@integrity-labs/agt-cli 0.6.6

package/dist/bin/agt.js

@@ -0,0 +1,3223 @@
+#!/usr/bin/env node
+import {
+  AGT_HOST,
+  CHANNEL_REGISTRY,
+  DEPLOYMENT_TEMPLATES,
+  SLACK_SCOPE_CATEGORY_LABELS,
+  SLACK_SCOPE_PRESETS,
+  SlackApiError,
+  api,
+  createSlackApp,
+  detectDrift,
+  exchangeApiKey,
+  extractFrontmatter,
+  generateCharterMd,
+  generateSlackAppManifest,
+  generateToolsMd,
+  getActiveTeam,
+  getAllChannelIds,
+  getApiKey,
+  getChannel,
+  getDefaultSlackScopes,
+  getFramework,
+  getHostId,
+  getScopesByCategory,
+  getTemplate,
+  lintAll,
+  lintCharter,
+  lintTools,
+  provision,
+  renderTemplate,
+  resolveChannels,
+  serializeManifestForSlackCli,
+  setActiveTeam
+} from "../chunk-EUF2V4N5.js";
+
+// src/bin/agt.ts
+import { join as join10 } from "path";
+import { homedir as homedir2 } from "os";
+import { Command } from "commander";
+
+// src/lib/globals.ts
+import chalk from "chalk";
+var _jsonMode = false;
+function setJsonMode(enabled) {
+  _jsonMode = enabled;
+  if (enabled) {
+    chalk.level = 0;
+  }
+}
+function isJsonMode() {
+  return _jsonMode;
+}
+function jsonOutput(data) {
+  console.log(JSON.stringify(data, null, 2));
+}
+
+// src/commands/whoami.ts
+import chalk3 from "chalk";
+import ora from "ora";
+
+// src/lib/output.ts
+import chalk2 from "chalk";
+import Table from "cli-table3";
+function success(msg) {
+  console.log(chalk2.green(`\u2714 ${msg}`));
+}
+function error(msg) {
+  console.error(chalk2.red(`\u2718 ${msg}`));
+}
+function warn(msg) {
+  console.warn(chalk2.yellow(`\u26A0 ${msg}`));
+}
+function info(msg) {
+  console.log(chalk2.cyan(`\u2139 ${msg}`));
+}
+function table(headers, rows) {
+  const t = new Table({
+    head: headers.map((h) => chalk2.bold.cyan(h)),
+    style: { head: [], border: [] }
+  });
+  for (const row of rows) {
+    t.push(row);
+  }
+  console.log(t.toString());
+}
+
+// src/commands/whoami.ts
+async function whoamiCommand() {
+  const json = isJsonMode();
+  const apiKey = getApiKey();
+  if (!apiKey) {
+    if (json) {
+      jsonOutput({ ok: false, error: "AGT_API_KEY is not set" });
+    } else {
+      error("AGT_API_KEY is not set. Export it with your host API key (tlk_...)");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const spinner = ora({ text: "Exchanging API key\u2026", isSilent: json });
+  spinner.start();
+  try {
+    const exchange = await exchangeApiKey(apiKey);
+    spinner.stop();
+    if (json) {
+      jsonOutput({
+        ok: true,
+        api_key_prefix: apiKey.slice(0, 8) + "****",
+        host: AGT_HOST ?? null,
+        host_id: exchange.hostId,
+        team: exchange.teamSlug,
+        team_id: exchange.teamId,
+        email: exchange.userEmail
+      });
+      return;
+    }
+    success("Authenticated via API key");
+    info(`API Key:    ${chalk3.bold(apiKey.slice(0, 8) + "****")}`);
+    info(`Host:       ${chalk3.bold(AGT_HOST ?? "not set")}`);
+    info(`Host ID:    ${exchange.hostId}`);
+    info(`Team:       ${chalk3.bold(exchange.teamSlug ?? exchange.teamId)}`);
+    info(`User:       ${chalk3.bold(exchange.userEmail ?? "unknown")}`);
+  } catch (err) {
+    spinner.fail("Failed to exchange API key.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/team.ts
+import chalk4 from "chalk";
+import ora2 from "ora";
+
+// src/lib/auth-guard.ts
+function requireAuth() {
+  const key = getApiKey();
+  if (!key) {
+    error("AGT_API_KEY is not set. Export it with your host API key (tlk_...)");
+    process.exitCode = 1;
+    return false;
+  }
+  return true;
+}
+function requireTeam() {
+  if (!requireAuth()) return null;
+  return "auto";
+}
+
+// src/commands/team.ts
+async function teamListCommand() {
+  if (!requireAuth()) return;
+  const json = isJsonMode();
+  const spinner = ora2({ text: "Fetching teams\u2026", isSilent: json });
+  spinner.start();
+  try {
+    const data = await api.get("/teams");
+    spinner.stop();
+    if (!data.teams || data.teams.length === 0) {
+      if (json) {
+        jsonOutput({ ok: true, teams: [] });
+      } else {
+        info("You are not a member of any teams. Create one with `agt team create <name>`.");
+      }
+      return;
+    }
+    const activeSlug = getActiveTeam();
+    if (json) {
+      const teams = data.teams.map((ws) => ({
+        name: ws.name,
+        slug: ws.slug,
+        role: ws.role,
+        active: ws.slug === activeSlug
+      }));
+      jsonOutput({ ok: true, teams });
+      return;
+    }
+    const rows = data.teams.map((ws) => {
+      const active = ws.slug === activeSlug ? chalk4.green("*") : "";
+      return [active, ws.name, ws.slug, ws.role];
+    });
+    table(["", "Name", "Slug", "Role"], rows);
+  } catch (err) {
+    spinner.fail("Failed to fetch teams.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function teamCreateCommand(name) {
+  if (!requireAuth()) return;
+  const json = isJsonMode();
+  const slug = name.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!slug) {
+    if (json) {
+      jsonOutput({ ok: false, error: "Invalid team name" });
+    } else {
+      error("Invalid team name. It must contain at least one alphanumeric character.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const spinner = ora2({ text: `Creating team "${name}" (${slug})\u2026`, isSilent: json });
+  spinner.start();
+  try {
+    const data = await api.post("/teams", { name, slug });
+    setActiveTeam(data.team.slug);
+    spinner.succeed(`Team "${chalk4.bold(name)}" created.`);
+    if (json) {
+      jsonOutput({ ok: true, name, slug: data.team.slug, role: data.team.role });
+      return;
+    }
+    info(`Slug: ${chalk4.bold(data.team.slug)}`);
+    success(`Active team set to ${chalk4.bold(data.team.slug)}.`);
+  } catch (err) {
+    spinner.fail("Failed to create team.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function teamSwitchCommand(slug) {
+  if (!requireAuth()) return;
+  const json = isJsonMode();
+  const spinner = ora2({ text: `Switching to team "${slug}"\u2026`, isSilent: json });
+  spinner.start();
+  try {
+    await api.get(`/teams/${encodeURIComponent(slug)}`);
+    setActiveTeam(slug);
+    spinner.succeed(`Active team set to ${chalk4.bold(slug)}.`);
+    if (json) {
+      jsonOutput({ ok: true, team: slug });
+    }
+  } catch (err) {
+    spinner.fail(`Could not switch to team "${slug}".`);
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/init.ts
+import chalk5 from "chalk";
+import ora3 from "ora";
+import { input, select, checkbox } from "@inquirer/prompts";
+import { randomUUID } from "crypto";
+import { mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
+function toSlug(name) {
+  return name.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function printDiagnostics(diagnostics) {
+  for (const d of diagnostics) {
+    const prefix = d.severity === "error" ? chalk5.red("ERR") : chalk5.yellow("WARN");
+    const path = d.path ? chalk5.dim(` (${d.path})`) : "";
+    console.log(`  ${prefix} [${d.code}] ${d.message}${path}`);
+  }
+}
+async function initCommand(opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const nonInteractive = !!opts.name;
+  const json = isJsonMode();
+  let displayName;
+  let codeName;
+  let description;
+  let environment;
+  let riskTier;
+  let budgetType;
+  let budgetLimitTokens;
+  let budgetLimitDollars;
+  let budgetLimit;
+  let budgetWindow;
+  let budgetEnforcement;
+  let selectedChannels;
+  let loggingMode;
+  if (nonInteractive) {
+    displayName = opts.name;
+    codeName = opts.codeName ?? toSlug(displayName);
+    description = opts.description ?? `${displayName} agent`;
+    environment = opts.env ?? "dev";
+    riskTier = opts.riskTier ?? "Low";
+    budgetType = opts.budgetType ?? "tokens";
+    budgetLimitTokens = budgetType === "tokens" || budgetType === "both" ? Number(opts.budgetTokens ?? "10000") : void 0;
+    budgetLimitDollars = budgetType === "dollars" || budgetType === "both" ? Number(opts.budgetDollars ?? "10") : void 0;
+    budgetLimit = budgetLimitTokens ?? budgetLimitDollars ?? 1e4;
+    budgetWindow = opts.budgetWindow ?? "daily";
+    budgetEnforcement = opts.budgetEnforcement ?? "block";
+    selectedChannels = opts.channels ? opts.channels.split(",").map((c) => c.trim()) : [];
+    loggingMode = opts.logging ?? "redacted";
+  } else {
+    console.log(chalk5.bold("\nAugmented \u2014 Agent Init Wizard\n"));
+    displayName = await input({
+      message: "Agent display name:",
+      validate: (v) => v.trim().length > 0 || "Name is required"
+    });
+    const suggestedSlug = toSlug(displayName);
+    codeName = await input({
+      message: "Code name (kebab-case):",
+      default: suggestedSlug,
+      validate: (v) => /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/.test(v) || "Must be lowercase alphanumeric with hyphens"
+    });
+    description = await input({
+      message: "Short description:",
+      default: `${displayName} agent`
+    });
+    environment = await select({
+      message: "Environment:",
+      choices: [
+        { value: "dev", name: "dev" },
+        { value: "stage", name: "stage" },
+        { value: "prod", name: "prod" }
+      ]
+    });
+    riskTier = await select({
+      message: "Risk tier:",
+      choices: [
+        { value: "Low", name: "Low \u2014 read-only tools, no PII" },
+        { value: "Medium", name: "Medium \u2014 write access, limited scope" },
+        { value: "High", name: "High \u2014 broad access, PII, external comms" }
+      ]
+    });
+    budgetType = await select({
+      message: "Budget type:",
+      choices: [
+        { value: "tokens", name: "Tokens" },
+        { value: "dollars", name: "Dollars" },
+        { value: "both", name: "Both" }
+      ]
+    });
+    budgetLimit = 1e4;
+    budgetLimitTokens = void 0;
+    budgetLimitDollars = void 0;
+    if (budgetType === "tokens" || budgetType === "both") {
+      const val = await input({
+        message: "Token budget limit:",
+        default: "10000",
+        validate: (v) => !isNaN(Number(v)) && Number(v) > 0 || "Must be a positive number"
+      });
+      budgetLimitTokens = Number(val);
+      budgetLimit = budgetLimitTokens;
+    }
+    if (budgetType === "dollars" || budgetType === "both") {
+      const val = await input({
+        message: "Dollar budget limit:",
+        default: "10",
+        validate: (v) => !isNaN(Number(v)) && Number(v) > 0 || "Must be a positive number"
+      });
+      budgetLimitDollars = Number(val);
+      if (budgetType === "dollars") budgetLimit = budgetLimitDollars;
+    }
+    budgetWindow = await select({
+      message: "Budget window:",
+      choices: [
+        { value: "daily", name: "Daily" },
+        { value: "weekly", name: "Weekly" },
+        { value: "monthly", name: "Monthly" }
+      ]
+    });
+    budgetEnforcement = await select({
+      message: "Budget enforcement:",
+      choices: [
+        { value: "block", name: "Block \u2014 hard stop when limit reached" },
+        { value: "throttle", name: "Throttle \u2014 slow down near limit" },
+        { value: "alert", name: "Alert \u2014 warn but do not stop" },
+        { value: "degrade", name: "Degrade \u2014 switch to cheaper model" }
+      ]
+    });
+    const allChannels = getAllChannelIds();
+    selectedChannels = await checkbox({
+      message: "Select allowed channels:",
+      choices: allChannels.map((c) => ({ value: c, name: c }))
+    });
+    loggingMode = await select({
+      message: "Logging mode:",
+      choices: [
+        { value: "redacted", name: "Redacted \u2014 PII stripped" },
+        { value: "hash-only", name: "Hash-only \u2014 content is hashed" },
+        { value: "full-local", name: "Full local \u2014 plain text (dev only)" }
+      ]
+    });
+  }
+  const spinner = ora3({ text: "Creating agent\u2026", isSilent: json });
+  spinner.start();
+  let userEmail;
+  let userId;
+  try {
+    const me = await api.get("/auth/me");
+    userId = me.id;
+    userEmail = me.email ?? me.id;
+  } catch (err) {
+    spinner.fail("Could not determine current user.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const agentId = randomUUID();
+  const charterInput = {
+    agent_id: agentId,
+    code_name: codeName,
+    display_name: displayName,
+    environment,
+    owner: {
+      id: userId,
+      name: userEmail,
+      email: userEmail
+    },
+    risk_tier: riskTier,
+    logging_mode: loggingMode,
+    description
+  };
+  const toolsInput = {
+    agent_id: agentId,
+    code_name: codeName,
+    environment,
+    owner: userEmail,
+    display_name: displayName,
+    logging_redaction: loggingMode
+  };
+  const charterMd = generateCharterMd(charterInput);
+  const toolsMd = generateToolsMd(toolsInput);
+  const lintResult = lintAll(charterMd, toolsMd);
+  try {
+    await api.post("/agents", {
+      code_name: codeName,
+      display_name: displayName,
+      description,
+      environment,
+      risk_tier: riskTier,
+      channels: selectedChannels,
+      charter_content: charterMd,
+      charter_version: "0.1",
+      tools_content: toolsMd,
+      tools_version: "0.1"
+    });
+  } catch (err) {
+    spinner.fail("Failed to register agent.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const agentDir = join(process.cwd(), ".augmented", codeName);
+  mkdirSync(agentDir, { recursive: true });
+  writeFileSync(join(agentDir, "CHARTER.md"), charterMd);
+  writeFileSync(join(agentDir, "TOOLS.md"), toolsMd);
+  spinner.succeed(`Agent "${chalk5.bold(displayName)}" created.`);
+  if (json) {
+    jsonOutput({
+      ok: true,
+      agent_id: agentId,
+      code_name: codeName,
+      display_name: displayName,
+      environment,
+      risk_tier: riskTier,
+      channels: selectedChannels,
+      directory: agentDir,
+      lint: {
+        ok: lintResult.ok,
+        errors: lintResult.errors.length,
+        warnings: lintResult.warnings.length,
+        diagnostics: [...lintResult.errors, ...lintResult.warnings]
+      }
+    });
+    return;
+  }
+  console.log();
+  info(`Agent ID:     ${agentId}`);
+  info(`Code Name:    ${codeName}`);
+  info(`Environment:  ${environment}`);
+  info(`Risk Tier:    ${riskTier}`);
+  info(`Channels:     ${selectedChannels.length > 0 ? selectedChannels.join(", ") : "none"}`);
+  info(`Files:        ${agentDir}/CHARTER.md, TOOLS.md`);
+  console.log();
+  if (lintResult.ok && lintResult.warnings.length === 0) {
