@integrity-labs/agt-cli 0.28.1170 → 0.28.1172

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-6UXQEE6G.js";
+} from "../chunk-7XUOPTSD.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5513,7 +5513,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1170" : "dev";
+var cliVersion = true ? "0.28.1172" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6773,7 +6773,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1170" : "dev";
+var cliVersion2 = true ? "0.28.1172" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-6UXQEE6G.js → chunk-7XUOPTSD.js}

@@ -8078,7 +8078,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1170" : "dev";
+var agtCliVersion = true ? "0.28.1172" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -13235,4 +13235,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-6UXQEE6G.js.map
+//# sourceMappingURL=chunk-7XUOPTSD.js.map

package/dist/lib/manager-worker.js

@@ -77,7 +77,7 @@ import {
   setConfigHash,
   shellGuard,
   tripClass
-} from "../chunk-6UXQEE6G.js";
+} from "../chunk-7XUOPTSD.js";
 import {
   CLAUDE_CODE_SECURITY_FLOOR,
   SELF_UPDATE_TIMEOUTS,
@@ -970,7 +970,9 @@ function claudeCodeUpgradeThrottled() {
 
 // src/lib/claude-pair-loop.ts
 var PAIR_LOOP_ACTIVE_INTERVAL_MS = 2e3;
-var PAIR_LOOP_IDLE_INTERVAL_MS = 1e4;
+var PAIR_LOOP_IDLE_INTERVAL_MS = 3e4;
+var PAIR_LOOP_FIRST_TICK_MS = 1e4;
+var PAIR_LOOP_FAILURE_BASE_MS = 1e4;
 var PAIR_LOOP_MAX_BACKOFF_MS = 12e4;
 var PAIR_LOOP_ARMED_MAX_MS = 15 * 6e4;
 function pairLoopArmed(opts) {
@@ -993,7 +995,8 @@ function pairLoopArmed(opts) {
 function nextPairLoopDelayMs(armed, consecutiveFailures) {
   if (consecutiveFailures > 0) {
     const exp = Math.min(consecutiveFailures - 1, 16);
-    return Math.min(PAIR_LOOP_IDLE_INTERVAL_MS * 2 ** exp, PAIR_LOOP_MAX_BACKOFF_MS);
+    const backoff = Math.min(PAIR_LOOP_FAILURE_BASE_MS * 2 ** exp, PAIR_LOOP_MAX_BACKOFF_MS);
+    return armed ? backoff : Math.max(backoff, PAIR_LOOP_IDLE_INTERVAL_MS);
   }
   return armed ? PAIR_LOOP_ACTIVE_INTERVAL_MS : PAIR_LOOP_IDLE_INTERVAL_MS;
 }
@@ -1013,11 +1016,11 @@ var ClaudePairLoop = class {
   inFlightTick = null;
   setTimer;
   clearTimer;
-  /** Arm the loop. The first tick runs after one idle interval. Idempotent. */
+  /** Arm the loop. The first tick runs after {@link PAIR_LOOP_FIRST_TICK_MS}. Idempotent. */
   start() {
     if (this.started) return;
     this.started = true;
-    this.schedule(PAIR_LOOP_IDLE_INTERVAL_MS);
+    this.schedule(PAIR_LOOP_FIRST_TICK_MS);
   }
   /**
    * Disarm the loop. No new tick starts, and a callback from this generation
@@ -7452,6 +7455,21 @@ function createTickBoardFetcher(fetchBoard) {
     return inflight;
   };
 }
+async function fetchBoardThroughGate(opts) {
+  const now = opts.now ?? Date.now;
+  const token = opts.gate.beginFetch(opts.key);
+  if (!opts.gate.shouldFetch(opts.key, now())) {
+    const held = opts.held();
+    if (held !== void 0) {
+      opts.onDecision?.("gated");
+      return held;
+    }
+  }
+  const rows = await opts.fetch();
+  opts.gate.markFetched(opts.key, token, now());
+  opts.onDecision?.("fetched");
+  return rows;
+}
 
 // src/lib/kanban-board-token.ts
 var BoardTokenCache = class {
@@ -7510,6 +7528,20 @@ var BoardTokenCache = class {
     }
     return rows;
   }
+  /**
+   * ENG-11720: the raw rows of the last board a successful request returned, or
+   * undefined when none is held. Served by the `/host/my-kanban` fetch gate
+   * while it is closed. Returns the held array itself: the one caller re-maps
+   * it through `sanitizeBoardItem` on every serve, which is what keeps the
+   * consumers from aliasing it (see the header).
