@integrity-labs/agt-cli 0.28.467 → 0.28.468

package/dist/lib/manager-worker.js

@@ -16,6 +16,7 @@ import {
   diffEnvIntegrations,
   envOnlyRespawnVars,
   exchangeApiKey,
+  exchangeFailureKind,
   executeConnectivityProbe,
   extractCommandNotFound,
   findMcpServersUsingVars,
@@ -24,6 +25,7 @@ import {
   getCachedClaudeAuthMode,
   getHostId,
   givenUpMcpServerKeys,
+  isTransientAuthFailure,
   liveProxyExtraHeaderVars,
   liveProxyTokenVars,
   pinAllowsUrgent,
@@ -42,7 +44,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-P5NFIZI4.js";
+} from "../chunk-Y2XU2XWM.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -2014,6 +2016,30 @@ function isDirectChatMessageExpired(createdAt, nowMs, maxAgeMs) {
   return nowMs - created > maxAgeMs;
 }
 
+// src/lib/manager/auth-resolve-decision.ts
+function decideAuthResolveFailureAction(args) {
+  const transient = isTransientAuthFailure(args.error);
+  if (!args.sessionHealthy) {
+    return {
+      action: "skip-spawn",
+      transient,
+      reason: transient ? "transient-fault-no-session" : "auth-verdict-no-session"
+    };
+  }
+  if (transient) {
+    return {
+      action: "preserve-session",
+      transient,
+      reason: "transient-fault-session-preserved"
+    };
+  }
+  return {
+    action: "stop-session",
+    transient,
+    reason: "auth-verdict-session-stopped"
+  };
+}
+
 // ../../packages/core/dist/host-config/capture.js
 import { createHash as createHash5 } from "crypto";
 var NON_SECRET_ENV_GATES = [
@@ -5370,20 +5396,54 @@ async function startRun(opts) {
     return { run_id: null, kanban_item_id: null };
   }
 }
+var DEFAULT_FINISH_RETRY_ATTEMPTS = 3;
+var DEFAULT_FINISH_RETRY_BASE_MS = 1e3;
+function finishRetryAttempts() {
+  const raw = process.env["AGT_RUNS_FINISH_RETRY_ATTEMPTS"];
+  const parsed = raw ? parseInt(raw, 10) : NaN;
+  if (Number.isFinite(parsed) && parsed >= 0) return Math.min(parsed, 6);
+  return DEFAULT_FINISH_RETRY_ATTEMPTS;
+}
+function finishRetryBaseMs() {
+  const raw = process.env["AGT_RUNS_FINISH_RETRY_BASE_MS"];
+  const parsed = raw ? parseInt(raw, 10) : NaN;
+  if (Number.isFinite(parsed) && parsed > 0) return Math.min(parsed, 3e4);
+  return DEFAULT_FINISH_RETRY_BASE_MS;
+}
+function isRetryableFinishError(err) {
+  if (err instanceof ApiError) return err.status >= 500 || err.status === 429;
+  return true;
+}
 async function finishRun(runId, outcome, options = {}) {
-  try {
-    await api.post("/host/runs/finish", {
-      run_id: runId,
-      outcome,
-      outcome_message: options.outcomeMessage,
-      metadata: options.metadata,
-      complete_kanban_item_id: options.completeKanbanItemId ?? void 0,
-      result: options.result
-    });
-  } catch (err) {
-    const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash9("sha256").update(errText).digest("hex").slice(0, 12);
-    log(`[runs] finish failed for run_id=${runId} outcome=${outcome} error_id=${errId}`);
+  const maxRetries = finishRetryAttempts();
+  const baseMs = finishRetryBaseMs();
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      await api.post("/host/runs/finish", {
+        run_id: runId,
+        outcome,
+        outcome_message: options.outcomeMessage,
+        metadata: options.metadata,
+        complete_kanban_item_id: options.completeKanbanItemId ?? void 0,
+        result: options.result
+      });
+      return;
+    } catch (err) {
+      const errText = err instanceof Error ? err.message : String(err);
+      const errId = createHash9("sha256").update(errText).digest("hex").slice(0, 12);
+      const status = err instanceof ApiError ? err.status : 0;
+      if (isRetryableFinishError(err) && attempt < maxRetries) {
+        log(
+          `[runs] finish attempt ${attempt + 1}/${maxRetries + 1} failed for run_id=${runId} outcome=${outcome} status=${status} error_id=${errId} \u2014 retrying`
+        );
+        await new Promise((resolve) => setTimeout(resolve, baseMs * 2 ** attempt));
