@integrity-labs/agt-cli 0.28.40 → 0.28.42

package/dist/{claude-pair-runtime-LOL5YGXP.js → claude-pair-runtime-YPTMIWJF.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-CFELQZI7.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-PNY26VBX.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-LOL5YGXP.js.map
+//# sourceMappingURL=claude-pair-runtime-YPTMIWJF.js.map

package/dist/lib/manager-worker.js

@@ -7,9 +7,13 @@ import {
   SUPERVISOR_RESTART_EXIT_CODE,
   api,
   atomicWriteFileSync,
+  buildConnectivityProbeDeps,
+  buildProbeEnv,
   defaultFlagsCachePath,
+  deriveMcpServerKey,
   estimateActiveTasksTokens,
   exchangeApiKey,
+  executeConnectivityProbe,
   extractCommandNotFound,
   getApiKey,
   getHostId,
@@ -23,7 +27,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-DA776TZO.js";
+} from "../chunk-3QK6QLQW.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -35,8 +39,6 @@ import {
   buildAllowedTools,
   checkChannelInputs,
   creditWatchdogGiveUpCount,
-  expandTemplateVars,
-  formatMissingVar,
   getLastFailureContext,
   getProjectDir,
   getSessionState,
@@ -47,10 +49,8 @@ import {
   isSessionHealthy,
   isStaleForToday,
   paneLogPath,
-  parseEnvIntegrations,
   peekCurrentSession,
   prepareForRespawn,
-  probeMcpEnvSubstitution,
   readPaneLogTail,
   resetRestartCount,
   resolveClaudeBinary,
@@ -65,7 +65,7 @@ import {
   takeWatchdogGiveUpCount,
   takeZombieDetection,
   transcriptActivityAgeSeconds
-} from "../chunk-57MHPANB.js";
+} from "../chunk-2BRF2FDJ.js";
 import {
   FLAGS_SCHEMA_VERSION,
   FLAG_REGISTRY,
@@ -79,6 +79,7 @@ import {
   classifyOutput,
   extractFrontmatter,
   formatActorId,
+  formatMissingVar,
   formatRunMarker,
   getFramework,
   isEmptyTotals,
@@ -86,20 +87,16 @@ import {
   isResolveError,
   isSelfCompletion,
   parseDeliveryTarget,
+  parseEnvIntegrations,
   parseTranscriptUsage,
   parseUsageBanner,
-  probeComposioAccount,
-  probeComposioMcpToolCall,
-  probeHttpProvider,
-  probeMcpHttp,
+  probeMcpEnvSubstitution,
   resolveAvatarEnvUrl,
   resolveChannels,
-  resolveConnectivityProbe,
   resolveDmTarget,
   sumTranscriptUsageInWindow,
-  worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "../chunk-X5E2Q3W2.js";
+} from "../chunk-SJUD2BWU.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -1210,73 +1207,6 @@ function shouldRespawnForModelChange(input) {
   return previousModel !== primaryModel;
 }
 
-// src/lib/connectivity-probe-executor.ts
-async function executeConnectivityProbe(target, deps = {}) {
-  const descriptor = resolveConnectivityProbe({
-    definitionId: target.definitionId,
-    sourceType: target.sourceType,
-    authType: target.authType,
-    // ENG-6242: carry the toolkit's connectivity_test override so a managed
-    // descriptor surfaces `probeTool`/`probeArgs` (the prescribed read-only tool)
-    // — without this the hourly probe auto-picked a different tool than the Test
-    // path, the false-RED that flagged every managed Linear install "unreachable".
-    connectivityTest: target.connectivityTest ?? null
-  });
-  if (!descriptor.readOnly) {
-    throw new Error(`Refusing non-read-only probe for ${target.definitionId}`);
-  }
-  switch (descriptor.kind) {
-    case "http_provider":
-      return probeHttpProvider(target.definitionId, target.credentials, deps.fetchImpl ?? fetch);
-    case "composio_account":
-      if (!deps.composioProbe) return null;
-      return deps.composioProbe(target.definitionId, target.credentials);
-    case "managed_composite": {
-      const outcomes = [];
-      if (deps.mcpProbe) {
-        outcomes.push(
-          await deps.mcpProbe({
-            serverKey: target.mcpServerKey ?? target.definitionId,
-            definitionId: target.definitionId
-          })
-        );
-      }
-      if (deps.composioProbe) {
-        outcomes.push(await deps.composioProbe(target.definitionId, target.credentials));
-      }
-      if (deps.composioToolCallProbe) {
-        const toolCall = await deps.composioToolCallProbe({
-          serverKey: target.mcpServerKey ?? target.definitionId,
-          definitionId: target.definitionId,
-          // ENG-6242: thread the prescribed tool through to the live tool-call
-          // leg. resolveConnectivityProbe only sets these for managed toolkits
-          // with a stored override; the probe re-validates read-only and falls
-          // back to auto-pick on drift, so a missing/invalid override is safe.
-          toolName: descriptor.probeTool ?? null,
-          toolArgs: descriptor.probeArgs ?? null
-        });
-        if (toolCall) outcomes.push(toolCall);
-      }
-      if (outcomes.length === 0) return null;
-      return outcomes.reduce((acc, o) => worseConnectivityOutcome(acc, o));
-    }
-    case "mcp_tools_list":
-      if (!deps.mcpProbe) return null;
-      return deps.mcpProbe({
-        serverKey: target.mcpServerKey ?? target.definitionId,
-        definitionId: target.definitionId
-      });
-    case "cli_command":
-      if (!deps.runCli) return null;
-      return deps.runCli(target.cliBinary ?? target.definitionId, descriptor.cliArgs ?? ["--version"]);
-    case "builtin":
-      return { status: "ok", message: `${target.definitionId}: built-in` };
-    case "unsupported":
-    default:
-      return null;
-  }
-}
-
 // src/lib/connectivity-probe-runner.ts
 var DEFAULT_INTERVAL_MS = 60 * 60 * 1e3;
 var DEFAULT_MAX_PER_RUN = 25;
@@ -1389,37 +1319,6 @@ var DependencyRecoveryLedger = class {
   }
 };
 
