@integrity-labs/agt-cli 0.28.1191 → 0.28.1193

package/dist/{claude-code-updater-JPVLPWVR.js → claude-code-updater-EOJQHUZ2.js}

@@ -13,9 +13,9 @@ import {
   probeClaudeInstalls,
   readsAsNativeInstall,
   shouldRunClaudeCodeUpdater
-} from "./chunk-VS3QXUDM.js";
+} from "./chunk-UQYIFOWE.js";
 import "./chunk-XWVM4KPK.js";
-import "./chunk-GRU6GNLP.js";
+import "./chunk-UUO7QTLC.js";
 import "./chunk-AIUIMEUS.js";
 import "./chunk-DGUM43GV.js";
 export {
@@ -34,4 +34,4 @@ export {
   readsAsNativeInstall,
   shouldRunClaudeCodeUpdater
 };
-//# sourceMappingURL=claude-code-updater-JPVLPWVR.js.map
+//# sourceMappingURL=claude-code-updater-EOJQHUZ2.js.map

package/dist/{claude-pair-runtime-JXXYGKWS.js → claude-pair-runtime-WKTA3HNF.js}

@@ -8,7 +8,7 @@ import {
 import {
   redactPaneFrame,
   sanitizeTerminalFrame
-} from "./chunk-GRU6GNLP.js";
+} from "./chunk-UUO7QTLC.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -321,7 +321,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-NSA3UYRF.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-5MGJGJIB.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -836,4 +836,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-JXXYGKWS.js.map
+//# sourceMappingURL=claude-pair-runtime-WKTA3HNF.js.map

