented)").option("--user <name>", "Unix user the manager runs as", "root").action(managerInstallSystemUnitCommand);
 manager.command("uninstall-system-unit").description("Remove the system-level systemd unit (Linux, root). Idempotent. (ENG-4706)").action(managerUninstallSystemUnitCommand);
 var agent = program.command("agent").description("Inspect and manage agents");
-agent.command("show <code-name>").description("Display an agent's provisioned configuration").option("--config-dir <dir>", "Config directory", join23(homedir12(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
+agent.command("restore-transcripts <code-name>").description(
+  "Place a migrated agent's archived transcripts on this host and re-pin its conversation (ENG-9567)"
+).option("--from <host>", "Source host to restore from \u2014 its name or uuid").option("--bucket <bucket>", "Source bucket, when no address is recorded for the host").option("--key-prefix <prefix>", "Source key prefix, when no address is recorded for the host").option("--region <region>", "Bucket region").option("--timezone <iana>", "The agent's IANA timezone, so the restored pin is dated as the spawner will read it").option("--json", "Emit the result as JSON").action(agentRestoreTranscriptsCommand);
+agent.command("show <code-name>").description("Display an agent's provisioned configuration").option("--config-dir <dir>", "Config directory", join24(homedir12(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
 var kanban = program.command("kanban").description("Manage agent kanban boards");
 kanban.command("list").description("List kanban board items for an agent").requiredOption("--agent <code-name>", "Agent code name").action(kanbanListCommand);
 kanban.command("add <title>").description("Add a new item to an agent kanban board").requiredOption("--agent <code-name>", "Agent code name").option("--priority <1|2|3>", "Priority: 1=high, 2=medium, 3=low", "2").option("--status <status>", "Initial status: backlog | todo | in_progress", "todo").option("--description <text>", "Item description").option("--estimate <minutes>", "Estimated time in minutes").option("--deliverable <text>", "Expected output/deliverable").action(kanbanAddCommand);