@integrity-labs/agt-cli 0.28.1145 → 0.28.1147

package/dist/claude-code-updater-SWTQNL3W.js

@@ -0,0 +1,35 @@
+import {
+  CLAUDE_CODE_SECURITY_FLOOR,
+  WELL_KNOWN_CLAUDE_PATHS,
+  _resetClaudeCodeUpdaterState,
+  compareVersions,
+  hostHasLiveAgent,
+  isBelowSecurityFloor,
+  isConcreteVersion,
+  isNativeInstallPath,
+  maybeUpdateClaudeCode,
+  parseVersion,
+  probeClaudeInstalls,
+  readsAsNativeInstall,
+  shouldRunClaudeCodeUpdater
+} from "./chunk-WDC6ZLG5.js";
+import "./chunk-XWVM4KPK.js";
+import "./chunk-XZ6THC7Q.js";
+import "./chunk-EL5MWGGH.js";
+import "./chunk-DGUM43GV.js";
+export {
+  CLAUDE_CODE_SECURITY_FLOOR,
+  WELL_KNOWN_CLAUDE_PATHS,
+  _resetClaudeCodeUpdaterState,
+  compareVersions,
+  hostHasLiveAgent,
+  isBelowSecurityFloor,
+  isConcreteVersion,
+  isNativeInstallPath,
+  maybeUpdateClaudeCode,
+  parseVersion,
+  probeClaudeInstalls,
+  readsAsNativeInstall,
+  shouldRunClaudeCodeUpdater
+};
+//# sourceMappingURL=claude-code-updater-SWTQNL3W.js.map

package/dist/{claude-pair-runtime-VEDZCIJR.js → claude-pair-runtime-4GZOYK4O.js}

@@ -269,7 +269,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-JKD36BCM.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-JKX5IIHF.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -739,4 +739,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-VEDZCIJR.js.map
+//# sourceMappingURL=claude-pair-runtime-4GZOYK4O.js.map

package/dist/lib/manager-worker.js

@@ -13,6 +13,7 @@ import {
   TunnelWatcher,
   api,
   atomicWriteFileSync,
+  buildClaudeAgentMatcher,
   buildConnectivityProbeDeps,
   buildProbeEnv,
   classifyEnvIntegrationsDiff,
@@ -76,7 +77,11 @@ import {
   setConfigHash,
   shellGuard,
   tripClass
-} from "../chunk-IEZQK73G.js";
+} from "../chunk-SF7ZOIKU.js";
+import {
+  CLAUDE_CODE_SECURITY_FLOOR,
+  compareVersions
+} from "../chunk-WDC6ZLG5.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -163,7 +168,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-EZYLIFK2.js";
+} from "../chunk-NBKNLVIB.js";
 import {
   isAgentIdle,
   isStaleForToday,
@@ -172,7 +177,7 @@ import {
   sessionTranscriptDir,
   subagentActivityAgeSeconds,
   transcriptActivityAgeSeconds
-} from "../chunk-XAZ4C444.js";
+} from "../chunk-FISAZWZ3.js";
 import {
   classifyUnanswerablePane,
   focusedConfirmDialogBlock,
@@ -182,6 +187,7 @@ import {
   simpleTextHash
 } from "../chunk-B6UYVEMD.js";
 import {
+  parsePsRows,
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
 import {
@@ -287,7 +293,7 @@ import {
   serializeAccountEnforcementMarker,
   stabiliseResetInstant,
   sumTranscriptUsageInWindow
-} from "../chunk-FQD4EIUF.js";
+} from "../chunk-XZ6THC7Q.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -299,7 +305,7 @@ import "../chunk-DGUM43GV.js";
 
 // src/lib/manager-worker.ts
 import { createHash as createHash20 } from "crypto";
-import { readFileSync as readFileSync34, writeFileSync as writeFileSync18, mkdirSync as mkdirSync16, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync13, statSync as statSync14, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4 } from "fs";
+import { readFileSync as readFileSync34, writeFileSync as writeFileSync18, mkdirSync as mkdirSync16, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync13, statSync as statSync14, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4, readlinkSync as readlinkSync2 } from "fs";
 