package/dist/lib/manager-worker.js

@@ -83,7 +83,7 @@ import {
   tripClass,
   writeEtcEnvironment,
   writeProfileDScript
-} from "../chunk-5RDPFXWO.js";
+} from "../chunk-ZTA7AGKM.js";
 import {
   CLAUDE_CODE_SECURITY_FLOOR,
   SELF_UPDATE_TIMEOUTS,
@@ -97,7 +97,7 @@ import {
   runSafeCleanup,
   tightestDiskStat,
   withPackageCacheLock
-} from "../chunk-VS3QXUDM.js";
+} from "../chunk-UQYIFOWE.js";
 import {
   rewriteSupervisorApiKey,
   supervisorChannelsRefusing
@@ -190,7 +190,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-L5BWZX3Z.js";
+} from "../chunk-NJ2AUTIO.js";
 import {
   isAgentIdle,
   isStaleForToday,
@@ -200,7 +200,7 @@ import {
   sessionTranscriptDir,
   subagentActivityAgeSeconds,
   transcriptActivityAgeSeconds
-} from "../chunk-7T4CZ2NS.js";
+} from "../chunk-DXLSLT5G.js";
 import {
   classifyUnanswerablePane,
   focusedConfirmDialogBlock,
@@ -318,6 +318,7 @@ import {
   resolveChannels,
   resolveCrossTeamPeerIntraOrg,
   resolveDmTarget,
+  resolveInheritedForDelivery,
   resolveSessionActivityState,
   scrubPreservingIdentifiers,
   senderPolicyIsEnforcedOn,
@@ -326,7 +327,7 @@ import {
   stabiliseResetInstant,
   sumTranscriptUsageInWindow,
   summarizeTranscriptActivity
-} from "../chunk-GRU6GNLP.js";
+} from "../chunk-UUO7QTLC.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -8777,6 +8778,16 @@ var agentState = {
    * above and is persisted through the same sidecar (`agentRules` concern).
    */
   knownAgentRulesHashes: /* @__PURE__ */ new Map(),
+  /**
+   * ENG-11472 (CodeRabbit on #7341): the inherited org/team rules last DELIVERED
+   * to each agent, so a cycle on which the API could not read one scope (sent as
+   * null) renders and hashes what the agent already has instead of an empty set.
+   * Keyed with the team the rules came from, so a moved agent never re-uses its
+   * old team's rules for its new team.
+   * In memory only: after a manager restart a failed scope is `unknown` and the
+   * rules restart is skipped for that cycle rather than guessed.
+   */
+  knownInheritedAgentRules: /* @__PURE__ */ new Map(),
   /**
    * ENG-6024: hash of the Teams behaviour subset (thread_auto_follow,
    * channel_response_mode, adaptive_cards_enabled/_ask_user_enabled) from the
@@ -8867,6 +8878,7 @@ function clearAgentState(agentId, codeName) {
   agentState.knownSenderPolicyHashes.delete(agentId);
   agentState.knownTelegramPolicyHashes.delete(agentId);
   agentState.knownAgentRulesHashes.delete(agentId);
+  agentState.knownInheritedAgentRules.delete(agentId);
   agentState.knownMsTeamsBehaviourHashes.delete(agentId);
   agentState.knownSlackBehaviourHashes.delete(agentId);
   agentState.knownGlobalSkillIds.delete(agentId);
@@ -15488,7 +15500,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-MWH3BKAL.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-J4CBYZS3.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -16285,7 +16297,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1191" : "dev";
+var agtCliVersion = true ? "0.28.1193" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -18189,7 +18201,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-NSA3UYRF.js");
+      const { collectDiagnostics } = await import("../persistent-session-5MGJGJIB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor)
@@ -18332,7 +18344,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-NSA3UYRF.js");
+      const { collectDiagnostics } = await import("../persistent-session-5MGJGJIB.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor) : void 0;
       let tailscaleHostname;
@@ -18587,7 +18599,7 @@ async function pollCycleInner() {
       }
       try {
         const desiredClaudeCodeVersion = hbResp?.desired_claude_code_version?.trim();
-        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-JPVLPWVR.js");
+        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-EOJQHUZ2.js");
         const securityFloor = currentSecurityFloor();
         claudeUpdaterInFlight = true;
         if (desiredClaudeCodeVersion && (claudePairLoop.busy || claudePairingInProgress())) {
@@ -18622,7 +18634,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-MWH3BKAL.js");
+      } = await import("../responsiveness-probe-J4CBYZS3.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -18739,7 +18751,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-MWH3BKAL.js");
+        } = await import("../responsiveness-probe-J4CBYZS3.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -19025,7 +19037,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-MWH3BKAL.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-J4CBYZS3.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -19056,7 +19068,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-NSA3UYRF.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-5MGJGJIB.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -19221,7 +19233,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-RYU7ZB56.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-7CSZHNBK.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20434,8 +20446,27 @@ async function processAgent(agent, agentStates, managedToolkits) {
       }
     }
   }
+  let provisionSucceeded = false;
+  const currentTeamId = refreshData.agent.team_id ?? null;
+  const inheritedResolution = resolveInheritedForDelivery(
+    refreshData.inherited_agent_rules,
+    agentState.knownInheritedAgentRules.get(agent.agent_id),
+    currentTeamId
