@integrity-labs/agt-cli 0.27.112 → 0.27.114

package/dist/{chunk-D2EJL2KI.js → chunk-RN3OMHW7.js}

@@ -1,7 +1,7 @@
 import {
   claudeModelAlias,
   isClaudeFastMode
-} from "./chunk-Z3YQYO43.js";
+} from "./chunk-MTKM655R.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -1574,4 +1574,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-D2EJL2KI.js.map
+//# sourceMappingURL=chunk-RN3OMHW7.js.map

package/dist/{claude-pair-runtime-DS7675XI.js → claude-pair-runtime-KVJ4U436.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-3ZWAGNNO.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-E6YLH6TX.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-DS7675XI.js.map
+//# sourceMappingURL=claude-pair-runtime-KVJ4U436.js.map

package/dist/lib/manager-worker.js

@@ -17,7 +17,7 @@ import {
   provisionStopHook,
   requireHost,
   safeWriteJsonAtomic
-} from "../chunk-ILYN3XBV.js";
+} from "../chunk-7KIMZAMG.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -55,7 +55,7 @@ import {
   stopPersistentSession,
   takeWatchdogGiveUpCount,
   takeZombieDetection
-} from "../chunk-D2EJL2KI.js";
+} from "../chunk-RN3OMHW7.js";
 import {
   KANBAN_CHECK_COMMAND,
   SUPPRESS_SENTINEL,
@@ -74,12 +74,14 @@ import {
   parseDeliveryTarget,
   parseTranscriptUsage,
   parseUsageBanner,
+  probeComposioAccount,
   probeHttpProvider,
   resolveChannels,
   resolveConnectivityProbe,
   resolveDmTarget,
+  worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "../chunk-Z3YQYO43.js";
+} from "../chunk-MTKM655R.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -1030,6 +1032,22 @@ async function executeConnectivityProbe(target, deps = {}) {
     case "composio_account":
       if (!deps.composioProbe) return null;
       return deps.composioProbe(target.definitionId, target.credentials);
+    case "managed_composite": {
+      const outcomes = [];
+      if (deps.mcpProbe) {
+        outcomes.push(
+          await deps.mcpProbe({
+            serverKey: target.mcpServerKey ?? target.definitionId,
+            definitionId: target.definitionId
+          })
+        );
+      }
+      if (deps.composioProbe) {
+        outcomes.push(await deps.composioProbe(target.definitionId, target.credentials));
+      }
+      if (outcomes.length === 0) return null;
+      return outcomes.reduce((acc, o) => worseConnectivityOutcome(acc, o));
+    }
     case "mcp_tools_list":
       if (!deps.mcpProbe) return null;
       return deps.mcpProbe({
@@ -3771,6 +3789,7 @@ var autoResumeInFlight = /* @__PURE__ */ new Set();
 var AUTO_RESUME_SELF_WINDOW_MS = 12e4;
 var autoResumeLoggedSkips = /* @__PURE__ */ new Map();
 var autoResumeStandDowns = /* @__PURE__ */ new Set();
+var killPausedCodeNames = /* @__PURE__ */ new Set();
 function maybeAutoResume(agent) {
   const codeName = agent.code_name;
   if (autoResumeInFlight.has(codeName)) return;
@@ -3929,6 +3948,28 @@ async function runAgentConnectivityProbes(agent, integrations, projectDir) {
         return { status: "transient_error", message: `MCP server '${target.serverKey}' not resolvable from .mcp.json` };
       }
       return probeMcpHttp(cfg);
+    },
+    // ENG-6139: connected-account binding check for managed (Composio) toolkits.
+    // The MCP handshake reads green on a dead/mis-bound account, so the managed
+    // probe also verifies the account is ACTIVE + bound to the entity the agent
+    // queries with. Inputs come from the agent's OWN wired MCP server: the
+    // `x-api-key` header and the `user_id` query param (the agent already
+    // authenticates with these), plus the recorded connected_account_id.
+    composioProbe: async (definitionId, credentials) => {
+      const serverKey = definitionId.replace(/[^a-z0-9]/gi, "_").toLowerCase();
+      const cfg = readMcpHttpServerConfig(projectDir, serverKey);
+      if (!cfg) {
+        return { status: "transient_error", message: `MCP server '${serverKey}' not resolvable from .mcp.json` };
+      }
