@integrity-labs/agt-cli 0.28.1068 → 0.28.1070

package/dist/{chunk-CFJONCHN.js → chunk-64DXAOQQ.js}

@@ -6798,6 +6798,38 @@ var FLAG_REGISTRY = [
     // safety control, so mutations require explicit confirmation.
     sensitive: true
   },
+  {
+    key: "pane-fatal-restart-mode",
+    description: `Pane fatal-error respawn (ENG-11278): the manager reads each claude-code agent pane and, when at least two consecutive most-recent turns ended in Claude Code's own "Prompt is too long \xB7 \u2026 \xB7 /clear to start fresh" / failed /compact result with no model output since, for two consecutive polls, treats the session as unable to answer. off = disabled, shadow = log "would force-fresh respawn" only, enforce = force a FRESH respawn (rotated session UUID, old transcript kept, inbound parked for replay) and raise a reaper_action alert, bounded by a per-agent budget (default 3 per 6h) after which it stops and raises a critical alert. The "Transcript writes are failing" status-bar banner alone only ever warns, in any mode but off. Declared safe value is shadow: observe-only, the absent-flag and flag-DB-error fallback. Flip to enforce centrally (stage or per org) to arm it.`,
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // shadow, not enforce (Obi Wan c734a443aa3f on #6707). This is NEW
+    // auto-respawn behaviour read host-side, and every sibling host-read mode
+    // flag (channel-quarantine-mode, mcp-quarantine-mode, and the pre-flag
+    // AGT_WEDGE_RESTART_MODE) ships shadow; ADR-0022's fail-safe direction is
+    // dark. Enforce is a deliberate, audited central flip, effective within one
+    // heartbeat with no manager restart. The case for enforce (it matches
+    // Claude Code's own turn-error text, not a timing heuristic, and is
+    // budget-bounded) is real, and is exactly what that flip is for.
+    defaultValue: "shadow",
+    // Operator escape hatch (highest precedence on the host). The reader is
+    // hostFlagStore().getString('pane-fatal-restart-mode') in manager-worker;
+    // there is no raw process.env read of it.
+    envVar: "AGT_PANE_FATAL_RESTART_MODE",
+    // Enforcement gate: weakening it (enforce -> shadow/off) drops a recovery
+    // control, so mutations require explicit confirmation.
+    sensitive: true,
+    // DELIBERATE UNREACHABLE PLACEHOLDER - NOT A REAL THRESHOLD YET. Same
+    // convention as `channel-quarantine-auto-resume` above: the reader lands in
+    // apps/cli (manager-worker 1d-3), and the agt-cli version that first ships
+    // it is not knowable before merge. Until bisected off the published dist,
+    // the reach estimate reports every host `stale`, which says "unknown" out
+    // loud instead of claiming reach. BEFORE relying on the reach modal for a
+    // flip: bisect the first agt-cli whose manager-worker reads this key and
+    // replace this value. Advisory only; a flip still takes effect on any host
+    // that runs the reader.
+    since: "0.29.0"
+  },
   {
     key: "docker-hygiene",
     description: "Manager-side docker hygiene on Docker-isolated hosts (ENG-8401): off = no-op, reap-superseded = after a successful agt-runtime retag, remove the prior untagged agt-runtime images that retag orphaned (Layer 1), full = reap-superseded plus a daily dangling-only image+builder prune (Layer 2). agt-runtime:latest and the just-pulled image are never removed and -a/--volumes are never used. Read host-side via hostFlagStore (getString); ships dark.",
@@ -16024,4 +16056,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-CFJONCHN.js.map
+//# sourceMappingURL=chunk-64DXAOQQ.js.map