+  );
+  if (inheritedResolution.reusedLastKnown.length > 0 || inheritedResolution.unknown.length > 0) {
+    log(
+      `[hot-reload] inherited rules for '${agent.code_name}': API could not read ${[...inheritedResolution.reusedLastKnown, ...inheritedResolution.unknown].join(" + ")} - ` + (inheritedResolution.unknown.length > 0 ? "no last-known copy, so the standing-rules restart is skipped this cycle" : "rendering the last-delivered rules for that scope")
+    );
+  }
+  const provisionRefreshData = { ...refreshData, inherited_agent_rules: inheritedResolution.rules };
+  const inheritedRulesKnown = inheritedResolution.unknown.length === 0;
   try {
-    const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter, renderIntegrationsSection);
+    if (!inheritedRulesKnown) {
+      throw new Error(
+        `inherited ${inheritedResolution.unknown.join(" + ")} rules could not be read and there is no last-delivered copy; not writing CLAUDE.md this cycle`
+      );
+    }
+    const artifacts = generateArtifacts(agent, provisionRefreshData, frameworkAdapter, renderIntegrationsSection);
     const changedFiles = [];
     mkdirSync16(agentDir, { recursive: true });
     for (const artifact of artifacts) {
@@ -20577,9 +20608,13 @@ async function processAgent(agent, agentStates, managedToolkits) {
     if (frameworkAdapter.deployArtifactsToProject) {
       frameworkAdapter.deployArtifactsToProject(agent.code_name, agentDir);
     }
+    provisionSucceeded = true;
   } catch (err) {
     log(`Provision failed for '${agent.code_name}': ${err.message}`);
   }
+  if (provisionSucceeded && inheritedRulesKnown && inheritedResolution.rules) {
+    agentState.knownInheritedAgentRules.set(agent.agent_id, { rules: inheritedResolution.rules, teamId: currentTeamId });
+  }
   const resolvedForModel = resolveModelChain(refreshData);
   const primaryModel = resolvedForModel.primary ?? refreshData.agent.primary_model;
   const holdModelChange = shouldHoldModelChange({
@@ -21204,11 +21239,16 @@ async function processAgent(agent, agentStates, managedToolkits) {
       agentState.knownTelegramPolicyHashes.delete(agent.agent_id);
       removeDeliveryBaselineEntry("telegramPolicy", agent.agent_id);
     }
-    {
+    if (!provisionSucceeded || !inheritedRulesKnown) {
+      log(
+        `[hot-reload] skipping the standing-rules check for '${agent.code_name}' - ` + (provisionSucceeded ? "an inherited scope could not be read and there is no last-known copy" : "provisioning failed this cycle, so the rendered rules are not on disk") + "; baseline left unchanged"
+      );
+    } else {
       const agentRules = refreshData.agent_rules ?? [];
-      const agentRulesHash = createHash20("sha256").update(agentRulesRestartBasis(agentRules)).digest("hex");
+      const inheritedRules = inheritedResolution.rules;
+      const agentRulesHash = createHash20("sha256").update(agentRulesRestartBasis(agentRules, inheritedRules)).digest("hex");
       const prevAgentRulesHash = agentState.knownAgentRulesHashes.get(agent.agent_id);
-      const rulesPresent = agentHasRules(agentRules);
+      const rulesPresent = agentHasRules(agentRules, inheritedRules);
       const agentRulesDecision = decideSenderPolicyRestart({
         previousHash: prevAgentRulesHash,
         currentPolicyRestrictive: rulesPresent,
@@ -23923,7 +23963,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-MWH3BKAL.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-J4CBYZS3.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -23966,7 +24006,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-NSA3UYRF.js");
+        const { collectDiagnostics } = await import("../persistent-session-5MGJGJIB.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor)
@@ -24017,7 +24057,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-NSA3UYRF.js");
+      const { collectDiagnostics } = await import("../persistent-session-5MGJGJIB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor)
@@ -24719,7 +24759,7 @@ async function processClaudePairSessions(agents) {
     snapshotPairConfig,
     // ENG-11659: result -> report body + the manager.log line that records it.
     planPairStartReport
-  } = await import("../claude-pair-runtime-JXXYGKWS.js");
+  } = await import("../claude-pair-runtime-WKTA3HNF.js");
   const { resetClaudeSignin, describeSigninResetForLog, describeSigninResetFailure } = await import("../claude-signin-reset-6IJMMVYG.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
@@ -24992,6 +25032,14 @@ function generateArtifacts(agent, refreshData, adapter, renderIntegrationsSectio
     // the claude-code adapter can render them into CLAUDE.md. Absent on an
     // older API renders nothing, which is the documented fail-direction.
     agentRules: refreshData.agent_rules,
+    // ENG-11472: inherited org and team rules; absent on an older API renders
+    // exactly as before.
+    // Settled to concrete lists in processAgent before this runs; a stray null
+    // scope still renders as none rather than failing the type.
+    inheritedAgentRules: refreshData.inherited_agent_rules ? {
+      organization: refreshData.inherited_agent_rules.organization ?? [],
+      team: refreshData.inherited_agent_rules.team ?? []
+    } : void 0,
     // ADR-0012 / ENG-6352: down-synced dynamic workflows (flag-gated, resolved
     // server-side). The claude-code adapter renders each as
     // `.claude/workflows/<name>.js`; undefined/empty no-ops.