@integrity-labs/agt-cli 0.27.23 → 0.27.25

package/dist/lib/manager-worker.js

@@ -15,7 +15,7 @@ import {
   provisionOrientHook,
   provisionStopHook,
   requireHost
-} from "../chunk-RM4XYPLD.js";
+} from "../chunk-GI73VOGA.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -578,6 +578,37 @@ function decideChannelRestart(input) {
   return { restart: true, added, removed };
 }
 
+// src/lib/sender-policy-restart-decision.ts
+function decideSenderPolicyRestart(input) {
+  const {
+    previousHash,
+    currentHash,
+    sessionMode,
+    framework,
+    sessionHealthy,
+    channelSetRestartAlreadyScheduled
+  } = input;
+  if (previousHash === void 0) {
+    return { restart: false, firstPoll: true, changed: false };
+  }
+  if (previousHash === currentHash) {
+    return { restart: false, firstPoll: false, changed: false };
+  }
+  if (sessionMode !== "persistent") {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  if (framework !== "claude-code") {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  if (!sessionHealthy) {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  if (channelSetRestartAlreadyScheduled) {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  return { restart: true, firstPoll: false, changed: true };
+}
+
 // src/lib/restart-breaker.ts
 function reaperRestartBreakerReason(activeKeys) {
   return activeKeys.length >= 2 ? "mcp-presence-reaper" : void 0;
@@ -2210,6 +2241,16 @@ var agentState = {
   knownIntegrationHashes: /* @__PURE__ */ new Map(),
   knownManagedMcpHashes: /* @__PURE__ */ new Map(),
   knownManagedMcpStructure: /* @__PURE__ */ new Map(),
+  /**
+   * ENG-5858: hash of the effective sender_policy returned by
+   * /host/refresh for this agent. Tracked separately from
+   * `knownChannelConfigHashes` because the channel-cred hash is
+   * per-channel (cleared/rewritten per channel) whereas sender_policy is
+   * agent-wide. A change here triggers a session restart so the
+   * slack-channel / teams-channel MCP children pick up the new env vars
+   * (they read SLACK_SENDER_POLICY / MSTEAMS_SENDER_POLICY only at boot).
+   */
+  knownSenderPolicyHashes: /* @__PURE__ */ new Map(),
   // ---------------------------------------------------------------------------
   // codeName-keyed
   // ---------------------------------------------------------------------------
@@ -2239,6 +2280,7 @@ function clearAgentState(agentId, codeName) {
   agentState.knownIntegrationHashes.delete(agentId);
   agentState.knownManagedMcpHashes.delete(agentId);
   agentState.knownManagedMcpStructure.delete(agentId);
+  agentState.knownSenderPolicyHashes.delete(agentId);
   agentState.agentDisplayNames.delete(codeName);
   agentState.codeNameToAgentId.delete(codeName);
   let channelCacheMutated = false;
@@ -3166,7 +3208,7 @@ var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.23" : "dev";
+var agtCliVersion = true ? "0.27.25" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -4976,7 +5018,7 @@ async function processAgent(agent, agentStates) {
           const peersForHash = channelId === "telegram" ? extractCharterTelegramPeers(refreshData.charter?.raw_content ?? "", gateContext) : channelId === "slack" ? extractCharterSlackPeers(refreshData.charter?.raw_content ?? "", gateContext) : null;
           const sessionModeForHash = refreshData.agent.session_mode;
           const senderPolicyForHash = refreshData.sender_policy ?? null;
-          const CHANNEL_WRITE_VERSION = 7;
+          const CHANNEL_WRITE_VERSION = 8;
           const configHash = createHash3("sha256").update(
             canonicalJson({
               writeVersion: CHANNEL_WRITE_VERSION,
@@ -5069,6 +5111,46 @@ async function processAgent(agent, agentStates) {
     }
     scheduleSessionRestart(agent.code_name, delay, "new channel set");
   }
+  if (channelConfigConverged) {
+    const hasSenderPolicyChannel = currentChannelIds.has("slack") || currentChannelIds.has("msteams");
+    const senderPolicyForRestartHash = refreshData.sender_policy ?? null;
+    const senderPolicyHash = createHash3("sha256").update(canonicalJson({ senderPolicy: senderPolicyForRestartHash })).digest("hex");
+    const prevSenderPolicyHash = agentState.knownSenderPolicyHashes.get(agent.agent_id);
+    const senderPolicyDecision = hasSenderPolicyChannel ? decideSenderPolicyRestart({
+      previousHash: prevSenderPolicyHash,
+      currentHash: senderPolicyHash,
+      sessionMode: refreshData.agent.session_mode,
+      framework: agentFrameworkCache.get(agent.code_name) ?? "openclaw",
+      sessionHealthy: isSessionHealthy(agent.code_name),
+      channelSetRestartAlreadyScheduled: restartDecision.restart
+    }) : { restart: false, firstPoll: prevSenderPolicyHash === void 0, changed: false };
+    if (senderPolicyDecision.restart) {
+      log(
+        `[hot-reload] sender_policy changed for '${agent.code_name}' (${prevSenderPolicyHash?.slice(0, 8) ?? "first"} \u2192 ${senderPolicyHash.slice(0, 8)}) \u2014 restarting session`
+      );
+      const notice = "Your sender_policy has been updated. Restarting session shortly so the channel MCP servers pick up the new gate.";
+      const delivered = await injectMessage(
+        agent.code_name,
+        "system",
+        notice,
+        { task_name: "sender-policy-update" },
+        log
+      ).catch(() => false);
+      const delay = delivered ? 8e3 : 3e3;
+      if (!delivered) {
+        log(
+          `[hot-reload] Inject notification unconfirmed for '${agent.code_name}' \u2014 proceeding with shorter delay`
+        );
+      }
+      scheduleSessionRestart(
+        agent.code_name,
+        delay,
+        "sender_policy change",
+        "sender-policy-change"
+      );
+    }
+    agentState.knownSenderPolicyHashes.set(agent.agent_id, senderPolicyHash);
+  }
   const agentSessionMode = refreshData.agent.session_mode;
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? "openclaw") === "claude-code") {
     try {