@integrity-labs/agt-cli 0.28.452 → 0.28.454

package/dist/{claude-pair-runtime-RCH4LKDE.js → claude-pair-runtime-NRKOKQYR.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-7HZXY56P.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-X5N7UFEF.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-RCH4LKDE.js.map
+//# sourceMappingURL=claude-pair-runtime-NRKOKQYR.js.map

package/dist/lib/manager-worker.js

@@ -42,7 +42,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-WOZINHUT.js";
+} from "../chunk-23E2T5UT.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -53,6 +53,7 @@ import {
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
+  BIND_FAILURE_QUARANTINE_THRESHOLD,
   CLAUDE_MD_MAX_CHARS,
   CONVERSATION_FAILURE_CATEGORIES,
   DEFAULT_FRAMEWORK,
@@ -63,6 +64,9 @@ import {
   KANBAN_CHECK_COMMAND,
   KANBAN_NUDGE_ACTIONABLE_STATUSES,
   MAX_AVATAR_ENV_URL_BYTES,
+  MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING,
+  RESTART_BREAKER_PROVISIONING_MAX,
+  RESTART_BREAKER_PROVISIONING_WINDOW_MS,
   SCHEDULED_TURN_MARKER_FILENAME,
   SUPPRESS_SENTINEL,
   StreamEncoder,
@@ -160,7 +164,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-ESZRW7A3.js";
+} from "../chunk-3NJHNIO3.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -844,7 +848,13 @@ function reaperRestartBreakerReason(activeKeys) {
 var KNOWN_REASON_CLASS_MAP = {
   crash: true,
   provisioning: true,
-  "credential-rotation": true
+  "credential-rotation": true,
+  // ENG-8215: the self-healing class (bind-remediation - the manager's OWN
+  // repair attempts, which must never count toward a trip). Adding it here is
+  // forced by the Record type, which is exactly why that shape was chosen over
+  // a Set literal (ENG-7577, CodeRabbit on #3861) - a new union member cannot
+  // be silently omitted from the rehydration allowlist.
+  "self-healing": true
 };
 var KNOWN_REASON_CLASSES = new Set(
   Object.keys(KNOWN_REASON_CLASS_MAP)
@@ -852,7 +862,10 @@ var KNOWN_REASON_CLASSES = new Set(
 var PROVISIONING_RELOAD_REASONS = /* @__PURE__ */ new Set([
   "hot-reload-mcp",
   "managed-mcp-churn",
-  "bind-remediation",
+  // ENG-8215: 'bind-remediation' MOVED OUT of this set into SELF_HEALING_REASONS.
+  // It is the manager repairing itself, not a config reload, and counting it
+  // meant the harder the platform tried to fix an agent the more certain it
+  // became that it should give up. Deliberately NOT re-added here.
   // ENG-7576: the dashboard integration-add stop itself - the first restart of
   // the very burst this class exists for, previously uncounted entirely.