+    success("Lint passed \u2014 no errors or warnings.");
+  } else {
+    if (lintResult.errors.length > 0) {
+      error(`Lint: ${lintResult.errors.length} error(s)`);
+      printDiagnostics(lintResult.errors);
+    }
+    if (lintResult.warnings.length > 0) {
+      warn(`Lint: ${lintResult.warnings.length} warning(s)`);
+      printDiagnostics(lintResult.warnings);
+    }
+  }
+  console.log();
+  info(`Next steps:`);
+  info(`  1. Edit ${chalk5.bold(".augmented/" + codeName + "/CHARTER.md")} to refine the agent charter`);
+  info(`  2. Edit ${chalk5.bold(".augmented/" + codeName + "/TOOLS.md")} to add tools`);
+  info(`  3. Run ${chalk5.bold("agt lint")} to validate`);
+  info(`  4. Run ${chalk5.bold("agt deploy")} to generate deployment config`);
+}
+
+// src/commands/lint.ts
+import chalk6 from "chalk";
+import ora4 from "ora";
+import { readFileSync, existsSync } from "fs";
+import { join as join2, resolve } from "path";
+function printDiagnostics2(diagnostics) {
+  for (const d of diagnostics) {
+    const prefix = d.severity === "error" ? chalk6.red("ERR") : chalk6.yellow("WARN");
+    const file = chalk6.dim(`[${d.file}]`);
+    const path = d.path ? chalk6.dim(` (${d.path})`) : "";
+    console.log(`  ${prefix} ${file} ${d.code}: ${d.message}${path}`);
+  }
+}
+function printResult(label, result) {
+  if (result.ok && result.warnings.length === 0) {
+    success(`${label}: passed`);
+    return;
+  }
+  if (result.errors.length > 0) {
+    error(`${label}: ${result.errors.length} error(s)`);
+    printDiagnostics2(result.errors);
+  }
+  if (result.warnings.length > 0) {
+    warn(`${label}: ${result.warnings.length} warning(s)`);
+    printDiagnostics2(result.warnings);
+  }
+}
+async function lintCommand(path) {
+  const json = isJsonMode();
+  const dirs = [];
+  if (path) {
+    const resolved = resolve(path);
+    if (!existsSync(resolved)) {
+      if (json) {
+        jsonOutput({ ok: false, error: `Path not found: ${resolved}` });
+      } else {
+        error(`Path not found: ${resolved}`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+    dirs.push({ name: path, dir: resolved });
+  } else {
+    const augmentedDir = join2(process.cwd(), ".augmented");
+    if (!existsSync(augmentedDir)) {
+      if (json) {
+        jsonOutput({ ok: false, error: "No .augmented/ directory found" });
+      } else {
+        error("No .augmented/ directory found. Run `agt init` first.");
+      }
+      process.exitCode = 1;
+      return;
+    }
+    const { readdirSync, statSync } = await import("fs");
+    const entries = readdirSync(augmentedDir);
+    for (const entry of entries) {
+      const entryPath = join2(augmentedDir, entry);
+      if (statSync(entryPath).isDirectory()) {
+        dirs.push({ name: entry, dir: entryPath });
+      }
+    }
+    if (dirs.length === 0) {
+      if (json) {
+        jsonOutput({ ok: false, error: "No agent directories found in .augmented/" });
+      } else {
+        error("No agent directories found in .augmented/. Run `agt init` first.");
+      }
+      process.exitCode = 1;
+      return;
+    }
+  }
+  let teamPolicy;
+  const teamSlug = requireTeam();
+  if (teamSlug) {
+    const spinner = ora4({ text: "Fetching team channel policy\u2026", isSilent: json });
+    spinner.start();
+    try {
+      const data = await api.get(`/teams/${encodeURIComponent(teamSlug)}/channel-policy`);
+      if (data.channel_policy) {
+        teamPolicy = {
+          team_id: data.channel_policy.team_id,
+          allowed_channels: data.channel_policy.allowed_channels ?? [],
+          denied_channels: data.channel_policy.denied_channels ?? [],
+          require_elevated_for_pii: data.channel_policy.require_elevated_for_pii ?? false
+        };
+      }
+      spinner.stop();
+    } catch {
+      spinner.stop();
+    }
+  }
+  let totalErrors = 0;
+  let totalWarnings = 0;
+  const jsonResults = [];
+  for (const { name, dir } of dirs) {
+    if (!json) console.log(chalk6.bold(`
+Linting ${name}:`));
+    const charterPath = join2(dir, "CHARTER.md");
+    const toolsPath = join2(dir, "TOOLS.md");
+    const hasCharter = existsSync(charterPath);
+    const hasTools = existsSync(toolsPath);
+    if (!hasCharter && !hasTools) {
+      if (!json) warn("No CHARTER.md or TOOLS.md found \u2014 skipping.");
+      if (json) jsonResults.push({ agent: name, skipped: true });
+      continue;
+    }
+    const charterContent = hasCharter ? readFileSync(charterPath, "utf-8") : void 0;
+    const toolsContent = hasTools ? readFileSync(toolsPath, "utf-8") : void 0;
+    let result;
+    if (charterContent && toolsContent) {
+      result = lintAll(charterContent, toolsContent, { teamChannelPolicy: teamPolicy });
+      if (!json) printResult("Full lint", result);
+    } else if (charterContent) {
+      result = lintCharter(charterContent, { teamChannelPolicy: teamPolicy });
+      if (!json) printResult("CHARTER.md", result);
+    } else {
+      result = lintTools(toolsContent);
+      if (!json) printResult("TOOLS.md", result);
+    }
+    totalErrors += result.errors.length;
+    totalWarnings += result.warnings.length;
+    if (json) {
+      jsonResults.push({
+        agent: name,
+        ok: result.ok,
+        errors: result.errors.length,
+        warnings: result.warnings.length,
+        diagnostics: [...result.errors, ...result.warnings]
+      });
+    }
+  }
+  if (json) {
+    jsonOutput({
+      ok: totalErrors === 0,
+      agents: jsonResults,
+      total_errors: totalErrors,
+      total_warnings: totalWarnings
+    });
+    if (totalErrors > 0) process.exitCode = 1;
+    return;
+  }
+  console.log();
+  if (totalErrors === 0 && totalWarnings === 0) {
+    success(`All ${dirs.length} agent(s) passed lint.`);
+  } else {
+    if (totalErrors > 0) {
+      error(`Total: ${totalErrors} error(s) across ${dirs.length} agent(s)`);
+      process.exitCode = 1;
+    }
+    if (totalWarnings > 0) {
+      warn(`Total: ${totalWarnings} warning(s) across ${dirs.length} agent(s)`);
+    }
+  }
+}
+
+// src/commands/channels.ts
+import chalk7 from "chalk";
+import ora5 from "ora";
+function channelsListCommand() {
+  const json = isJsonMode();
+  if (json) {
+    const channels2 = CHANNEL_REGISTRY.map((ch) => ({
+      id: ch.id,
+      name: ch.name,
+      security_tier: ch.securityTier,
+      e2e_encrypted: ch.e2eEncrypted,
+      audit_trail: ch.auditTrail,
+      public_exposure_risk: ch.publicExposureRisk
+    }));
+    jsonOutput({ ok: true, channels: channels2 });
+    return;
+  }
+  console.log(chalk7.bold("\nChannel Registry (18 channels)\n"));
+  const rows = CHANNEL_REGISTRY.map((ch) => [
+    ch.id,
+    ch.name,
+    ch.securityTier === "elevated" ? chalk7.green(ch.securityTier) : ch.securityTier === "limited" ? chalk7.red(ch.securityTier) : chalk7.cyan(ch.securityTier),
+    typeof ch.e2eEncrypted === "boolean" ? ch.e2eEncrypted ? chalk7.green("yes") : chalk7.dim("no") : chalk7.yellow(ch.e2eEncrypted),
+    typeof ch.auditTrail === "boolean" ? ch.auditTrail ? chalk7.green("yes") : chalk7.dim("no") : chalk7.yellow(ch.auditTrail),
+    ch.publicExposureRisk === "High" ? chalk7.red(ch.publicExposureRisk) : ch.publicExposureRisk === "Medium" ? chalk7.yellow(ch.publicExposureRisk) : chalk7.green(ch.publicExposureRisk)
+  ]);
+  table(["ID", "Name", "Security Tier", "E2E Encrypted", "Audit Trail", "Public Risk"], rows);
+}
+async function channelsCheckCommand(agentCodeName) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora5({ text: `Resolving channels for "${agentCodeName}"\u2026`, isSilent: json });
+  spinner.start();
+  try {
+    const data = await api.get(`/agents/${encodeURIComponent(agentCodeName)}/channels`);
+    const agentPolicy = {
+      policy: "allowlist",
+      allowed: data.agent_channels ?? [],
+      denied: [],
+      require_approval_to_change: false
+    };
+    const teamPolicy = data.channel_policy ? {
+      team_id: data.channel_policy.team_id,
+      allowed_channels: data.channel_policy.allowed_channels ?? [],
+      denied_channels: data.channel_policy.denied_channels ?? [],
+      require_elevated_for_pii: data.channel_policy.require_elevated_for_pii ?? false
+    } : void 0;
+    const resolved = resolveChannels(agentPolicy, teamPolicy);
+    spinner.stop();
+    if (json) {
+      jsonOutput({
+        ok: true,
+        agent: agentCodeName,
+        agent_allowlist: agentPolicy.allowed,
+        team_policy: teamPolicy ? {
+          allowed: teamPolicy.allowed_channels,
+          denied: teamPolicy.denied_channels,
+          require_elevated_for_pii: teamPolicy.require_elevated_for_pii
+        } : null,
+        resolved_channels: resolved,
+        count: resolved.length
+      });
+      return;
+    }
+    console.log(chalk7.bold(`
+Channel Resolution: ${agentCodeName}
+`));
+    info(`Agent allowlist: ${agentPolicy.allowed.length > 0 ? agentPolicy.allowed.join(", ") : "none"}`);
+    if (teamPolicy) {
+      info(`Team allowed: ${teamPolicy.allowed_channels.length > 0 ? teamPolicy.allowed_channels.join(", ") : "all (no restriction)"}`);
+      info(`Team denied:  ${teamPolicy.denied_channels.length > 0 ? teamPolicy.denied_channels.join(", ") : "none"}`);
+      if (teamPolicy.require_elevated_for_pii) {
+        info("Team requires elevated tier for PII channels");
+      }
+    } else {
+      info("No team channel policy configured.");
+    }
+    console.log();
+    if (resolved.length === 0) {
+      error("No channels available after resolution. The agent cannot communicate.");
+      process.exitCode = 1;
+      return;
+    }
+    const rows = resolved.map((chId) => {
+      const ch = getChannel(chId);
+      return [
+        chId,
+        ch?.name ?? "Unknown",
+        ch?.securityTier ?? "-",
+        ch?.publicExposureRisk ?? "-"
+      ];
+    });
+    success(`${resolved.length} channel(s) available:`);
+    table(["ID", "Name", "Security Tier", "Public Risk"], rows);
+  } catch (err) {
+    spinner.fail("Failed to resolve channels.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/channel-slack.ts
+import chalk8 from "chalk";
+import ora6 from "ora";
+import { checkbox as checkbox2, confirm as confirm2, input as input2 } from "@inquirer/prompts";
+import { writeFile } from "fs/promises";
+import { join as join3 } from "path";
+import { tmpdir } from "os";
+async function channelSlackSetupCommand(agentCodeName, options) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora6({ text: `Looking up agent "${agentCodeName}"\u2026`, isSilent: json });
+  spinner.start();
+  try {
+    const agentData = await api.get(`/agents/${encodeURIComponent(agentCodeName)}`);
+    const agent2 = agentData.agent;
+    const channels2 = agent2.channels ?? [];
+    if (!channels2.includes("slack")) {
+      spinner.fail(`Agent "${agentCodeName}" does not have Slack in its channel list.`);
+      error(`Enable Slack in the agent's channels first (add "slack" to the channels array).`);
+      process.exitCode = 1;
+      return;
+    }
+    spinner.succeed(`Found agent "${agentCodeName}"`);
+    let selectedScopes;
+    if (options.scopes) {
+      selectedScopes = options.scopes.split(",").map((s) => s.trim());
+    } else if (options.preset) {
+      const preset = options.preset;
+      if (!(preset in SLACK_SCOPE_PRESETS)) {
+        error(`Unknown preset "${options.preset}". Available: minimal, standard, full`);
+        process.exitCode = 1;
+        return;
+      }
+      selectedScopes = [...SLACK_SCOPE_PRESETS[preset]];
+      info(`Using "${preset}" preset (${selectedScopes.length} scopes)`);
+    } else if (json) {
+      selectedScopes = [...SLACK_SCOPE_PRESETS.standard];
+    } else {
+      const scopesByCategory = getScopesByCategory();
+      const defaults = getDefaultSlackScopes();
+      const choices = [];
+      for (const [category, defs] of scopesByCategory) {
+        const label = SLACK_SCOPE_CATEGORY_LABELS[category];
+        choices.push({ type: "separator", separator: `\u2500\u2500 ${label} \u2500\u2500` });
+        for (const def of defs) {
+          const riskColor = def.risk === "high" ? chalk8.red : def.risk === "medium" ? chalk8.yellow : chalk8.green;
+          choices.push({
+            name: `${def.scope} ${chalk8.dim(`\u2014 ${def.description}`)} ${riskColor(`[${def.risk}]`)}`,
+            value: def.scope,
+            checked: defaults.includes(def.scope)
+          });
+        }
+      }
+      selectedScopes = await checkbox2({
+        message: "Select Slack bot scopes:",
+        choices,
+        pageSize: 30
+      });
+    }
+    if (selectedScopes.length === 0) {
+      error("No scopes selected. At least one scope is required.");
+      process.exitCode = 1;
+      return;
+    }
+    info(`Selected ${selectedScopes.length} scope(s): ${selectedScopes.join(", ")}`);
+    const manifest = generateSlackAppManifest({
+      agent_name: agent2.display_name ?? agentCodeName,
+      description: `Augmented-managed Slack bot for agent ${agentCodeName}`,
+      scopes: selectedScopes
+    });
+    const manifestObj = serializeManifestForSlackCli(manifest);
+    const manifestJson = JSON.stringify(manifestObj, null, 2);
+    const manifestPath = join3(tmpdir(), `augmented-slack-manifest-${agentCodeName}.json`);
+    await writeFile(manifestPath, manifestJson, "utf-8");
+    success(`Manifest written to ${manifestPath}`);
+    console.log(chalk8.dim(manifestJson));
+    let appId;
+    let botTokenRef = options.botToken;
+    let signingSecretRef = options.signingSecret;
+    if (!options.skipCreate) {
+      let token = options.configToken;
+      if (!token && !json) {
+        token = (await input2({
+          message: "Paste your Slack config token (xoxe-\u2026) to create the app automatically, or leave empty to skip:"
+        })).trim() || void 0;
+      }
+      if (token) {
+        const createSpinner = ora6({ text: "Creating Slack app via API\u2026", isSilent: json });
+        createSpinner.start();
+        try {
+          const result = await createSlackApp(token, manifest);
+          appId = result.app_id;
+          signingSecretRef = `secret_ref://slack/${agentCodeName}/signing_secret`;
+          createSpinner.succeed(`Slack app created: ${result.app_id}`);
+          info(`OAuth URL: ${result.oauth_authorize_url}`);
+        } catch (err) {
+          createSpinner.fail("Failed to create Slack app via API.");
+          if (err instanceof SlackApiError) {
