@integrity-labs/agt-cli 0.28.817 → 0.28.818

package/dist/{chunk-356JFTPK.js → chunk-Y3CAZCIA.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-5RZBTMBD.js";
+} from "./chunk-ZDV575SW.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -71,7 +71,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-SZ47B4KO.js";
+} from "./chunk-NVUWRJWX.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6523,7 +6523,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.817" : "dev";
+var agtCliVersion = true ? "0.28.818" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10818,4 +10818,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-356JFTPK.js.map
+//# sourceMappingURL=chunk-Y3CAZCIA.js.map

package/dist/{chunk-5RZBTMBD.js → chunk-ZDV575SW.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-SZ47B4KO.js";
+} from "./chunk-NVUWRJWX.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -134,9 +134,9 @@ function hardBoundedCapture(file, args, opts) {
 }
 
 // src/lib/persistent-session.ts
-import { join as join6, dirname as dirname5 } from "path";
+import { join as join7, dirname as dirname5 } from "path";
 import { homedir as homedir5, platform, userInfo as userInfo2 } from "os";
-import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync as readdirSync2, writeFileSync as writeFileSync4, appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, chmodSync as chmodSync3, copyFileSync, rmSync as rmSync3, lstatSync as lstatSync3, realpathSync as realpathSync2, renameSync as renameSync2, statSync } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync7, readdirSync as readdirSync2, writeFileSync as writeFileSync5, appendFileSync as appendFileSync2, mkdirSync as mkdirSync6, chmodSync as chmodSync3, copyFileSync, rmSync as rmSync3, lstatSync as lstatSync3, realpathSync as realpathSync2, renameSync as renameSync3, statSync } from "fs";
 
 // src/lib/mcp-sanitize.ts
 import { readFileSync, writeFileSync } from "fs";
@@ -3429,6 +3429,23 @@ var CLAUDE_CODE_SLOT_ENV = /* @__PURE__ */ new Map([
   ["primary", "ANTHROPIC_MODEL"],
   ["small_fast", "ANTHROPIC_SMALL_FAST_MODEL"]
 ]);
+var CLAUDE_CODE_SLOT_SETTINGS_KEY = /* @__PURE__ */ new Map([
+  ["advisor", "advisorModel"]
+]);
+var MANAGED_PROJECT_SETTINGS_KEYS = [
+  ...CLAUDE_CODE_SLOT_SETTINGS_KEY.values()
+];
+function projectSettingsForRole(policy, role) {
+  if (!policy) return {};
+  const out = {};
+  for (const m of policy.models) {
+    if (m.role !== role) continue;
+    const key = CLAUDE_CODE_SLOT_SETTINGS_KEY.get(m.slot);
+    if (!key) continue;
+    out[key] = m.modelId;
+  }
+  return out;
+}
 function modelEnvForRole(policy, role) {
   if (!policy) return {};
   const out = {};
@@ -3443,7 +3460,7 @@ function modelEnvForRole(policy, role) {
 function resolveModelPolicySpawnEnv(input) {
   const { policy, openRouterMode, gatewayToken, codeName } = input;
   const active = activeBinding(policy);
-  if (!policy || !active) return { env: {}, modelEnv: {}, notice: null };
+  if (!policy || !active) return { env: {}, modelEnv: {}, projectSettings: {}, notice: null };
   const roleNote = policy.activeRole === "primary" ? "" : ` role=${policy.activeRole} (FAILOVER)`;
   if (openRouterMode) {
     return {
@@ -3453,11 +3470,18 @@ function resolveModelPolicySpawnEnv(input) {
       // is how the "two actuators" problem above becomes a wrong model rather
       // than a logged conflict.
       modelEnv: {},
+      // ENG-10075: and no advisor. OpenRouter wins the whole policy here, not
+      // the env half of it — writing an advisor into the settings file for an
+      // agent whose model selection this branch just refused would be the
+      // half-applied state the `blocked` branch below spells out.
