@integrity-labs/agt-cli 0.28.1193 → 0.28.1194

package/dist/{chunk-NJ2AUTIO.js → chunk-KL35IHP2.js}

@@ -4,7 +4,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-DXLSLT5G.js";
+} from "./chunk-MLIFIEIF.js";
 import {
   classifyUnanswerablePane,
   customApiKeyDialogKeys,
@@ -51,7 +51,7 @@ import {
   remoteMcpConnectionEnvInfix,
   remoteMcpConnectionLabel,
   remoteMcpConnectionScopedEnvVar
-} from "./chunk-UUO7QTLC.js";
+} from "./chunk-2HAH3TZ4.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   approveApiKeyInClaudeConfig,
@@ -6173,4 +6173,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-NJ2AUTIO.js.map
+//# sourceMappingURL=chunk-KL35IHP2.js.map

package/dist/{chunk-DXLSLT5G.js → chunk-MLIFIEIF.js}

@@ -1,6 +1,6 @@
 import {
   encodeClaudeProjectPath
-} from "./chunk-UUO7QTLC.js";
+} from "./chunk-2HAH3TZ4.js";
 
 // src/lib/daily-session.ts
 import { randomUUID } from "crypto";
@@ -240,4 +240,4 @@ export {
   peekPreviousSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-DXLSLT5G.js.map
+//# sourceMappingURL=chunk-MLIFIEIF.js.map

package/dist/{chunk-UQYIFOWE.js → chunk-WUYF7RDA.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-XWVM4KPK.js";
 import {
   FORCED_UPDATE_HARD_DEADLINE_MS
-} from "./chunk-UUO7QTLC.js";
+} from "./chunk-2HAH3TZ4.js";
 import {
   effectiveClaudeJsonPath
 } from "./chunk-AIUIMEUS.js";
@@ -722,4 +722,4 @@ export {
   probeClaudeInstalls,
   maybeUpdateClaudeCode
 };
-//# sourceMappingURL=chunk-UQYIFOWE.js.map
+//# sourceMappingURL=chunk-WUYF7RDA.js.map

package/dist/{claude-code-updater-EOJQHUZ2.js → claude-code-updater-DLTAAQOT.js}

@@ -13,9 +13,9 @@ import {
   probeClaudeInstalls,
   readsAsNativeInstall,
   shouldRunClaudeCodeUpdater
-} from "./chunk-UQYIFOWE.js";
+} from "./chunk-WUYF7RDA.js";
 import "./chunk-XWVM4KPK.js";
-import "./chunk-UUO7QTLC.js";
+import "./chunk-2HAH3TZ4.js";
 import "./chunk-AIUIMEUS.js";
 import "./chunk-DGUM43GV.js";
 export {
@@ -34,4 +34,4 @@ export {
   readsAsNativeInstall,
   shouldRunClaudeCodeUpdater
 };
-//# sourceMappingURL=claude-code-updater-EOJQHUZ2.js.map
+//# sourceMappingURL=claude-code-updater-DLTAAQOT.js.map

package/dist/{claude-pair-runtime-WKTA3HNF.js → claude-pair-runtime-XAUZPAUP.js}

@@ -8,7 +8,7 @@ import {
 import {
   redactPaneFrame,
   sanitizeTerminalFrame
-} from "./chunk-UUO7QTLC.js";
+} from "./chunk-2HAH3TZ4.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -321,7 +321,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-5MGJGJIB.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-TV4FIBN4.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -836,4 +836,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-WKTA3HNF.js.map
+//# sourceMappingURL=claude-pair-runtime-XAUZPAUP.js.map