+            warn(`Slack API error: ${err.message}`);
+          } else {
+            warn(err.message);
+          }
+          info(`Manifest saved at: ${manifestPath}`);
+          info("Create the app manually via https://api.slack.com/apps and paste the manifest.");
+        }
+      } else {
+        info(`Manifest saved at: ${manifestPath}`);
+        info("Create the app manually via https://api.slack.com/apps and paste the manifest.");
+      }
+    }
+    if (!signingSecretRef && !json) {
+      const secret = await input2({
+        message: "Paste your Slack Signing Secret, or leave empty to skip:"
+      });
+      if (secret.trim()) {
+        signingSecretRef = `secret_ref://slack/${agentCodeName}/signing_secret`;
+      }
+    }
+    if (!botTokenRef && !json) {
+      const token = await input2({
+        message: "Paste your Slack Bot Token (xoxb-\u2026), or leave empty to skip:"
+      });
+      if (token.trim()) {
+        botTokenRef = `secret_ref://slack/${agentCodeName}/bot_token`;
+      }
+    }
+    const configSpinner = ora6({ text: "Saving channel config\u2026", isSilent: json });
+    configSpinner.start();
+    const config = {
+      channel_type: "slack",
+      app_name: agent2.display_name ?? agentCodeName,
+      scopes: selectedScopes,
+      ...appId ? { app_id: appId } : {},
+      ...botTokenRef ? { bot_token_ref: botTokenRef } : {},
+      ...signingSecretRef ? { signing_secret_ref: signingSecretRef } : {},
+      manifest
+    };
+    try {
+      await api.put(
+        `/agents/${encodeURIComponent(agentCodeName)}/channel-configs/slack`,
+        {
+          config,
+          status: botTokenRef ? "configured" : "pending"
+        }
+      );
+    } catch (err) {
+      configSpinner.fail("Failed to save channel config.");
+      error(err.message);
+      process.exitCode = 1;
+      return;
+    }
+    configSpinner.succeed("Slack channel config saved.");
+    if (json) {
+      jsonOutput({
+        ok: true,
+        agent: agentCodeName,
+        channel: "slack",
+        scopes: selectedScopes,
+        status: botTokenRef ? "configured" : "pending",
+        manifest_path: manifestPath
+      });
+    } else {
+      console.log();
+      success(`Slack setup complete for "${agentCodeName}"`);
+      info(`Status: ${botTokenRef ? "configured" : "pending (add credentials to activate)"}`);
+    }
+  } catch (err) {
+    spinner.fail("Slack setup failed.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function channelSlackStatusCommand(agentCodeName) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora6({ text: `Fetching Slack config for "${agentCodeName}"\u2026`, isSilent: json });
+  spinner.start();
+  try {
+    const data = await api.get(`/agents/${encodeURIComponent(agentCodeName)}/channel-configs/slack`);
+    spinner.stop();
+    const config = data.config;
+    if (json) {
+      jsonOutput({
+        ok: true,
+        agent: agentCodeName,
+        channel: "slack",
+        configured: true,
+        config
+      });
+      return;
+    }
+    console.log(chalk8.bold(`
+Slack Configuration: ${agentCodeName}
+`));
+    const rows = [
+      ["App Name", config.app_name ?? "-"],
+      ["App ID", config.app_id ?? "-"],
+      ["Team ID", config.team_id ?? "-"],
+      ["Bot Token", config.bot_token_ref ? chalk8.green("configured") : chalk8.dim("not set")],
+      ["Signing Secret", config.signing_secret_ref ? chalk8.green("configured") : chalk8.dim("not set")],
+      ["Scopes", (config.scopes ?? []).join(", ") || "-"]
+    ];
+    table(["Field", "Value"], rows);
+  } catch (err) {
+    spinner.stop();
+    if (err.status === 404) {
+      if (json) {
+        jsonOutput({ ok: true, agent: agentCodeName, channel: "slack", configured: false });
+      } else {
+        warn(`No Slack configuration found for "${agentCodeName}".`);
+        info("Run `agt channels slack setup " + agentCodeName + "` to configure.");
+      }
+      return;
+    }
+    spinner.fail("Failed to fetch Slack status.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function channelSlackRemoveCommand(agentCodeName) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora6({ text: `Looking up agent "${agentCodeName}"\u2026`, isSilent: json });
+  spinner.start();
+  try {
+    let config = null;
+    try {
+      const data = await api.get(`/agents/${encodeURIComponent(agentCodeName)}/channel-configs/slack`);
+      config = data.config;
+    } catch (err) {
+      if (err.status === 404) {
+        spinner.info(`No Slack configuration found for "${agentCodeName}".`);
+        if (json) {
+          jsonOutput({ ok: true, agent: agentCodeName, channel: "slack", removed: false, reason: "not_configured" });
+        }
+        return;
+      }
+      throw err;
+    }
+    spinner.stop();
+    if (!json) {
+      const appLabel = config?.app_id ? ` (App ID: ${config.app_id})` : config?.app_name ? ` (${config.app_name})` : "";
+      const confirmed = await confirm2({
+        message: `Remove Slack bot configuration${appLabel} for "${agentCodeName}"?`,
+        default: false
+      });
+      if (!confirmed) {
+        warn("Aborted.");
+        return;
+      }
+    }
+    const removeSpinner = ora6({ text: "Removing Slack configuration\u2026", isSilent: json });
+    removeSpinner.start();
+    await api.del(`/agents/${encodeURIComponent(agentCodeName)}/channel-configs/slack`);
+    removeSpinner.succeed("Slack configuration removed.");
+    if (json) {
+      jsonOutput({ ok: true, agent: agentCodeName, channel: "slack", removed: true });
+    } else {
+      if (config?.app_id) {
+        console.log();
+        info(`Note: The Slack app (${config.app_id}) still exists in your Slack workspace.`);
+        info("Delete it manually at https://api.slack.com/apps if no longer needed.");
+      }
+    }
+  } catch (err) {
+    error(err.message);
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    }
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/channel-beam.ts
+import chalk9 from "chalk";
+import ora7 from "ora";
+import { confirm as confirm3 } from "@inquirer/prompts";
+async function channelBeamSetupCommand(agentCodeName, options) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora7({ text: `Looking up agent "${agentCodeName}"\u2026`, isSilent: json });
+  spinner.start();
+  try {
+    const agentData = await api.get(`/agents/${encodeURIComponent(agentCodeName)}`);
+    const agent2 = agentData.agent;
+    const channels2 = agent2.channels ?? [];
+    if (!channels2.includes("beam")) {
+      spinner.fail(`Agent "${agentCodeName}" does not have Beam in its channel list.`);
+      error(`Enable Beam in the agent's channels first (add "beam" to the channels array).`);
+      process.exitCode = 1;
+      return;
+    }
+    spinner.succeed(`Found agent "${agentCodeName}"`);
+    const existingConfig = await api.get(`/agents/${encodeURIComponent(agentCodeName)}/channel-configs/beam`).catch(() => ({ config: null }));
+    if (existingConfig.config?.beam_id) {
+      info(`Agent already has Beam identity: ${chalk9.cyan(String(existingConfig.config.beam_id))}`);
+      const proceed = await confirm3({
+        message: "Regenerate identity? This will create a new keypair and re-register.",
+        default: false
+      });
+      if (!proceed) return;
+    }
+    spinner.start("Generating Ed25519 identity and registering with Beam directory\u2026");
+    const result = await api.post(`/agents/${encodeURIComponent(agentCodeName)}/channel-configs/beam/setup`, {
+      auto_publish_capabilities: options.autoPublish ?? true,
+      directory_url: options.directoryUrl
+    });
+    if (!result.ok) {
+      spinner.fail("Registration failed");
+      error(result.error ?? "Unknown error");
+      process.exitCode = 1;
+      return;
+    }
+    spinner.succeed("Beam identity created and registered");
+    if (json) {
+      jsonOutput({
+        beam_id: result.beam_id,
+        did: result.did,
+        public_key: result.public_key,
+        trust_score: result.trust_score,
+        verification_tier: result.verification_tier,
+        published_capabilities: result.published_capabilities
+      });
+      return;
+    }
+    console.log();
+    table(
+      ["Field", "Value"],
+      [
+        ["Beam ID", chalk9.cyan(result.beam_id)],
+        ["DID", chalk9.dim(result.did)],
+        ["Trust Score", String(result.trust_score)],
+        ["Verification", result.verification_tier],
+        ["Capabilities", result.published_capabilities.length > 0 ? result.published_capabilities.join(", ") : chalk9.dim("none published")]
+      ]
+    );
+    console.log();
+    success(`Agent "${agentCodeName}" is now reachable at ${chalk9.cyan(result.beam_id)}`);
+  } catch (err) {
+    spinner.fail("Setup failed");
+    error(err instanceof Error ? err.message : "Unknown error");
+    process.exitCode = 1;
+  }
+}
+async function channelBeamStatusCommand(agentCodeName) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora7({ text: `Fetching Beam config for "${agentCodeName}"\u2026`, isSilent: json });
+  spinner.start();
+  try {
+    const data = await api.get(`/agents/${encodeURIComponent(agentCodeName)}/channel-configs/beam`);
+    if (!data.config?.beam_id) {
+      spinner.info("No Beam identity configured for this agent.");
+      return;
+    }
+    spinner.succeed("Beam configuration found");
+    const cfg = data.config;
+    if (json) {
+      jsonOutput(cfg);
+      return;
+    }
+    console.log();
+    table(
+      ["Field", "Value"],
+      [
+        ["Beam ID", chalk9.cyan(String(cfg.beam_id))],
+        ["DID", chalk9.dim(String(cfg.did ?? "\u2014"))],
+        ["Public Key", chalk9.dim(String(cfg.public_key ?? "").slice(0, 24) + "\u2026")],
+        ["Trust Score", String(cfg.trust_score ?? 0)],
+        ["Verification", String(cfg.verification_tier ?? "basic")],
+        ["Auto-publish", cfg.auto_publish_capabilities ? chalk9.green("yes") : chalk9.dim("no")],
+        ["Capabilities", Array.isArray(cfg.published_capabilities) && cfg.published_capabilities.length > 0 ? cfg.published_capabilities.join(", ") : chalk9.dim("none")],
+        ["Status", data.status ?? "\u2014"]
+      ]
+    );
+    console.log();
+  } catch (err) {
+    spinner.fail("Failed to fetch config");
+    error(err instanceof Error ? err.message : "Unknown error");
+    process.exitCode = 1;
+  }
+}
+async function channelBeamRemoveCommand(agentCodeName) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  if (!json) {
+    const proceed = await confirm3({
+      message: `Remove Beam identity from "${agentCodeName}"? The directory entry will expire.`,
+      default: false
+    });
+    if (!proceed) return;
+  }
+  const spinner = ora7({ text: "Removing Beam identity\u2026", isSilent: json });
+  spinner.start();
+  try {
+    await api.del(`/agents/${encodeURIComponent(agentCodeName)}/channel-configs/beam`);
+    spinner.succeed("Beam identity removed");
+    if (json) {
+      jsonOutput({ ok: true });
+    }
+  } catch (err) {
+    spinner.fail("Failed to remove");
+    error(err instanceof Error ? err.message : "Unknown error");
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/deploy.ts
+import chalk10 from "chalk";
+import ora8 from "ora";
+import { select as select2, input as input3 } from "@inquirer/prompts";
+import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { join as join4 } from "path";
+async function deployCommand(opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const nonInteractive = !!opts.template;
+  const json = isJsonMode();
+  let templateId;
+  let basePort;
+  if (nonInteractive) {
+    templateId = opts.template;
+    basePort = Number(opts.port ?? "9000");
+    if (isNaN(basePort) || basePort < 1 || basePort > 65535) {
+      if (json) {
+        jsonOutput({ ok: false, error: "Invalid port number" });
+      } else {
+        error("Invalid port number. Must be between 1 and 65535.");
+      }
+      process.exitCode = 1;
+      return;
+    }
+  } else {
+    console.log(chalk10.bold("\nAugmented \u2014 Deploy\n"));
+    templateId = await select2({
+      message: "Deployment template:",
+      choices: DEPLOYMENT_TEMPLATES.map((t) => ({
+        value: t.id,
+        name: `${t.name} \u2014 ${t.description}`
+      }))
+    });
+    const basePortStr = await input3({
+      message: "Base port for gateway:",
+      default: "9000",
+      validate: (v) => {
+        const n = Number(v);
+        return !isNaN(n) && n > 0 && n < 65536 || "Must be a valid port number";
+      }
+    });
+    basePort = Number(basePortStr);
+  }
+  const tmpl = getTemplate(templateId);
+  if (!tmpl) {
+    if (json) {
+      jsonOutput({ ok: false, error: `Template "${templateId}" not found` });
+    } else {
+      error(`Template "${templateId}" not found.`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const spinner = ora8({ text: "Fetching agents\u2026", isSilent: json });
+  spinner.start();
+  let agents;
+  try {
+    const data = await api.get("/agents");
+    agents = data.agents;
+  } catch (err) {
+    spinner.fail("Failed to fetch agents.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  if (!agents || agents.length === 0) {
+    spinner.fail("No agents found in team.");
+    if (json) {
+      jsonOutput({ ok: false, error: "No agents found in team. Run `agt init` first." });
+    } else {
+      error("No agents found in team. Run `agt init` first.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const templateAgents = agents.map((a, i) => ({
+    agent_id: a.agent_id,
+    code_name: a.code_name,
+    display_name: a.display_name,
+    environment: a.environment,
+    port: basePort + i
+  }));
+  const context = {
+    agents: templateAgents,
+    gateway: { port: basePort },
+    variables: {}
+  };
+  let rendered;
+  try {
+    rendered = renderTemplate(tmpl.template, context);
+  } catch (err) {
+    spinner.fail("Template rendering failed.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    await api.post("/deployments", {
+      template_id: tmpl.id,
+      agent_ids: agents.map((a) => a.agent_id),
+      variables: { base_port: basePort }
+    });
+  } catch (deployErr) {
+    spinner.stop();
+    if (!json) info(`Warning: could not record deployment in database: ${deployErr.message}`);
+  }
+  const outDir = join4(process.cwd(), ".augmented", "deploy");
+  mkdirSync2(outDir, { recursive: true });
