@integrity-labs/agt-cli 0.28.472 → 0.28.474

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-KCU4ZTE4.js";
+} from "../chunk-C47UJ5QI.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.472" : "dev";
+var cliVersion = true ? "0.28.474" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.472" : "dev";
+var cliVersion2 = true ? "0.28.474" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-KCU4ZTE4.js → chunk-C47UJ5QI.js}

@@ -4932,7 +4932,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.472" : "dev";
+var agtCliVersion = true ? "0.28.474" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7661,4 +7661,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-KCU4ZTE4.js.map
+//# sourceMappingURL=chunk-C47UJ5QI.js.map

package/dist/lib/manager-worker.js

@@ -44,7 +44,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-KCU4ZTE4.js";
+} from "../chunk-C47UJ5QI.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -2576,6 +2576,59 @@ async function getClaudeAccountFingerprint(paths, nowMs = Date.now()) {
   return lastKnownFingerprint;
 }
 
+// src/lib/auth-tuple-diff.ts
+var ABSENT2 = "none";
+var COMPONENT_ORDER = [
+  "auth_mode",
+  "anthropic_api_key_fingerprint",
+  "claude_account_fingerprint",
+  "openrouter_fingerprint"
+];
+function parseAuthTuple(tuple) {
+  const raw = typeof tuple === "string" ? tuple : "";
+  if (raw.startsWith("openrouter:")) {
+    return {
+      auth_mode: "openrouter",
+      openrouter_fingerprint: raw.slice("openrouter:".length) || ABSENT2
+    };
+  }
+  const parts = raw.split(":");
+  if (parts.length < 2) {
+    return { auth_mode: raw || ABSENT2 };
+  }
+  return {
+    auth_mode: parts[0] || ABSENT2,
+    anthropic_api_key_fingerprint: parts[1] || ABSENT2,
+    // Omitted from the string when there is no signed-in account fingerprint
+    // (api_key mode, or subscription mode before the first successful read).
+    // Recorded as the ABSENT sentinel so "account appeared" / "account
+    // disappeared" is itself visible as a change.
+    claude_account_fingerprint: parts[2] || ABSENT2
+  };
+}
+function diffAuthTuples(recorded, current) {
+  const before = parseAuthTuple(recorded);
+  const after = parseAuthTuple(current);
+  const names = [
+    ...COMPONENT_ORDER.filter((n) => n in before || n in after),
+    // Anything unexpected (a tuple shape a newer manager introduced) still gets
+    // reported rather than dropped — this path must never hide a change.
+    ...Object.keys({ ...before, ...after }).filter((n) => !COMPONENT_ORDER.includes(n)).sort()
+  ];
+  const components = names.map((component) => {
+    const from = before[component] ?? ABSENT2;
+    const to = after[component] ?? ABSENT2;
+    return { component, changed: from !== to, from, to };
+  });
+  const changed = components.filter((c) => c.changed).map((c) => c.component);
+  const unchanged = components.filter((c) => !c.changed).map((c) => c.component);
+  const summary = changed.length === 0 ? "auth-tuple-change: no component differs (tuple string re-formatted)" : `auth-tuple-change: ${changed.map((name) => {
+    const c = components.find((x) => x.component === name);
+    return `${name} ${c.from}\u2192${c.to}`;
+  }).join(", ")}${unchanged.length > 0 ? ` (unchanged: ${unchanged.join(", ")})` : ""}`;
+  return { changed, unchanged, components, summary };
+}
+
 // src/lib/account-enforcement-marker.ts
 import { mkdirSync as mkdirSync5, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir6 } from "os";
@@ -9818,7 +9871,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   }
   return result != null;
 }
-function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason, gateReason = breakerReason, runClose) {
+function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason, gateReason = breakerReason, runClose, auditDetail) {
   const gate = restartGateFor(codeName, gateReason);
   if (gate !== "bypass" && gate !== "proceed") {
     log(`[maintenance-window] Deferring '${gateReason}' restart for '${codeName}' (${gate})`);
@@ -9844,7 +9897,10 @@ function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason, gate
       void api.post("/host/restart-event", {
         agent_id: restartAgentId,
         source: breakerReason,
-        reason: breakerReason
+        // ENG-8293: fall back to the source string (the pre-ENG-8293 shape)
+        // only when the caller supplied nothing better.
