@saadnvd1/agent-os 0.3.664 → 0.3.672

package/lib/chat/mcp-auth.ts

@@ -0,0 +1,193 @@
+/**
+ * Signing in to an MCP server from the browser. The agent starts the
+ * sign-in and gives a link; the provider then sends the browser back to
+ * AgentOS (/api/mcp-auth/callback), which hands that address to the agent.
+ * What ties the return to the attempt is the OAuth `state`, kept in SQLite
+ * (the start and callback routes are separate bundles, so memory isn't
+ * shared), used once, and dropped after PENDING_MS. The agent holds the
+ * tokens; nothing here stores or logs the address it was given.
+ */
+
+import { db } from "../db";
+import { getItem } from "./store";
+import { mcpAuthWorker } from "./runner";
+import type { McpSignInStart } from "./events";
+
+export const PENDING_MS = 15 * 60 * 1000;
+export const CALLBACK_PATH = "/api/mcp-auth/callback";
+
+interface Pending {
+  sessionId: string;
+  itemId: string;
+  server: string;
+  origin: string | null;
+  at: number;
+}
+
+interface PendingRow {
+  session_id: string;
+  item_id: string;
+  server: string;
+  origin: string | null;
+  at: number;
+}
+
+export function resetMcpSignIns(): void {
+  db.prepare(`DELETE FROM mcp_sign_ins`).run();
+}
+
+function sweep(now = Date.now()): void {
+  db.prepare(`DELETE FROM mcp_sign_ins WHERE at < ?`).run(now - PENDING_MS);
+}
+
+function savePending(state: string, p: Pending): void {
+  db.prepare(
+    `DELETE FROM mcp_sign_ins WHERE session_id = ? AND server = ?`
+  ).run(p.sessionId, p.server);
+  db.prepare(
+    `INSERT OR REPLACE INTO mcp_sign_ins (state, session_id, item_id, server, origin, at)
+     VALUES (?, ?, ?, ?, ?, ?)`
+  ).run(state, p.sessionId, p.itemId, p.server, p.origin, p.at);
+}
+
+function peekPending(state: string): Pending | undefined {
+  const r = db
+    .prepare(`SELECT * FROM mcp_sign_ins WHERE state = ?`)
+    .get(state) as PendingRow | undefined;
+  return (
+    r && {
+      sessionId: r.session_id,
+      itemId: r.item_id,
+      server: r.server,
+      origin: r.origin,
+      at: r.at,
+    }
+  );
+}
+
+// Single use: only the caller whose delete changed a row may go on.
+function takePending(state: string): boolean {
+  return (
+    db.prepare(`DELETE FROM mcp_sign_ins WHERE state = ?`).run(state).changes >
+    0
+  );
+}
+
+// `http(s)://host[:port]`, nothing else: the browser's own address for
+// AgentOS, so the provider returns to wherever the user is.
+export function cleanOrigin(value: string | null | undefined): string | null {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+    return url.origin === value ? url.origin : null;
+  } catch {
+    return null;
+  }
+}
+
+function serverOf(sessionId: string, itemId: string, server: string) {
+  const item = getItem(sessionId, itemId);
+  if (item?.kind !== "mcp") throw new Error("That list is gone");
+  const view = item.servers.find((s) => s.name === server);
+  if (!view) throw new Error(`${server} isn't in that list`);
+  return view;
+}
+
+export async function startMcpSignIn(
+  sessionId: string,
+  input: { itemId: string; server: string; origin?: string | null }
+): Promise<McpSignInStart> {
+  if (!serverOf(sessionId, input.itemId, input.server).signIn)
+    throw new Error("AgentOS can't sign in to this server");
+  const worker = mcpAuthWorker(sessionId);
+  const origin = cleanOrigin(input.origin);
+  const { start, error } = await worker.mcpAuth(
+    {
+      action: "start",
+      server: input.server,
+      itemId: input.itemId,
+      redirectUri: origin ? `${origin}${CALLBACK_PATH}` : undefined,
+    },
+    30_000
+  );
+  if (error || !start) throw new Error(error ?? "Sign-in didn't start");
+  sweep();
+  const { state, ...result } = start;
+  if (state)
+    savePending(state, {
+      sessionId,
+      itemId: input.itemId,
+      server: input.server,
+      origin,
+      at: Date.now(),
+    });
+  return result;
+}
+
+// The provider returned the browser (or the user pasted the address it
+// ended on). `expect` pins a pasted address to the row it was typed in.
+export async function finishMcpSignIn(
+  callbackUrl: string,
+  expect?: { sessionId: string; server: string }
+): Promise<{ server: string }> {
+  sweep();
+  let state: string | null = null;
+  try {
+    state = new URL(callbackUrl).searchParams.get("state");
+  } catch {
+    throw new Error("That isn't a web address");
+  }
+  const p = state ? peekPending(state) : undefined;
+  if (!state || !p)
+    throw new Error(
+      "That sign-in expired or was already used. Press Sign in again."
+    );
+  if (
+    expect &&
+    (expect.sessionId !== p.sessionId || expect.server !== p.server)
+  )
+    throw new Error("That address belongs to a different sign-in");
+  if (!takePending(state))
+    throw new Error(
+      "That sign-in expired or was already used. Press Sign in again."
+    );
+  const { error } = await mcpAuthWorker(p.sessionId).mcpAuth({
+    action: "submit",
+    server: p.server,
+    itemId: p.itemId,
+    url: callbackUrl,
+  });
+  if (error) throw new Error(error);
+  return { server: p.server };
+}
+
+// The provider's redirect reached our callback route. Rebuild the address
+// from the origin the sign-in started with, not from the request (behind the
+// custom server Next may derive it from Host), so it matches the
+// redirect_uri the provider was given exactly.
+export async function finishMcpSignInFromRedirect(
+  search: string
+): Promise<{ server: string }> {
+  sweep();
+  const state = new URLSearchParams(search).get("state");
+  const origin = state ? peekPending(state)?.origin : null;
+  if (!origin)
+    throw new Error(
+      "That sign-in expired or was already used. Press Sign in again."
+    );
+  return finishMcpSignIn(`${origin}${CALLBACK_PATH}${search}`);
+}
+
+// "Check again": reconnect and refresh the list.
+export async function reconnectMcpServer(
+  sessionId: string,
+  input: { itemId: string; server: string }
+): Promise<void> {
+  serverOf(sessionId, input.itemId, input.server);
+  const { error } = await mcpAuthWorker(sessionId).mcpAuth(
+    { action: "reconnect", ...input },
+    30_000
+  );
+  if (error) throw new Error(error);
+}

