@integrity-labs/agt-cli 0.28.503 → 0.28.504

package/dist/{claude-pair-runtime-JEMJAZPB.js → claude-pair-runtime-E3KMHKQQ.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-4PVEGHA5.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-AB4SAH5B.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-JEMJAZPB.js.map
+//# sourceMappingURL=claude-pair-runtime-E3KMHKQQ.js.map

package/dist/lib/manager-worker.js

@@ -52,7 +52,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-GR375XXG.js";
+} from "../chunk-GXEXHVNW.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -172,7 +172,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-GBSMIV4P.js";
+} from "../chunk-HEUDF73X.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -3665,13 +3665,34 @@ function bundleFingerprint(files) {
 
 // src/lib/channel-config-hash.ts
 import { createHash as createHash7 } from "crypto";
+var DERIVED_PRINCIPAL_ID_LIST_KEYS = [
+  "allowed_users",
+  "diagnostic_chat_ids",
+  "ping_allowed_users",
+  "ping_allowed_chat_ids"
+];
+function normalizeChannelConfigForHash(config2) {
+  if (config2 === null || typeof config2 !== "object" || Array.isArray(config2)) return config2;
+  const src = config2;
+  let normalized = null;
+  for (const key of DERIVED_PRINCIPAL_ID_LIST_KEYS) {
+    const list = src[key];
+    if (!Array.isArray(list)) continue;
+    normalized ??= { ...src };
+    normalized[key] = [...list].sort();
+  }
+  return normalized ?? config2;
+}
 var CHANNEL_WRITE_VERSION = 9;
 function computeChannelConfigHash(input) {
   return createHash7("sha256").update(
     canonicalJson({
       writeVersion: CHANNEL_WRITE_VERSION,
       cliVersion: input.cliVersion,
-      config: input.config,
+      // ENG-8399: value-blind on the server-derived principal id SETS so a
+      // reorder of the same principals can't oscillate this hash into a
+      // false rewrite (and, downstream, a session respawn).
+      config: normalizeChannelConfigForHash(input.config),
       team: input.team,
       peers: input.peers,
       sessionMode: input.sessionMode ?? null,
@@ -8902,7 +8923,7 @@ function hasRevokedResiduals(state7) {
 var pendingSessionRestarts = /* @__PURE__ */ new Map();
 var lastRestartWasExternal = /* @__PURE__ */ new Map();
 var pendingRestartVerifications = /* @__PURE__ */ new Map();
-var restartBreaker = new RestartBreaker();
+var restartBreaker = new RestartBreaker({ runtimeKey: (codeName) => agentRuntimeKey(codeName) });
 {
   const clamp = restartBreaker.getQuarantineOrderingClamp();
   if (clamp) {
@@ -9015,9 +9036,9 @@ function maybeClearStaleTrip(agent) {
   log(
     `[circuit-breaker] agent=${codeName} cleared STALE trip \u2014 authoritative status=active while a trip was held (age=${Math.round(decision.ageMs / 6e4)}min, trippedAt=${new Date(trip.trippedAt).toISOString()}); the pause this trip caused is no longer in force (ENG-7577)`
   );
-  const marker = autoResumeMarkers.get(codeName);
+  const marker = getAutoResumeMarker(codeName);
   const isSelfResume = marker !== void 0 && Date.now() - marker.autoResumedAt < AUTO_RESUME_SELF_WINDOW_MS;
-  if (!isSelfResume) autoResumeMarkers.delete(codeName);
+  if (!isSelfResume) deleteAutoResumeMarker(codeName);
   state6 = {
     ...state6,
     circuitBreakerTrips: restartBreaker.serialize(),
@@ -9026,6 +9047,30 @@ function maybeClearStaleTrip(agent) {
   send({ type: "state-update", state: state6 });
 }
 var autoResumeMarkers = /* @__PURE__ */ new Map();
+function autoResumeMarkerKey(codeName) {
+  return agentRuntimeKey(codeName);
+}
+function getAutoResumeMarker(codeName) {
+  const key = autoResumeMarkerKey(codeName);
+  const hit = autoResumeMarkers.get(key);
+  if (hit || key === codeName) return hit;
+  const legacy = autoResumeMarkers.get(codeName);
