@integrity-labs/agt-cli 0.27.4 → 0.27.7-test.5

package/dist/claude-code-updater-4E5T2X3Z.js

@@ -0,0 +1,208 @@
+import {
+  CLAUDE_AGENT_PROCESS_PATTERN,
+  parsePsRows
+} from "./chunk-XWVM4KPK.js";
+
+// src/lib/claude-code-updater.ts
+import { execFile, execFileSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var NPM_PKG = "@anthropic-ai/claude-code";
+var DEFAULT_INTERVAL_MS = 6 * 60 * 60 * 1e3;
+var DEFAULT_VERIFY_MISMATCH_THRESHOLD = 5;
+function intervalMs() {
+  const raw = Number.parseInt(process.env["AGT_CLAUDE_UPDATE_INTERVAL_MS"] ?? "", 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_INTERVAL_MS;
+}
+function verifyMismatchThreshold() {
+  const raw = Number.parseInt(process.env["AGT_CLAUDE_UPDATE_VERIFY_THRESHOLD"] ?? "", 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_VERIFY_MISMATCH_THRESHOLD;
+}
+function parseVersion(output) {
+  const m = output.match(/\d+\.\d+\.\d+[A-Za-z0-9.+-]*/);
+  return m ? m[0] : null;
+}
+function isConcreteVersion(spec) {
+  return /^\d+\.\d+\.\d+[A-Za-z0-9.+-]*$/.test(spec.trim());
+}
+var WELL_KNOWN_CLAUDE_PATHS = [
+  "/usr/bin/claude",
+  // Anthropic native autoupdater (Linux deb/rpm)
+  "/usr/local/bin/claude",
+  // npm global on macOS Intel + Linux without nvm
+  "/opt/homebrew/bin/claude",
+  // Homebrew on macOS Apple Silicon
+  "/home/linuxbrew/.linuxbrew/bin/claude"
+  // Linuxbrew (used on agt-aws-* hosts)
+];
+var lastCheckAt = 0;
+var multiInstallWarned = false;
+var verifyMismatchState = null;
+function _resetClaudeCodeUpdaterState() {
+  lastCheckAt = 0;
+  multiInstallWarned = false;
+  verifyMismatchState = null;
+}
+function defaultPsSnapshot() {
+  return execFileSync("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", maxBuffer: 16 * 1024 * 1024 });
+}
+function defaultReadClaudeJson(path) {
+  try {
+    return readFileSync(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function hostHasLiveAgent(psOutput) {
+  return parsePsRows(psOutput).some((r) => CLAUDE_AGENT_PROCESS_PATTERN.test(r.args));
+}
+function readsAsNativeInstall(raw) {
+  if (!raw) return false;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed.installMethod === "native";
+  } catch {
+    return false;
+  }
+}
+async function resolveInstallTargetPath(run) {
+  try {
+    const { stdout } = await run("npm", ["prefix", "-g"]);
+    const prefix = stdout.trim();
+    if (!prefix) return null;
+    return `${prefix}/bin/claude`;
+  } catch {
+    return null;
+  }
+}
+async function probeClaudeInstalls(run, fileExists, home) {
+  const candidates = new Set(WELL_KNOWN_CLAUDE_PATHS);
+  candidates.add(`${home}/.claude/local/claude`);
+  try {
+    const { stdout } = await run("which", ["claude"]);
+    const p = stdout.trim().split("\n")[0]?.trim();
+    if (p) candidates.add(p);
+  } catch {
+  }
+  const results = [];
+  for (const p of candidates) {
+    if (!fileExists(p)) continue;
+    let version = null;
+    try {
+      const { stdout } = await run(p, ["--version"]);
+      version = parseVersion(stdout);
+    } catch {
+    }
+    results.push({ path: p, version });
+  }
+  return results;
+}
+async function maybeUpdateClaudeCode(deps) {
+  const now = deps.now ? deps.now() : Date.now();
+  const run = deps.runCommand ?? ((cmd, args) => execFileAsync(cmd, args, { maxBuffer: 16 * 1024 * 1024 }));
+  const ps = deps.psSnapshot ?? defaultPsSnapshot;
+  const fileExists = deps.fileExists ?? existsSync;
+  const readClaudeJson = deps.readClaudeJson ?? defaultReadClaudeJson;
+  const home = (deps.homeDir ?? homedir)();
+  const { log } = deps;
+  if (now - lastCheckAt < intervalMs()) {
+    return { action: "throttled" };
+  }
+  lastCheckAt = now;
+  try {
+    const spec = (deps.desiredVersion || "latest").trim();
+    if (!multiInstallWarned) {
+      const installs = await probeClaudeInstalls(run, fileExists, home);
+      if (installs.length > 1) {
+        const summary = installs.map((i) => `${i.path}=${i.version ?? "unknown"}`).join(", ");
+        log(`[claude-code-updater] multiple claude installs detected: ${summary}`);
+      }
+      multiInstallWarned = true;
+    }
+    if (readsAsNativeInstall(readClaudeJson(`${home}/.claude.json`))) {
+      log("[claude-code-updater] native install detected, deferring to Anthropic autoupdater");
+      verifyMismatchState = null;
+      return { action: "skipped_native_install", target: spec };
+    }
+    let target;
+    if (isConcreteVersion(spec)) {
+      target = spec;
+    } else {
+      const { stdout } = await run("npm", ["view", `${NPM_PKG}@${spec}`, "version"]);
