@integrity-labs/agt-cli 0.27.159 → 0.27.160

package/dist/{chunk-F5ZAIJHI.js → chunk-O24XVAYZ.js}

@@ -2,15 +2,19 @@ import {
   CHANNEL_REGISTRY,
   DEFAULT_MODELS,
   OAUTH_PROVIDERS,
+  coerceEnvValue,
   formatForOpenClawCli,
   getChannel,
+  getFlagDefinition,
   getFramework,
   isParseError,
+  listFlagDefinitions,
+  normalizeFlagValue,
   parseDeliveryTarget,
   registerFramework,
   resolveAvatarEnvUrl,
   wrapScheduledTaskPrompt
-} from "./chunk-5E5B4T7K.js";
+} from "./chunk-BC26YO7P.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -5642,14 +5646,14 @@ ${sections}`
     const augDir = join4(homeDir, ".augmented");
     const agents = /* @__PURE__ */ new Set();
     try {
-      const { readdirSync: readdirSync2, statSync } = await import("fs");
+      const { readdirSync: readdirSync2, statSync: statSync2 } = await import("fs");
       const entries = readdirSync2(augDir);
       for (const entry of entries) {
         if (entry.startsWith("_") || entry.startsWith("."))
           continue;
         const agentRoot = join4(augDir, entry);
         try {
-          if (!statSync(agentRoot).isDirectory())
+          if (!statSync2(agentRoot).isDirectory())
             continue;
         } catch {
           continue;
@@ -7342,6 +7346,200 @@ async function getHostId() {
   return hostId;
 }
 
+// src/lib/atomic-write.ts
+import { closeSync, fsyncSync, openSync, writeSync, renameSync as renameSync4, mkdirSync as mkdirSync6 } from "fs";
+import { dirname as dirname5 } from "path";
+function atomicWriteFileSync(path, data) {
+  const dirPath = dirname5(path);
+  const tmpPath = `${path}.tmp.${process.pid}.${Math.random().toString(36).slice(2, 8)}`;
+  try {
+    mkdirSync6(dirPath, { recursive: true });
+  } catch {
+  }
+  const fd = openSync(tmpPath, "w", 420);
+  try {
+    writeSync(fd, data);
+    try {
+      fsyncSync(fd);
+    } catch {
+    }
+  } finally {
+    closeSync(fd);
+  }
+  renameSync4(tmpPath, path);
+  try {
+    const dirFd = openSync(dirPath, "r");
+    try {
+      fsyncSync(dirFd);
+    } finally {
+      closeSync(dirFd);
+    }
+  } catch {
+  }
+}
+
+// src/lib/feature-flags-host.ts
+import { existsSync as existsSync7, readFileSync as readFileSync7, statSync } from "fs";
+import { join as join7 } from "path";
+function defaultFlagsCachePath(configDir) {
+  return join7(configDir, "flags-cache.json");
+}
+function readFlagsCache(path) {
+  try {
+    if (!existsSync7(path)) return null;
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return null;
+    const obj = parsed;
+    const flags = obj["flags"];
+    if (!flags || typeof flags !== "object") return null;
+    return {
+      schema_version: typeof obj["schema_version"] === "string" ? obj["schema_version"] : "",
+      updated_at: typeof obj["updated_at"] === "string" ? obj["updated_at"] : "",
+      flags: { ...flags }
+    };
+  } catch {
+    return null;
+  }
+}
+function writeFlagsCache(path, file) {
+  atomicWriteFileSync(path, `${JSON.stringify(file, null, 2)}
+`);
+}
+function flagsCacheAgeSeconds(cache, path, now = /* @__PURE__ */ new Date()) {
+  const fromRecorded = Date.parse(cache.updated_at);
+  if (!Number.isNaN(fromRecorded)) {
+    return Math.max(0, (now.getTime() - fromRecorded) / 1e3);
+  }
+  try {
+    return Math.max(0, (now.getTime() - statSync(path).mtimeMs) / 1e3);
+  } catch {
+    return null;
+  }
+}
+function resolveFlagFromLayers(definition, heartbeatFlags, env) {
+  const envValue = definition.envVar ? coerceEnvValue(definition, env[definition.envVar]) : void 0;
+  const hbValue = heartbeatFlags ? normalizeFlagValue(definition, heartbeatFlags[definition.key]) : void 0;
+  if (envValue !== void 0) {
+    return {
+      key: definition.key,
+      value: envValue,
+      source: "env",
+      envVar: definition.envVar,
