@integrity-labs/agt-cli 0.28.1068 → 0.28.1069

package/dist/{claude-pair-runtime-4BISLPPZ.js → claude-pair-runtime-Z7SMBMUG.js}

@@ -266,7 +266,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-VRAVB743.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-52A2G7D7.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -734,4 +734,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-4BISLPPZ.js.map
+//# sourceMappingURL=claude-pair-runtime-Z7SMBMUG.js.map

package/dist/lib/manager-worker.js

@@ -67,7 +67,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-WLB2E3PO.js";
+} from "../chunk-CO2ODT4I.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -154,7 +154,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-65F44JJJ.js";
+} from "../chunk-FHUYRSCF.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -309,7 +309,7 @@ function defaultUnique() {
 // src/lib/manager-worker.ts
 import { execFileSync as syncExecFile } from "child_process";
 import { join as join43, dirname as dirname11, delimiter as pathDelimiter } from "path";
-import { homedir as homedir17 } from "os";
+import { homedir as homedir17, platform as platform3 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../packages/core/dist/provisioning/channel-policy-env.js
@@ -3292,6 +3292,24 @@ async function maybePollHostUsage(deps) {
   }
 }
 
+// src/lib/claude-host-args.ts
+var HOST_CLAUDE_RETENTION_SETTINGS = JSON.stringify({ cleanupPeriodDays: 3650 });
+function hostClaudeOneShotArgs(emptyMcpConfigPath) {
+  return [
+    // No project config, no MCP, no tools: these exercise the model or auth only.
+    "--mcp-config",
+    emptyMcpConfigPath,
+    "--strict-mcp-config",
+    "--permission-mode",
+    "auto",
+    "--allowedTools",
+    "",
+    // ENG-11277: never age anything out of the shared ~/.claude from here.
+    "--settings",
+    HOST_CLAUDE_RETENTION_SETTINGS
+  ];
+}
+
 // src/lib/claude-account-fingerprint.ts
 import { createHash as createHash6 } from "crypto";
 import { readFile as readFile3, readdir as readdir3 } from "fs/promises";
@@ -14123,7 +14141,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-QTYKXBH7.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-SJCP4V4X.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14144,6 +14162,11 @@ function inboundHeldMinutesFor(codeName) {
 }
 var consecutiveWedgeCycles = /* @__PURE__ */ new Map();
 var wedgeExemptionLogged = /* @__PURE__ */ new Set();
+var transcriptMountStreak = /* @__PURE__ */ new Map();
+var transcriptMountRestarts = /* @__PURE__ */ new Map();
+var transcriptMountReported = /* @__PURE__ */ new Set();
+var containerPidCache = /* @__PURE__ */ new Map();
+var transcriptMountEscalatedAt = /* @__PURE__ */ new Map();
 var paneFatalStreak = /* @__PURE__ */ new Map();
 var paneFatalRestarts = /* @__PURE__ */ new Map();
 var paneFatalReported = /* @__PURE__ */ new Set();
@@ -14875,7 +14898,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1068" : "dev";
+var agtCliVersion = true ? "0.28.1069" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15869,13 +15892,7 @@ async function runClaudeRuntimeAuthProbe() {
     "text",
     // Same isolation as conversation-eval: no project config, no MCP, no tools.
     // The probe must exercise AUTH and nothing else.
-    "--mcp-config",
-    emptyMcp,
-    "--strict-mcp-config",
-    "--permission-mode",
-    "auto",
-    "--allowedTools",
-    ""
+    ...hostClaudeOneShotArgs(emptyMcp)
   ];
   try {
     const { stdout, stderr } = await execFilePromiseLong(resolveClaudeBinary(), args, {
@@ -15910,13 +15927,7 @@ async function runHostUsageCommand() {
     const emptyMcp = ensureEvalEmptyMcpConfig();
     const args = [
       ...USAGE_COMMAND_ARGS,
-      "--mcp-config",
-      emptyMcp,
-      "--strict-mcp-config",
-      "--permission-mode",
-      "auto",
-      "--allowedTools",
-      ""
+      ...hostClaudeOneShotArgs(emptyMcp)
     ];
     const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
       cwd: homedir17(),
@@ -15988,13 +15999,7 @@ async function runEvalClaude(prompt, model) {
     "--output-format",
     "text",
     // Isolation: only the empty MCP config, ignore project/user config + no tools.
-    "--mcp-config",
-    emptyMcp,
-    "--strict-mcp-config",
-    "--permission-mode",
-    "auto",
-    "--allowedTools",
-    ""
+    ...hostClaudeOneShotArgs(emptyMcp)
   ];
   const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
     cwd: homedir17(),
@@ -16510,7 +16515,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-VRAVB743.js");
+      const { collectDiagnostics } = await import("../persistent-session-52A2G7D7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -16652,7 +16657,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-VRAVB743.js");
+      const { collectDiagnostics } = await import("../persistent-session-52A2G7D7.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -16860,7 +16865,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-QTYKXBH7.js");