+      const apiKey = cfg.headers?.["x-api-key"] ?? cfg.headers?.["X-API-Key"] ?? "";
+      let expectedUserId = "";
+      try {
+        expectedUserId = new URL(cfg.url).searchParams.get("user_id") ?? "";
+      } catch {
+        expectedUserId = "";
+      }
+      const connectedAccountId = typeof credentials?.["connected_account_id"] === "string" ? credentials["connected_account_id"] : "";
+      return probeComposioAccount({ connectedAccountId, apiKey, expectedUserId });
     }
   };
   const intervalSec = Number(process.env.AGT_CONNECTIVITY_PROBE_INTERVAL_SECONDS) || 3600;
@@ -4133,7 +4174,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.112" : "dev";
+var agtCliVersion = true ? "0.27.114" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -5326,7 +5367,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-3ZWAGNNO.js");
+      const { collectDiagnostics } = await import("../persistent-session-E6YLH6TX.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -5413,12 +5454,12 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-EGXJFJBW.js");
+      } = await import("../responsiveness-probe-TDHX6JKG.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
         if (probeCodeNames.length > 0) {
-          const { takeAcpxExecFailureCount, creditAcpxExecFailureCount } = await import("../persistent-session-3ZWAGNNO.js");
+          const { takeAcpxExecFailureCount, creditAcpxExecFailureCount } = await import("../persistent-session-E6YLH6TX.js");
           const drainedGiveUps = /* @__PURE__ */ new Map();
           const drainedAcpxFailures = /* @__PURE__ */ new Map();
           const probes = collectResponsivenessProbes(probeCodeNames).map((p) => {
@@ -5778,6 +5819,16 @@ async function processAgent(agent, agentStates) {
     if (previousKnownStatus !== agent.status) {
       log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
     }
+    if (agent.kill_switch) {
+      killPausedCodeNames.add(agent.code_name);
+      if (previousKnownStatus !== agent.status) {
+        log(
+          `[kill-switch] '${agent.code_name}' halted by ${agent.kill_switch.scope ?? "unknown"} kill switch` + (agent.kill_switch.reason ? ` (reason: ${agent.kill_switch.reason})` : "") + ` source=${agent.kill_switch.source ?? "unknown"}`
+        );
+      }
+    } else if (killPausedCodeNames.delete(agent.code_name)) {
+      log(`[kill-switch] '${agent.code_name}' kill switch cleared while still ${agent.status} (no resume \u2014 paused for another reason)`);
+    }
     await stopGatewayIfRunning(agent.code_name, adapter);
     stopPersistentSessionAndForgetMcpBaseline(agent.code_name);
     try {
@@ -5786,7 +5837,7 @@ async function processAgent(agent, agentStates) {
       log(`Killed tmux session for paused agent '${agent.code_name}'`);
     } catch {
     }
-    if (agent.status === "paused") {
+    if (agent.status === "paused" && !agent.kill_switch) {
       maybeAutoResume(agent);
     }
     agentStates.push({
@@ -5892,6 +5943,16 @@ async function processAgent(agent, agentStates) {
         log(`[auto-resume] Cleared auto-resume marker for '${agent.code_name}' on operator resume \u2014 credit re-armed (ENG-6088)`);
       }
     }
+    if (previousStatus === "paused" && agent.status === "active" && killPausedCodeNames.delete(agent.code_name)) {
+      log(`[kill-switch] '${agent.code_name}' kill switch cleared \u2014 resuming session`);
+      void injectMessage(
+        agent.code_name,
+        "system",
+        "The kill switch that halted you has been cleared. Your session is resuming.",
+        { task_name: "kill-switch-resume" },
+        log
+      ).catch(() => false);
+    }
     let channelCacheMutated = false;
     for (const key of agentState.knownChannelConfigHashes.keys()) {
       if (key.startsWith(`${agent.agent_id}:`)) {
@@ -9794,7 +9855,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-DS7675XI.js");
+  } = await import("../claude-pair-runtime-KVJ4U436.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));