package/lib/chat/registry.ts

@@ -38,6 +38,8 @@ export interface Live {
   canFresh?: boolean;
   // Whether it takes "background_task" (an older worker drops it).
   canBackground?: boolean;
+  // Whether it takes "mcp_auth" (sign in to an MCP server).
+  canMcpAuth?: boolean;
   // From an older build and idle: retired once its guess at the next
   // message is in, or this fires.
   retiring?: NodeJS.Timeout;

package/lib/chat/runner.ts

@@ -87,6 +87,7 @@ import {
 } from "./worker/client";
 import { buildId, isStaleWorker } from "../build";
 import type { WorkerEvent } from "./worker/protocol";
+import type { WorkerClient } from "./worker/client";
 import { DEMO_REFUSAL, demoMode } from "../security/demo";
 import { chatHold, chatRefusal } from "./hold";
 import { getHost } from "../hosts";
@@ -363,6 +364,7 @@ async function ensureLive(sessionId: string, spawn = true): Promise<Live> {
       canQueue: !!hello.caps?.includes("queue"),
       canFresh: !!hello.caps?.includes("fresh"),
       canBackground: !!hello.caps?.includes("background"),
+      canMcpAuth: !!hello.caps?.includes("mcp_auth"),
     };
     // From an older build and busy, or running background work: it goes at
     // its next turn boundary, by itself if it can. Messages meanwhile wait
@@ -932,6 +934,22 @@ export async function backgroundChatTask(
   });
 }
 