+   *
+   * Counts nothing. The stats above describe what the conditional REQUEST did,
+   * and a gated pass made no request — counting it as `unchanged` would report
+   * a server-confirmed hit that never happened.
+   */
+  held(agentId) {
+    return this.entries.get(agentId)?.rows;
+  }
   /**
    * Drop an agent's board. Teardown must call this: a board left behind is
    * served to the agent if it is later RE-ADDED, which is exactly when its work
@@ -7583,6 +7615,13 @@ function createFetchGate(ttlMs) {
     }
   };
 }
+async function runIfDue(gate, key, fn, now = Date.now) {
+  const token = gate.beginFetch(key);
+  if (!gate.shouldFetch(key, now())) return { ran: false };
+  const value = await fn();
+  gate.markFetched(key, token, now());
+  return { ran: true, value };
+}
 function forceGates(gates, agentId) {
   for (const gate of gates) {
     if (agentId === void 0) gate.forceAll();
@@ -13898,7 +13937,15 @@ function recordLatency(ms) {
   }
 }
 function startRealtimeKanban(config2) {
-  const { agentIds, onTodayItem, onCompletion, log: log2 } = config2;
+  const { agentIds, onTodayItem, onCompletion, onBoardChanged, log: log2 } = config2;
+  const boardChanged = (agentId) => {
+    if (!onBoardChanged || !agentId) return;
+    try {
+      onBoardChanged(agentId);
+    } catch (err) {
+      log2(`[realtime] Kanban board-change handler error: ${err.message}`);
+    }
+  };
   if (agentIds.length === 0) return;
   const sb = ensureClient(config2);
   const filterStr = agentIds.length === 1 ? `agent_id=eq.${agentIds[0]}` : `agent_id=in.(${agentIds.join(",")})`;
@@ -13909,6 +13956,7 @@ function startRealtimeKanban(config2) {
     filter: filterStr
   }, (payload) => {
     const item = payload.new;
+    boardChanged(item?.agent_id);
     if (item.status === "todo") {
       log2(`[realtime] New kanban item in 'todo': item_id=${item.id} agent=${item.agent_id}`);
       onTodayItem(item);
@@ -13921,6 +13969,7 @@ function startRealtimeKanban(config2) {
   }, (payload) => {
     const item = payload.new;
     const old = payload.old;
+    boardChanged(item?.agent_id);
     if (item.status === "todo" && old.status !== "todo") {
       log2(`[realtime] Kanban item moved to 'todo': item_id=${item.id} agent=${item.agent_id}`);
       onTodayItem(item);
@@ -15830,6 +15879,7 @@ function clearAgentCaches(agentId, codeName) {
   pendingRecoveryCost.delete(codeName);
   lastRefreshPayload.delete(agentId);
   boardTokenCache.forget(agentId);
+  boardFetchGate.forget(agentId);
   refreshFetchGate.forget(agentId);
   memoriesFetchGate.forget(agentId);
   secretsFetchGate.forget(agentId);
@@ -15878,7 +15928,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1170" : "dev";
+var agtCliVersion = true ? "0.28.1172" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -17627,6 +17677,11 @@ var integrationsFetchGate = createFetchGate(DESIRED_STATE_FETCH_TTL_MS);
 var lastIntegrationsPayload = /* @__PURE__ */ new Map();
 var quarantinedFetchGate = createFetchGate(DESIRED_STATE_FETCH_TTL_MS);
 var lastQuarantinedPayload = /* @__PURE__ */ new Map();
+var MY_KANBAN_FETCH_TTL_MS = 3e4;
+var boardFetchGate = createFetchGate(MY_KANBAN_FETCH_TTL_MS);
+var RECURRING_SPAWN_INTERVAL_MS = 6e4;
+var RECURRING_SPAWN_GATE_KEY = "host";
+var recurringSpawnGate = createFetchGate(RECURRING_SPAWN_INTERVAL_MS);
 function forceIntegrationsFetch(agentId) {
   integrationsFetchGate.forceNext(agentId);
   quarantinedFetchGate.forceNext(agentId);
@@ -17639,13 +17694,20 @@ var pollCycleQuarantinedFetches = 0;
 var pollCycleQuarantinedSkips = 0;
 var pollCycleMemoriesUnchanged = 0;
 var pollCycleMemoriesFull = 0;
+var pollCycleBoardFetched = 0;
+var pollCycleBoardGated = 0;
 var DESIRED_STATE_FETCH_GATES = [
   refreshFetchGate,
   memoriesFetchGate,
   secretsFetchGate,