-// src/lib/cli-probe.ts
-import { execFile } from "child_process";
-var DEFAULT_TIMEOUT_MS = 8e3;
-function runCliProbe(binary, args, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return new Promise((resolve) => {
-    execFile(
-      binary,
-      args,
-      { timeout: timeoutMs, env: opts.env ?? process.env, windowsHide: true },
-      (err, stdout) => {
-        if (!err) {
-          const firstLine = String(stdout).split(/\r?\n/, 1)[0]?.trim();
-          resolve({ status: "ok", message: firstLine ? `${binary}: ${firstLine}` : `${binary}: ok` });
-          return;
-        }
-        const e = err;
-        if (e.code === "ENOENT") {
-          resolve({ status: "down", message: `${binary} not found on PATH (not installed)` });
-          return;
-        }
-        if (e.killed || e.signal === "SIGTERM") {
-          resolve({ status: "transient_error", message: `${binary} probe timed out after ${timeoutMs / 1e3}s` });
-          return;
-        }
-        resolve({ status: "down", message: `${binary} exited non-zero: ${e.message}` });
-      }
-    );
-  });
-}
-
 // src/lib/self-update-coalesce.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
@@ -3132,9 +3031,9 @@ var GatewayClientPool = class extends EventEmitter {
 import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
 import { homedir as homedir4, platform } from "os";
 import { join as join9 } from "path";
-import { execFile as execFile2 } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
-var execFileAsync = promisify(execFile2);
+var execFileAsync = promisify(execFile);
 var EXPIRING_SOON_MS = 48 * 60 * 60 * 1e3;
 async function detectClaudeAuth() {
   if (process.env["ANTHROPIC_API_KEY"] || process.env["ANTHROPIC_AUTH_TOKEN"]) {
@@ -6490,116 +6389,10 @@ function projectMcpKeys(_codeName, projectDir) {
     return null;
   }
 }
-function readMcpHttpServerConfig(projectDir, serverKey, env) {
-  try {
-    const raw = readFileSync14(join16(projectDir, ".mcp.json"), "utf-8");
-    const servers = JSON.parse(raw).mcpServers ?? {};
-    const entry = servers[serverKey];
-    if (entry && typeof entry.url === "string" && (entry.type === "http" || entry.type === void 0)) {
-      const unresolved = /* @__PURE__ */ new Set();
-      const sub = (value) => {
-        if (!env) return value;
-        const r = expandTemplateVars(value, env);
-        for (const name of r.unresolved) unresolved.add(name);
-        return r.value;
-      };
-      const url = sub(entry.url);
-      let headers;
-      if (entry.headers) {
-        headers = {};
-        for (const [k, v] of Object.entries(entry.headers)) headers[k] = sub(v);
-      }
-      return { url, ...headers ? { headers } : {}, unresolved: [...unresolved] };
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function deriveMcpServerKey(input) {
-  const kind = resolveConnectivityProbe({
-    definitionId: input.definitionId,
-    sourceType: input.sourceType,
-    authType: input.authType,
-    connectivityTest: input.connectivityTest ?? null
-  }).kind;
-  if (kind !== "mcp_tools_list" && kind !== "managed_composite") return void 0;
-  return input.definitionId.replace(/[^a-z0-9]/gi, "_").toLowerCase();
-}
 async function runAgentConnectivityProbes(agent, integrations, projectDir) {
   if (integrations.length === 0) return;
-  const probeEnv = { ...process.env };
-  try {
-    const envIntPath = join16(projectDir, ".env.integrations");
-    if (existsSync9(envIntPath)) {
-      Object.assign(probeEnv, parseEnvIntegrations(readFileSync14(envIntPath, "utf-8")));
-    }
-  } catch {
-  }
-  const probeDeps = {
-    fetchImpl: fetch,
-    runCli: (binary, args) => runCliProbe(binary, args, { env: probeEnv }),
-    mcpProbe: async (target) => {
-      const cfg = readMcpHttpServerConfig(projectDir, target.serverKey, probeEnv);
-      if (!cfg) {
-        return { status: "transient_error", message: `MCP server '${target.serverKey}' not resolvable from .mcp.json` };
-      }
-      if (cfg.unresolved.length > 0) {
-        return {
-          status: "transient_error",