+      const resolved = parseVersion(stdout);
+      if (!resolved) {
+        log(`[claude-code-updater] could not resolve ${NPM_PKG}@${spec} to a version; skipping`);
+        return { action: "failed", reason: "unresolved_target" };
+      }
+      target = resolved;
+    }
+    let current = deps.currentVersion ?? null;
+    if (!current) {
+      try {
+        const { stdout } = await run("claude", ["--version"]);
+        current = parseVersion(stdout);
+      } catch {
+        current = null;
+      }
+    }
+    if (current && current === target) {
+      if (verifyMismatchState && verifyMismatchState.target === target) {
+        verifyMismatchState = null;
+      }
+      return { action: "up_to_date", version: target };
+    }
+    if (hostHasLiveAgent(ps())) {
+      log(`[claude-code-updater] host busy (live agent) \u2014 deferring update to ${target} to a later cycle`);
+      return { action: "deferred_busy", target };
+    }
+    const installTargetPath = await resolveInstallTargetPath(run);
+    log(`[claude-code-updater] updating Claude Code ${current ?? "(none)"} \u2192 ${target}`);
+    await run("npm", ["install", "-g", `${NPM_PKG}@${target}`]);
+    const verifyTarget = installTargetPath ?? "claude";
+    let installed = null;
+    try {
+      const { stdout } = await run(verifyTarget, ["--version"]);
+      installed = parseVersion(stdout);
+    } catch {
+      installed = null;
+    }
+    if (installed !== target) {
+      log(
+        `[claude-code-updater] post-install verify mismatch: expected ${target}, got ${installed ?? "unknown"} from ${verifyTarget}`
+      );
+      if (!verifyMismatchState || verifyMismatchState.target !== target) {
+        verifyMismatchState = { target, count: 1, alarmed: false };
+      } else {
+        verifyMismatchState.count += 1;
+      }
+      const threshold = verifyMismatchThreshold();
+      if (verifyMismatchState.count >= threshold && !verifyMismatchState.alarmed) {
+        verifyMismatchState.alarmed = true;
+        log(
+          `[claude-code-updater] ERROR verify_mismatch_stuck: ${verifyMismatchState.count} consecutive verify failures for target ${target} (verify path: ${verifyTarget}) \u2014 install is not taking effect, investigate host install slots`
+        );
+        return { action: "failed", reason: "verify_mismatch_threshold" };
+      }
+      return { action: "failed", reason: "verify_mismatch" };
+    }
+    verifyMismatchState = null;
+    log(`[claude-code-updater] updated Claude Code ${current ?? "(none)"} \u2192 ${installed}`);
+    return { action: "updated", from: current, to: installed };
+  } catch (err) {
+    log(`[claude-code-updater] update attempt failed: ${err instanceof Error ? err.message : String(err)}`);
+    return { action: "failed", reason: "exception" };
+  }
+}
+export {
+  WELL_KNOWN_CLAUDE_PATHS,
+  _resetClaudeCodeUpdaterState,
+  hostHasLiveAgent,
+  isConcreteVersion,
+  maybeUpdateClaudeCode,
+  parseVersion,
+  probeClaudeInstalls,
+  readsAsNativeInstall
+};
+//# sourceMappingURL=claude-code-updater-4E5T2X3Z.js.map

package/dist/claude-code-updater-4E5T2X3Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/claude-code-updater.ts"],"sourcesContent":["// ENG-5672: idle-gated, server-pinned Claude Code auto-updater.\n// ENG-5798: multi-install drift handling — detect coexisting claude binaries,\n//           short-circuit on native autoupdater hosts, verify against absolute\n//           install path, hard-error after N consecutive verify mismatches.\n//\n// Hosts install @anthropic-ai/claude-code once at bootstrap (host-bootstrap.ts)\n// and never refresh it, so a long-lived host runs a stale Claude Code forever.\n// This module brings a host to its *desired* version, which the server pins via\n// /host/refresh (per-host override, else fleet default, else 'latest').\n//\n// Safety properties (this runs npm install -g on live prod hosts):\n//   • Idle-gated — we never install while a `claude --name agt-*` agent process\n//     is running on the host (a running process holds the old binary anyway;\n//     replacing it under a live session is pointless and risky). Busy → defer\n//     to a later cycle.\n//   • No-op when already on target — a concrete target equal to the installed\n//     version short-circuits; a dist-tag ('latest') is resolved to a concrete\n//     version via `npm view` and compared, so we don't reinstall every cycle.\n//   • Host-global throttle — at most one check per interval (default 6h), so the\n//     manager's ~10-30s poll doesn't shell out to npm/ps constantly.