package/dist/lib/manager-worker.js

@@ -56,6 +56,7 @@ import {
   mintRotatedHostKey,
   parseRmPolicy,
   pinAllowsUrgent,
+  probeHostKey,
   provision,
   provisionAutoKanbanProgressHook,
   provisionChannelProgressHook,
@@ -83,7 +84,7 @@ import {
   tripClass,
   writeEtcEnvironment,
   writeProfileDScript
-} from "../chunk-ZTA7AGKM.js";
+} from "../chunk-DPXWD2HJ.js";
 import {
   CLAUDE_CODE_SECURITY_FLOOR,
   SELF_UPDATE_TIMEOUTS,
@@ -97,7 +98,7 @@ import {
   runSafeCleanup,
   tightestDiskStat,
   withPackageCacheLock
-} from "../chunk-UQYIFOWE.js";
+} from "../chunk-WUYF7RDA.js";
 import {
   rewriteSupervisorApiKey,
   supervisorChannelsRefusing
@@ -190,7 +191,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-NJ2AUTIO.js";
+} from "../chunk-KL35IHP2.js";
 import {
   isAgentIdle,
   isStaleForToday,
@@ -200,7 +201,7 @@ import {
   sessionTranscriptDir,
   subagentActivityAgeSeconds,
   transcriptActivityAgeSeconds
-} from "../chunk-DXLSLT5G.js";
+} from "../chunk-MLIFIEIF.js";
 import {
   classifyUnanswerablePane,
   focusedConfirmDialogBlock,
@@ -233,6 +234,7 @@ import {
   FORCED_UPDATE_HARD_DEADLINE_MS,
   FORCED_UPDATE_RELAX_AFTER_MS,
   HITL_TIER_ORDER,
+  HOST_KEY_ROTATION_RETRY_MS,
   HOST_USAGE_POLL_INTERVAL_MS,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
@@ -327,7 +329,7 @@ import {
   stabiliseResetInstant,
   sumTranscriptUsageInWindow,
   summarizeTranscriptActivity
-} from "../chunk-UUO7QTLC.js";
+} from "../chunk-2HAH3TZ4.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -3698,9 +3700,41 @@ async function adoptRotatedHostKey(deps) {
     );
     return deps.held ? { status: "persist-refused", reasons: refusals, held: deps.held } : { status: "persist-refused", reasons: refusals };
   }
+  let held = deps.held;
+  if (held && deps.probeHeld) {
+    let verdict;
+    try {
+      verdict = await deps.probeHeld(held.rawKey);
+    } catch {
+      verdict = "unknown";
+    }
+    if (verdict === "unusable") {
+      let restored = false;
+      try {
+        restored = deps.restoreRunningKey?.() ?? false;
+      } catch {
+        restored = false;
+      }
+      if (!restored) {
+        deps.log(
+          `[key-rotation] the held key ${held.prefix} is no longer usable, but the running key could not be written back to the persist channels - NOT minting; retrying later. The current key stays in force in this process.`
+        );
+        return { status: "error", detail: "could not restore the running key", held };
+      }
+      deps.log(
+        `[key-rotation] the held key ${held.prefix} is no longer usable (the control plane discarded it); restored the running key to disk, minting a fresh one`
+      );
+      held = void 0;
+    } else if (verdict === "unknown") {
+      deps.log(
+        `[key-rotation] could not confirm the held key ${held.prefix} is still usable - NOT persisting it; keeping it for the next attempt. The current key stays in force.`
+      );
+      return { status: "error", detail: "held key liveness unknown", held };
+    }
+  }
   let minted;
-  if (deps.held) {
-    minted = deps.held;
+  if (held) {
+    minted = held;
     deps.log(`[key-rotation] retrying the persist of ${minted.prefix}, minted earlier for this request`);
   } else {
     let result;
@@ -3711,6 +3745,12 @@ async function adoptRotatedHostKey(deps) {
       deps.log(`[key-rotation] mint failed: ${detail}`);
       return { status: "error", detail };
     }
+    if (result && "alreadyHolds" in result) {
+      deps.log(
+        `[key-rotation] this host is already running on ${result.alreadyHolds}, the key minted for this request; acking it on the next heartbeat`
+      );
+      return { status: "already-held", prefix: result.alreadyHolds };
+    }
     if (result && "refused" in result) {
       deps.log(
         `[key-rotation] the control plane refused the mint for good: ${result.refused}. Not retrying this request. If it never completes, a compromised rotation clears it (docs/runbooks/host-api-key-rotation.md).`
@@ -3759,6 +3799,26 @@ async function adoptRotatedHostKey(deps) {
   );
   return { status: "adopted", prefix: minted.prefix };
 }
+function settleRotationOutcome(outcome, requestedAt) {
+  switch (outcome.status) {
+    case "adopted":
+    case "already-held":
+      return {
+        handled: true,
+        pendingAck: requestedAt ? { prefix: outcome.prefix, requestedAt } : null,
+        retry: false
+      };
+    case "mint-refused":
+      return { handled: true, pendingAck: null, retry: false };
+    default:
+      return { handled: false, pendingAck: null, retry: true };
+  }
+}
+function applySettledOutcome(settled, saveAck) {
+  if (!settled.handled) return { markHandled: false, retry: true };
+  if (settled.pendingAck && !saveAck(settled.pendingAck)) return { markHandled: false, retry: true };
+  return { markHandled: true, retry: false };
+}
 function nextPendingAck(pending2, resp) {
   if (!pending2) return { pending: null, log: null };
   if (!resp || !("key_rotation_requested_at" in resp)) {
@@ -15500,7 +15560,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-J4CBYZS3.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-BBAAYANU.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -16297,7 +16357,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1193" : "dev";
