@integrity-labs/agt-cli 0.28.291 → 0.28.293

package/dist/{claude-pair-runtime-DVAUH47F.js → claude-pair-runtime-EWJQ5QXS.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-WVLFEQPW.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-7Z33SV2X.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-DVAUH47F.js.map
+//# sourceMappingURL=claude-pair-runtime-EWJQ5QXS.js.map

package/dist/lib/manager-worker.js

@@ -9,6 +9,7 @@ import {
   atomicWriteFileSync,
   buildConnectivityProbeDeps,
   buildProbeEnv,
+  classifyEnvIntegrationsDiff,
   clearPresenceReaperState,
   clearPresenceReaperStateForKeys,
   defaultFlagsCachePath,
@@ -38,7 +39,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-R3VRYIZJ.js";
+} from "../chunk-D6SMNBPT.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -125,7 +126,7 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-BNQPLUUB.js";
+} from "../chunk-IGADZDYT.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -657,14 +658,27 @@ var PROVISIONING_RELOAD_REASONS = /* @__PURE__ */ new Set([
 function isProvisioningReloadReason(reason) {
   return PROVISIONING_RELOAD_REASONS.has(reason);
 }
+var CREDENTIAL_ROTATION_REASONS = /* @__PURE__ */ new Set([
+  "credential-rotation"
+]);
+function isCredentialRotationReason(reason) {
+  return CREDENTIAL_ROTATION_REASONS.has(reason);
+}
+function restartReasonClass(reason) {
+  if (isCredentialRotationReason(reason)) return "credential-rotation";
+  return isProvisioningReloadReason(reason) ? "provisioning" : "crash";
+}
 function countByClass(events) {
   let crash = 0;
   let provisioning = 0;
+  let credentialRotation = 0;
   for (const e of events) {
-    if (isProvisioningReloadReason(e.reason)) provisioning += 1;
+    const klass = restartReasonClass(e.reason);
+    if (klass === "provisioning") provisioning += 1;
+    else if (klass === "credential-rotation") credentialRotation += 1;
     else crash += 1;
   }
-  return { crash, provisioning };
+  return { crash, provisioning, "credential-rotation": credentialRotation };
 }
 var DEFAULT_MAX = 2;
 var DEFAULT_WINDOW_MS = 6e5;
@@ -738,15 +752,19 @@ var RestartBreaker = class {
     prior.push({ reason, at });
     this.events.set(codeName, prior);
     const crashCount = prior.filter(
-      (e) => e.at >= at - this.windowMs && !isProvisioningReloadReason(e.reason)
+      (e) => e.at >= at - this.windowMs && restartReasonClass(e.reason) === "crash"
     ).length;
     const provEvents = prior.filter(
       (e) => e.at >= at - this.provisioningWindowMs && isProvisioningReloadReason(e.reason)
     );
+    const credRotCount = prior.filter(
+      (e) => e.at >= at - this.provisioningWindowMs && isCredentialRotationReason(e.reason)
+    ).length;
     const windowCount = prior.filter((e) => e.at >= at - this.windowMs).length;
     const classCounts = {
       crash: crashCount,
-      provisioning: provEvents.length
+      provisioning: provEvents.length,
+      "credential-rotation": credRotCount
     };
     let trippedClass;
     let tripEvents;
@@ -754,7 +772,7 @@ var RestartBreaker = class {
     if (crashCount > this.max) {
       trippedClass = "crash";
       tripEvents = prior.filter(
-        (e) => e.at >= at - this.windowMs && !isProvisioningReloadReason(e.reason)
+        (e) => e.at >= at - this.windowMs && restartReasonClass(e.reason) === "crash"
       );
       tripWindowMs = this.windowMs;
     } else if (provEvents.length > this.provisioningMax) {
@@ -6326,7 +6344,14 @@ function restartReasonBindsNewMcp(breakerReason) {
   // above always described it, but the path passed no breakerReason so it never
   // hit this predicate. Including it arms the ENG-6174 respawn verification for
   // the ONE real respawn of an integration add.
-  breakerReason === "integration-change";
+  breakerReason === "integration-change" || // ENG-7541: a 'credential-rotation' respawn IS the env-only re-mint path
+  // (ENG-7510), just tagged with a non-tripping breaker class. It must behave
+  // IDENTICALLY to 'hot-reload-mcp' for respawn timing + verification — come
+  // back immediately so the agent picks up the fresh credential, and arm the
+  // ENG-6174 respawn verification (the unchanged MCP set re-binds normally, so
+  // verification passes). The ONLY thing that differs from 'hot-reload-mcp' is
+  // the breaker tally it lands on.
+  breakerReason === "credential-rotation";
 }
 function dashboardRestartBreakerReason(restartReason) {
   return restartReason === "integration-change" ? "integration-change" : void 0;
@@ -6897,7 +6922,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.291" : "dev";
+var agtCliVersion = true ? "0.28.293" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7750,7 +7775,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-WVLFEQPW.js");
+      const { collectDiagnostics } = await import("../persistent-session-7Z33SV2X.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -7848,7 +7873,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-WVLFEQPW.js");
+      const { collectDiagnostics } = await import("../persistent-session-7Z33SV2X.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -7996,7 +8021,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-VCOYMMIT.js");
+      } = await import("../responsiveness-probe-RPX63Y5S.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8028,7 +8053,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-VCOYMMIT.js");
+        } = await import("../responsiveness-probe-RPX63Y5S.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -9574,6 +9599,9 @@ async function processAgent(agent, agentStates) {
               });
             }
             const respawnVars = envOnlyRespawnVars(changedVars, mcpJsonForReap, CHANNEL_SECRET_ENV_KEYS);
+            const envDiff = classifyEnvIntegrationsDiff(preWriteEnv, postWriteEnv);
+            const rotatedOnlyVars = new Set(envDiff.rotated);
+            const envRespawnReason = respawnVars.length > 0 && respawnVars.every((v) => rotatedOnlyVars.has(v)) ? "credential-rotation" : "hot-reload-mcp";
             const needsRespawn = respawnVars.length > 0 && !intFlap.flapping;
             const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
             const reconnectNote = affectedServerKeys.length > 0 ? ` The MCP servers that depend on rotating credentials (${affectedServerKeys.join(", ")}) have been signalled to reconnect.` : "";
@@ -9592,10 +9620,11 @@ async function processAgent(agent, agentStates) {
               scheduleSessionRestart(
                 agent.code_name,
                 0,
-                `env-only integration change (${respawnVars.join(", ")})`
+                `env-only integration change (${respawnVars.join(", ")})`,
+                envRespawnReason
               );
               log(
-                `[hot-reload] Scheduled respawn for '${agent.code_name}' to apply env-only integration change (no MCP child to reap): ${respawnVars.join(", ")} (ENG-7510)`
+                `[hot-reload] Scheduled respawn for '${agent.code_name}' to apply env-only integration change (no MCP child to reap): ${respawnVars.join(", ")} [reason=${envRespawnReason}] (ENG-7510/ENG-7541)`
               );
             }
           } catch (err) {
@@ -10952,7 +10981,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-WVLFEQPW.js");
+        const { collectDiagnostics } = await import("../persistent-session-7Z33SV2X.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -11002,7 +11031,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-WVLFEQPW.js");
+      const { collectDiagnostics } = await import("../persistent-session-7Z33SV2X.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -11406,7 +11435,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-DVAUH47F.js");
+  } = await import("../claude-pair-runtime-EWJQ5QXS.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));