@integrity-labs/agt-cli 0.28.854 → 0.28.856

package/dist/{chunk-FHOLG6VL.js → chunk-6I5IMMWR.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-2E2NKILK.js";
+} from "./chunk-6CLS6G7Y.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -76,7 +76,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-4Z4GFQAD.js";
+} from "./chunk-M6E42Z4Z.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -450,7 +450,7 @@ function orderTitlesForDescription(entries) {
 
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync4, chmodSync as chmodSync4, readdirSync, rmSync as rmSync2, copyFileSync, lstatSync, realpathSync, symlinkSync, readlinkSync, renameSync as renameSync4, opendirSync } from "fs";
-import { join as join3, relative, dirname as dirname3 } from "path";
+import { join as join4, relative, dirname as dirname3 } from "path";
 import { homedir as homedir3, tmpdir } from "os";
 import { execFile } from "child_process";
 
@@ -1245,6 +1245,125 @@ function decryptIntegrationCredentials(credentials, row) {
   return out;
 }
 
+// ../../packages/core/dist/provisioning/computer-use-mcp.js
+import { join as join3 } from "path";
+var COMPUTER_USE_DEFINITION_ID = "open-computer-use";
+var COMPUTER_USE_MCP_KEY = "open-computer-use";
+var COMPUTER_USE_SSH_KEY_ENV = `${remoteMcpEnvPrefix(COMPUTER_USE_DEFINITION_ID, null)}_API_KEY`;
+var DEFAULT_SSH_HOST = "127.0.0.1";
+var DEFAULT_SSH_PORT = 2222;
+var DEFAULT_REMOTE_COMMAND = "open-computer-use mcp";
+var SAFE_SSH_USER = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var ALLOWED_SSH_HOSTS = Object.freeze([
+  "127.0.0.1",
+  "::1",
+  "localhost"
+]);
+var SHELL_METACHARACTERS = /[;|&`$()<>\n\r*?\[\]{}!#~'"\\]/;
+function readString(config, key) {
+  const v = config?.[key];
+  return typeof v === "string" && v.trim().length > 0 ? v.trim() : null;
+}
+function readPort(config) {
+  const v = config?.["ssh_port"];
+  if (v === void 0 || v === null || v === "")
+    return DEFAULT_SSH_PORT;
+  const n = typeof v === "number" ? v : Number(v);
+  if (!Number.isInteger(n) || n < 1 || n > 65535)
+    return null;
+  return n;
+}
+function buildComputerUseMcpEntry(input) {
+  const user = readString(input.config, "ssh_user");
+  if (user === null) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_user is required (the macOS account the tunnel authenticates as) \u2014 no MCP entry was written`
+    };
+  }
+  const port = readPort(input.config);
+  if (port === null) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_port must be an integer 1-65535 \u2014 no MCP entry was written`
+    };
+  }
+  if (!SAFE_SSH_USER.test(user)) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_user must start with a letter or digit and contain only letters, digits, '.', '_' and '-' \u2014 no MCP entry was written`
+    };
+  }
+  const host = readString(input.config, "ssh_host") ?? DEFAULT_SSH_HOST;
+  if (!ALLOWED_SSH_HOSTS.includes(host)) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_host must be one of ${ALLOWED_SSH_HOSTS.join(", ")} \u2014 the Mac opens a REVERSE tunnel, so the agent host connects to its own loopback. A different host would send this agent's key somewhere else. No MCP entry was written`
+    };
+  }
+  const remoteCommand = readString(input.config, "remote_command") ?? DEFAULT_REMOTE_COMMAND;
+  if (SHELL_METACHARACTERS.test(remoteCommand)) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.remote_command must name a binary and its arguments and may not contain shell metacharacters (; | & \` $ ( ) < > newline) \u2014 no MCP entry was written`
+    };
+  }
+  const knownHosts = join3(input.agentDir, ".computer-use-known-hosts");
+  return {
+    problem: null,
+    entry: {
+      command: "node",
+      args: [
+        input.proxyPath,
+        "--",
+        "ssh",
+        // -T: no pty. The upstream speaks JSON-RPC over stdio; a pty would
+        // inject terminal control sequences into the stream.
+        "-T",
+        // Never prompt. Without this a missing or rejected key makes ssh sit
+        // waiting for a passphrase on a stdin that is carrying JSON-RPC, and
+        // the server appears to hang rather than to fail.
+        "-o",
+        "BatchMode=yes",
+        "-o",
+        "StrictHostKeyChecking=accept-new",
+        "-o",
+        `UserKnownHostsFile=${knownHosts}`,
+        "-o",
+        "ConnectTimeout=10",
+        // Keepalives so a dropped tunnel surfaces as a closed stdio pipe
+        // rather than a silently wedged child. ENG-10134 owns detecting that
+        // and respawning; this just makes the event happen.
+        "-o",
+        "ServerAliveInterval=15",
+        "-o",
+        "ServerAliveCountMax=3",
+        "-p",
+        String(port),
+        `${user}@${host}`,
+        remoteCommand
+      ],
+      env: {
+        // The three the approval gate reads (ENG-10132). Deliberately the vars
+        // the agent's environment already carries rather than new ones: the
+        // gate refuses every call when any is missing, so adding a bespoke var
+        // here would mean a new way for the proxy to be silently disarmed.
+        AGT_HOST: "${AGT_HOST}",
+        AGT_API_KEY: "${AGT_API_KEY}",
+        AGT_AGENT_ID: input.agentId,
+        // The credential. `${...}` is Claude Code's spawn-time substitution
+        // from the agent's environment, which the manager populates from
+        // `.env.integrations` — the same path every other integration
+        // credential travels.
+        [COMPUTER_USE_SSH_KEY_ENV]: `\${${COMPUTER_USE_SSH_KEY_ENV}}`,
+        // ssh must be resolvable, and it is not a node builtin.
+        PATH: process.env["PATH"] ?? "",
+        HOME: process.env["HOME"] ?? ""
+      }
+    }
+  };
+}
+
 // ../../packages/core/dist/provisioning/github-broker-credentials.js
 var GITHUB_BROKER_BIN_DIR = ".claude/agt-bin";
 var GIT_CREDENTIAL_HELPER_BASENAME = "git-credential-agt-github";
@@ -1554,7 +1673,7 @@ var VALID_CODE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var SECRET_FILE_MODE = 384;
 function writeEnvIntegrationsForAgent(codeName, args) {
   const agentDir = getAgentDir(codeName);
-  const envPath = join3(agentDir, ".env.integrations");
+  const envPath = join4(agentDir, ".env.integrations");
   let existing = null;
   try {
     existing = readFileSync4(envPath, "utf-8");
@@ -1571,7 +1690,7 @@ function writeEnvIntegrationsForAgent(codeName, args) {
   try {
     const projectDir = getProjectDir2(codeName);
     mkdirSync3(projectDir, { recursive: true });
-    const dest = join3(projectDir, ".env.integrations");
+    const dest = join4(projectDir, ".env.integrations");
     writeFileSync4(dest, content, { mode: SECRET_FILE_MODE });
     try {
       chmodSync4(dest, SECRET_FILE_MODE);
@@ -1592,7 +1711,7 @@ var MIGRATABLE_FIELD_TO_ENV_VAR = {
   AGT_API_KEY: "AGT_API_KEY"
 };
 function migrateExistingLiteralSecrets(codeName) {
-  const mcpJsonPath = join3(getAgentDir(codeName), "provision", ".mcp.json");
+  const mcpJsonPath = join4(getAgentDir(codeName), "provision", ".mcp.json");
   let config;
   try {
     config = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
@@ -1601,7 +1720,7 @@ function migrateExistingLiteralSecrets(codeName) {
   }
   let existingEnvKeys = /* @__PURE__ */ new Set();
   try {
-    existingEnvKeys = new Set(parseEnvFileEntries(readFileSync4(join3(getAgentDir(codeName), ".env.integrations"), "utf-8")).keys());
+    existingEnvKeys = new Set(parseEnvFileEntries(readFileSync4(join4(getAgentDir(codeName), ".env.integrations"), "utf-8")).keys());
   } catch {
   }
   const updates = {};
@@ -1675,8 +1794,8 @@ function ensureIdKeyedLayout(codeName, agentId) {
   assertValidCodeName(codeName);
   assertValidAgentId(agentId);
   const home = getHomeDir();
-  const codeNamePath = join3(home, ".augmented", codeName);
-  const idPath = join3(home, ".augmented", agentId);
+  const codeNamePath = join4(home, ".augmented", codeName);
+  const idPath = join4(home, ".augmented", agentId);
   let state;
   try {
     state = lstatSync(codeNamePath).isSymbolicLink() ? "symlink" : "realdir";
@@ -1699,7 +1818,7 @@ function ensureIdKeyedLayout(codeName, agentId) {
   return idPath;
 }
 function stagedMigrationLinkPath(home, codeName) {
-  return join3(home, ".augmented", `.${codeName}.migrating`);
+  return join4(home, ".augmented", `.${codeName}.migrating`);
 }
 function cleanupStaleStagedLink(staged) {
   try {
@@ -1719,8 +1838,8 @@ function migrateAgentDirToIdKeyed(codeName, agentId, opts = {}) {
   assertValidCodeName(codeName);
   assertValidAgentId(agentId);
   const home = opts.home ?? getHomeDir();
-  const codeNamePath = join3(home, ".augmented", codeName);
-  const idPath = join3(home, ".augmented", agentId);