+  if (!legacy) return void 0;
+  autoResumeMarkers.delete(codeName);
+  autoResumeMarkers.set(key, legacy);
+  return legacy;
+}
+function setAutoResumeMarker(codeName, rec) {
+  const key = autoResumeMarkerKey(codeName);
+  if (key !== codeName) autoResumeMarkers.delete(codeName);
+  autoResumeMarkers.set(key, rec);
+}
+function deleteAutoResumeMarker(codeName) {
+  const key = autoResumeMarkerKey(codeName);
+  let removed = autoResumeMarkers.delete(key);
+  if (key !== codeName && autoResumeMarkers.delete(codeName)) removed = true;
+  return removed;
+}
 var autoResumeInFlight = /* @__PURE__ */ new Set();
 var AUTO_RESUME_SELF_WINDOW_MS = 12e4;
 var autoResumeLoggedSkips = /* @__PURE__ */ new Map();
@@ -9046,7 +9091,7 @@ function maybeAutoResume(agent) {
   if (trip && autoResumeStandDowns.has(`${codeName}:${trip.trippedAt}`)) return;
   const decision = decideAutoResume({
     trip,
-    marker: autoResumeMarkers.get(codeName),
+    marker: getAutoResumeMarker(codeName),
     config: readAutoResumeConfig(),
     now: Date.now()
   });
@@ -9073,7 +9118,7 @@ function maybeAutoResume(agent) {
   }).then((res) => {
     autoResumeInFlight.delete(codeName);
     if (res.resumed) {
-      autoResumeMarkers.set(codeName, { trippedAt, autoResumedAt: Date.now() });
+      setAutoResumeMarker(codeName, { trippedAt, autoResumedAt: Date.now() });
       restartBreaker.clear(codeName);
       reportedTrips.delete(codeName);
       dependencyRecoveryLedger.clear(codeName);
@@ -9150,7 +9195,7 @@ async function maybeResumeReconcile(agent) {
     const mcpPresent = deriveMcpPresent(declaredKeys, givenUpMcpServerKeys(codeName));
     const decision = decideResumeReconcile({
       trip,
-      marker: autoResumeMarkers.get(codeName),
+      marker: getAutoResumeMarker(codeName),
       health: { ...serverHealth, mcpPresent },
       config: config2,
       now: Date.now()
@@ -9187,7 +9232,7 @@ async function maybeResumeReconcile(agent) {
       }
     );
     if (res.resumed) {
-      autoResumeMarkers.set(codeName, { trippedAt, autoResumedAt: Date.now() });
+      setAutoResumeMarker(codeName, { trippedAt, autoResumedAt: Date.now() });
       restartBreaker.clear(codeName);
       reportedTrips.delete(codeName);
       dependencyRecoveryLedger.clear(codeName);
@@ -9956,7 +10001,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.503" : "dev";
+var agtCliVersion = true ? "0.28.504" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -10191,6 +10236,9 @@ async function ensureIsolationImage(imageUri) {
       return;
     }
     log(`[isolation-image] ${localTag} now points at ${imageUri}`);
+    if (shouldReapOnRetag(hostFlagStore().getString("docker-hygiene"))) {
+      await reapSupersededRuntimeImages(imageUri, localTag);
+    }
     isolationImageEnsured.add(imageUri);
     isolationImageRetryAfter.delete(imageUri);
     isolationImageFailureCount.delete(imageUri);
@@ -10198,6 +10246,47 @@ async function ensureIsolationImage(imageUri) {
     isolationImageInFlight.delete(imageUri);
   }
 }
+function supersededRuntimeImageIds(currentId, repoImageIds) {
+  const cur = currentId.trim();
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of repoImageIds) {
+    const id = raw.trim();
+    if (!id || id === cur || seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+  }
+  return out;
+}
+function shouldReapOnRetag(mode) {
+  return mode === "reap-superseded" || mode === "full";
+}
+async function reapSupersededRuntimeImages(imageUri, localTag) {
+  try {
+    const repo = imageUri.replace(/@sha256:[a-f0-9]+$/i, "").replace(/:[^/:]+$/, "");
+    const idRes = await runAsync("docker", ["image", "inspect", "--format", "{{.Id}}", localTag], { timeout: 15e3 });
+    if (idRes.code !== 0) {
