@integrity-labs/agt-cli 0.28.546 → 0.28.548

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-7WHF3QRW.js";
+} from "../chunk-GYBGWZJP.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-QPSEQLSI.js";
+} from "../chunk-ST4PZ6RF.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4834,7 +4834,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.546" : "dev";
+var cliVersion = true ? "0.28.548" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6006,7 +6006,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.546" : "dev";
+var cliVersion2 = true ? "0.28.548" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-7WHF3QRW.js → chunk-GYBGWZJP.js}

@@ -42,7 +42,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-QPSEQLSI.js";
+} from "./chunk-ST4PZ6RF.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5549,7 +5549,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.546" : "dev";
+var agtCliVersion = true ? "0.28.548" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8861,4 +8861,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-7WHF3QRW.js.map
+//# sourceMappingURL=chunk-GYBGWZJP.js.map

package/dist/{chunk-QPSEQLSI.js → chunk-ST4PZ6RF.js}

@@ -15694,4 +15694,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-QPSEQLSI.js.map
+//# sourceMappingURL=chunk-ST4PZ6RF.js.map

package/dist/{claude-pair-runtime-R3R5OWDM.js → claude-pair-runtime-TZKJGXZU.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-FM5746XM.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-KVONGDAL.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-R3R5OWDM.js.map
+//# sourceMappingURL=claude-pair-runtime-TZKJGXZU.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-7WHF3QRW.js";
+} from "../chunk-GYBGWZJP.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -181,7 +181,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-QPSEQLSI.js";
+} from "../chunk-ST4PZ6RF.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -288,7 +288,17 @@ function decidePostRestartVerification(pending, sessionStartedAt, sessionHealthy
   return { kind: "unverified", attempt, final: attempt >= maxAttempts };
 }
 function shouldRemediateUnverifiedRestart(outcome, ctx) {
-  return ctx.enabled && !ctx.breakerTripped && outcome.kind === "unverified" && outcome.final;
+  return ctx.enabled && !ctx.breakerTripped && // ENG-8581: never remediate a session whose spawn was SKIPPED because the
+  // host cannot authenticate to Claude. Re-respawning cannot bind tools when
+  // no session can start at all, so the remediation is incapable of succeeding
+  // and simply loops. Observed on dig-host: 28 restarts in 6h, then 21 more in
+  // the hour around its re-auth, none of which could ever have worked.
+  //
+  // The circuit breaker does not catch this, which is the other half of the
+  // ticket: a skipped spawn returns `spawnAttempted: false`, so a restart that
+  // is never ATTEMPTED never registers as a failing restart. The mechanism
+  // designed to stop the loop is structurally blind to it.
+  !ctx.authSkipped && outcome.kind === "unverified" && outcome.final;
 }
 function computeFirstConnectUnsettled(integrations, now, windowMs) {
   return integrations.some((i) => {
@@ -300,7 +310,11 @@ function computeFirstConnectUnsettled(integrations, now, windowMs) {
   });
 }
 function shouldDeferBindRemediationForFirstConnect(outcome, ctx) {
-  return ctx.enabled && !ctx.breakerTripped && ctx.firstConnectUnsettled && ctx.deferralsSoFar < ctx.maxDeferrals && outcome.kind === "unverified" && outcome.final;
+  return ctx.enabled && !ctx.breakerTripped && // ENG-8581: an auth-skipped session has no first-connect to wait for either.
+  // Deferring would re-arm the verify window forever against a session that
+  // cannot start, burning the deferral budget on a condition no amount of
+  // waiting fixes. Same gate as remediation, for the same reason.
+  !ctx.authSkipped && ctx.firstConnectUnsettled && ctx.deferralsSoFar < ctx.maxDeferrals && outcome.kind === "unverified" && outcome.final;
 }
 