+  const codeNamePath = join4(home, ".augmented", codeName);
+  const idPath = join4(home, ".augmented", agentId);
   const staged = stagedMigrationLinkPath(home, codeName);
   let codeNameKind;
   try {
@@ -1758,14 +1877,14 @@ function migrateAgentDirToIdKeyed(codeName, agentId, opts = {}) {
 }
 function getAgentDir(codeName) {
   assertValidCodeName(codeName);
-  return resolveRealAgentPath(join3(getHomeDir(), ".augmented", codeName));
+  return resolveRealAgentPath(join4(getHomeDir(), ".augmented", codeName));
 }
 var migratedCodeNames = /* @__PURE__ */ new Set();
 function migrateLegacyClaudecodeDir(codeName, log2) {
   assertValidCodeName(codeName);
   if (migratedCodeNames.has(codeName))
     return;
-  const legacyRoot = join3(getHomeDir(), ".augmented", codeName, "claudecode");
+  const legacyRoot = join4(getHomeDir(), ".augmented", codeName, "claudecode");
   if (!existsSync4(legacyRoot)) {
     migratedCodeNames.add(codeName);
     return;
@@ -1778,8 +1897,8 @@ function migrateLegacyClaudecodeDir(codeName, log2) {
     const walkAndMigrate = (srcDir, destDir) => {
       mkdirSync3(destDir, { recursive: true });
       for (const entry of readdirSync(srcDir, { withFileTypes: true })) {
-        const src = join3(srcDir, entry.name);
-        const dest = join3(destDir, entry.name);
+        const src = join4(srcDir, entry.name);
+        const dest = join4(destDir, entry.name);
         if (entry.isDirectory()) {
           walkAndMigrate(src, dest);
           continue;
@@ -1819,13 +1938,13 @@ function migrateLegacyClaudecodeDir(codeName, log2) {
   }
 }
 function syncGitHubBrokerCredentialTooling(projectDir, enabled) {
-  const binDir = join3(projectDir, GITHUB_BROKER_BIN_DIR);
+  const binDir = join4(projectDir, GITHUB_BROKER_BIN_DIR);
   if (!enabled) {
     rmSync2(binDir, { recursive: true, force: true });
     return {};
   }
-  const helperPath = join3(binDir, GIT_CREDENTIAL_HELPER_BASENAME);
-  const shimPath = join3(binDir, GH_SHIM_BASENAME);
+  const helperPath = join4(binDir, GIT_CREDENTIAL_HELPER_BASENAME);
+  const shimPath = join4(binDir, GH_SHIM_BASENAME);
   mkdirSync3(binDir, { recursive: true });
   writeFileSync4(helperPath, renderGitCredentialHelper(), { mode: BROKER_SCRIPT_MODE });
   chmodSync4(helperPath, BROKER_SCRIPT_MODE);
@@ -1834,10 +1953,10 @@ function syncGitHubBrokerCredentialTooling(projectDir, enabled) {
   return buildGitCredentialEnv(helperPath);
 }
 function getProjectDir2(codeName) {
-  return join3(getAgentDir(codeName), "project");
+  return join4(getAgentDir(codeName), "project");
 }
 function getScratchDir(codeName) {
-  return join3(getAgentDir(codeName), "scratch");
+  return join4(getAgentDir(codeName), "scratch");
 }
 function getAgentTmpDir(codeName) {
   return agentTmpDirFor(getAgentDir(codeName));
@@ -1853,7 +1972,7 @@ function sweepScratchDir(codeName, now = Date.now()) {
   }
   const cutoff = now - SCRATCH_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
   for (const entry of entries) {
-    const full = join3(scratchDir, entry);
+    const full = join4(scratchDir, entry);
     try {
       if (isFreshWithin(full, cutoff))
         continue;
@@ -1881,7 +2000,7 @@ function sweepStrandedArtefactTmpDirs(now = Date.now()) {
   for (const entry of entries) {
     if (!STRANDED_ARTEFACT_TMP_PREFIXES.some((prefix) => entry.startsWith(prefix)))
       continue;
-    const full = join3(root, entry);
+    const full = join4(root, entry);
     try {
       if (isFreshWithin(full, cutoff))
         continue;
@@ -1921,7 +2040,7 @@ function isFreshWithin(path, cutoff) {
         const child = dir.readSync();
         if (child === null)
           break;
-        queue.push(join3(current, child.name));
+        queue.push(join4(current, child.name));
         budget -= 1;
       }
     } catch {
@@ -1938,8 +2057,8 @@ function isFreshWithin(path, cutoff) {
 function syncMcpToProject(codeName) {
   const agentDir = getAgentDir(codeName);
   const projectDir = getProjectDir2(codeName);
-  const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
-  const projectMcpPath = join3(projectDir, ".mcp.json");
+  const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
+  const projectMcpPath = join4(projectDir, ".mcp.json");
   try {
     const content = readFileSync4(provisionMcpPath, "utf-8");
     mkdirSync3(projectDir, { recursive: true });
@@ -1963,7 +2082,7 @@ function syncMcpToProject(codeName) {
 }
 var INTEGRATIONS_SUMMARY_FILE = "integrations-summary.json";
 function integrationsSummaryPath(codeName) {
-  return join3(getAgentDir(codeName), "provision", INTEGRATIONS_SUMMARY_FILE);
+  return join4(getAgentDir(codeName), "provision", INTEGRATIONS_SUMMARY_FILE);
 }
 function writeIntegrationsSummaryForAgent(codeName, summaries) {
   const target = integrationsSummaryPath(codeName);
@@ -1985,7 +2104,7 @@ function readIntegrationsSummaryForAgent(codeName) {
 function renderChannelMessageHandlerForAgent(codeName) {
   const agentDir = getAgentDir(codeName);
   const projectDir = getProjectDir2(codeName);
-  const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
+  const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
   let mcpServerKeys;
   try {
     const config = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
@@ -1996,7 +2115,7 @@ function renderChannelMessageHandlerForAgent(codeName) {
   const integrations = readIntegrationsSummaryForAgent(codeName);
   const content = buildChannelMessageHandlerAgent({ mcpServerKeys, integrations });
   for (const baseDir of [agentDir, projectDir]) {
-    const target = join3(baseDir, ".claude", "agents", "channel-message-handler.md");
+    const target = join4(baseDir, ".claude", "agents", "channel-message-handler.md");
     try {
       mkdirSync3(dirname3(target), { recursive: true });
       writeFileSync4(target, content);
@@ -2014,7 +2133,7 @@ function writeMcpJsonGuarded(codeName, path, config) {
   return true;
 }
 function readExistingMcpEnvVar(codeName, serverId, envKey) {
-  const mcpJsonPath = join3(getAgentDir(codeName), "provision", ".mcp.json");
+  const mcpJsonPath = join4(getAgentDir(codeName), "provision", ".mcp.json");
   try {
     const raw = readFileSync4(mcpJsonPath, "utf-8");
     const config = JSON.parse(raw);
@@ -2044,7 +2163,7 @@ function resolveBrokerAgentId(codeName, fallback) {
   return void 0;
 }
 function ensureWorkspaceTrusted(projectDir) {
-  const configPath = join3(homedir3(), ".claude.json");
+  const configPath = join4(homedir3(), ".claude.json");
   try {
     let config = {};
     if (existsSync4(configPath)) {
@@ -2088,8 +2207,8 @@ function deployArtifactsToProject(codeName, provisionDir) {
   const SKILLS_START = "<!-- AGT:SKILLS_INDEX_START -->";
   const SKILLS_END = "<!-- AGT:SKILLS_INDEX_END -->";
   for (const file of artifactFiles) {
-    const src = join3(provisionDir, file);
-    const dest = join3(projectDir, file);
+    const src = join4(provisionDir, file);
+    const dest = join4(projectDir, file);
     try {
       const srcContent = readFileSync4(src, "utf-8");
       if (file === "CLAUDE.md" && existsSync4(dest)) {
@@ -2115,15 +2234,15 @@ function deployArtifactsToProject(codeName, provisionDir) {
     } catch {
     }
   }
-  const skillsDir = join3(provisionDir, ".claude", "skills");
-  const destSkillsDir = join3(projectDir, ".claude", "skills");
+  const skillsDir = join4(provisionDir, ".claude", "skills");
+  const destSkillsDir = join4(projectDir, ".claude", "skills");
   try {
     if (existsSync4(destSkillsDir)) {
       const srcFolders = existsSync4(skillsDir) ? new Set(readdirSync(skillsDir)) : /* @__PURE__ */ new Set();
       for (const folder of readdirSync(destSkillsDir)) {
         if (folder.startsWith("knowledge-") || folder === "core-knowledge" && !srcFolders.has(folder)) {
           try {
-            rmSync2(join3(destSkillsDir, folder), { recursive: true });
+            rmSync2(join4(destSkillsDir, folder), { recursive: true });
           } catch {
           }
         }
@@ -2131,11 +2250,11 @@ function deployArtifactsToProject(codeName, provisionDir) {
     }
     if (existsSync4(skillsDir)) {
       for (const skillFolder of readdirSync(skillsDir)) {
-        const srcSkillFile = join3(skillsDir, skillFolder, "SKILL.md");
+        const srcSkillFile = join4(skillsDir, skillFolder, "SKILL.md");
         if (!existsSync4(srcSkillFile))
           continue;
-        const destFolder = join3(destSkillsDir, skillFolder);
-        const destFile = join3(destFolder, "SKILL.md");
+        const destFolder = join4(destSkillsDir, skillFolder);
+        const destFile = join4(destFolder, "SKILL.md");
         const srcContent = readFileSync4(srcSkillFile, "utf-8");
