@integrity-labs/agt-cli 0.19.15 → 0.19.17

package/dist/lib/manager-worker.js

@@ -22,7 +22,7 @@ import {
   resolveChannels,
   resolveDmTarget,
   wrapScheduledTaskPrompt
-} from "../chunk-DVWBVANP.js";
+} from "../chunk-AYSU35A4.js";
 import {
   findTaskByTemplate,
   getProjectDir,
@@ -60,10 +60,18 @@ import { join as join4, dirname } from "path";
 import { homedir as homedir3 } from "os";
 import { fileURLToPath } from "url";
 
+// src/lib/mcp-config-drift.ts
+function decideMcpDriftAction(currentHash, knownHash) {
+  if (!currentHash) return { kind: "no-config" };
+  if (!knownHash) return { kind: "baseline", hash: currentHash };
+  if (knownHash === currentHash) return { kind: "no-drift" };
+  return { kind: "drift", previous: knownHash, current: currentHash };
+}
+
 // src/lib/stale-mcp-reaper.ts
 import { execFileSync } from "child_process";
-function parseEnvIntegrationsVars(content) {
-  const names = /* @__PURE__ */ new Set();
+function parseEnvIntegrationsEntries(content) {
+  const entries = /* @__PURE__ */ new Map();
   for (const raw of content.split(/\r?\n/)) {
     const line = raw.trim();
     if (!line || line.startsWith("#")) continue;
@@ -71,9 +79,22 @@ function parseEnvIntegrationsVars(content) {
     if (eq <= 0) continue;
     const name = line.slice(0, eq).trim();
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) continue;
-    names.add(name);
+    const value = line.slice(eq + 1);
+    entries.set(name, value);
+  }
+  return entries;
+}
+function diffEnvIntegrations(oldContent, newContent) {
+  const oldEntries = oldContent === void 0 ? /* @__PURE__ */ new Map() : parseEnvIntegrationsEntries(oldContent);
+  const newEntries = parseEnvIntegrationsEntries(newContent);
+  const changed = /* @__PURE__ */ new Set();
+  for (const [name, value] of newEntries) {
+    if (oldEntries.get(name) !== value) changed.add(name);
+  }
+  for (const name of oldEntries.keys()) {
+    if (!newEntries.has(name)) changed.add(name);
   }
-  return [...names];
+  return [...changed];
 }
 function findMcpServersUsingVars(mcp, changedVars) {
   const changedSet = new Set(changedVars);
@@ -102,14 +123,48 @@ function findMcpServersUsingVars(mcp, changedVars) {
   }
   return result;
 }
-function buildArgvMatchers(serverKeys) {
+function buildArgvMatchersForEntry(key, entry) {
+  const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const patterns = [];
-  for (const key of serverKeys) {
-    const safe = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    patterns.push(new RegExp(`\\b${safe}\\b`));
+  const args = entry?.args ?? [];
+  for (let i = args.length - 1; i >= 0; i--) {
+    const arg = args[i];
+    if (typeof arg !== "string" || !arg) continue;
+    if (arg.startsWith("-")) continue;
+    const stripped = arg.replace(
+      /@[^/@]*$/,
+      (m) => (
+        // @latest, @1.2.3, etc. — drop. But @scope at the START of a
+        // package spec must NOT be stripped, so we only strip a tail
+        // `@...` if it doesn't itself start with a slash inside.
+        // The regex above only matches a single trailing `@...`
+        // segment after the last `/`, so this is safe for `@scope/pkg`.
