@integrity-labs/agt-cli 0.28.860 → 0.28.861

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-HKJLINLX.js";
+} from "../chunk-IQROQ3XJ.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-MRDINJFN.js";
+} from "../chunk-G23CONQJ.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-7F7DI322.js";
+} from "../chunk-USHD2L3F.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.860" : "dev";
+var cliVersion = true ? "0.28.861" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.860" : "dev";
+var cliVersion2 = true ? "0.28.861" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-MRDINJFN.js → chunk-G23CONQJ.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-7F7DI322.js";
+} from "./chunk-USHD2L3F.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5431,4 +5431,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-MRDINJFN.js.map
+//# sourceMappingURL=chunk-G23CONQJ.js.map

package/dist/{chunk-HKJLINLX.js → chunk-IQROQ3XJ.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-MRDINJFN.js";
+} from "./chunk-G23CONQJ.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -76,7 +76,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-7F7DI322.js";
+} from "./chunk-USHD2L3F.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -320,6 +320,125 @@ function formatMirrorMismatch(m) {
   return `[mcp-mirror] [parity-violation] server=${m.server} field=${m.field} location=${m.location} reason=${m.reason}`;
 }
 
+// ../../packages/core/dist/provisioning/computer-use-mcp.js
+import { join } from "path";
+var COMPUTER_USE_DEFINITION_ID = "open-computer-use";
+var COMPUTER_USE_MCP_KEY = "open-computer-use";
+var COMPUTER_USE_SSH_KEY_ENV = `${remoteMcpEnvPrefix(COMPUTER_USE_DEFINITION_ID, null)}_API_KEY`;
+var DEFAULT_SSH_HOST = "127.0.0.1";
+var DEFAULT_SSH_PORT = 2222;
+var DEFAULT_REMOTE_COMMAND = "open-computer-use mcp";
+var SAFE_SSH_USER = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var ALLOWED_SSH_HOSTS = Object.freeze([
+  "127.0.0.1",
+  "::1",
+  "localhost"
+]);
+var SHELL_METACHARACTERS = /[;|&`$()<>\n\r*?\[\]{}!#~'"\\]/;
+function readString(config, key) {
+  const v = config?.[key];
+  return typeof v === "string" && v.trim().length > 0 ? v.trim() : null;
+}
+function readPort(config) {
+  const v = config?.["ssh_port"];
+  if (v === void 0 || v === null || v === "")
+    return DEFAULT_SSH_PORT;
+  const n = typeof v === "number" ? v : Number(v);
+  if (!Number.isInteger(n) || n < 1 || n > 65535)
+    return null;
+  return n;
+}
+function buildComputerUseMcpEntry(input) {
+  const user = readString(input.config, "ssh_user");
+  if (user === null) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_user is required (the macOS account the tunnel authenticates as) \u2014 no MCP entry was written`
+    };
+  }
+  const port = readPort(input.config);
+  if (port === null) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_port must be an integer 1-65535 \u2014 no MCP entry was written`
+    };
+  }
+  if (!SAFE_SSH_USER.test(user)) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_user must start with a letter or digit and contain only letters, digits, '.', '_' and '-' \u2014 no MCP entry was written`
+    };
+  }
+  const host = readString(input.config, "ssh_host") ?? DEFAULT_SSH_HOST;
+  if (!ALLOWED_SSH_HOSTS.includes(host)) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_host must be one of ${ALLOWED_SSH_HOSTS.join(", ")} \u2014 the Mac opens a REVERSE tunnel, so the agent host connects to its own loopback. A different host would send this agent's key somewhere else. No MCP entry was written`
+    };
+  }
+  const remoteCommand = readString(input.config, "remote_command") ?? DEFAULT_REMOTE_COMMAND;
+  if (SHELL_METACHARACTERS.test(remoteCommand)) {
+    return {
+      entry: null,
+      problem: `${COMPUTER_USE_DEFINITION_ID}: config.remote_command must name a binary and its arguments and may not contain shell metacharacters (; | & \` $ ( ) < > newline) \u2014 no MCP entry was written`
+    };
+  }
+  const knownHosts = join(input.agentDir, ".computer-use-known-hosts");
+  return {
+    problem: null,
+    entry: {
+      command: "node",
+      args: [
+        input.proxyPath,
+        "--",
+        "ssh",
+        // -T: no pty. The upstream speaks JSON-RPC over stdio; a pty would
+        // inject terminal control sequences into the stream.