+  const outPath = join4(outDir, "docker-compose.yaml");
+  writeFileSync2(outPath, rendered);
+  spinner.succeed("Deployment config generated.");
+  if (json) {
+    jsonOutput({
+      ok: true,
+      template: tmpl.id,
+      agents: agents.map((a) => a.code_name),
+      output_path: outPath
+    });
+    return;
+  }
+  console.log();
+  info(`Template: ${chalk10.bold(tmpl.name)}`);
+  info(`Agents:   ${agents.map((a) => a.code_name).join(", ")}`);
+  info(`Output:   ${outPath}`);
+  console.log();
+  info(`Next steps:`);
+  info(`  cd .augmented/deploy && docker compose up`);
+}
+
+// src/commands/provision.ts
+import chalk11 from "chalk";
+import ora9 from "ora";
+import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { join as join5 } from "path";
+function printDiagnostics3(diagnostics) {
+  for (const d of diagnostics) {
+    const prefix = d.severity === "error" ? chalk11.red("ERR") : chalk11.yellow("WARN");
+    const path = d.path ? chalk11.dim(` (${d.path})`) : "";
+    console.log(`  ${prefix} [${d.code}] ${d.message}${path}`);
+  }
+}
+async function provisionCommand(codeName, options) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const target = options.target ?? "local_docker";
+  const outputDir = options.output ?? join5(process.cwd(), ".augmented", codeName, "provision");
+  const dryRun = options.dryRun ?? false;
+  if (!json) console.log(chalk11.bold("\nAugmented \u2014 Provision\n"));
+  const spinner = ora9({ text: "Fetching agent data\u2026", isSilent: json });
+  spinner.start();
+  let provisionData;
+  try {
+    provisionData = await api.get(`/agents/${encodeURIComponent(codeName)}/provision-data`);
+  } catch (err) {
+    spinner.fail(`Could not fetch provision data for "${codeName}".`);
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const agentData = provisionData.agent;
+  if (!provisionData.charter) {
+    spinner.fail("No CHARTER.md version found.");
+    if (json) jsonOutput({ ok: false, error: "No CHARTER.md version found" });
+    else error("No CHARTER.md version found for this agent");
+    process.exitCode = 1;
+    return;
+  }
+  if (!provisionData.tools) {
+    spinner.fail("No TOOLS.md version found.");
+    if (json) jsonOutput({ ok: false, error: "No TOOLS.md version found" });
+    else error("No TOOLS.md version found for this agent");
+    process.exitCode = 1;
+    return;
+  }
+  spinner.text = "Parsing frontmatter\u2026";
+  const charterContent = provisionData.charter.raw_content;
+  const toolsContent = provisionData.tools.raw_content;
+  const charterParsed = extractFrontmatter(charterContent);
+  if (!charterParsed.frontmatter) {
+    spinner.fail("Failed to parse CHARTER.md frontmatter.");
+    if (json) jsonOutput({ ok: false, error: charterParsed.error ?? "Unknown parse error" });
+    else error(charterParsed.error ?? "Unknown parse error");
+    process.exitCode = 1;
+    return;
+  }
+  const toolsParsed = extractFrontmatter(toolsContent);
+  if (!toolsParsed.frontmatter) {
+    spinner.fail("Failed to parse TOOLS.md frontmatter.");
+    if (json) jsonOutput({ ok: false, error: toolsParsed.error ?? "Unknown parse error" });
+    else error(toolsParsed.error ?? "Unknown parse error");
+    process.exitCode = 1;
+    return;
+  }
+  const charterFrontmatter = charterParsed.frontmatter;
+  const toolsFrontmatter = toolsParsed.frontmatter;
+  spinner.text = "Linting\u2026";
+  const lintResult = lintAll(charterContent, toolsContent);
+  if (!lintResult.ok) {
+    spinner.fail("Lint errors \u2014 cannot provision.");
+    if (json) {
+      jsonOutput({
+        ok: false,
+        error: "Lint errors \u2014 cannot provision",
+        lint: {
+          errors: lintResult.errors.length,
+          warnings: lintResult.warnings.length,
+          diagnostics: [...lintResult.errors, ...lintResult.warnings]
+        }
+      });
+    } else {
+      printDiagnostics3(lintResult.errors);
+      if (lintResult.warnings.length > 0) printDiagnostics3(lintResult.warnings);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  if (lintResult.warnings.length > 0 && !json) {
+    spinner.stop();
+    warn(`Lint: ${lintResult.warnings.length} warning(s)`);
+    printDiagnostics3(lintResult.warnings);
+    spinner.start("Provisioning\u2026");
+  }
+  spinner.text = "Resolving channels\u2026";
+  const configuredChannels = Object.keys(provisionData.channel_configs ?? {});
+  const agentChannelPolicy = {
+    policy: "allowlist",
+    allowed: configuredChannels,
+    denied: [],
+    require_approval_to_change: true
+  };
+  let teamChannelPolicy;
+  const policyData = provisionData.team_channel_policy;
+  if (policyData) {
+    teamChannelPolicy = {
+      team_id: policyData.team_id,
+      allowed_channels: policyData.allowed_channels ?? [],
+      denied_channels: policyData.denied_channels ?? [],
+      require_elevated_for_pii: policyData.require_elevated_for_pii ?? false
+    };
+  }
+  const resolvedChannels = resolveChannels(agentChannelPolicy, teamChannelPolicy);
+  const frameworkId = agentData.framework ?? "openclaw";
+  const adapter = getFramework(frameworkId);
+  spinner.text = `Building ${adapter.label} config\u2026`;
+  const provisionInput = {
+    agent: agentData,
+    charterFrontmatter,
+    charterContent,
+    toolsFrontmatter,
+    toolsContent,
+    resolvedChannels,
+    deploymentTarget: target,
+    gatewayPort: 9e3
+  };
+  const provisionOutput = provision(provisionInput, frameworkId);
+  const templateId = target === "local_docker" ? "shared-gateway-local" : "shared-gateway-local";
+  const tmpl = getTemplate(templateId);
+  let deploymentYaml = "";
+  if (tmpl) {
+    const templateContext = {
+      agents: [{
+        agent_id: agentData.agent_id,
+        code_name: agentData.code_name,
+        display_name: agentData.display_name,
+        environment: agentData.environment,
+        port: 9e3
+      }],
+      gateway: { port: 9e3 },
+      variables: {}
+    };
+    deploymentYaml = renderTemplate(tmpl.template, templateContext);
+  }
+  if (dryRun) {
+    spinner.stop();
+    if (json) {
+      jsonOutput({
+        ok: true,
+        dry_run: true,
+        agent: codeName,
+        framework: frameworkId,
+        target,
+        charter_hash: provisionOutput.charterHash,
+        tools_hash: provisionOutput.toolsHash,
+        channels: resolvedChannels.length,
+        artifacts: provisionOutput.artifacts.map((a) => ({
+          path: a.relativePath,
+          size: a.content.length
+        })),
+        deployment_yaml: deploymentYaml || null
+      });
+      return;
+    }
+    console.log();
+    info("Dry run \u2014 no files written.");
+    console.log();
+    for (const artifact of provisionOutput.artifacts) {
+      console.log(chalk11.bold(`${artifact.relativePath}:`));
+      console.log(artifact.content);
+    }
+    if (deploymentYaml) {
+      console.log(chalk11.bold("Deployment Template:"));
+      console.log(deploymentYaml);
+    }
+    console.log();
+    info(`CHARTER hash:  ${provisionOutput.charterHash}`);
+    info(`TOOLS hash: ${provisionOutput.toolsHash}`);
+    return;
+  }
+  spinner.text = "Writing files\u2026";
+  mkdirSync3(outputDir, { recursive: true });
+  for (const artifact of provisionOutput.artifacts) {
+    writeFileSync3(join5(outputDir, artifact.relativePath), artifact.content);
+  }
+  if (deploymentYaml) {
+    writeFileSync3(join5(outputDir, "docker-compose.yaml"), deploymentYaml);
+  }
+  spinner.text = "Storing provision snapshot\u2026";
+  try {
+    await api.post(`/agents/${encodeURIComponent(codeName)}/provision-snapshots`, {
+      charter_version: provisionData.charter.version,
+      tools_version: provisionData.tools.version,
+      charter_content: charterContent,
+      tools_content: toolsContent,
+      channels: resolvedChannels
+    });
+  } catch (err) {
+    spinner.stop();
+    if (!json) warn(`Provision completed but could not store snapshot: ${err.message}`);
+  }
+  spinner.succeed(`Agent "${chalk11.bold(agentData.display_name)}" provisioned.`);
+  if (json) {
+    jsonOutput({
+      ok: true,
+      agent: codeName,
+      framework: frameworkId,
+      target,
+      output_dir: outputDir,
+      charter_hash: provisionOutput.charterHash,
+      tools_hash: provisionOutput.toolsHash,
+      channels: resolvedChannels.length,
+      artifacts: provisionOutput.artifacts.map((a) => a.relativePath)
+    });
+    return;
+  }
+  console.log();
+  info(`Agent:       ${agentData.code_name}`);
+  info(`Framework:   ${adapter.label}`);
+  info(`Target:      ${target}`);
+  info(`Output:      ${outputDir}`);
+  info(`CHARTER hash:   ${provisionOutput.charterHash.slice(0, 12)}\u2026`);
+  info(`TOOLS hash:  ${provisionOutput.toolsHash.slice(0, 12)}\u2026`);
+  info(`Channels:    ${resolvedChannels.length} active`);
+  info(`Artifacts:   ${provisionOutput.artifacts.map((a) => a.relativePath).join(", ")}`);
+  console.log();
+  info("Next steps:");
+  info(`  cd ${outputDir} && docker compose up`);
+  info(`  agt drift check ${agentData.code_name}`);
+}
+
+// src/commands/drift.ts
+import chalk12 from "chalk";
+import ora10 from "ora";
+
+// ../../packages/core/dist/drift/live-state-reader.js
+import { readFile } from "fs/promises";
+import { createHash } from "crypto";
+import { join as join6 } from "path";
+import JSON5 from "json5";
+async function hashFile(filePath) {
+  try {
+    const content = await readFile(filePath);
+    return createHash("sha256").update(content).digest("hex");
+  } catch {
+    return null;
+  }
+}
+async function readJsonFile(filePath) {
+  try {
+    const content = await readFile(filePath, "utf-8");
+    return JSON5.parse(content);
+  } catch {
+    return null;
+  }
+}
+async function readLiveState(options) {
+  const trackedFiles = options.trackedFiles ?? ["openclaw.json5", "CHARTER.md", "TOOLS.md"];
+  const charterFile = trackedFiles.find((f) => f.includes("CHARTER")) ?? "CHARTER.md";
+  const toolsFile = trackedFiles.find((f) => f.includes("TOOLS")) ?? "TOOLS.md";
+  const [frameworkConfig, charterHash, toolsHash] = await Promise.all([
+    readJsonFile(options.configPath),
+    hashFile(join6(options.teamDir, charterFile)),
+    hashFile(join6(options.teamDir, toolsFile))
+  ]);
+  return {
+    frameworkConfig,
+    charterHash,
+    toolsHash,
+    configPath: options.configPath
+  };
+}
+
+// src/commands/drift.ts
+var KEBAB_CASE_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+function severityColor(severity) {
+  switch (severity) {
+    case "critical":
+      return chalk12.red(severity);
+    case "warning":
+      return chalk12.yellow(severity);
+    default:
+      return chalk12.dim(severity);
+  }
+}
+function printDriftReport(report) {
+  console.log(chalk12.bold(`
+Drift Report: ${report.codeName}
+`));
+  info(`Agent ID:    ${report.agentId}`);
+  info(`Checked at:  ${report.checkedAt.toISOString()}`);
+  console.log();
+  if (!report.hasDrift) {
+    success("No drift detected. Agent matches provisioned state.");
+    return;
+  }
+  warn(`Drift detected: ${report.criticalCount} critical, ${report.warningCount} warning`);
+  console.log();
+  const rows = report.findings.map((f) => [
+    severityColor(f.severity),
+    f.category,
+    f.field,
+    f.message
+  ]);
+  table(["Severity", "Category", "Field", "Message"], rows);
+}
+async function driftCheckCommand(codeName, opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  if (!KEBAB_CASE_RE.test(codeName)) {
+    error('Invalid code-name. Must be kebab-case (e.g. "my-agent").');
+    process.exitCode = 1;
+    return;
+  }
+  const useJson = opts.json || isJsonMode();
+  const spinner = ora10({ text: `Checking drift for "${codeName}"\u2026`, isSilent: useJson });
+  spinner.start();
+  try {
+    const driftData = await api.get(`/agents/${encodeURIComponent(codeName)}/drift-data`);
+    const agent2 = driftData.agent;
+    const snapshot = driftData.snapshot;
+    if (!snapshot) {
+      spinner.fail(`No provision snapshot found for "${codeName}". Run \`agt provision\` first.`);
+      error("No provision snapshot available");
+      process.exitCode = 1;
+      return;
+    }
+    const frameworkId = agent2.framework ?? "openclaw";
+    const adapter = getFramework(frameworkId);
+    const trackedFiles = adapter.driftTrackedFiles();
+    const defaultDir = `.augmented/${teamSlug}/${codeName}/provision`;
+    const configPath = opts.config ?? `${defaultDir}/${trackedFiles[0]}`;
+    const liveState = await readLiveState({
+      configPath,
+      teamDir: defaultDir,
+      trackedFiles,
+      runAudit: opts.audit
+    });
+    const report = detectDrift(
+      {
+        frameworkConfig: snapshot.openclaw_config ?? {},
+        charterHash: snapshot.charter_hash ?? "",
+        toolsHash: snapshot.tools_hash ?? "",
+        toolAllow: snapshot.tool_allow ?? [],
+        toolDeny: snapshot.tool_deny ?? [],
+        channelsConfig: snapshot.channels_config ?? {},
+        sandboxMode: snapshot.sandbox_mode ?? "all"
+      },
+      liveState,
+      agent2.agent_id,
+      codeName,
+      agent2.risk_tier ?? "Medium"
+    );
+    spinner.stop();
+    if (useJson) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      printDriftReport(report);
+    }
+    if (report.hasDrift) {
+      process.exitCode = 1;
+    }
+  } catch (err) {
+    spinner.fail("Drift check failed.");
+    error(err.message);
+    process.exitCode = 1;
+  }
+}
+async function driftWatchCommand(codeName, opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  if (!KEBAB_CASE_RE.test(codeName)) {
+    error('Invalid code-name. Must be kebab-case (e.g. "my-agent").');
+    process.exitCode = 1;
+    return;
+  }
+  const useJson = opts.json || isJsonMode();
+  const intervalSec = parseInt(opts.interval ?? "60", 10);
+  if (isNaN(intervalSec) || intervalSec < 1) {
+    error("Interval must be a positive number of seconds.");
+    process.exitCode = 1;
+    return;
+  }
+  let agent2;
+  try {
+    const data = await api.get(`/agents/${encodeURIComponent(codeName)}`);
+    agent2 = data.agent;
+  } catch (err) {
+    error(err.message);
+    process.exitCode = 1;
+    return;
+  }
+  const frameworkId = agent2.framework ?? "openclaw";
+  const adapter = getFramework(frameworkId);
+  const trackedFiles = adapter.driftTrackedFiles();
+  if (!useJson) {
+    console.log(
+      chalk12.bold(`
+Watching drift for "${codeName}" every ${intervalSec}s. Press Ctrl+C to stop.