+var agtCliVersion = true ? "0.28.1194" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16561,7 +16621,7 @@ function setPendingKeyRotationAck(next) {
   }
 }
 var keyRotationRetryAfter = 0;
-var KEY_ROTATION_RETRY_MS = 5 * 6e4;
+var KEY_ROTATION_RETRY_MS = HOST_KEY_ROTATION_RETRY_MS;
 var heldRotatedKey = null;
 function persistRotatedHostKey(rawKey) {
   const apiUrl = process.env["AGT_HOST"]?.trim();
@@ -18201,7 +18261,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-5MGJGJIB.js");
+      const { collectDiagnostics } = await import("../persistent-session-TV4FIBN4.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor)
@@ -18344,7 +18404,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-5MGJGJIB.js");
+      const { collectDiagnostics } = await import("../persistent-session-TV4FIBN4.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor) : void 0;
       let tailscaleHostname;
@@ -18574,6 +18634,12 @@ async function pollCycleInner() {
             ]
           }),
           held: heldRotatedKey && heldRotatedKey.requestedAt === rotationRequestedAt ? heldRotatedKey.minted : void 0,
+          // ENG-11826: a held key may have been discarded by the API since.
+          probeHeld: (rawKey) => probeHostKey(rawKey),
+          restoreRunningKey: () => {
+            const running2 = getApiKey();
+            return running2 ? persistRotatedHostKey(running2) : false;
+          },
           persist: (rawKey) => persistRotatedHostKey(rawKey),
           onPersisted: (prefix) => rotationRequestedAt ? setPendingKeyRotationAck({ prefix, requestedAt: rotationRequestedAt }) : true,
           adoptInProcess: (rawKey) => adoptHostKeyInProcess(rawKey),
@@ -18583,13 +18649,10 @@ async function pollCycleInner() {
           setPendingKeyRotationAck(null);
         }
         heldRotatedKey = (outcome.status === "persist-failed" || outcome.status === "error" || outcome.status === "persist-refused") && outcome.held && rotationRequestedAt ? { requestedAt: rotationRequestedAt, minted: outcome.held } : null;
-        if (outcome.status === "mint-refused") {
-          lastKeyRotationHandled = rotationRequestedAt;
-        } else if (outcome.status === "adopted") {
+        const settled = settleRotationOutcome(outcome, rotationRequestedAt);
+        const applied = applySettledOutcome(settled, (ack) => setPendingKeyRotationAck(ack));
+        if (applied.markHandled) {
           lastKeyRotationHandled = rotationRequestedAt;
-          setPendingKeyRotationAck(
-            rotationRequestedAt ? { prefix: outcome.prefix, requestedAt: rotationRequestedAt } : null
-          );
         } else {
           keyRotationRetryAfter = Date.now() + KEY_ROTATION_RETRY_MS;
           log(
@@ -18599,7 +18662,7 @@ async function pollCycleInner() {
       }
       try {
         const desiredClaudeCodeVersion = hbResp?.desired_claude_code_version?.trim();
-        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-EOJQHUZ2.js");
+        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-DLTAAQOT.js");
         const securityFloor = currentSecurityFloor();
         claudeUpdaterInFlight = true;
         if (desiredClaudeCodeVersion && (claudePairLoop.busy || claudePairingInProgress())) {
@@ -18634,7 +18697,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-J4CBYZS3.js");
+      } = await import("../responsiveness-probe-BBAAYANU.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -18751,7 +18814,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-J4CBYZS3.js");
+        } = await import("../responsiveness-probe-BBAAYANU.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -19037,7 +19100,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-J4CBYZS3.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-BBAAYANU.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -19068,7 +19131,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-5MGJGJIB.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-TV4FIBN4.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -19233,7 +19296,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-7CSZHNBK.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-JMYATIQN.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -23963,7 +24026,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-J4CBYZS3.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-BBAAYANU.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -24006,7 +24069,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-5MGJGJIB.js");
+        const { collectDiagnostics } = await import("../persistent-session-TV4FIBN4.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor)
@@ -24057,7 +24120,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-5MGJGJIB.js");
+      const { collectDiagnostics } = await import("../persistent-session-TV4FIBN4.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor)
@@ -24759,7 +24822,7 @@ async function processClaudePairSessions(agents) {
     snapshotPairConfig,
     // ENG-11659: result -> report body + the manager.log line that records it.
     planPairStartReport
-  } = await import("../claude-pair-runtime-WKTA3HNF.js");
+  } = await import("../claude-pair-runtime-XAUZPAUP.js");
   const { resetClaudeSignin, describeSigninResetForLog, describeSigninResetFailure } = await import("../claude-signin-reset-6IJMMVYG.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);