@integrity-labs/agt-cli 0.27.99 → 0.27.101

package/dist/{claude-pair-runtime-M2WYVEV2.js → claude-pair-runtime-PJSO3JKN.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-HAPAZHOA.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-KAZNNGUD.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-M2WYVEV2.js.map
+//# sourceMappingURL=claude-pair-runtime-PJSO3JKN.js.map

package/dist/lib/manager-worker.js

@@ -1,5 +1,6 @@
 import {
   ApiError,
+  CHANNEL_SECRET_ENV_KEYS,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
   SUPERVISOR_RESTART_EXIT_CODE,
@@ -16,7 +17,7 @@ import {
   provisionStopHook,
   requireHost,
   safeWriteJsonAtomic
-} from "../chunk-IUQIRUNJ.js";
+} from "../chunk-UBW4SAJF.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -54,7 +55,7 @@ import {
   stopPersistentSession,
   takeWatchdogGiveUpCount,
   takeZombieDetection
-} from "../chunk-3TAVWBOA.js";
+} from "../chunk-Q5K5YADO.js";
 import {
   KANBAN_CHECK_COMMAND,
   appendDmFooter,
@@ -77,7 +78,7 @@ import {
   resolveConnectivityProbe,
   resolveDmTarget,
   wrapScheduledTaskPrompt
-} from "../chunk-T2UTQH6W.js";
+} from "../chunk-KZVMMXDB.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -114,6 +115,12 @@ function managedMcpStructureHash(entries) {
   const basis = entries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => `${e.serverId}|${Object.keys(e.headers ?? {}).sort().join(",")}`).join("\n");
   return createHash("sha256").update(basis).digest("hex").slice(0, 16);
 }
+function channelSecretValueHash(envEntries, channelSecretKeys) {
+  if (!envEntries) return null;
+  const basis = channelSecretKeys.slice().sort().filter((k) => Object.prototype.hasOwnProperty.call(envEntries, k)).map((k) => `${k}=${envEntries[k]}`).join("\n");
+  if (basis.length === 0) return null;
+  return createHash("sha256").update(basis).digest("hex").slice(0, 16);
+}
 
 // src/lib/integration-hash.ts
 import { createHash as createHash2 } from "crypto";
@@ -3780,6 +3787,7 @@ function restartGateFor(codeName, breakerReason) {
 }
 var runningMcpHashes = /* @__PURE__ */ new Map();
 var runningMcpServerKeys = /* @__PURE__ */ new Map();
+var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
     const raw = readFileSync9(join8(projectDir, ".mcp.json"), "utf-8");
@@ -3865,6 +3873,7 @@ function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason) {
   stopPersistentSession(codeName, log);
   runningMcpHashes.delete(codeName);
   runningMcpServerKeys.delete(codeName);
+  runningChannelSecretHashes.delete(codeName);
   closeInjectedRunIfOpen(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
   closeScheduledRunsForCode(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
   if (breakerReason) {
@@ -3933,6 +3942,35 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
     }
   }
 }
+function projectChannelSecretHash(projectDir) {
+  try {
+    const entries = parseEnvIntegrations(
+      readFileSync9(join8(projectDir, ".env.integrations"), "utf-8")
+    );
+    return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
+  } catch {
+    return null;
+  }
+}
+function checkChannelSecretDriftAndScheduleRestart(codeName, projectDir) {
+  const currentHash = projectChannelSecretHash(projectDir);
+  const action = decideMcpDriftAction(currentHash, runningChannelSecretHashes.get(codeName));
+  switch (action.kind) {
+    case "no-config":
+    case "no-drift":
+      return;
+    case "baseline":
+      runningChannelSecretHashes.set(codeName, action.hash);
+      return;
+    case "drift":
+      log(
+        `[hot-reload] channel credential rotated for '${codeName}' (${action.previous} \u2192 ${action.current}) \u2014 respawning to load the new token (ENG-6062)`
+      );
+      scheduleSessionRestart(codeName, 0, "channel credential rotation (ENG-6062)");
+      runningChannelSecretHashes.delete(codeName);
+      return;
+  }
+}
 var managedToolkitIdByAgentAndServerId = /* @__PURE__ */ new Map();
 function managedToolkitMapKey(agentId, serverId) {
   return `${agentId}\0${serverId}`;
@@ -3996,7 +4034,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.99" : "dev";
+var agtCliVersion = true ? "0.27.101" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -5187,7 +5225,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-HAPAZHOA.js");
+      const { collectDiagnostics } = await import("../persistent-session-KAZNNGUD.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -5260,7 +5298,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-ZFYY5XOU.js");
+      } = await import("../responsiveness-probe-MWVDZLO6.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -6857,6 +6895,13 @@ async function processAgent(agent, agentStates) {
     } catch (err) {
       log(`[hot-reload] .mcp.json drift check failed for '${agent.code_name}': ${err.message}`);
     }
+    if (channelConfigConverged) {
+      try {
+        checkChannelSecretDriftAndScheduleRestart(agent.code_name, getProjectDir(agent.code_name));
+      } catch (err) {
+        log(`[hot-reload] channel-secret drift check failed for '${agent.code_name}': ${err.message}`);
+      }
+    }
     try {
       const sess = getSessionState(agent.code_name);
       let mcpJsonParsed = null;
@@ -9588,7 +9633,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-M2WYVEV2.js");
+  } = await import("../claude-pair-runtime-PJSO3JKN.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));