+`)
+    );
+  }
+  let previousFindingCount = -1;
+  const runCheck = async () => {
+    const spinner = ora10({ text: `Checking drift for "${codeName}"\u2026`, isSilent: useJson });
+    spinner.start();
+    try {
+      const driftData = await api.get(`/agents/${encodeURIComponent(codeName)}/drift-data`);
+      const snapshot = driftData.snapshot;
+      if (!snapshot) {
+        spinner.warn("No provision snapshot found. Skipping check.");
+        return;
+      }
+      const watchDefaultDir = `.augmented/${teamSlug}/${codeName}/provision`;
+      const configPath = opts.config ?? `${watchDefaultDir}/${trackedFiles[0]}`;
+      const liveState = await readLiveState({
+        configPath,
+        teamDir: watchDefaultDir,
+        trackedFiles
+      });
+      const report = detectDrift(
+        {
+          frameworkConfig: snapshot.openclaw_config ?? {},
+          charterHash: snapshot.charter_hash ?? "",
+          toolsHash: snapshot.tools_hash ?? "",
+          toolAllow: snapshot.tool_allow ?? [],
+          toolDeny: snapshot.tool_deny ?? [],
+          channelsConfig: snapshot.channels_config ?? {},
+          sandboxMode: snapshot.sandbox_mode ?? "all"
+        },
+        liveState,
+        agent2.agent_id,
+        codeName,
+        agent2.risk_tier ?? "Medium"
+      );
+      spinner.stop();
+      const isNew = report.findings.length !== previousFindingCount;
+      previousFindingCount = report.findings.length;
+      if (useJson) {
+        console.log(JSON.stringify(report, null, 2));
+      } else if (report.hasDrift) {
+        printDriftReport(report);
+      } else {
+        success(`[${(/* @__PURE__ */ new Date()).toLocaleTimeString()}] No drift detected.`);
+      }
+      if (isNew && report.hasDrift && opts.webhook) {
+        try {
+          await fetch(opts.webhook, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(report)
+          });
+          if (!useJson) info(`Webhook notified: ${opts.webhook}`);
+        } catch (webhookErr) {
+          if (!useJson) warn(`Failed to notify webhook: ${webhookErr.message}`);
+        }
+      }
+    } catch (err) {
+      spinner.fail("Drift check failed.");
+      error(err.message);
+    }
+  };
+  await runCheck();
+  const timer = setInterval(() => {
+    void runCheck();
+  }, intervalSec * 1e3);
+  process.on("SIGINT", () => {
+    clearInterval(timer);
+    if (!useJson) console.log(chalk12.dim("\nStopped watching."));
+    process.exit(0);
+  });
+}
+
+// src/commands/host.ts
+import chalk13 from "chalk";
+import ora11 from "ora";
+async function hostListCommand() {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora11({ text: "Fetching hosts\u2026", isSilent: json });
+  spinner.start();
+  try {
+    const data = await api.get("/hosts");
+    spinner.stop();
+    if (!data.hosts || data.hosts.length === 0) {
+      if (json) {
+        jsonOutput({ ok: true, hosts: [] });
+      } else {
+        info("No hosts found. Create one with `agt host create --name <name>`.");
+      }
+      return;
+    }
+    if (json) {
+      jsonOutput({ ok: true, hosts: data.hosts });
+      return;
+    }
+    const rows = data.hosts.map((h) => {
+      const status = h.status === "active" ? chalk13.green("active") : chalk13.red("decommissioned");
+      const agents = String(h.agents);
+      const lastSeen = h.last_seen_at ? new Date(h.last_seen_at).toLocaleDateString() : chalk13.dim("never");
+      const prefix = h.key_prefix ? `tlk_${h.key_prefix}\u2026` : chalk13.dim("none");
+      return [h.name, status, agents, lastSeen, prefix];
+    });
+    table(["Name", "Status", "Agents", "Last Seen", "Key"], rows);
+  } catch (err) {
+    spinner.fail("Failed to fetch hosts.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function hostAssignCommand(hostName, agentCodeNames, opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  if (!agentCodeNames || agentCodeNames.length === 0) {
+    if (json) {
+      jsonOutput({ ok: false, error: "At least one agent code name is required" });
+    } else {
+      error("At least one agent code name is required.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const spinner = ora11({ text: "Assigning agents\u2026", isSilent: json });
+  spinner.start();
+  try {
+    await api.post(`/hosts/${encodeURIComponent(hostName)}/assign`, {
+      agents: agentCodeNames,
+      force: opts.force
+    });
+    spinner.succeed(`Agents assigned to ${chalk13.bold(hostName)}.`);
+    if (json) {
+      jsonOutput({ ok: true, host: hostName, assigned: agentCodeNames });
+      return;
+    }
+    for (const name of agentCodeNames) {
+      info(`  ${name}`);
+    }
+  } catch (err) {
+    spinner.fail("Failed to assign agents.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function hostUnassignCommand(hostName, agentCodeNames) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  if (!agentCodeNames || agentCodeNames.length === 0) {
+    if (json) {
+      jsonOutput({ ok: false, error: "At least one agent code name is required" });
+    } else {
+      error("At least one agent code name is required.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const spinner = ora11({ text: "Unassigning agents\u2026", isSilent: json });
+  spinner.start();
+  try {
+    await api.post(`/hosts/${encodeURIComponent(hostName)}/unassign`, {
+      agents: agentCodeNames
+    });
+    spinner.succeed(`Agents unassigned from ${chalk13.bold(hostName)}.`);
+    if (json) {
+      jsonOutput({ ok: true, host: hostName, unassigned: agentCodeNames });
+      return;
+    }
+    for (const name of agentCodeNames) {
+      info(`  ${name}`);
+    }
+  } catch (err) {
+    spinner.fail("Failed to unassign agents.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function hostAgentsCommand(hostName) {
+  const json = isJsonMode();
+  const spinner = ora11({ text: "Fetching host agents\u2026", isSilent: json });
+  spinner.start();
+  try {
+    const hostId = await getHostId();
+    if (!hostName && !hostId) {
+      spinner.fail("No host specified.");
+      if (json) {
+        jsonOutput({ ok: false, error: "Provide a host name or use an AGT_API_KEY" });
+      } else {
+        error("Provide a host name, or set AGT_API_KEY to auto-resolve the host.");
+      }
+      process.exitCode = 1;
+      return;
+    }
+    let agents;
+    if (hostId && !hostName) {
+      const data = await api.post("/host/agents", { host_id: hostId });
+      agents = data.agents ?? [];
+    } else {
+      const teamSlug = requireTeam();
+      if (!teamSlug) return;
+      const data = await api.get(`/hosts/${encodeURIComponent(hostName)}/agents`);
+      agents = data.agents ?? [];
+    }
+    spinner.stop();
+    if (agents.length === 0) {
+      if (json) {
+        jsonOutput({ ok: true, agents: [] });
+      } else {
+        info("No agents assigned to this host.");
+        info("Assign agents with `agt host assign <host-name> <agent-code-name>`.");
+      }
+      return;
+    }
+    if (json) {
+      jsonOutput({ ok: true, agents });
+      return;
+    }
+    const rows = agents.map((a) => {
+      const statusColor = a.status === "active" ? chalk13.green : chalk13.yellow;
+      return [
+        a.code_name,
+        a.display_name,
+        statusColor(a.status),
+        a.environment
+      ];
+    });
+    table(["Code Name", "Display Name", "Status", "Environment"], rows);
+  } catch (err) {
+    spinner.fail("Failed to fetch host agents.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function hostRotateKeyCommand(hostName) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora11({ text: "Rotating host key\u2026", isSilent: json });
+  spinner.start();
+  try {
+    const data = await api.post(`/hosts/${encodeURIComponent(hostName)}/rotate-key`);
+    spinner.succeed(`Key rotated for ${chalk13.bold(hostName)}.`);
+    if (json) {
+      jsonOutput({
+        ok: true,
+        host: hostName,
+        key: data.key
+      });
+      return;
+    }
+    console.log();
+    info(`Host:   ${chalk13.bold(hostName)}`);
+    info(`Prefix: ${data.key.prefix}`);
+    console.log();
+    console.log(chalk13.yellow.bold("  Save this key now \u2014 it will not be shown again:"));
+    console.log();
+    console.log(`  ${chalk13.green.bold(data.key.raw_key)}`);
+    console.log();
+  } catch (err) {
+    spinner.fail("Failed to rotate key.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function hostDecommissionCommand(hostName) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora11({ text: "Decommissioning host\u2026", isSilent: json });
+  spinner.start();
+  try {
+    await api.post(`/hosts/${encodeURIComponent(hostName)}/decommission`);
+    spinner.succeed(`Host "${chalk13.bold(hostName)}" decommissioned.`);
+    if (json) {
+      jsonOutput({
+        ok: true,
+        host: hostName,
+        status: "decommissioned"
+      });
+      return;
+    }
+    info(`Host:   ${hostName}`);
+    info(`Status: ${chalk13.red("decommissioned")}`);
+    info("API key revoked. Agents remain assigned for audit visibility.");
+    info("Reassign agents to another host with `agt host assign --force`.");
+  } catch (err) {
+    spinner.fail("Failed to decommission host.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/manager.ts
+import chalk14 from "chalk";
+import { join as join8 } from "path";
+import { homedir } from "os";
+
+// src/lib/watchdog.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync4, unlinkSync, existsSync as existsSync2, mkdirSync as mkdirSync4 } from "fs";
+import { join as join7 } from "path";
+var AUGMENTED_DIR = join7(process.env["HOME"] ?? "/tmp", ".augmented");
+var PID_FILE = join7(AUGMENTED_DIR, "manager.pid");
+var STATE_FILE = join7(AUGMENTED_DIR, "manager-state.json");
+function ensureDir() {
+  if (!existsSync2(AUGMENTED_DIR)) {
+    mkdirSync4(AUGMENTED_DIR, { recursive: true });
+  }
+}
+function writePidFile(pid) {
+  ensureDir();
+  writeFileSync4(PID_FILE, String(pid), { mode: 384 });
+}
+function readPidFile() {
+  try {
+    const raw = readFileSync2(PID_FILE, "utf-8").trim();
+    const pid = parseInt(raw, 10);
+    return isNaN(pid) ? null : pid;
+  } catch {
+    return null;
+  }
+}
+function removePidFile() {
+  try {
+    unlinkSync(PID_FILE);
+  } catch {
+  }
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readStateFile() {
+  try {
+    const raw = readFileSync2(STATE_FILE, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function removeStateFile() {
+  try {
+    unlinkSync(STATE_FILE);
+  } catch {
+  }
+}
+function startWatchdog(opts) {
+  const existingPid = readPidFile();
+  if (existingPid !== null) {
+    if (isProcessAlive(existingPid)) {
+      throw new Error(`Manager already running (PID ${existingPid}). Use \`agt manager stop\` first.`);
+    }
+    removePidFile();
+    removeStateFile();
+  }
+  writePidFile(process.pid);
+  void import("../lib/manager-worker.js").then(({ startManager }) => {
+    startManager({
+      intervalMs: opts.intervalMs,
+      configDir: opts.configDir
+    });
+  });
+  process.on("exit", () => {
+    removePidFile();
+  });
+  return { pid: process.pid };
+}
+async function stopWatchdog() {
+  const pid = readPidFile();
+  if (pid === null) {
+    return { stopped: false };
+  }
+  if (!isProcessAlive(pid)) {
+    removePidFile();
+    removeStateFile();
+    return { stopped: true, pid };
+  }
+  process.kill(pid, "SIGTERM");
+  const deadline = Date.now() + 5e3;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 200));
+    if (!isProcessAlive(pid)) {
+      removePidFile();
+      return { stopped: true, pid };
+    }
+  }
+  try {
+    process.kill(pid, "SIGKILL");
+  } catch {
+  }
+  removePidFile();
+  removeStateFile();
+  return { stopped: true, pid };
+}
+function getManagerStatus() {
+  const pid = readPidFile();
+  if (pid === null) return null;
+  if (!isProcessAlive(pid)) {
+    removePidFile();
+    removeStateFile();
+    return null;
+  }
+  return readStateFile();
+}
+
+// src/commands/manager.ts
+function managerStartCommand(opts) {
+  const json = isJsonMode();
+  if (!AGT_HOST) {
+    const msg = "AGT_HOST is not set. Export it to point at the Augmented API (e.g. export AGT_HOST=https://your-api.example.com)";
+    if (json) {
+      jsonOutput({ ok: false, error: msg });
+    } else {
+      error(msg);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const apiKey = getApiKey();
+  if (!apiKey) {
+    const msg = "AGT_API_KEY is not set. Export it with your host API key (tlk_...)";
+    if (json) {
+      jsonOutput({ ok: false, error: msg });
+    } else {
+      error(msg);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const intervalSec = parseInt(opts.interval ?? "10", 10);
+  if (isNaN(intervalSec) || intervalSec < 5) {
+    if (json) {
+      jsonOutput({ ok: false, error: "Interval must be at least 10 seconds" });
+    } else {
+      error("Interval must be at least 10 seconds.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const configDir = opts.configDir ?? join8(homedir(), ".augmented");
+  try {