+        "-T",
+        // Never prompt. Without this a missing or rejected key makes ssh sit
+        // waiting for a passphrase on a stdin that is carrying JSON-RPC, and
+        // the server appears to hang rather than to fail.
+        "-o",
+        "BatchMode=yes",
+        "-o",
+        "StrictHostKeyChecking=accept-new",
+        "-o",
+        `UserKnownHostsFile=${knownHosts}`,
+        "-o",
+        "ConnectTimeout=10",
+        // Keepalives so a dropped tunnel surfaces as a closed stdio pipe
+        // rather than a silently wedged child. ENG-10134 owns detecting that
+        // and respawning; this just makes the event happen.
+        "-o",
+        "ServerAliveInterval=15",
+        "-o",
+        "ServerAliveCountMax=3",
+        "-p",
+        String(port),
+        `${user}@${host}`,
+        remoteCommand
+      ],
+      env: {
+        // The three the approval gate reads (ENG-10132). Deliberately the vars
+        // the agent's environment already carries rather than new ones: the
+        // gate refuses every call when any is missing, so adding a bespoke var
+        // here would mean a new way for the proxy to be silently disarmed.
+        AGT_HOST: "${AGT_HOST}",
+        AGT_API_KEY: "${AGT_API_KEY}",
+        AGT_AGENT_ID: input.agentId,
+        // The credential. `${...}` is Claude Code's spawn-time substitution
+        // from the agent's environment, which the manager populates from
+        // `.env.integrations` — the same path every other integration
+        // credential travels.
+        [COMPUTER_USE_SSH_KEY_ENV]: `\${${COMPUTER_USE_SSH_KEY_ENV}}`,
+        // ssh must be resolvable, and it is not a node builtin.
+        PATH: process.env["PATH"] ?? "",
+        HOME: process.env["HOME"] ?? ""
+      }
+    }
+  };
+}
+
 // ../../packages/core/dist/provisioning/hook-env.js
 function augmentedHookPath(currentPath) {
   const extras = [
@@ -457,7 +576,7 @@ import { execFile } from "child_process";
 // ../../packages/core/dist/integrations/xurl-config.js
 import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname, join as join2 } from "path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 var XURL_FILE_MODE = 384;
 var XURL_AGT_APP_PREFIX = "agt-";
@@ -576,7 +695,7 @@ function buildAgtXurlApps(integrations) {
 }
 function getXurlStorePath() {
   const home = process.env["HOME"] ?? process.env["USERPROFILE"] ?? homedir();
-  return join(home, ".xurl");
+  return join2(home, ".xurl");
 }
 function writeXurlStoreForIntegrations(integrations, filePath = getXurlStorePath()) {
   const agtApps = buildAgtXurlApps(integrations);
@@ -619,7 +738,7 @@ function writeXurlStoreForIntegrations(integrations, filePath = getXurlStorePath
 // ../../packages/core/dist/integrations/framer-credentials.js
 import { chmodSync as chmodSync3, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync3, rmSync, statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 var FRAMER_PROJECTS_CONFIG_VERSION = 2;
 var BARE_PROJECT_ID = /^[A-Za-z0-9]{20}$/u;
 var SLUGGED_PROJECT_ID = /^.+--([A-Za-z0-9]+)/u;
@@ -718,7 +837,7 @@ function mergeFramerProjectsConfig(existing, inputs, options = {}) {
 var FRAMER_FILE_MODE = 384;
 var MANAGED_SIDECAR_NAME = ".augmented-managed-projects.json";
 function sidecarPathFor(projectsPath) {
-  return join2(dirname2(projectsPath), MANAGED_SIDECAR_NAME);
+  return join3(dirname2(projectsPath), MANAGED_SIDECAR_NAME);
 }
 function readManagedIds(projectsPath) {
   try {
@@ -794,9 +913,9 @@ function asString2(value) {
 function getFramerProjectsPath() {
   const xdg = process.env["XDG_CONFIG_HOME"];
   if (xdg)
-    return join2(xdg, "framer", "projects.json");
+    return join3(xdg, "framer", "projects.json");
   const home = process.env["HOME"] ?? process.env["USERPROFILE"] ?? homedir2();
-  return join2(home, ".config", "framer", "projects.json");
+  return join3(home, ".config", "framer", "projects.json");
 }
