@integrity-labs/agt-cli 0.28.318 → 0.28.319

package/dist/{claude-pair-runtime-PWVOBBX4.js → claude-pair-runtime-55LJJ7DB.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-VSSEZTY7.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-U5IQYEXX.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-PWVOBBX4.js.map
+//# sourceMappingURL=claude-pair-runtime-55LJJ7DB.js.map

package/dist/lib/manager-worker.js

@@ -26,6 +26,7 @@ import {
   getCachedClaudeAuthMode,
   getHostId,
   givenUpMcpServerKeys,
+  liveProxyExtraHeaderVars,
   provision,
   provisionAutoKanbanProgressHook,
   provisionChannelProgressHook,
@@ -39,7 +40,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-2DIWTRTU.js";
+} from "../chunk-373GH3RH.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -48,6 +49,7 @@ import {
   syncTasksToScheduler
 } from "../chunk-I3YS5WFV.js";
 import {
+  AnchorSessionClient,
   CONVERSATION_FAILURE_CATEGORIES,
   DEFAULT_FRAMEWORK,
   FLAGS_SCHEMA_VERSION,
@@ -127,7 +129,7 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-4DHYHNCV.js";
+} from "../chunk-ISHK77EM.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -279,6 +281,95 @@ function withResolvedRemoteMcp(integration) {
   };
 }
 