 // src/lib/atomic-file-replace.ts
 import { copyFileSync, renameSync, unlinkSync } from "fs";
@@ -562,6 +568,161 @@ function heartbeatHostNodeFields(observation, pin, pinState) {
 
 // src/lib/manager-worker.ts
 import { execFileSync as syncExecFile } from "child_process";
+
+// src/lib/runtime-image-recycle.ts
+var RUNTIME_CLAUDE_CODE_SECURITY_FLOOR = CLAUDE_CODE_SECURITY_FLOOR;
+var RECYCLE_STAGGER_MS = 2 * 6e4;
+var CONTAINER_IMAGE_CACHE_MS = 5 * 6e4;
+var LOCAL_TAG_CACHE_MS = 6e4;
+function isBelowRuntimeFloor(version, floor = RUNTIME_CLAUDE_CODE_SECURITY_FLOOR) {
+  if (!version) return false;
+  const cmp = compareVersions(version, floor);
+  return cmp !== null && cmp < 0;
+}
+function isReplacedExeLink(link) {
+  return typeof link === "string" && link.endsWith(" (deleted)");
+}
+function isContainerImageStale(containerImageId, localTagImageId) {
+  if (!containerImageId || !localTagImageId) return false;
+  return containerImageId.trim() !== localTagImageId.trim();
+}
+function decideImageRecycleAction(i) {
+  if (!i.stale || !i.sessionHealthy) return "none";
+  if (!i.inWindow && !i.belowFloor) return "defer-window";
+  let verdict;
+  if (i.idle) {
+    verdict = "recycle";
+  } else if (i.belowFloor && i.belowFloorBusyForMs >= i.deadlineMs) {
+    const inboundFresh = i.recentInboundAgeSec !== null && i.recentInboundAgeSec < i.inboundGraceSec;
+    if (inboundFresh && i.inboundHeldMin < i.inboundHoldMaxMin) return "defer-inbound";
+    verdict = "recycle-deadline";
+  } else {
+    return "defer-busy";
+  }
+  if (i.sinceLastHostRecycleMs !== null && i.sinceLastHostRecycleMs < i.staggerMs) return "defer-stagger";
+  if (!i.deviceStateReady) return "defer-device-state";
+  return verdict;
+}
+var belowFloorBusySince = /* @__PURE__ */ new Map();
+var inboundHeldSince = /* @__PURE__ */ new Map();
+var containerImageCache = /* @__PURE__ */ new Map();
+var localTagCache = null;
+var hostSessionCache = /* @__PURE__ */ new Map();
+var lastHostRecycleAt = null;
+var lastLoggedDecision = /* @__PURE__ */ new Map();
+function containerImageIdFor(codeName, io) {
+  const now = io.now();
+  const hit = containerImageCache.get(codeName);
+  if (hit && now - hit.at < CONTAINER_IMAGE_CACHE_MS) return hit.imageId;
+  const imageId = io.inspectContainerImage(codeName);
+  containerImageCache.set(codeName, { at: now, imageId });
+  return imageId;
+}
+function hostSessionStateFor(codeName, io) {
+  const now = io.now();
+  const hit = hostSessionCache.get(codeName);
+  if (hit && now - hit.at < CONTAINER_IMAGE_CACHE_MS) return hit;
+  const probe = io.hostSessionBinary ? io.hostSessionBinary(codeName) : null;
+  const replaced = probe ? isReplacedExeLink(probe.exeLink) : false;
+  let version = null;
+  if (probe && replaced && io.runningBinaryVersion) {
+    const raw = io.runningBinaryVersion(probe.pid);
+    version = raw ? raw.match(/\d+\.\d+\.\d+[A-Za-z0-9.+-]*/)?.[0] ?? null : null;
+  }
+  const state10 = { at: now, pid: probe?.pid ?? null, replaced, version };
+  hostSessionCache.set(codeName, state10);
+  return state10;
+}
+function localTagImageIdFor(tag, io) {
+  const now = io.now();
+  if (localTagCache && localTagCache.tag === tag && now - localTagCache.at < LOCAL_TAG_CACHE_MS) {
+    return localTagCache.imageId;
+  }
+  const imageId = io.inspectTagImage(tag);
+  localTagCache = { at: now, tag, imageId };
+  return imageId;
+}
+function evaluateImageRecycle(args, io) {
+  const { codeName } = args;
+  const now = io.now();
+  if (!args.sessionHealthy) {
+    clearEpisode(codeName);
+    return "none";
+  }
+  const mode = args.mode ?? "container";
+  let stale;
+  let runningVersion;
+  let describe;
+  if (mode === "host") {
+    const host = hostSessionStateFor(codeName, io);
+    stale = host.replaced;
+    runningVersion = host.version;
+    describe = `host session pid ${host.pid ?? "unknown"} runs a replaced claude binary (running ${host.version ?? "unknown"})`;
+  } else {