-          message: `MCP '${target.serverKey}' auth unresolved: ${cfg.unresolved.join(", ")}`
-        };
-      }
-      return probeMcpHttp(cfg);
-    },
-    // ENG-6139: connected-account binding check for managed (Composio) toolkits.
-    // The MCP handshake reads green on a dead/mis-bound account, so the managed
-    // probe also verifies the account is ACTIVE + bound to the entity the agent
-    // queries with. Inputs come from the agent's OWN wired MCP server: the
-    // `x-api-key` header and the `user_id` query param (the agent already
-    // authenticates with these), plus the recorded connected_account_id.
-    composioProbe: async (definitionId, credentials) => {
-      const serverKey = definitionId.replace(/[^a-z0-9]/gi, "_").toLowerCase();
-      const cfg = readMcpHttpServerConfig(projectDir, serverKey, probeEnv);
-      if (!cfg) {
-        return { status: "transient_error", message: `MCP server '${serverKey}' not resolvable from .mcp.json` };
-      }
-      if (cfg.unresolved.length > 0) {
-        return {
-          status: "transient_error",
-          message: `MCP '${serverKey}' auth unresolved: ${cfg.unresolved.join(", ")}`
-        };
-      }
-      const apiKey = cfg.headers?.["x-api-key"] ?? cfg.headers?.["X-API-Key"] ?? "";
-      let expectedUserId = "";
-      let serverId;
-      try {
-        const u = new URL(cfg.url);
-        expectedUserId = u.searchParams.get("user_id") ?? "";
-        const m = u.pathname.match(/\/v3\/mcp\/([^/]+)\/mcp/);
-        serverId = m?.[1] ? decodeURIComponent(m[1]) : void 0;
-      } catch {
-        expectedUserId = "";
-      }
-      const connectedAccountId = typeof credentials?.["connected_account_id"] === "string" ? credentials["connected_account_id"] : "";
-      return probeComposioAccount({ connectedAccountId, apiKey, expectedUserId, serverId });
-    },
-    // ENG-6157 (Phase 2): the live tool-call leg. Uses the agent's OWN wired MCP
-    // URL + headers (the exact path tool calls take), so a broken auth_config
-    // linkage surfaces as a real `No connected account found` instead of a
-    // green handshake. Skips (`null`) when no safe read-only tool is callable.
-    composioToolCallProbe: async (target) => {
-      const cfg = readMcpHttpServerConfig(projectDir, target.serverKey, probeEnv);
-      if (!cfg) return null;
-      if (cfg.unresolved.length > 0) return null;
-      return probeComposioMcpToolCall({
-        url: cfg.url,
-        headers: cfg.headers,
-        toolName: target.toolName,
-        toolArgs: target.toolArgs
-      });
-    }
-  };
+  const probeEnv = buildProbeEnv(projectDir);
+  const probeDeps = buildConnectivityProbeDeps(projectDir, probeEnv);
   const intervalSec = Number(process.env.AGT_CONNECTIVITY_PROBE_INTERVAL_SECONDS) || 3600;
   const result = await runConnectivityProbes(
     integrations.map((i) => {
@@ -6833,7 +6626,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.40" : "dev";
+var agtCliVersion = true ? "0.28.42" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7942,7 +7735,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-CFELQZI7.js");
+      const { collectDiagnostics } = await import("../persistent-session-PNY26VBX.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -8043,7 +7836,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-YOT3EKKN.js");
+      } = await import("../responsiveness-probe-4YMZ6LXO.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8075,7 +7868,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-YOT3EKKN.js");
+        } = await import("../responsiveness-probe-4YMZ6LXO.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -11479,7 +11272,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-LOL5YGXP.js");
+  } = await import("../claude-pair-runtime-YPTMIWJF.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -12366,7 +12159,6 @@ export {
   claudeCodeUpgradeMarkerPath,
   claudeCodeUpgradeThrottled,
   claudeManagedSettingsPath,
-  deriveMcpServerKey,
   ensureClaudeManagedSettings,
   extractCharterSlackPeers,
   extractCharterTelegramPeers,