+// The session's running worker, when it can sign in to MCP servers; why not
+// otherwise (a chat on another machine, an idle one, one from an older build).
+export function mcpAuthWorker(sessionId: string): WorkerClient {
+  checkChattable(getSession(sessionId));
+  const live = registry.live.get(sessionId);
+  if (!live || live.retiring)
+    throw new Error(
+      "This chat's agent isn't running. Send /mcp again to wake it, then sign in."
+    );
+  if (!live.canMcpAuth)
+    throw new Error(
+      "This chat's agent is from an older AgentOS build. Send it a message or reopen the chat, then try again."
+    );
+  return live.worker;
+}
+
 export function chatTaskOutput(
   sessionId: string,
   taskId: string

package/lib/chat/worker/client.ts

@@ -12,7 +12,8 @@ import path from "path";
 import { promisify } from "util";
 import { endTmuxSession } from "../../tmux/end";
 import type { UndoResult } from "../driver";
-import type { FileSuggestion } from "../events";
+import type { FileSuggestion, McpSignInStart } from "../events";
+import type { McpAuthCommand } from "./mcp-auth";
 import {
   envPath,
   lineReader,
@@ -47,6 +48,11 @@ export class WorkerClient {
     (r: { ok?: boolean; error?: string }) => void
   >();
 
+  private mcpAuths = new Map<
+    string,
+    (r: { start?: McpSignInStart & { state?: string }; error?: string }) => void
+  >();
+
   private constructor(
     private socket: net.Socket,
     private handlers: WorkerHandlers
@@ -115,6 +121,11 @@ export class WorkerClient {
       this.backgrounds.delete(e.reqId);
       return;
     }
+    if (e.type === "mcp_auth_result") {
+      this.mcpAuths.get(e.reqId)?.({ start: e.start, error: e.error });
+      this.mcpAuths.delete(e.reqId);
+      return;
+    }
     if (e.type === "files_result") {
       this.files.get(e.reqId)?.(e.files ?? null);
       this.files.delete(e.reqId);
@@ -155,6 +166,29 @@ export class WorkerClient {
     });
   }
 
+  // Signs in to an MCP server (start, finish or reconnect): what it came back
+  // with, or why not (an error, or no answer in time).
+  mcpAuth(
+    cmd: Omit<McpAuthCommand, "type" | "reqId">,
+    timeoutMs = 60_000
+  ): Promise<{
+    start?: McpSignInStart & { state?: string };
+    error?: string;
+  }> {
+    const reqId = randomUUID();
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        this.mcpAuths.delete(reqId);
+        resolve({ error: "The agent didn't answer in time" });
+      }, timeoutMs);
+      this.mcpAuths.set(reqId, (r) => {
+        clearTimeout(timer);
+        resolve(r);
+      });
+      this.command({ type: "mcp_auth", reqId, ...cmd });
+    });
+  }
+
   // The agent's own matches for an @mention; null when it can't say (an
   // older worker, an error, no answer in time).
   fileSuggestions(

package/lib/chat/worker/host.ts

@@ -25,10 +25,12 @@ import {
   itemsOfKind,
   flushItems,
   moveToEnd,
+  getItem,
   queueItem,
   runningTools,
   settle,
 } from "../store";
+import { handleMcpAuth, stopMcpWatches } from "./mcp-auth";
 import { claimNext, enqueue, listQueue, moveToFront } from "../queued";
 import { isHeld } from "../hold";
 import {
@@ -804,6 +806,12 @@ export class ChatHost {
           });
         }
         return;
+      case "mcp_auth":
+        return handleMcpAuth(cmd, this.conversation, {
+          emit: (e) => this.emit(e),
+          record: (item) => this.record(item),
+          item: (id) => getItem(this.session.id, id),
+        });
       case "undo":
         try {
           const result = await this.conversation.undo(
@@ -1051,6 +1059,7 @@ export class ChatHost {
     this.setCompacting(false);
     flushItems();
     this.onClose();
+    stopMcpWatches(this.conversation.mcpAuth);
     this.conversation.close();
   }
 }

package/lib/chat/worker/main.ts

@@ -76,7 +76,7 @@ async function main(sessionId: string) {
         state: host.state,
         compacting: host.compactingNow,
         streaming: [...host.streaming.values()],
-        caps: ["plan", "queue", "retire", "fresh", "background"],
+        caps: ["plan", "queue", "retire", "fresh", "background", "mcp_auth"],
       } satisfies WorkerEvent)}\n`
     );
     client.on(