\n//   • Log-and-continue — every failure is logged and swallowed; an error here\n//     must never break the manager poll cycle.\n//   • Multi-install awareness (ENG-5798) — on hosts where Anthropic's native\n//     autoupdater owns /usr/bin/claude, this updater short-circuits cleanly\n//     instead of fighting it. On hosts where multiple binaries coexist (e.g. a\n//     brew cask alongside the npm global), we log every path+version once so\n//     drift is visible in manager.log without spamming every cycle.\n//\n// The *installed* version is reported separately as hosts.framework_version\n// (the claude-code framework adapter's getVersion() == `claude --version`), so\n// this module does not report it itself.\n\nimport { execFile, execFileSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { promisify } from 'node:util';\nimport { parsePsRows, CLAUDE_AGENT_PROCESS_PATTERN } from './orphan-channel-mcp-reaper.js';\n\nconst execFileAsync = promisify(execFile);\n\nconst NPM_PKG = '@anthropic-ai/claude-code';\n\n/** Default host-global check interval. Overridable via env for tuning. */\nconst DEFAULT_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6h\n\n/**\n * ENG-5798: After this many consecutive verify mismatches against the same\n * target version, emit a distinct one-shot error code that the\n * synthetic-probe / CloudWatch alarm pipeline can latch onto, instead of\n * silently re-failing forever. Overridable via env for testing.\n */\nconst DEFAULT_VERIFY_MISMATCH_THRESHOLD = 5;\n\nfunction intervalMs(): number {\n  const raw = Number.parseInt(process.env['AGT_CLAUDE_UPDATE_INTERVAL_MS'] ?? '', 10);\n  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_INTERVAL_MS;\n}\n\nfunction verifyMismatchThreshold(): number {\n  const raw = Number.parseInt(process.env['AGT_CLAUDE_UPDATE_VERIFY_THRESHOLD'] ?? '', 10);\n  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_VERIFY_MISMATCH_THRESHOLD;\n}\n\n/** Extract a version string (leading semver) from `claude --version` / npm output. */\nexport function parseVersion(output: string): string | null {\n  const m = output.match(/\\d+\\.\\d+\\.\\d+[A-Za-z0-9.+-]*/);\n  return m ? m[0] : null;\n}\n\n/** A target spec is \"concrete\" when it already names an exact version. */\nexport function isConcreteVersion(spec: string): boolean {\n  return /^\\d+\\.\\d+\\.\\d+[A-Za-z0-9.+-]*$/.test(spec.trim());\n}\n\n/**\n * Well-known absolute paths where a `claude` binary may live on managed hosts.\n * Probed alongside the PATH-resolved binary so we can see all install slots,\n * even ones not on the manager systemd unit's PATH.\n */\nexport const WELL_KNOWN_CLAUDE_PATHS: readonly string[] = [\n  '/usr/bin/claude', // Anthropic native autoupdater (Linux deb/rpm)\n  '/usr/local/bin/claude', // npm global on macOS Intel + Linux without nvm\n  '/opt/homebrew/bin/claude', // Homebrew on macOS Apple Silicon\n  '/home/linuxbrew/.linuxbrew/bin/claude', // Linuxbrew (used on agt-aws-* hosts)\n];\n\nexport interface ClaudeCodeUpdaterDeps {\n  /** Server-pinned target: a concrete version or an npm dist-tag like 'latest'. */\n  desiredVersion: string;\n  /** Currently-installed version, if the caller already knows it (e.g. the\n   *  manager's cachedFrameworkVersion). When omitted we run `claude --version`. */\n  currentVersion?: string | null;\n  log: (msg: string) => void;\n  /** Override \"now\" for tests. */\n  now?: () => number;\n  /** Run a command; injected in tests. Defaults to execFile. */\n  runCommand?: (cmd: string, args: string[]) => Promise<{ stdout: string; stderr: string }>;\n  /** Raw `ps -eo pid,ppid,args` snapshot; injected in tests. */\n  psSnapshot?: () => string;\n  /** Sync existence probe for binary detection; injected in tests. */\n  fileExists?: (path: string) => boolean;\n  /** Read ~/.claude.json contents (raw); returns null when absent. Injected in tests. */\n  readClaudeJson?: (path: string) => string | null;\n  /** Resolve the user's home directory; injected in tests. */\n  homeDir?: () => string;\n}\n\nexport type UpdaterOutcome =\n  | { action: 'throttled' }\n  | { action: 'up_to_date'; version: string }\n  | { action: 'deferred_busy'; target: string }\n  | { action: 'skipped_native_install'; target: string }\n  | { action: 'updated'; from: string | null; to: string }\n  | { action: 'failed'; reason: string };\n\n// ── Host-global state (module-level; one updater per host process) ──────────\nlet lastCheckAt = 0;\n/** Per-process one-shot guard for the multi-install warn line. */\nlet multiInstallWarned = false;\n/**\n * Sticky counter for consecutive `post-install verify mismatch` against the\n * same target version. Reset on success, on target change, or after the\n * threshold error has been emitted (so we emit it exactly once per stuck run).