+    const { pid } = startWatchdog({
+      intervalMs: intervalSec * 1e3,
+      configDir
+    });
+    if (json) {
+      jsonOutput({ ok: true, pid, interval: intervalSec, configDir });
+    } else {
+      success(`Manager started (PID ${pid}, interval ${intervalSec}s)`);
+      info(`Config dir: ${configDir}`);
+      info("Stop with: agt manager stop");
+    }
+  } catch (err) {
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function managerStopCommand() {
+  const json = isJsonMode();
+  try {
+    const result = await stopWatchdog();
+    if (!result.stopped && !result.pid) {
+      if (json) {
+        jsonOutput({ ok: false, error: "Manager is not running" });
+      } else {
+        error("Manager is not running.");
+      }
+      process.exitCode = 1;
+      return;
+    }
+    if (json) {
+      jsonOutput({ ok: true, stopped: true, pid: result.pid });
+    } else {
+      success(`Manager stopped (PID ${result.pid})`);
+    }
+  } catch (err) {
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+function managerStatusCommand() {
+  const json = isJsonMode();
+  const status = getManagerStatus();
+  if (!status) {
+    if (json) {
+      jsonOutput({ ok: true, running: false });
+    } else {
+      info("Manager is not running.");
+    }
+    return;
+  }
+  if (json) {
+    jsonOutput({ ok: true, running: true, ...status });
+    return;
+  }
+  console.log(chalk14.bold("\nManager Status\n"));
+  info(`PID:        ${status.pid}`);
+  info(`Started:    ${status.startedAt}`);
+  info(`Last poll:  ${status.lastPollAt ?? chalk14.dim("none")}`);
+  info(`Polls:      ${status.pollCount}`);
+  info(`Errors:     ${status.errorCount}`);
+  console.log();
+  if (status.agents.length === 0) {
+    info("No agents discovered yet.");
+    return;
+  }
+  const rows = status.agents.map((a) => {
+    let gwStatus = chalk14.dim("\u2014");
+    if (a.gatewayRunning) {
+      gwStatus = chalk14.green(`:${a.gatewayPort} (PID ${a.gatewayPid})`);
+    } else if (a.gatewayPort) {
+      gwStatus = chalk14.red(`:${a.gatewayPort} (down)`);
+    }
+    return [
+      a.codeName,
+      a.status === "active" ? chalk14.green(a.status) : a.status === "paused" ? chalk14.yellow(a.status) : chalk14.dim(a.status ?? "\u2014"),
+      a.charterVersion || chalk14.dim("\u2014"),
+      gwStatus,
+      a.lastProvisionAt ? new Date(a.lastProvisionAt).toLocaleTimeString() : chalk14.dim("\u2014"),
+      a.lastDriftCheckAt ? new Date(a.lastDriftCheckAt).toLocaleTimeString() : chalk14.dim("\u2014")
+    ];
+  });
+  table(
+    ["Agent", "Status", "Charter", "Gateway", "Last Provision", "Last Drift"],
+    rows
+  );
+  const acpAgents = status.agents.filter((a) => a.acpSessions && a.acpSessions.length > 0);
+  if (acpAgents.length > 0) {
+    console.log(chalk14.bold("\nACP Sessions\n"));
+    const acpRows = acpAgents.flatMap(
+      (a) => a.acpSessions.map((s) => [
+        a.codeName,
+        s.agentCommand,
+        s.sessionName ?? chalk14.dim("default"),
+        s.queueState === "running" ? chalk14.green(s.queueState) : s.queueState === "queued" ? chalk14.yellow(s.queueState) : chalk14.dim(s.queueState),
+        String(s.turnCount),
+        new Date(s.startedAt).toLocaleTimeString()
+      ])
+    );
+    table(
+      ["Agent", "Coding Agent", "Session", "Queue", "Turns", "Started"],
+      acpRows
+    );
+  }
+}
+
+// src/commands/agent.ts
+import chalk15 from "chalk";
+import JSON52 from "json5";
+import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
+import { join as join9 } from "path";
+async function agentShowCommand(codeName, opts) {
+  const json = isJsonMode();
+  const agentDir = join9(opts.configDir, codeName, "provision");
+  const hasLocalConfig = existsSync3(agentDir);
+  let apiChannels = null;
+  let apiAgent = null;
+  if (getApiKey()) {
+    try {
+      const data = await api.get(`/agents/${encodeURIComponent(codeName)}/provision-data`);
+      apiAgent = data.agent ?? null;
+      if (data.channel_configs) {
+        apiChannels = Object.entries(data.channel_configs).map(
+          ([channelId, val]) => ({
+            channel_id: channelId,
+            config: val.config,
+            status: val.status
+          })
+        );
+      }
+    } catch {
+    }
+  }
+  if (!hasLocalConfig && !apiAgent) {
+    if (json) {
+      jsonOutput({ ok: false, error: `Agent '${codeName}' not found` });
+    } else {
+      error(`Agent '${codeName}' not found`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  let charter = null;
+  let tools = null;
+  let openclawConfig = null;
+  let agentState = null;
+  if (hasLocalConfig) {
+    const charterPath = join9(agentDir, "CHARTER.md");
+    if (existsSync3(charterPath)) {
+      const raw = readFileSync3(charterPath, "utf-8");
+      const parsed = extractFrontmatter(raw);
+      if (parsed.frontmatter) {
+        charter = parsed.frontmatter;
+      }
+    }
+    const toolsPath = join9(agentDir, "TOOLS.md");
+    if (existsSync3(toolsPath)) {
+      const raw = readFileSync3(toolsPath, "utf-8");
+      const parsed = extractFrontmatter(raw);
+      if (parsed.frontmatter) {
+        tools = parsed.frontmatter;
+      }
+    }
+    const openclawPath = join9(agentDir, "openclaw.json5");
+    if (existsSync3(openclawPath)) {
+      try {
+        const raw = readFileSync3(openclawPath, "utf-8");
+        openclawConfig = JSON52.parse(raw);
+      } catch {
+      }
+    }
+    const statePath = join9(opts.configDir, "manager-state.json");
+    if (existsSync3(statePath)) {
+      try {
+        const raw = readFileSync3(statePath, "utf-8");
+        const state = JSON.parse(raw);
+        agentState = state.agents?.find((a) => a.codeName === codeName) ?? null;
+      } catch {
+      }
+    }
+  }
+  const channelRows = [];
+  if (apiChannels && apiChannels.length > 0) {
+    for (const ch of apiChannels) {
+      const def = getChannel(ch.channel_id);
+      channelRows.push({
+        id: ch.channel_id,
+        name: def?.name ?? ch.channel_id,
+        tier: def?.securityTier ?? "unknown",
+        enabled: true,
+        status: ch.status,
+        e2e: def ? String(def.e2eEncrypted) : "\u2014"
+      });
+    }
+  } else {
+    const openclawChannels = Array.isArray(openclawConfig?.channels) ? openclawConfig.channels : [];
+    for (const ch of openclawChannels) {
+      const def = getChannel(ch.id);
+      channelRows.push({
+        id: ch.id,
+        name: def?.name ?? ch.id,
+        tier: def?.securityTier ?? "unknown",
+        enabled: ch.enabled !== false,
+        status: ch.enabled !== false ? "configured" : "disabled",
+        e2e: def ? String(def.e2eEncrypted) : "\u2014"
+      });
+    }
+  }
+  if (json) {
+    const filtered2 = opts.allChannels ? channelRows : channelRows.filter((c) => c.enabled);
+    jsonOutput({
+      ok: true,
+      agent: {
+        code_name: codeName,
+        display_name: apiAgent?.display_name ?? charter?.display_name ?? null,
+        agent_id: apiAgent?.agent_id ?? charter?.agent_id ?? null,
+        environment: apiAgent?.environment ?? charter?.environment ?? null,
+        risk_tier: apiAgent?.risk_tier ?? charter?.risk_tier ?? null,
+        owner: charter?.owner ?? null,
+        logging_mode: charter?.logging_mode ?? null,
+        budget: charter?.budget ?? null,
+        limits: charter?.limits ?? null
+      },
+      versions: {
+        charter: agentState?.charterVersion ?? charter?.version ?? null,
+        tools: agentState?.toolsVersion ?? tools?.version ?? null,
+        last_provision: agentState?.lastProvisionAt ?? null,
+        last_drift_check: agentState?.lastDriftCheckAt ?? null
+      },
+      tools: {
+        enforcement_mode: tools?.enforcement_mode ?? null,
+        global_controls: tools?.global_controls ?? null,
+        count: tools?.tools?.length ?? 0,
+        items: tools?.tools ?? []
+      },
+      channels: filtered2,
+      openclaw: openclawConfig ? { sandbox: openclawConfig.sandbox ?? null, gateway: openclawConfig.gateway ?? null } : null
+    });
+    return;
+  }
+  const displayName = apiAgent?.display_name ?? charter?.display_name ?? codeName;
+  console.log(chalk15.bold(`
+Agent: ${codeName}`) + (displayName !== codeName ? ` (${displayName})` : "") + "\n");
+  if (charter || apiAgent) {
+    const agentId = apiAgent?.agent_id ?? charter?.agent_id;
+    const environment = apiAgent?.environment ?? charter?.environment;
+    const riskTier = apiAgent?.risk_tier ?? charter?.risk_tier;
+    info(`Agent ID:     ${agentId ?? "\u2014"}`);
+    info(`Environment:  ${environment ?? "\u2014"}`);
+    info(`Risk Tier:    ${riskTier ?? "\u2014"}`);
+    info(`Owner:        ${charter?.owner?.name ?? "\u2014"}`);
+    const charterVer = agentState?.charterVersion ?? charter?.version;
+    const toolsVer = agentState?.toolsVersion ?? tools?.version ?? "\u2014";
+    const provTs = agentState?.lastProvisionAt ? formatTimestamp(agentState.lastProvisionAt) : null;
+    if (charterVer) {
+      info(`Charter:      v${charterVer}${provTs ? ` (provisioned ${provTs})` : ""}`);
+    }
+    if (toolsVer !== "\u2014") {
+      info(`Tools:        v${toolsVer}${provTs ? ` (provisioned ${provTs})` : ""}`);
+    }
+    const sandbox = openclawConfig ? openclawConfig.sandbox : null;
+    if (sandbox != null) {
+      info(`Sandbox:      ${sandbox ? "on" : "off"}`);
+    }
+    const b = charter?.budget;
+    if (b) {
+      const budgetStr = `${b.limit.toLocaleString()} ${b.type} / ${b.window} (${b.enforcement ?? "block"})`;
+      info(`Budget:       ${budgetStr}`);
+    }
+  } else {
+    info("No agent metadata available");
+  }
+  const filtered = opts.allChannels ? channelRows : channelRows.filter((c) => c.enabled);
+  console.log(chalk15.bold("\nChannels:"));
+  if (filtered.length === 0) {
+    info("(none enabled)");
+  } else {
+    table(
+      ["Channel", "Name", "Tier", "Status", "E2E"],
+      filtered.map((c) => [
+        c.id,
+        c.name,
+        c.tier,
+        c.status,
+        c.e2e
+      ])
+    );
+  }
+  if (tools) {
+    console.log(chalk15.bold("\nTools:"));
+    if (tools.tools.length === 0) {
+      info("(none configured)");
+    } else {
+      table(
+        ["ID", "Name", "Type", "Access", "Enforcement"],
+        tools.tools.map((t) => [t.id, t.name, t.type, t.access, t.enforcement])
+      );
+    }
+    if (tools.global_controls) {
+      const gc = tools.global_controls;
+      console.log(chalk15.bold("\nGlobal Controls:"));
+      info(`Network:   ${gc.default_network_policy === "deny" ? "deny-by-default" : "allow-by-default"}`);
+      info(`Timeout:   ${gc.default_timeout_ms}ms`);
+      info(`Rate:      ${gc.default_rate_limit_rpm} rpm`);
+      info(`Retries:   ${gc.default_retries}`);
+    }
+  }
+  console.log();
+}
+function formatTimestamp(iso) {
+  const d = new Date(iso);
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}`;
+}
+
+// src/commands/kanban.ts
+import chalk16 from "chalk";
+import ora12 from "ora";
+async function resolveAgentId(codeName) {
+  try {
+    const data = await api.get(`/agents/${codeName}`);
+    return data.agent_id;
+  } catch {
+    return null;
+  }
+}
+function priorityLabel(p) {
+  return p === 1 ? chalk16.red("HIGH") : p === 3 ? chalk16.dim("LOW") : chalk16.yellow("MED");
+}
+function statusLabel(s) {
+  const map = {
+    in_progress: chalk16.blue("In Progress"),
+    today: chalk16.green("Today"),
+    backlog: chalk16.dim("Backlog"),
+    done: chalk16.gray("Done")
+  };
+  return map[s] ?? s;
+}
+async function kanbanListCommand(opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const spinner = ora12({ text: "Fetching kanban board\u2026", isSilent: json });
+  spinner.start();
+  const agentId = await resolveAgentId(opts.agent);
+  if (!agentId) {
+    spinner.fail(`Agent "${opts.agent}" not found.`);
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const data = await api.post("/host/my-kanban", {
+      agent_id: agentId
+    });
+    spinner.stop();
+    if (json) {
+      jsonOutput({ ok: true, items: data.items });
+      return;
+    }
+    if (!data.items.length) {
+      info(`Board for ${opts.agent} is empty.`);
+      return;
+    }
+    const rows = data.items.map((item) => [
+      priorityLabel(item.priority),
+      statusLabel(item.status),
+      item.title.length > 50 ? item.title.slice(0, 47) + "\u2026" : item.title,
+      item.estimated_minutes ? `~${item.estimated_minutes}min` : "",
+      item.id.slice(0, 8)
+    ]);
+    console.log(chalk16.bold(`
+Kanban: ${opts.agent}
+`));
+    table(["Pri", "Status", "Title", "Est", "ID"], rows);
+  } catch (err) {
+    spinner.fail("Failed to fetch board.");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function kanbanAddCommand(title, opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const agentId = await resolveAgentId(opts.agent);
+  if (!agentId) {
+    error(`Agent "${opts.agent}" not found.`);
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const data = await api.post("/host/kanban", {
+      agent_id: agentId,
+      add: [