+      log(`[docker-gc] could not resolve ${localTag} id, skipping reap: ${idRes.stderr.trim().slice(0, 160)}`);
+      return;
+    }
+    const currentId = idRes.stdout.trim();
+    const lsRes = await runAsync("docker", ["images", "--no-trunc", "--format", "{{.ID}}", repo], { timeout: 15e3 });
+    if (lsRes.code !== 0) {
+      log(`[docker-gc] could not list ${repo} images, skipping reap: ${lsRes.stderr.trim().slice(0, 160)}`);
+      return;
+    }
+    const targets = supersededRuntimeImageIds(currentId, lsRes.stdout.split("\n"));
+    let reaped = 0;
+    for (const id of targets) {
+      const rm = await runAsync("docker", ["rmi", id], { timeout: 3e4 });
+      if (rm.code === 0) reaped++;
+      else log(`[docker-gc] skip ${id.slice(0, 19)}: ${(rm.stderr || rm.stdout).trim().slice(0, 120)}`);
+    }
+    if (reaped > 0) log(`[docker-gc] reaped ${reaped} superseded ${repo} image(s)`);
+  } catch (err) {
+    log(`[docker-gc] reap failed: ${isolationImageErrDetail(err)}`);
+  }
+}
 function runAsync(cmd, args, opts) {
   return new Promise((resolve, reject) => {
     import("child_process").then(({ spawn }) => {
@@ -11119,7 +11208,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-4PVEGHA5.js");
+      const { collectDiagnostics } = await import("../persistent-session-AB4SAH5B.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11226,7 +11315,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-4PVEGHA5.js");
+      const { collectDiagnostics } = await import("../persistent-session-AB4SAH5B.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11341,7 +11430,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-PNKFXRVF.js");
+      } = await import("../responsiveness-probe-O4SCSCKC.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11405,7 +11494,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-PNKFXRVF.js");
+        } = await import("../responsiveness-probe-O4SCSCKC.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -12097,9 +12186,9 @@ async function processAgent(agent, agentStates) {
       log(`[circuit-breaker] Cleared trip for '${agent.code_name}' on operator resume (paused \u2192 active)`);
     }
     if (previousStatus === "paused" && agent.status === "active") {
-      const marker = autoResumeMarkers.get(agent.code_name);
+      const marker = getAutoResumeMarker(agent.code_name);
       const isSelfResume = marker !== void 0 && Date.now() - marker.autoResumedAt < AUTO_RESUME_SELF_WINDOW_MS;
-      if (!isSelfResume && autoResumeMarkers.delete(agent.code_name)) {
+      if (!isSelfResume && deleteAutoResumeMarker(agent.code_name)) {
         state6 = {
           ...state6,
           circuitBreakerAutoResumes: Object.fromEntries(autoResumeMarkers.entries())
@@ -14897,7 +14986,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-4PVEGHA5.js");
+        const { collectDiagnostics } = await import("../persistent-session-AB4SAH5B.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -14947,7 +15036,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-4PVEGHA5.js");
+      const { collectDiagnostics } = await import("../persistent-session-AB4SAH5B.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15465,7 +15554,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-JEMJAZPB.js");
+  } = await import("../claude-pair-runtime-E3KMHKQQ.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -16405,11 +16494,13 @@ export {
   reorderRestartedFirst,
   resolveManagedMcpServerId,
   restartReasonBindsNewMcp,
+  shouldReapOnRetag,
   shouldReportRestartToAudit,
   shouldSkipRevokedCleanup,
   shouldUpdateOnLatest,
   stampClaudeCodeUpgradeMarker,
   startManager,
-  stopManager
+  stopManager,
+  supersededRuntimeImageIds
 };
 //# sourceMappingURL=manager-worker.js.map