@integrity-labs/agt-cli 0.28.1125 → 0.28.1127

package/dist/{chunk-JHKH2EYM.js → chunk-7W5TLMFG.js}

@@ -16,7 +16,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-C5YNHEST.js";
+} from "./chunk-37PZYGGA.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -79,7 +79,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-JI2D2TA2.js";
+} from "./chunk-6J7WE4J4.js";
 import {
   classifyUnanswerablePane,
   isConsumerTermsDialogVisible,
@@ -7518,7 +7518,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1125" : "dev";
+var agtCliVersion = true ? "0.28.1127" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -12664,4 +12664,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-JHKH2EYM.js.map
+//# sourceMappingURL=chunk-7W5TLMFG.js.map

package/dist/{claude-pair-runtime-5OBFRZWS.js → claude-pair-runtime-H55GPDDO.js}

@@ -269,7 +269,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-E5IR3RBF.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-D5O5MMNY.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -739,4 +739,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-5OBFRZWS.js.map
+//# sourceMappingURL=claude-pair-runtime-H55GPDDO.js.map

package/dist/lib/manager-worker.js

@@ -71,7 +71,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-JHKH2EYM.js";
+} from "../chunk-7W5TLMFG.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -158,7 +158,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-C5YNHEST.js";
+} from "../chunk-37PZYGGA.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -268,7 +268,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-JI2D2TA2.js";
+} from "../chunk-6J7WE4J4.js";
 import {
   classifyUnanswerablePane,
   paneRemedy
@@ -14192,7 +14192,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-KCICZE6E.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-JJQ3AC5E.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14950,7 +14950,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1125" : "dev";
+var agtCliVersion = true ? "0.28.1127" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16580,7 +16580,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-E5IR3RBF.js");
+      const { collectDiagnostics } = await import("../persistent-session-D5O5MMNY.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -16722,7 +16722,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-E5IR3RBF.js");
+      const { collectDiagnostics } = await import("../persistent-session-D5O5MMNY.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -16930,7 +16930,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-KCICZE6E.js");
+      } = await import("../responsiveness-probe-JJQ3AC5E.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -17047,7 +17047,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-KCICZE6E.js");
+        } = await import("../responsiveness-probe-JJQ3AC5E.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -17333,7 +17333,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-KCICZE6E.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-JJQ3AC5E.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -17364,7 +17364,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-E5IR3RBF.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-D5O5MMNY.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -17529,7 +17529,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-VYP4VCMX.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-WYJJYTQB.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -22116,7 +22116,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-KCICZE6E.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-JJQ3AC5E.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -22159,7 +22159,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-E5IR3RBF.js");
+        const { collectDiagnostics } = await import("../persistent-session-D5O5MMNY.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22210,7 +22210,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-E5IR3RBF.js");
+      const { collectDiagnostics } = await import("../persistent-session-D5O5MMNY.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22883,7 +22883,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-5OBFRZWS.js");
+  } = await import("../claude-pair-runtime-H55GPDDO.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -35740,6 +35740,8 @@ var NOTICE_KIND_AUDIENCE = {
   aws_grant_denied: "agent",
   gcp_grant_resolved: "agent",
   gcp_grant_denied: "agent",
+  azure_grant_resolved: "agent",
+  azure_grant_denied: "agent",
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",
@@ -40797,11 +40799,22 @@ function probeAgentSessionCached(codeName, ttlMs = SESSION_PROBE_TTL_MS, now = D
 // src/direct-chat-poll-guard.ts
 function evaluatePollGuard(state, nowMs, stuckMs) {
   if (!state.inFlight) return { run: true, stuck: false };
+  if (state.leaseUntilMs != null && nowMs < state.leaseUntilMs) return { run: false, stuck: false };
   if (state.inFlightSinceMs != null && nowMs - state.inFlightSinceMs >= stuckMs) {
     return { run: true, stuck: true };
   }
   return { run: false, stuck: false };
 }
+async function withPollGuardLease(state, leaseUntilMs, work, nowMs = Date.now) {
+  const previous = state.leaseUntilMs ?? null;
+  state.leaseUntilMs = Math.max(previous ?? 0, leaseUntilMs);
+  try {
+    return await work();
+  } finally {
+    state.leaseUntilMs = previous;
+    if (state.inFlight) state.inFlightSinceMs = nowMs();
+  }
+}
 async function fetchWithTimeout(input, init, timeoutMs, fetchImpl = fetch) {
   const controller = new AbortController();
   const timer = setTimeout(() => {
@@ -40945,7 +40958,44 @@ import {
 