         try {
           if (existsSync4(destFile) && readFileSync4(destFile, "utf-8") === srcContent)
@@ -2148,8 +2267,8 @@ function deployArtifactsToProject(codeName, provisionDir) {
     }
   } catch {
   }
-  const agentsDir = join3(provisionDir, ".claude", "agents");
-  const destAgentsDir = join3(projectDir, ".claude", "agents");
+  const agentsDir = join4(provisionDir, ".claude", "agents");
+  const destAgentsDir = join4(projectDir, ".claude", "agents");
   try {
     if (existsSync4(agentsDir)) {
       const sourceAgentFiles = new Set(readdirSync(agentsDir).filter((f) => f.endsWith(".md")));
@@ -2160,14 +2279,14 @@ function deployArtifactsToProject(codeName, provisionDir) {
           if (sourceAgentFiles.has(destFile))
             continue;
           try {
-            rmSync2(join3(destAgentsDir, destFile));
+            rmSync2(join4(destAgentsDir, destFile));
           } catch {
           }
         }
       }
       for (const agentFile of sourceAgentFiles) {
-        const srcPath = join3(agentsDir, agentFile);
-        const destPath = join3(destAgentsDir, agentFile);
+        const srcPath = join4(agentsDir, agentFile);
+        const destPath = join4(destAgentsDir, agentFile);
         const srcContent = readFileSync4(srcPath, "utf-8");
         try {
           if (existsSync4(destPath) && readFileSync4(destPath, "utf-8") === srcContent)
@@ -2180,8 +2299,8 @@ function deployArtifactsToProject(codeName, provisionDir) {
     }
   } catch {
   }
-  const workflowsDir = join3(provisionDir, ".claude", "workflows");
-  const destWorkflowsDir = join3(projectDir, ".claude", "workflows");
+  const workflowsDir = join4(provisionDir, ".claude", "workflows");
+  const destWorkflowsDir = join4(projectDir, ".claude", "workflows");
   try {
     const sourceWorkflowFiles = existsSync4(workflowsDir) ? new Set(readdirSync(workflowsDir).filter((f) => f.endsWith(".js"))) : /* @__PURE__ */ new Set();
     if (existsSync4(destWorkflowsDir)) {
@@ -2191,14 +2310,14 @@ function deployArtifactsToProject(codeName, provisionDir) {
         if (sourceWorkflowFiles.has(destFile))
           continue;
         try {
-          rmSync2(join3(destWorkflowsDir, destFile));
+          rmSync2(join4(destWorkflowsDir, destFile));
         } catch {
         }
       }
     }
     for (const workflowFile of sourceWorkflowFiles) {
-      const srcPath = join3(workflowsDir, workflowFile);
-      const destPath = join3(destWorkflowsDir, workflowFile);
+      const srcPath = join4(workflowsDir, workflowFile);
+      const destPath = join4(destWorkflowsDir, workflowFile);
       const srcContent = readFileSync4(srcPath, "utf-8");
       try {
         if (existsSync4(destPath) && readFileSync4(destPath, "utf-8") === srcContent)
@@ -2210,8 +2329,8 @@ function deployArtifactsToProject(codeName, provisionDir) {
     }
   } catch {
   }
-  const agentMcpPath = join3(getAgentDir(codeName), "provision", ".mcp.json");
-  const projectMcpPath = join3(projectDir, ".mcp.json");
+  const agentMcpPath = join4(getAgentDir(codeName), "provision", ".mcp.json");
+  const projectMcpPath = join4(projectDir, ".mcp.json");
   try {
     const agentMcp = JSON.parse(readFileSync4(agentMcpPath, "utf-8"));
     let projectMcp;
@@ -2237,8 +2356,8 @@ function deployArtifactsToProject(codeName, provisionDir) {
   const agentDir = getAgentDir(codeName);
   for (const envFile of [".env", ".env.integrations"]) {
     try {
-      const content = readFileSync4(join3(agentDir, envFile), "utf-8");
-      const envDest = join3(projectDir, envFile);
+      const content = readFileSync4(join4(agentDir, envFile), "utf-8");
+      const envDest = join4(projectDir, envFile);
       writeFileSync4(envDest, content, { mode: SECRET_FILE_MODE });
       try {
         chmodSync4(envDest, SECRET_FILE_MODE);
@@ -2248,12 +2367,12 @@ function deployArtifactsToProject(codeName, provisionDir) {
     }
   }
   try {
-    const gitDir = join3(projectDir, ".git");
-    const hookSrc = join3(provisionDir, ".git-hooks", "pre-commit");
+    const gitDir = join4(projectDir, ".git");
+    const hookSrc = join4(provisionDir, ".git-hooks", "pre-commit");
     if (existsSync4(gitDir) && existsSync4(hookSrc)) {
-      const hooksDir = join3(gitDir, "hooks");
+      const hooksDir = join4(gitDir, "hooks");
       mkdirSync3(hooksDir, { recursive: true });
-      const hookDest = join3(hooksDir, "pre-commit");
+      const hookDest = join4(hooksDir, "pre-commit");
       const srcContent = readFileSync4(hookSrc, "utf-8");
       const upToDate = existsSync4(hookDest) && readFileSync4(hookDest, "utf-8") === srcContent;
       if (!upToDate)
@@ -2265,9 +2384,9 @@ function deployArtifactsToProject(codeName, provisionDir) {
 }
 function provisionStopHook(codeName) {
   const projectDir = getProjectDir2(codeName);
-  const claudeDir = join3(projectDir, ".claude");
+  const claudeDir = join4(projectDir, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
-  const hookScriptPath = join3(claudeDir, "agt-stop-hook.sh");
+  const hookScriptPath = join4(claudeDir, "agt-stop-hook.sh");
   const hookScript = [
     "#!/bin/bash",
     "# Auto-generated by Augmented \u2014 captures persistent session task results.",
@@ -2299,7 +2418,7 @@ function provisionStopHook(codeName) {
     "exit 0"
   ].join("\n") + "\n";
   writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
-  const ghostHookPath = join3(claudeDir, "agt-ghost-reply-hook.sh");
+  const ghostHookPath = join4(claudeDir, "agt-ghost-reply-hook.sh");
   const jqNormalizeContent = '(.message.content // .content // []) | if type == "string" then [{type: "text", text: .}] elif type == "array" then . else [] end';
   const ghostHookScript = [
     "#!/bin/bash",
@@ -3188,7 +3307,7 @@ function provisionStopHook(codeName) {
   ].join("\n") + "\n";
   writeFileSync4(ghostHookPath, ghostHookScript, { mode: 493 });
   const backlogHookPath = provisionBacklogPullHook(codeName);
-  const settingsPath = join3(claudeDir, "settings.local.json");
+  const settingsPath = join4(claudeDir, "settings.local.json");
   let settings = {};
   try {
     settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
@@ -3209,17 +3328,17 @@ function provisionStopHook(codeName) {
 }
 function provisionIsolationHook(codeName, agentId) {
   const projectDir = getProjectDir2(codeName);
-  const claudeDir = join3(projectDir, ".claude");
+  const claudeDir = join4(projectDir, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
   const hasAgentId = agentId !== void 0;
   if (hasAgentId)
     assertValidAgentId(agentId);
   const homeDir = getHomeDir();
-  const augmentedBase = join3(homeDir, ".augmented");
+  const augmentedBase = join4(homeDir, ".augmented");
   const ownAgentDir = getAgentDir(codeName);
-  const logFile = join3(ownAgentDir, "isolation.log");
+  const logFile = join4(ownAgentDir, "isolation.log");
   const idAllowClause = hasAgentId ? ` && [ "$AGENT_DIR" != "${agentId}" ]` : "";
-  const hookScriptPath = join3(claudeDir, "agt-isolation-hook.sh");
+  const hookScriptPath = join4(claudeDir, "agt-isolation-hook.sh");
   const hookScript = [
     "#!/bin/bash",
     "# Auto-generated by Augmented \u2014 prevents cross-agent file access.",
@@ -3273,7 +3392,7 @@ function provisionIsolationHook(codeName, agentId) {
     "exit 0"
   ].join("\n") + "\n";
   writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join3(claudeDir, "settings.local.json");
+  const settingsPath = join4(claudeDir, "settings.local.json");
   let settings = {};
   try {
     settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
@@ -3295,9 +3414,9 @@ function provisionIsolationHook(codeName, agentId) {
 }
 function provisionBacklogPullHook(codeName) {
   const projectDir = getProjectDir2(codeName);
-  const claudeDir = join3(projectDir, ".claude");
+  const claudeDir = join4(projectDir, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
-  const hookScriptPath = join3(claudeDir, "agt-backlog-pull-hook.sh");
+  const hookScriptPath = join4(claudeDir, "agt-backlog-pull-hook.sh");
   const hookScript = `#!/usr/bin/env bash
 # Auto-generated by Augmented (CS-1549) \u2014 Stop hook: don't end a turn idle
 # beside a non-empty backlog. Fail-open on every path; blocks at most once per
@@ -3464,9 +3583,9 @@ exit 0
 }
 function provisionAutoKanbanProgressHook(codeName) {
   const projectDir = getProjectDir2(codeName);
-  const claudeDir = join3(projectDir, ".claude");
+  const claudeDir = join4(projectDir, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
-  const hookScriptPath = join3(claudeDir, "agt-auto-kanban-progress-hook.sh");
+  const hookScriptPath = join4(claudeDir, "agt-auto-kanban-progress-hook.sh");