   "integration-change",
@@ -876,21 +889,35 @@ var CREDENTIAL_ROTATION_REASONS = /* @__PURE__ */ new Set([
 function isCredentialRotationReason(reason) {
   return CREDENTIAL_ROTATION_REASONS.has(reason);
 }
+var SELF_HEALING_REASONS = /* @__PURE__ */ new Set([
+  "bind-remediation"
+]);
+function isSelfHealingReason(reason) {
+  return SELF_HEALING_REASONS.has(reason);
+}
 function restartReasonClass(reason) {
   if (isCredentialRotationReason(reason)) return "credential-rotation";
+  if (isSelfHealingReason(reason)) return "self-healing";
   return isProvisioningReloadReason(reason) ? "provisioning" : "crash";
 }
 function countByClass(events) {
   let crash = 0;
   let provisioning = 0;
   let credentialRotation = 0;
+  let selfHealing = 0;
   for (const e of events) {
     const klass = restartReasonClass(e.reason);
     if (klass === "provisioning") provisioning += 1;
     else if (klass === "credential-rotation") credentialRotation += 1;
+    else if (klass === "self-healing") selfHealing += 1;
     else crash += 1;
   }
-  return { crash, provisioning, "credential-rotation": credentialRotation };
+  return {
+    crash,
+    provisioning,
+    "credential-rotation": credentialRotation,
+    "self-healing": selfHealing
+  };
 }
 function maxProvisioningBucket(events) {
   const buckets = /* @__PURE__ */ new Map();
@@ -912,8 +939,8 @@ function tripClass(trip) {
 }
 var DEFAULT_MAX = 2;
 var DEFAULT_WINDOW_MS = 6e5;
-var DEFAULT_PROVISIONING_MAX = 5;
-var DEFAULT_PROVISIONING_WINDOW_MS = 18e5;
+var DEFAULT_PROVISIONING_MAX = RESTART_BREAKER_PROVISIONING_MAX;
+var DEFAULT_PROVISIONING_WINDOW_MS = RESTART_BREAKER_PROVISIONING_WINDOW_MS;
 function readEnvNumber(name, fallback) {
   const raw = process.env[name];
   if (!raw) return fallback;
@@ -923,6 +950,11 @@ function readEnvNumber(name, fallback) {
 var RestartBreaker = class {
   max;
   windowMs;
+  /**
+   * ENG-8215: NOT readonly - the constructor may clamp it upward to preserve the
+   * quarantine-fires-first ordering against a runtime override. Never mutated
+   * after construction.
+   */
   provisioningMax;
   provisioningWindowMs;
   /** Longest window either tally needs — how long the events log must retain. */
@@ -930,6 +962,13 @@ var RestartBreaker = class {
   now;
   events = /* @__PURE__ */ new Map();
   trips = /* @__PURE__ */ new Map();
+  /**
+   * ENG-8215: set when a supplied `provisioningMax` was raised to keep MCP
+   * quarantine ahead of the breaker. Read once by the manager at construction so
+   * an overridden-and-clamped value is visible in manager.log rather than
+   * silently discarded.
+   */
+  quarantineOrderingClamped;
   constructor(opts = {}) {
     this.max = opts.max ?? readEnvNumber("AGT_RESTART_BREAKER_MAX", DEFAULT_MAX);
     this.windowMs = opts.windowMs ?? readEnvNumber("AGT_RESTART_BREAKER_WINDOW_MS", DEFAULT_WINDOW_MS);
@@ -945,11 +984,27 @@ var RestartBreaker = class {
     if (!Number.isFinite(this.provisioningMax) || this.provisioningMax < 1) {
       throw new Error("restart-breaker provisioningMax must be a finite number >= 1");
     }
+    if (this.provisioningMax < MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING) {
+      this.quarantineOrderingClamped = {
+        requested: this.provisioningMax,
+        applied: MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING,
+        quarantineThreshold: BIND_FAILURE_QUARANTINE_THRESHOLD
+      };
+      this.provisioningMax = MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING;
+    }
     if (!Number.isFinite(this.provisioningWindowMs) || this.provisioningWindowMs < 1e3) {
       throw new Error("restart-breaker provisioningWindowMs must be a finite number >= 1000");
     }
     this.retentionMs = Math.max(this.windowMs, this.provisioningWindowMs);
   }
+  /**
+   * ENG-8215: the clamp record, if the configured provisioning max had to be
+   * raised to keep MCP quarantine ahead of the breaker. `undefined` when the
+   * configured value already satisfied the ordering.