+      projectSettings: {},
       notice: `[model-policy] '${codeName}' has policy '${policy.name}' but is in OpenRouter mode \u2014 OpenRouter wins, policy not applied (ENG-9483: unifying the two actuators is a separate migration)`
     };
   }
   const modelEnv = modelEnvForRole(policy, active.role);
+  const projectSettings = projectSettingsForRole(policy, active.role);
   const modelNote = Object.keys(modelEnv).length > 0 ? ` models=${Object.entries(modelEnv).map(([k, v]) => `${k}=${v}`).join(" ")}` : "";
+  const advisorNote = Object.keys(projectSettings).length > 0 ? ` project-settings=${Object.entries(projectSettings).map(([k, v]) => `${k}=${v}`).join(" ")}` : "";
   const resolution = resolveBindingCredential(active, gatewayToken);
   switch (resolution.kind) {
     case "gateway":
@@ -3467,7 +3491,8 @@ function resolveModelPolicySpawnEnv(input) {
           ANTHROPIC_AUTH_TOKEN: resolution.authToken
         },
         modelEnv,
-        notice: `[model-policy] '${codeName}' inference via gateway ${resolution.baseUrl} (policy '${policy.name}' rev ${policy.revision}, from ${policy.resolvedFrom})${roleNote}${modelNote}`
+        projectSettings,
+        notice: `[model-policy] '${codeName}' inference via gateway ${resolution.baseUrl} (policy '${policy.name}' rev ${policy.revision}, from ${policy.resolvedFrom})${roleNote}${modelNote}${advisorNote}`
       };
     case "blocked":
       return {
@@ -3478,13 +3503,17 @@ function resolveModelPolicySpawnEnv(input) {
         // somewhere else — a policy half-applied, which is the one outcome this
         // file has no branch for.
         modelEnv: {},
+        // ENG-10075: and no advisor, for the identical reason. An advisor is a
+        // model choice made for an endpoint this manager could not honour.
+        projectSettings: {},
         notice: `[model-policy] '${codeName}' policy '${policy.name}' NOT applied \u2014 reason=${resolution.reason}; keeping existing auth (transport=${active.transport}, credential_source=${active.credentialSource})${roleNote}`
       };
     case "host-default":
       return {
         env: {},
         modelEnv,
-        notice: modelNote || roleNote ? `[model-policy] '${codeName}' model from policy '${policy.name}' rev ${policy.revision} (from ${policy.resolvedFrom})${roleNote};${modelNote || " no slot maps to an env var"}` : null
+        projectSettings,
+        notice: modelNote || roleNote || advisorNote ? `[model-policy] '${codeName}' model from policy '${policy.name}' rev ${policy.revision} (from ${policy.resolvedFrom})${roleNote};${modelNote || " no slot maps to an env var"}${advisorNote}` : null
       };
   }
 }
@@ -3506,13 +3535,81 @@ function roleFromAuthComponent(value) {
   return ROLES.includes(role) ? role : "primary";
 }
 
+// src/lib/project-claude-settings.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
+import { join as join6 } from "path";
+function writeProjectClaudeSettings(args) {
+  const { projectDir, managed } = args;
+  const path = join6(projectDir, ".claude", "settings.json");
+  try {
+    const fileExists = existsSync5(path);
+    if (Object.keys(managed).length === 0 && !fileExists) return { kind: "noop" };
+    let existing = {};
+    let backup = null;
+    if (fileExists) {
+      const raw = readFileSync6(path, "utf8");
+      try {
+        const parsed = JSON.parse(raw);
+        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+          existing = parsed;
+        } else {
+          throw new Error("settings.json is not a JSON object");
+        }
+      } catch {
+        backup = `${path}.corrupt-${Date.now()}`;
+        renameSync2(path, backup);
+        existing = {};
+      }
+    }
+    const next = { ...existing };
