@integrity-labs/agt-cli 0.27.99 → 0.27.100

package/dist/lib/manager-worker.js

@@ -1,5 +1,6 @@
 import {
   ApiError,
+  CHANNEL_SECRET_ENV_KEYS,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
   SUPERVISOR_RESTART_EXIT_CODE,
@@ -16,7 +17,7 @@ import {
   provisionStopHook,
   requireHost,
   safeWriteJsonAtomic
-} from "../chunk-IUQIRUNJ.js";
+} from "../chunk-DV3OH45P.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -114,6 +115,12 @@ function managedMcpStructureHash(entries) {
   const basis = entries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => `${e.serverId}|${Object.keys(e.headers ?? {}).sort().join(",")}`).join("\n");
   return createHash("sha256").update(basis).digest("hex").slice(0, 16);
 }
+function channelSecretValueHash(envEntries, channelSecretKeys) {
+  if (!envEntries) return null;
+  const basis = channelSecretKeys.slice().sort().filter((k) => Object.prototype.hasOwnProperty.call(envEntries, k)).map((k) => `${k}=${envEntries[k]}`).join("\n");
+  if (basis.length === 0) return null;
+  return createHash("sha256").update(basis).digest("hex").slice(0, 16);
+}
 
 // src/lib/integration-hash.ts
 import { createHash as createHash2 } from "crypto";
@@ -3780,6 +3787,7 @@ function restartGateFor(codeName, breakerReason) {
 }
 var runningMcpHashes = /* @__PURE__ */ new Map();
 var runningMcpServerKeys = /* @__PURE__ */ new Map();
+var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
     const raw = readFileSync9(join8(projectDir, ".mcp.json"), "utf-8");
@@ -3865,6 +3873,7 @@ function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason) {
   stopPersistentSession(codeName, log);
   runningMcpHashes.delete(codeName);
   runningMcpServerKeys.delete(codeName);
+  runningChannelSecretHashes.delete(codeName);
   closeInjectedRunIfOpen(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
   closeScheduledRunsForCode(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
   if (breakerReason) {
@@ -3933,6 +3942,35 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
     }
   }
 }
+function projectChannelSecretHash(projectDir) {
+  try {
+    const entries = parseEnvIntegrations(
+      readFileSync9(join8(projectDir, ".env.integrations"), "utf-8")
+    );
+    return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
+  } catch {
+    return null;
+  }
+}
+function checkChannelSecretDriftAndScheduleRestart(codeName, projectDir) {
+  const currentHash = projectChannelSecretHash(projectDir);
+  const action = decideMcpDriftAction(currentHash, runningChannelSecretHashes.get(codeName));
+  switch (action.kind) {
+    case "no-config":
+    case "no-drift":
+      return;
+    case "baseline":
+      runningChannelSecretHashes.set(codeName, action.hash);
+      return;
+    case "drift":
+      log(
+        `[hot-reload] channel credential rotated for '${codeName}' (${action.previous} \u2192 ${action.current}) \u2014 respawning to load the new token (ENG-6062)`
+      );
+      scheduleSessionRestart(codeName, 0, "channel credential rotation (ENG-6062)");
+      runningChannelSecretHashes.delete(codeName);
+      return;
+  }
+}
 var managedToolkitIdByAgentAndServerId = /* @__PURE__ */ new Map();
 function managedToolkitMapKey(agentId, serverId) {
   return `${agentId}\0${serverId}`;
@@ -3996,7 +4034,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.99" : "dev";
+var agtCliVersion = true ? "0.27.100" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -6857,6 +6895,13 @@ async function processAgent(agent, agentStates) {
     } catch (err) {
       log(`[hot-reload] .mcp.json drift check failed for '${agent.code_name}': ${err.message}`);
     }
+    if (channelConfigConverged) {
+      try {
+        checkChannelSecretDriftAndScheduleRestart(agent.code_name, getProjectDir(agent.code_name));
+      } catch (err) {
+        log(`[hot-reload] channel-secret drift check failed for '${agent.code_name}': ${err.message}`);
+      }
+    }
     try {
       const sess = getSessionState(agent.code_name);
       let mcpJsonParsed = null;