   const hookScript = `#!/usr/bin/env bash
 # Auto-generated by Augmented (ENG-6179 / ENG-6241) \u2014 PostToolUse auto-progress.
 # Maps the agent's latest tool action onto its active in-thread kanban progress
@@ -3575,7 +3694,7 @@ BODY="$(jq -nc --arg a "$AGENT_ID" --arg s "$STEP" '{agent_id:$a, step:$s}' 2>/d
 exit 0
 `;
   writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join3(claudeDir, "settings.local.json");
+  const settingsPath = join4(claudeDir, "settings.local.json");
   let settings = {};
   try {
     settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
@@ -3594,9 +3713,9 @@ exit 0
 }
 function provisionChannelProgressHook(codeName) {
   const projectDir = getProjectDir2(codeName);
-  const claudeDir = join3(projectDir, ".claude");
+  const claudeDir = join4(projectDir, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
-  const hookScriptPath = join3(claudeDir, "agt-channel-progress-hook.sh");
+  const hookScriptPath = join4(claudeDir, "agt-channel-progress-hook.sh");
   const hookScript = `#!/usr/bin/env bash
 # Auto-generated by Augmented (ENG-6567 Phase 2) \u2014 PostToolUse channel-progress
 # heartbeat. Writes a throttled local {step, updated_at_ms} the channel MCP reads
@@ -3664,7 +3783,7 @@ fi
 exit 0
 `;
   writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join3(claudeDir, "settings.local.json");
+  const settingsPath = join4(claudeDir, "settings.local.json");
   let settings = {};
   try {
     settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
@@ -3687,11 +3806,11 @@ exit 0
 }
 function provisionOrientHook(codeName) {
   const projectDir = getProjectDir2(codeName);
-  const claudeDir = join3(projectDir, ".claude");
+  const claudeDir = join4(projectDir, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
   const agentDir = getAgentDir(codeName);
-  const codeRoots = [join3(getHomeDir(), "code"), join3(agentDir, "code")];
-  const hookScriptPath = join3(claudeDir, "agt-orient-hook.sh");
+  const codeRoots = [join4(getHomeDir(), "code"), join4(agentDir, "code")];
+  const hookScriptPath = join4(claudeDir, "agt-orient-hook.sh");
   const hookScript = [
     "#!/bin/bash",
     "# Auto-generated by Augmented (ENG-5397) \u2014 SessionStart orientation hook.",
@@ -3964,7 +4083,7 @@ function provisionOrientHook(codeName) {
     "exit 0"
   ].join("\n") + "\n";
   writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join3(claudeDir, "settings.local.json");
+  const settingsPath = join4(claudeDir, "settings.local.json");
   let settings = {};
   try {
     settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
@@ -3991,11 +4110,11 @@ function provisionOrientHook(codeName) {
 }
 function provisionPreCompactHook(codeName) {
   const projectDir = getProjectDir2(codeName);
-  const claudeDir = join3(projectDir, ".claude");
+  const claudeDir = join4(projectDir, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
   const agentDir = getAgentDir(codeName);
   const jqNormalizeContent = '(.message.content // .content // []) | if type == "string" then [{type: "text", text: .}] elif type == "array" then . else [] end';
-  const hookScriptPath = join3(claudeDir, "agt-pre-compact-hook.sh");
+  const hookScriptPath = join4(claudeDir, "agt-pre-compact-hook.sh");
   const hookScript = [
     "#!/bin/bash",
     "# Auto-generated by Augmented (ENG-7339) - PreCompact courtesy notice.",
@@ -4101,7 +4220,7 @@ function provisionPreCompactHook(codeName) {
   ].join("\n") + "\n";
   writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
   chmodSync4(hookScriptPath, 493);
-  const settingsPath = join3(claudeDir, "settings.local.json");
+  const settingsPath = join4(claudeDir, "settings.local.json");
   let settings = {};
   try {
     settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
@@ -4128,10 +4247,10 @@ function provisionPreCompactHook(codeName) {
 }
 function provisionSessionStateHook(codeName) {
   const projectDir = getProjectDir2(codeName);
-  const claudeDir = join3(projectDir, ".claude");
+  const claudeDir = join4(projectDir, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
   const agentDir = getAgentDir(codeName);
-  const hookScriptPath = join3(claudeDir, "agt-session-state-hook.sh");
+  const hookScriptPath = join4(claudeDir, "agt-session-state-hook.sh");
   const hookScript = `#!/usr/bin/env bash
 # Auto-generated by Augmented (ENG-6233 / ENG-6268) \u2014 SessionStart session-state
 # recorder. Writes the model + session origin (which only the agent's own
@@ -4209,7 +4328,7 @@ fi
 exit 0
 `;
   writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
-  const settingsPath = join3(claudeDir, "settings.local.json");
+  const settingsPath = join4(claudeDir, "settings.local.json");
   let settings = {};
   try {
     settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
@@ -4343,7 +4462,7 @@ function buildSettingsJson(input) {
   const projectDir = getProjectDir2(agent.code_name);
   const agentDir = getAgentDir(agent.code_name);
   const homeDir = getHomeDir();
-  const codenameAliasDir = join3(homeDir, ".augmented", agent.code_name);
+  const codenameAliasDir = join4(homeDir, ".augmented", agent.code_name);
   settings["allowedDirectories"] = [
     .../* @__PURE__ */ new Set([
       projectDir,
@@ -4352,7 +4471,7 @@ function buildSettingsJson(input) {
       // Agent's config dir (.env, schedules, registration)
       codenameAliasDir,
       // Codename symlink alias (== agentDir for legacy agents)
-      join3(homeDir, ".augmented", "_mcp"),
+      join4(homeDir, ".augmented", "_mcp"),
       // Shared MCP binaries
       "/tmp"
       // Temp files
@@ -4470,7 +4589,7 @@ ${integrationsBlock}`;
 function renderAugmentedWorkerForAgent(codeName) {
   const agentDir = getAgentDir(codeName);
   const projectDir = getProjectDir2(codeName);
-  const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
+  const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
   let mcpServerKeys;
   try {
     const config = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
@@ -4481,7 +4600,7 @@ function renderAugmentedWorkerForAgent(codeName) {
   const integrations = readIntegrationsSummaryForAgent(codeName);
   const content = buildAugmentedWorkerAgent({ mcpServerKeys, integrations });
   for (const baseDir of [agentDir, projectDir]) {
-    const target = join3(baseDir, ".claude", "agents", "augmented-worker.md");
+    const target = join4(baseDir, ".claude", "agents", "augmented-worker.md");
     try {
       mkdirSync3(dirname3(target), { recursive: true });
       writeFileSync4(target, content);
@@ -4510,8 +4629,8 @@ function buildPostizMcpEntry(integration) {
 }
 function buildMcpJson(input) {
   const mcpServers = {};
-  const turnInitiatorFile = join3(getAgentDir(input.agent.code_name), ".current-turn-initiator.json");
-  const localMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "index.js");
+  const turnInitiatorFile = join4(getAgentDir(input.agent.code_name), ".current-turn-initiator.json");
+  const localMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "index.js");
   mcpServers["augmented"] = {
     command: "node",
     args: [localMcpPath],
@@ -4563,7 +4682,7 @@ function buildMcpJson(input) {
   const xeroIntegration = input.integrations?.find((i) => i.definition_id === "xero");
   if (xeroIntegration) {
     const brokerMode = Boolean(xeroIntegration.id);
-    const localXeroMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "xero.js");
+    const localXeroMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "xero.js");
     mcpServers["xero"] = {
       command: "node",
       args: [localXeroMcpPath],
@@ -4603,7 +4722,7 @@ function buildMcpJson(input) {
         // getProjectDir (the ADR-0049 seam), not the MCP child's inherited
         // cwd, so the path stays correct if Claude Code ever spawns the
         // server from somewhere else.
-        XERO_EXPORT_DIR: join3(getProjectDir2(input.agent.code_name), "xero-exports"),
+        XERO_EXPORT_DIR: join4(getProjectDir2(input.agent.code_name), "xero-exports"),
         PATH: process.env["PATH"] ?? "",
         HOME: process.env["HOME"] ?? ""
       }
@@ -4614,8 +4733,8 @@ function buildMcpJson(input) {
     mcpServers["postiz"] = buildPostizMcpEntry(postizIntegration);
   }
   const remoteOAuthProxyPaths = {
-    proxyPath: join3(getHomeDir(), ".augmented", "_mcp", "remote-oauth-proxy.js"),
-    tokenFile: join3(getProjectDir2(input.agent.code_name), ".env.integrations")
+    proxyPath: join4(getHomeDir(), ".augmented", "_mcp", "remote-oauth-proxy.js"),
+    tokenFile: join4(getProjectDir2(input.agent.code_name), ".env.integrations")
   };
   for (const integration of input.integrations ?? []) {
     const connectionKey = integration.connection_key;
@@ -4681,7 +4800,7 @@ function buildMcpJson(input) {
   }
   const hasAdminDebug = input.integrations?.some((i) => i.definition_id === "augmented-admin") ?? false;
   if (hasAdminDebug) {
-    const localAdminMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-admin.js");
+    const localAdminMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "augmented-admin.js");
     mcpServers["augmented-admin"] = {
       command: "node",
       args: [localAdminMcpPath],
@@ -4695,7 +4814,7 @@ function buildMcpJson(input) {
   }
   const hasSupport = input.integrations?.some((i) => i.definition_id === "augmented-support") ?? false;
   if (hasSupport) {
-    const localSupportMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-support.js");
+    const localSupportMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "augmented-support.js");
     mcpServers["augmented-support"] = {
       command: "node",
       args: [localSupportMcpPath],
@@ -4709,7 +4828,7 @@ function buildMcpJson(input) {
   }
   const hasHelpKb = input.integrations?.some((i) => i.definition_id === "augmented-help-kb") ?? false;
   if (hasHelpKb) {
-    const localHelpKbMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-help-kb.js");
+    const localHelpKbMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "augmented-help-kb.js");
     mcpServers["augmented-help-kb"] = {
       command: "node",
       args: [localHelpKbMcpPath],
@@ -4723,7 +4842,7 @@ function buildMcpJson(input) {
   }
   const origamiIntegration = input.integrations?.find((i) => i.definition_id === "origami");
   if (origamiIntegration?.stdioMcp === true && origamiIntegration.id) {
-    const localOrigamiMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "origami.js");
+    const localOrigamiMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "origami.js");
     mcpServers["origami"] = {
       command: "node",
       args: [localOrigamiMcpPath],
@@ -4736,6 +4855,21 @@ function buildMcpJson(input) {
       }
     };
   }
+  const computerUseIntegration = input.integrations?.find((i) => i.definition_id === COMPUTER_USE_DEFINITION_ID);
+  if (computerUseIntegration) {
+    const rendered = buildComputerUseMcpEntry({
+      agentId: input.agent.agent_id,
+      agentCodeName: input.agent.code_name,
+      config: computerUseIntegration.config,
+      proxyPath: join4(getHomeDir(), ".augmented", "_mcp", "computer-use-proxy.js"),
+      agentDir: getAgentDir(input.agent.code_name)
+    });
+    if (rendered.entry) {
+      mcpServers[COMPUTER_USE_MCP_KEY] = rendered.entry;
+    } else {
+      console.warn(`[claudecode] ${rendered.problem}`);
+    }
+  }
   return { mcpServers };
 }
 function reconstructQuarantinedMcpServerEntry(agent, integration) {
@@ -4972,14 +5106,14 @@ ${sections}`
   },
   async getRegisteredAgents(_profile) {
     const homeDir = getHomeDir();
-    const augDir = join3(homeDir, ".augmented");
+    const augDir = join4(homeDir, ".augmented");
     const agents = /* @__PURE__ */ new Set();
     try {
       const entries = readdirSync(augDir);
       for (const entry of entries) {
         if (entry.startsWith("_") || entry.startsWith("."))