+    const containerImage = containerImageIdFor(codeName, io);
+    const localImage = localTagImageIdFor(args.imageTag, io);
+    stale = isContainerImageStale(containerImage, localImage);
+    runningVersion = args.runtimeClaudeVersion;
+    const short = (id) => id ? id.replace(/^sha256:/, "").slice(0, 12) : "unknown";
+    describe = `runs image ${short(containerImage)}, ${args.imageTag} is ${short(localImage)}`;
+  }
+  if (!stale) {
+    clearEpisode(codeName);
+    return "none";
+  }
+  const belowFloor = isBelowRuntimeFloor(runningVersion, args.floor);
+  if (belowFloor && !args.idle) {
+    if (!belowFloorBusySince.has(codeName)) belowFloorBusySince.set(codeName, now);
+  } else {
+    belowFloorBusySince.delete(codeName);
+  }
+  const busySince = belowFloorBusySince.get(codeName);
+  const heldSince = inboundHeldSince.get(codeName);
+  const base = {
+    stale,
+    sessionHealthy: args.sessionHealthy,
+    inWindow: args.inWindow,
+    belowFloor,
+    idle: args.idle,
+    belowFloorBusyForMs: busySince === void 0 ? 0 : now - busySince,
+    deadlineMs: args.deadlineMs,
+    recentInboundAgeSec: args.recentInboundAgeSec,
+    inboundGraceSec: args.inboundGraceSec,
+    inboundHeldMin: heldSince === void 0 ? 0 : (now - heldSince) / 6e4,
+    inboundHoldMaxMin: args.inboundHoldMaxMin,
+    sinceLastHostRecycleMs: lastHostRecycleAt === null ? null : now - lastHostRecycleAt,
+    staggerMs: RECYCLE_STAGGER_MS,
+    deviceStateReady: true
+  };
+  let decision = decideImageRecycleAction(base);
+  if ((decision === "recycle" || decision === "recycle-deadline") && !args.deviceStateReady()) {
+    decision = decideImageRecycleAction({ ...base, deviceStateReady: false });
+  }
+  if (decision === "defer-inbound") {
+    if (!inboundHeldSince.has(codeName)) inboundHeldSince.set(codeName, now);
+  } else {
+    inboundHeldSince.delete(codeName);
+  }
+  if (lastLoggedDecision.get(codeName) !== decision) {
+    lastLoggedDecision.set(codeName, decision);
+    const floorNote = belowFloor ? ` running Claude Code ${runningVersion} is below the security floor ${args.floor ?? RUNTIME_CLAUDE_CODE_SECURITY_FLOOR};` : "";
+    io.log(`[runtime-image-recycle] '${codeName}' ${describe};${floorNote} decision=${decision}`);
+  }
+  return decision;
+}
+function noteRecycled(codeName, io) {
+  lastHostRecycleAt = io.now();
+  clearEpisode(codeName);
+  containerImageCache.delete(codeName);
+  hostSessionCache.delete(codeName);
+}
+function clearEpisode(codeName) {
+  belowFloorBusySince.delete(codeName);
+  inboundHeldSince.delete(codeName);
+  lastLoggedDecision.delete(codeName);
+}
+
+// src/lib/manager-worker.ts
 import { join as join43, dirname as dirname11, delimiter as pathDelimiter } from "path";
 import { homedir as homedir17, hostname, platform as platform3 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -14730,7 +14891,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-GGBDYMEW.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-IWC6K5NQ.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -15488,7 +15649,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1145" : "dev";
+var agtCliVersion = true ? "0.28.1147" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15630,6 +15791,61 @@ async function ensureToolkitCliInner(toolkitSlug) {
   }
 }
 var isolationImageEnsured = /* @__PURE__ */ new Set();
+var runtimeImageRecycleIo = {
+  now: () => Date.now(),
+  inspectContainerImage: (codeName) => {
+    try {
+      return syncExecFile("docker", ["inspect", "--format", "{{.Image}}", `agt-${codeName}`], {
+        timeout: 5e3,
+        stdio: ["ignore", "pipe", "ignore"]
+      }).toString().trim() || null;
+    } catch {
+      return null;
+    }
+  },
+  inspectTagImage: (tag) => {
+    try {
+      return syncExecFile("docker", ["image", "inspect", "--format", "{{.Id}}", tag], {
+        timeout: 5e3,
+        stdio: ["ignore", "pipe", "ignore"]
+      }).toString().trim() || null;
+    } catch {
+      return null;
+    }
+  },
