@integrity-labs/agt-cli 0.28.130 → 0.28.132

package/dist/{claude-pair-runtime-F5KZNGVO.js → claude-pair-runtime-NJDB2EPV.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-YU3FIAUK.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-6MR7EVEN.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-F5KZNGVO.js.map
+//# sourceMappingURL=claude-pair-runtime-NJDB2EPV.js.map

package/dist/lib/manager-worker.js

@@ -28,7 +28,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-RTSX4A54.js";
+} from "../chunk-GF2KBUVY.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -72,7 +72,7 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-XBF7ACI5.js";
+} from "../chunk-U3CDNNEK.js";
 import {
   FLAGS_SCHEMA_VERSION,
   FLAG_REGISTRY,
@@ -374,16 +374,38 @@ function findMcpChildrenForAgent(args) {
   return matched;
 }
 function reapStaleMcpChildren(args) {
-  const { log: log2, codeName, serverKeys, mcpJson, graceMs = 5e3 } = args;
+  const { log: log2, codeName, serverKeys, mcpJson, graceMs = 5e3, isolated = false } = args;
   if (serverKeys.length === 0) return [];
-  const runPs = args.runPs ?? (() => execFileSync("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", timeout: 5e3 }));
-  const killProcess = args.killProcess ?? ((pid, signal) => {
+  const runPs = args.runPs ?? (isolated ? () => execFileSync("docker", ["exec", `agt-${codeName}`, "ps", "-eo", "pid,ppid,args"], {
+    encoding: "utf-8",
+    timeout: 8e3
+  }) : () => execFileSync("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", timeout: 5e3 }));
+  const killProcess = args.killProcess ?? (isolated ? (pid, signal) => {
+    try {
+      execFileSync(
+        "docker",
+        ["exec", `agt-${codeName}`, "kill", signal === "SIGKILL" ? "-KILL" : "-TERM", String(pid)],
+        { timeout: 8e3, stdio: "ignore" }
+      );
+    } catch {
+    }
+  } : (pid, signal) => {
     try {
       process.kill(pid, signal);
     } catch {
     }
   });
-  const isAlive = args.isAlive ?? ((pid) => {
+  const isAlive = args.isAlive ?? (isolated ? (pid) => {
+    try {
+      execFileSync("docker", ["exec", `agt-${codeName}`, "kill", "-0", String(pid)], {
+        timeout: 8e3,
+        stdio: "ignore"
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  } : (pid) => {
     try {
       process.kill(pid, 0);
       return true;
@@ -399,7 +421,7 @@ function reapStaleMcpChildren(args) {
     return [];
   }
   const rows = parsePsRows(psOutput);
-  const targets = findMcpChildrenForAgent({ rows, codeName, serverKeys, mcpJson });
+  const targets = findMcpChildrenForAgent({ rows, codeName, serverKeys, mcpJson, inContainer: isolated });
   if (targets.length === 0) return [];
   const byPid = new Map(rows.map((r) => [r.pid, r]));
   const describe = (pid) => {
@@ -437,7 +459,8 @@ function reapStaleMcpChildren(args) {
           rows: parsePsRows(freshPsOutput),
           codeName,
           serverKeys,
-          mcpJson
+          mcpJson,
+          inContainer: isolated
         })
       );
       const stragglers = targets.filter((pid) => isAlive(pid) && stillOwned.has(pid));
@@ -1653,6 +1676,18 @@ function decideMaintenanceWindowGate(opts) {
   if (!opts.window) return "proceed";
   return isWithinMaintenanceWindow(opts.window, opts.now) ? "proceed" : "defer";
 }
+function decideForcedUpdate(opts) {
+  const { requestedAt, lastProcessedAt, hostBusy } = opts;
+  if (!requestedAt) return "none";
+  const requestedMs = Date.parse(requestedAt);
+  if (Number.isNaN(requestedMs)) return "none";
+  if (lastProcessedAt) {
+    const processedMs = Date.parse(lastProcessedAt);
+    if (!Number.isNaN(processedMs) && processedMs >= requestedMs) return "already-handled";
+  }
+  if (hostBusy) return "defer-idle";
+  return "consume";
+}
 function isUrgentUpgrade(opts) {
   if (!opts.urgentTarget) return false;
   if (opts.installed === "dev") return false;
@@ -6757,6 +6792,21 @@ function restartGateFor(codeName, reason) {
     now: /* @__PURE__ */ new Date()
   });
 }
+function isHostBusyForForcedUpdate() {
+  const now = /* @__PURE__ */ new Date();
+  for (const agent of state6.agents) {
+    const decision = decideRestartGate({
+      window: null,
+      paneLogAgeSeconds: paneLogAgeSecondsFor(agent.codeName),
+      transcriptAgeSeconds: transcriptAgeSecondsFor(agent.codeName),
+      inboundAgeSeconds: inboundAgeSecondsFor(agent.codeName),
+      now,
+      env: {}
+    });
+    if (decision === "defer-idle") return true;
+  }
+  return false;
+}
 var runningMcpHashes = /* @__PURE__ */ new Map();
 var runningMcpServerKeys = /* @__PURE__ */ new Map();
 var runningChannelSecretHashes = /* @__PURE__ */ new Map();
@@ -7017,7 +7067,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.130" : "dev";
