@integrity-labs/agt-cli 0.28.540 → 0.28.542

package/dist/{chunk-AGAGAM4W.js → chunk-GVYAIEFA.js}

@@ -42,7 +42,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-N6HD5UG4.js";
+} from "./chunk-F63RM2RQ.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5549,7 +5549,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.540" : "dev";
+var agtCliVersion = true ? "0.28.542" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8861,4 +8861,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-AGAGAM4W.js.map
+//# sourceMappingURL=chunk-GVYAIEFA.js.map

package/dist/{claude-pair-runtime-FHNWMTUH.js → claude-pair-runtime-2UU67Q2T.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-D47WOTHA.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-7GPDXRPK.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-FHNWMTUH.js.map
+//# sourceMappingURL=claude-pair-runtime-2UU67Q2T.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-AGAGAM4W.js";
+} from "../chunk-GVYAIEFA.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -66,6 +66,7 @@ import {
   AnchorSessionClient,
   CLAUDE_MD_MAX_CHARS,
   CONVERSATION_FAILURE_CATEGORIES,
+  ChildProcessError,
   DEFAULT_FRAMEWORK,
   DEFAULT_NEIGHBOURHOOD_MS,
   FLAGS_SCHEMA_VERSION,
@@ -180,7 +181,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-N6HD5UG4.js";
+} from "../chunk-F63RM2RQ.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -4498,6 +4499,73 @@ async function applyClaudeAuthToEnv(childEnv, label) {
   }
 }
 
+// src/lib/claude-runtime-auth-probe.ts
+var RUNTIME_AUTH_SENTINEL = "AGTAUTHOK";
+var RUNTIME_AUTH_PROBE_PROMPT = `Reply with exactly this and nothing else: ${RUNTIME_AUTH_SENTINEL}`;
+var AUTH_REFUSAL_MARKERS = [
+  "failed to authenticate",
+  "oauth session expired",
+  "could not be refreshed",
+  "invalid api key",
+  "authentication_error",
+  "please run /login",
+  "please run `claude /login`"
+];
+function safeDetail(raw) {
+  return raw.replace(/\bsk-[a-zA-Z0-9-]+/g, "sk-<redacted>").replace(/\b(Bearer|token|refreshToken|accessToken)\s*[:=]?\s*\S+/gi, "$1 <redacted>").replace(/\s+/g, " ").trim().slice(0, 200);
+}
+function classifyRuntimeAuthProbe(input) {
+  const { exitCode, stdout, stderr, timedOut } = input;
+  const combined = `${stdout}
+${stderr}`;
+  const haystack = combined.toLowerCase();
+  if (timedOut) {
+    return { verdict: "inconclusive", detail: "probe timed out" };
+  }
+  const marker = AUTH_REFUSAL_MARKERS.find((m) => haystack.includes(m));
+  if (marker) {
+    return {
+      verdict: "not-authenticated",
+      detail: safeDetail(combined) || `matched: ${marker}`
+    };
+  }
+  if (exitCode === 0 && stdout.includes(RUNTIME_AUTH_SENTINEL)) {
+    return { verdict: "authenticated", detail: "sentinel returned" };
+  }
+  if (exitCode === 0) {
+    return { verdict: "inconclusive", detail: "exit 0 but sentinel absent" };
+  }
+  return {
+    verdict: "inconclusive",
+    detail: safeDetail(`exit ${exitCode ?? "null"}: ${combined}`)
+  };
+}
+function foldRuntimeAuthVerdict(input) {
+  const { verdict, previous, consecutiveFailures, requiredConsecutiveFailures } = input;
+  if (verdict === "authenticated") {
+    return { reported: true, consecutiveFailures: 0 };
+  }
+  if (verdict === "not-authenticated") {
+    const next = consecutiveFailures + 1;
+    return {
+      reported: next >= requiredConsecutiveFailures ? false : previous,
+      consecutiveFailures: next