+    for (const key of MANAGED_PROJECT_SETTINGS_KEYS) {
+      if (key in managed) next[key] = managed[key];
+      else delete next[key];
+    }
+    if (Object.keys(next).length === 0) {
+      if (backup) return { kind: "recovered", path, backup, rewritten: false };
+      if (fileExists) {
+        unlinkSync(path);
+        return { kind: "removed", path };
+      }
+      return { kind: "noop" };
+    }
+    const serialized = `${JSON.stringify(next, null, 2)}
+`;
+    if (!backup && fileExists && readFileSync6(path, "utf8") === serialized) {
+      return { kind: "unchanged", path };
+    }
+    mkdirSync5(join6(projectDir, ".claude"), { recursive: true });
+    writeFileSync4(path, serialized, { mode: 384 });
+    if (backup) return { kind: "recovered", path, backup, rewritten: true };
+    return { kind: "written", path, keys: Object.keys(managed) };
+  } catch (err) {
+    return { kind: "failed", path, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function projectClaudeSettingsNotice(codeName, outcome) {
+  switch (outcome.kind) {
+    case "noop":
+    case "unchanged":
+      return null;
+    case "written":
+      return `[model-policy] '${codeName}' wrote ${outcome.keys.join(", ")} to ${outcome.path}`;
+    case "removed":
+      return `[model-policy] '${codeName}' policy no longer sets any project setting \u2014 removed ${outcome.path}`;
+    case "recovered":
+      return outcome.rewritten ? `[model-policy] '${codeName}' ${outcome.path} was not parseable JSON; moved to ${outcome.backup} and rewrote it` : `[model-policy] '${codeName}' ${outcome.path} was not parseable JSON; moved to ${outcome.backup} and did NOT replace it (the policy sets nothing)`;
+    case "failed":
+      return `[model-policy] '${codeName}' could NOT write ${outcome.path} (${outcome.error}) \u2014 agent spawns without it`;
+  }
+}
+
 // src/lib/persistent-session.ts
 var OPENROUTER_ANTHROPIC_BASE_URL = "https://openrouter.ai/api";
 function syncClaudeCredsToRoot() {
   if (platform() !== "linux") return true;
   if (typeof process.getuid !== "function" || process.getuid() !== 0) return true;
   for (const filename of [".credentials.json", "credentials.json"]) {
-    if (existsSync5(join6("/root/.claude", filename))) return true;
+    if (existsSync6(join7("/root/.claude", filename))) return true;
   }
   let sourcePath = null;
   try {
@@ -3520,8 +3617,8 @@ function syncClaudeCredsToRoot() {
     outer: for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       for (const filename of [".credentials.json", "credentials.json"]) {
-        const candidate = join6("/home", entry.name, ".claude", filename);
-        if (existsSync5(candidate)) {
+        const candidate = join7("/home", entry.name, ".claude", filename);
+        if (existsSync6(candidate)) {
           sourcePath = candidate;
           break outer;
         }
@@ -3532,9 +3629,9 @@ function syncClaudeCredsToRoot() {
   if (!sourcePath) return false;
   const targetDir = "/root/.claude";
   const sourceFilename = sourcePath.endsWith("credentials.json") && !sourcePath.endsWith(".credentials.json") ? "credentials.json" : ".credentials.json";
-  const targetPath = join6(targetDir, sourceFilename);
+  const targetPath = join7(targetDir, sourceFilename);
   try {
-    if (!existsSync5(targetDir)) mkdirSync5(targetDir, { recursive: true, mode: 448 });
+    if (!existsSync6(targetDir)) mkdirSync6(targetDir, { recursive: true, mode: 448 });
     copyFileSync(sourcePath, targetPath);
     chmodSync3(targetPath, 384);
     return true;
@@ -3551,13 +3648,13 @@ var cachedClaudePath = null;
 function resolveClaudeBinary() {
   if (cachedClaudePath) return cachedClaudePath;
   const override = process.env.CLAUDE_PATH;
