@integrity-labs/agt-cli 0.28.1051 → 0.28.1053

package/dist/{chunk-RE4DLJBA.js → chunk-Z45XEW4H.js}

@@ -16,7 +16,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-FNUTMHWV.js";
+} from "./chunk-4ZH75WMF.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -7122,7 +7122,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1051" : "dev";
+var agtCliVersion = true ? "0.28.1053" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -12079,4 +12079,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-RE4DLJBA.js.map
+//# sourceMappingURL=chunk-Z45XEW4H.js.map

package/dist/{claude-pair-runtime-53UOTF6V.js → claude-pair-runtime-KMPRE2ZJ.js}

@@ -266,7 +266,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-3FT727PQ.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-5RX4P7GP.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -734,4 +734,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-53UOTF6V.js.map
+//# sourceMappingURL=claude-pair-runtime-KMPRE2ZJ.js.map

package/dist/lib/manager-worker.js

@@ -66,7 +66,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-RE4DLJBA.js";
+} from "../chunk-Z45XEW4H.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -88,6 +88,7 @@ import {
   collectChannelSpawnSecrets,
   creditWatchdogGiveUpCount,
   creditWatchdogUnclaimedDialogCount,
+  denyWebFetchForToolsContent,
   effectiveIsolationMode,
   egressMode,
   execFilePromiseLong,
@@ -129,6 +130,7 @@ import {
   resetRestartCount,
   resolveClaudeBinary,
   resolveContainerMemory,
+  resolveWebFetchBaseline,
   restartEgressSidecar,
   rotatePaneLogForDayRollover,
   rotateSessionForWedge,
@@ -148,8 +150,10 @@ import {
   takeWatchdogUnclaimedDialogCount,
   takeZombieDetection,
   toOpencodeModel,
+  webFetchBaselineValue,
+  webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-FNUTMHWV.js";
+} from "../chunk-4ZH75WMF.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -6723,7 +6727,15 @@ var BASELINE_CONCERNS = [
   // telegramPolicy baseline and take the whole fleet through a fail-closed
   // restart round to add a key — the precedent set when telegramPolicy itself
   // was added.
-  "agentRules"
+  "agentRules",
+  // ENG-11168 (Obi Wan 218694c47fe3 on #6601): the WebFetch decision a running
+  // session was SPAWNED with ('deny' | 'allow'). `--disallowedTools WebFetch` is
+  // a spawn flag, so a network-policy change reaches a session only by respawn,
+  // and the manager has to remember across its own restarts what each surviving
+  // session actually has. Written only at spawn, where the flag is a fact; never
+  // when a respawn is merely scheduled (the ENG-7771 lesson). Additive, so no
+  // version bump - same reasoning as agentRules above.
+  "webFetch"
 ];
 function createDeliveryBaselineMaps() {
   return {
@@ -6731,7 +6743,8 @@ function createDeliveryBaselineMaps() {
     slackBehaviour: /* @__PURE__ */ new Map(),
     msteamsBehaviour: /* @__PURE__ */ new Map(),
     telegramPolicy: /* @__PURE__ */ new Map(),
-    agentRules: /* @__PURE__ */ new Map()
+    agentRules: /* @__PURE__ */ new Map(),
+    webFetch: /* @__PURE__ */ new Map()
   };
 }
 function getSenderPolicyBaselineFile(configDir) {
@@ -14040,7 +14053,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-DEG3SWG3.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-C75AUK6I.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14786,7 +14799,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1051" : "dev";
+var agtCliVersion = true ? "0.28.1053" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16421,7 +16434,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-3FT727PQ.js");
+      const { collectDiagnostics } = await import("../persistent-session-5RX4P7GP.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -16563,7 +16576,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-3FT727PQ.js");
+      const { collectDiagnostics } = await import("../persistent-session-5RX4P7GP.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -16748,7 +16761,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-DEG3SWG3.js");
+      } = await import("../responsiveness-probe-C75AUK6I.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16865,7 +16878,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-DEG3SWG3.js");
+        } = await import("../responsiveness-probe-C75AUK6I.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -20606,6 +20619,7 @@ function clearSessionPolicyBaseline(codeName) {