+      envMasksHeartbeat: hbValue !== void 0 && hbValue !== envValue
+    };
+  }
+  if (hbValue !== void 0) {
+    return { key: definition.key, value: hbValue, source: "heartbeat-cache" };
+  }
+  return { key: definition.key, value: definition.defaultValue, source: "default" };
+}
+function resolveAllFlags(heartbeatFlags, env = process.env) {
+  return listFlagDefinitions().map(
+    (definition) => resolveFlagFromLayers(definition, heartbeatFlags, env)
+  );
+}
+var HostFlagStore = class {
+  heartbeatFlags = {};
+  cachePath;
+  log;
+  env;
+  initialised = false;
+  constructor(opts) {
+    this.cachePath = opts.cachePath;
+    this.log = opts.log ?? (() => {
+    });
+    this.env = opts.env ?? process.env;
+  }
+  /**
+   * Boot-time hydrate from the last-known-good cache. Cached values are used
+   * only until the first successful heartbeat; the cache age is logged so a
+   * stale `flags-cache.json` is visible (ADR-0022 §5 restart-with-stale-cache).
+   */
+  init(now = /* @__PURE__ */ new Date()) {
+    if (this.initialised) return;
+    this.initialised = true;
+    const cached = readFlagsCache(this.cachePath);
+    if (!cached) {
+      this.log("[flags] no last-known-good cache on disk; using compiled defaults until first heartbeat");
+      return;
+    }
+    this.heartbeatFlags = { ...cached.flags };
+    const ageSeconds = flagsCacheAgeSeconds(cached, this.cachePath, now);
+    const age = ageSeconds === null ? "unknown" : `${Math.round(ageSeconds)}s`;
+    const schema = cached.schema_version || "unknown";
+    this.log(
+      `[flags] loaded last-known-good cache (age: ${age}, schema: ${schema}); using cached values until first heartbeat`
+    );
+  }
+  /**
+   * Merge a heartbeat flag map: log per-flag transitions and env-masking warns,
+   * replace the in-memory map (full map; unknown keys kept), and persist it.
+   * A missing/non-object map is a no-op so an older API that omits the field
+   * doesn't blow away a good cache.
+   */
+  applyHeartbeat(map, schemaVersion) {
+    if (!map || typeof map !== "object") return;
+    const previous = this.heartbeatFlags;
+    for (const definition of listFlagDefinitions()) {
+      const before = normalizeFlagValue(definition, previous[definition.key]);
+      const after = normalizeFlagValue(definition, map[definition.key]);
+      if (after !== void 0 && after !== before) {
+        this.log(
+          `[flags] ${definition.key}: ${before ?? "(default)"} -> ${after} (source: heartbeat)`
+        );
+      }
+      if (definition.envVar) {
+        const envValue = coerceEnvValue(definition, this.env[definition.envVar]);
+        if (envValue !== void 0 && after !== void 0 && envValue !== after) {
+          this.log(
+            `[flags] WARN env override ${definition.envVar}=${envValue} is masking heartbeat value ${after} for '${definition.key}' (env wins until unset)`
+          );
+        }
+      }
+    }
+    this.heartbeatFlags = { ...map };
+    try {
+      writeFlagsCache(this.cachePath, {
+        schema_version: schemaVersion ?? "",
+        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        flags: this.heartbeatFlags
+      });
+    } catch (err) {
+      this.log(`[flags] cache write failed: ${err.message}`);
+    }
+  }
+  /** Resolve one flag, or `undefined` if the key isn't registered. */
+  resolve(key) {
+    const definition = getFlagDefinition(key);
+    if (!definition) return void 0;
+    return resolveFlagFromLayers(definition, this.heartbeatFlags, this.env);
+  }
+  resolveAll() {
+    return resolveAllFlags(this.heartbeatFlags, this.env);
+  }
+  /**
+   * Typed boolean accessor. Falls back to the registry default for the key
+   * (and to `false` for an unknown/non-boolean key) so a caller can read a
+   * gate without null-checking.