 function buildFramerCredentialInputs(integrations) {
   const inputs = [];
@@ -1245,125 +1364,6 @@ function decryptIntegrationCredentials(credentials, row) {
   return out;
 }
 
-// ../../packages/core/dist/provisioning/computer-use-mcp.js
-import { join as join3 } from "path";
-var COMPUTER_USE_DEFINITION_ID = "open-computer-use";
-var COMPUTER_USE_MCP_KEY = "open-computer-use";
-var COMPUTER_USE_SSH_KEY_ENV = `${remoteMcpEnvPrefix(COMPUTER_USE_DEFINITION_ID, null)}_API_KEY`;
-var DEFAULT_SSH_HOST = "127.0.0.1";
-var DEFAULT_SSH_PORT = 2222;
-var DEFAULT_REMOTE_COMMAND = "open-computer-use mcp";
-var SAFE_SSH_USER = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-var ALLOWED_SSH_HOSTS = Object.freeze([
-  "127.0.0.1",
-  "::1",
-  "localhost"
-]);
-var SHELL_METACHARACTERS = /[;|&`$()<>\n\r*?\[\]{}!#~'"\\]/;
-function readString(config, key) {
-  const v = config?.[key];
-  return typeof v === "string" && v.trim().length > 0 ? v.trim() : null;
-}
-function readPort(config) {
-  const v = config?.["ssh_port"];
-  if (v === void 0 || v === null || v === "")
-    return DEFAULT_SSH_PORT;
-  const n = typeof v === "number" ? v : Number(v);
-  if (!Number.isInteger(n) || n < 1 || n > 65535)
-    return null;
-  return n;
-}
-function buildComputerUseMcpEntry(input) {
-  const user = readString(input.config, "ssh_user");
-  if (user === null) {
-    return {
-      entry: null,
-      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_user is required (the macOS account the tunnel authenticates as) \u2014 no MCP entry was written`
-    };
-  }
-  const port = readPort(input.config);
-  if (port === null) {
-    return {
-      entry: null,
-      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_port must be an integer 1-65535 \u2014 no MCP entry was written`
-    };
-  }
-  if (!SAFE_SSH_USER.test(user)) {
-    return {
-      entry: null,
-      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_user must start with a letter or digit and contain only letters, digits, '.', '_' and '-' \u2014 no MCP entry was written`
-    };
-  }
-  const host = readString(input.config, "ssh_host") ?? DEFAULT_SSH_HOST;
-  if (!ALLOWED_SSH_HOSTS.includes(host)) {
-    return {
-      entry: null,
-      problem: `${COMPUTER_USE_DEFINITION_ID}: config.ssh_host must be one of ${ALLOWED_SSH_HOSTS.join(", ")} \u2014 the Mac opens a REVERSE tunnel, so the agent host connects to its own loopback. A different host would send this agent's key somewhere else. No MCP entry was written`
-    };
-  }
-  const remoteCommand = readString(input.config, "remote_command") ?? DEFAULT_REMOTE_COMMAND;
-  if (SHELL_METACHARACTERS.test(remoteCommand)) {
-    return {
-      entry: null,
-      problem: `${COMPUTER_USE_DEFINITION_ID}: config.remote_command must name a binary and its arguments and may not contain shell metacharacters (; | & \` $ ( ) < > newline) \u2014 no MCP entry was written`
-    };
-  }
-  const knownHosts = join3(input.agentDir, ".computer-use-known-hosts");
-  return {
-    problem: null,
-    entry: {
-      command: "node",
-      args: [
-        input.proxyPath,
-        "--",
-        "ssh",
-        // -T: no pty. The upstream speaks JSON-RPC over stdio; a pty would
-        // inject terminal control sequences into the stream.
-        "-T",
-        // Never prompt. Without this a missing or rejected key makes ssh sit
-        // waiting for a passphrase on a stdin that is carrying JSON-RPC, and
-        // the server appears to hang rather than to fail.
-        "-o",
-        "BatchMode=yes",
-        "-o",
-        "StrictHostKeyChecking=accept-new",
-        "-o",
-        `UserKnownHostsFile=${knownHosts}`,
-        "-o",
-        "ConnectTimeout=10",
-        // Keepalives so a dropped tunnel surfaces as a closed stdio pipe
-        // rather than a silently wedged child. ENG-10134 owns detecting that
-        // and respawning; this just makes the event happen.
