@integrity-labs/agt-cli 0.19.14 → 0.19.15

package/dist/{claude-pair-runtime-VXN4NVGR.js → claude-pair-runtime-UF4OMFCA.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-CFDGW7QE.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-M2GVL6Z6.js");
   const claudeBin = resolveClaudeBinary();
   try {
     await execFileAsync("tmux", [
@@ -357,4 +357,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-VXN4NVGR.js.map
+//# sourceMappingURL=claude-pair-runtime-UF4OMFCA.js.map

package/dist/lib/manager-worker.js

@@ -22,7 +22,7 @@ import {
   resolveChannels,
   resolveDmTarget,
   wrapScheduledTaskPrompt
-} from "../chunk-KLNFWXOI.js";
+} from "../chunk-DVWBVANP.js";
 import {
   findTaskByTemplate,
   getProjectDir,
@@ -39,6 +39,7 @@ import {
   isAgentIdle,
   isSessionHealthy,
   isStaleForToday,
+  parsePsRows,
   peekCurrentSession,
   prepareForRespawn,
   reapOrphanChannelMcps,
@@ -48,7 +49,7 @@ import {
   startPersistentSession,
   stopAllSessionsAndWait,
   stopPersistentSession
-} from "../chunk-HA4IUBVC.js";
+} from "../chunk-3K3RO5NS.js";
 
 // src/lib/manager-worker.ts
 import { createHash } from "crypto";
@@ -59,6 +60,160 @@ import { join as join4, dirname } from "path";
 import { homedir as homedir3 } from "os";
 import { fileURLToPath } from "url";
 
+// src/lib/stale-mcp-reaper.ts
+import { execFileSync } from "child_process";
+function parseEnvIntegrationsVars(content) {
+  const names = /* @__PURE__ */ new Set();
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const name = line.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) continue;
+    names.add(name);
+  }
+  return [...names];
+}
+function findMcpServersUsingVars(mcp, changedVars) {
+  const changedSet = new Set(changedVars);
+  if (!mcp?.mcpServers || changedSet.size === 0) return [];
+  const result = [];
+  for (const [serverKey, entry] of Object.entries(mcp.mcpServers)) {
+    if (!entry || typeof entry !== "object") continue;
+    const env = entry.env;
+    if (!env || typeof env !== "object") continue;
+    let matches = false;
+    for (const value of Object.values(env)) {
+      if (typeof value !== "string") continue;
+      const placeholderMatches = value.match(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g);
+      if (placeholderMatches) {
+        for (const ph of placeholderMatches) {
+          const name = ph.slice(2, -1);
+          if (changedSet.has(name)) {
+            matches = true;
+            break;
+          }
+        }
+      }
+      if (matches) break;
+    }
+    if (matches) result.push(serverKey);
+  }
+  return result;
+}
+function buildArgvMatchers(serverKeys) {
+  const patterns = [];
+  for (const key of serverKeys) {
+    const safe = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    patterns.push(new RegExp(`\\b${safe}\\b`));
+    if (safe.includes("_")) {
+      const dashed = safe.replace(/_/g, "-");
+      patterns.push(new RegExp(`\\b${dashed}\\b`));
+    }
+  }
+  return patterns;
+}
+function buildClaudeAgentMatcher(codeName) {
+  const safe = codeName.replace(/[^A-Za-z0-9_-]/g, "");
+  return new RegExp(`\\bclaude\\b.*--name\\s+agt-${safe}(?=\\s|$)`);
+}
+function findMcpChildrenForAgent(args) {
+  const { rows, codeName, serverKeys } = args;
+  const maxDepth = args.maxDepth ?? 8;
+  if (serverKeys.length === 0 || rows.length === 0) return [];
+  const claudeMatcher = buildClaudeAgentMatcher(codeName);
+  const argvMatchers = buildArgvMatchers(serverKeys);
+  const byPid = new Map(rows.map((r) => [r.pid, r]));
+  const matched = [];
+  for (const row of rows) {
+    if (!argvMatchers.some((re) => re.test(row.args))) continue;
+    if (/\bclaude\b/.test(row.args) && row.args.includes(`--name agt-${codeName}`)) continue;
+    let cur = byPid.get(row.ppid);
+    let belongs = false;
+    for (let depth = 0; depth < maxDepth && cur; depth++) {
+      if (claudeMatcher.test(cur.args)) {
+        belongs = true;
+        break;
+      }
+      if (cur.pid === 1) break;
+      cur = byPid.get(cur.ppid);
+    }
+    if (belongs) matched.push(row.pid);