+var agtCliVersion = true ? "0.28.132" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7318,7 +7368,8 @@ var selfUpdateUpToDateLogged = false;
 var restartAfterUpgrade = false;
 var pendingUpgradeVersion = null;
 var selfUpdateInFlight = false;
-async function checkAndUpdateCli() {
+async function checkAndUpdateCli(opts) {
+  const force = opts?.force ?? false;
   if (selfUpdateInFlight) return;
   selfUpdateInFlight = true;
   try {
@@ -7336,19 +7387,21 @@ async function checkAndUpdateCli() {
     if (!isBrewFormula && !isNpmGlobal) return;
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
     const markerPath = join16(homedir9(), ".augmented", ".last-update-check");
-    try {
-      const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
-      if (Date.now() - lastCheck < UPDATE_CHECK_INTERVAL_MS) return;
-    } catch {
+    if (!force) {
+      try {
+        const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
+        if (Date.now() - lastCheck < UPDATE_CHECK_INTERVAL_MS) return;
+      } catch {
+      }
     }
     try {
       writeF(markerPath, String(Date.now()));
     } catch {
     }
     if (isBrewFormula) {
-      await checkAndUpdateCliViaBrew();
+      await checkAndUpdateCliViaBrew(force);
     } else {
-      await checkAndUpdateCliViaNpm();
+      await checkAndUpdateCliViaNpm(force);
     }
     try {
       writeF(markerPath, String(Date.now()));
@@ -7358,7 +7411,7 @@ async function checkAndUpdateCli() {
     selfUpdateInFlight = false;
   }
 }
-async function checkAndUpdateCliViaBrew() {
+async function checkAndUpdateCliViaBrew(force = false) {
   const { execFileSync: execFileSync4 } = await import("child_process");
   const brewPath = resolveBrewPath(execFileSync4);
   if (!brewPath) return;
@@ -7377,7 +7430,7 @@ async function checkAndUpdateCliViaBrew() {
     if (agtOutdated) {
       const installed = agtOutdated.installed_versions?.[0] ?? "unknown";
       const latest = agtOutdated.current_version ?? "unknown";
-      if (decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "defer") {
+      if (!force && decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "defer") {
         log(
           `[self-update] agt CLI ${installed} \u2192 ${latest} (brew) deferred \u2014 ` + formatWindowDeferLogLine(cachedMaintenanceWindow ?? {}, /* @__PURE__ */ new Date())
         );
@@ -7389,7 +7442,7 @@ async function checkAndUpdateCliViaBrew() {
         lastAppliedMs: readLastSelfUpdateAppliedMs(selfUpdateAppliedMarkerPath()),
         now: Date.now()
       });
-      if (!coalesce.proceed) {
+      if (!force && !coalesce.proceed) {
         log(formatCoalesceDeferLogLine({
           installed,
           latest,
@@ -7399,7 +7452,7 @@ async function checkAndUpdateCliViaBrew() {
         }));
         return;
       }
-      log(`[self-update] agt CLI update available: ${installed} \u2192 ${latest}. Upgrading via brew...`);
+      log(`[self-update] agt CLI update available: ${installed} \u2192 ${latest}. Upgrading via brew${force ? " (forced \u2014 Update CLI now)" : ""}...`);
       try {
         execFileSync4(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
           timeout: 12e4,
@@ -7420,7 +7473,7 @@ async function checkAndUpdateCliViaBrew() {
     log(`[self-update] brew outdated failed: ${err.message}`);
   }
 }
-async function checkAndUpdateCliViaNpm() {
+async function checkAndUpdateCliViaNpm(force = false) {
   if (agtCliVersion === "dev") return;
   const channel = process.env.AGT_CLI_RELEASE_CHANNEL || "latest";
   let latest;
@@ -7478,7 +7531,7 @@ async function checkAndUpdateCliViaNpm() {
     }
     return;
   }
-  if (decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "defer") {
+  if (!force && decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "defer") {
     log(
       `[self-update] agt CLI ${agtCliVersion} \u2192 ${latest} (channel=${channel}) deferred \u2014 ` + formatWindowDeferLogLine(cachedMaintenanceWindow ?? {}, /* @__PURE__ */ new Date())
     );
@@ -7490,7 +7543,7 @@ async function checkAndUpdateCliViaNpm() {
     lastAppliedMs: readLastSelfUpdateAppliedMs(selfUpdateAppliedMarkerPath()),
     now: Date.now()
   });
-  if (!coalesce.proceed) {
+  if (!force && !coalesce.proceed) {
     log(formatCoalesceDeferLogLine({
       installed: agtCliVersion,
       latest,
@@ -8144,7 +8197,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-YU3FIAUK.js");
+      const { collectDiagnostics } = await import("../persistent-session-6MR7EVEN.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -8216,11 +8269,53 @@ async function pollCycle() {
         // combines these with the org's server-resolved flags + versions into a
         // host_config_snapshots row (on change) so bugs correlate with config.