+        m.includes("/") ? m : ""
+      )
+    );
+    const tail = "(?![A-Za-z0-9_-])";
+    if (/^@?[a-z0-9]([a-z0-9._-]*\/)?[a-z0-9._-]+$/i.test(stripped)) {
+      patterns.push(new RegExp(`${escapeRe(stripped)}${tail}`));
+      const basename = stripped.split("/").pop();
+      if (basename && basename !== stripped) {
+        patterns.push(new RegExp(`${escapeRe(basename)}${tail}`));
+      }
+      break;
+    }
+    if (stripped.includes("/")) {
+      const basename = stripped.split("/").pop();
+      if (basename) {
+        patterns.push(new RegExp(`${escapeRe(basename)}${tail}`));
+        break;
+      }
+    }
+  }
+  if (patterns.length === 0) {
+    const safe = escapeRe(key);
+    patterns.push(new RegExp(`(?<![A-Za-z0-9_])${safe}(?![A-Za-z0-9_])`));
     if (safe.includes("_")) {
       const dashed = safe.replace(/_/g, "-");
-      patterns.push(new RegExp(`\\b${dashed}\\b`));
+      patterns.push(new RegExp(`(?<![A-Za-z0-9_])${dashed}(?![A-Za-z0-9_])`));
     }
   }
   return patterns;
@@ -119,11 +174,15 @@ function buildClaudeAgentMatcher(codeName) {
   return new RegExp(`\\bclaude\\b.*--name\\s+agt-${safe}(?=\\s|$)`);
 }
 function findMcpChildrenForAgent(args) {
-  const { rows, codeName, serverKeys } = args;
+  const { rows, codeName, serverKeys, mcpJson } = args;
   const maxDepth = args.maxDepth ?? 8;
   if (serverKeys.length === 0 || rows.length === 0) return [];
   const claudeMatcher = buildClaudeAgentMatcher(codeName);
-  const argvMatchers = buildArgvMatchers(serverKeys);
+  const argvMatchers = [];
+  for (const key of serverKeys) {
+    const entry = mcpJson?.mcpServers?.[key];
+    argvMatchers.push(...buildArgvMatchersForEntry(key, entry));
+  }
   const byPid = new Map(rows.map((r) => [r.pid, r]));
   const matched = [];
   for (const row of rows) {
@@ -144,7 +203,7 @@ function findMcpChildrenForAgent(args) {
   return matched;
 }
 function reapStaleMcpChildren(args) {
-  const { log: log2, codeName, serverKeys, graceMs = 5e3 } = args;
+  const { log: log2, codeName, serverKeys, mcpJson, graceMs = 5e3 } = args;
   if (serverKeys.length === 0) return [];
   const runPs = args.runPs ?? (() => execFileSync("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", timeout: 5e3 }));
   const killProcess = args.killProcess ?? ((pid, signal) => {
@@ -169,7 +228,7 @@ function reapStaleMcpChildren(args) {
     return [];
   }
   const rows = parsePsRows(psOutput);
-  const targets = findMcpChildrenForAgent({ rows, codeName, serverKeys });
+  const targets = findMcpChildrenForAgent({ rows, codeName, serverKeys, mcpJson });
   if (targets.length === 0) return [];
   const byPid = new Map(rows.map((r) => [r.pid, r]));
   const describe = (pid) => {
@@ -196,7 +255,8 @@ function reapStaleMcpChildren(args) {
         findMcpChildrenForAgent({
           rows: parsePsRows(freshPsOutput),
           codeName,
-          serverKeys
+          serverKeys,
+          mcpJson
         })
       );
       const stragglers = targets.filter((pid) => isAlive(pid) && stillOwned.has(pid));
@@ -1748,6 +1808,7 @@ function scheduleSessionRestart(codeName, delayMs, reason) {
   const timer = setTimeout(() => {
     pendingSessionRestarts.delete(codeName);
     stopPersistentSession(codeName, log);
+    runningMcpHashes.delete(codeName);
     log(`[hot-reload] Session stopped for '${codeName}' \u2014 will respawn with ${reason}`);
   }, delayMs);
   timer.unref?.();
@@ -1762,6 +1823,38 @@ function cancelPendingSessionRestart(codeName) {
 }
 var writtenHashes = /* @__PURE__ */ new Map();
 var knownSecretsHashes = /* @__PURE__ */ new Map();
+var runningMcpHashes = /* @__PURE__ */ new Map();
+function projectMcpHash(codeName, projectDir) {
+  try {
+    return createHash("sha256").update(readFileSync3(join4(projectDir, ".mcp.json"))).digest("hex");
+  } catch {
+    return null;
+  }
+}
+function stopPersistentSessionAndForgetMcpBaseline(codeName) {
+  cancelPendingSessionRestart(codeName);
+  stopPersistentSession(codeName, log);
+  runningMcpHashes.delete(codeName);
+}
+function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
+  const currentHash = projectMcpHash(codeName, projectDir);
+  const action = decideMcpDriftAction(currentHash, runningMcpHashes.get(codeName));
+  switch (action.kind) {
+    case "no-config":
+    case "no-drift":
+      return;
+    case "baseline":
+      runningMcpHashes.set(codeName, action.hash);
+      return;
+    case "drift":
+      log(
+        `[hot-reload] .mcp.json content changed for '${codeName}' (${action.previous.slice(0, 12)} \u2192 ${action.current.slice(0, 12)}); scheduling restart (ENG-4897)`
+      );
+      scheduleSessionRestart(codeName, 0, ".mcp.json content change (ENG-4897)");