+  }
+  return matched;
+}
+function reapStaleMcpChildren(args) {
+  const { log: log2, codeName, serverKeys, graceMs = 5e3 } = args;
+  if (serverKeys.length === 0) return [];
+  const runPs = args.runPs ?? (() => execFileSync("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", timeout: 5e3 }));
+  const killProcess = args.killProcess ?? ((pid, signal) => {
+    try {
+      process.kill(pid, signal);
+    } catch {
+    }
+  });
+  const isAlive = args.isAlive ?? ((pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  let psOutput;
+  try {
+    psOutput = runPs();
+  } catch (err) {
+    log2(`[stale-mcp-reaper] ps invocation failed for '${codeName}': ${err.message} \u2014 skipping reap`);
+    return [];
+  }
+  const rows = parsePsRows(psOutput);
+  const targets = findMcpChildrenForAgent({ rows, codeName, serverKeys });
+  if (targets.length === 0) return [];
+  const byPid = new Map(rows.map((r) => [r.pid, r]));
+  const describe = (pid) => {
+    const argv = byPid.get(pid)?.args ?? "";
+    const pkgMatch = argv.match(/(@[a-z0-9_-]+\/[a-z0-9_-]+|[a-z0-9_-]+-mcp-server|[a-z0-9_-]+-mcp\b)/i);
+    return pkgMatch ? `${pkgMatch[1]} (pid ${pid})` : `pid ${pid}`;
+  };
+  log2(
+    `[stale-mcp-reaper] '${codeName}': rotating ${targets.length} stale MCP child(ren) for [${serverKeys.join(", ")}]: ${targets.map(describe).join(", ")}`
+  );
+  for (const pid of targets) {
+    killProcess(pid, "SIGTERM");
+  }
+  setTimeout(() => {
+    try {
+      let freshPsOutput;
+      try {
+        freshPsOutput = runPs();
+      } catch (err) {
+        log2(`[stale-mcp-reaper] '${codeName}': fresh ps for SIGKILL re-verify failed: ${err.message} \u2014 skipping SIGKILL pass`);
+        return;
+      }
+      const stillOwned = new Set(
+        findMcpChildrenForAgent({
+          rows: parsePsRows(freshPsOutput),
+          codeName,
+          serverKeys
+        })
+      );
+      const stragglers = targets.filter((pid) => isAlive(pid) && stillOwned.has(pid));
+      if (stragglers.length === 0) return;
+      log2(
+        `[stale-mcp-reaper] '${codeName}': ${stragglers.length} child(ren) survived SIGTERM; sending SIGKILL: ${stragglers.map(describe).join(", ")}`
+      );
+      for (const pid of stragglers) {
+        killProcess(pid, "SIGKILL");
+      }
+    } catch (err) {
+      log2(`[stale-mcp-reaper] '${codeName}': error in SIGKILL pass: ${err.message}`);
+    }
+  }, graceMs).unref();
+  return targets;
+}
+
 // src/lib/channel-restart-decision.ts
 function launchableChannelIds(channelConfigs) {
   if (!channelConfigs) return /* @__PURE__ */ new Set();
@@ -649,7 +804,7 @@ function saveChannelHashCache(source, configDir) {
 }
 
 // src/lib/channel-sweep.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 var CHANNEL_BASENAMES = [
   "slack-channel",
   "direct-chat-channel",
@@ -812,7 +967,7 @@ function resolveLiveAnchorPids(agentCodeNames) {
   for (const codeName of agentCodeNames) {
     const pids = /* @__PURE__ */ new Set();
     try {
-      const out = execFileSync("tmux", ["list-panes", "-t", `agt-${codeName}`, "-F", "#{pane_pid}"], {
+      const out = execFileSync2("tmux", ["list-panes", "-t", `agt-${codeName}`, "-F", "#{pane_pid}"], {
         encoding: "utf-8",
         timeout: 2e3,
         stdio: ["ignore", "pipe", "ignore"]
@@ -832,7 +987,7 @@ async function sweepChannelProcesses(opts) {
   const kill = opts.killFn ?? defaultKill;
   let psOutput = "";
   try {
-    psOutput = execFileSync("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
+    psOutput = execFileSync2("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
       encoding: "utf-8",
       timeout: 5e3,
       maxBuffer: 10 * 1024 * 1024
@@ -869,7 +1024,7 @@ function defaultKillSignal(pid, signal) {
   }
 }
 function defaultPs() {
-  return execFileSync("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
+  return execFileSync2("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
     encoding: "utf-8",
     timeout: 5e3,
     maxBuffer: 10 * 1024 * 1024