+  // Non-isolated sessions: find `claude --name agt-<code>` (not the docker
+  // wrapper) and read its /proc exe link. Linux-only by nature; anywhere /proc
+  // is absent the link read fails, the session reads as current, and nothing
+  // recycles.
+  hostSessionBinary: (codeName) => {
+    try {
+      const matcher = buildClaudeAgentMatcher(codeName);
+      const ps = syncExecFile("ps", ["-eo", "pid,ppid,args"], { timeout: 5e3, maxBuffer: 16 * 1024 * 1024 }).toString();
+      const row = parsePsRows(ps).find((r) => matcher.test(r.args) && !/\bdocker\b/.test(r.args));
+      if (!row) return null;
+      let exeLink = null;
+      try {
+        exeLink = readlinkSync2(`/proc/${row.pid}/exe`);
+      } catch {
+        exeLink = null;
+      }
+      return { pid: row.pid, exeLink };
+    } catch {
+      return null;
+    }
+  },
+  runningBinaryVersion: (pid) => {
+    try {
+      return syncExecFile(`/proc/${pid}/exe`, ["--version"], {
+        timeout: 1e4,
+        stdio: ["ignore", "pipe", "ignore"]
+      }).toString().trim() || null;
+    } catch {
+      return null;
+    }
+  },
+  log: (msg) => log(msg)
+};
 var isolationImageRetryAfter = /* @__PURE__ */ new Map();
 var isolationImageFailureCount = /* @__PURE__ */ new Map();
 var isolationImageInFlight = /* @__PURE__ */ new Set();
@@ -17208,7 +17424,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-JKD36BCM.js");
+      const { collectDiagnostics } = await import("../persistent-session-JKX5IIHF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -17350,7 +17566,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-JKD36BCM.js");
+      const { collectDiagnostics } = await import("../persistent-session-JKX5IIHF.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -17550,7 +17766,7 @@ async function pollCycleInner() {
       setConfigHash(hbResp?.config_hash ?? null);
       try {
         const desiredClaudeCodeVersion = hbResp?.desired_claude_code_version?.trim();
-        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-HTDCRIMM.js");
+        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-SWTQNL3W.js");
         if (desiredClaudeCodeVersion && shouldRunClaudeCodeUpdater({
           desiredVersion: desiredClaudeCodeVersion,
           installedVersion: cachedFrameworkVersion,
@@ -17575,7 +17791,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-GGBDYMEW.js");
+      } = await import("../responsiveness-probe-IWC6K5NQ.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -17692,7 +17908,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-GGBDYMEW.js");
+        } = await import("../responsiveness-probe-IWC6K5NQ.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -17978,7 +18194,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-GGBDYMEW.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-IWC6K5NQ.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -18009,7 +18225,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-JKD36BCM.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-JKX5IIHF.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -18174,7 +18390,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-7AG56OKQ.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-U5JSZD5Z.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -22157,6 +22373,48 @@ async function ensurePersistentSessionUnchecked(agent, tasks, boardItems, refres
   if (rolloverDecision !== "inbound-wait") {
     dayRolloverInboundHold.delete(codeName);
   }
+  if (restartTrigger === null) {
+    try {
+      const recycleMode = isolationMode(codeName) === "docker" ? "container" : "host";
+      const recycleSessionHealthy = isSessionHealthy(codeName);
+      const recycleCurrent = recycleSessionHealthy ? peekCurrentSession(codeName) : null;
+      const recycleIdle = recycleCurrent ? isAgentIdle(projectDir, recycleCurrent.sessionId) : false;
+      const runtimeSample = runtimeVersionFor(codeName);