+      runningMcpHashes.delete(codeName);
+      return;
+  }
+}
 var knownChannelConfigHashes = /* @__PURE__ */ new Map();
 var knownModels = /* @__PURE__ */ new Map();
 var knownTasksHashes = /* @__PURE__ */ new Map();
@@ -1836,7 +1929,7 @@ function clearAgentCaches(agentId, codeName) {
 var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-var agtCliVersion = true ? "0.19.15" : "dev";
+var agtCliVersion = true ? "0.19.17" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -2679,8 +2772,7 @@ async function pollCycle() {
       log,
       resolveFramework: (codeName) => agentFrameworkCache.get(codeName) ?? null,
       stopSession: (codeName) => {
-        cancelPendingSessionRestart(codeName);
-        stopPersistentSession(codeName, log);
+        stopPersistentSessionAndForgetMcpBaseline(codeName);
         persistentSessionAgents.delete(codeName);
         claudeAuthTupleBySession.delete(codeName);
       },
@@ -2840,8 +2932,7 @@ async function pollCycle() {
         log(`Agent '${prev.codeName}' removed from host (deleted or unassigned)`);
         const adapter = resolveAgentFramework(prev.codeName);
         await stopGatewayIfRunning(prev.codeName, adapter);
-        cancelPendingSessionRestart(prev.codeName);
-        stopPersistentSession(prev.codeName, log);
+        stopPersistentSessionAndForgetMcpBaseline(prev.codeName);
         try {
           const { execSync: es } = await import("child_process");
           es(`tmux kill-session -t agt-${prev.codeName} 2>/dev/null`, { stdio: "ignore" });
@@ -2978,8 +3069,7 @@ async function processAgent(agent, agentStates) {
   if (agent.status === "draft" || agent.status === "paused") {
     log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
     await stopGatewayIfRunning(agent.code_name, adapter);
-    cancelPendingSessionRestart(agent.code_name);
-    stopPersistentSession(agent.code_name, log);
+    stopPersistentSessionAndForgetMcpBaseline(agent.code_name);
     try {
       const { execSync: es } = await import("child_process");
       es(`tmux kill-session -t agt-${agent.code_name} 2>/dev/null`, { stdio: "ignore" });
@@ -3007,8 +3097,7 @@ async function processAgent(agent, agentStates) {
   if (agent.status === "revoked") {
     log(`Agent '${agent.code_name}' is revoked, cleaning up`);
     await stopGatewayIfRunning(agent.code_name, adapter);
-    cancelPendingSessionRestart(agent.code_name);
-    stopPersistentSession(agent.code_name, log);
+    stopPersistentSessionAndForgetMcpBaseline(agent.code_name);
     try {
       const { execSync: es } = await import("child_process");
       es(`tmux kill-session -t agt-${agent.code_name} 2>/dev/null`, { stdio: "ignore" });
@@ -3481,40 +3570,50 @@ async function processAgent(agent, agentStates) {
       const intHash = createHash("sha256").update(JSON.stringify(integrations.map((i) => `${i.definition_id}:${JSON.stringify(i.credentials)}`))).digest("hex").slice(0, 16);
       const prevIntHash = knownIntegrationHashes.get(agent.agent_id);
       if (intHash !== prevIntHash) {
+        const projectDir = join4(homedir3(), ".augmented", agent.code_name, "project");
+        const envIntPath = join4(projectDir, ".env.integrations");
+        let preWriteEnv;
+        try {
+          preWriteEnv = readFileSync3(envIntPath, "utf-8");
+        } catch {
+          preWriteEnv = void 0;
+        }
         if (frameworkAdapter.writeIntegrations) {
           frameworkAdapter.writeIntegrations(agent.code_name, integrations);
         }
-        knownIntegrationHashes.set(agent.agent_id, intHash);
         log(`Integrations provisioned for '${agent.code_name}' (${integrations.length} integration(s))`);
         const fw = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
+        let rotationHandled = true;
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
-          let affectedServerKeys = [];
           try {
-            const projectDir = join4(homedir3(), ".augmented", agent.code_name, "project");
-            const envIntPath = join4(projectDir, ".env.integrations");
             const projectMcpPath = join4(projectDir, ".mcp.json");
-            const envContent = readFileSync3(envIntPath, "utf-8");
+            const postWriteEnv = readFileSync3(envIntPath, "utf-8");
             const mcpContent = readFileSync3(projectMcpPath, "utf-8");
-            const changedVars = parseEnvIntegrationsVars(envContent);
-            const mcpJson = JSON.parse(mcpContent);
-            affectedServerKeys = findMcpServersUsingVars(mcpJson, changedVars);
-          } catch (err) {
-            log(`[hot-reload] Failed to compute affected MCP servers for '${agent.code_name}': ${err.message}`);