+        {
+          title,
+          description: opts.description,
+          priority: opts.priority ? Number(opts.priority) : 2,
+          status: opts.status ?? "today",
+          estimated_minutes: opts.estimate ? Number(opts.estimate) : void 0,
+          deliverable: opts.deliverable,
+          source: "manual"
+        }
+      ]
+    });
+    if (json) {
+      jsonOutput({ ok: true, added: data.added });
+    } else {
+      success(`Added "${title}" to ${opts.agent}'s board.`);
+    }
+  } catch (err) {
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function kanbanMoveCommand(titleOrId, status, opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const validStatuses = ["backlog", "today", "in_progress", "done"];
+  if (!validStatuses.includes(status)) {
+    error(`Invalid status "${status}". Must be one of: ${validStatuses.join(", ")}`);
+    process.exitCode = 1;
+    return;
+  }
+  const agentId = await resolveAgentId(opts.agent);
+  if (!agentId) {
+    error(`Agent "${opts.agent}" not found.`);
+    process.exitCode = 1;
+    return;
+  }
+  const isUuid = /^[0-9a-f]{8}-/.test(titleOrId);
+  const update = {
+    status,
+    notes: opts.notes
+  };
+  if (isUuid) {
+    update.id = titleOrId;
+  } else {
+    update.title = titleOrId;
+  }
+  try {
+    const data = await api.post("/host/kanban", {
+      agent_id: agentId,
+      update: [update]
+    });
+    if (json) {
+      jsonOutput({ ok: true, updated: data.updated });
+    } else if (data.updated > 0) {
+      success(`Moved "${titleOrId}" \u2192 ${status}.`);
+    } else {
+      error(`Item "${titleOrId}" not found.`);
+      process.exitCode = 1;
+    }
+  } catch (err) {
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function kanbanUpdateCommand(titleOrId, opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const agentId = await resolveAgentId(opts.agent);
+  if (!agentId) {
+    error(`Agent "${opts.agent}" not found.`);
+    process.exitCode = 1;
+    return;
+  }
+  let board;
+  try {
+    board = await api.post("/host/my-kanban", {
+      agent_id: agentId
+    });
+  } catch (err) {
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const isUuid = /^[0-9a-f]{8}-/.test(titleOrId);
+  const match = board.items.find(
+    (i) => isUuid && i.id === titleOrId || i.title === titleOrId
+  );
+  if (!match) {
+    if (json) {
+      jsonOutput({ ok: false, error: `Item "${titleOrId}" not found.` });
+    } else {
+      error(`Item "${titleOrId}" not found.`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const data = await api.post("/host/kanban", {
+      agent_id: agentId,
+      update: [
+        {
+          id: match.id,
+          status: match.status,
+          notes: opts.notes,
+          result: opts.result
+        }
+      ]
+    });
+    if (json) {
+      jsonOutput({ ok: true, updated: data.updated });
+    } else {
+      success(`Updated "${match.title}".`);
+    }
+  } catch (err) {
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+async function kanbanDoneCommand(titleOrId, opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const agentId = await resolveAgentId(opts.agent);
+  if (!agentId) {
+    error(`Agent "${opts.agent}" not found.`);
+    process.exitCode = 1;
+    return;
+  }
+  const isUuid = /^[0-9a-f]{8}-/.test(titleOrId);
+  const update = {
+    status: "done",
+    result: opts.result,
+    notes: opts.notes
+  };
+  if (isUuid) {
+    update.id = titleOrId;
+  } else {
+    update.title = titleOrId;
+  }
+  try {
+    const data = await api.post("/host/kanban", {
+      agent_id: agentId,
+      update: [update]
+    });
+    if (json) {
+      jsonOutput({ ok: true, updated: data.updated });
+    } else if (data.updated > 0) {
+      success(`Marked "${titleOrId}" as done.`);
+    } else {
+      error(`Item "${titleOrId}" not found.`);
+      process.exitCode = 1;
+    }
+  } catch (err) {
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+  }
+}
+
+// ../../packages/core/dist/acp/agent-registry.js
+var ACP_AGENT_REGISTRY = [
+  {
+    name: "claude",
+    label: "Claude Code",
+    adapter_package: "claude-agent-acp",
+    command: "npx",
+    args: ["-y", "claude-agent-acp"],
+    type: "npx-wrapper"
+  },
+  {
+    name: "openclaw",
+    label: "OpenClaw",
+    command: "openclaw",
+    args: ["acp"],
+    type: "native"
+  },
+  {
+    name: "codex",
+    label: "Codex",
+    adapter_package: "codex-acp",
+    command: "npx",
+    args: ["-y", "codex-acp"],
+    type: "npx-wrapper"
+  }
+];
+var agentMap = new Map(ACP_AGENT_REGISTRY.map((a) => [a.name, a]));
+function getAcpAgent(name) {
+  return agentMap.get(name);
+}
+
+// ../../packages/core/dist/acp/client.js
+import { spawn } from "child_process";
+function resolveAgentCommand(agentName) {
+  const adapter = getAcpAgent(agentName);
+  if (adapter) {
+    return {
+      command: "acpx",
+      args: [adapter.name]
+    };
+  }
+  return {
+    command: "acpx",
+    args: ["--agent", agentName]
+  };
+}
+async function runAcpx(args, options = {}) {
+  return new Promise((resolve2) => {
+    const child = spawn("acpx", args, {
+      cwd: options.cwd,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...process.env }
+    });
+    let stdout = "";
+    let stderr = "";
+    const events = [];
+    child.stdout?.on("data", (data) => {
+      const chunk = data.toString();
+      stdout += chunk;
+      for (const line of chunk.split("\n").filter(Boolean)) {
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed.eventVersion === 1) {
+            events.push(parsed);
+          }
+        } catch {
+        }
+      }
+    });
+    child.stderr?.on("data", (data) => {
+      stderr += data.toString();
+    });
+    const timer = options.timeout ? setTimeout(() => child.kill("SIGTERM"), options.timeout * 1e3) : void 0;
+    child.on("close", (code) => {
+      if (timer)
+        clearTimeout(timer);
+      resolve2({ exitCode: code ?? 1, stdout, stderr, events });
+    });
+  });
+}
+async function acpSpawnSession(opts) {
+  const { command: _cmd, args: agentArgs } = resolveAgentCommand(opts.agent);
+  const args = [...agentArgs, "sessions", "ensure"];
+  if (opts.sessionName)
+    args.push("-s", opts.sessionName);
+  if (opts.approveAll)
+    args.unshift("--approve-all");
+  if (opts.ttl !== void 0)
+    args.unshift("--ttl", String(opts.ttl));
+  args.unshift("--format", "json");
+  return runAcpx(args, { cwd: opts.cwd });
+}
+async function acpPrompt(opts) {
+  const { command: _cmd, args: agentArgs } = resolveAgentCommand(opts.agent);
+  const args = [...agentArgs, "prompt", opts.prompt];
+  if (opts.sessionName)
+    args.push("-s", opts.sessionName);
+  if (opts.noWait)
+    args.push("--no-wait");
+  if (opts.format)
+    args.unshift("--format", opts.format);
+  if (opts.timeout)
+    args.unshift("--timeout", String(opts.timeout));
+  return runAcpx(args, { cwd: opts.cwd, timeout: opts.timeout });
+}
+async function acpExec(agent2, prompt, options = {}) {
+  const { command: _cmd, args: agentArgs } = resolveAgentCommand(agent2);
+  const args = [...agentArgs, "exec", prompt];
+  if (options.format)
+    args.unshift("--format", options.format);
+  if (options.timeout)
+    args.unshift("--timeout", String(options.timeout));
+  return runAcpx(args, { cwd: options.cwd, timeout: options.timeout });
+}
+async function acpListSessions(agent2, options = {}) {
+  const { command: _cmd, args: agentArgs } = resolveAgentCommand(agent2);
+  const args = [...agentArgs, "sessions", "list", "--format", "json"];
+  return runAcpx(args, { cwd: options.cwd });
+}
+async function acpCancel(agent2, options = {}) {
+  const { command: _cmd, args: agentArgs } = resolveAgentCommand(agent2);
+  const args = [...agentArgs, "cancel"];
+  if (options.sessionName)
+    args.push("-s", options.sessionName);
+  return runAcpx(args, { cwd: options.cwd });
+}
+async function acpCloseSession(agent2, options = {}) {
+  const { command: _cmd, args: agentArgs } = resolveAgentCommand(agent2);
+  const args = [...agentArgs, "sessions", "close"];
+  if (options.sessionName)
+    args.push(options.sessionName);
+  return runAcpx(args, { cwd: options.cwd });
+}
+
+// src/commands/acpx.ts
+async function acpxSpawnCommand(agent2, _opts, cmd) {
+  const parentOpts = cmd.parent.opts();
+  const cwd = parentOpts.cwd ?? process.cwd();
+  const sessionName = parentOpts.name;
+  const approveAll = Boolean(parentOpts.approveAll);
+  const ttl = parentOpts.ttl !== void 0 ? Number(parentOpts.ttl) : void 0;
+  info(`Spawning ACP session for "${agent2}"...`);
+  const result = await acpSpawnSession({
+    agent: agent2,
+    cwd,
+    sessionName,
+    approveAll,
+    ttl
+  });
+  if (result.exitCode !== 0) {
+    error(`Failed to spawn session: ${result.stderr || "unknown error"}`);
+    process.exitCode = 1;
+    return;
+  }
+  if (isJsonMode()) {
+    process.stdout.write(result.stdout);
+  } else {
+    success(`ACP session spawned for "${agent2}"`);
+    if (sessionName) info(`Session name: ${sessionName}`);
+    info(`Working directory: ${cwd}`);
+  }
+}
+async function acpxPromptCommand(agent2, prompt, _opts, cmd) {
+  const parentOpts = cmd.parent.opts();
+  const cwd = parentOpts.cwd ?? process.cwd();
+  const sessionName = parentOpts.name;
+  const format = parentOpts.format ?? "text";
+  const noWait = Boolean(parentOpts.noWait);
+  const timeout = parentOpts.timeout !== void 0 ? Number(parentOpts.timeout) : void 0;
+  if (!isJsonMode()) info(`Sending prompt to "${agent2}"...`);
+  const result = await acpPrompt({
+    agent: agent2,
+    prompt,
+    cwd,
+    sessionName,
+    format,
+    noWait,
+    timeout
+  });
+  process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  process.exitCode = result.exitCode;
+}
+async function acpxExecCommand(agent2, prompt, _opts, cmd) {
+  const parentOpts = cmd.parent.opts();
+  const cwd = parentOpts.cwd ?? process.cwd();
+  const format = parentOpts.format ?? "text";
+  const timeout = parentOpts.timeout !== void 0 ? Number(parentOpts.timeout) : void 0;
+  if (!isJsonMode()) info(`Running one-shot exec with "${agent2}"...`);
+  const result = await acpExec(agent2, prompt, { cwd, format, timeout });
+  process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  process.exitCode = result.exitCode;
+}
+async function acpxListSessionsCommand(agent2, _opts, cmd) {
+  const parentOpts = cmd.parent.opts();
+  const cwd = parentOpts.cwd ?? process.cwd();
+  const result = await acpListSessions(agent2, { cwd });
+  if (isJsonMode()) {
+    process.stdout.write(result.stdout);
+  } else {
+    if (result.exitCode !== 0) {
+      error(`Failed to list sessions: ${result.stderr || "unknown error"}`);
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      const sessions = JSON.parse(result.stdout);
+      if (Array.isArray(sessions) && sessions.length > 0) {
+        info(`Active sessions for "${agent2}":`);
+        process.stdout.write(result.stdout);
+      } else {
+        info(`No active sessions for "${agent2}".`);
+      }
+    } catch {
+      process.stdout.write(result.stdout);
+    }
+  }
+}
+async function acpxCancelCommand(agent2, _opts, cmd) {
+  const parentOpts = cmd.parent.opts();
+  const cwd = parentOpts.cwd ?? process.cwd();
+  const sessionName = parentOpts.name;
+  info(`Sending cancel to "${agent2}"...`);
+  const result = await acpCancel(agent2, { cwd, sessionName });
+  if (result.exitCode !== 0) {
+    error(`Cancel failed: ${result.stderr || "unknown error"}`);
+    process.exitCode = 1;
+    return;
+  }
+  success("Cancel sent (cooperative).");
+}
+async function acpxCloseCommand(agent2, _opts, cmd) {
+  const parentOpts = cmd.parent.opts();
+  const cwd = parentOpts.cwd ?? process.cwd();
+  const sessionName = parentOpts.name;
+  info(`Closing ACP session for "${agent2}"...`);
+  const result = await acpCloseSession(agent2, { cwd, sessionName });
+  if (result.exitCode !== 0) {
+    error(`Close failed: ${result.stderr || "unknown error"}`);
+    process.exitCode = 1;
+    return;
+  }
+  success("Session closed (soft-close \u2014 history retained).");
+}
+
+// src/commands/update.ts
+import { execSync } from "child_process";
+import chalk17 from "chalk";
+import ora13 from "ora";
+var cliVersion = true ? "0.6.6" : "dev";
+async function fetchLatestVersion() {
+  const host2 = AGT_HOST;
+  if (!host2) return null;
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5e3);
+    timeout.unref();
+    const res = await fetch(`${host2}/cli/version`, {
+      signal: controller.signal
+    });
+    clearTimeout(timeout);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+function isNewerVersion(local, remote) {
+  if (local === "dev") return false;
+  const parse = (v) => v.replace(/^v/, "").split(".").map(Number);
+  const lParts = parse(local);
+  const rParts = parse(remote);
+  const lMaj = lParts[0] ?? 0, lMin = lParts[1] ?? 0, lPat = lParts[2] ?? 0;
+  const rMaj = rParts[0] ?? 0, rMin = rParts[1] ?? 0, rPat = rParts[2] ?? 0;
+  if (rMaj !== lMaj) return rMaj > lMaj;