+// src/lib/anchor-session-lifecycle.ts
+var DEFAULT_ANCHOR_SESSION_MAX_DURATION_MINUTES = 60;
+var DEFAULT_ANCHOR_SESSION_REFRESH_MARGIN_MINUTES = 5;
+var AnchorSessionLifecycle = class {
+  store = /* @__PURE__ */ new Map();
+  maxDurationMs;
+  refreshMarginMs;
+  idleTimeoutMinutes;
+  createClient;
+  constructor(opts = {}) {
+    const maxDurationMinutes = opts.maxDurationMinutes ?? DEFAULT_ANCHOR_SESSION_MAX_DURATION_MINUTES;
+    this.maxDurationMs = maxDurationMinutes * 6e4;
+    this.refreshMarginMs = (opts.refreshMarginMinutes ?? DEFAULT_ANCHOR_SESSION_REFRESH_MARGIN_MINUTES) * 6e4;
+    this.idleTimeoutMinutes = opts.idleTimeoutMinutes ?? maxDurationMinutes;
+    this.createClient = opts.createClient ?? ((apiKey) => new AnchorSessionClient({ apiKey }));
+  }
+  /**
+   * Return the session id the agent should bind, minting or re-minting as needed.
+   * Returns null for the stateless case (no profile / no key / mint failure with
+   * no valid fallback) - the manager then leaves `ANCHOR_BROWSER_SESSION_ID`
+   * empty. Never throws.
+   */
+  async ensure(params) {
+    const { agentId, now } = params;
+    const log2 = params.log ?? (() => {
+    });
+    const profileName = params.profileName?.trim() || "";
+    const apiKey = params.apiKey?.trim() || "";
+    const existing = this.store.get(agentId);
+    if (!profileName) {
+      if (existing) {
+        this.endBestEffort(apiKey, existing.sessionId, log2);
+        this.store.delete(agentId);
+      }
+      return null;
+    }
+    if (!apiKey) {
+      if (existing && existing.profileName === profileName && now < existing.expiresAt) {
+        return existing.sessionId;
+      }
+      log2(`[anchor-session] ${agentId}: profile "${profileName}" but no api key - stateless`);
+      return null;
+    }
+    if (existing && existing.profileName === profileName && now < existing.expiresAt - this.refreshMarginMs) {
+      return existing.sessionId;
+    }
+    try {
+      const client2 = this.createClient(apiKey);
+      const session = await client2.createSession({
+        profileName,
+        dedicatedStickyIp: true,
+        maxDurationMinutes: this.maxDurationMs / 6e4,
+        idleTimeoutMinutes: this.idleTimeoutMinutes
+      });
+      const effectiveMs = Math.min(this.maxDurationMs, this.idleTimeoutMinutes * 6e4);
+      this.store.set(agentId, {
+        sessionId: session.sessionId,
+        profileName,
+        expiresAt: now + effectiveMs
+      });
+      if (existing && existing.sessionId !== session.sessionId) {
+        this.endBestEffort(apiKey, existing.sessionId, log2);
+      }
+      log2(`[anchor-session] ${agentId}: minted session for profile "${profileName}"`);
+      return session.sessionId;
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      if (existing && existing.profileName === profileName && now < existing.expiresAt) {
+        log2(`[anchor-session] ${agentId}: re-mint failed (${reason}) - keeping current session`);
+        return existing.sessionId;
+      }
+      log2(`[anchor-session] ${agentId}: mint failed (${reason}) - degrading to stateless`);
+      return null;
+    }
+  }
+  /** Forget an agent's session (e.g. on decommission). Best-effort ends it. */
+  forget(agentId, apiKey, log2 = () => {
+  }) {
+    const existing = this.store.get(agentId);
+    if (!existing) return;
+    this.endBestEffort(apiKey?.trim() || "", existing.sessionId, log2);
+    this.store.delete(agentId);
+  }
+  endBestEffort(apiKey, sessionId, log2) {
+    if (!apiKey || !sessionId) return;
+    void this.createClient(apiKey).endSession(sessionId).catch((err) => log2(`[anchor-session] failed to end a stale session: ${err.message}`));
+  }
+};
+
 // src/lib/channel-restart-decision.ts
 function launchableChannelIds(channelConfigs) {
   if (!channelConfigs) return /* @__PURE__ */ new Set();
@@ -6739,6 +6830,7 @@ function isHostBusyForForcedUpdate() {
   return false;
 }
 var runningMcpHashes = /* @__PURE__ */ new Map();
+var anchorSessionLifecycle = new AnchorSessionLifecycle();
 var runningMcpServerKeys = /* @__PURE__ */ new Map();
 var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
@@ -7087,7 +7179,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.318" : "dev";
+var agtCliVersion = true ? "0.28.319" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7959,7 +8051,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-VSSEZTY7.js");
+      const { collectDiagnostics } = await import("../persistent-session-U5IQYEXX.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -8057,7 +8149,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-VSSEZTY7.js");
+      const { collectDiagnostics } = await import("../persistent-session-U5IQYEXX.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -8206,7 +8298,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-I6YFUKYD.js");
+      } = await import("../responsiveness-probe-YIESMTKL.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8238,7 +8330,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-I6YFUKYD.js");
+        } = await import("../responsiveness-probe-YIESMTKL.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -9722,6 +9814,24 @@ async function processAgent(agent, agentStates) {
         log(`OAuth token refresh failed for '${agent.code_name}/${integration.definition_id}': ${err.message}`);
       }
     }
+    const anchorIntegration = integrations.find((i) => i.definition_id === "anchor-browser");
+    if (anchorIntegration) {
+      const profileName = anchorIntegration.config?.["profile_name"];
+      const apiKey = anchorIntegration.credentials?.["api_key"];
+      const sessionId = await anchorSessionLifecycle.ensure({
+        agentId: agent.agent_id,
+        profileName,
+        apiKey,
+        now: Date.now(),
+        log
+      });
+      const config2 = { ...anchorIntegration.config ?? {} };
+      if (sessionId) config2["session_id"] = sessionId;
+      else delete config2["session_id"];
+      anchorIntegration.config = config2;
+    } else {
+      anchorSessionLifecycle.forget(agent.agent_id, void 0, log);
+    }
     if (hostFlagStore().getBoolean("connectivity-probe")) {
       try {
         const probeProjectDir = join19(homedir10(), ".augmented", agent.code_name, "project");
@@ -9809,7 +9919,8 @@ async function processAgent(agent, agentStates) {
                 isolated: isolationMode(agent.code_name) === "docker"
               });
             }
-            const respawnVars = envOnlyRespawnVars(changedVars, mcpJsonForReap, CHANNEL_SECRET_ENV_KEYS);
+            const liveProxyVars = liveProxyExtraHeaderVars(mcpJsonForReap);
+            const respawnVars = envOnlyRespawnVars(changedVars, mcpJsonForReap, CHANNEL_SECRET_ENV_KEYS).filter((v) => !liveProxyVars.has(v));
             const envDiff = classifyEnvIntegrationsDiff(preWriteEnv, postWriteEnv);
             const rotatedOnlyVars = new Set(envDiff.rotated);
             const envRespawnReason = respawnVars.length > 0 && respawnVars.every((v) => rotatedOnlyVars.has(v)) ? "credential-rotation" : "hot-reload-mcp";
@@ -11257,7 +11368,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-VSSEZTY7.js");
+        const { collectDiagnostics } = await import("../persistent-session-U5IQYEXX.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -11307,7 +11418,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-VSSEZTY7.js");
+      const { collectDiagnostics } = await import("../persistent-session-U5IQYEXX.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -11731,7 +11842,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-PWVOBBX4.js");
+  } = await import("../claude-pair-runtime-55LJJ7DB.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));