-          }
-          if (affectedServerKeys.length > 0) {
-            reapStaleMcpChildren({
-              log,
-              codeName: agent.code_name,
-              serverKeys: affectedServerKeys
+            const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
+            const mcpJsonForReap = JSON.parse(mcpContent);
+            const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
+            if (affectedServerKeys.length > 0) {
+              reapStaleMcpChildren({
+                log,
+                codeName: agent.code_name,
+                serverKeys: affectedServerKeys,
+                mcpJson: mcpJsonForReap
+              });
+            }
+            const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
+            const reapNote = affectedServerKeys.length > 0 ? ` The MCP servers that depend on rotating credentials (${affectedServerKeys.join(", ")}) have been signalled to reconnect.` : "";
+            injectMessage(agent.code_name, "system", `Your integrations have been refreshed. You have access to: ${names}.${reapNote}`, {
+              task_name: "integration-update"
+            }, log).catch(() => {
             });
+            log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names} (reaped ${affectedServerKeys.length} stale MCP server(s))`);
+          } catch (err) {
+            rotationHandled = false;
+            log(`[hot-reload] Failed to compute / reap affected MCP servers for '${agent.code_name}': ${err.message} \u2014 will retry next tick`);
           }
-          const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
-          const reapNote = affectedServerKeys.length > 0 ? ` The MCP servers that depend on rotating credentials (${affectedServerKeys.join(", ")}) have been signalled to reconnect.` : "";
-          injectMessage(agent.code_name, "system", `Your integrations have been refreshed. You have access to: ${names}.${reapNote}`, {
-            task_name: "integration-update"
-          }, log).catch(() => {
-          });
-          log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names} (reaped ${affectedServerKeys.length} stale MCP server(s))`);
+        }
+        if (rotationHandled) {
+          knownIntegrationHashes.set(agent.agent_id, intHash);
         }
         needsGatewayRestart = true;
       }
@@ -3832,6 +3931,11 @@ async function processAgent(agent, agentStates) {
   const sessionMode = refreshData.agent.session_mode ?? "oneshot";
   if (agentFw === "claude-code" && sessionMode === "persistent") {
     await ensurePersistentSession(agent, tasks, boardItems, refreshData);
+    try {
+      checkMcpConfigDriftAndScheduleRestart(agent.code_name, getProjectDir2(agent.code_name));
+    } catch (err) {
+      log(`[hot-reload] .mcp.json drift check failed for '${agent.code_name}': ${err.message}`);
+    }
   } else if (agentFw === "claude-code" && tasks.length > 0) {
     await syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData);
   } else if (frameworkAdapter.syncScheduledTasks && gatewayRunning && gatewayPort) {
@@ -4583,8 +4687,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     const msg = err.message;
     log(`[persistent-session] Failed to resolve auth for '${codeName}': ${msg} \u2014 refusing to spawn`);
     if (isSessionHealthy(codeName)) {
-      cancelPendingSessionRestart(codeName);
-      stopPersistentSession(codeName, log);
+      stopPersistentSessionAndForgetMcpBaseline(codeName);
       persistentSessionAgents.delete(codeName);
       claudeAuthTupleBySession.delete(codeName);
     }
@@ -4606,8 +4709,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const recordedAuthTuple = claudeAuthTupleBySession.get(codeName);
   if (recordedAuthTuple && recordedAuthTuple !== currentAuthTuple && isSessionHealthy(codeName)) {
     log(`[persistent-session] Auth config changed for '${codeName}' (${recordedAuthTuple} \u2192 ${currentAuthTuple}) \u2014 restarting session`);
-    cancelPendingSessionRestart(codeName);
-    stopPersistentSession(codeName, log);
+    stopPersistentSessionAndForgetMcpBaseline(codeName);
     persistentSessionAgents.delete(codeName);
   }
   if (isStaleForToday(codeName) && isSessionHealthy(codeName)) {
@@ -4618,8 +4720,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
         log(
           `[persistent-session] Day rollover for '${codeName}' (yesterday=${current.date}) \u2014 agent idle, restarting to mint fresh session`
         );
-        cancelPendingSessionRestart(codeName);
-        stopPersistentSession(codeName, log);
+        stopPersistentSessionAndForgetMcpBaseline(codeName);
         persistentSessionAgents.delete(codeName);
       } else {
         log(