@integrity-labs/agt-cli 0.28.489 → 0.28.491

package/dist/lib/manager-worker.js

@@ -44,7 +44,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-46GY6S7I.js";
+} from "../chunk-HA46Z4D6.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -1825,7 +1825,29 @@ var GATEABLE_RESTART_REASONS = /* @__PURE__ */ new Set([
   "mcp-presence-reaper",
   // ENG-7949: same gate-but-window-exempt shape as 'mcp-presence-reaper' — see
   // WINDOW_EXEMPT_RESTART_REASONS below for why this one skips the window too.
-  "channel-mcp-down"
+  "channel-mcp-down",
+  // ENG-8343: a value-only credential RE-MINT (canonically the GitHub App
+  // installation token, ~1h TTL) rewrites GITHUB_ACCESS_TOKEN/GITHUB_TOKEN, and
+  // the ENG-7510 env-only path stops the session to deliver it. Absent from this
+  // allowlist it hit the fail-open default above and bypassed BOTH axes, so the
+  // stop landed ~3ms after the schedule — unconditionally, mid-turn, roughly once
+  // an hour per affected agent (6 agents / ~144 kills a day at time of filing).
+  //
+  // This absence was an oversight, NOT a decision: ENG-7541 introduced the reason
+  // for the breaker and nobody added it here. The call site in manager-worker.ts
+  // documented the opposite ("defers until idle (never mid-turn) ... safe on a
+  // busy agent"), which is why the gap survived ENG-7541, ENG-7737 and ENG-8264
+  // without anyone catching it. Contrast 'integration-change' and 'hot-reload-mcp'
+  // above, whose absence IS deliberate and is documented as such.
+  //
+  // Deliberately NOT given an idle-escalation ceiling like the window axis has
+  // (ENG-8224). A repair that can never fire is worse than interrupting a turn
+  // when the thing being repaired is a dead channel or a dead toolkit; a rotated
+  // credential is not that. The worst case here is an agent that stays busy past
+  // the outgoing token's expiry and sees 401s on `gh`/`git` until its next quiet
+  // gap, which is strictly cheaper than destroying the turn. Do not "fix" this by
+  // forcing the restart through on a deadline.
+  "credential-rotation"
 ]);
 function isGateableRestartReason(reason) {
   return reason != null && GATEABLE_RESTART_REASONS.has(reason);
@@ -1833,7 +1855,8 @@ function isGateableRestartReason(reason) {
 var WINDOW_EXEMPT_RESTART_REASONS = /* @__PURE__ */ new Set([
   "channel-set-change",
   "sender-policy-change",
-  "channel-mcp-down"
+  "channel-mcp-down",
+  "credential-rotation"
 ]);
 var RESTART_WINDOW_DEFER_ESCALATE_AFTER = 20;
 function shouldRelaxRestartWindowGate(deferStreak) {
@@ -9344,12 +9367,16 @@ function restartReasonBindsNewMcp(breakerReason) {
   // hit this predicate. Including it arms the ENG-6174 respawn verification for
   // the ONE real respawn of an integration add.
   breakerReason === "integration-change" || // ENG-7541: a 'credential-rotation' respawn IS the env-only re-mint path
-  // (ENG-7510), just tagged with a non-tripping breaker class. It must behave
-  // IDENTICALLY to 'hot-reload-mcp' for respawn timing + verification — come
-  // back immediately so the agent picks up the fresh credential, and arm the
+  // (ENG-7510), just tagged with a non-tripping breaker class. Once its stop
+  // fires it must behave IDENTICALLY to 'hot-reload-mcp' — come back
+  // immediately so the agent picks up the fresh credential, and arm the
   // ENG-6174 respawn verification (the unchanged MCP set re-binds normally, so
-  // verification passes). The ONLY thing that differs from 'hot-reload-mcp' is
-  // the breaker tally it lands on.
+  // verification passes).
+  // ENG-8343 scope note: "immediately" here is POST-STOP respawn timing only.
+  // WHEN the stop itself fires is now gated (defer-until-idle, window-exempt) —
+  // exactly the combination 'channel-set-change' above already has: gated at
+  // the stop, immediate on the way back. Do not read this predicate as a claim
+  // that the stop is ungated.
   breakerReason === "credential-rotation";
 }
 function dashboardRestartBreakerReason(restartReason) {
@@ -10079,7 +10106,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.489" : "dev";
+var agtCliVersion = true ? "0.28.491" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();