@integrity-labs/agt-cli 0.28.1193 → 0.28.1194

package/dist/{chunk-ZTA7AGKM.js → chunk-DPXWD2HJ.js}

@@ -16,11 +16,11 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-NJ2AUTIO.js";
+} from "./chunk-KL35IHP2.js";
 import {
   readDailySessionPin,
   sessionTranscriptDir
-} from "./chunk-DXLSLT5G.js";
+} from "./chunk-MLIFIEIF.js";
 import {
   classifyUnanswerablePane,
   isConsumerTermsDialogVisible,
@@ -32,6 +32,7 @@ import {
 } from "./chunk-XWVM4KPK.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
+  HOST_ROTATE_KEY_CONFLICT,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
   INTEGRATION_REGISTRY,
@@ -91,7 +92,7 @@ import {
   scanConfigForLiteralSecrets,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-UUO7QTLC.js";
+} from "./chunk-2HAH3TZ4.js";
 import {
   claudeJsonPathFor,
   effectiveClaudeJsonPath,
@@ -8081,7 +8082,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1193" : "dev";
+var agtCliVersion = true ? "0.28.1194" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8272,12 +8273,15 @@ async function mintRotatedHostKey(rawHostKey) {
     // 5-minute retry backoff would then re-arm the same stall. 10s matches the
     // other short calls in this process (`telegram-ingest.ts`). A timeout
     // surfaces as a thrown error, which `adoptRotatedHostKey` reports as
-    // `error` and the manager retries after the backoff — but the retry only
-    // succeeds if the SERVER never committed the mint. The abort cancels the
-    // client, not the route: if the key was already inserted and recorded, the
-    // retry hits the one-mint-per-request guard, gets 409, and the request
-    // needs a `compromised` rotation (Obi Wan `9b564171021b` on #7114). A lost
-    // response after the commit ends the same way. The runbook lists it.
+    // `error` and the manager retries after the backoff. The abort cancels the
+    // client, not the route, so the key may already be minted and recorded;
+    // a lost response after the commit is the same case. The retry still
+    // works: the server discards a minted key nobody has ever authenticated
+    // with once it is older than HOST_SELF_ROTATION_STALE_MINT_MS, which is
+    // shorter than the backoff, and mints again (ENG-11826; it used to need a
+    // `compromised` rotation, Obi Wan `9b564171021b` on #7114). That covers
+    // the backoff retry; a manager that restarts inside the window gets
+    // `mint_pending`, which this version retries and older versions do not.
     signal: AbortSignal.timeout(1e4)
   });
   if (res.status === 403) {
@@ -8285,6 +8289,12 @@ async function mintRotatedHostKey(rawHostKey) {
   }
   if (res.status === 409) {
     const body = await res.json().catch(() => ({}));
+    if (body["code"] === HOST_ROTATE_KEY_CONFLICT.mintPending) {
+      throw new Error(`Host key rotation mint deferred: ${String(body["error"] ?? "a mint is in flight")}`);
+    }
+    if (body["code"] === HOST_ROTATE_KEY_CONFLICT.alreadyHoldsMintedKey && typeof body["prefix"] === "string" && body["prefix"]) {
+      return { alreadyHolds: body["prefix"] };
+    }
     return { refused: String(body["error"] ?? "conflict") };
   }
   if (!res.ok) {
@@ -8297,6 +8307,28 @@ async function mintRotatedHostKey(rawHostKey) {
   if (!prefix || !rawKey) return null;
   return { prefix, rawKey };
 }
+async function probeHostKey(rawKey) {
+  let res;
+  try {
+    res = await fetch(`${requireHost()}/host/exchange`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ host_key: rawKey }),
+      // Same bound as the mint, for the same reason: it runs on the poll cycle.
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+    return "unknown";
+  }
+  if (res.ok) return "live";
+  if (res.status === 401) {
+    const body = await res.json().catch(() => ({}));
+    if (body["code"] === "key_revoked" || body["code"] === "invalid_key" || body["code"] === "key_expired") {
+      return "unusable";
+    }
+  }
+  return "unknown";
+}
 function adoptHostKeyInProcess(rawKey) {
   process.env["AGT_API_KEY"] = rawKey;
   forceNextExchange();
@@ -13577,6 +13609,7 @@ export {
   exchangeApiKey,
   mintAgentKey,
   mintRotatedHostKey,
+  probeHostKey,
   adoptHostKeyInProcess,
   ApiError,
   api,
@@ -13649,4 +13682,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-ZTA7AGKM.js.map
+//# sourceMappingURL=chunk-DPXWD2HJ.js.map