@integrity-labs/agt-cli 0.28.1139 → 0.28.1141

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-PI2WUKWD.js";
+} from "../chunk-6WHFJSXT.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1139" : "dev";
+var cliVersion = true ? "0.28.1141" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1139" : "dev";
+var cliVersion2 = true ? "0.28.1141" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-PI2WUKWD.js → chunk-6WHFJSXT.js}

@@ -8076,7 +8076,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1139" : "dev";
+var agtCliVersion = true ? "0.28.1141" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -13227,4 +13227,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-PI2WUKWD.js.map
+//# sourceMappingURL=chunk-6WHFJSXT.js.map

package/dist/lib/manager-worker.js

@@ -76,7 +76,7 @@ import {
   setConfigHash,
   shellGuard,
   tripClass
-} from "../chunk-PI2WUKWD.js";
+} from "../chunk-6WHFJSXT.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -343,6 +343,8 @@ var HostNodeConvergence = class {
   }
   converged = /* @__PURE__ */ new Set();
   abandoned = /* @__PURE__ */ new Set();
+  /** Pins this platform cannot install at all; see {@link recordUnsupported}. */
+  unsupported = /* @__PURE__ */ new Set();
   failures = /* @__PURE__ */ new Map();
   retryAfter = /* @__PURE__ */ new Map();
   /**
@@ -383,6 +385,7 @@ var HostNodeConvergence = class {
     this.lastDesired = pin;
     this.converged.clear();
     this.abandoned.clear();
+    this.unsupported.clear();
     this.failures.clear();
     this.retryAfter.clear();
   }
@@ -393,6 +396,7 @@ var HostNodeConvergence = class {
   stateOf(pin, now = Date.now()) {
     if (this.converged.has(pin)) return "converged";
     if (this.abandoned.has(pin)) return "abandoned";
+    if (this.unsupported.has(pin)) return "unsupported";
     if ((this.retryAfter.get(pin) ?? 0) > now) return "cooling";
     return "ready";
   }
@@ -447,6 +451,20 @@ var HostNodeConvergence = class {
     this.failures.delete(pin);
     this.retryAfter.delete(pin);
   }
+  /**
+   * The pin cannot be installed on this platform (no `dnf`). Terminal, so it
+   * stops further attempts exactly as success does — hammering an impossible
+   * install every poll is worse than stopping — but it reports as itself.
+   *
+   * Carries the same staleness guard as {@link recordSuccess}: a late call for
+   * a superseded pin must not write a conclusion about the pin now wanted.
+   */
+  recordUnsupported(pin) {
+    if (this.lastDesired !== null && pin !== this.lastDesired) return;
+    this.unsupported.add(pin);
+    this.failures.delete(pin);
+    this.retryAfter.delete(pin);
+  }
   /**
    * An attempt failed. Returns the resulting state so the caller can log the
    * right thing: 'cooling' means it will retry, 'abandoned' means it will not.
@@ -488,6 +506,58 @@ var HostNodeConvergence = class {
   }
 };
 