-  if (override && existsSync5(override)) {
+  if (override && existsSync6(override)) {
     cachedClaudePath = override;
     return override;
   }
   try {
     const out = execSync2("which claude 2>/dev/null", { encoding: "utf-8" }).trim();
-    if (out && existsSync5(out)) {
+    if (out && existsSync6(out)) {
       cachedClaudePath = out;
       return out;
     }
@@ -3569,7 +3666,7 @@ function resolveClaudeBinary() {
     "/usr/local/bin/claude"
   ];
   for (const p of candidates) {
-    if (existsSync5(p)) {
+    if (existsSync6(p)) {
       cachedClaudePath = p;
       return p;
     }
@@ -3660,12 +3757,12 @@ function buildEgressAllowlist(toolsFrontmatter, policyDomains = []) {
 }
 function egressAllowlistHostPath(codeName, homeDir) {
   const home = homeDir ?? (process.env.HOME?.trim() || homedir5());
-  return join6(home, ".augmented", "_egress", `${agentRuntimeKey(codeName, home)}.txt`);
+  return join7(home, ".augmented", "_egress", `${agentRuntimeKey(codeName, home)}.txt`);
 }
 function writeEgressAllowlist(codeName, domains, homeDir) {
   const p = egressAllowlistHostPath(codeName, homeDir);
-  mkdirSync5(dirname5(p), { recursive: true });
-  writeFileSync4(p, domains.join("\n") + "\n", { mode: 420 });
+  mkdirSync6(dirname5(p), { recursive: true });
+  writeFileSync5(p, domains.join("\n") + "\n", { mode: 420 });
   return p;
 }
 var EGRESS_DOCKER_TIMEOUT_MS = 1e4;
@@ -3701,11 +3798,11 @@ function restartEgressSidecar(codeName) {
 function buildDockerRunCommand(args) {
   const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, passModelPolicyGateway, passModelPolicyModel, egress, forwardSlackReplyBinding, forwardBlockTurnEndAllMarkers, forwardKanbanWaiting, forwardNotifyDispatch, forwardTurnFailureNotice, forwardChannelSecrets } = args;
   const q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
-  const agentDir2 = join6(homeDir, ".augmented", codeName);
-  const agentIdDir = join6(homeDir, ".augmented", agentId);
-  const mcpDir = join6(homeDir, ".augmented", "_mcp");
-  const claudeHome = join6(homeDir, ".claude");
-  const claudeJson = join6(homeDir, ".claude.json");
+  const agentDir2 = join7(homeDir, ".augmented", codeName);
+  const agentIdDir = join7(homeDir, ".augmented", agentId);
+  const mcpDir = join7(homeDir, ".augmented", "_mcp");
+  const claudeHome = join7(homeDir, ".claude");
+  const claudeJson = join7(homeDir, ".claude.json");
   const mounts = [
     `-v ${q(`${agentDir2}:${agentDir2}`)}`,
     `-v ${q(`${agentIdDir}:${agentIdDir}`)}`,
@@ -3718,7 +3815,7 @@ function buildDockerRunCommand(args) {
   const cpus = process.env.AGT_ISOLATION_CPUS || "1.0";
   const pids = process.env.AGT_ISOLATION_PIDS || "512";
   const envArgs = [`-e ${q(`HOME=${homeDir}`)}`];
-  envArgs.push(`-e ${q(`npm_config_cache=${join6(agentDir2, ".npm-cache")}`)}`);
+  envArgs.push(`-e ${q(`npm_config_cache=${join7(agentDir2, ".npm-cache")}`)}`);
   envArgs.push(`-e ${q(`${CLAUDE_CODE_TMPDIR_ENV}=${agentTmpDirFor(agentDir2)}`)}`);
   if (passApiKey) envArgs.push("-e ANTHROPIC_API_KEY");
   if (passOpenRouter) {
@@ -3824,8 +3921,8 @@ function buildDockerRunCommand(args) {
 }
 function writePersistentClaudeWrapper(args) {
   const { projectDir, claudeBin, initPrompt, claudeArgsJoined } = args;
-  const envIntegrationsPath = join6(projectDir, ".env.integrations");
-  const wrapperPath = join6(projectDir, ".claude", "persistent-claude.sh");
+  const envIntegrationsPath = join7(projectDir, ".env.integrations");
+  const wrapperPath = join7(projectDir, ".claude", "persistent-claude.sh");
   const wrapperLines = [
     "#!/usr/bin/env bash",
     "set -e",
@@ -3833,7 +3930,7 @@ function writePersistentClaudeWrapper(args) {
     // --dangerously-skip-permissions on dedicated EC2 hosts.