           continue;
-        const agentRoot = join3(augDir, entry);
+        const agentRoot = join4(augDir, entry);
         let st;
         try {
           st = lstatSync(agentRoot);
@@ -4988,11 +5122,11 @@ ${sections}`
         }
         if (st.isSymbolicLink() || !st.isDirectory())
           continue;
-        if (!existsSync4(join3(agentRoot, "registration.json")))
+        if (!existsSync4(join4(agentRoot, "registration.json")))
           continue;
         let codeName = entry;
         try {
-          const reg = JSON.parse(readFileSync4(join3(agentRoot, "registration.json"), "utf8"));
+          const reg = JSON.parse(readFileSync4(join4(agentRoot, "registration.json"), "utf8"));
           if (reg && typeof reg.code_name === "string" && reg.code_name) {
             codeName = reg.code_name;
           }
@@ -5013,7 +5147,7 @@ ${sections}`
       const projectDir = getProjectDir2(codeName);
       mkdirSync3(agentDir, { recursive: true });
       mkdirSync3(projectDir, { recursive: true });
-      writeFileSync4(join3(agentDir, "registration.json"), JSON.stringify({
+      writeFileSync4(join4(agentDir, "registration.json"), JSON.stringify({
         code_name: codeName,
         agent_id: agentId ?? null,
         team_dir: teamDir,
@@ -5032,7 +5166,7 @@ ${sections}`
   async deregisterAgent(codeName) {
     try {
       const agentDir = getAgentDir(codeName);
-      const regFile = join3(agentDir, "registration.json");
+      const regFile = join4(agentDir, "registration.json");
       if (existsSync4(regFile)) {
         const { unlinkSync: unlinkSync5 } = await import("fs");
         unlinkSync5(regFile);
@@ -5058,7 +5192,7 @@ ${sections}`
       }
     }
     if (envLines.length > 1) {
-      const envPath = join3(agentDir, ".env");
+      const envPath = join4(agentDir, ".env");
       writeFileSync4(envPath, envLines.join("\n") + "\n");
       chmodSync4(envPath, SECRET_FILE_MODE);
     }
@@ -5120,7 +5254,7 @@ ${sections}`
       if (!botToken)
         return missingCredentialField("bot_token");
       const allowedChats = config["allowed_chats"];
-      const localTelegramChannel = join3(getHomeDir(), ".augmented", "_mcp", "telegram-channel.js");
+      const localTelegramChannel = join4(getHomeDir(), ".augmented", "_mcp", "telegram-channel.js");
       const resolvedAgtHostForTelegram = process.env["AGT_HOST"]?.trim() || "https://api.augmented.team";
       const resolvedAgtApiKeyForTelegram = process.env["AGT_API_KEY"]?.trim();
       writeEnvIntegrationsForAgent(codeName, {
@@ -5135,7 +5269,7 @@ ${sections}`
         ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {},
         ...tzEnv,
         // ENG-6582 (D16): stamp the verified turn initiator for broker MCPs.
-        AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json")
+        AGT_TURN_INITIATOR_FILE: join4(getAgentDir(codeName), ".current-turn-initiator.json")
       };
       if (allowedChats && allowedChats.length > 0) {
         telegramEnv.TELEGRAM_ALLOWED_CHATS = allowedChats.join(",");
@@ -5198,7 +5332,7 @@ ${sections}`
         args: [localTelegramChannel],
         env: telegramEnv
       };
-      const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
+      const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
       mkdirSync3(dirname3(provisionMcpPath), { recursive: true });
       let mcpConfig2 = { mcpServers: {} };
       try {
@@ -5216,13 +5350,13 @@ ${sections}`
     }
     if (isPersistent && (channelId === "discord" || channelId === "slack")) {
       let wrotePersistentCredential = false;
-      const channelDir = join3(getHomeDir(), ".claude", "channels", channelId);
+      const channelDir = join4(getHomeDir(), ".claude", "channels", channelId);
       if (channelId === "discord")
         mkdirSync3(channelDir, { recursive: true });
       if (channelId === "discord") {
         const botToken = config["bot_token"];
         if (botToken) {
-          writeFileSync4(join3(channelDir, ".env"), `DISCORD_BOT_TOKEN=${botToken}
+          writeFileSync4(join4(channelDir, ".env"), `DISCORD_BOT_TOKEN=${botToken}
 `);
           wrotePersistentCredential = true;
         }
@@ -5286,7 +5420,7 @@ ${sections}`
               ...appToken ? { SLACK_APP_TOKEN: appToken } : {}
             }, ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"])
           });
-          const localSlackChannel = join3(getHomeDir(), ".augmented", "_mcp", "slack-channel.js");
+          const localSlackChannel = join4(getHomeDir(), ".augmented", "_mcp", "slack-channel.js");
           const slackAvatarEnvUrl = resolveAvatarEnvUrl(options?.agentAvatarUrl).url;
           const slackEntry = {
             command: existsSync4(localSlackChannel) ? "node" : "npx",
@@ -5372,10 +5506,10 @@ ${sections}`
               ...pingAllowedUsers.length > 0 ? { SLACK_PING_ALLOWED_USERS: pingAllowedUsers.join(",") } : {},
               // ENG-6563 (D16): stamp the verified turn initiator so broker MCPs
               // can forward it when the agent files an approval mid-turn.
-              AGT_TURN_INITIATOR_FILE: join3(agentDir, ".current-turn-initiator.json")
+              AGT_TURN_INITIATOR_FILE: join4(agentDir, ".current-turn-initiator.json")
             }
           };
-          const provisionMcpPath = join3(agentDir, "provision", ".mcp.json");
+          const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
           mkdirSync3(dirname3(provisionMcpPath), { recursive: true });
           let mcpConfig2 = { mcpServers: {} };
           try {
@@ -5390,7 +5524,7 @@ ${sections}`
           }
           syncMcpToProject(codeName);
           wrotePersistentCredential = true;
-          const staleChannelsPath = join3(getProjectDir2(codeName), ".mcp-channels.json");
+          const staleChannelsPath = join4(getProjectDir2(codeName), ".mcp-channels.json");
           if (existsSync4(staleChannelsPath)) {
             try {
               rmSync2(staleChannelsPath, { force: true });
@@ -5404,7 +5538,7 @@ ${sections}`
       }
       return CHANNEL_WRITE_OK;
     }
-    const mcpJsonPath = join3(agentDir, "provision", ".mcp.json");
+    const mcpJsonPath = join4(agentDir, "provision", ".mcp.json");
     mkdirSync3(dirname3(mcpJsonPath), { recursive: true });
     let mcpConfig;
     try {
@@ -5427,7 +5561,7 @@ ${sections}`
       const appToken = config["app_token"];
       if (!botToken)
         return missingCredentialField("bot_token");
-      const localSlackChannel = join3(getHomeDir(), ".augmented", "_mcp", "slack-channel.js");
+      const localSlackChannel = join4(getHomeDir(), ".augmented", "_mcp", "slack-channel.js");
       const slackThreadAutoFollow = config["thread_auto_follow"];
       const slackAutoFollowEnv = slackThreadAutoFollow && slackThreadAutoFollow !== "off" ? { SLACK_THREAD_AUTO_FOLLOW: slackThreadAutoFollow } : {};
       const slackChannelResponseMode = config["channel_response_mode"];
@@ -5516,7 +5650,7 @@ ${sections}`
             ...slackAgtAuthEnv,
             ...tzEnv,
             // ENG-6563 (D16): stamp the verified turn initiator for broker MCPs.
-            AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json"),
+            AGT_TURN_INITIATOR_FILE: join4(getAgentDir(codeName), ".current-turn-initiator.json"),
             // ENG-6155: avatar URL → bot Slack profile photo (see persistent
             // branch above). Mirrored here so oneshot-mode agents get it too.
             // ENG-6245: slackAvatarEnvUrl is null for data-URI / oversized values.
@@ -5541,7 +5675,7 @@ ${sections}`
             ...slackAgtAuthEnv,
             ...tzEnv,
             // ENG-6563 (D16): stamp the verified turn initiator for broker MCPs.
-            AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json"),
+            AGT_TURN_INITIATOR_FILE: join4(getAgentDir(codeName), ".current-turn-initiator.json"),
             // ENG-6155: avatar URL → bot Slack profile photo (see persistent
             // branch above). Mirrored here so oneshot-mode agents get it too.
             // ENG-6245: slackAvatarEnvUrl is null for data-URI / oversized values.
