@integrity-labs/agt-cli 0.28.376 → 0.28.378

package/dist/{claude-pair-runtime-2BAVARZU.js → claude-pair-runtime-FYILNSJ5.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-YEGKJ6D2.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-UR2QF76O.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-2BAVARZU.js.map
+//# sourceMappingURL=claude-pair-runtime-FYILNSJ5.js.map

package/dist/lib/manager-worker.js

@@ -43,7 +43,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-KHAXB7KJ.js";
+} from "../chunk-JB5PEPQU.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -145,7 +145,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-EZ5DJZ6Q.js";
+} from "../chunk-Q64467SG.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -9100,7 +9100,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.376" : "dev";
+var agtCliVersion = true ? "0.28.378" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -9232,6 +9232,116 @@ async function ensureToolkitCli(toolkitSlug) {
     recordToolkitFailure(toolkitSlug, `installer=${resolvedInstaller} completed but ${binary} still not on PATH`);
   }
 }
+var isolationImageEnsured = /* @__PURE__ */ new Set();
+var isolationImageRetryAfter = /* @__PURE__ */ new Map();
+var isolationImageFailureCount = /* @__PURE__ */ new Map();
+var isolationImageInFlight = /* @__PURE__ */ new Set();
+var ISOLATION_IMAGE_RETRY_MS = 5 * 6e4;
+var ISOLATION_IMAGE_MAX_FAILURES = 3;
+function isolationImageErrDetail(err) {
+  const e = err;
+  const stderr = e?.stderr ? e.stderr.toString().trim() : "";
+  return (stderr || e?.message || String(err)).slice(0, 300);
+}
+function recordIsolationImageFailure(imageUri, reason) {
+  const count = (isolationImageFailureCount.get(imageUri) ?? 0) + 1;
+  isolationImageFailureCount.set(imageUri, count);
+  if (count >= ISOLATION_IMAGE_MAX_FAILURES) {
+    log(`[isolation-image] ${reason} (giving up after ${count} attempts - existing local image stays in use; restart the manager to retry)`);
+    isolationImageEnsured.add(imageUri);
+    isolationImageRetryAfter.delete(imageUri);
+  } else {
+    log(`[isolation-image] ${reason} (attempt ${count}/${ISOLATION_IMAGE_MAX_FAILURES}, retrying in ${ISOLATION_IMAGE_RETRY_MS / 6e4}m)`);
+    isolationImageRetryAfter.set(imageUri, Date.now() + ISOLATION_IMAGE_RETRY_MS);
+  }
+}
+async function ensureIsolationImage(imageUri) {
+  if (process.env.AGT_ISOLATION_IMAGE) return;
+  if (!imageUri || isolationImageEnsured.has(imageUri)) return;
+  if (isolationImageInFlight.has(imageUri)) return;
+  const retryAfter = isolationImageRetryAfter.get(imageUri) ?? 0;
+  if (retryAfter > Date.now()) return;
+  const registry = imageUri.split("/")[0] ?? "";
+  const isPublic = registry === "public.ecr.aws";
+  const privRegion = registry.match(/\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com$/)?.[1];
+  if (!isPublic && !privRegion) {
+    log(`[isolation-image] '${imageUri}' is not a recognised ECR image URI - skipping managed pull`);
+    isolationImageEnsured.add(imageUri);
+    return;
+  }
+  isolationImageInFlight.add(imageUri);
+  try {
+    const { execFileSync: execFileSync2 } = await import("child_process");
+    try {
+      execFileSync2("which", ["docker"], { timeout: 5e3, stdio: "pipe" });
+    } catch {
+      recordIsolationImageFailure(imageUri, `'docker' not found on host - required to pull the isolation image (install it, then the manager retries)`);
+      return;
+    }
+    const hasAws = (() => {
+      try {
+        execFileSync2("which", ["aws"], { timeout: 5e3, stdio: "pipe" });
+        return true;
+      } catch {
+        return false;
+      }
+    })();
+    if (isPublic) {
+      if (hasAws) {
+        try {
+          const password = execFileSync2("aws", ["ecr-public", "get-login-password", "--region", "us-east-1"], {
+            timeout: 3e4,
+            stdio: ["ignore", "pipe", "pipe"]
+          }).toString().trim();
+          execFileSync2("docker", ["login", "--username", "AWS", "--password-stdin", "public.ecr.aws"], {
+            input: password,
+            timeout: 3e4,
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+        } catch (err) {
+          log(`[isolation-image] ecr-public login failed, falling back to anonymous pull: ${isolationImageErrDetail(err)}`);