+    };
+  }
+  return { reported: previous, consecutiveFailures };
+}
+function heartbeatRuntimeAuthReport(probeVerdict) {
+  return probeVerdict ?? void 0;
+}
+function heartbeatRuntimeAuthFields(probeVerdict) {
+  const reported = heartbeatRuntimeAuthReport(probeVerdict);
+  if (reported === void 0) return {};
+  return {
+    agent_runtime_authenticated: reported,
+    agent_runtime_auth_observed: true
+  };
+}
+
 // src/lib/manager/kanban/parsers.ts
 import { existsSync as existsSync8, readFileSync as readFileSync15 } from "fs";
 import { join as join20 } from "path";
@@ -10369,7 +10437,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.540" : "dev";
+var agtCliVersion = true ? "0.28.542" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11240,6 +11308,99 @@ function isOlderSemverTuple(local, remote) {
   }
   return false;
 }
+var RUNTIME_AUTH_PROBE_INTERVAL_MS = 15 * 60 * 1e3;
+var RUNTIME_AUTH_PROBE_TIMEOUT_MS = 6e4;
+var RUNTIME_AUTH_PROBE_FAILURES_TO_CONDEMN = 2;
+var lastRuntimeAuthProbeAt = 0;
+var runtimeAuthProbeInFlight = false;
+var runtimeAuthConsecutiveFailures = 0;
+var runtimeAuthProbeVerdict = null;
+function effectiveRuntimeAuthenticated() {
+  return runtimeAuthProbeVerdict ?? agentRuntimeAuthenticated;
+}
+async function maybeProbeClaudeRuntimeAuth() {
+  if (runtimeAuthProbeInFlight) return;
+  if (Date.now() - lastRuntimeAuthProbeAt < RUNTIME_AUTH_PROBE_INTERVAL_MS) return;
+  const { execFileSync: execFileSync2 } = await import("child_process");
+  if (!claudeBinaryInstalled(execFileSync2)) return;
+  runtimeAuthProbeInFlight = true;
+  lastRuntimeAuthProbeAt = Date.now();
+  try {
+    const before = effectiveRuntimeAuthenticated();
+    const result = await runClaudeRuntimeAuthProbe();
+    const folded = foldRuntimeAuthVerdict({
+      verdict: result.verdict,
+      previous: before,
+      consecutiveFailures: runtimeAuthConsecutiveFailures,
+      requiredConsecutiveFailures: RUNTIME_AUTH_PROBE_FAILURES_TO_CONDEMN
+    });
+    runtimeAuthConsecutiveFailures = folded.consecutiveFailures;
+    if (result.verdict === "authenticated" || folded.reported !== before) {
+      runtimeAuthProbeVerdict = folded.reported;
+    }
+    if (folded.reported !== before) {
+      log(
+        `[runtime-auth-probe] reported authentication ${before} -> ${folded.reported} (verdict=${result.verdict}, consecutiveFailures=${folded.consecutiveFailures}): ${result.detail}`
+      );
+    } else if (result.verdict !== "authenticated") {
+      log(
+        `[runtime-auth-probe] verdict=${result.verdict} (consecutiveFailures=${runtimeAuthConsecutiveFailures}): ${result.detail}`
+      );
+    }
+  } catch (err) {
+    log(`[runtime-auth-probe] probe error (treated as inconclusive): ${err.message}`);
+  } finally {
+    runtimeAuthProbeInFlight = false;
+  }
+}
+async function runClaudeRuntimeAuthProbe() {
+  const childEnv = { ...process.env };
+  await applyClaudeAuthToEnv(childEnv, "runtime-auth-probe");
+  const emptyMcp = ensureEvalEmptyMcpConfig();
+  const args = [
+    "-p",
+    RUNTIME_AUTH_PROBE_PROMPT,
+    "--model",
+    process.env["AGT_CONV_EVAL_CLAUDE_MODEL"]?.trim() || DEFAULT_CLAUDE_EVAL_MODEL,
+    // feature-gate-allow: model tunable, not a gate
+    "--output-format",
+    "text",
+    // Same isolation as conversation-eval: no project config, no MCP, no tools.
+    // The probe must exercise AUTH and nothing else.
+    "--mcp-config",
+    emptyMcp,
+    "--strict-mcp-config",
+    "--permission-mode",
+    "auto",
+    "--allowedTools",
+    ""
+  ];
+  try {
+    const { stdout, stderr } = await execFilePromiseLong(resolveClaudeBinary(), args, {
+      cwd: homedir12(),
+      timeout: RUNTIME_AUTH_PROBE_TIMEOUT_MS,
+      stdin: "ignore",
+      env: childEnv,
+      onSpawn: (pid) => registerClaudeSpawn({ pid, started_at: Date.now(), kind: "conv-eval" }),
+      onExit: (pid) => unregisterClaudeSpawn(pid)
+    });
+    return classifyRuntimeAuthProbe({ exitCode: 0, stdout, stderr });
+  } catch (err) {
+    if (err instanceof ChildProcessError) {
+      return classifyRuntimeAuthProbe({
+        exitCode: err.code,
+        stdout: err.stdout,
+        stderr: err.stderr
+      });
+    }
+    return classifyRuntimeAuthProbe({
+      exitCode: null,
+      stdout: "",
+      stderr: err.message,
+      timedOut: true
+    });
+  }
+}
 async function checkClaudeAuth() {
   try {
     const report = await detectClaudeAuth();
@@ -11580,7 +11741,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-D47WOTHA.js");
+      const { collectDiagnostics } = await import("../persistent-session-7GPDXRPK.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11666,6 +11827,7 @@ async function pollCycle() {
     checkAndUpdateCli().catch((err) => log(`[self-update] Check failed: ${err.message}`));
   }
   maybeUpgradeClaudeCode().catch((err) => log(`[claude-code-upgrade] Check failed: ${err.message}`));
+  maybeProbeClaudeRuntimeAuth().catch((err) => log(`[runtime-auth-probe] Check failed: ${err.message}`));
   try {
     registeredAgentsCache.clear();
     const hostId = await getHostId();
@@ -11687,7 +11849,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-D47WOTHA.js");
+      const { collectDiagnostics } = await import("../persistent-session-7GPDXRPK.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11733,7 +11895,14 @@ async function pollCycle() {
         framework_version: cachedFrameworkVersion ?? void 0,
         agt_version: agtCliVersion,
         host_security: detectHostSecurity() ?? void 0,
-        agent_runtime_authenticated: agentRuntimeAuthenticated,
+        // ENG-8623: the probe's verdict, or the field is OMITTED. The column is
+        // named for a runtime observation and the API now stamps a freshness
+        // timestamp beside it, so a file-derived value here would manufacture an
+        // observation nobody made. Spread as ONE unit: the boolean and its
+        // provenance marker must never diverge, so they are produced together
+        // rather than as two fields a future edit could separate. See
+        // `heartbeatRuntimeAuthFields`.
+        ...heartbeatRuntimeAuthFields(runtimeAuthProbeVerdict),
         agent_diagnostics: agentDiagnostics,
         hostname: tailscaleHostname,
         os_username: osUsername,
@@ -11803,7 +11972,7 @@ async function pollCycle() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-HZUQTMSG.js");
+      } = await import("../responsiveness-probe-P52CE6K7.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11894,7 +12063,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-HZUQTMSG.js");
+        } = await import("../responsiveness-probe-P52CE6K7.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15424,7 +15593,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-D47WOTHA.js");
+        const { collectDiagnostics } = await import("../persistent-session-7GPDXRPK.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15474,7 +15643,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-D47WOTHA.js");
+      const { collectDiagnostics } = await import("../persistent-session-7GPDXRPK.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15998,7 +16167,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-FHNWMTUH.js");
+  } = await import("../claude-pair-runtime-2UU67Q2T.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -16942,6 +17111,7 @@ export {
   isPrereleaseVersion,
   markAgentForFreshMemorySync,
   maybeInjectKanbanCheck,
+  maybeProbeClaudeRuntimeAuth,
   maybeUpgradeClaudeCode,
   refreshSkillsIndexInClaudeMd,
   reorderRestartedFirst,