+        reason: auditDetail?.reason ?? breakerReason,
+        ...auditDetail?.detail ? { detail: auditDetail.detail } : {}
       }).catch((err) => log(`[restart-event] report failed for '${codeName}': ${err.message}`));
     }
   }
@@ -10038,7 +10094,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.472" : "dev";
+var agtCliVersion = true ? "0.28.474" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -10995,6 +11051,8 @@ function loadChannelHashCache2() {
 function saveChannelHashCache2() {
   saveChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
 }
+var channelWriteFailureCounts = /* @__PURE__ */ new Map();
+var CHANNEL_WRITE_FAILURE_ESCALATE_EVERY = 90;
 var persistedDeliveryBaseline = createDeliveryBaselineMaps();
 function loadSenderPolicyBaseline2() {
   loadSenderPolicyBaseline(persistedDeliveryBaseline, channelHashCacheDir(), log);
@@ -12660,9 +12718,24 @@ async function processAgent(agent, agentStates) {
                 agentAvatarUrl
               }
             );
-            agentState.knownChannelConfigHashes.set(cacheKey, configHash);
-            saveChannelHashCache2();
-            log(`Channel credentials written for '${agent.code_name}/${channelId}' (reason=${reason}, hash=${configHash.slice(0, 8)}${prevHash ? `, prev=${prevHash.slice(0, 8)}` : ""})`);
+            const landed = frameworkAdapter.hasChannelCredentials?.(agent.code_name, channelId) ?? true;
+            if (!landed) {
+              channelConfigConverged = false;
+              const attempts = (channelWriteFailureCounts.get(cacheKey) ?? 0) + 1;
+              channelWriteFailureCounts.set(cacheKey, attempts);
+              if (attempts === 1 || attempts % CHANNEL_WRITE_FAILURE_ESCALATE_EVERY === 0) {
+                log(
+                  `ERROR: channel credentials for '${agent.code_name}/${channelId}' did NOT land on disk after a write that reported no error (reason=${reason}, attempt ${attempts}). The write was silently skipped \u2014 likely a missing credential field, or the guarded .mcp.json write was rejected by the secret lint / config validator (its reason is printed once per fingerprint on stderr). The channel will stay unusable until this is resolved; not re-logging every cycle.`
+                );
+              }
+            } else {
+              if (channelWriteFailureCounts.delete(cacheKey)) {
+                log(`Channel credentials for '${agent.code_name}/${channelId}' landed on disk after ${reason} \u2014 recovered.`);
+              }
+              agentState.knownChannelConfigHashes.set(cacheKey, configHash);
+              saveChannelHashCache2();
+              log(`Channel credentials written for '${agent.code_name}/${channelId}' (reason=${reason}, hash=${configHash.slice(0, 8)}${prevHash ? `, prev=${prevHash.slice(0, 8)}` : ""})`);
+            }
           } catch (err) {
             channelConfigConverged = false;
             log(`Failed to write channel credentials for '${agent.code_name}/${channelId}': ${err.message}`);
@@ -14483,8 +14556,20 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const currentAuthTuple = openRouterForAgent ? `openrouter:${openRouterForAgent.fingerprint ?? openRouterForAgent.model}` : `${claudeAuthMode}:${anthropicApiKeyFingerprint ?? "none"}${claudeAccountFingerprint ? `:${claudeAccountFingerprint}` : ""}`;
   const recordedAuthTuple = claudeAuthTupleBySession.get(codeName);
   if (recordedAuthTuple && recordedAuthTuple !== currentAuthTuple && isSessionHealthy(codeName)) {
-    log(`[persistent-session] Auth config changed for '${codeName}' (${recordedAuthTuple} \u2192 ${currentAuthTuple}) \u2014 restarting session`);
-    stopPersistentSessionAndForgetMcpBaseline(codeName, "auth-tuple-change");
+    const authTupleDiff = diffAuthTuples(recordedAuthTuple, currentAuthTuple);
+    log(
+      `[persistent-session] Auth config changed for '${codeName}' (${recordedAuthTuple} \u2192 ${currentAuthTuple}) \u2014 ${authTupleDiff.summary} \u2014 restarting session`
+    );
+    stopPersistentSessionAndForgetMcpBaseline(codeName, "auth-tuple-change", void 0, void 0, {
+      reason: authTupleDiff.summary,
+      detail: {
+        auth_tuple: {
+          changed: authTupleDiff.changed,
+          unchanged: authTupleDiff.unchanged,
+          components: authTupleDiff.components
+        }
+      }
+    });
     agentState.persistentSessionAgents.delete(codeName);
     restartTrigger = "auth-tuple";
   }