+        }
+      }
+    } else if (privRegion) {
+      if (!hasAws) {
+        recordIsolationImageFailure(imageUri, `'aws' CLI not found - required to authenticate a private ECR pull of ${registry} (install it, then the manager retries)`);
+        return;
+      }
+      try {
+        const password = execFileSync2("aws", ["ecr", "get-login-password", "--region", privRegion], {
+          timeout: 3e4,
+          stdio: ["ignore", "pipe", "pipe"]
+        }).toString().trim();
+        execFileSync2("docker", ["login", "--username", "AWS", "--password-stdin", registry], {
+          input: password,
+          timeout: 3e4,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+      } catch (err) {
+        recordIsolationImageFailure(imageUri, `ecr login for ${registry} failed: ${isolationImageErrDetail(err)}`);
+        return;
+      }
+    }
+    log(`[isolation-image] pulling ${imageUri}\u2026`);
+    const pull = await runAsync("docker", ["pull", imageUri], { timeout: 6e5 });
+    if (pull.code !== 0) {
+      recordIsolationImageFailure(imageUri, `docker pull failed (exit ${pull.code}): ${(pull.stderr || pull.stdout).slice(0, 300)}`);
+      return;
+    }
+    const localTag = "agt-runtime:latest";
+    const tag = await runAsync("docker", ["tag", imageUri, localTag], { timeout: 3e4 });
+    if (tag.code !== 0) {
+      recordIsolationImageFailure(imageUri, `docker tag \u2192 ${localTag} failed (exit ${tag.code}): ${tag.stderr.slice(0, 200)}`);
+      return;
+    }
+    log(`[isolation-image] ${localTag} now points at ${imageUri}`);
+    isolationImageEnsured.add(imageUri);
+    isolationImageRetryAfter.delete(imageUri);
+    isolationImageFailureCount.delete(imageUri);
+  } finally {
+    isolationImageInFlight.delete(imageUri);
+  }
+}
 function runAsync(cmd, args, opts) {
   return new Promise((resolve, reject) => {
     import("child_process").then(({ spawn }) => {
@@ -10119,7 +10229,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-YEGKJ6D2.js");
+      const { collectDiagnostics } = await import("../persistent-session-UR2QF76O.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -10218,7 +10328,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-YEGKJ6D2.js");
+      const { collectDiagnostics } = await import("../persistent-session-UR2QF76O.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -10373,7 +10483,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-N2JSVMRN.js");
+      } = await import("../responsiveness-probe-QXVQKH7F.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -10405,7 +10515,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-N2JSVMRN.js");
+        } = await import("../responsiveness-probe-QXVQKH7F.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-HYOOQV4A.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -12443,6 +12553,12 @@ async function processAgent(agent, agentStates) {
           await ensureToolkitCli(toolkitSlug);
         }
       }
+      const desiredRuntimeImage = refreshAny.desired_runtime_image;
+      if (desiredRuntimeImage && isolationMode(agent.code_name) !== "none") {
+        void ensureIsolationImage(desiredRuntimeImage).catch((err) => {
+          log(`[isolation-image] unexpected managed-pull failure: ${isolationImageErrDetail(err)}`);
+        });
+      }
       const agentFw2 = agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK;
       if (agentFw2 === "claude-code" && installedIntegrationSkills.length > 0 && isSessionHealthy(agent.code_name)) {
         const names = installedIntegrationSkills.join(", ");
@@ -13583,7 +13699,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-YEGKJ6D2.js");
+        const { collectDiagnostics } = await import("../persistent-session-UR2QF76O.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -13633,7 +13749,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-YEGKJ6D2.js");
+      const { collectDiagnostics } = await import("../persistent-session-UR2QF76O.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -14086,7 +14202,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-2BAVARZU.js");
+  } = await import("../claude-pair-runtime-FYILNSJ5.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));