+// src/lib/host-node-report.ts
+var HOST_NODE_PROBE_INTERVAL_MS = 15 * 60 * 1e3;
+function shouldReprobeHostNode(lastObservedAt, now) {
+  if (lastObservedAt === 0) return true;
+  return now - lastObservedAt >= HOST_NODE_PROBE_INTERVAL_MS;
+}
+function normalizeReportedNodeVersion(raw) {
+  if (raw == null) return null;
+  const v = raw.trim().replace(/^v/, "");
+  return HOST_NODE_PIN_VERSION_RE.test(v) ? v : null;
+}
+function parsePathNodeVersion(stdout) {
+  const m = /^v?(\d+\.\d+\.\d+)$/.exec(stdout.trim());
+  return m ? normalizeReportedNodeVersion(m[1]) : null;
+}
+function parseRpmNodeVersion(stdout) {
+  return normalizeReportedNodeVersion(stdout.trim());
+}
+var RPM_NODE_QUERY_ARGV = ["-q", "--qf", "%{VERSION}", "nodejs"];
+var PATH_NODE_QUERY_ARGV = ["--version"];
+async function probeOrNull(probe) {
+  try {
+    return await probe();
+  } catch {
+    return null;
+  }
+}
+async function probeHostNode(run) {
+  const pathVersion = await probeOrNull(async () => {
+    const probe = await run("node", [...PATH_NODE_QUERY_ARGV]);
+    return probe.code === 0 ? parsePathNodeVersion(probe.stdout) : null;
+  });
+  const rpmVersion = await probeOrNull(async () => {
+    const rpm = await run("rpm", [...RPM_NODE_QUERY_ARGV]);
+    return rpm.code === 0 ? parseRpmNodeVersion(rpm.stdout) : null;
+  });
+  return { pathVersion, rpmVersion };
+}
+function heartbeatHostNodeFields(observation, pin, pinState) {
+  if (!observation) return {};
+  return {
+    host_node_version: normalizeReportedNodeVersion(observation.pathVersion),
+    host_node_rpm_version: normalizeReportedNodeVersion(observation.rpmVersion),
+    // A state without a pin would be meaningless, so the two are resolved
+    // together: no pin in force means no state, whatever the converger's
+    // internal maps happen to still hold for an older pin.
+    host_node_pin: pin,
+    host_node_pin_state: pin ? pinState : null,
+    host_node_observed: true
+  };
+}
+
 // src/lib/manager-worker.ts
 import { execFileSync as syncExecFile } from "child_process";
 import { join as join43, dirname as dirname11, delimiter as pathDelimiter } from "path";
@@ -15416,7 +15486,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1139" : "dev";
+var agtCliVersion = true ? "0.28.1141" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15597,8 +15667,22 @@ function recordHostNodeFailure(pin, reason) {
 async function diskNodeVersion() {
   const probe = await runAsync("node", ["--version"], { timeout: 15e3 });
   if (probe.code !== 0) return null;
-  const m = /^v?(\d+\.\d+\.\d+)/.exec(probe.stdout.trim());
-  return m?.[1] ?? null;
+  return parsePathNodeVersion(probe.stdout);
+}
+var hostNodeObservation = null;
+var hostNodeObservedAt = 0;
+function invalidateHostNodeObservation(pathVersion) {
+  hostNodeObservedAt = 0;
+  if (pathVersion !== void 0 && hostNodeObservation) {
+    hostNodeObservation = { ...hostNodeObservation, pathVersion };
+  }
+}
+async function refreshHostNodeObservation(now = Date.now()) {
+  if (!shouldReprobeHostNode(hostNodeObservedAt, now)) return;
+  hostNodeObservedAt = now;
+  hostNodeObservation = await probeHostNode(
+    (cmd, args) => runAsync(cmd, args, { timeout: 15e3 })
+  );
 }
 async function ensureHostNodeVersion(rawPin) {
   const pin = normalizeHostNodePinVersion(rawPin);
@@ -15628,7 +15712,7 @@ async function ensureHostNodeVersion(rawPin) {
         hostNodeNoDnfLogged = true;
         log(`[host-node] 'dnf' not found - cannot converge host Node onto ${pin} on this platform (leaving ${current ?? "unknown"} in place)`);
       }
-      hostNodeConvergence.recordSuccess(pin);
+      hostNodeConvergence.recordUnsupported(pin);
       return;
     }
     const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
@@ -15649,6 +15733,7 @@ async function ensureHostNodeVersion(rawPin) {
     }
     log(`[host-node] host Node is now ${pin} on disk. Running processes keep the previous binary until they restart - this does NOT restart the manager (ENG-11617).`);
     hostNodeConvergence.recordSuccess(pin);
+    invalidateHostNodeObservation(after);
   } catch (err) {
     recordHostNodeFailure(pin, `install attempt threw: ${isolationImageErrDetail(err)}`);
   } finally {
@@ -17317,6 +17402,8 @@ async function pollCycleInner() {
       } else {
         lastManagedSettingsStatus = null;
       }
+      await refreshHostNodeObservation();
+      const hostNodePin = hostNodeConvergence.desiredPin();
       const hbResp = await api.post("/host/heartbeat", {
         host_id: hostId,
         framework_version: cachedFrameworkVersion ?? void 0,
@@ -17330,6 +17417,17 @@ async function pollCycleInner() {
         // rather than as two fields a future edit could separate. See
         // `heartbeatRuntimeAuthFields`.
         ...heartbeatRuntimeAuthFields(runtimeAuthProbeVerdict),
+        // ENG-11639: host Node, and how the pin stands with this host. Spread as
+        // ONE unit for the same reason as the line above — the API stamps a
+        // freshness timestamp on receipt, so the values and their
+        // `host_node_observed` marker must never be editable apart. Omitted
+        // entirely until the first measurement, because ABSENCE MEANS NO SIGNAL
+        // here and must not be readable as either patched or unpatched.
+        ...heartbeatHostNodeFields(
+          hostNodeObservation,
+          hostNodePin,
+          hostNodePin ? hostNodeConvergence.stateOf(hostNodePin) : null
+        ),
         agent_diagnostics: agentDiagnostics,
         hostname: tailscaleHostname,
         os_username: osUsername,