@@ -5555,12 +5689,12 @@ ${sections}`
       if (!appId || !clientSecret) {
         return missingCredentialField(!appId ? "app_id" : "client_secret");
       }
-      const localTeamsChannel = join3(getHomeDir(), ".augmented", "_mcp", "teams-channel.js");
+      const localTeamsChannel = join4(getHomeDir(), ".augmented", "_mcp", "teams-channel.js");
       const agentDirMs = getAgentDir(codeName);
       try {
-        mkdirSync3(join3(agentDirMs, "msteams-pending-inbound", ".markers"), { recursive: true });
-        mkdirSync3(join3(agentDirMs, "msteams-pending-interactions"), { recursive: true });
-        mkdirSync3(join3(agentDirMs, "msteams-recovery-outbox"), { recursive: true });
+        mkdirSync3(join4(agentDirMs, "msteams-pending-inbound", ".markers"), { recursive: true });
+        mkdirSync3(join4(agentDirMs, "msteams-pending-interactions"), { recursive: true });
+        mkdirSync3(join4(agentDirMs, "msteams-recovery-outbox"), { recursive: true });
       } catch {
       }
       const tenantId = config["tenant_id"] ?? "common";
@@ -5638,7 +5772,7 @@ ${sections}`
     }
     if (channelId === "whatsapp") {
       const provider = config["provider"] ?? "kapso";
-      const localWhatsappChannel = join3(getHomeDir(), ".augmented", "_mcp", "whatsapp-channel.js");
+      const localWhatsappChannel = join4(getHomeDir(), ".augmented", "_mcp", "whatsapp-channel.js");
       if (provider === "baileys") {
         mcpServers["whatsapp"] = {
           command: "node",
@@ -5658,7 +5792,7 @@ ${sections}`
       const phoneNumberId = config["phone_number_id"];
       if (projectApiKey && phoneNumberId) {
         try {
-          mkdirSync3(join3(getAgentDir(codeName), "whatsapp-pending-inbound"), { recursive: true });
+          mkdirSync3(join4(getAgentDir(codeName), "whatsapp-pending-inbound"), { recursive: true });
         } catch {
         }
         writeEnvIntegrationsForAgent(codeName, {
@@ -5690,7 +5824,7 @@ ${sections}`
     return CHANNEL_WRITE_OK;
   },
   hasChannelCredentials(codeName, channelId) {
-    const provisionMcpPath = join3(getAgentDir(codeName), "provision", ".mcp.json");
+    const provisionMcpPath = join4(getAgentDir(codeName), "provision", ".mcp.json");
     if (!existsSync4(provisionMcpPath))
       return false;
     try {
@@ -5702,7 +5836,7 @@ ${sections}`
   },
   removeChannelCredentials(codeName, channelId) {
     const agentDir = getAgentDir(codeName);
-    const mcpJsonPath = join3(agentDir, "provision", ".mcp.json");
+    const mcpJsonPath = join4(agentDir, "provision", ".mcp.json");
     modifyJsonConfig(mcpJsonPath, (config) => {
       const mcpServers = config["mcpServers"];
       if (!mcpServers || !(channelId in mcpServers))
@@ -5714,7 +5848,7 @@ ${sections}`
   },
   async updateAgentModel(codeName, model) {
     const agentDir = getAgentDir(codeName);
-    const settingsPath = join3(agentDir, "provision", "settings.json");
+    const settingsPath = join4(agentDir, "provision", "settings.json");
     let changed = false;
     modifyJsonConfig(settingsPath, (config) => {
       config["model"] = model;
@@ -5732,12 +5866,12 @@ ${sections}`
   seedProfileConfig(codeName) {
     const agentDir = getAgentDir(codeName);
     const projectDir = getProjectDir2(codeName);
-    mkdirSync3(join3(agentDir, "provision"), { recursive: true });
+    mkdirSync3(join4(agentDir, "provision"), { recursive: true });
     mkdirSync3(projectDir, { recursive: true });
   },
   syncScheduledTasks(codeName, tasks) {
     const agentDir = getAgentDir(codeName);
-    const schedulesPath = join3(agentDir, "schedules.json");
+    const schedulesPath = join4(agentDir, "schedules.json");
     const mapped = mapScheduledTasks(tasks);
     mkdirSync3(agentDir, { recursive: true });
     writeFileSync4(schedulesPath, JSON.stringify({ schedules: mapped }, null, 2));
@@ -5862,7 +5996,7 @@ ${sections}`
         xeroEnv.AGT_AGENT_ID = agentId;
         xeroEnv.AGT_INTEGRATION_ID = xeroIntegration.id;
       }
-      const localXeroMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "xero.js");
+      const localXeroMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "xero.js");
       this.writeMcpServer(codeName, "xero", {
         command: "node",
         args: [localXeroMcpPath],
@@ -5874,8 +6008,8 @@ ${sections}`
       this.writeMcpServer(codeName, "postiz", buildPostizMcpEntry(postizIntegration));
     }
     const remoteOAuthProxyPaths = {
-      proxyPath: join3(getHomeDir(), ".augmented", "_mcp", "remote-oauth-proxy.js"),
-      tokenFile: join3(getProjectDir2(codeName), ".env.integrations")
+      proxyPath: join4(getHomeDir(), ".augmented", "_mcp", "remote-oauth-proxy.js"),
+      tokenFile: join4(getProjectDir2(codeName), ".env.integrations")
     };
     for (const integration of integrations) {
       const connectionKey = integration.connection_key;
@@ -5916,7 +6050,7 @@ ${sections}`
             // ENG-6586 (D16): keep incremental cloud-broker wiring in sync with
             // buildMcpJson so agents that add cloud-broker post-provision still
             // forward the per-turn initiator.
-            AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json"),
+            AGT_TURN_INITIATOR_FILE: join4(getAgentDir(codeName), ".current-turn-initiator.json"),
             PATH: process.env["PATH"] ?? "",
             HOME: process.env["HOME"] ?? ""
           }
@@ -5940,7 +6074,7 @@ ${sections}`
             // ENG-6563 (D16): keep incremental xero-broker wiring in sync with
             // buildMcpJson so agents that add xero-broker post-provision still
             // forward the per-turn initiator.
-            AGT_TURN_INITIATOR_FILE: join3(getAgentDir(codeName), ".current-turn-initiator.json"),
+            AGT_TURN_INITIATOR_FILE: join4(getAgentDir(codeName), ".current-turn-initiator.json"),
             PATH: process.env["PATH"] ?? "",
             HOME: process.env["HOME"] ?? ""
           }
@@ -5949,7 +6083,7 @@ ${sections}`
     }
     const hasAdminDebug = integrations.some((i) => i.definition_id === "augmented-admin");
     if (hasAdminDebug) {
-      const localAdminMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-admin.js");
+      const localAdminMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "augmented-admin.js");
       this.writeMcpServer(codeName, "augmented-admin", {
         command: "node",
         args: [localAdminMcpPath],
@@ -5963,7 +6097,7 @@ ${sections}`
     }
     const hasSupport = integrations.some((i) => i.definition_id === "augmented-support");
     if (hasSupport) {
-      const localSupportMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-support.js");
+      const localSupportMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "augmented-support.js");
       this.writeMcpServer(codeName, "augmented-support", {
         command: "node",
         args: [localSupportMcpPath],
@@ -5977,7 +6111,7 @@ ${sections}`
     }
     const hasHelpKb = integrations.some((i) => i.definition_id === "augmented-help-kb");
     if (hasHelpKb) {
-      const localHelpKbMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "augmented-help-kb.js");
+      const localHelpKbMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "augmented-help-kb.js");
       this.writeMcpServer(codeName, "augmented-help-kb", {
         command: "node",
         args: [localHelpKbMcpPath],
@@ -5993,7 +6127,7 @@ ${sections}`
     const origamiStdioAgentId = resolveBrokerAgentId(codeName) ?? agentId;
     const origamiStdioExpected = Boolean(origamiStdio?.stdioMcp === true && origamiStdio.id);
     if (origamiStdioExpected && origamiStdioAgentId) {
-      const localOrigamiMcpPath = join3(getHomeDir(), ".augmented", "_mcp", "origami.js");
+      const localOrigamiMcpPath = join4(getHomeDir(), ".augmented", "_mcp", "origami.js");
       this.writeMcpServer(codeName, "origami", {
         command: "node",
         args: [localOrigamiMcpPath],
@@ -6006,6 +6140,23 @@ ${sections}`
         }
       });
     }
+    const computerUseRow = integrations.find((i) => i.definition_id === COMPUTER_USE_DEFINITION_ID);
+    const computerUseAgentId = resolveBrokerAgentId(codeName) ?? agentId;
+    const computerUseExpected = Boolean(computerUseRow);
+    if (computerUseRow && computerUseAgentId) {
+      const rendered = buildComputerUseMcpEntry({
+        agentId: computerUseAgentId,
+        agentCodeName: codeName,
+        config: computerUseRow.config,
+        proxyPath: join4(getHomeDir(), ".augmented", "_mcp", "computer-use-proxy.js"),
+        agentDir: getAgentDir(codeName)
+      });
+      if (rendered.entry) {
+        this.writeMcpServer(codeName, COMPUTER_USE_MCP_KEY, rendered.entry);
+      } else {
+        console.warn(`[claudecode] ${rendered.problem}`);
+      }
+    }
     if (this.removeMcpServer) {
       const nativeMcpKeys = INTEGRATION_REGISTRY.filter((d) => d.nativeMcp !== void 0).map((d) => d.nativeMcp.key ?? d.id);
       const registryRemoteMcpKeys = INTEGRATION_REGISTRY.filter((d) => d.remoteMcp !== void 0).map((d) => d.id);
@@ -6025,6 +6176,15 @@ ${sections}`
         // that removing the integration OR flipping the catalog stdio_mcp
         // flag back (rollback) prunes the entry symmetrically.
         "origami",
+        // ENG-10133: the computer-use proxy. In the universe for BOTH of the
+        // ways this entry must disappear, which here are the same event seen
+        // twice: the operator revokes the integration, or the
+        // `open-computer-use` flag is turned off and the API stops forwarding
+        // the row. Either way the row leaves `integrations` and this prune is
+        // what takes the server off disk. Missing from this set, an agent would
+        // keep a live path to someone's desktop after the grant was withdrawn —
+        // the ENG-8332 shape, on the one integration where it matters most.
+        COMPUTER_USE_MCP_KEY,
         // ENG-8421 retirement tombstone. Vercel moved from a remote MCP
         // (`https://mcp.vercel.com`) to an api_key Direct HTTP integration, so
         // its registry entry no longer carries `remoteMcp` — which means it no
@@ -6088,6 +6248,8 @@ ${sections}`
         expectedKeys.add("augmented-help-kb");
       if (origamiStdioExpected)
         expectedKeys.add("origami");
+      if (computerUseExpected)
+        expectedKeys.add(COMPUTER_USE_MCP_KEY);
       for (const integration of integrations) {
         const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
         if (def?.nativeMcp) {
@@ -6110,7 +6272,7 @@ ${sections}`
       }
     }
     const projectDir = getProjectDir2(codeName);
-    const claudeMdPath = join3(projectDir, "CLAUDE.md");
+    const claudeMdPath = join4(projectDir, "CLAUDE.md");
     try {
       const existing = readFileSync4(claudeMdPath, "utf-8");
       const renderSection = options?.renderClaudeMdSection === true;
@@ -6131,10 +6293,10 @@ ${sections}`
       if (updated !== existing)
         writeFileSync4(claudeMdPath, updated);
       const agentDir2 = getAgentDir(codeName);
-      const envSrc = join3(agentDir2, ".env.integrations");
+      const envSrc = join4(agentDir2, ".env.integrations");
       try {
         const envContent = readFileSync4(envSrc, "utf-8");
-        const envDest = join3(projectDir, ".env.integrations");
+        const envDest = join4(projectDir, ".env.integrations");
         writeFileSync4(envDest, envContent, { mode: SECRET_FILE_MODE });
         try {
           chmodSync4(envDest, SECRET_FILE_MODE);
@@ -6149,8 +6311,8 @@ ${sections}`
   },
   writeMcpServer(codeName, serverId, config) {
     const agentDir = getAgentDir(codeName);
-    const mcpJsonPath = join3(agentDir, "provision", ".mcp.json");
-    mkdirSync3(join3(agentDir, "provision"), { recursive: true });
+    const mcpJsonPath = join4(agentDir, "provision", ".mcp.json");
+    mkdirSync3(join4(agentDir, "provision"), { recursive: true });
     let mcpConfig;
     try {
       mcpConfig = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
@@ -6197,7 +6359,7 @@ ${sections}`
     }
   },
   getMcpPath(codeName) {
-    return join3(getAgentDir(codeName), "provision", ".mcp.json");
+    return join4(getAgentDir(codeName), "provision", ".mcp.json");
   },
   /**
    * ENG-7994: the declared servers from `provision/.mcp.json`. Mirrors what the
@@ -6208,7 +6370,7 @@ ${sections}`
   readMcpServers(codeName) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync4(join3(getAgentDir(codeName), "provision", ".mcp.json"), "utf-8"));
+      parsed = JSON.parse(readFileSync4(join4(getAgentDir(codeName), "provision", ".mcp.json"), "utf-8"));
     } catch {
       return {};
     }
@@ -6221,7 +6383,7 @@ ${sections}`
   },
   removeMcpServer(codeName, serverId) {
     const agentDir = getAgentDir(codeName);
-    const mcpJsonPath = join3(agentDir, "provision", ".mcp.json");
+    const mcpJsonPath = join4(agentDir, "provision", ".mcp.json");
     let mcpConfig;
     try {
       mcpConfig = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
@@ -6243,17 +6405,17 @@ ${sections}`
     const READ_WRITE_MODE = 420;
     const agentDir = getAgentDir(codeName);
     const projectDir = getProjectDir2(codeName);
-    for (const baseDir of [join3(agentDir, "skills"), join3(projectDir, ".claude", "skills")]) {
-      const skillDir = join3(baseDir, skillId);
+    for (const baseDir of [join4(agentDir, "skills"), join4(projectDir, ".claude", "skills")]) {
+      const skillDir = join4(baseDir, skillId);
       mkdirSync3(skillDir, { recursive: true });
       for (const file of files) {
         assertSafeRelativePath(file.relativePath);
-        const filePath = join3(skillDir, file.relativePath);
+        const filePath = join4(skillDir, file.relativePath);
         const rel = relative(skillDir, filePath);
         if (rel.startsWith("..") || rel === "") {
           throw new Error(`Path traversal detected: ${file.relativePath} resolves outside ${skillDir}`);
         }
-        mkdirSync3(join3(filePath, ".."), { recursive: true });
+        mkdirSync3(join4(filePath, ".."), { recursive: true });
         if (isPluginManaged && existsSync4(filePath)) {
           try {
             chmodSync4(filePath, READ_WRITE_MODE);
@@ -6272,7 +6434,7 @@ ${sections}`
   },
   installPlugin(codeName, pluginId, pluginPath, pluginConfig) {
     const agentDir = getAgentDir(codeName);
-    const pluginsJsonPath = join3(agentDir, "plugins.json");
+    const pluginsJsonPath = join4(agentDir, "plugins.json");
     mkdirSync3(agentDir, { recursive: true });
     let pluginsConfig;
     try {
@@ -6305,11 +6467,11 @@ ${sections}`
     assertValidCodeName(codeName);
     assertValidCodeName(plugin.slug);
     const projectDir = getProjectDir2(codeName);
-    const claudeDir = join3(projectDir, ".claude");
+    const claudeDir = join4(projectDir, ".claude");
     mkdirSync3(claudeDir, { recursive: true });
     const sourceSpec = options?.scriptSource ?? `augmented-plugin:${plugin.slug}`;
     this.installPlugin(codeName, plugin.slug, sourceSpec, contextValues);
-    const installedDir = join3(projectDir, ".claude", "plugins", plugin.slug);
+    const installedDir = join4(projectDir, ".claude", "plugins", plugin.slug);
     for (const skill of plugin.skills) {
       const skillId = skill.id;
       assertValidCodeName(skillId);
@@ -6321,7 +6483,7 @@ ${sections}`
     }
     const scriptsConfig = plugin.scripts;
     if (scriptsConfig?.hooks) {
-      const settingsPath = join3(claudeDir, "settings.local.json");
+      const settingsPath = join4(claudeDir, "settings.local.json");
       let settings = {};
       try {
         settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
@@ -6361,7 +6523,7 @@ ${sections}`
       writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
     }
     if (plugin.allowed_tools.length > 0) {
-      const settingsPath = join3(claudeDir, "settings.local.json");
+      const settingsPath = join4(claudeDir, "settings.local.json");
       let settings = {};
       try {
         settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
@@ -6379,14 +6541,14 @@ ${sections}`
       writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
     }
     if (contextValues && Object.keys(contextValues).length > 0) {
-      const configDir = join3(projectDir, `.${plugin.slug}`);
+      const configDir = join4(projectDir, `.${plugin.slug}`);
       mkdirSync3(configDir, { recursive: true });
-      writeFileSync4(join3(configDir, "config.json"), JSON.stringify(contextValues, null, 2));
+      writeFileSync4(join4(configDir, "config.json"), JSON.stringify(contextValues, null, 2));
     }
   },
   executePluginHook(ctx) {
     assertValidCodeName(ctx.codeName);
-    const agentRootDir = join3(getHomeDir(), ".augmented", ctx.codeName);
+    const agentRootDir = join4(getHomeDir(), ".augmented", ctx.codeName);
     const projectDir = getProjectDir2(ctx.codeName);
     mkdirSync3(agentRootDir, { recursive: true });
     mkdirSync3(projectDir, { recursive: true });
@@ -6442,7 +6604,7 @@ ${sections}`
     }
     if (Object.keys(tokens).length === 0)
       return;
-    const tokenPath = join3(agentDir, ".tokens.json");
+    const tokenPath = join4(agentDir, ".tokens.json");
     writeFileSync4(tokenPath, JSON.stringify(tokens, null, 2));
     chmodSync4(tokenPath, SECRET_FILE_MODE);
   }
@@ -6467,10 +6629,10 @@ function jsonOutput(data) {
 
 // src/lib/config.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 import { homedir as homedir4 } from "os";
-var AUGMENTED_DIR = join4(homedir4(), ".augmented");
-var CONFIG_PATH = join4(AUGMENTED_DIR, "config.json");
+var AUGMENTED_DIR = join5(homedir4(), ".augmented");
+var CONFIG_PATH = join5(AUGMENTED_DIR, "config.json");
 function ensureAugmentedDir() {
   if (!existsSync5(AUGMENTED_DIR)) {
     mkdirSync4(AUGMENTED_DIR, { recursive: true });
@@ -6483,7 +6645,7 @@ function loadFromShellProfile(force = false) {
   if (!force && process.env["AGT_HOST"] && process.env["AGT_API_KEY"]) return;
   const shell = process.env["SHELL"] ?? "";
   const home = homedir4();
-  const candidates = shell.includes("zsh") ? [join4(home, ".zshrc"), join4(home, ".zprofile")] : shell.includes("fish") ? [join4(home, ".config", "fish", "config.fish")] : [join4(home, ".bashrc"), join4(home, ".bash_profile")];
+  const candidates = shell.includes("zsh") ? [join5(home, ".zshrc"), join5(home, ".zprofile")] : shell.includes("fish") ? [join5(home, ".config", "fish", "config.fish")] : [join5(home, ".bashrc"), join5(home, ".bash_profile")];
   for (const profile of candidates) {
     try {
       const content = readFileSync5(profile, "utf-8");
@@ -6566,7 +6728,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.854" : "dev";
+var agtCliVersion = true ? "0.28.856" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -6864,9 +7026,9 @@ function atomicWriteFileSync(path, data) {
 
 // src/lib/feature-flags-host.ts
 import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 function defaultFlagsCachePath(configDir) {
-  return join5(configDir, "flags-cache.json");
+  return join6(configDir, "flags-cache.json");
 }
 function readFlagsCache(path) {
   try {
@@ -8661,7 +8823,7 @@ function verdictForUnavailableMcpConfig(cause, ctx) {
 }
 
 // src/lib/connectivity-probe-context.ts
-import { delimiter as pathDelimiter, join as join6 } from "path";
+import { delimiter as pathDelimiter, join as join7 } from "path";
 import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir5 } from "os";
 
@@ -9295,7 +9457,7 @@ function resolveHttpServerEntry(entry, env) {