 // src/direct-chat-inbound-attachments.ts
 import { join as join14 } from "path";
-var MAX_INBOUND_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+var MAX_INBOUND_ATTACHMENT_BYTES = DIRECT_CHAT_UPLOAD_MAX_BYTES;
+var INBOUND_DOWNLOAD_FLOOR_MS = 2e4;
+var INBOUND_DOWNLOAD_MIN_BYTES_PER_SEC = 512 * 1024;
+function inboundDownloadTimeoutMs(expectedBytes) {
+  const bytes = typeof expectedBytes === "number" && Number.isFinite(expectedBytes) && expectedBytes > 0 ? Math.min(expectedBytes, MAX_INBOUND_ATTACHMENT_BYTES) : MAX_INBOUND_ATTACHMENT_BYTES;
+  return INBOUND_DOWNLOAD_FLOOR_MS + Math.ceil(bytes / INBOUND_DOWNLOAD_MIN_BYTES_PER_SEC * 1e3);
+}
+function attachmentsDownloadBudgetMs(attachments) {
+  return attachments.reduce((sum, a) => sum + inboundDownloadTimeoutMs(a.byte_size), 0);
+}
+async function fetchWithTransferDeadline(url, budgetMs, fetchImpl = fetch) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort(new Error(`inbound attachment download timed out after ${budgetMs}ms`));
+  }, budgetMs);
+  timer.unref?.();
+  let res;
+  try {
+    res = await fetchImpl(url, { method: "GET", signal: controller.signal });
+  } catch (err) {
+    clearTimeout(timer);
+    throw err;
+  }
+  const len = res.headers.get("content-length");
+  return {
+    ok: res.ok,
+    status: res.status,
+    contentLength: len != null ? Number(len) : null,
+    bytes: async () => {
+      try {
+        return new Uint8Array(await res.arrayBuffer());
+      } finally {
+        clearTimeout(timer);
+      }
+    }
+  };
+}
+var OVER_CAP_ERROR = `exceeds the ${formatUploadSize(MAX_INBOUND_ATTACHMENT_BYTES)} inbound limit`;
 var INBOUND_ATTACHMENTS_SUBDIR = "direct-chat-inbound";
 function resolveInboundAttachmentsDir(input) {
   const alias = resolveAgentDirAlias(input);
@@ -41017,10 +41067,10 @@ async function downloadInboundAttachment(att, dir, deps) {
     isImage: isImageContentType(att.content_type)
   };
   if (att.byte_size > MAX_INBOUND_ATTACHMENT_BYTES) {
-    return { ...base, error: "exceeds the 10 MB inbound limit" };
+    return { ...base, error: OVER_CAP_ERROR };
   }
   try {
-    const res = await deps.fetchUrl(att.download_url);
+    const res = await deps.fetchUrl(att.download_url, att.byte_size);
     if (!res.ok) {
       let s3Body = "";
       try {
@@ -41034,11 +41084,11 @@ async function downloadInboundAttachment(att, dir, deps) {
       return { ...base, error: `download HTTP ${res.status}` };
     }
     if (res.contentLength != null && res.contentLength > MAX_INBOUND_ATTACHMENT_BYTES) {
-      return { ...base, error: "exceeds the 10 MB inbound limit" };
+      return { ...base, error: OVER_CAP_ERROR };
     }
     const bytes = await res.bytes();
     if (bytes.byteLength > MAX_INBOUND_ATTACHMENT_BYTES) {
-      return { ...base, error: "exceeds the 10 MB inbound limit" };
+      return { ...base, error: OVER_CAP_ERROR };
     }
     deps.ensureDir(dir);
     const path = deps.joinPath(dir, safeInboundFilename(att.upload_id, att.filename));
@@ -42233,16 +42283,7 @@ async function maybeSendDirectChatAccountWarn(sessionId) {
   }
 }
 var inboundAttachmentDeps = {
-  fetchUrl: async (url) => {
-    const res = await fetchWithTimeout(url, { method: "GET" }, HTTP_TIMEOUT_MS);
-    const len = res.headers.get("content-length");
-    return {
-      ok: res.ok,
-      status: res.status,
-      contentLength: len != null ? Number(len) : null,
-      bytes: async () => new Uint8Array(await res.arrayBuffer())
-    };
-  },
+  fetchUrl: (url, expectedBytes) => fetchWithTransferDeadline(url, inboundDownloadTimeoutMs(expectedBytes)),
   ensureDir: (dir) => mkdirSync7(dir, { recursive: true }),
   writeFile: (path, bytes) => writeFileSync8(path, bytes, { mode: 384 }),
   joinPath: (...parts) => join17(...parts),
@@ -43110,10 +43151,10 @@ async function pollForMessages(sinceMs) {
       }
       const inboundAttachments = msg.attachments ?? [];
       if (!isNotice && inboundAttachments.length > 0 && INBOUND_ATTACHMENTS_DIR) {
-        const processed = await downloadInboundAttachments(
-          inboundAttachments,
-          INBOUND_ATTACHMENTS_DIR,
-          inboundAttachmentDeps
+        const processed = await withPollGuardLease(
+          pollGuard,
+          Date.now() + attachmentsDownloadBudgetMs(inboundAttachments) + POLL_STUCK_MS,
+          () => downloadInboundAttachments(inboundAttachments, INBOUND_ATTACHMENTS_DIR, inboundAttachmentDeps)
         );
         const annotation = buildAttachmentAnnotation(processed);
         if (annotation) injectContent = `${injectContent}${annotation}`;
@@ -43273,7 +43314,7 @@ var DOORBELL_ENABLED = resolveHostBooleanFlag({
 var DOORBELL_FILE = "direct-chat-doorbell";
 var SAFETY_NET_POLL_MS = 3e4;
 var POLL_STUCK_MS = 9e4;
-var pollGuard = { inFlight: false, inFlightSinceMs: null };
+var pollGuard = { inFlight: false, inFlightSinceMs: null, leaseUntilMs: null };
 async function pollOnce(sinceMs) {
   const decision = evaluatePollGuard(pollGuard, Date.now(), POLL_STUCK_MS);
   if (!decision.run) return { ran: false, ok: false };
@@ -43291,6 +43332,7 @@ async function pollOnce(sinceMs) {
   } finally {
     pollGuard.inFlight = false;
     pollGuard.inFlightSinceMs = null;
+    pollGuard.leaseUntilMs = null;
   }
 }
 var doorbellWatcher = null;