-        "-o",
-        "ServerAliveInterval=15",
-        "-o",
-        "ServerAliveCountMax=3",
-        "-p",
-        String(port),
-        `${user}@${host}`,
-        remoteCommand
-      ],
-      env: {
-        // The three the approval gate reads (ENG-10132). Deliberately the vars
-        // the agent's environment already carries rather than new ones: the
-        // gate refuses every call when any is missing, so adding a bespoke var
-        // here would mean a new way for the proxy to be silently disarmed.
-        AGT_HOST: "${AGT_HOST}",
-        AGT_API_KEY: "${AGT_API_KEY}",
-        AGT_AGENT_ID: input.agentId,
-        // The credential. `${...}` is Claude Code's spawn-time substitution
-        // from the agent's environment, which the manager populates from
-        // `.env.integrations` — the same path every other integration
-        // credential travels.
-        [COMPUTER_USE_SSH_KEY_ENV]: `\${${COMPUTER_USE_SSH_KEY_ENV}}`,
-        // ssh must be resolvable, and it is not a node builtin.
-        PATH: process.env["PATH"] ?? "",
-        HOME: process.env["HOME"] ?? ""
-      }
-    }
-  };
-}
-
 // ../../packages/core/dist/provisioning/github-broker-credentials.js
 var GITHUB_BROKER_BIN_DIR = ".claude/agt-bin";
 var GIT_CREDENTIAL_HELPER_BASENAME = "git-credential-agt-github";
@@ -6728,7 +6728,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.860" : "dev";
+var agtCliVersion = true ? "0.28.861" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9706,6 +9706,247 @@ function buildConnectivityProbeDeps(projectDir, probeEnv) {
   };
 }
 
+// src/lib/computer-use-tunnel.ts
+import { connect } from "net";
+function isTunnelUsable(v) {
+  return v === null || v.state === "reachable";
+}
+function classifyTunnelProbe(o, at) {
+  switch (o.kind) {
+    case "banner":
+      return o.line.startsWith("SSH-") ? { state: "reachable", detail: `sshd answered through the tunnel (${o.line.trim()})`, at } : {
+        state: "stale-forward",
+        detail: "the port accepted a connection and replied with something that is not an SSH banner \u2014 the forward is being held by something other than the Mac\u2019s sshd",
+        at
+      };
+    case "connected-no-banner":
+      return {
+        state: "stale-forward",
+        detail: "the port accepted a connection but sent no SSH banner \u2014 a dead forward is still holding it (the case ExitOnForwardFailure=yes prevents on the Mac side)",
+        at
+      };
+    case "refused":
+      return {
+        state: "no-tunnel",
+        detail: `nothing is listening: ${o.message} \u2014 the Mac is off, asleep, or autossh is not running`,
+        at
+      };
+    case "timeout":
+      return {
+        state: "no-tunnel",
+        detail: "the connection did not complete within its bound \u2014 the Mac is off, asleep, or unreachable",
+        at
+      };
+    case "error":
+      return { state: "no-tunnel", detail: `probe could not connect: ${o.message}`, at };
+  }
+}
+function parseTunnelEndpoint(args) {
+  if (!args || args.length === 0) return null;
+  let port = null;
+  for (let i = 0; i < args.length - 1; i++) {
+    if (args[i] === "-p") {
+      const n = Number(args[i + 1]);
+      if (Number.isInteger(n) && n > 0 && n <= 65535) port = n;
+      break;
+    }
+  }
+  let host = null;
+  for (const a of args) {
+    const m = /^[A-Za-z0-9][A-Za-z0-9._-]*@(.+)$/.exec(a ?? "");
+    if (m?.[1]) {
+      host = m[1];
+      break;
+    }
+  }
+  if (port === null || host === null) return null;
+  return { host, port };
+}
+var MAX_BANNER_BYTES = 255;
+var DEFAULT_PROBE_TIMEOUT_MS = 3e3;
+function probeTunnel(endpoint, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    let settled = false;
+    let connected = false;
+    let socket = null;
+    let banner = null;
