@integrity-labs/agt-cli 0.28.380 → 0.28.381

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-C4OWMK2J.js";
+} from "../chunk-TRTVQUQL.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4829,7 +4829,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.380" : "dev";
+var cliVersion = true ? "0.28.381" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6001,7 +6001,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.380" : "dev";
+var cliVersion2 = true ? "0.28.381" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-C4OWMK2J.js → chunk-TRTVQUQL.js}

@@ -6184,7 +6184,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.380" : "dev";
+var agtCliVersion = true ? "0.28.381" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8630,4 +8630,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-C4OWMK2J.js.map
+//# sourceMappingURL=chunk-TRTVQUQL.js.map

package/dist/lib/manager-worker.js

@@ -43,7 +43,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-C4OWMK2J.js";
+} from "../chunk-TRTVQUQL.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -287,6 +287,13 @@ function computeIntegrationsHash(integrations) {
   );
   return createHash2("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
 }
+function computeCapabilitySurfaceHash(integrations) {
+  const payload = [...integrations].sort((a, b) => a.definition_id.localeCompare(b.definition_id)).map((i) => {
+    const caps = [...i.capabilities ?? []].sort((a, b) => a.id.localeCompare(b.id)).map((c) => `${c.id}:${c.access}`);
+    return `${i.definition_id}:${i.display_name ?? ""}:${JSON.stringify(caps)}`;
+  });
+  return createHash2("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+}
 