     "export IS_SANDBOX=1"
   ];
-  if (existsSync5(envIntegrationsPath)) {
+  if (existsSync6(envIntegrationsPath)) {
     wrapperLines.push(
       "set -a",
       `source ${JSON.stringify(envIntegrationsPath)}`,
@@ -3841,23 +3938,23 @@ function writePersistentClaudeWrapper(args) {
     );
   }
   wrapperLines.push("export DISABLE_AUTOUPDATER=1");
-  const brokerBinDir = join6(projectDir, ".claude", "agt-bin");
-  if (existsSync5(brokerBinDir)) {
+  const brokerBinDir = join7(projectDir, ".claude", "agt-bin");
+  if (existsSync6(brokerBinDir)) {
     wrapperLines.push(`export PATH=${JSON.stringify(brokerBinDir)}:"$PATH"`);
   }
   const initPromptArg = initPrompt ? `${JSON.stringify(initPrompt)} ` : "";
   wrapperLines.push(
     `exec ${JSON.stringify(claudeBin)} ${initPromptArg}${claudeArgsJoined}`
   );
-  mkdirSync5(join6(projectDir, ".claude"), { recursive: true });
-  writeFileSync4(wrapperPath, wrapperLines.join("\n") + "\n", { mode: 448 });
+  mkdirSync6(join7(projectDir, ".claude"), { recursive: true });
+  writeFileSync5(wrapperPath, wrapperLines.join("\n") + "\n", { mode: 448 });
   chmodSync3(wrapperPath, 448);
   return wrapperPath;
 }
 function collectMcpServerNames(mcpConfigPath) {
-  if (!existsSync5(mcpConfigPath)) return [];
+  if (!existsSync6(mcpConfigPath)) return [];
   try {
-    const data = JSON.parse(readFileSync6(mcpConfigPath, "utf-8"));
+    const data = JSON.parse(readFileSync7(mcpConfigPath, "utf-8"));
     const servers = data.mcpServers;
     return servers ? Object.keys(servers) : [];
   } catch {
@@ -3909,12 +4006,12 @@ function findForeignAgentIdsInMcpConfig(args) {
   return out;
 }
 var sessions2 = /* @__PURE__ */ new Map();
-var PANE_LOG_DIR = join6(homedir5(), ".augmented");
+var PANE_LOG_DIR = join7(homedir5(), ".augmented");
 var PANE_TAIL_LINES = 20;
 function paneLogPath(codeName) {
-  return join6(PANE_LOG_DIR, codeName, "pane.log");
+  return join7(PANE_LOG_DIR, codeName, "pane.log");
 }
-var PANE_REDACTOR_SCRIPT = join6(PANE_LOG_DIR, "pane-log-redactor.pl");
+var PANE_REDACTOR_SCRIPT = join7(PANE_LOG_DIR, "pane-log-redactor.pl");
 var paneRedactorPerlAvailable = null;
 function paneSinkCommand(logPath, log2) {
   if (paneRedactorPerlAvailable === null) {
@@ -3928,12 +4025,12 @@ function paneSinkCommand(logPath, log2) {
   }
   if (paneRedactorPerlAvailable) {
     try {
-      mkdirSync5(dirname5(PANE_REDACTOR_SCRIPT), { recursive: true });
+      mkdirSync6(dirname5(PANE_REDACTOR_SCRIPT), { recursive: true });
       const tmp = `${PANE_REDACTOR_SCRIPT}.${randomUUID()}.tmp`;
       try {
-        writeFileSync4(tmp, buildRedactorProgram(), { encoding: "utf-8", mode: 448 });
+        writeFileSync5(tmp, buildRedactorProgram(), { encoding: "utf-8", mode: 448 });
         chmodSync3(tmp, 448);
-        renameSync2(tmp, PANE_REDACTOR_SCRIPT);
+        renameSync3(tmp, PANE_REDACTOR_SCRIPT);
       } catch (e) {
         try {
           rmSync3(tmp, { force: true });
@@ -3955,7 +4052,7 @@ function paneSinkCommand(logPath, log2) {
 function setupPaneLog2(tmuxSession, codeName, log2) {
   const logPath = paneLogPath(codeName);
   try {
-    mkdirSync5(dirname5(logPath), { recursive: true });
+    mkdirSync6(dirname5(logPath), { recursive: true });