+      const runtimeClaudeVersion = recycleMode === "container" ? runtimeSample.state === "ok" ? runtimeSample.version : null : hostSessionStateFor(codeName, runtimeImageRecycleIo).version;
+      const recycleBelowFloor = isBelowRuntimeFloor(runtimeClaudeVersion);
+      const recycleDecision = evaluateImageRecycle(
+        {
+          codeName,
+          mode: recycleMode,
+          imageTag: process.env.AGT_ISOLATION_IMAGE || "agt-runtime:latest",
+          sessionHealthy: recycleSessionHealthy && recycleCurrent !== null,
+          inWindow: decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "proceed",
+          runtimeClaudeVersion,
+          idle: recycleIdle,
+          // Only stat the channel dirs when a forced recycle is on the table.
+          recentInboundAgeSec: recycleBelowFloor && !recycleIdle ? await channelInboundActivityAgeSecondsFor(codeName) : null,
+          inboundGraceSec: DAY_ROLLOVER_INBOUND_GRACE_SEC,
+          inboundHoldMaxMin: DAY_ROLLOVER_INBOUND_DEFER_MAX_MIN,
+          deadlineMs: FORCED_UPDATE_HARD_DEADLINE_MS,
+          deviceStateReady: () => deviceStateAllowsRollover(codeName, "force-reset")
+        },
+        runtimeImageRecycleIo
+      );
+      if (recycleDecision === "recycle" || recycleDecision === "recycle-deadline") {
+        const tornDown = stopPersistentSessionAndForgetMcpBaseline(codeName, "runtime-image-update", void 0, void 0, {
+          reason: recycleDecision === "recycle-deadline" ? `${recycleMode === "container" ? "container" : "host session"} below Claude Code security floor ${RUNTIME_CLAUDE_CODE_SECURITY_FLOOR}; busy past the deadline, recycled onto the current ${recycleMode === "container" ? "agt-runtime image" : "claude binary"}` : recycleMode === "container" ? "container running a superseded agt-runtime image; recycled between turns" : "host session running a replaced claude binary; recycled between turns",
+          detail: { runtime_claude_version: runtimeClaudeVersion, decision: recycleDecision, mode: recycleMode }
+        });
+        if (tornDown) {
+          agentState.persistentSessionAgents.delete(codeName);
+          noteRecycled(codeName, runtimeImageRecycleIo);
+          restartTrigger = "runtime-image";
+        }
+      }
+    } catch (err) {
+      log(`[runtime-image-recycle] check failed for '${codeName}' (leaving the session alone): ${err.message}`);
+    }
+  }
   if (restartTrigger === "day-rollover") {
     rotatePaneLogForDayRollover(codeName, log, agentTimezone);
   }
@@ -22532,7 +22790,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash20("sha256")
       break;
     }
   }
-  const finalDecision = restartTrigger === "auth-tuple" ? "restart-pending" : restartTrigger === "day-rollover" ? dayRolloverForced ? "day-rollover-forced" : "day-rollover-restart" : dayRolloverDeferred ? "day-rollover-deferred" : "healthy";
+  const finalDecision = restartTrigger === "auth-tuple" || restartTrigger === "runtime-image" ? "restart-pending" : restartTrigger === "day-rollover" ? dayRolloverForced ? "day-rollover-forced" : "day-rollover-restart" : dayRolloverDeferred ? "day-rollover-deferred" : "healthy";
   return {
     decision: finalDecision,
     spawnAttempted: false,
@@ -22772,7 +23030,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-GGBDYMEW.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-IWC6K5NQ.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -22815,7 +23073,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-JKD36BCM.js");
+        const { collectDiagnostics } = await import("../persistent-session-JKX5IIHF.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22866,7 +23124,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-JKD36BCM.js");
+      const { collectDiagnostics } = await import("../persistent-session-JKX5IIHF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -23539,7 +23797,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-VEDZCIJR.js");
+  } = await import("../claude-pair-runtime-4GZOYK4O.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));