@integrity-labs/agt-cli 0.28.335 → 0.28.337

package/dist/lib/manager-worker.js

@@ -14,6 +14,7 @@ import {
   classifyEnvIntegrationsDiff,
   clearPresenceReaperState,
   clearPresenceReaperStateForKeys,
+  decidePin,
   defaultFlagsCachePath,
   deriveMcpServerKey,
   diffEnvIntegrations,
@@ -29,6 +30,7 @@ import {
   getHostId,
   givenUpMcpServerKeys,
   liveProxyExtraHeaderVars,
+  pinAllowsUrgent,
   provision,
   provisionAutoKanbanProgressHook,
   provisionChannelProgressHook,
@@ -43,7 +45,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-VJYEJQDY.js";
+} from "../chunk-N7XPDFCW.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -8386,7 +8388,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.335" : "dev";
+var agtCliVersion = true ? "0.28.337" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -8686,6 +8688,8 @@ function selfUpdateAppliedMarkerPath() {
   return join21(homedir11(), ".augmented", ".last-self-update-applied");
 }
 var selfUpdateUpToDateLogged = false;
+var selfUpdatePinnedLogged = false;
+var selfUpdatePinInvalidLogged = false;
 var restartAfterUpgrade = false;
 var pendingUpgradeVersion = null;
 var selfUpdateInFlight = false;
@@ -8733,6 +8737,25 @@ async function checkAndUpdateCliViaBrew(force = false) {
   const { execFileSync: execFileSync2 } = await import("child_process");
   const brewPath = resolveBrewPath(execFileSync2);
   if (!brewPath) return "noop";
+  {
+    const brewPin = decidePin({ installed: agtCliVersion, pinRaw: process.env.AGT_CLI_PIN_VERSION });
+    if (brewPin.kind === "satisfied") {
+      if (!selfUpdatePinnedLogged) {
+        log(`[self-update] agt CLI pinned to ${brewPin.version} (AGT_CLI_PIN_VERSION); already satisfied on this brew install.`);
+        selfUpdatePinnedLogged = true;
+      }
+      return "noop";
+    }
+    if (brewPin.kind === "install") {
+      if (!selfUpdatePinnedLogged) {
+        log(
+          `[self-update] agt CLI is pinned to ${brewPin.version} (AGT_CLI_PIN_VERSION) but this is a Homebrew install (currently ${agtCliVersion}); brew can't install an exact version, so the pin CANNOT be satisfied here. Not upgrading. Switch to the npm-global install (or hold the formula) to pin exactly.`
+        );
+        selfUpdatePinnedLogged = true;
+      }
+      return "noop";
+    }
+  }
   let metadataFresh = true;
   try {
     execFileSync2(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
@@ -8800,6 +8823,44 @@ async function checkAndUpdateCliViaBrew(force = false) {
 async function checkAndUpdateCliViaNpm(force = false) {
   if (agtCliVersion === "dev") return "noop";
   const channel = process.env.AGT_CLI_RELEASE_CHANNEL || "latest";
+  const pinRaw = process.env.AGT_CLI_PIN_VERSION;
+  const pinDecision = decidePin({ installed: agtCliVersion, pinRaw });
+  if (pinDecision.kind === "invalid") {
+    if (!selfUpdatePinInvalidLogged) {
+      log(
+        `[self-update] AGT_CLI_PIN_VERSION="${pinDecision.raw}" is not a valid version; ignoring the pin and tracking channel=${channel} as usual.`
+      );
+      selfUpdatePinInvalidLogged = true;
+    }
+  } else if (pinDecision.kind !== "unpinned") {
+    if (pinAllowsUrgent(process.env.AGT_CLI_PIN_ALLOW_URGENT)) {
+      const urgentTarget2 = await fetchUrgentDistTagVersion();
+      if (urgentTarget2 && urgentTarget2 === agtCliVersion) {
+        return "noop";
+      }
+      if (isUrgentUpgrade({
+        urgentTarget: urgentTarget2,
+        installed: agtCliVersion,
+        isNewer: (installed, candidate) => candidate !== installed && !isOlderSemverTuple(installed, candidate)
+      })) {
+        log(
+          `[self-update] URGENT agt CLI hotfix ${agtCliVersion} \u2192 ${urgentTarget2} overrides pin=${pinDecision.version} (AGT_CLI_PIN_ALLOW_URGENT). Upgrading via npm...`
+        );
+        return await installAgtCliViaNpm(urgentTarget2, "urgent(pin-allow-urgent)");
+      }
+    }
+    if (pinDecision.kind === "satisfied") {
+      if (!selfUpdatePinnedLogged) {
+        log(`[self-update] agt CLI pinned to ${pinDecision.version} (AGT_CLI_PIN_VERSION); up to date.`);
+        selfUpdatePinnedLogged = true;
+      }
+      return "noop";
+    }
+    log(
+      `[self-update] agt CLI pinned to ${pinDecision.version} (AGT_CLI_PIN_VERSION); installing exact version (${agtCliVersion} \u2192 ${pinDecision.version})...`
+    );
+    return await installAgtCliViaNpm(pinDecision.version, `pin=${pinDecision.version}`);
+  }
   let latest;
   try {
     const res = await fetch(