+      } = await import("../responsiveness-probe-SJCP4V4X.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16977,7 +16982,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-QTYKXBH7.js");
+        } = await import("../responsiveness-probe-SJCP4V4X.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -17253,7 +17258,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-QTYKXBH7.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-SJCP4V4X.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -17276,6 +17281,177 @@ async function pollCycleInner() {
     } catch (err) {
       log(`[pane-fatal] detection failed: ${err.message}`);
     }
+    try {
+      const {
+        probeContainerTranscriptMounts,
+        decideTranscriptMountAction,
+        resolveTranscriptMountConfig,
+        TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
+        bindSourceEscalations
+      } = await import("../transcript-mount-health-OHE6IVJV.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-52A2G7D7.js");
+      const mountConfig = resolveTranscriptMountConfig();
+      const liveAgents = agentState.persistentSessionAgents;
+      for (const tracked of [
+        ...transcriptMountStreak.keys(),
+        ...transcriptMountRestarts.keys(),
+        ...transcriptMountReported,
+        ...containerPidCache.keys()
+      ]) {
+        if (!liveAgents.has(tracked)) {
+          transcriptMountStreak.delete(tracked);
+          transcriptMountRestarts.delete(tracked);
+          transcriptMountReported.delete(tracked);
+          containerPidCache.delete(tracked);
+          transcriptMountEscalatedAt.delete(`${tracked}:give-up`);
+          transcriptMountEscalatedAt.delete(`${tracked}:layout`);
+          transcriptMountEscalatedAt.delete(`${tracked}:io`);
+        }
+      }
+      const escalateTranscriptMount = (codeName, agentId, cause, action, reason, nowMs) => {
+        const key = `${codeName}:${cause}`;
+        const last = transcriptMountEscalatedAt.get(key);
+        if (last !== void 0 && nowMs - last < TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS) return false;
+        transcriptMountEscalatedAt.set(key, nowMs);
+        if (mountConfig.mode === "enforce") {
+          void reportReaperEvent(agentId, "transcript-mount-reaper", action, reason);
+        }
+        return last === void 0;
+      };
+      if (mountConfig.mode !== "off" && platform3() === "linux") {
+        const mountNowMs = Date.now();
+        const homeDirForBinds = process.env.HOME?.trim() || homedir17();
+        for (const codeName of liveAgents) {
+          if (effectiveIsolationMode(codeName) !== "docker") continue;
+          if (!isSessionHealthy(codeName)) {
+            transcriptMountStreak.delete(codeName);
+            containerPidCache.delete(codeName);
+            continue;
+          }
+          const agentId = agentState.codeNameToAgentId.get(codeName);
+          if (!agentId) continue;
+          let pid = containerPidCache.get(codeName) ?? null;
+          if (pid !== null && !existsSync19(`/proc/${pid}`)) pid = null;
+          if (pid === null) {
+            try {
+              const out = syncExecFile("docker", ["inspect", "-f", "{{.State.Pid}}", `agt-${codeName}`], {
+                stdio: ["ignore", "pipe", "ignore"],
+                timeout: 5e3
+              }).toString().trim();
+              const parsed = Number.parseInt(out, 10);
+              pid = Number.isInteger(parsed) && parsed > 0 ? parsed : null;
+            } catch {
+              pid = null;
+            }
+            if (pid !== null) containerPidCache.set(codeName, pid);
+          }
+          const src = transcriptBindSourcesFor({
+            homeDir: homeDirForBinds,
+            agentId,
+            projectDir: getProjectDir(codeName)
+          });
+          const verdict = probeContainerTranscriptMounts({
+            pid,
+            // Mask (parent) first: an unlinked mask root is the cause even when
+            // the nested slug bind still resolves.
+            binds: [
+              { containerPath: src.projects, hostPath: src.mask },
+              { containerPath: src.own, hostPath: src.own }
+            ],
+            stat: (path) => statSync14(path)
+          });
+          if (verdict.state !== "orphaned") {
+            transcriptMountStreak.delete(codeName);
+            if (verdict.state === "ok") {
+              transcriptMountReported.delete(codeName);
+              transcriptMountEscalatedAt.delete(`${codeName}:give-up`);
+              const { refused } = ensureTranscriptBindSources({
+                homeDir: homeDirForBinds,
+                agentId,
+                projectDir: getProjectDir(codeName)
+              });
+              const escalations = bindSourceEscalations(refused);
+              for (const cause of ["layout", "io"]) {
