@integrity-labs/agt-cli 0.28.488 → 0.28.490

package/dist/{claude-pair-runtime-FEVTBAHV.js → claude-pair-runtime-GJF64TMZ.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-3LWKJAAP.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-Y3WIXJPW.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-FEVTBAHV.js.map
+//# sourceMappingURL=claude-pair-runtime-GJF64TMZ.js.map

package/dist/lib/manager-worker.js

@@ -44,7 +44,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-PMDCZKFQ.js";
+} from "../chunk-DNRXJESD.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -162,7 +162,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-XZI5IHQP.js";
+} from "../chunk-34E3FHOS.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -1825,7 +1825,29 @@ var GATEABLE_RESTART_REASONS = /* @__PURE__ */ new Set([
   "mcp-presence-reaper",
   // ENG-7949: same gate-but-window-exempt shape as 'mcp-presence-reaper' — see
   // WINDOW_EXEMPT_RESTART_REASONS below for why this one skips the window too.
-  "channel-mcp-down"
+  "channel-mcp-down",
+  // ENG-8343: a value-only credential RE-MINT (canonically the GitHub App
+  // installation token, ~1h TTL) rewrites GITHUB_ACCESS_TOKEN/GITHUB_TOKEN, and
+  // the ENG-7510 env-only path stops the session to deliver it. Absent from this
+  // allowlist it hit the fail-open default above and bypassed BOTH axes, so the
+  // stop landed ~3ms after the schedule — unconditionally, mid-turn, roughly once
+  // an hour per affected agent (6 agents / ~144 kills a day at time of filing).
+  //
+  // This absence was an oversight, NOT a decision: ENG-7541 introduced the reason
+  // for the breaker and nobody added it here. The call site in manager-worker.ts
+  // documented the opposite ("defers until idle (never mid-turn) ... safe on a
+  // busy agent"), which is why the gap survived ENG-7541, ENG-7737 and ENG-8264
+  // without anyone catching it. Contrast 'integration-change' and 'hot-reload-mcp'
+  // above, whose absence IS deliberate and is documented as such.
+  //
+  // Deliberately NOT given an idle-escalation ceiling like the window axis has
+  // (ENG-8224). A repair that can never fire is worse than interrupting a turn
+  // when the thing being repaired is a dead channel or a dead toolkit; a rotated
+  // credential is not that. The worst case here is an agent that stays busy past
+  // the outgoing token's expiry and sees 401s on `gh`/`git` until its next quiet
+  // gap, which is strictly cheaper than destroying the turn. Do not "fix" this by
+  // forcing the restart through on a deadline.
+  "credential-rotation"
 ]);
 function isGateableRestartReason(reason) {
   return reason != null && GATEABLE_RESTART_REASONS.has(reason);
@@ -1833,7 +1855,8 @@ function isGateableRestartReason(reason) {
 var WINDOW_EXEMPT_RESTART_REASONS = /* @__PURE__ */ new Set([
   "channel-set-change",
   "sender-policy-change",
-  "channel-mcp-down"
+  "channel-mcp-down",
+  "credential-rotation"
 ]);
 var RESTART_WINDOW_DEFER_ESCALATE_AFTER = 20;
 function shouldRelaxRestartWindowGate(deferStreak) {
@@ -9344,12 +9367,16 @@ function restartReasonBindsNewMcp(breakerReason) {
   // hit this predicate. Including it arms the ENG-6174 respawn verification for
   // the ONE real respawn of an integration add.
   breakerReason === "integration-change" || // ENG-7541: a 'credential-rotation' respawn IS the env-only re-mint path
-  // (ENG-7510), just tagged with a non-tripping breaker class. It must behave
-  // IDENTICALLY to 'hot-reload-mcp' for respawn timing + verification — come
-  // back immediately so the agent picks up the fresh credential, and arm the
+  // (ENG-7510), just tagged with a non-tripping breaker class. Once its stop
+  // fires it must behave IDENTICALLY to 'hot-reload-mcp' — come back
+  // immediately so the agent picks up the fresh credential, and arm the
   // ENG-6174 respawn verification (the unchanged MCP set re-binds normally, so
-  // verification passes). The ONLY thing that differs from 'hot-reload-mcp' is
-  // the breaker tally it lands on.
+  // verification passes).
+  // ENG-8343 scope note: "immediately" here is POST-STOP respawn timing only.
+  // WHEN the stop itself fires is now gated (defer-until-idle, window-exempt) —
+  // exactly the combination 'channel-set-change' above already has: gated at
+  // the stop, immediate on the way back. Do not read this predicate as a claim
+  // that the stop is ungated.
   breakerReason === "credential-rotation";
 }
 function dashboardRestartBreakerReason(restartReason) {
@@ -10079,7 +10106,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.488" : "dev";
+var agtCliVersion = true ? "0.28.490" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11242,7 +11269,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-3LWKJAAP.js");
+      const { collectDiagnostics } = await import("../persistent-session-Y3WIXJPW.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11349,7 +11376,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-3LWKJAAP.js");
+      const { collectDiagnostics } = await import("../persistent-session-Y3WIXJPW.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11463,7 +11490,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-AAVWTFJN.js");
+      } = await import("../responsiveness-probe-AEFEFKOQ.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11527,7 +11554,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-AAVWTFJN.js");
+        } = await import("../responsiveness-probe-AEFEFKOQ.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15009,7 +15036,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-3LWKJAAP.js");
+        const { collectDiagnostics } = await import("../persistent-session-Y3WIXJPW.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15059,7 +15086,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-3LWKJAAP.js");
+      const { collectDiagnostics } = await import("../persistent-session-Y3WIXJPW.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15517,7 +15544,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-FEVTBAHV.js");
+  } = await import("../claude-pair-runtime-GJF64TMZ.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));