 function readMcpHttpServerConfig(projectDir, serverKey, env) {
   let servers;
   try {
-    const raw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync7(join7(projectDir, ".mcp.json"), "utf-8");
     servers = JSON.parse(raw).mcpServers ?? {};
   } catch {
     return { ok: false, cause: "file-unreadable" };
@@ -9307,7 +9469,7 @@ function readMcpHttpServerConfig(projectDir, serverKey, env) {
 }
 function resolveDeclaredServerKey(projectDir, definitionId, derivedKey) {
   try {
-    const raw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync7(join7(projectDir, ".mcp.json"), "utf-8");
     const servers = JSON.parse(raw).mcpServers ?? {};
     const declared = Object.keys(servers);
     if (derivedKey !== definitionId && derivedKey !== sanitizeServerKey(definitionId)) {
@@ -9349,7 +9511,7 @@ function resolveStdioServerEntry(entry, env) {
 function readMcpStdioServerConfig(projectDir, serverKey, env) {
   let servers;
   try {
-    const raw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync7(join7(projectDir, ".mcp.json"), "utf-8");
     servers = JSON.parse(raw).mcpServers ?? {};
   } catch {
     return { ok: false, cause: "file-unreadable" };
@@ -9377,13 +9539,13 @@ function toolkitPathDirs() {
   const home = process.env.HOME?.trim() || homedir5();
   return [
     ...PROBE_TOOLKIT_PATH_DIRS,
-    ...PROBE_HOME_RELATIVE_PATH_SEGMENTS.map((seg) => join6(home, seg))
+    ...PROBE_HOME_RELATIVE_PATH_SEGMENTS.map((seg) => join7(home, seg))
   ];
 }
 function buildProbeEnv(projectDir, agentId) {
   const probeEnv = { ...process.env };
   try {
-    const envIntPath = join6(projectDir, ".env.integrations");
+    const envIntPath = join7(projectDir, ".env.integrations");
     if (existsSync7(envIntPath)) {
       Object.assign(probeEnv, parseEnvIntegrations(readFileSync7(envIntPath, "utf-8")));
     }
@@ -9393,7 +9555,7 @@ function buildProbeEnv(projectDir, agentId) {
     probeEnv.AGT_AGENT_ID = agentId.trim();
   }
   try {
-    const agentBinDir = join6(projectDir, ".claude", "agt-bin");
+    const agentBinDir = join7(projectDir, ".claude", "agt-bin");
     if (existsSync7(agentBinDir)) {
       const parts = probeEnv.PATH ? probeEnv.PATH.split(pathDelimiter) : [];
       parts.unshift(agentBinDir);
@@ -9547,7 +9709,7 @@ function buildConnectivityProbeDeps(projectDir, probeEnv) {
 // src/lib/session-tool-bind-probe-host.ts
 import { execFileSync as syncExecFile } from "child_process";
 import { readFileSync as readFileSync8 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import { dirname as dirname5 } from "path";
 function deliveryFields(i) {
   const keys = ["source_type", "provider", "mcp_command", "mcp_url", "cli_binary", "cli_package"];
@@ -9561,7 +9723,7 @@ async function gatherSessionToolBindProbe(agent, integrations, projectDir, opts)
   if (integrations.length === 0) return null;
   let mcpRaw = null;
   try {
-    mcpRaw = readFileSync8(join7(projectDir, ".mcp.json"), "utf-8");
+    mcpRaw = readFileSync8(join8(projectDir, ".mcp.json"), "utf-8");
   } catch {
     mcpRaw = null;
   }
@@ -9654,7 +9816,7 @@ var SLACK_MCP_SERVER_KEY = "slack";
 function readSlackTransportDownKeys(projectDir) {
   const none = /* @__PURE__ */ new Set();
   try {
-    const raw = readFileSync8(join7(dirname5(projectDir), SLACK_SOCKET_STATE_FILENAME), "utf-8");
+    const raw = readFileSync8(join8(dirname5(projectDir), SLACK_SOCKET_STATE_FILENAME), "utf-8");
     const state = parseSlackSocketState(raw, Date.now());
     return isSlackInboundTransportDown(state, SLACK_TRANSPORT_DOWN_AFTER_MS) ? /* @__PURE__ */ new Set([SLACK_MCP_SERVER_KEY]) : none;
   } catch {
@@ -9741,7 +9903,7 @@ function describeWorkerModuleFailure(err) {
 // src/lib/drain-transcript-flush.ts
 import { existsSync as existsSync8, readdirSync as readdirSync2 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname6, join as join8, relative as relative2, sep } from "path";
+import { dirname as dirname6, join as join9, relative as relative2, sep } from "path";
 import { spawn as spawn2 } from "child_process";
 
 // src/lib/host-archive-address.ts
@@ -9785,7 +9947,7 @@ function readHostArchiveAddress(path) {
 
 // src/lib/drain-transcript-flush.ts
 function sessionsBaseDir() {
-  return join8(homedir6(), ".claude", "projects");
+  return join9(homedir6(), ".claude", "projects");
 }
 var PER_FILE_UPLOAD_TIMEOUT_MS = 3e4;
 var UPLOAD_CONCURRENCY = 4;
@@ -9796,7 +9958,7 @@ function listJsonlFiles(dir) {
   const out = [];
   const walk = (d) => {
     for (const entry of readdirSync2(d, { withFileTypes: true })) {
-      const full = join8(d, entry.name);
+      const full = join9(d, entry.name);
       if (entry.isDirectory()) walk(full);
       else if (entry.isFile() && entry.name.endsWith(".jsonl")) out.push(full);
     }
@@ -9813,7 +9975,7 @@ function transcriptObjectKey(keyPrefix, baseDir, file) {
   return `${keyPrefix.replace(/\/+$/, "")}/${rel}`;
 }
 function drainManifestObjectKey(keyPrefix, baseDir, transcriptDir) {
-  return transcriptObjectKey(keyPrefix, baseDir, join8(transcriptDir, DRAIN_MANIFEST_FILENAME));
+  return transcriptObjectKey(keyPrefix, baseDir, join9(transcriptDir, DRAIN_MANIFEST_FILENAME));
 }
 async function flushAgentTranscriptsOnDrain(codeName, deps) {
   const dir = deps.resolveTranscriptDir(codeName);
@@ -9965,7 +10127,7 @@ function drainTranscriptFlushDeps(log2) {
     // tree — the thing host-archive-address.ts's header warns about.
     readSourceLayout: (codeName) => {
       const agentDir = dirname6(getProjectDir(codeName));
-      const codeNameDir = join8(homedir6(), ".augmented", codeName);
+      const codeNameDir = join9(homedir6(), ".augmented", codeName);
       return { layout: agentDir === codeNameDir ? "codename-keyed" : "id-keyed", agentDir };
     },
     readSessionPin: (codeName) => readDailySessionPin(codeName),
@@ -10053,20 +10215,20 @@ function decidePin(opts) {
 // src/commands/manager.ts
 import chalk3 from "chalk";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { homedir as homedir7, userInfo } from "os";
 import { spawn as spawn4 } from "child_process";
 
 // src/lib/watchdog.ts
 import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, unlinkSync as unlinkSync4, existsSync as existsSync9, mkdirSync as mkdirSync6, openSync as openSync2, closeSync as closeSync2, chmodSync as chmodSync5 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { spawn as spawn3, execFileSync as execFileSync3 } from "child_process";
-var DEFAULT_CONFIG_DIR = join9(process.env["HOME"] ?? "/tmp", ".augmented");
+var DEFAULT_CONFIG_DIR = join10(process.env["HOME"] ?? "/tmp", ".augmented");
 function getManagerPaths(configDir) {
   return {
-    pidFile: join9(configDir, "manager.pid"),
-    stateFile: join9(configDir, "manager-state.json"),
-    logFile: join9(configDir, "manager.log")
+    pidFile: join10(configDir, "manager.pid"),
+    stateFile: join10(configDir, "manager-state.json"),
+    logFile: join10(configDir, "manager.log")
   };
 }
 function ensureDir(configDir) {
@@ -10322,7 +10484,7 @@ function managerStartCommand(opts) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join10(homedir7(), ".augmented");
+  const configDir = opts.configDir ?? join11(homedir7(), ".augmented");
   if (opts.supervise) {
     if (json) {
       jsonOutput({ ok: false, error: "--supervise is not supported with --json" });
@@ -10418,7 +10580,7 @@ function runSupervisorLoop(intervalSec, configDir) {
 }
 async function managerStopCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join10(homedir7(), ".augmented");
+  const configDir = opts.configDir ?? join11(homedir7(), ".augmented");
   try {
     const result = await stopWatchdog(configDir);
     if (!result.stopped && !result.pid) {
@@ -10446,7 +10608,7 @@ async function managerStopCommand(opts = {}) {
 }
 function managerStatusCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join10(homedir7(), ".augmented");
+  const configDir = opts.configDir ?? join11(homedir7(), ".augmented");
   const status = getManagerStatus(configDir);
   if (!status) {
     if (json) {
@@ -10538,7 +10700,7 @@ async function managerInstallCommand(opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join10(homedir7(), ".augmented");
+  const configDir = opts.configDir ?? join11(homedir7(), ".augmented");
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -10551,7 +10713,7 @@ async function managerInstallCommand(opts = {}) {
   if (process.platform === "darwin") {
     const home = homedir7();
     const protectedRoots = ["Documents", "Downloads", "Desktop", "Movies", "Music", "Pictures"];
-    const offending = protectedRoots.map((r) => join10(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
+    const offending = protectedRoots.map((r) => join11(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
     if (offending) {
       const msg = `agt binary at ${agtBin} sits inside a macOS TCC-protected folder (${offending}). launchd-spawned processes cannot read files there and the manager would EPERM on startup. Either install agt globally (\`npm install -g @integrity-labs/agt-cli\`) or copy the dist outside protected folders before running this command.`;
       if (json) jsonOutput({ ok: false, error: msg });
@@ -10620,7 +10782,7 @@ async function managerInstallSystemUnitCommand(opts = {}) {
     return;
   }
   const user = opts.user ?? "root";
-  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join10("/home", user, ".augmented"));
+  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join11("/home", user, ".augmented"));
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -10924,4 +11086,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-FHOLG6VL.js.map
+//# sourceMappingURL=chunk-6I5IMMWR.js.map