package/lib/chat/worker/mcp-auth.ts

@@ -0,0 +1,119 @@
+/**
+ * Signing in to an MCP server from a chat: the worker owns the agent, so it
+ * starts the sign-in, hands over the address the provider returned to, and
+ * reconnects. The /mcp item it came from is rewritten in place (same id) so
+ * its row turns connected. A sign-in the browser can't finish by itself (it
+ * happens on another machine, or on claude.ai) is watched until the server
+ * stops needing it.
+ */
+
+import type { ChatConversation, McpAuth } from "../driver";
+import type { ChatItem, McpSignInStart } from "../events";
+import { cleanMcpError } from "../drivers/claude";
+import type { WorkerCommand, WorkerEvent } from "./protocol";
+
+export type McpAuthCommand = Extract<WorkerCommand, { type: "mcp_auth" }>;
+
+export const WATCH_EVERY_MS = 2000;
+export const WATCH_FOR_MS = 10 * 60 * 1000;
+
+interface Host {
+  emit(e: WorkerEvent): void;
+  record(item: ChatItem): void;
+  item(id: string): ChatItem | undefined;
+}
+
+const watches = new WeakMap<object, Map<string, NodeJS.Timeout>>();
+
+function stopWatch(owner: object, server: string): void {
+  const timer = watches.get(owner)?.get(server);
+  if (timer) clearInterval(timer);
+  watches.get(owner)?.delete(server);
+}
+
+// The conversation is closing: no watch outlives it.
+export function stopMcpWatches(auth: object | undefined): void {
+  if (!auth) return;
+  for (const timer of watches.get(auth)?.values() ?? []) clearInterval(timer);
+  watches.delete(auth);
+}
+
+// Rewrites the /mcp item with the servers as they are now.
+async function refresh(auth: McpAuth, host: Host, itemId: string) {
+  const item = host.item(itemId);
+  if (item?.kind !== "mcp") return;
+  host.record({ ...item, servers: await auth.servers() });
+}
+
+function watch(auth: McpAuth, host: Host, itemId: string, server: string) {
+  const owner = auth;
+  stopWatch(owner, server);
+  const timers = watches.get(owner) ?? new Map();
+  watches.set(owner, timers);
+  const started = Date.now();
+  let busy = false;
+  const timer = setInterval(async () => {
+    if (busy) return;
+    busy = true;
+    try {
+      const now = (await auth.servers()).find((s) => s.name === server);
+      if (now && now.status !== "needs-auth") {
+        stopWatch(owner, server);
+        await refresh(auth, host, itemId);
+      } else if (Date.now() - started > WATCH_FOR_MS) stopWatch(owner, server);
+    } catch {
+      stopWatch(owner, server);
+    } finally {
+      busy = false;
+    }
+  }, WATCH_EVERY_MS);
+  timer.unref?.();
+  timers.set(server, timer);
+}
+
+export async function handleMcpAuth(
+  cmd: McpAuthCommand,
+  conversation: Pick<ChatConversation, "mcpAuth">,
+  host: Host
+): Promise<void> {
+  const auth = conversation.mcpAuth;
+  const reply = (r: { start?: McpSignInStart; error?: string }) =>
+    host.emit({ type: "mcp_auth_result", reqId: cmd.reqId, ...r });
+  if (!auth) return reply({ error: "This agent can't sign in to MCP servers" });
+  try {
+    if (cmd.action === "start") {
+      const { state, ...start } = await auth.start(cmd.server, cmd.redirectUri);
+      if (start.mode === "done") {
+        await auth.reconnect(cmd.server);
+        await refresh(auth, host, cmd.itemId);
+      } else if (start.mode !== "callback")
+        watch(auth, host, cmd.itemId, cmd.server);
+      // The state ties the provider's return to this attempt; the server
+      // keeps it, the browser never needs it.
+      return reply({ start: { ...start, ...(state && { state }) } });
+    }
+    stopWatch(auth, cmd.server);
+    let failure: unknown;
+    try {
+      if (cmd.action === "submit") {
+        if (!cmd.url) throw new Error("No address to finish with");
+        await auth.submit(cmd.server, cmd.url);
+      }
+      await auth.reconnect(cmd.server);
+    } catch (error) {
+      failure = error;
+    }
+    await refresh(auth, host, cmd.itemId).catch(() => {});
+    reply(failure ? { error: message(failure) } : {});
+  } catch (error) {
+    reply({ error: message(error) });
+  }
+}
+
+// An error can quote the server's URL, and a key in it.
+function message(error: unknown): string {
+  return (
+    cleanMcpError(error instanceof Error ? error.message : String(error)) ??
+    "Sign-in failed"
+  );
+}