@@ -1681,10 +1836,10 @@ function clearAgentCaches(agentId, codeName) {
 var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-var agtCliVersion = true ? "0.19.14" : "dev";
-function resolveBrewPath(execFileSync2) {
+var agtCliVersion = true ? "0.19.15" : "dev";
+function resolveBrewPath(execFileSync3) {
   try {
-    const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
+    const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
     if (out) return out;
   } catch {
   }
@@ -1726,9 +1881,9 @@ async function ensureToolkitCli(toolkitSlug) {
   }
   const { binary, installer, package: pkg, script } = integration.cli_tool;
   const resolvedInstaller = installer ?? "manual";
-  const { execFileSync: execFileSync2, execSync } = await import("child_process");
+  const { execFileSync: execFileSync3, execSync } = await import("child_process");
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
     toolkitCliFailureCount.delete(toolkitSlug);
@@ -1749,14 +1904,14 @@ async function ensureToolkitCli(toolkitSlug) {
         return;
       }
       log(`[toolkit-install] ${toolkitSlug}: installing via npm (${pkg})\u2026`);
-      execFileSync2("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
+      execFileSync3("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
     } else if (resolvedInstaller === "brew") {
       if (!pkg) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but no package declared`);
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      const brewPath = resolveBrewPath(execFileSync2);
+      const brewPath = resolveBrewPath(execFileSync3);
       if (!brewPath) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but Homebrew not available \u2014 install manually: brew install ${pkg}`);
         toolkitCliEnsured.add(toolkitSlug);
@@ -1766,9 +1921,9 @@ async function ensureToolkitCli(toolkitSlug) {
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
-        execFileSync2("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
+        execFileSync3("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
       } else {
-        execFileSync2(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
+        execFileSync3(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
       }
     } else if (resolvedInstaller === "script") {
       if (!script) {
@@ -1788,7 +1943,7 @@ async function ensureToolkitCli(toolkitSlug) {
     process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
   }
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     log(`[toolkit-install] ${toolkitSlug}: installed \u2014 ${binary} now on PATH`);
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
@@ -1841,8 +1996,8 @@ async function ensureFrameworkBinary(frameworkId) {
   if (frameworkId !== "claude-code") return;
   if (frameworkBinaryChecked.has(frameworkId)) return;
   frameworkBinaryChecked.add(frameworkId);
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) {
     log("Homebrew not found (no `brew` on PATH, no /home/linuxbrew/.linuxbrew/bin/brew). Cannot auto-install Claude Code. Install manually: https://claude.ai/download");
     return;
@@ -1858,7 +2013,7 @@ async function ensureFrameworkBinary(frameworkId) {
   let claudeExists = existsSync3("/home/linuxbrew/.linuxbrew/bin/claude");
   if (!claudeExists) {
     try {
-      execFileSync2("which", ["claude"], { timeout: 5e3 });
+      execFileSync3("which", ["claude"], { timeout: 5e3 });
       claudeExists = true;
     } catch {
     }
@@ -1950,16 +2105,16 @@ async function checkAndUpdateCli() {
   }
 }
 async function checkAndUpdateCliViaBrew() {
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) return;
   try {
-    execFileSync2(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
+    execFileSync3(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
   } catch (err) {
     log(`[self-update] brew update failed (continuing with stale cache): ${err.message}`);
   }
   try {
-    const outdated = execFileSync2(brewPath, ["outdated", "--json=v2"], {
+    const outdated = execFileSync3(brewPath, ["outdated", "--json=v2"], {