 }
 var opencodeCredentialFingerprintBySession = /* @__PURE__ */ new Map();
 var egressAllowlistBySession = /* @__PURE__ */ new Map();
+var denyWebFetchBySession = /* @__PURE__ */ new Map();
 function deriveEgressAllowlist(toolsRaw, policy) {
   return buildEgressAllowlist(
     toolsRaw ? extractFrontmatter(toolsRaw).frontmatter : null,
@@ -21087,10 +21101,9 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash20("sha256")
     });
     trackSessionRun(codeName, sessionRunResult.run_id);
     const spawnPrimaryModel = resolveModelChain(refreshData).primary ?? refreshData.agent?.["primary_model"] ?? null;
-    const egressAllowlist = deriveEgressAllowlist(
-      refreshData.tools?.raw_content,
-      modelPolicy
-    );
+    const spawnToolsRaw = refreshData.tools?.raw_content;
+    const egressAllowlist = deriveEgressAllowlist(spawnToolsRaw, modelPolicy);
+    const spawnDenyWebFetch = denyWebFetchForToolsContent(spawnToolsRaw);
     egressAllowlistBySession.set(codeName, egressAllowlist);
     const spawnAgentClass = refreshData.agent?.["agent_class"];
     let perAgentApiKey = null;
@@ -21184,6 +21197,11 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash20("sha256")
       // this the flip reaches nothing running under Docker isolation.
       turnFailureNoticeEnabled: hostFlagStore().getBoolean("wedge-transient-notice"),
       egressAllowlist,
+      // ENG-11168: WebFetch follows the agent's network policy, from the SAME
+      // trusted control-plane tools content the egress allowlist uses (never the
+      // agent's on-disk TOOLS.md). Recomputed on every spawn, so a policy change
+      // applies at the next restart rather than being ratcheted in forever.
+      denyWebFetch: spawnDenyWebFetch,
       // ADR-0042 pt3b (ENG-7607 / ENG-8992): this agent's own org-scoped key
       // (null when unarmed). The spawn env carries it as this agent's AGT_API_KEY.
       perAgentApiKey,
@@ -21199,6 +21217,8 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash20("sha256")
     agentState.persistentSessionAgents.add(codeName);
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
     recordSessionPolicyBaseline(codeName, currentPolicyModel, currentPolicyId);
+    denyWebFetchBySession.set(codeName, spawnDenyWebFetch);
+    persistDeliveryBaselineEntry("webFetch", agent.agent_id, webFetchBaselineValue(spawnDenyWebFetch));
     seedSessionLaunchBaselines(codeName, projectDir);
     if (effectiveIsolationMode(codeName) === "docker") {
       seedContainerMemory(codeName, resolveContainerMemory(spawnAgentClass));
@@ -21211,6 +21231,20 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash20("sha256")
     };
   }
   resetRestartCount(codeName);
+  const liveDenyWebFetch = denyWebFetchForToolsContent(
+    refreshData.tools?.raw_content
+  );
+  const spawnedDenyWebFetch = resolveWebFetchBaseline(
+    denyWebFetchBySession.get(codeName),
+    persistedDeliveryBaseline.webFetch.get(agent.agent_id)
+  );
+  if (webFetchRestartNeeded(spawnedDenyWebFetch, liveDenyWebFetch)) {
+    log(
+      `[persistent-session] default_network_policy for '${codeName}' changed: WebFetch now ${liveDenyWebFetch ? "withheld" : "allowed"} - respawning to apply it (ENG-11168)`
+    );
+    scheduleSessionRestart(codeName, 0, "network policy change (ENG-11168)");
+  }
+  denyWebFetchBySession.set(codeName, liveDenyWebFetch);
   if (egressMode(codeName) === "allowlist") {
     const allowlist = deriveEgressAllowlist(
       refreshData.tools?.raw_content,
@@ -21565,7 +21599,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-DEG3SWG3.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-C75AUK6I.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -21608,7 +21642,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-3FT727PQ.js");
+        const { collectDiagnostics } = await import("../persistent-session-5RX4P7GP.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -21659,7 +21693,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-3FT727PQ.js");
+      const { collectDiagnostics } = await import("../persistent-session-5RX4P7GP.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22331,7 +22365,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-53UOTF6V.js");
+  } = await import("../claude-pair-runtime-KMPRE2ZJ.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));