+   */
+  getBoolean(key) {
+    const definition = getFlagDefinition(key);
+    const resolved = this.resolve(key);
+    if (resolved && typeof resolved.value === "boolean") return resolved.value;
+    return definition?.flagType === "boolean" ? definition.defaultValue : false;
+  }
+  /**
+   * Typed string accessor for enum flags. Falls back to the registry default
+   * (and to `''` for an unknown/non-enum key).
+   */
+  getString(key) {
+    const definition = getFlagDefinition(key);
+    const resolved = this.resolve(key);
+    if (resolved && typeof resolved.value === "string") return resolved.value;
+    return definition?.flagType === "enum" ? definition.defaultValue : "";
+  }
+};
+
 // ../../packages/core/dist/provisioning/provisioner.js
 import { createHash } from "crypto";
 function sha256(content) {
@@ -7363,26 +7561,26 @@ function provision(input, frameworkId = "openclaw") {
 
 // src/commands/manager.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync8, realpathSync } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync9, realpathSync } from "fs";
+import { join as join9 } from "path";
 import { homedir as homedir6, userInfo } from "os";
 import { spawn as spawn3 } from "child_process";
 
 // src/lib/watchdog.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync7, mkdirSync as mkdirSync6, openSync, closeSync, chmodSync as chmodSync6 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync8, mkdirSync as mkdirSync7, openSync as openSync2, closeSync as closeSync2, chmodSync as chmodSync6 } from "fs";
+import { join as join8 } from "path";
 import { spawn as spawn2, execFileSync } from "child_process";
-var DEFAULT_CONFIG_DIR = join7(process.env["HOME"] ?? "/tmp", ".augmented");
+var DEFAULT_CONFIG_DIR = join8(process.env["HOME"] ?? "/tmp", ".augmented");
 function getManagerPaths(configDir) {
   return {
-    pidFile: join7(configDir, "manager.pid"),
-    stateFile: join7(configDir, "manager-state.json"),
-    logFile: join7(configDir, "manager.log")
+    pidFile: join8(configDir, "manager.pid"),
+    stateFile: join8(configDir, "manager-state.json"),
+    logFile: join8(configDir, "manager.log")
   };
 }
 function ensureDir2(configDir) {
-  if (!existsSync7(configDir)) {
-    mkdirSync6(configDir, { recursive: true });
+  if (!existsSync8(configDir)) {
+    mkdirSync7(configDir, { recursive: true });
   }
 }
 function writePidFile(configDir, pid) {
@@ -7391,7 +7589,7 @@ function writePidFile(configDir, pid) {
 }
 function readPidFile(configDir) {
   try {
-    const raw = readFileSync7(getManagerPaths(configDir).pidFile, "utf-8").trim();
+    const raw = readFileSync8(getManagerPaths(configDir).pidFile, "utf-8").trim();
     const pid = parseInt(raw, 10);
     return isNaN(pid) ? null : pid;
   } catch {
@@ -7429,7 +7627,7 @@ function defaultPgrep() {
 }
 function readStateFile(configDir) {
   try {
-    const raw = readFileSync7(getManagerPaths(configDir).stateFile, "utf-8");
+    const raw = readFileSync8(getManagerPaths(configDir).stateFile, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -7461,7 +7659,7 @@ function startWatchdog(opts) {
   if (opts.detached) {
     ensureDir2(configDir);
     const { logFile } = getManagerPaths(configDir);
-    const logFd = openSync(logFile, "a", 384);
+    const logFd = openSync2(logFile, "a", 384);
     try {
       chmodSync6(logFile, 384);
     } catch {
@@ -7477,7 +7675,7 @@ function startWatchdog(opts) {
       }
     );
     child.unref();
-    closeSync(logFd);
+    closeSync2(logFd);
     if (!child.pid) {
       throw new Error("Failed to spawn detached manager process");
     }
@@ -7485,7 +7683,7 @@ function startWatchdog(opts) {