+    const done = (o) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket?.destroy();
+      } catch {
+      }
+      resolve(o);
+    };
+    const timer = setTimeout(() => {
+      done(connected ? { kind: "connected-no-banner" } : { kind: "timeout" });
+    }, timeoutMs);
+    try {
+      socket = connect({ host: endpoint.host, port: endpoint.port });
+    } catch (err) {
+      done({ kind: "error", message: err.message });
+      return;
+    }
+    socket.on("connect", () => {
+      connected = true;
+    });
+    socket.on("data", (chunk) => {
+      banner = banner ? Buffer.concat([banner, chunk]) : chunk;
+      const text = banner.toString("utf8");
+      const nl = text.indexOf("\n");
+      if (nl !== -1) {
+        done({ kind: "banner", line: text.slice(0, nl) });
+        return;
+      }
+      if (banner.length > MAX_BANNER_BYTES) {
+        done({ kind: "banner", line: text.slice(0, MAX_BANNER_BYTES) });
+      }
+    });
+    socket.on("error", (err) => {
+      done(
+        err.code === "ECONNREFUSED" ? { kind: "refused", message: `connection refused on ${endpoint.host}:${endpoint.port}` } : { kind: "error", message: err.message }
+      );
+    });
+    socket.on("close", () => {
+      done(
+        connected ? { kind: "connected-no-banner" } : { kind: "refused", message: `closed without connecting on ${endpoint.host}:${endpoint.port}` }
+      );
+    });
+  });
+}
+function computerUseSignatureView(mcpJson) {
+  if (!mcpJson) return mcpJson;
+  const servers = mcpJson.mcpServers;
+  if (!servers || !Object.prototype.hasOwnProperty.call(servers, COMPUTER_USE_MCP_KEY)) {
+    return mcpJson;
+  }
+  const entry = servers[COMPUTER_USE_MCP_KEY];
+  const args = entry?.args;
+  if (!Array.isArray(args) || args.length === 0) return mcpJson;
+  const sep2 = args.indexOf("--");
+  const head = sep2 > 0 ? args.slice(0, sep2) : [args[0]];
+  return {
+    ...mcpJson,
+    mcpServers: { ...servers, [COMPUTER_USE_MCP_KEY]: { ...entry, args: head } }
+  };
+}
+function computerUseReaperView(mcpJson, verdict) {
+  if (!mcpJson) return mcpJson;
+  const servers = mcpJson.mcpServers;
+  if (!servers || !Object.prototype.hasOwnProperty.call(servers, COMPUTER_USE_MCP_KEY)) {
+    return mcpJson;
+  }
+  if (!isTunnelUsable(verdict)) {
+    const { [COMPUTER_USE_MCP_KEY]: _omitted, ...rest } = servers;
+    return { ...mcpJson, mcpServers: rest };
+  }
+  return computerUseSignatureView(mcpJson);
+}
+var PROBE_MIN_INTERVAL_MS = 6e4;
+var TunnelWatcher = class {
+  entries = /* @__PURE__ */ new Map();
+  now;
+  probeFn;
+  minIntervalMs;
+  constructor(deps = {}) {
+    this.now = deps.now ?? Date.now;
+    this.probeFn = deps.probe ?? ((e) => probeTunnel(e));
+    this.minIntervalMs = deps.minIntervalMs ?? PROBE_MIN_INTERVAL_MS;
+  }
+  verdictFor(codeName) {
+    return this.entries.get(codeName)?.verdict ?? null;
+  }
+  /** Drop an agent's state (deprovision / rename). */
+  forget(codeName) {
+    this.entries.delete(codeName);
+  }
+  /**
+   * Read the current verdict and, if it is stale, start a refresh.
+   *
+   * `isolated` short-circuits the probe entirely. A Docker-isolated agent's
+   * `127.0.0.1` is the CONTAINER's loopback — the manager provisions either a
+   * per-agent `--internal` network (egress mode) or the default bridge, and
+   * neither shares the host's loopback where the Mac's reverse tunnel lands. So
+   * the in-container ssh can never reach the tunnel, and a probe run from the
+   * host would answer for an endpoint the agent cannot use: it would say
+   * "reachable", expose the key, and the reaper would respawn into guaranteed
+   * failure every poll — precisely the thrash AC#5 forbids. The verdict is
+   * derived from that topology rather than measured, because it is a property of
+   * how the container is created, not of the Mac.