\n */\nlet verifyMismatchState: { target: string; count: number; alarmed: boolean } | null = null;\n\n/** Test helper — reset module state. Not for production use. */\nexport function _resetClaudeCodeUpdaterState(): void {\n  lastCheckAt = 0;\n  multiInstallWarned = false;\n  verifyMismatchState = null;\n}\n\nfunction defaultPsSnapshot(): string {\n  return execFileSync('ps', ['-eo', 'pid,ppid,args'], { encoding: 'utf-8', maxBuffer: 16 * 1024 * 1024 });\n}\n\nfunction defaultReadClaudeJson(path: string): string | null {\n  try {\n    return readFileSync(path, 'utf-8');\n  } catch {\n    return null;\n  }\n}\n\n/** True when at least one `claude --name agt-*` agent process is live. */\nexport function hostHasLiveAgent(psOutput: string): boolean {\n  return parsePsRows(psOutput).some((r) => CLAUDE_AGENT_PROCESS_PATTERN.test(r.args));\n}\n\n/**\n * ENG-5798: returns true when ~/.claude.json reports `installMethod: \"native\"`,\n * meaning Anthropic's native autoupdater owns the on-disk binary. In that case\n * the brew/npm update path is actively harmful — it installs a second binary\n * the host's PATH never resolves to, and verify reads from yet a third.\n */\nexport function readsAsNativeInstall(raw: string | null): boolean {\n  if (!raw) return false;\n  try {\n    const parsed = JSON.parse(raw) as { installMethod?: unknown };\n    return parsed.installMethod === 'native';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Resolve the absolute filesystem path that `npm install -g <pkg>` will write\n * the `claude` binary to. Returns null when `npm prefix -g` fails or is empty,\n * in which case the caller should fall back to PATH-based verify.\n *\n * We deliberately use `npm prefix -g` rather than `which claude` because the\n * latter resolves through PATH, which on agt-aws-* hosts can land on\n * /usr/bin/claude (the native autoupdater slot) — exactly the misalignment\n * ENG-5798 is fixing.\n */\nasync function resolveInstallTargetPath(\n  run: (cmd: string, args: string[]) => Promise<{ stdout: string; stderr: string }>,\n): Promise<string | null> {\n  try {\n    const { stdout } = await run('npm', ['prefix', '-g']);\n    const prefix = stdout.trim();\n    if (!prefix) return null;\n    return `${prefix}/bin/claude`;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Enumerate every `claude` binary visible to the host: PATH-resolved + the\n * well-known absolute slots + `~/.claude/local/claude`. Returns one entry per\n * unique resolved path with the version each reports (or null if it failed to\n * execute). Used purely for the one-shot drift warn line.\n */\nexport async function probeClaudeInstalls(\n  run: (cmd: string, args: string[]) => Promise<{ stdout: string; stderr: string }>,\n  fileExists: (path: string) => boolean,\n  home: string,\n): Promise<Array<{ path: string; version: string | null }>> {\n  const candidates = new Set<string>(WELL_KNOWN_CLAUDE_PATHS);\n  candidates.add(`${home}/.claude/local/claude`);\n  // PATH-resolved. `which` is portable enough across the Linux + macOS hosts\n  // we target; errors here just mean \"no claude on PATH\", which is fine.\n  try {\n    const { stdout } = await run('which', ['claude']);\n    const p = stdout.trim().split('\\n')[0]?.trim();\n    if (p) candidates.add(p);\n  } catch {\n    /* no-op */\n  }\n\n  const results: Array<{ path: string; version: string | null }> = [];\n  for (const p of candidates) {\n    if (!fileExists(p)) continue;\n    let version: string | null = null;\n    try {\n      const { stdout } = await run(p, ['--version']);\n      version = parseVersion(stdout);\n    } catch {\n      /* binary exists but failed to execute — record path with null version */\n    }\n    results.push({ path: p, version });\n  }\n  return results;\n}\n\n/**\n * Bring Claude Code to the desired version if the host is idle and not already\n * on target. Safe to call every manager poll — internally throttled. Returns an\n * outcome describing what happened (for logging/observability/tests).\n */\nexport async function maybeUpdateClaudeCode(deps: ClaudeCodeUpdaterDeps): Promise<UpdaterOutcome> {\n  const now = deps.now ? deps.now() : Date.now();\n  const run = deps.runCommand ?? ((cmd, args) => execFileAsync(cmd, args, { maxBuffer: 16 * 1024 * 1024 }));\n  const ps = deps.psSnapshot ?? defaultPsSnapshot;\n  const fileExists = deps.fileExists ?? existsSync;\n  const readClaudeJson = deps.readClaudeJson ?? defaultReadClaudeJson;\n  const home = (deps.homeDir ?? homedir)();\n  const { log } = deps;\n\n  // 1. Host-global throttle.