 // src/lib/integration-hash.ts
@@ -9772,6 +9786,12 @@ function cancelPendingSessionRestart(codeName) {
   deferLogThrottle.delete(codeName);
   log(`[hot-reload] Cancelled pending restart timer for '${codeName}' (another teardown path is handling it)`);
 }
+var lastSpawnOutcomeByAgent = /* @__PURE__ */ new Map();
+function spawnWasRefusedWithNoSession(codeName) {
+  const last = lastSpawnOutcomeByAgent.get(codeName);
+  if (!last) return false;
+  return !last.spawnAttempted && !last.sessionHealthyAfter;
+}
 function bindRemediationEnabled() {
   return hostFlagStore().getBoolean("bind-remediation");
 }
@@ -9807,6 +9827,7 @@ function verifyPendingRestarts(now) {
           if (shouldDeferBindRemediationForFirstConnect(outcome, {
             enabled: bindRemediationEnabled(),
             breakerTripped: restartBreaker.isTripped(codeName),
+            authSkipped: spawnWasRefusedWithNoSession(codeName),
             firstConnectUnsettled: firstConnectUnsettledByAgent.get(codeName) ?? false,
             deferralsSoFar: deferrals,
             maxDeferrals: BIND_REMEDIATION_MAX_CONNECTIVITY_DEFERRALS
@@ -9826,9 +9847,15 @@ function verifyPendingRestarts(now) {
             `[restart-verify] ERROR '${codeName}' did NOT respawn healthy after ${outcome.attempt} attempts following an MCP change \u2014 the live session may be stuck on its pre-restart tools. Check session health / manager.log; a manual session restart may be required (ENG-6174)`
           );
           finishRestartTiming(codeName, "failed", `${outcome.attempt} verify attempts`, log, now);
+          if (bindRemediationEnabled() && spawnWasRefusedWithNoSession(codeName)) {
+            log(
+              `[bind-remediation] '${codeName}' NOT remediating \u2014 the last spawn was refused and no session is running (e.g. the host cannot authenticate to Claude). A re-respawn cannot bind tools when nothing can start, so this would loop without the breaker ever seeing it (ENG-8581). Fix the host, not the session.`
+            );
+          }
           if (shouldRemediateUnverifiedRestart(outcome, {
             enabled: bindRemediationEnabled(),
-            breakerTripped: restartBreaker.isTripped(codeName)
+            breakerTripped: restartBreaker.isTripped(codeName),
+            authSkipped: spawnWasRefusedWithNoSession(codeName)
           })) {
             const jitterMs = Math.floor(Math.random() * BIND_REMEDIATION_JITTER_MS);
             log(
@@ -10455,7 +10482,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.546" : "dev";
+var agtCliVersion = true ? "0.28.548" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11759,7 +11786,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-FM5746XM.js");
+      const { collectDiagnostics } = await import("../persistent-session-KVONGDAL.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11867,7 +11894,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-FM5746XM.js");
+      const { collectDiagnostics } = await import("../persistent-session-KVONGDAL.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11990,7 +12017,7 @@ async function pollCycle() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-WZMDBY3T.js");
+      } = await import("../responsiveness-probe-OUHRYJYH.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -12081,7 +12108,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-WZMDBY3T.js");
+        } = await import("../responsiveness-probe-OUHRYJYH.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14365,6 +14392,10 @@ async function processAgent(agent, agentStates) {
     log(
       `[persistent-session-decision] agent=${agent.code_name} decision=${psResult.decision} spawn_attempted=${psResult.spawnAttempted} session_healthy_after=${psResult.sessionHealthyAfter}${detailSuffix}`
     );
+    lastSpawnOutcomeByAgent.set(agent.code_name, {
+      spawnAttempted: psResult.spawnAttempted,
+      sessionHealthyAfter: psResult.sessionHealthyAfter
+    });
     const stuck = persistentSessionStuckTracker.record({
       codeName: agent.code_name,
       sessionHealthy: psResult.sessionHealthyAfter,
@@ -15611,7 +15642,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-FM5746XM.js");
+        const { collectDiagnostics } = await import("../persistent-session-KVONGDAL.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15661,7 +15692,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-FM5746XM.js");
+      const { collectDiagnostics } = await import("../persistent-session-KVONGDAL.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -16185,7 +16216,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-R3R5OWDM.js");
+  } = await import("../claude-pair-runtime-TZKJGXZU.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));