@integrity-labs/agt-cli 0.28.130 → 0.28.131

package/dist/{claude-pair-runtime-F5KZNGVO.js → claude-pair-runtime-NJDB2EPV.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-YU3FIAUK.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-6MR7EVEN.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-F5KZNGVO.js.map
+//# sourceMappingURL=claude-pair-runtime-NJDB2EPV.js.map

package/dist/lib/manager-worker.js

@@ -28,7 +28,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-RTSX4A54.js";
+} from "../chunk-N5N3CA6W.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -72,7 +72,7 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-XBF7ACI5.js";
+} from "../chunk-U3CDNNEK.js";
 import {
   FLAGS_SCHEMA_VERSION,
   FLAG_REGISTRY,
@@ -374,16 +374,38 @@ function findMcpChildrenForAgent(args) {
   return matched;
 }
 function reapStaleMcpChildren(args) {
-  const { log: log2, codeName, serverKeys, mcpJson, graceMs = 5e3 } = args;
+  const { log: log2, codeName, serverKeys, mcpJson, graceMs = 5e3, isolated = false } = args;
   if (serverKeys.length === 0) return [];
-  const runPs = args.runPs ?? (() => execFileSync("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", timeout: 5e3 }));
-  const killProcess = args.killProcess ?? ((pid, signal) => {
+  const runPs = args.runPs ?? (isolated ? () => execFileSync("docker", ["exec", `agt-${codeName}`, "ps", "-eo", "pid,ppid,args"], {
+    encoding: "utf-8",
+    timeout: 8e3
+  }) : () => execFileSync("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", timeout: 5e3 }));
+  const killProcess = args.killProcess ?? (isolated ? (pid, signal) => {
+    try {
+      execFileSync(
+        "docker",
+        ["exec", `agt-${codeName}`, "kill", signal === "SIGKILL" ? "-KILL" : "-TERM", String(pid)],
+        { timeout: 8e3, stdio: "ignore" }
+      );
+    } catch {
+    }
+  } : (pid, signal) => {
     try {
       process.kill(pid, signal);
     } catch {
     }
   });
-  const isAlive = args.isAlive ?? ((pid) => {
+  const isAlive = args.isAlive ?? (isolated ? (pid) => {
+    try {
+      execFileSync("docker", ["exec", `agt-${codeName}`, "kill", "-0", String(pid)], {
+        timeout: 8e3,
+        stdio: "ignore"
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  } : (pid) => {
     try {
       process.kill(pid, 0);
       return true;
@@ -399,7 +421,7 @@ function reapStaleMcpChildren(args) {
     return [];
   }
   const rows = parsePsRows(psOutput);
-  const targets = findMcpChildrenForAgent({ rows, codeName, serverKeys, mcpJson });
+  const targets = findMcpChildrenForAgent({ rows, codeName, serverKeys, mcpJson, inContainer: isolated });
   if (targets.length === 0) return [];
   const byPid = new Map(rows.map((r) => [r.pid, r]));
   const describe = (pid) => {
@@ -437,7 +459,8 @@ function reapStaleMcpChildren(args) {
           rows: parsePsRows(freshPsOutput),
           codeName,
           serverKeys,
-          mcpJson
+          mcpJson,
+          inContainer: isolated
         })
       );
       const stragglers = targets.filter((pid) => isAlive(pid) && stillOwned.has(pid));
@@ -7017,7 +7040,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.130" : "dev";
+var agtCliVersion = true ? "0.28.131" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -8144,7 +8167,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-YU3FIAUK.js");
+      const { collectDiagnostics } = await import("../persistent-session-6MR7EVEN.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -8245,7 +8268,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-TN5JW2NM.js");
+      } = await import("../responsiveness-probe-GWJ6TKO2.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8277,7 +8300,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-TN5JW2NM.js");
+        } = await import("../responsiveness-probe-GWJ6TKO2.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -8550,7 +8573,9 @@ async function pollCycle() {
     await healthCheckGateways(agentStates);
     if (Date.now() - lastChannelSweepAt >= CHANNEL_SWEEP_INTERVAL_MS) {
       lastChannelSweepAt = Date.now();
-      const agentCodeNames = new Set(agentStates.map((a) => a.codeName));
+      const agentCodeNames = new Set(
+        agentStates.map((a) => a.codeName).filter((c) => isolationMode(c) !== "docker")
+      );
       sweepChannelProcesses({
         agentCodeNames,
         dryRun: CHANNEL_SWEEP_DRY_RUN,
@@ -9695,7 +9720,11 @@ async function processAgent(agent, agentStates) {
                 log,
                 codeName: agent.code_name,
                 serverKeys: affectedServerKeys,
-                mcpJson: mcpJsonForReap
+                mcpJson: mcpJsonForReap,
+                // ENG-6670: enumerate + signal in the container PID namespace
+                // for Docker-isolated agents (host ps can't see in-container
+                // children; a host kill on a container pid would be wrong).
+                isolated: isolationMode(agent.code_name) === "docker"
               });
             }
             const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
@@ -11820,7 +11849,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-F5KZNGVO.js");
+  } = await import("../claude-pair-runtime-NJDB2EPV.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));