+                if (!escalations.some((e) => e.cause === cause)) transcriptMountEscalatedAt.delete(`${codeName}:${cause}`);
+              }
+              for (const e of escalations) {
+                if (escalateTranscriptMount(codeName, agentId, e.cause, e.action, e.message, mountNowMs)) {
+                  log(`[transcript-mount] bind source ${e.cause} problem for agent=${codeName}: ${e.message}`);
+                }
+              }
+            }
+            continue;
+          }
+          const cycles = (transcriptMountStreak.get(codeName) ?? 0) + 1;
+          transcriptMountStreak.set(codeName, cycles);
+          const history = (transcriptMountRestarts.get(codeName) ?? []).filter(
+            (t) => mountNowMs - t < mountConfig.restartWindowMs
+          );
+          transcriptMountRestarts.set(codeName, history);
+          const action = decideTranscriptMountAction(
+            { verdict, consecutiveCycles: cycles, recentRestartsMs: history, nowMs: mountNowMs },
+            mountConfig
+          );
+          if (action === "none") continue;
+          const detail = `agent=${codeName} path=${verdict.path} reason=${verdict.reason} cycles=${cycles} restartsInWindow=${history.length}`;
+          if (action === "would-restart") {
+            if (!transcriptMountReported.has(codeName)) {
+              transcriptMountReported.add(codeName);
+              log(`[transcript-mount] SHADOW would respawn (container transcript dir orphaned) ${detail}`);
+            }
+            continue;
+          }
+          if (action === "give-up") {
+            if (!transcriptMountReported.has(codeName)) {
+              transcriptMountReported.add(codeName);
+              log(
+                `[transcript-mount] restart budget spent and the transcript dir is orphaned again \u2014 NOT respawning; something on the host keeps removing it ${detail}`
+              );
+            }
+            escalateTranscriptMount(
+              codeName,
+              agentId,
+              "give-up",
+              "blocked",
+              `Container transcript directory ${verdict.path} is orphaned (${verdict.reason}) again after ${history.length} respawn(s) in the window; transcript writes and compaction are failing ENOENT. Stopped auto-restarting: something on the host keeps removing the bind source.`,
+              mountNowMs
+            );
+            continue;
+          }
+          try {
+            stopPersistentSessionAndForgetMcpBaseline(
+              codeName,
+              "transcript-mount-orphaned",
+              void 0,
+              { outcome: "failed", message: `transcript mount orphaned (${verdict.reason})` },
+              {
+                reason: `transcript bind ${verdict.path} orphaned (${verdict.reason}); respawn to re-bind (ENG-11277)`,
+                detail: {
+                  mount_path: verdict.path,
+                  mount_state: verdict.reason,
+                  consecutive_cycles: cycles,
+                  restarts_in_window: history.length
+                }
+              }
+            );
+            containerPidCache.delete(codeName);
+            transcriptMountStreak.delete(codeName);
+            transcriptMountRestarts.set(codeName, [...history, mountNowMs]);
+            log(`[transcript-mount] respawning to re-bind orphaned transcript mount ${detail}`);
+            void reportReaperEvent(
+              agentId,
+              "transcript-mount-reaper",
+              "restart",
+              `Container transcript directory ${verdict.path} was ${verdict.reason}; transcript writes and compaction were failing ENOENT. Respawned to re-bind.`
+            );
+          } catch (err) {
+            log(`[transcript-mount] respawn failed for ${codeName}: ${err.message}`);
+          }
+        }
+      }
+    } catch (err) {
+      log(`[transcript-mount] probe failed: ${err.message}`);
+    }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
       const { probeSessionAuth } = await import("../session-auth-dead-JJPNV3YQ.js");
@@ -21843,7 +22019,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-QTYKXBH7.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-SJCP4V4X.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -21886,7 +22062,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-VRAVB743.js");
+        const { collectDiagnostics } = await import("../persistent-session-52A2G7D7.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -21937,7 +22113,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-VRAVB743.js");
+      const { collectDiagnostics } = await import("../persistent-session-52A2G7D7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22609,7 +22785,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-4BISLPPZ.js");
+  } = await import("../claude-pair-runtime-Z7SMBMUG.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));