package/lib/chat/worker/protocol.ts

@@ -15,6 +15,7 @@ import type {
   Compacting,
   DriverEvent,
   FileSuggestion,
+  McpSignInStart,
   ChatOrigin,
   PeerMessage,
 } from "../events";
@@ -56,6 +57,18 @@ export type WorkerCommand =
   | { type: "undo"; reqId: string; checkpoint: string; dryRun: boolean }
   | { type: "stop_task"; taskId: string }
   | { type: "background_task"; reqId: string; toolUseId?: string }
+  // Sign in to an MCP server listed in the /mcp item `itemId`: start it
+  // (redirectUri: where the provider should return the browser), finish it
+  // with the address it returned to (url), or just reconnect.
+  | {
+      type: "mcp_auth";
+      reqId: string;
+      action: "start" | "submit" | "reconnect";
+      server: string;
+      itemId: string;
+      redirectUri?: string;
+      url?: string;
+    }
   // It runs an older build: it takes no new message into its agent (they
   // wait in the queue) and closes at its next turn boundary, so a current
   // worker resumes the conversation with today's tools.
@@ -101,6 +114,12 @@ export type WorkerEvent =
   | { type: "suggestion"; text: string | null }
   | { type: "undo_result"; reqId: string; result?: UndoResult; error?: string }
   | { type: "background_result"; reqId: string; ok?: boolean; error?: string }
+  | {
+      type: "mcp_auth_result";
+      reqId: string;
+      start?: McpSignInStart & { state?: string };
+      error?: string;
+    }
   | {
       type: "files_result";
       reqId: string;

package/lib/db/migrations/20261018T1730_mcp_sign_ins.ts

@@ -0,0 +1,22 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261018T1730_mcp_sign_ins",
+  up: (db) => {
+    // MCP sign-ins waiting for the provider to send the browser back, keyed by
+    // the OAuth state. Short-lived and single use; no tokens are stored.
+    // Additive.
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS mcp_sign_ins (
+        state TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL,
+        item_id TEXT NOT NULL,
+        server TEXT NOT NULL,
+        origin TEXT,
+        at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_mcp_sign_ins_session
+        ON mcp_sign_ins(session_id, server);
+    `);
+  },
+} satisfies Migration;

package/lib/db/migrations/20261018T2100_orch_full_access.ts

@@ -0,0 +1,16 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261018T2100_orch_full_access",
+  up: (db) => {
+    // Whether the workspace's orchestrator runs with its shell and file
+    // guards off (orchestrator/full-access.ts). On by default. Additive.
+    const cols = db.prepare(`PRAGMA table_info(workspaces)`).all() as {
+      name: string;
+    }[];
+    if (!cols.some((c) => c.name === "orch_full_access"))
+      db.exec(
+        `ALTER TABLE workspaces ADD COLUMN orch_full_access INTEGER NOT NULL DEFAULT 1`
+      );
+  },
+} satisfies Migration;

package/lib/db/migrations/20261018T2130_project_tier.ts

@@ -0,0 +1,38 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261018T2130_project_tier",
+  up: (db) => {
+    // A project's tier: "production" tasks pass every merge gate, "fast"
+    // ones merge as soon as their PR opens (orchestrator/fast-lane.ts). The
+    // LumifyHub and Workstak projects start production, in the same step as
+    // the column, so running this again never overwrites a tier Saad changed.
+    const cols = db.prepare(`PRAGMA table_info(projects)`).all() as {
+      name: string;
+    }[];
+    if (!cols.some((c) => c.name === "tier")) {
+      db.exec(
+        `ALTER TABLE projects ADD COLUMN tier TEXT NOT NULL DEFAULT 'fast'`
+      );
+      db.exec(
+        `UPDATE projects SET tier = 'production'
+         WHERE lower(name) LIKE 'lumifyhub%' OR lower(name) LIKE 'workstak%'
+            OR workspace_id IN (
+              SELECT id FROM workspaces WHERE lower(name) IN ('lumifyhub', 'workstak')
+            )`
+      );
+    }
+    // What the fast lane has done to a task: the PR it armed (so a disarm
+    // sticks) and the merge whose CI it still watches.
+    db.exec(`CREATE TABLE IF NOT EXISTS fast_lane_tasks (
+      session_id TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      auto_armed_pr INTEGER,
+      merged_sha TEXT,
+      merged_pr INTEGER,
+      merged_at TEXT,
+      ci_checked_at TEXT,
+      ci_done_at TEXT
+    )`);
+  },
+} satisfies Migration;