\n  if (now - lastCheckAt < intervalMs()) {\n    return { action: 'throttled' };\n  }\n  lastCheckAt = now;\n\n  try {\n    const spec = (deps.desiredVersion || 'latest').trim();\n\n    // 2. ENG-5798 multi-install drift detection. Emit one warn line per\n    //    process listing every claude binary + version we can see. This is\n    //    independent of the install decision below — even on hosts where we\n    //    proceed normally, surfacing drift is the difference between a 3-day\n    //    silent loop and a one-line lead.\n    if (!multiInstallWarned) {\n      const installs = await probeClaudeInstalls(run, fileExists, home);\n      if (installs.length > 1) {\n        const summary = installs\n          .map((i) => `${i.path}=${i.version ?? 'unknown'}`)\n          .join(', ');\n        log(`[claude-code-updater] multiple claude installs detected: ${summary}`);\n      }\n      multiInstallWarned = true;\n    }\n\n    // 3. ENG-5798 native-install short-circuit. When Anthropic's native\n    //    autoupdater owns the host binary, the brew/npm update path is\n    //    actively harmful (it installs a second binary the manager's PATH\n    //    never resolves to, then verifies against yet a third). Defer.\n    if (readsAsNativeInstall(readClaudeJson(`${home}/.claude.json`))) {\n      // One-shot info line per process — same throttle as the warn above, but\n      // we re-use the throttle window to keep this from logging every poll.\n      log('[claude-code-updater] native install detected, deferring to Anthropic autoupdater');\n      // Reset any sticky verify-mismatch state — it can't apply once we stop\n      // attempting installs.\n      verifyMismatchState = null;\n      return { action: 'skipped_native_install', target: spec };\n    }\n\n    // 4. Resolve the target to a concrete version (read-only). A concrete spec\n    //    is its own target; a dist-tag is resolved via `npm view`.\n    let target: string;\n    if (isConcreteVersion(spec)) {\n      target = spec;\n    } else {\n      const { stdout } = await run('npm', ['view', `${NPM_PKG}@${spec}`, 'version']);\n      const resolved = parseVersion(stdout);\n      if (!resolved) {\n        log(`[claude-code-updater] could not resolve ${NPM_PKG}@${spec} to a version; skipping`);\n        return { action: 'failed', reason: 'unresolved_target' };\n      }\n      target = resolved;\n    }\n\n    // 5. Determine the installed version (prefer the caller's cached value).\n    let current = deps.currentVersion ?? null;\n    if (!current) {\n      try {\n        const { stdout } = await run('claude', ['--version']);\n        current = parseVersion(stdout);\n      } catch {\n        current = null; // claude missing/broken — treat as \"needs install\".\n      }\n    }\n\n    // 6. Already on target → nothing to do.\n    if (current && current === target) {\n      // Successful no-op — clear sticky verify mismatch state for this target.\n      if (verifyMismatchState && verifyMismatchState.target === target) {\n        verifyMismatchState = null;\n      }\n      return { action: 'up_to_date', version: target };\n    }\n\n    // 7. Idle gate — never replace the binary under a live agent session.\n    if (hostHasLiveAgent(ps())) {\n      log(`[claude-code-updater] host busy (live agent) — deferring update to ${target} to a later cycle`);\n      return { action: 'deferred_busy', target };\n    }\n\n    // 8. Install the target, then verify against the *absolute* path of the\n    //    binary npm just wrote — not via PATH. PATH resolution is the original\n    //    ENG-5798 bug: on hosts with multiple claude installs, PATH lands on a\n    //    different binary than the one npm overwrites, so verify never agrees.\n    const installTargetPath = await resolveInstallTargetPath(run);\n    log(`[claude-code-updater] updating Claude Code ${current ?? '(none)'} → ${target}`);\n    await run('npm', ['install', '-g', `${NPM_PKG}@${target}`]);\n\n    // Prefer the absolute install target; fall back to PATH only when\n    // `npm prefix -g` failed (in which case verify is best-effort).\n    const verifyTarget = installTargetPath ?? 'claude';\n    let installed: string | null = null;\n    try {\n      const { stdout } = await run(verifyTarget, ['--version']);\n      installed = parseVersion(stdout);\n    } catch {\n      installed = null;\n    }\n\n    if (installed !