   defaultSchedulesFetchGate,
   integrationsFetchGate,
-  quarantinedFetchGate
+  quarantinedFetchGate,
+  // ENG-11720. None of the lanes reaching here changes the board (the board
+  // has its own push, `onBoardChanged`), so this entry is the maintenance rule
+  // above applied, not a freshness requirement. Cost: one board round trip for
+  // the pushed agent, which is the pre-gate every-pass behaviour at worst.
+  boardFetchGate
 ];
 function forceRefreshFetch(agentId) {
   forceGates(DESIRED_STATE_FETCH_GATES, agentId);
@@ -19062,6 +19124,8 @@ async function pollCycleInner() {
     pollCycleQuarantinedSkips = 0;
     pollCycleMemoriesUnchanged = 0;
     pollCycleMemoriesFull = 0;
+    pollCycleBoardFetched = 0;
+    pollCycleBoardGated = 0;
     boardTokenCache.resetStats();
     for (const agent of processOrder) {
       if (restartInFlight.has(agent.agent_id)) {
@@ -19103,7 +19167,7 @@ async function pollCycleInner() {
     }
     const boardStats = boardTokenCache.stats();
     log(
-      `[poll-cycle] agents=${processOrder.length} refresh_fetched=${pollCycleFetches} refresh_skipped=${pollCycleFetchSkips} memories_unchanged=${pollCycleMemoriesUnchanged} memories_full=${pollCycleMemoriesFull} board_unchanged=${boardStats.unchanged} board_full=${boardStats.full} board_refetch=${boardStats.refetch} integrations_fetched=${pollCycleIntegrationsFetches} integrations_skipped=${pollCycleIntegrationsSkips} quarantined_fetched=${pollCycleQuarantinedFetches} quarantined_skipped=${pollCycleQuarantinedSkips} duration_ms=${Date.now() - cycleStartedAt}`
+      `[poll-cycle] agents=${processOrder.length} refresh_fetched=${pollCycleFetches} refresh_skipped=${pollCycleFetchSkips} memories_unchanged=${pollCycleMemoriesUnchanged} memories_full=${pollCycleMemoriesFull} board_unchanged=${boardStats.unchanged} board_full=${boardStats.full} board_refetch=${boardStats.refetch} board_fetched=${pollCycleBoardFetched} board_gated=${pollCycleBoardGated} integrations_fetched=${pollCycleIntegrationsFetches} integrations_skipped=${pollCycleIntegrationsSkips} quarantined_fetched=${pollCycleQuarantinedFetches} quarantined_skipped=${pollCycleQuarantinedSkips} duration_ms=${Date.now() - cycleStartedAt}`
     );
     void maybeReportActivityCache({ api, log });
     const crossAgentPrune = managedPruneLedger.summarize();
@@ -19340,9 +19404,13 @@ async function pollCycleInner() {
     ensureRealtimeKanbanStarted(agentStates);
     ensureRealtimeIntegrationContextStarted(agentStates);
     try {
-      const spawnData = await api.post("/host/kanban/recurring/spawn");
-      if (spawnData.spawned > 0) {
-        log(`Spawned ${spawnData.spawned} recurring kanban item(s)`);
+      const spawn = await runIfDue(
+        recurringSpawnGate,
+        RECURRING_SPAWN_GATE_KEY,
+        () => api.post("/host/kanban/recurring/spawn")
+      );
+      if (spawn.ran && spawn.value.spawned > 0) {
+        log(`Spawned ${spawn.value.spawned} recurring kanban item(s)`);
       }
     } catch {
     }
@@ -21491,23 +21559,35 @@ async function processAgent(agent, agentStates, managedToolkits) {
     }
   }
   const fetchTickBoard = createTickBoardFetcher(async () => {
-    const knownToken = boardTokenCache.tokenFor(agent.agent_id);
-    const post = (token) => api.post("/host/my-kanban", {
-      agent_id: agent.agent_id,
-      // ENG-9585: this is the ONLY caller that polls (every ~10s, per agent),
-      // and it reads exactly `BoardItem`. `description` and `notes` are 57.8%
-      // of the payload and are read here by nothing — but the `kanban_list` MCP
-      // tool and `agt kanban` DO read them, so the route cannot simply drop
-      // them. Asking for the lean shape is this caller saying what it needs;
-      // every other caller keeps the full payload by default.