package/lib/db/types.ts

@@ -175,6 +175,9 @@ export interface Group {
   created_at: string;
 }
 
+// production: every merge gate applies. fast: a task's PR merges when it opens.
+export type ProjectTier = "production" | "fast";
+
 export interface Project {
   id: string;
   name: string;
@@ -190,6 +193,7 @@ export interface Project {
   lh_board_id: string | null;
   lh_board_name: string | null;
   lh_board_page_id: string | null;
+  tier: ProjectTier;
   // What its tasks need from a machine (JSON array), and where that came from.
   machine_needs?: string | null;
   machine_needs_source?: string | null;
@@ -296,6 +300,9 @@ export interface Workspace {
   // Tasks are messaged about failing checks and reviews on their PRs
   // (orchestrator/pr-wake.ts).
   wake_tasks_on_pr: boolean;
+  // Its orchestrator's shell and file writes aren't checked, and it may merge
+  // directly (orchestrator/full-access.ts).
+  orch_full_access: boolean;
   created_at: string;
 }
 

package/lib/done/testing.ts

@@ -2,9 +2,9 @@
 // worktrees cut from it the way AgentOS cuts them.
 
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { gitSync } from "../git-exec";
+import { tempDir } from "@/lib/test-temp";
 
 // Old enough that CI counts as settled on every commit.
 const env = { ...process.env, GIT_COMMITTER_DATE: "2026-01-01T00:00:00Z" };
@@ -24,7 +24,7 @@ export function commitFile(cwd: string, file: string, text: string): string {
 export const WORKTREE_MARK = "aos-done-wt";
 
 export function makeRepo() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "aos-done-repo-"));
+  const root = tempDir("aos-done-repo-");
   const remote = path.join(root, "remote.git");
   const repo = path.join(root, "repo");
   git(root, "init", "-q", "--bare", "-b", "main", remote);

package/lib/env-setup.ts

@@ -180,7 +180,7 @@ export async function setupWorktree(options: {
 
   // 1. The project's config. A broken one is reported and nothing of it is
   // used: running an older file's setup instead would hide the mistake.
-  const { config, source, error } = loadProjectConfig(sourcePath);
+  const { config, source, error, warning } = loadProjectConfig(sourcePath);
   if (error) {
     result.success = false;
     result.steps.push({
@@ -189,6 +189,13 @@ export async function setupWorktree(options: {
       success: false,
       error,
     });
+  } else if (warning) {
+    result.steps.push({
+      name: "Read agentos.json and .dispatch.json",
+      command: "read agentos.json + .dispatch.json",
+      success: true,
+      output: warning,
+    });
   }
 
   // 2. Copy env files, or exactly what the config's `copy` names

package/lib/health/boots.ts

@@ -7,8 +7,7 @@
  */
 
 import fs from "fs";
-import os from "os";
-import path from "path";
+import { agentosHome } from "../agentos-home";
 import { db } from "../db";
 import { gitSync } from "../git-exec";
 import { getSetting, putSetting } from "../settings-store";
@@ -80,12 +79,7 @@ export const recentBoots = (n = 6) =>
     .prepare(`SELECT * FROM health_boots ORDER BY started_at DESC LIMIT ?`)
     .all(n) as BootRow[];
 
-export const DEPLOY_RESTART_FILE = path.join(
-  os.homedir(),
-  ".agent-os",
-  "autodeploy",
-  "restarted"
-);
+export const DEPLOY_RESTART_FILE = agentosHome("autodeploy", "restarted");
 
 // When autodeploy last restarted the server (it writes epoch seconds once the
 // server is back up), or null.