+        continue;
+      }
+      log(
+        `[runs] finish failed for run_id=${runId} outcome=${outcome} status=${status} error_id=${errId} attempts=${attempt + 1} \u2014 run row left unclosed`
+      );
+      return;
+    }
   }
 }
 var MAX_PRIOR_RUNS = 5;
@@ -9758,7 +9818,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   }
   return result != null;
 }
-function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason, gateReason = breakerReason) {
+function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason, gateReason = breakerReason, runClose) {
   const gate = restartGateFor(codeName, gateReason);
   if (gate !== "bypass" && gate !== "proceed") {
     log(`[maintenance-window] Deferring '${gateReason}' restart for '${codeName}' (${gate})`);
@@ -9771,8 +9831,10 @@ function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason, gate
   runningMcpServerKeys.delete(codeName);
   runningChannelSecretHashes.delete(codeName);
   sessionLaunchManagedStructure.delete(codeName);
-  closeInjectedRunIfOpen(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
-  closeScheduledRunsForCode(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
+  const runOutcome = runClose?.outcome ?? "cancelled";
+  const runMessage = runClose ? `session stopped (${runClose.message})` : `session stopped (${breakerReason ?? "deprovision"})`;
+  closeInjectedRunIfOpen(codeName, runOutcome, runMessage);
+  closeScheduledRunsForCode(codeName, runOutcome, runMessage);
   if (breakerReason) {
     recordRestartForBreaker(codeName, breakerReason);
   }
@@ -9976,7 +10038,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.467" : "dev";
+var agtCliVersion = true ? "0.28.468" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -14340,9 +14402,38 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     anthropicApiKeyFingerprint = exchange.anthropicApiKeyFingerprint;
   } catch (err) {
     const msg = err.message;
+    const healthyBefore = isSessionHealthy(codeName);
+    const authFailure = decideAuthResolveFailureAction({ error: err, sessionHealthy: healthyBefore });
+    const kind = exchangeFailureKind(err);
+    if (authFailure.action === "preserve-session") {
+      log(
+        `[persistent-session] Failed to resolve auth for '${codeName}': ${msg} \u2014 transient (${kind}), leaving the healthy session running; retrying next poll`
+      );
+      const healthyAfter = isSessionHealthy(codeName);
+      if (healthyAfter) {
+        return {
+          decision: "skipped-auth-resolve-transient",
+          spawnAttempted: false,
+          sessionHealthyAfter: true,
+          detail: `${authFailure.reason} (${kind}): ${msg}`
+        };
+      }
+      log(
+        `[persistent-session] '${codeName}' session did NOT survive the transient auth failure (${kind}) \u2014 reporting as a skip, next poll respawns`
+      );
+      return {
+        decision: "skipped-auth-resolve-failed",
+        spawnAttempted: false,
+        sessionHealthyAfter: false,
+        detail: `transient-fault-session-lost (${kind}): ${msg}`
+      };
+    }
     log(`[persistent-session] Failed to resolve auth for '${codeName}': ${msg} \u2014 refusing to spawn`);
-    if (isSessionHealthy(codeName)) {
-      stopPersistentSessionAndForgetMcpBaseline(codeName);
+    if (authFailure.action === "stop-session") {
+      stopPersistentSessionAndForgetMcpBaseline(codeName, void 0, void 0, {
+        outcome: "failed",
+        message: `auth resolve failed (${kind})`
+      });
       agentState.persistentSessionAgents.delete(codeName);
       claudeAuthTupleBySession.delete(codeName);
     }
@@ -14350,7 +14441,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       decision: "skipped-auth-resolve-failed",
       spawnAttempted: false,
       sessionHealthyAfter: isSessionHealthy(codeName),
-      detail: msg
+      detail: `${authFailure.reason} (${kind}): ${msg}`
     };
   }
   if (claudeAuthMode === "openrouter" || openRouterForAgent) {