package/dist/mcp/index.js

@@ -28108,6 +28108,8 @@ var NOTICE_KIND_AUDIENCE = {
   aws_grant_denied: "agent",
   gcp_grant_resolved: "agent",
   gcp_grant_denied: "agent",
+  azure_grant_resolved: "agent",
+  azure_grant_denied: "agent",
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",

package/dist/mcp/origami.js

@@ -42240,6 +42240,8 @@ var NOTICE_KIND_AUDIENCE = {
   aws_grant_denied: "agent",
   gcp_grant_resolved: "agent",
   gcp_grant_denied: "agent",
+  azure_grant_resolved: "agent",
+  azure_grant_denied: "agent",
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",

package/dist/mcp/slack-channel.js

@@ -36636,6 +36636,8 @@ var NOTICE_KIND_AUDIENCE = {
   aws_grant_denied: "agent",
   gcp_grant_resolved: "agent",
   gcp_grant_denied: "agent",
+  azure_grant_resolved: "agent",
+  azure_grant_denied: "agent",
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",

package/dist/mcp/telegram-channel.js

@@ -36864,6 +36864,8 @@ var NOTICE_KIND_AUDIENCE = {
   aws_grant_denied: "agent",
   gcp_grant_resolved: "agent",
   gcp_grant_denied: "agent",
+  azure_grant_resolved: "agent",
+  azure_grant_denied: "agent",
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",

package/dist/{persistent-session-E5IR3RBF.js → persistent-session-D5O5MMNY.js}

@@ -68,8 +68,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-C5YNHEST.js";
-import "./chunk-JI2D2TA2.js";
+} from "./chunk-37PZYGGA.js";
+import "./chunk-6J7WE4J4.js";
 import "./chunk-OCMJ5E6J.js";
 import "./chunk-XWVM4KPK.js";
 import "./chunk-EL5MWGGH.js";
@@ -145,4 +145,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-E5IR3RBF.js.map
+//# sourceMappingURL=persistent-session-D5O5MMNY.js.map

package/dist/{responsiveness-probe-KCICZE6E.js → responsiveness-probe-JJQ3AC5E.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-C5YNHEST.js";
-import "./chunk-JI2D2TA2.js";
+} from "./chunk-37PZYGGA.js";
+import "./chunk-6J7WE4J4.js";
 import "./chunk-OCMJ5E6J.js";
 import "./chunk-XWVM4KPK.js";
 import "./chunk-EL5MWGGH.js";
@@ -802,4 +802,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-KCICZE6E.js.map
+//# sourceMappingURL=responsiveness-probe-JJQ3AC5E.js.map

package/dist/{session-auth-dead-VYP4VCMX.js → session-auth-dead-WYJJYTQB.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-JI2D2TA2.js";
+} from "./chunk-6J7WE4J4.js";
 import "./chunk-DGUM43GV.js";
 
 // src/lib/session-auth-dead.ts
@@ -204,4 +204,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-VYP4VCMX.js.map
+//# sourceMappingURL=session-auth-dead-WYJJYTQB.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.1125",
+  "version": "0.28.1127",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {