@integrity-labs/agt-cli 0.28.508 → 0.28.510

package/dist/{claude-pair-runtime-YQ7V5TS6.js → claude-pair-runtime-4CYSUXLF.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-VX37ESOS.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-4VF7V4HB.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-YQ7V5TS6.js.map
+//# sourceMappingURL=claude-pair-runtime-4CYSUXLF.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-GK3TSZ4S.js";
+} from "../chunk-EQW3EHDQ.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -173,7 +173,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-LNPJI2AE.js";
+} from "../chunk-7DZNVMMX.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -1899,7 +1899,19 @@ var NON_SECRET_ENV_GATES = [
   "AGT_DISABLE_MSTEAMS_HOST_ROUTES",
   "AGT_DEPLOY_CRONS",
   "AGT_CONV_EVAL_BACKEND",
-  "AGT_CLI_RELEASE_CHANNEL"
+  "AGT_CLI_RELEASE_CHANNEL",
+  // ENG-8341: the host-local self-update pin. It OUTRANKS
+  // hosts.desired_agt_cli_version in resolveEffectivePinRaw, so without it the
+  // control plane cannot resolve a host's true target: a host env-pinned to X
+  // while the DB says NULL is CORRECT to sit behind `latest`, and a drift
+  // monitor that cannot see the env pin would page on exactly the hosts an
+  // operator deliberately held back. A version string, not a secret (and
+  // SECRET_NAME_PATTERN would drop it if it were shaped like one).
+  "AGT_CLI_PIN_VERSION",
+  // ENG-8341: the paired escape hatch. A host allowing urgent upgrades can
+  // legitimately be AHEAD of its pin, which is the other direction of the same
+  // false positive.
+  "AGT_CLI_PIN_ALLOW_URGENT"
 ];
 var SECRET_NAME_PATTERN = /(KEY|SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIAL|PRIVATE|SIGNING|WEBHOOK)/i;
 function listCapturableEnvGateNames() {
@@ -10038,7 +10050,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.508" : "dev";
+var agtCliVersion = true ? "0.28.510" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11245,7 +11257,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-VX37ESOS.js");
+      const { collectDiagnostics } = await import("../persistent-session-4VF7V4HB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11352,7 +11364,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-VX37ESOS.js");
+      const { collectDiagnostics } = await import("../persistent-session-4VF7V4HB.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11467,7 +11479,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-5MEW5XNI.js");
+      } = await import("../responsiveness-probe-PWS3FIRF.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11531,7 +11543,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-5MEW5XNI.js");
+        } = await import("../responsiveness-probe-PWS3FIRF.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15023,7 +15035,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-VX37ESOS.js");
+        const { collectDiagnostics } = await import("../persistent-session-4VF7V4HB.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15073,7 +15085,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-VX37ESOS.js");
+      const { collectDiagnostics } = await import("../persistent-session-4VF7V4HB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15591,7 +15603,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-YQ7V5TS6.js");
+  } = await import("../claude-pair-runtime-4CYSUXLF.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));