     appendFileSync2(
       logPath,
       `
@@ -3974,17 +4071,17 @@ function setupPaneLog2(tmuxSession, codeName, log2) {
 function rotatePaneLogForDayRollover(codeName, log2, agentTimezone, now = /* @__PURE__ */ new Date()) {
   const logPath = paneLogPath(codeName);
   try {
-    if (!existsSync5(logPath)) return null;
+    if (!existsSync6(logPath)) return null;
     if (statSync(logPath).size === 0) return null;
     const stamp = todayLocalIso(now, agentTimezone ?? void 0).replace(/-/g, "");
     const dir = dirname5(logPath);
-    let target = join6(dir, `pane.log-${stamp}`);
-    if (existsSync5(target)) {
+    let target = join7(dir, `pane.log-${stamp}`);
+    if (existsSync6(target)) {
       const hhmmss = now.toISOString().slice(11, 19).replace(/:/g, "");
-      target = join6(dir, `pane.log-${stamp}-${hhmmss}`);
+      target = join7(dir, `pane.log-${stamp}-${hhmmss}`);
     }
-    renameSync2(logPath, target);
-    writeFileSync4(logPath, "", "utf-8");
+    renameSync3(logPath, target);
+    writeFileSync5(logPath, "", "utf-8");
     const rotated = target.slice(dir.length + 1);
     log2(`[persistent-session] Rotated pane.log for '${codeName}' \u2192 ${rotated} (day-rollover)`);
     return rotated;
@@ -3995,9 +4092,9 @@ function rotatePaneLogForDayRollover(codeName, log2, agentTimezone, now = /* @__
 }
 function readPaneLogTail(codeName, lines = PANE_TAIL_LINES) {
   const logPath = paneLogPath(codeName);
-  if (!existsSync5(logPath)) return null;
+  if (!existsSync6(logPath)) return null;
   try {
-    const raw = readFileSync6(logPath, "utf-8");
+    const raw = readFileSync7(logPath, "utf-8");
     if (!raw) return null;
     const stripped = raw.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "");
     const all = stripped.split("\n").filter((l) => l.length > 0);
@@ -4071,11 +4168,11 @@ function resolveSessionSpawnDecision(args) {
   };
 }
 function directChatSessionStatePath(agentId) {
-  return join6(homedir5(), ".augmented", agentId, "direct-chat-session.json");
+  return join7(homedir5(), ".augmented", agentId, "direct-chat-session.json");
 }
 function readDirectChatSessionState(agentId) {
   try {
-    const parsed = JSON.parse(readFileSync6(directChatSessionStatePath(agentId), "utf-8"));
+    const parsed = JSON.parse(readFileSync7(directChatSessionStatePath(agentId), "utf-8"));
     if (!parsed || typeof parsed !== "object") return null;
     const state = parsed;
     state.mcpServerKeys = Array.isArray(state.mcpServerKeys) ? state.mcpServerKeys.filter((k) => typeof k === "string") : void 0;
@@ -4086,8 +4183,8 @@ function readDirectChatSessionState(agentId) {
 }
 function writeDirectChatSessionState(agentId, state) {
   const p = directChatSessionStatePath(agentId);
-  mkdirSync5(dirname5(p), { recursive: true });
-  writeFileSync4(p, JSON.stringify(state));
+  mkdirSync6(dirname5(p), { recursive: true });
+  writeFileSync5(p, JSON.stringify(state));
 }
 function spawnBackoffMs(restartCount) {
   return Math.min(5e3 * Math.pow(2, restartCount), 6e4);
@@ -4125,6 +4222,7 @@ function spawnSession(config, session) {
   const {
     env: policyEnv,
     modelEnv: policyModelEnv,
+    projectSettings: policyProjectSettings,
