@integrity-labs/agt-cli 0.28.1166 → 0.28.1168

package/dist/lib/manager-worker.js

@@ -77,12 +77,13 @@ import {
   setConfigHash,
   shellGuard,
   tripClass
-} from "../chunk-UX3TDTVM.js";
+} from "../chunk-Y4DBRVXD.js";
 import {
   CLAUDE_CODE_SECURITY_FLOOR,
   SELF_UPDATE_TIMEOUTS,
   anyPackageInstallRunning,
   compareVersions,
+  effectiveSecurityFloor,
   ensureDiskForSelfUpdate,
   maybeRunDiskGuard,
   readDiskStat,
@@ -90,7 +91,7 @@ import {
   runSafeCleanup,
   tightestDiskStat,
   withPackageCacheLock
-} from "../chunk-6KJFIVYJ.js";
+} from "../chunk-IV2UENRG.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -177,7 +178,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-NOCTCO7G.js";
+} from "../chunk-AJTF72A2.js";
 import {
   isAgentIdle,
   isStaleForToday,
@@ -186,7 +187,7 @@ import {
   sessionTranscriptDir,
   subagentActivityAgeSeconds,
   transcriptActivityAgeSeconds
-} from "../chunk-ZSCZDOHR.js";
+} from "../chunk-AV4KD3HE.js";
 import {
   classifyUnanswerablePane,
   focusedConfirmDialogBlock,
@@ -304,7 +305,7 @@ import {
   serializeAccountEnforcementMarker,
   stabiliseResetInstant,
   sumTranscriptUsageInWindow
-} from "../chunk-I5NQ762W.js";
+} from "../chunk-7IAJXJ7C.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -581,11 +582,10 @@ function heartbeatHostNodeFields(observation, pin, pinState) {
 import { execFileSync as syncExecFile } from "child_process";
 
