@integrity-labs/agt-cli 0.28.291 → 0.28.292

package/dist/lib/manager-worker.js

@@ -9,6 +9,7 @@ import {
   atomicWriteFileSync,
   buildConnectivityProbeDeps,
   buildProbeEnv,
+  classifyEnvIntegrationsDiff,
   clearPresenceReaperState,
   clearPresenceReaperStateForKeys,
   defaultFlagsCachePath,
@@ -38,7 +39,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-R3VRYIZJ.js";
+} from "../chunk-PTJHDSJU.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -657,14 +658,27 @@ var PROVISIONING_RELOAD_REASONS = /* @__PURE__ */ new Set([
 function isProvisioningReloadReason(reason) {
   return PROVISIONING_RELOAD_REASONS.has(reason);
 }
+var CREDENTIAL_ROTATION_REASONS = /* @__PURE__ */ new Set([
+  "credential-rotation"
+]);
+function isCredentialRotationReason(reason) {
+  return CREDENTIAL_ROTATION_REASONS.has(reason);
+}
+function restartReasonClass(reason) {
+  if (isCredentialRotationReason(reason)) return "credential-rotation";
+  return isProvisioningReloadReason(reason) ? "provisioning" : "crash";
+}
 function countByClass(events) {
   let crash = 0;
   let provisioning = 0;
+  let credentialRotation = 0;
   for (const e of events) {
-    if (isProvisioningReloadReason(e.reason)) provisioning += 1;
+    const klass = restartReasonClass(e.reason);
+    if (klass === "provisioning") provisioning += 1;
+    else if (klass === "credential-rotation") credentialRotation += 1;
     else crash += 1;
   }
-  return { crash, provisioning };
+  return { crash, provisioning, "credential-rotation": credentialRotation };
 }
 var DEFAULT_MAX = 2;
 var DEFAULT_WINDOW_MS = 6e5;
@@ -738,15 +752,19 @@ var RestartBreaker = class {
     prior.push({ reason, at });
     this.events.set(codeName, prior);
     const crashCount = prior.filter(
-      (e) => e.at >= at - this.windowMs && !isProvisioningReloadReason(e.reason)
+      (e) => e.at >= at - this.windowMs && restartReasonClass(e.reason) === "crash"
     ).length;
     const provEvents = prior.filter(
       (e) => e.at >= at - this.provisioningWindowMs && isProvisioningReloadReason(e.reason)
     );
+    const credRotCount = prior.filter(
+      (e) => e.at >= at - this.provisioningWindowMs && isCredentialRotationReason(e.reason)
+    ).length;
     const windowCount = prior.filter((e) => e.at >= at - this.windowMs).length;
     const classCounts = {
       crash: crashCount,
-      provisioning: provEvents.length
+      provisioning: provEvents.length,
+      "credential-rotation": credRotCount
     };
     let trippedClass;
     let tripEvents;
@@ -754,7 +772,7 @@ var RestartBreaker = class {
     if (crashCount > this.max) {
       trippedClass = "crash";
       tripEvents = prior.filter(
-        (e) => e.at >= at - this.windowMs && !isProvisioningReloadReason(e.reason)
+        (e) => e.at >= at - this.windowMs && restartReasonClass(e.reason) === "crash"
       );
       tripWindowMs = this.windowMs;
     } else if (provEvents.length > this.provisioningMax) {
@@ -6326,7 +6344,14 @@ function restartReasonBindsNewMcp(breakerReason) {
   // above always described it, but the path passed no breakerReason so it never
   // hit this predicate. Including it arms the ENG-6174 respawn verification for
   // the ONE real respawn of an integration add.
-  breakerReason === "integration-change";
+  breakerReason === "integration-change" || // ENG-7541: a 'credential-rotation' respawn IS the env-only re-mint path
+  // (ENG-7510), just tagged with a non-tripping breaker class. It must behave
+  // IDENTICALLY to 'hot-reload-mcp' for respawn timing + verification — come
+  // back immediately so the agent picks up the fresh credential, and arm the
+  // ENG-6174 respawn verification (the unchanged MCP set re-binds normally, so
+  // verification passes). The ONLY thing that differs from 'hot-reload-mcp' is
+  // the breaker tally it lands on.
+  breakerReason === "credential-rotation";
 }
 function dashboardRestartBreakerReason(restartReason) {
   return restartReason === "integration-change" ? "integration-change" : void 0;
@@ -6897,7 +6922,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.291" : "dev";
+var agtCliVersion = true ? "0.28.292" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -9574,6 +9599,9 @@ async function processAgent(agent, agentStates) {
               });
             }
             const respawnVars = envOnlyRespawnVars(changedVars, mcpJsonForReap, CHANNEL_SECRET_ENV_KEYS);
+            const envDiff = classifyEnvIntegrationsDiff(preWriteEnv, postWriteEnv);
+            const rotatedOnlyVars = new Set(envDiff.rotated);
+            const envRespawnReason = respawnVars.length > 0 && respawnVars.every((v) => rotatedOnlyVars.has(v)) ? "credential-rotation" : "hot-reload-mcp";
             const needsRespawn = respawnVars.length > 0 && !intFlap.flapping;
             const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
             const reconnectNote = affectedServerKeys.length > 0 ? ` The MCP servers that depend on rotating credentials (${affectedServerKeys.join(", ")}) have been signalled to reconnect.` : "";
@@ -9592,10 +9620,11 @@ async function processAgent(agent, agentStates) {
               scheduleSessionRestart(
                 agent.code_name,
                 0,
-                `env-only integration change (${respawnVars.join(", ")})`
+                `env-only integration change (${respawnVars.join(", ")})`,
+                envRespawnReason
               );
               log(
-                `[hot-reload] Scheduled respawn for '${agent.code_name}' to apply env-only integration change (no MCP child to reap): ${respawnVars.join(", ")} (ENG-7510)`
+                `[hot-reload] Scheduled respawn for '${agent.code_name}' to apply env-only integration change (no MCP child to reap): ${respawnVars.join(", ")} [reason=${envRespawnReason}] (ENG-7510/ENG-7541)`
               );
             }
           } catch (err) {