     notice: policyNotice
   } = resolveModelPolicySpawnEnv({
     policy: config.modelPolicy ?? null,
@@ -4133,6 +4231,11 @@ function spawnSession(config, session) {
     codeName
   });
   if (policyNotice) log2(policyNotice);
+  const projectSettingsNotice = projectClaudeSettingsNotice(
+    codeName,
+    writeProjectClaudeSettings({ projectDir, managed: policyProjectSettings })
+  );
+  if (projectSettingsNotice) log2(projectSettingsNotice);
   const policyEnvActive = Object.keys(policyEnv).length > 0;
   const policyModelActive = Object.keys(policyModelEnv).length > 0;
   const tmuxSession = `agt-${codeName}`;
@@ -4175,10 +4278,10 @@ function spawnSession(config, session) {
         log2(`[persistent-session] No Claude Code credentials found under /root/.claude or /home/*. Pair via browser from the host page, or run 'claude /login' on the host.`);
       }
     } else {
-      const claudeDir = join6(homedir5(), ".claude");
+      const claudeDir = join7(homedir5(), ".claude");
       for (const filename of [".credentials.json", "credentials.json"]) {
-        const p = join6(claudeDir, filename);
-        if (existsSync5(p)) {
+        const p = join7(claudeDir, filename);
+        if (existsSync6(p)) {
           try {
             rmSync3(p, { force: true });
             log2(`[persistent-session] Removed ${p} (api_key mode active \u2014 preventing OAuth fallback)`);
@@ -4228,7 +4331,7 @@ function spawnSession(config, session) {
     if (channels.length > 0) args.push("--channels", ...channels);
     if (devChannels.length > 0) args.push("--dangerously-load-development-channels", ...devChannels);
     args.push("--mcp-config", mcpConfigPath);
-    if (existsSync5(claudeMdPath)) args.push("--system-prompt-file", claudeMdPath);
+    if (existsSync6(claudeMdPath)) args.push("--system-prompt-file", claudeMdPath);
     if (!openRouterMode && !policyModelActive) {
       const modelAlias = claudeModelAlias(config.primaryModel);
       if (modelAlias) args.push("--model", modelAlias);
@@ -4407,7 +4510,7 @@ function spawnSession(config, session) {
     };
     for (const f of probeMcpEnvSubstitution({
       mcpConfigPath,
-      envIntegrationsPath: join6(projectDir, ".env.integrations"),
+      envIntegrationsPath: join7(projectDir, ".env.integrations"),
       baseEnv: probeBaseEnv
     })) {
       log2(`[persistent-session] ${formatMissingVar(f)} agent=${codeName}`);
@@ -4420,7 +4523,7 @@ function spawnSession(config, session) {
     }
     try {
       const foreign = findForeignAgentIdsInMcpConfig({
-        mcpConfigText: readFileSync6(mcpConfigPath, "utf8"),
+        mcpConfigText: readFileSync7(mcpConfigPath, "utf8"),
         agentId: config.agentId
       });
       if (foreign.length > 0) {
@@ -5109,7 +5212,7 @@ function resolveRealAgentPath(codeNamePath) {
   return codeNamePath;
 }
 function getProjectDir(codeName) {
-  return join6(resolveRealAgentPath(join6(homedir5(), ".augmented", codeName)), "project");
+  return join7(resolveRealAgentPath(join7(homedir5(), ".augmented", codeName)), "project");
 }
 
 export {
@@ -5209,4 +5312,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-5RZBTMBD.js.map
+//# sourceMappingURL=chunk-ZDV575SW.js.map