+  if (rMin !== lMin) return rMin > lMin;
+  return rPat > lPat;
+}
+function performUpdate(version) {
+  execSync(`npm install -g @integrity-labs/agt-cli@${version} --registry=https://npm.pkg.github.com`, {
+    stdio: "inherit"
+  });
+}
+async function updateCommand() {
+  const json = isJsonMode();
+  const spinner = ora13({ text: "Checking for updates\u2026", isSilent: json });
+  spinner.start();
+  const versionInfo = await fetchLatestVersion();
+  if (!versionInfo) {
+    spinner.stop();
+    if (json) {
+      jsonOutput({ ok: false, error: "Could not reach API to check for updates" });
+    } else {
+      warn("Could not reach the API to check for updates. Check AGT_HOST is set and the API is reachable.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const updateAvailable = isNewerVersion(cliVersion, versionInfo.latest);
+  if (!updateAvailable) {
+    spinner.stop();
+    if (json) {
+      jsonOutput({ ok: true, current: cliVersion, latest: versionInfo.latest, update_available: false });
+    } else {
+      success(`You're on the latest version (${chalk17.bold(cliVersion)})`);
+    }
+    return;
+  }
+  spinner.stop();
+  if (!json) {
+    info(`Update available: ${chalk17.dim(cliVersion)} \u2192 ${chalk17.bold.green(versionInfo.latest)}`);
+    if (versionInfo.changelog_url) {
+      info(`Changelog: ${versionInfo.changelog_url}`);
+    }
+  }
+  const updateSpinner = ora13({ text: "Installing update\u2026", isSilent: json });
+  updateSpinner.start();
+  try {
+    performUpdate(versionInfo.latest);
+    updateSpinner.stop();
+    if (json) {
+      jsonOutput({
+        ok: true,
+        current: cliVersion,
+        latest: versionInfo.latest,
+        update_available: true,
+        updated: true
+      });
+    } else {
+      success(`Updated to ${chalk17.bold(versionInfo.latest)}`);
+    }
+  } catch (err) {
+    updateSpinner.fail("Update failed");
+    if (json) {
+      jsonOutput({
+        ok: false,
+        current: cliVersion,
+        latest: versionInfo.latest,
+        update_available: true,
+        updated: false,
+        error: err.message
+      });
+    } else {
+      error(`Failed to install update: ${err.message}`);
+      info(`You can manually update with: npm install -g @integrity-labs/agt-cli@${versionInfo.latest} --registry=https://npm.pkg.github.com`);
+    }
+    process.exitCode = 1;
+  }
+}
+async function checkForUpdateOnStartup() {
+  try {
+    const versionInfo = await fetchLatestVersion();
+    if (!versionInfo) return;
+    if (isNewerVersion(cliVersion, versionInfo.latest)) {
+      console.error(
+        chalk17.yellow(`
+  Update available: ${cliVersion} \u2192 ${versionInfo.latest}. Run ${chalk17.bold("agt update")} to install.
+`)
+      );
+    }
+  } catch {
+  }
+}
+
+// src/bin/agt.ts
+var cliVersion2 = true ? "0.6.6" : "dev";
+var program = new Command();
+program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
+program.hook("preAction", (thisCommand) => {
+  const root = thisCommand.optsWithGlobals();
+  if (root.json) {
+    setJsonMode(true);
+  }
+});
+program.command("whoami").description("Show the authenticated host, team, and user from AGT_API_KEY").action(whoamiCommand);
+var team = program.command("team").description("Manage teams");
+team.command("list").description("List teams you belong to").action(teamListCommand);
+team.command("create <name>").description("Create a new team and set it as active").action(teamCreateCommand);
+team.command("switch <slug>").description("Switch the active team").action(teamSwitchCommand);
+program.command("init").description("Create a new agent (interactive wizard, or non-interactive with --name)").option("--name <display-name>", "Agent display name (triggers non-interactive mode)").option("--code-name <code-name>", "Agent code name (kebab-case, derived from --name if omitted)").option("--description <text>", "Short agent description").option("--env <environment>", "Environment: dev | stage | prod", "dev").option("--risk-tier <tier>", "Risk tier: Low | Medium | High", "Low").option("--budget-type <type>", "Budget type: tokens | dollars | both", "tokens").option("--budget-tokens <number>", "Token budget limit", "10000").option("--budget-dollars <number>", "Dollar budget limit", "10").option("--budget-window <window>", "Budget window: daily | weekly | monthly", "daily").option("--budget-enforcement <mode>", "Budget enforcement: block | throttle | alert | degrade", "block").option("--channels <list>", "Comma-separated channel IDs").option("--logging <mode>", "Logging mode: redacted | hash-only | full-local", "redacted").action(initCommand);
+program.command("lint").argument("[path]", "Path to agent directory (default: all agents in .augmented/)").description("Lint CHARTER.md and TOOLS.md files").action(lintCommand);
+var channels = program.command("channels").description("Manage and inspect channel configuration");
+channels.command("list").description("Print the full channel registry with security metadata").action(channelsListCommand);
+channels.command("check <agent>").description("Resolve the effective channel list for an agent").action(channelsCheckCommand);
+var slack = channels.command("slack").description("Manage Slack channel configuration");
+slack.command("setup <agent-code-name>").description("Configure Slack bot scopes, generate manifest, and store credentials").option("--preset <preset>", "Scope preset: minimal | standard | full").option("--scopes <scopes>", "Comma-separated list of Slack bot scopes").option("--skip-create", "Skip Slack CLI app creation step").option("--bot-token <token>", "Slack bot token (xoxb-\u2026)").option("--signing-secret <secret>", "Slack signing secret").option("--config-token <token>", "Slack app configuration token (xoxe-\u2026) for API-based app creation").action(channelSlackSetupCommand);
+slack.command("status <agent-code-name>").description("Show current Slack configuration for an agent").action(channelSlackStatusCommand);
+slack.command("remove <agent-code-name>").description("Remove Slack bot configuration for an agent").action(channelSlackRemoveCommand);
+var beam = channels.command("beam").description("Manage Beam Protocol channel configuration");
+beam.command("setup <agent-code-name>").description("Generate Beam identity, register in directory, and configure channel").option("--directory-url <url>", "Beam directory URL (default: hosted)").option("--skip-register", "Skip directory registration").option("--auto-publish", "Auto-publish capabilities from TOOLS.md", true).action(channelBeamSetupCommand);
+beam.command("status <agent-code-name>").description("Show Beam configuration and directory status").action(channelBeamStatusCommand);
+beam.command("remove <agent-code-name>").description("Remove Beam identity for an agent").action(channelBeamRemoveCommand);
+program.command("provision <code-name>").description("Provision an agent: build OpenClaw config, generate files, store snapshot").option("--target <target>", "Deployment target", "local_docker").option("--output <dir>", "Output directory for generated files").option("--dry-run", "Print what would be generated without writing files").action(provisionCommand);
+program.command("deploy").description("Generate deployment config from a template").option("--template <id>", "Template ID (triggers non-interactive mode)").option("--port <number>", "Base port for gateway", "9000").action(deployCommand);
+var drift = program.command("drift").description("Detect configuration drift from provisioned state");
+drift.command("check <code-name>").description("Compare live state against provisioned snapshot").option("--json", "Output as JSON").option("--audit", "Run openclaw security audit").option("--config <path>", "Path to openclaw.json").action(driftCheckCommand);
+drift.command("watch <code-name>").description("Continuously monitor for drift").option("--interval <seconds>", "Check interval in seconds", "60").option("--webhook <url>", "POST webhook URL on new findings").option("--json", "Output as JSON").option("--config <path>", "Path to openclaw.json").action(driftWatchCommand);
+var host = program.command("host").description("Manage hosts (OpenClaw servers/gateways) and their API keys");
+host.command("list").description("List hosts in the active team").action(hostListCommand);
+host.command("assign <host-name> <agent-code-names...>").description("Assign agents to a host").option("--force", "Reassign agents already assigned to another host").action(hostAssignCommand);
+host.command("unassign <host-name> <agent-code-names...>").description("Unassign agents from a host").action(hostUnassignCommand);
+host.command("agents [host-name]").description("List agents assigned to a host (omit name to auto-resolve from AGT_API_KEY)").action(hostAgentsCommand);
+host.command("rotate-key <host-name>").description("Rotate the API key for a host (revokes the old key)").action(hostRotateKeyCommand);
+host.command("decommission <host-name>").description("Decommission a host (revokes key, marks inactive)").action(hostDecommissionCommand);
+var manager = program.command("manager").description("Host config sync daemon \u2014 keeps local agent files in sync with API");
+manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join10(homedir2(), ".augmented")).action(managerStartCommand);
+manager.command("stop").description("Stop the running manager daemon").action(managerStopCommand);
+manager.command("status").description("Show the current manager daemon status and discovered agents").action(managerStatusCommand);
+var agent = program.command("agent").description("Inspect and manage agents");
+agent.command("show <code-name>").description("Display an agent's provisioned OpenClaw configuration").option("--config-dir <dir>", "Config directory", join10(homedir2(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
+var kanban = program.command("kanban").description("Manage agent kanban boards");
+kanban.command("list").description("List kanban board items for an agent").requiredOption("--agent <code-name>", "Agent code name").action(kanbanListCommand);
+kanban.command("add <title>").description("Add a new item to an agent kanban board").requiredOption("--agent <code-name>", "Agent code name").option("--priority <1|2|3>", "Priority: 1=high, 2=medium, 3=low", "2").option("--status <status>", "Initial status: backlog | today | in_progress", "today").option("--description <text>", "Item description").option("--estimate <minutes>", "Estimated time in minutes").option("--deliverable <text>", "Expected output/deliverable").action(kanbanAddCommand);
+kanban.command("move <title-or-id> <status>").description("Move a kanban item to a different status").requiredOption("--agent <code-name>", "Agent code name").option("--notes <text>", "Progress notes").action(kanbanMoveCommand);
+kanban.command("update <title-or-id>").description("Update notes or result on a kanban item").requiredOption("--agent <code-name>", "Agent code name").option("--notes <text>", "Progress notes").option("--result <text>", "Result/output produced").action(kanbanUpdateCommand);
+kanban.command("done <title-or-id>").description("Mark a kanban item as done").requiredOption("--agent <code-name>", "Agent code name").option("--result <text>", "What was produced/delivered").option("--notes <text>", "Completion notes").action(kanbanDoneCommand);
+var acpx = program.command("acpx").description("Agent Client Protocol (ACP) session management via acpx").option("--cwd <path>", "Working directory for session routing").option("-s, --name <name>", "Named session for parallel workstreams").option("--approve-all", "Auto-approve all agent tool permissions").option("--format <type>", "Output format: text | json | json-strict | quiet", "text").option("--ttl <seconds>", "Queue owner idle TTL in seconds (0 = indefinite)").option("--timeout <seconds>", "Prompt execution timeout").option("--no-wait", "Submit prompt without waiting for completion");
+acpx.command("spawn <agent>").description("Spawn or ensure an ACP session for an agent (claude, codex, openclaw)").action(acpxSpawnCommand);
+acpx.command("prompt <agent> <prompt>").description("Send a prompt to an ACP session").action(acpxPromptCommand);
+acpx.command("exec <agent> <prompt>").description("One-shot execution (no session reuse)").action(acpxExecCommand);
+acpx.command("list-sessions <agent>").description("List active ACP sessions for an agent").action(acpxListSessionsCommand);
+acpx.command("cancel <agent>").description("Send cooperative cancel to the running ACP session").action(acpxCancelCommand);
+acpx.command("close <agent>").description("Soft-close an ACP session (preserves history)").action(acpxCloseCommand);
+program.command("update").description("Check for and install CLI updates").action(updateCommand);
+var skipUpdateCheck = process.argv.includes("--skip-update-check") || process.argv.includes("--json") || process.argv[2] === "update";
+if (!skipUpdateCheck) {
+  checkForUpdateOnStartup().catch(() => {
+  });
+}
+program.parse();
+//# sourceMappingURL=agt.js.map