 // src/lib/host-integration-mapping.ts
 function withResolvedRemoteMcp(integration) {
@@ -3810,6 +3817,18 @@ var agentState = {
   knownModels: /* @__PURE__ */ new Map(),
   knownTasksHashes: /* @__PURE__ */ new Map(),
   knownIntegrationHashes: /* @__PURE__ */ new Map(),
+  /**
+   * ENG-7946: hash of the integration CAPABILITY SURFACE (definition_id +
+   * display_name + capabilities), updated each poll alongside
+   * `knownIntegrationHashes`. The `integration-update` notice injected into
+   * the agent's session is gated on THIS hash changing, not the full
+   * credential+config hash — so token refreshes (which bump
+   * `knownIntegrationHashes` via the `credentials` field) do not fire a
+   * spurious notice. In-memory only: a manager restart clears it, and the
+   * first-poll delta fires exactly one notice on startup, which is correct
+   * (it reflects the true current surface).
+   */
+  knownCapabilitySurfaceHashes: /* @__PURE__ */ new Map(),
   /**
    * ENG-7812: the integration MEMBERSHIP (sorted `definition_id`s, credential/
    * config churn ignored) observed on the previous refresh. Diffed against the
@@ -3903,6 +3922,7 @@ function clearAgentState(agentId, codeName) {
   agentState.knownModels.delete(agentId);
   agentState.knownTasksHashes.delete(agentId);
   agentState.knownIntegrationHashes.delete(agentId);
+  agentState.knownCapabilitySurfaceHashes.delete(agentId);
   agentState.knownIntegrationMembership.delete(agentId);
   agentState.knownManagedMcpHashes.delete(agentId);
   agentState.knownManagedMcpStructure.delete(agentId);
@@ -9100,7 +9120,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.380" : "dev";
+var agtCliVersion = true ? "0.28.381" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -12128,17 +12148,22 @@ async function processAgent(agent, agentStates) {
       });
     }
     agentState.knownIntegrationMembership.set(agent.agent_id, currentIntIds);
+    const capSurfaceHash = computeCapabilitySurfaceHash(integrations);
+    const prevCapSurfaceHash = agentState.knownCapabilitySurfaceHashes.get(agent.agent_id);
+    const capSurfaceNames = integrations.map((i) => i.display_name || i.definition_id).join(", ");
+    const intMembership = membershipSignature(integrations.map((i) => i.definition_id));
+    const intFlap = mcpFlapDampener.record(agent.code_name, FLAP_CHANNEL_INTEGRATIONS, intMembership);
+    if (intFlap.onset) {
+      log(
+        `[mcp-flap-dampener] integration set for '${agent.code_name}' is FLAPPING (${intFlap.tier} tier: ${intFlap.transitions} transitions / ${intFlap.distinctStates} states in window) - suppressing integration-update notices until it settles (ENG-6123, ENG-6512)`
+      );
+      recordConfigChurnEvent(agent.agent_id, agent.code_name, FLAP_CHANNEL_INTEGRATIONS, intMembership);
+    }
+    let reapNote = "";
+    let rotationHandled = true;
     if (integrations.length > 0) {
       const intHash = computeIntegrationsHash(integrations);
       const prevIntHash = agentState.knownIntegrationHashes.get(agent.agent_id);
-      const intMembership = membershipSignature(integrations.map((i) => i.definition_id));
-      const intFlap = mcpFlapDampener.record(agent.code_name, FLAP_CHANNEL_INTEGRATIONS, intMembership);
-      if (intFlap.onset) {
-        log(
-          `[mcp-flap-dampener] integration set for '${agent.code_name}' is FLAPPING (${intFlap.tier} tier: ${intFlap.transitions} transitions / ${intFlap.distinctStates} states in window) \u2014 suppressing integration-update notices until it settles (ENG-6123, ENG-6512)`
-        );
-        recordConfigChurnEvent(agent.agent_id, agent.code_name, FLAP_CHANNEL_INTEGRATIONS, intMembership);
-      }
       if (intHash !== prevIntHash) {
         const projectDir = join21(homedir10(), ".augmented", agent.code_name, "project");
         const envIntPath = join21(projectDir, ".env.integrations");
@@ -12159,7 +12184,6 @@ async function processAgent(agent, agentStates) {
           );
           stopOpencodeSession(agent.code_name, log);
         }
-        let rotationHandled = true;
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
             const projectMcpPath = join21(projectDir, ".mcp.json");
@@ -12186,18 +12210,11 @@ async function processAgent(agent, agentStates) {
             const rotatedOnlyVars = new Set(envDiff.rotated);
             const envRespawnReason = respawnVars.length > 0 && respawnVars.every((v) => rotatedOnlyVars.has(v)) ? "credential-rotation" : "hot-reload-mcp";
             const needsRespawn = respawnVars.length > 0 && !intFlap.flapping;
-            const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
             const reconnectNote = affectedServerKeys.length > 0 ? ` The MCP servers that depend on rotating credentials (${affectedServerKeys.join(", ")}) have been signalled to reconnect.` : "";
             const restartNote = needsRespawn ? " Your session will restart shortly to apply the change (ENG-7510)." : "";
-            const reapNote = `${reconnectNote}${restartNote}`;
-            if (intFlap.flapping) {
-              log(`[mcp-flap-dampener] suppressed integration-update notice for '${agent.code_name}' (set flapping, ENG-6123): ${names}`);
-            } else {
-              injectMessage(agent.code_name, "system", `Your integrations have been refreshed. You have access to: ${names}.${reapNote}`, {
-                task_name: "integration-update"
-              }, log).catch(() => {
-              });
-              log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names} (reaped ${affectedServerKeys.length} stale MCP server(s))`);
+            reapNote = `${reconnectNote}${restartNote}`;
+            if (!intFlap.flapping && capSurfaceHash === prevCapSurfaceHash) {
+              log(`[hot-reload] Suppressed integration-update notice for '${agent.code_name}' - capability surface unchanged (credential/config rotation only, ENG-7946): ${capSurfaceNames}`);
             }
             if (needsRespawn) {
               scheduleSessionRestart(
@@ -12220,6 +12237,18 @@ async function processAgent(agent, agentStates) {
         }
       }
     }
+    if (capSurfaceHash !== prevCapSurfaceHash && rotationHandled) {
+      if (intFlap.flapping) {
+        log(`[mcp-flap-dampener] suppressed integration-update notice for '${agent.code_name}' (set flapping, ENG-6123): ${capSurfaceNames}`);
+      } else {
+        injectMessage(agent.code_name, "system", `Your integrations have been refreshed. You have access to: ${capSurfaceNames}.${reapNote}`, {
+          task_name: "integration-update"
+        }, log).catch(() => {
+        });
+        log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${capSurfaceNames}`);
+      }
+      agentState.knownCapabilitySurfaceHashes.set(agent.agent_id, capSurfaceHash);
+    }
     const fwForMcp = agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK;
     if (frameworkAdapter.writeMcpServer) {
       try {