+   */
+  getQuarantineOrderingClamp() {
+    return this.quarantineOrderingClamped;
+  }
   /** True if this agent's breaker is currently tripped (manager must skip spawn). */
   isTripped(codeName) {
     return this.trips.has(codeName);
@@ -995,11 +1050,15 @@ var RestartBreaker = class {
     const credRotCount = prior.filter(
       (e) => e.at >= at - this.provisioningWindowMs && isCredentialRotationReason(e.reason)
     ).length;
+    const selfHealCount = prior.filter(
+      (e) => e.at >= at - this.provisioningWindowMs && isSelfHealingReason(e.reason)
+    ).length;
     const windowCount = prior.filter((e) => e.at >= at - this.windowMs).length;
     const classCounts = {
       crash: crashCount,
       provisioning: provEvents.length,
-      "credential-rotation": credRotCount
+      "credential-rotation": credRotCount,
+      "self-healing": selfHealCount
     };
     const provBucket = maxProvisioningBucket(provEvents);
     let trippedClass;
@@ -8863,9 +8922,17 @@ var pendingSessionRestarts = /* @__PURE__ */ new Map();
 var lastRestartWasExternal = /* @__PURE__ */ new Map();
 var pendingRestartVerifications = /* @__PURE__ */ new Map();
 var restartBreaker = new RestartBreaker();
+{
+  const clamp = restartBreaker.getQuarantineOrderingClamp();
+  if (clamp) {
+    log(
+      `[circuit-breaker] provisioningMax=${clamp.requested} would trip before MCP quarantine (threshold=${clamp.quarantineThreshold}); raised to ${clamp.applied} so a failing integration is isolated before the whole agent is paused (ENG-8215)`
+    );
+  }
+}
 var reportedTrips = /* @__PURE__ */ new Map();
-var RESTART_BREAKER_PROVISIONING_MAX = readEnvNumber("AGT_RESTART_BREAKER_PROVISIONING_MAX", 5);
-var RESTART_BREAKER_PROVISIONING_WINDOW_MS = readEnvNumber(
+var RESTART_BREAKER_PROVISIONING_MAX2 = readEnvNumber("AGT_RESTART_BREAKER_PROVISIONING_MAX", 5);
+var RESTART_BREAKER_PROVISIONING_WINDOW_MS2 = readEnvNumber(
   "AGT_RESTART_BREAKER_PROVISIONING_WINDOW_MS",
   18e5
 );
@@ -8910,13 +8977,13 @@ function recordRestartForBreaker(codeName, reason) {
   let integrationKey;
   if (isProvisioningReloadReason(reason)) {
     const attribution = agentState.provisioningAttribution.get(codeName);
-    if (attribution && Date.now() - attribution.at <= RESTART_BREAKER_PROVISIONING_WINDOW_MS) {
+    if (attribution && Date.now() - attribution.at <= RESTART_BREAKER_PROVISIONING_WINDOW_MS2) {
       integrationKey = attribution.key;
     }
   }
   const result = restartBreaker.record(codeName, reason, integrationKey);
   if (!result.tripped || !result.trip) {
-    if (isProvisioningReloadReason(reason) && result.maxProvisioningBucket >= RESTART_BREAKER_PROVISIONING_MAX) {
+    if (isProvisioningReloadReason(reason) && result.maxProvisioningBucket >= RESTART_BREAKER_PROVISIONING_MAX2) {
       const culprit = result.maxProvisioningBucketKey ? ` [${result.maxProvisioningBucketKey}]` : "";
       log(
         `[restart-breaker] agent=${codeName} provisioning-reload churn at the trip bar: ${result.maxProvisioningBucket} restarts for one integration${culprit} in window (reason=${reason}); one more will auto-pause the agent; that integration is likely churning (ENG-7560, ENG-7812)`
@@ -9882,7 +9949,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.452" : "dev";
+var agtCliVersion = true ? "0.28.454" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11043,7 +11110,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-7HZXY56P.js");
+      const { collectDiagnostics } = await import("../persistent-session-X5N7UFEF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11150,7 +11217,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-7HZXY56P.js");
+      const { collectDiagnostics } = await import("../persistent-session-X5N7UFEF.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11264,7 +11331,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-AIA7ZEBW.js");
+      } = await import("../responsiveness-probe-OAZ55KPC.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11328,7 +11395,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-AIA7ZEBW.js");
+        } = await import("../responsiveness-probe-OAZ55KPC.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14700,7 +14767,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-7HZXY56P.js");
+        const { collectDiagnostics } = await import("../persistent-session-X5N7UFEF.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -14750,7 +14817,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-7HZXY56P.js");
+      const { collectDiagnostics } = await import("../persistent-session-X5N7UFEF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15203,7 +15270,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-RCH4LKDE.js");
+  } = await import("../claude-pair-runtime-NRKOKQYR.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));