         // Allowlist-only by construction — no raw env / secrets ever sent.
-        env_gates: collectEnvGates(process.env)
+        env_gates: collectEnvGates(process.env),
+        // ENG-6692: ack the last consumed "Update CLI now" timestamp so the API
+        // clears hosts.update_requested_at. Echoes our persisted dedup marker;
+        // null until we've ever consumed one.
+        update_request_processed_at: state6.lastUpdateRequestProcessedAt ?? null
       });
       if (hbResp?.maintenance_window) {
         cachedMaintenanceWindow = hbResp.maintenance_window;
       }
+      const requestedUpdateAt = hbResp?.update_requested_at ?? null;
+      const forcedUpdate = decideForcedUpdate({
+        requestedAt: requestedUpdateAt,
+        lastProcessedAt: state6.lastUpdateRequestProcessedAt ?? null,
+        hostBusy: isHostBusyForForcedUpdate()
+      });
+      if (forcedUpdate === "defer-idle") {
+        log(
+          `[self-update] "Update CLI now" requested at ${requestedUpdateAt} \u2014 deferring: an agent is mid-turn / recently active. Retrying next poll.`
+        );
+      } else if (forcedUpdate === "consume") {
+        if (selfUpdateInFlight) {
+          log(
+            `[self-update] "Update CLI now" requested at ${requestedUpdateAt} \u2014 deferring: a self-update is already in flight. Retrying next poll.`
+          );
+        } else {
+          const prevProcessedAt = state6.lastUpdateRequestProcessedAt ?? null;
+          state6.lastUpdateRequestProcessedAt = requestedUpdateAt;
+          let persisted = true;
+          try {
+            atomicWriteFileSync(getStateFile(), JSON.stringify(state6, null, 2));
+          } catch (err) {
+            persisted = false;
+            state6.lastUpdateRequestProcessedAt = prevProcessedAt;
+            log(
+              `[self-update] failed to persist update-request ack; retrying next heartbeat: ${err.message}`
+            );
+          }
+          if (persisted) {
+            log(
+              `[self-update] "Update CLI now" requested at ${requestedUpdateAt} \u2014 running window-bypassing self-update now (host idle).`
+            );
+            void checkAndUpdateCli({ force: true }).catch(
+              (err) => log(`[self-update] forced check failed: ${err.message}`)
+            );
+          }
+        }
+      }
       if (hbResp?.feature_flags) {
         hostFlagStore().applyHeartbeat(hbResp.feature_flags, hbResp.flags_schema_version);
       }
@@ -8245,7 +8340,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-TN5JW2NM.js");
+      } = await import("../responsiveness-probe-GWJ6TKO2.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8277,7 +8372,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-TN5JW2NM.js");
+        } = await import("../responsiveness-probe-GWJ6TKO2.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -8550,7 +8645,9 @@ async function pollCycle() {
     await healthCheckGateways(agentStates);
     if (Date.now() - lastChannelSweepAt >= CHANNEL_SWEEP_INTERVAL_MS) {
       lastChannelSweepAt = Date.now();
-      const agentCodeNames = new Set(agentStates.map((a) => a.codeName));
+      const agentCodeNames = new Set(
+        agentStates.map((a) => a.codeName).filter((c) => isolationMode(c) !== "docker")
+      );
       sweepChannelProcesses({
         agentCodeNames,
         dryRun: CHANNEL_SWEEP_DRY_RUN,
@@ -9695,7 +9792,11 @@ async function processAgent(agent, agentStates) {
                 log,
                 codeName: agent.code_name,
                 serverKeys: affectedServerKeys,
-                mcpJson: mcpJsonForReap
+                mcpJson: mcpJsonForReap,
+                // ENG-6670: enumerate + signal in the container PID namespace
+                // for Docker-isolated agents (host ps can't see in-container
+                // children; a host kill on a container pid would be wrong).
+                isolated: isolationMode(agent.code_name) === "docker"
               });
             }
             const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
@@ -11820,7 +11921,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-F5KZNGVO.js");
+  } = await import("../claude-pair-runtime-NJDB2EPV.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -12446,6 +12547,12 @@ function startManager(opts) {
         const n = autoResumeMarkers.size;
         if (n > 0) log(`[startup] rehydrated ${n} auto-resume marker(s) (ENG-6088)`);
       }
+      if (typeof parsed.lastUpdateRequestProcessedAt === "string" || parsed.lastUpdateRequestProcessedAt === null) {
+        state6.lastUpdateRequestProcessedAt = parsed.lastUpdateRequestProcessedAt;
+        if (state6.lastUpdateRequestProcessedAt) {
+          log(`[startup] rehydrated update-request ack at ${state6.lastUpdateRequestProcessedAt} (ENG-6692)`);
+        }
+      }
     }
   } catch (err) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);