@integrity-labs/agt-cli 0.28.375 → 0.28.377

package/dist/lib/manager-worker.js

@@ -43,7 +43,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-HXEGK3AW.js";
+} from "../chunk-IPWFCWG4.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -9100,7 +9100,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.375" : "dev";
+var agtCliVersion = true ? "0.28.377" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -9232,6 +9232,116 @@ async function ensureToolkitCli(toolkitSlug) {
     recordToolkitFailure(toolkitSlug, `installer=${resolvedInstaller} completed but ${binary} still not on PATH`);
   }
 }
+var isolationImageEnsured = /* @__PURE__ */ new Set();
+var isolationImageRetryAfter = /* @__PURE__ */ new Map();
+var isolationImageFailureCount = /* @__PURE__ */ new Map();
+var isolationImageInFlight = /* @__PURE__ */ new Set();
+var ISOLATION_IMAGE_RETRY_MS = 5 * 6e4;
+var ISOLATION_IMAGE_MAX_FAILURES = 3;
+function isolationImageErrDetail(err) {
+  const e = err;
+  const stderr = e?.stderr ? e.stderr.toString().trim() : "";
+  return (stderr || e?.message || String(err)).slice(0, 300);
+}
+function recordIsolationImageFailure(imageUri, reason) {
+  const count = (isolationImageFailureCount.get(imageUri) ?? 0) + 1;
+  isolationImageFailureCount.set(imageUri, count);
+  if (count >= ISOLATION_IMAGE_MAX_FAILURES) {
+    log(`[isolation-image] ${reason} (giving up after ${count} attempts - existing local image stays in use; restart the manager to retry)`);
+    isolationImageEnsured.add(imageUri);
+    isolationImageRetryAfter.delete(imageUri);
+  } else {
+    log(`[isolation-image] ${reason} (attempt ${count}/${ISOLATION_IMAGE_MAX_FAILURES}, retrying in ${ISOLATION_IMAGE_RETRY_MS / 6e4}m)`);
+    isolationImageRetryAfter.set(imageUri, Date.now() + ISOLATION_IMAGE_RETRY_MS);
+  }
+}
+async function ensureIsolationImage(imageUri) {
+  if (process.env.AGT_ISOLATION_IMAGE) return;
+  if (!imageUri || isolationImageEnsured.has(imageUri)) return;
+  if (isolationImageInFlight.has(imageUri)) return;
+  const retryAfter = isolationImageRetryAfter.get(imageUri) ?? 0;
+  if (retryAfter > Date.now()) return;
+  const registry = imageUri.split("/")[0] ?? "";
+  const isPublic = registry === "public.ecr.aws";
+  const privRegion = registry.match(/\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com$/)?.[1];
+  if (!isPublic && !privRegion) {
+    log(`[isolation-image] '${imageUri}' is not a recognised ECR image URI - skipping managed pull`);
+    isolationImageEnsured.add(imageUri);
+    return;
+  }
+  isolationImageInFlight.add(imageUri);
+  try {
+    const { execFileSync: execFileSync2 } = await import("child_process");
+    try {
+      execFileSync2("which", ["docker"], { timeout: 5e3, stdio: "pipe" });
+    } catch {
+      recordIsolationImageFailure(imageUri, `'docker' not found on host - required to pull the isolation image (install it, then the manager retries)`);
+      return;
+    }
+    const hasAws = (() => {
+      try {
+        execFileSync2("which", ["aws"], { timeout: 5e3, stdio: "pipe" });
+        return true;
+      } catch {
+        return false;
+      }
+    })();
+    if (isPublic) {
+      if (hasAws) {
+        try {
+          const password = execFileSync2("aws", ["ecr-public", "get-login-password", "--region", "us-east-1"], {
+            timeout: 3e4,
+            stdio: ["ignore", "pipe", "pipe"]
+          }).toString().trim();
+          execFileSync2("docker", ["login", "--username", "AWS", "--password-stdin", "public.ecr.aws"], {
+            input: password,
+            timeout: 3e4,
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+        } catch (err) {
+          log(`[isolation-image] ecr-public login failed, falling back to anonymous pull: ${isolationImageErrDetail(err)}`);
+        }
+      }
+    } else if (privRegion) {
+      if (!hasAws) {
+        recordIsolationImageFailure(imageUri, `'aws' CLI not found - required to authenticate a private ECR pull of ${registry} (install it, then the manager retries)`);
+        return;
+      }
+      try {
+        const password = execFileSync2("aws", ["ecr", "get-login-password", "--region", privRegion], {
+          timeout: 3e4,
+          stdio: ["ignore", "pipe", "pipe"]
+        }).toString().trim();
+        execFileSync2("docker", ["login", "--username", "AWS", "--password-stdin", registry], {
+          input: password,
+          timeout: 3e4,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+      } catch (err) {
+        recordIsolationImageFailure(imageUri, `ecr login for ${registry} failed: ${isolationImageErrDetail(err)}`);
+        return;
+      }
+    }
+    log(`[isolation-image] pulling ${imageUri}\u2026`);
+    const pull = await runAsync("docker", ["pull", imageUri], { timeout: 6e5 });
+    if (pull.code !== 0) {
+      recordIsolationImageFailure(imageUri, `docker pull failed (exit ${pull.code}): ${(pull.stderr || pull.stdout).slice(0, 300)}`);
+      return;
+    }
+    const localTag = "agt-runtime:latest";
+    const tag = await runAsync("docker", ["tag", imageUri, localTag], { timeout: 3e4 });
+    if (tag.code !== 0) {
+      recordIsolationImageFailure(imageUri, `docker tag \u2192 ${localTag} failed (exit ${tag.code}): ${tag.stderr.slice(0, 200)}`);
+      return;
+    }
+    log(`[isolation-image] ${localTag} now points at ${imageUri}`);
+    isolationImageEnsured.add(imageUri);
+    isolationImageRetryAfter.delete(imageUri);
+    isolationImageFailureCount.delete(imageUri);
+  } finally {
+    isolationImageInFlight.delete(imageUri);
+  }
+}
 function runAsync(cmd, args, opts) {
   return new Promise((resolve, reject) => {
     import("child_process").then(({ spawn }) => {
@@ -12443,6 +12553,12 @@ async function processAgent(agent, agentStates) {
           await ensureToolkitCli(toolkitSlug);
         }
       }
+      const desiredRuntimeImage = refreshAny.desired_runtime_image;
+      if (desiredRuntimeImage && isolationMode(agent.code_name) !== "none") {
+        void ensureIsolationImage(desiredRuntimeImage).catch((err) => {
+          log(`[isolation-image] unexpected managed-pull failure: ${isolationImageErrDetail(err)}`);
+        });
+      }
       const agentFw2 = agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK;
       if (agentFw2 === "claude-code" && installedIntegrationSkills.length > 0 && isSessionHealthy(agent.code_name)) {
         const names = installedIntegrationSkills.join(", ");