== target) {\n      log(\n        `[claude-code-updater] post-install verify mismatch: expected ${target}, got ${installed ?? 'unknown'} from ${verifyTarget}`,\n      );\n\n      // ENG-5798: hard-error after N consecutive mismatches against the same\n      // target. Reset the counter when the target changes — a new pin is a\n      // new event, not a continuation of the old stuck run.\n      if (!verifyMismatchState || verifyMismatchState.target !== target) {\n        verifyMismatchState = { target, count: 1, alarmed: false };\n      } else {\n        verifyMismatchState.count += 1;\n      }\n\n      const threshold = verifyMismatchThreshold();\n      if (verifyMismatchState.count >= threshold && !verifyMismatchState.alarmed) {\n        verifyMismatchState.alarmed = true;\n        log(\n          `[claude-code-updater] ERROR verify_mismatch_stuck: ${verifyMismatchState.count} consecutive verify failures for target ${target} (verify path: ${verifyTarget}) — install is not taking effect, investigate host install slots`,\n        );\n        return { action: 'failed', reason: 'verify_mismatch_threshold' };\n      }\n      return { action: 'failed', reason: 'verify_mismatch' };\n    }\n\n    // Successful install — clear sticky state.\n    verifyMismatchState = null;\n    log(`[claude-code-updater] updated Claude Code ${current ?? '(none)'} → ${installed}`);\n    return { action: 'updated', from: current, to: installed };\n  } catch (err) {\n    // Log-and-continue: an updater failure must never break the manager tick.\n    log(`[claude-code-updater] update attempt failed: ${err instanceof Error ? err.message : String(err)}`);\n    return { action: 'failed', reason: 'exception' };\n  }\n}\n"],"mappings":";;;;;;AAgCA,SAAS,UAAU,oBAAoB;AACvC,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AACxB,SAAS,iBAAiB;AAG1B,IAAM,gBAAgB,UAAU,QAAQ;AAExC,IAAM,UAAU;AAGhB,IAAM,sBAAsB,IAAI,KAAK,KAAK;AAQ1C,IAAM,oCAAoC;AAE1C,SAAS,aAAqB;AAC5B,QAAM,MAAM,OAAO,SAAS,QAAQ,IAAI,+BAA+B,KAAK,IAAI,EAAE;AAClF,SAAO,OAAO,SAAS,GAAG,KAAK,MAAM,IAAI,MAAM;AACjD;AAEA,SAAS,0BAAkC;AACzC,QAAM,MAAM,OAAO,SAAS,QAAQ,IAAI,oCAAoC,KAAK,IAAI,EAAE;AACvF,SAAO,OAAO,SAAS,GAAG,KAAK,MAAM,IAAI,MAAM;AACjD;AAGO,SAAS,aAAa,QAA+B;AAC1D,QAAM,IAAI,OAAO,MAAM,8BAA8B;AACrD,SAAO,IAAI,EAAE,CAAC,IAAI;AACpB;AAGO,SAAS,kBAAkB,MAAuB;AACvD,SAAO,iCAAiC,KAAK,KAAK,KAAK,CAAC;AAC1D;AAOO,IAAM,0BAA6C;AAAA,EACxD;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAgCA,IAAI,cAAc;AAElB,IAAI,qBAAqB;AAMzB,IAAI,sBAAkF;AAG/E,SAAS,+BAAqC;AACnD,gBAAc;AACd,uBAAqB;AACrB,wBAAsB;AACxB;AAEA,SAAS,oBAA4B;AACnC,SAAO,aAAa,MAAM,CAAC,OAAO,eAAe,GAAG,EAAE,UAAU,SAAS,WAAW,KAAK,OAAO,KAAK,CAAC;AACxG;AAEA,SAAS,sBAAsB,MAA6B;AAC1D,MAAI;AACF,WAAO,aAAa,MAAM,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,UAA2B;AAC1D,SAAO,YAAY,QAAQ,EAAE,KAAK,CAAC,MAAM,6BAA6B,KAAK,EAAE,IAAI,CAAC;AACpF;AAQO,SAAS,qBAAqB,KAA6B;AAChE,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,WAAO,OAAO,kBAAkB;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYA,eAAe,yBACb,KACwB;AACxB,MAAI;AACF,UAAM,EAAE,OAAO,IAAI,MAAM,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC;AACpD,UAAM,SAAS,OAAO,KAAK;AAC3B,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,GAAG,MAAM;AAAA,EAClB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,oBACpB,KACA,YACA,MAC0D;AAC1D,QAAM,aAAa,IAAI,IAAY,uBAAuB;AAC1D,aAAW,IAAI,GAAG,IAAI,uBAAuB;AAG7C,MAAI;AACF,UAAM,EAAE,OAAO,IAAI,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC;AAChD,UAAM,IAAI,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,GAAG,KAAK;AAC7C,QAAI,EAAG,YAAW,IAAI,CAAC;AAAA,EACzB,QAAQ;AAAA,EAER;AAEA,QAAM,UAA2D,CAAC;AAClE,aAAW,KAAK,YAAY;AAC1B,QAAI,CAAC,WAAW,CAAC,EAAG;AACpB,QAAI,UAAyB;AAC7B,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC;AAC7C,gBAAU,aAAa,MAAM;AAAA,IAC/B,QAAQ;AAAA,IAER;AACA,YAAQ,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;AAAA,EACnC;AACA,SAAO;AACT;AAOA,eAAsB,sBAAsB,MAAsD;AAChG,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI;AAC7C,QAAM,MAAM,KAAK,eAAe,CAAC,KAAK,SAAS,cAAc,KAAK,MAAM,EAAE,WAAW,KAAK,OAAO,KAAK,CAAC;AACvG,QAAM,KAAK,KAAK,cAAc;AAC9B,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,QAAQ,KAAK,WAAW,SAAS;AACvC,QAAM,EAAE,IAAI,IAAI;AAGhB,MAAI,MAAM,cAAc,WAAW,GAAG;AACpC,WAAO,EAAE,QAAQ,YAAY;AAAA,EAC/B;AACA,gBAAc;AAEd,MAAI;AACF,UAAM,QAAQ,KAAK,kBAAkB,UAAU,KAAK;AAOpD,QAAI,CAAC,oBAAoB;AACvB,YAAM,WAAW,MAAM,oBAAoB,KAAK,YAAY,IAAI;AAChE,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,UAAU,SACb,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,EAAE,WAAW,SAAS,EAAE,EAChD,KAAK,IAAI;AACZ,YAAI,4DAA4D,OAAO,EAAE;AAAA,MAC3E;AACA,2BAAqB;AAAA,IACvB;AAMA,QAAI,qBAAqB,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG;AAGhE,UAAI,mFAAmF;AAGvF,4BAAsB;AACtB,aAAO,EAAE,QAAQ,0BAA0B,QAAQ,KAAK;AAAA,IAC1D;AAIA,QAAI;AACJ,QAAI,kBAAkB,IAAI,GAAG;AAC3B,eAAS;AAAA,IACX,OAAO;AACL,YAAM,EAAE,OAAO,IAAI,MAAM,IAAI,OAAO,CAAC,QAAQ,GAAG,OAAO,IAAI,IAAI,IAAI,SAAS,CAAC;AAC7E,YAAM,WAAW,aAAa,MAAM;AACpC,UAAI,CAAC,UAAU;AACb,YAAI,2CAA2C,OAAO,IAAI,IAAI,yBAAyB;AACvF,eAAO,EAAE,QAAQ,UAAU,QAAQ,oBAAoB;AAAA,MACzD;AACA,eAAS;AAAA,IACX;AAGA,QAAI,UAAU,KAAK,kBAAkB;AACrC,QAAI,CAAC,SAAS;AACZ,UAAI;AACF,cAAM,EAAE,OAAO,IAAI,MAAM,IAAI,UAAU,CAAC,WAAW,CAAC;AACpD,kBAAU,aAAa,MAAM;AAAA,MAC/B,QAAQ;AACN,kBAAU;AAAA,MACZ;AAAA,IACF;AAGA,QAAI,WAAW,YAAY,QAAQ;AAEjC,UAAI,uBAAuB,oBAAoB,WAAW,QAAQ;AAChE,8BAAsB;AAAA,MACxB;AACA,aAAO,EAAE,QAAQ,cAAc,SAAS,OAAO;AAAA,IACjD;AAGA,QAAI,iBAAiB,GAAG,CAAC,GAAG;AAC1B,UAAI,2EAAsE,MAAM,mBAAmB;AACnG,aAAO,EAAE,QAAQ,iBAAiB,OAAO;AAAA,IAC3C;AAMA,UAAM,oBAAoB,MAAM,yBAAyB,GAAG;AAC5D,QAAI,8CAA8C,WAAW,QAAQ,WAAM,MAAM,EAAE;AACnF,UAAM,IAAI,OAAO,CAAC,WAAW,MAAM,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;AAI1D,UAAM,eAAe,qBAAqB;AAC1C,QAAI,YAA2B;AAC/B,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC;AACxD,kBAAY,aAAa,MAAM;AAAA,IACjC,QAAQ;AACN,kBAAY;AAAA,IACd;AAEA,QAAI,cAAc,QAAQ;AACxB;AAAA,QACE,gEAAgE,MAAM,SAAS,aAAa,SAAS,SAAS,YAAY;AAAA,MAC5H;AAKA,UAAI,CAAC,uBAAuB,oBAAoB,WAAW,QAAQ;AACjE,8BAAsB,EAAE,QAAQ,OAAO,GAAG,SAAS,MAAM;AAAA,MAC3D,OAAO;AACL,4BAAoB,SAAS;AAAA,MAC/B;AAEA,YAAM,YAAY,wBAAwB;AAC1C,UAAI,oBAAoB,SAAS,aAAa,CAAC,oBAAoB,SAAS;AAC1E,4BAAoB,UAAU;AAC9B;AAAA,UACE,sDAAsD,oBAAoB,KAAK,2CAA2C,MAAM,kBAAkB,YAAY;AAAA,QAChK;AACA,eAAO,EAAE,QAAQ,UAAU,QAAQ,4BAA4B;AAAA,MACjE;AACA,aAAO,EAAE,QAAQ,UAAU,QAAQ,kBAAkB;AAAA,IACvD;AAGA,0BAAsB;AACtB,QAAI,6CAA6C,WAAW,QAAQ,WAAM,SAAS,EAAE;AACrF,WAAO,EAAE,QAAQ,WAAW,MAAM,SAAS,IAAI,UAAU;AAAA,EAC3D,SAAS,KAAK;AAEZ,QAAI,gDAAgD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACtG,WAAO,EAAE,QAAQ,UAAU,QAAQ,YAAY;AAAA,EACjD;AACF;","names":[]}

package/dist/{claude-pair-runtime-IWSCXRZ7.js → claude-pair-runtime-ZBQKBBMT.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-KUKHF33M.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-ICYFLUAM.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-IWSCXRZ7.js.map
+//# sourceMappingURL=claude-pair-runtime-ZBQKBBMT.js.map

package/dist/lib/manager-worker.js

@@ -1,5 +1,7 @@
 import {
   ApiError,
+  INTEGRATIONS_SECTION_END,
+  INTEGRATIONS_SECTION_START,
   SUPERVISOR_RESTART_EXIT_CODE,
   api,
   estimateActiveTasksTokens,
@@ -13,7 +15,7 @@ import {
   provisionOrientHook,
   provisionStopHook,
   requireHost
-} from "../chunk-44OJXXLF.js";
+} from "../chunk-WCY7QM3R.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -44,7 +46,7 @@ import {
   stopAllSessionsAndWait,
   stopPersistentSession,
   takeZombieDetection
-} from "../chunk-U37Y32S5.js";
+} from "../chunk-GN4XPQWJ.js";
 import {
   KANBAN_CHECK_COMMAND,
   appendDmFooter,
@@ -67,7 +69,7 @@ import {
   resolveConnectivityProbe,
   resolveDmTarget,
   wrapScheduledTaskPrompt
-} from "../chunk-JTZZ6YB2.js";
+} from "../chunk-YSBGIXJG.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -2772,6 +2774,9 @@ function stopRealtimeChat() {
 }
 
 // src/lib/manager-worker.ts
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function applyRestartAcks(args) {
   const { agentStates, priorAgents, restartAcks } = args;
   if (agentStates.length === 0) return false;
@@ -3161,7 +3166,7 @@ var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.4" : "dev";
+var agtCliVersion = true ? "0.27.7-test.5" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -3331,10 +3336,42 @@ function runAsync(cmd, args, opts) {
     }).catch(reject);
   });
 }
+function claudeManagedSettingsPath() {
+  return process.platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json" : "/etc/claude-code/managed-settings.json";
+}
+function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
+  try {
+    let settings = {};
+    if (existsSync4(path)) {
+      const raw = readFileSync5(path, "utf-8").trim();
+      if (raw) {
+        let parsed;
+        try {
+          parsed = JSON.parse(raw);
+        } catch (err) {
+          log(`[managed-settings] ${path} is not valid JSON (${err.message}) \u2014 leaving as-is; Claude Code channels may be blocked`);
+          return;
+        }
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+          settings = parsed;
+        }
+      }
+    }
+    if (settings.channelsEnabled === true) return;
+    settings.channelsEnabled = true;
+    mkdirSync2(dirname(path), { recursive: true });
+    writeFileSync3(path, `${JSON.stringify(settings, null, 2)}