 // src/lib/runtime-image-recycle.ts
-var RUNTIME_CLAUDE_CODE_SECURITY_FLOOR = CLAUDE_CODE_SECURITY_FLOOR;
 var RECYCLE_STAGGER_MS = 2 * 6e4;
 var CONTAINER_IMAGE_CACHE_MS = 5 * 6e4;
 var LOCAL_TAG_CACHE_MS = 6e4;
-function isBelowRuntimeFloor(version, floor = RUNTIME_CLAUDE_CODE_SECURITY_FLOOR) {
+function isBelowRuntimeFloor(version, floor = CLAUDE_CODE_SECURITY_FLOOR) {
   if (!version) return false;
   const cmp = compareVersions(version, floor);
   return cmp !== null && cmp < 0;
@@ -716,7 +716,7 @@ function evaluateImageRecycle(args, io) {
   }
   if (lastLoggedDecision.get(codeName) !== decision) {
     lastLoggedDecision.set(codeName, decision);
-    const floorNote = belowFloor ? ` running Claude Code ${runningVersion} is below the security floor ${args.floor ?? RUNTIME_CLAUDE_CODE_SECURITY_FLOOR};` : "";
+    const floorNote = belowFloor ? ` running Claude Code ${runningVersion} is below the security floor ${args.floor ?? CLAUDE_CODE_SECURITY_FLOOR};` : "";
     io.log(`[runtime-image-recycle] '${codeName}' ${describe};${floorNote} decision=${decision}`);
   }
   return decision;
@@ -15082,7 +15082,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-6K6SVHRK.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-ZEK2TD5E.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -15868,13 +15868,17 @@ function clearAgentCaches(agentId, codeName) {
 }
 var cachedFrameworkVersion = null;
 var cachedMaintenanceWindow = null;
+var cachedServerSecurityFloor = null;
+function currentSecurityFloor() {
+  return effectiveSecurityFloor(cachedServerSecurityFloor);
+}
 var cachedDesiredAgtCliVersion = null;
 var desiredAgtCliVersionHydrated = false;
 var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1166" : "dev";
+var agtCliVersion = true ? "0.28.1168" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -17674,7 +17678,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-YQLP5NPI.js");
+      const { collectDiagnostics } = await import("../persistent-session-LKJVSRHX.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -17817,7 +17821,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-YQLP5NPI.js");
+      const { collectDiagnostics } = await import("../persistent-session-LKJVSRHX.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -18002,6 +18006,10 @@ async function pollCycleInner() {
       if (hbResp?.maintenance_window) {
         cachedMaintenanceWindow = hbResp.maintenance_window;
       }
+      if (hbResp && Object.prototype.hasOwnProperty.call(hbResp, "claude_code_security_floor")) {
+        const serverFloor = hbResp.claude_code_security_floor;
+        cachedServerSecurityFloor = typeof serverFloor === "string" ? serverFloor : null;
+      }
       if (hbResp) {
         desiredAgtCliVersionHydrated = true;
         if ("desired_agt_cli_version" in hbResp) {
@@ -18017,7 +18025,8 @@ async function pollCycleInner() {
       setConfigHash(hbResp?.config_hash ?? null);
       try {
         const desiredClaudeCodeVersion = hbResp?.desired_claude_code_version?.trim();
-        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-VRZ7MMKO.js");
+        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-WD4NNWY5.js");
+        const securityFloor = currentSecurityFloor();
         claudeUpdaterInFlight = true;
         if (desiredClaudeCodeVersion && (claudePairLoop.busy || claudePairingInProgress())) {
           log(
@@ -18026,12 +18035,14 @@ async function pollCycleInner() {
         } else if (desiredClaudeCodeVersion && shouldRunClaudeCodeUpdater({
           desiredVersion: desiredClaudeCodeVersion,
           installedVersion: cachedFrameworkVersion,
-          windowGate: decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() })
+          windowGate: decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }),
+          floor: securityFloor
         })) {
           await maybeUpdateClaudeCode({
             desiredVersion: desiredClaudeCodeVersion,
             currentVersion: cachedFrameworkVersion,
-            log
+            log,
+            securityFloor
           });
         }
       } catch (err) {
@@ -18049,7 +18060,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-6K6SVHRK.js");
+      } = await import("../responsiveness-probe-ZEK2TD5E.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -18166,7 +18177,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-6K6SVHRK.js");
+        } = await import("../responsiveness-probe-ZEK2TD5E.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -18452,7 +18463,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-6K6SVHRK.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-ZEK2TD5E.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -18483,7 +18494,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-YQLP5NPI.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-LKJVSRHX.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -18648,7 +18659,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-M4KYOBXK.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-TSARKC55.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -22671,7 +22682,8 @@ async function ensurePersistentSessionUnchecked(agent, tasks, boardItems, refres
       const recycleIdle = recycleCurrent ? isAgentIdle(projectDir, recycleCurrent.sessionId) : false;
       const runtimeSample = runtimeVersionFor(codeName);
       const runtimeClaudeVersion = recycleMode === "container" ? runtimeSample.state === "ok" ? runtimeSample.version : null : hostSessionStateFor(codeName, runtimeImageRecycleIo).version;
-      const recycleBelowFloor = isBelowRuntimeFloor(runtimeClaudeVersion);
+      const recycleFloor = currentSecurityFloor();
+      const recycleBelowFloor = isBelowRuntimeFloor(runtimeClaudeVersion, recycleFloor);
       const recycleDecision = evaluateImageRecycle(
         {
           codeName,
@@ -22680,6 +22692,7 @@ async function ensurePersistentSessionUnchecked(agent, tasks, boardItems, refres
           sessionHealthy: recycleSessionHealthy && recycleCurrent !== null,
           inWindow: decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "proceed",
           runtimeClaudeVersion,
+          floor: recycleFloor,
           idle: recycleIdle,
           // Only stat the channel dirs when a forced recycle is on the table.
           recentInboundAgeSec: recycleBelowFloor && !recycleIdle ? await channelInboundActivityAgeSecondsFor(codeName) : null,
@@ -22692,8 +22705,8 @@ async function ensurePersistentSessionUnchecked(agent, tasks, boardItems, refres
       );
       if (recycleDecision === "recycle" || recycleDecision === "recycle-deadline") {
         const tornDown = stopPersistentSessionAndForgetMcpBaseline(codeName, "runtime-image-update", void 0, void 0, {
-          reason: recycleDecision === "recycle-deadline" ? `${recycleMode === "container" ? "container" : "host session"} below Claude Code security floor ${RUNTIME_CLAUDE_CODE_SECURITY_FLOOR}; busy past the deadline, recycled onto the current ${recycleMode === "container" ? "agt-runtime image" : "claude binary"}` : recycleMode === "container" ? "container running a superseded agt-runtime image; recycled between turns" : "host session running a replaced claude binary; recycled between turns",
-          detail: { runtime_claude_version: runtimeClaudeVersion, decision: recycleDecision, mode: recycleMode }
+          reason: recycleDecision === "recycle-deadline" ? `${recycleMode === "container" ? "container" : "host session"} below Claude Code security floor ${recycleFloor}; busy past the deadline, recycled onto the current ${recycleMode === "container" ? "agt-runtime image" : "claude binary"}` : recycleMode === "container" ? "container running a superseded agt-runtime image; recycled between turns" : "host session running a replaced claude binary; recycled between turns",
+          detail: { runtime_claude_version: runtimeClaudeVersion, decision: recycleDecision, mode: recycleMode, security_floor: recycleFloor }
         });
         if (tornDown) {
           agentState.persistentSessionAgents.delete(codeName);
@@ -23316,7 +23329,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-6K6SVHRK.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-ZEK2TD5E.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -23359,7 +23372,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-YQLP5NPI.js");
+        const { collectDiagnostics } = await import("../persistent-session-LKJVSRHX.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -23410,7 +23423,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-YQLP5NPI.js");
+      const { collectDiagnostics } = await import("../persistent-session-LKJVSRHX.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -24104,7 +24117,7 @@ async function processClaudePairSessions(agents) {
     snapshotPairConfig,
     // ENG-11659: result -> report body + the manager.log line that records it.
     planPairStartReport
-  } = await import("../claude-pair-runtime-HOIYDAGM.js");
+  } = await import("../claude-pair-runtime-JWXVVSSG.js");
   const { resetClaudeSignin, describeSigninResetForLog, describeSigninResetFailure } = await import("../claude-signin-reset-EF3UO5IK.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);