     const deadline = Date.now() + 5e3;
     const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
     while (Date.now() < deadline) {
-      if (existsSync7(pidFile)) {
+      if (existsSync8(pidFile)) {
         return { pid: child.pid };
       }
       if (child.exitCode !== null) {
@@ -7613,7 +7811,7 @@ function managerStartCommand(opts) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join8(homedir6(), ".augmented");
+  const configDir = opts.configDir ?? join9(homedir6(), ".augmented");
   if (opts.supervise) {
     if (json) {
       jsonOutput({ ok: false, error: "--supervise is not supported with --json" });
@@ -7709,7 +7907,7 @@ function runSupervisorLoop(intervalSec, configDir) {
 }
 async function managerStopCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join8(homedir6(), ".augmented");
+  const configDir = opts.configDir ?? join9(homedir6(), ".augmented");
   try {
     const result = await stopWatchdog(configDir);
     if (!result.stopped && !result.pid) {
@@ -7737,7 +7935,7 @@ async function managerStopCommand(opts = {}) {
 }
 function managerStatusCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join8(homedir6(), ".augmented");
+  const configDir = opts.configDir ?? join9(homedir6(), ".augmented");
   const status = getManagerStatus(configDir);
   if (!status) {
     if (json) {
@@ -7809,7 +8007,7 @@ function resolveStableAgtBin(rawPath) {
   if (!prefix || !formula) return rawPath;
   const candidates = [`${prefix}/bin/${formula}`, `${prefix}/bin/agt`];
   for (const candidate of candidates) {
-    if (!existsSync8(candidate)) continue;
+    if (!existsSync9(candidate)) continue;
     try {
       realpathSync(candidate);
       return candidate;
@@ -7829,7 +8027,7 @@ async function managerInstallCommand(opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join8(homedir6(), ".augmented");
+  const configDir = opts.configDir ?? join9(homedir6(), ".augmented");
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -7842,7 +8040,7 @@ async function managerInstallCommand(opts = {}) {
   if (process.platform === "darwin") {
     const home = homedir6();
     const protectedRoots = ["Documents", "Downloads", "Desktop", "Movies", "Music", "Pictures"];
-    const offending = protectedRoots.map((r) => join8(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
+    const offending = protectedRoots.map((r) => join9(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
     if (offending) {
       const msg = `agt binary at ${agtBin} sits inside a macOS TCC-protected folder (${offending}). launchd-spawned processes cannot read files there and the manager would EPERM on startup. Either install agt globally (\`npm install -g @integrity-labs/agt-cli\`) or copy the dist outside protected folders before running this command.`;
       if (json) jsonOutput({ ok: false, error: msg });
@@ -7910,7 +8108,7 @@ async function managerInstallSystemUnitCommand(opts = {}) {
     return;
   }
   const user = opts.user ?? "root";
-  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join8("/home", user, ".augmented"));
+  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join9("/home", user, ".augmented"));
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -8005,6 +8203,13 @@ export {
   warn,
   info,
   table,
+  atomicWriteFileSync,
+  defaultFlagsCachePath,
+  readFlagsCache,
+  flagsCacheAgeSeconds,
+  resolveFlagFromLayers,
+  resolveAllFlags,
+  HostFlagStore,
   provision,
   getManagerPaths,
   startWatchdog,
@@ -8017,4 +8222,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-F5ZAIJHI.js.map
+//# sourceMappingURL=chunk-O24XVAYZ.js.map