+`);
+    log(`[managed-settings] set channelsEnabled:true in ${path} (ENG-5786 \u2014 unblocks Claude Code channels)`);
+  } catch (err) {
+    log(`[managed-settings] could not ensure ${path}: ${err.message} \u2014 Claude Code channels may be blocked; set channelsEnabled:true manually`);
+  }
+}
 async function ensureFrameworkBinary(frameworkId) {
   if (frameworkId !== "claude-code") return;
   if (frameworkBinaryChecked.has(frameworkId)) return;
   frameworkBinaryChecked.add(frameworkId);
+  ensureClaudeManagedSettings();
   const { execFileSync: execFileSync4 } = await import("child_process");
   const brewPath = resolveBrewPath(execFileSync4);
   if (!brewPath) {
@@ -3547,7 +3584,19 @@ async function checkAndUpdateCliViaNpm() {
     log(`[self-update] npm registry fetch failed: ${err.message}`);
     return;
   }
-  const shouldUpdate = channel === "latest" ? isNewerSemver(agtCliVersion, latest) : latest !== agtCliVersion;
+  let shouldUpdate;
+  if (channel === "latest") {
+    shouldUpdate = isNewerSemver(agtCliVersion, latest);
+  } else if (latest === agtCliVersion) {
+    shouldUpdate = false;
+  } else if (isOlderSemverTuple(agtCliVersion, latest)) {
+    log(
+      `[self-update] refusing to downgrade: installed ${agtCliVersion} is newer than channel=${channel} target ${latest}. Bump the channel tag forward to resume tracking.`
+    );
+    shouldUpdate = false;
+  } else {
+    shouldUpdate = true;
+  }
   if (!shouldUpdate) {
     if (!selfUpdateUpToDateLogged) {
       log(`[self-update] agt CLI is up to date (npm, channel=${channel}, ${agtCliVersion})`);
@@ -3591,6 +3640,17 @@ function isNewerSemver(local, remote) {
   }
   return false;
 }
+function isOlderSemverTuple(local, remote) {
+  const parse = (v) => v.replace(/^v/, "").split(/[-+]/)[0].split(".").map((p) => Number(p));
+  const l = parse(local);
+  const r = parse(remote);
+  for (let i = 0; i < 3; i++) {
+    const lv = l[i] ?? 0;
+    const rv = r[i] ?? 0;
+    if (rv !== lv) return rv < lv;
+  }
+  return false;
+}
 async function checkClaudeAuth() {
   try {
     const report = await detectClaudeAuth();
@@ -4120,7 +4180,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-KUKHF33M.js");
+      const { collectDiagnostics } = await import("../persistent-session-ICYFLUAM.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -4172,7 +4232,7 @@ async function pollCycle() {
         realtime_socket_connected: isRealtimeSocketConnected()
       });
       try {
-        const { maybeUpdateClaudeCode } = await import("../claude-code-updater-7BGQ6JCV.js");
+        const { maybeUpdateClaudeCode } = await import("../claude-code-updater-4E5T2X3Z.js");
         await maybeUpdateClaudeCode({
           desiredVersion: hbResp?.desired_claude_code_version ?? "latest",
           currentVersion: cachedFrameworkVersion,
@@ -4188,7 +4248,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-WYQS3YID.js");
+      } = await import("../responsiveness-probe-WZNQ2762.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -4691,7 +4751,14 @@ async function processAgent(agent, agentStates) {
       if (artifact.relativePath === "CLAUDE.md") {
         const stripDynamicSections = (s) => {
           let out = s.replace(new RegExp(`${SKILLS_INDEX_START}[\\s\\S]*?${SKILLS_INDEX_END}`), "");
-          out = out.replace(/## Integrations[\s\S]*?(?=## Rules)/, "");
+          if (out.includes(INTEGRATIONS_SECTION_START)) {
+            out = out.replace(
+              new RegExp(`${escapeRegExp(INTEGRATIONS_SECTION_START)}[\\s\\S]*?${escapeRegExp(INTEGRATIONS_SECTION_END)}\\n*`),
+              ""
+            );
+          } else {
+            out = out.replace(/## Integrations[\s\S]*?(?=## Rules)/, "");
+          }
           return out.trimEnd();
         };
         newHash = sha256(stripDynamicSections(artifact.content));
@@ -8129,7 +8196,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-IWSCXRZ7.js");
+  } = await import("../claude-pair-runtime-ZBQKBBMT.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -8917,7 +8984,9 @@ export {
   buildDoneCardNotification,
   claudeCodeUpgradeMarkerPath,
   claudeCodeUpgradeThrottled,
+  claudeManagedSettingsPath,
   deliverScheduledCardResult,
+  ensureClaudeManagedSettings,
   extractCharterSlackPeers,
   extractCharterTelegramPeers,
   formatBoardForPrompt,
@@ -8927,6 +8996,7 @@ export {
   isHybridActionable,
   isKanbanHybridDryRun,
   isKanbanHybridEnabled,
+  isOlderSemverTuple,
   isPlainScheduledTemplate,
   isScheduledCardTracked,
   isScheduledViaKanbanEnabled,