@integrity-labs/agt-cli 0.27.98 → 0.27.100

package/dist/lib/manager-worker.js

@@ -1,5 +1,6 @@
 import {
   ApiError,
+  CHANNEL_SECRET_ENV_KEYS,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
   SUPERVISOR_RESTART_EXIT_CODE,
@@ -16,7 +17,7 @@ import {
   provisionStopHook,
   requireHost,
   safeWriteJsonAtomic
-} from "../chunk-S265L5AN.js";
+} from "../chunk-DV3OH45P.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -114,6 +115,12 @@ function managedMcpStructureHash(entries) {
   const basis = entries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => `${e.serverId}|${Object.keys(e.headers ?? {}).sort().join(",")}`).join("\n");
   return createHash("sha256").update(basis).digest("hex").slice(0, 16);
 }
+function channelSecretValueHash(envEntries, channelSecretKeys) {
+  if (!envEntries) return null;
+  const basis = channelSecretKeys.slice().sort().filter((k) => Object.prototype.hasOwnProperty.call(envEntries, k)).map((k) => `${k}=${envEntries[k]}`).join("\n");
+  if (basis.length === 0) return null;
+  return createHash("sha256").update(basis).digest("hex").slice(0, 16);
+}
 
 // src/lib/integration-hash.ts
 import { createHash as createHash2 } from "crypto";
@@ -3780,6 +3787,7 @@ function restartGateFor(codeName, breakerReason) {
 }
 var runningMcpHashes = /* @__PURE__ */ new Map();
 var runningMcpServerKeys = /* @__PURE__ */ new Map();
+var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
     const raw = readFileSync9(join8(projectDir, ".mcp.json"), "utf-8");
@@ -3865,6 +3873,7 @@ function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason) {
   stopPersistentSession(codeName, log);
   runningMcpHashes.delete(codeName);
   runningMcpServerKeys.delete(codeName);
+  runningChannelSecretHashes.delete(codeName);
   closeInjectedRunIfOpen(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
   closeScheduledRunsForCode(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
   if (breakerReason) {
@@ -3933,6 +3942,35 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
     }
   }
 }
+function projectChannelSecretHash(projectDir) {
+  try {
+    const entries = parseEnvIntegrations(
+      readFileSync9(join8(projectDir, ".env.integrations"), "utf-8")
+    );
+    return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
+  } catch {
+    return null;
+  }
+}
+function checkChannelSecretDriftAndScheduleRestart(codeName, projectDir) {
+  const currentHash = projectChannelSecretHash(projectDir);
+  const action = decideMcpDriftAction(currentHash, runningChannelSecretHashes.get(codeName));
+  switch (action.kind) {
+    case "no-config":
+    case "no-drift":
+      return;
+    case "baseline":
+      runningChannelSecretHashes.set(codeName, action.hash);
+      return;
+    case "drift":
+      log(
+        `[hot-reload] channel credential rotated for '${codeName}' (${action.previous} \u2192 ${action.current}) \u2014 respawning to load the new token (ENG-6062)`
+      );
+      scheduleSessionRestart(codeName, 0, "channel credential rotation (ENG-6062)");
+      runningChannelSecretHashes.delete(codeName);
+      return;
+  }
+}
 var managedToolkitIdByAgentAndServerId = /* @__PURE__ */ new Map();
 function managedToolkitMapKey(agentId, serverId) {
   return `${agentId}\0${serverId}`;
@@ -3996,7 +4034,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.98" : "dev";
+var agtCliVersion = true ? "0.27.100" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -6857,6 +6895,13 @@ async function processAgent(agent, agentStates) {
     } catch (err) {
       log(`[hot-reload] .mcp.json drift check failed for '${agent.code_name}': ${err.message}`);
     }
+    if (channelConfigConverged) {
+      try {
+        checkChannelSecretDriftAndScheduleRestart(agent.code_name, getProjectDir(agent.code_name));
+      } catch (err) {
+        log(`[hot-reload] channel-secret drift check failed for '${agent.code_name}': ${err.message}`);
+      }
+    }
     try {
       const sess = getSessionState(agent.code_name);
       let mcpJsonParsed = null;
@@ -7430,6 +7475,19 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
     });
   }
 }
+function deriveScheduledTaskNotify(task) {
+  if (task.deliveryChannel !== "msteams") return {};
+  const to = task.deliveryTo;
+  let conversationId = null;
+  if (typeof to === "string" && to.trim().length > 0) {
+    conversationId = to.trim();
+  } else if (to && typeof to === "object") {
+    const cid = to.conversation_id;
+    if (typeof cid === "string" && cid.trim().length > 0) conversationId = cid.trim();
+  }
+  if (!conversationId) return {};
+  return { notify_channel: "msteams", notify_to: conversationId };
+}
 async function startRun(opts) {
   try {
     const res = await api.post(
@@ -7598,7 +7656,8 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt) {
       title: task.name,
       description: prompt,
       priority: 2,
-      initial_status: "todo"
+      initial_status: "todo",
+      ...deriveScheduledTaskNotify(task)
     }
   });
   if (!run_id || !kanban_item_id) {
@@ -7707,7 +7766,7 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
       source_type: "scheduled_task",
       source_ref: task.taskId,
       metadata: { template_id: task.templateId, name: task.name },
-      materialize_kanban: { title: task.name, priority: 2 }
+      materialize_kanban: { title: task.name, priority: 2, ...deriveScheduledTaskNotify(task) }
     });
     runId = startResult.run_id;
     kanbanItemId = startResult.kanban_item_id;
@@ -10460,6 +10519,7 @@ export {
   claudeManagedSettingsPath,
   deliverScheduledCardResult,
   deliverScheduledTaskOutput,
+  deriveScheduledTaskNotify,
   ensureClaudeManagedSettings,
   extractCharterSlackPeers,
   extractCharterTelegramPeers,