       timeout: 3e4,
       encoding: "utf-8"
     });
@@ -1970,7 +2125,7 @@ async function checkAndUpdateCliViaBrew() {
       const latest = agtOutdated.current_version ?? "unknown";
       log(`[self-update] agt CLI update available: ${installed} \u2192 ${latest}. Upgrading via brew...`);
       try {
-        execFileSync2(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
+        execFileSync3(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
           timeout: 12e4,
           stdio: "pipe"
         });
@@ -1989,7 +2144,7 @@ async function checkAndUpdateCliViaBrew() {
   }
 }
 async function checkAndUpdateCliViaNpm() {
-  const { execFileSync: execFileSync2 } = await import("child_process");
+  const { execFileSync: execFileSync3 } = await import("child_process");
   if (agtCliVersion === "dev") return;
   let latest;
   try {
@@ -2038,7 +2193,7 @@ async function checkAndUpdateCliViaNpm() {
     "--registry=https://registry.npmjs.org"
   ];
   try {
-    execFileSync2(cmd, args, { timeout: 18e4, stdio: "pipe" });
+    execFileSync3(cmd, args, { timeout: 18e4, stdio: "pipe" });
     log(`[self-update] agt CLI upgraded to ${latest}. Scheduling manager restart so the new binary takes effect.`);
     restartAfterUpgrade = true;
     pendingUpgradeVersion = latest;
@@ -2585,7 +2740,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-CFDGW7QE.js");
+      const { collectDiagnostics } = await import("../persistent-session-M2GVL6Z6.js");
       const diagCodeNames = [...persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -3333,12 +3488,33 @@ async function processAgent(agent, agentStates) {
         log(`Integrations provisioned for '${agent.code_name}' (${integrations.length} integration(s))`);
         const fw = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
+          let affectedServerKeys = [];
+          try {
+            const projectDir = join4(homedir3(), ".augmented", agent.code_name, "project");
+            const envIntPath = join4(projectDir, ".env.integrations");
+            const projectMcpPath = join4(projectDir, ".mcp.json");
+            const envContent = readFileSync3(envIntPath, "utf-8");
+            const mcpContent = readFileSync3(projectMcpPath, "utf-8");
+            const changedVars = parseEnvIntegrationsVars(envContent);
+            const mcpJson = JSON.parse(mcpContent);
+            affectedServerKeys = findMcpServersUsingVars(mcpJson, changedVars);
+          } catch (err) {
+            log(`[hot-reload] Failed to compute affected MCP servers for '${agent.code_name}': ${err.message}`);
+          }
+          if (affectedServerKeys.length > 0) {
+            reapStaleMcpChildren({
+              log,
+              codeName: agent.code_name,
+              serverKeys: affectedServerKeys
+            });
+          }
           const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
-          injectMessage(agent.code_name, "system", `Your integrations have been updated. You now have access to: ${names}. Your .env.integrations and CLAUDE.md have been refreshed \u2014 credentials are available immediately via environment variables.`, {
+          const reapNote = affectedServerKeys.length > 0 ? ` The MCP servers that depend on rotating credentials (${affectedServerKeys.join(", ")}) have been signalled to reconnect.` : "";
+          injectMessage(agent.code_name, "system", `Your integrations have been refreshed. You have access to: ${names}.${reapNote}`, {
             task_name: "integration-update"
           }, log).catch(() => {
           });
-          log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names}`);
+          log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names} (reaped ${affectedServerKeys.length} stale MCP server(s))`);
         }
         needsGatewayRestart = true;
       }
@@ -5822,7 +5998,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-VXN4NVGR.js");
+  } = await import("../claude-pair-runtime-UF4OMFCA.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));