-      detail: "board",
-      ...token ? { known_token: token } : {}
+    const rawRows = await fetchBoardThroughGate({
+      key: agent.agent_id,
+      gate: boardFetchGate,
+      held: () => boardTokenCache.held(agent.agent_id),
+      onDecision: (decision) => {
+        if (decision === "gated") pollCycleBoardGated += 1;
+        else pollCycleBoardFetched += 1;
+      },
+      fetch: async () => {
+        const knownToken = boardTokenCache.tokenFor(agent.agent_id);
+        const post = (token) => api.post("/host/my-kanban", {
+          agent_id: agent.agent_id,
+          // ENG-9585: this is the ONLY caller that polls (every ~10s, per agent),
+          // and it reads exactly `BoardItem`. `description` and `notes` are 57.8%
+          // of the payload and are read here by nothing — but the `kanban_list` MCP
+          // tool and `agt kanban` DO read them, so the route cannot simply drop
+          // them. Asking for the lean shape is this caller saying what it needs;
+          // every other caller keeps the full payload by default.
+          detail: "board",
+          ...token ? { known_token: token } : {}
+        });
+        let rows = boardTokenCache.resolve(agent.agent_id, await post(knownToken));
+        if (rows === null) {
+          rows = boardTokenCache.resolve(agent.agent_id, await post(void 0)) ?? [];
+        }
+        return rows;
+      }
     });
-    let rows = boardTokenCache.resolve(agent.agent_id, await post(knownToken));
-    if (rows === null) {
-      rows = boardTokenCache.resolve(agent.agent_id, await post(void 0)) ?? [];
-    }
-    return rows.map(sanitizeBoardItem);
+    return rawRows.map(sanitizeBoardItem);
   });
   let boardItems = [];
   let boardItemsStale = false;
@@ -22110,6 +22190,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
                 reason: `Timed out \u2014 in progress for ${age} minutes with no update`
               });
               reapAction = reapResult.action ?? null;
+              boardFetchGate.forceNext(agentId);
               log(
                 `Reap result for item_id=${item.id}: updated=${reapResult.updated} action=${reapResult.action ?? reapResult.reason ?? "none"}`
               );
@@ -23495,6 +23576,14 @@ function ensureRealtimeKanbanStarted(agentStates) {
       supabaseAnonKey: exchange.supabaseAnonKey,
       token: exchange.token,
       agentIds: activeAgentIds,
+      // ENG-11720: what makes the `/host/my-kanban` gate safe. Any change to one
+      // of this agent's cards reopens it, so the next pass fetches — no early
+      // poll, because a card change is not urgent enough to pull a whole cycle
+      // forward, and forces are counters, so a burst of UPDATEs (embedding
+      // writes, notes) still costs at most one fetch per pass.
+      onBoardChanged: (agentId) => {
+        boardFetchGate.forceNext(agentId);
+      },
       onTodayItem: (item) => {
         if (item.source_type === "scheduled_task") return;
         const agent = agentStates.find((a) => a.agentId === item.agent_id);