+   */
+  observe(codeName, args, isolated, hooks = {}) {
+    const at = this.now();
+    if (isolated) {
+      return this.record(
+        codeName,
+        {
+          state: "container-vantage",
+          detail: "agent is Docker-isolated; the container\u2019s loopback is not the host\u2019s, so the Mac\u2019s reverse tunnel is unreachable from inside it \u2014 computer-use cannot work for this agent",
+          at
+        },
+        hooks
+      );
+    }
+    const endpoint = parseTunnelEndpoint(args);
+    if (!endpoint) {
+      return this.verdictFor(codeName);
+    }
+    const cur = this.entries.get(codeName);
+    const fresh = cur?.verdict != null && at - cur.verdict.at < this.minIntervalMs;
+    if (!cur?.probing && !fresh) {
+      this.startProbe(codeName, endpoint, hooks);
+    }
+    return cur?.verdict ?? null;
+  }
+  startProbe(codeName, endpoint, hooks) {
+    const prev = this.entries.get(codeName);
+    this.entries.set(codeName, {
+      verdict: prev?.verdict ?? null,
+      probing: true,
+      loggedState: prev?.loggedState ?? null
+    });
+    void this.probeFn(endpoint).then((outcome) => {
+      this.record(codeName, classifyTunnelProbe(outcome, this.now()), hooks);
+    }).catch((err) => {
+      this.record(
+        codeName,
+        { state: "no-tunnel", detail: `probe threw: ${err.message}`, at: this.now() },
+        hooks
+      );
+    }).finally(() => {
+      const e = this.entries.get(codeName);
+      if (e) e.probing = false;
+    });
+  }
+  record(codeName, verdict, hooks) {
+    const prev = this.entries.get(codeName);
+    const hadVerdict = prev?.verdict != null;
+    const wasUsable = hadVerdict && prev.verdict.state === "reachable";
+    this.entries.set(codeName, {
+      verdict,
+      probing: prev?.probing ?? false,
+      loggedState: prev?.loggedState ?? null
+    });
+    if (prev?.loggedState !== verdict.state) {
+      this.entries.get(codeName).loggedState = verdict.state;
+      hooks.log?.(`[computer-use-tunnel] '${codeName}': ${verdict.state} \u2014 ${verdict.detail}`);
+    }
+    if (hadVerdict && !wasUsable && verdict.state === "reachable") {
+      try {
+        hooks.onRecovered?.(codeName);
+      } catch (err) {
+        hooks.log?.(
+          `[computer-use-tunnel] '${codeName}': onRecovered threw (suppressed; verdict stands): ${err.message}`
+        );
+      }
+    }
+    return verdict;
+  }
+};
+
 // src/lib/session-tool-bind-probe-host.ts
 import { execFileSync as syncExecFile } from "child_process";
 import { readFileSync as readFileSync8 } from "fs";
@@ -9756,7 +9997,15 @@ async function gatherSessionToolBindProbe(agent, integrations, projectDir, opts)
         findMissingMcpServers({
           rows: parsePsRows(psOutput),
           codeName: agent.code_name,
-          mcpJson,
+          // ENG-10134: correct the computer-use entry's argv signature before
+          // the same matcher the presence reaper uses looks at it. Left raw, its
+          // signature resolves to the Mac's SSH USERNAME (ENG-10258), so a dead
+          // child matches any sibling with a /home/<user>/ path and this probe
+          // reports `bound` to the control plane for a server that is not
+          // running. Deliberately the signature view and NOT the reaper's gated
+          // one: while the tunnel is down the server genuinely IS unbound, and
+          // reporting that is the accurate answer here.
+          mcpJson: computerUseSignatureView(mcpJson),
           inContainer: isolated
         })
       );
@@ -10997,6 +11246,7 @@ function withEvidence(outcome, evidence) {
 
 export {
   safeWriteJsonAtomic,
+  COMPUTER_USE_MCP_KEY,
   extractCommandNotFound,
   describeChannelWriteFailure,
   migrateAgentDirToIdKeyed,
@@ -11062,6 +11312,8 @@ export {
   deriveMcpServerKey,
   buildProbeEnv,
   buildConnectivityProbeDeps,
+  computerUseReaperView,
+  TunnelWatcher,
   gatherSessionToolBindProbe,
   provision,
   describeStartupCompletion,
@@ -11086,4 +11338,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-HKJLINLX.js.map
+//# sourceMappingURL=chunk-IQROQ3XJ.js.map