@integrity-labs/agt-cli 0.28.547 → 0.28.549

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-SYHPBJK7.js";
+} from "../chunk-MDIHMULA.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -288,7 +288,17 @@ function decidePostRestartVerification(pending, sessionStartedAt, sessionHealthy
   return { kind: "unverified", attempt, final: attempt >= maxAttempts };
 }
 function shouldRemediateUnverifiedRestart(outcome, ctx) {
-  return ctx.enabled && !ctx.breakerTripped && outcome.kind === "unverified" && outcome.final;
+  return ctx.enabled && !ctx.breakerTripped && // ENG-8581: never remediate a session whose spawn was SKIPPED because the
+  // host cannot authenticate to Claude. Re-respawning cannot bind tools when
+  // no session can start at all, so the remediation is incapable of succeeding
+  // and simply loops. Observed on dig-host: 28 restarts in 6h, then 21 more in
+  // the hour around its re-auth, none of which could ever have worked.
+  //
+  // The circuit breaker does not catch this, which is the other half of the
+  // ticket: a skipped spawn returns `spawnAttempted: false`, so a restart that
+  // is never ATTEMPTED never registers as a failing restart. The mechanism
+  // designed to stop the loop is structurally blind to it.
+  !ctx.authSkipped && outcome.kind === "unverified" && outcome.final;
 }
 function computeFirstConnectUnsettled(integrations, now, windowMs) {
   return integrations.some((i) => {
@@ -300,7 +310,11 @@ function computeFirstConnectUnsettled(integrations, now, windowMs) {
   });
 }
 function shouldDeferBindRemediationForFirstConnect(outcome, ctx) {
-  return ctx.enabled && !ctx.breakerTripped && ctx.firstConnectUnsettled && ctx.deferralsSoFar < ctx.maxDeferrals && outcome.kind === "unverified" && outcome.final;
+  return ctx.enabled && !ctx.breakerTripped && // ENG-8581: an auth-skipped session has no first-connect to wait for either.
+  // Deferring would re-arm the verify window forever against a session that
+  // cannot start, burning the deferral budget on a condition no amount of
+  // waiting fixes. Same gate as remediation, for the same reason.
+  !ctx.authSkipped && ctx.firstConnectUnsettled && ctx.deferralsSoFar < ctx.maxDeferrals && outcome.kind === "unverified" && outcome.final;
 }
 
 // src/lib/integration-hash.ts
@@ -9772,6 +9786,12 @@ function cancelPendingSessionRestart(codeName) {
   deferLogThrottle.delete(codeName);
   log(`[hot-reload] Cancelled pending restart timer for '${codeName}' (another teardown path is handling it)`);
 }
+var lastSpawnOutcomeByAgent = /* @__PURE__ */ new Map();
+function spawnWasRefusedWithNoSession(codeName) {
+  const last = lastSpawnOutcomeByAgent.get(codeName);
+  if (!last) return false;
+  return !last.spawnAttempted && !last.sessionHealthyAfter;
+}
 function bindRemediationEnabled() {
   return hostFlagStore().getBoolean("bind-remediation");
 }
@@ -9807,6 +9827,7 @@ function verifyPendingRestarts(now) {
           if (shouldDeferBindRemediationForFirstConnect(outcome, {
             enabled: bindRemediationEnabled(),
             breakerTripped: restartBreaker.isTripped(codeName),
+            authSkipped: spawnWasRefusedWithNoSession(codeName),
             firstConnectUnsettled: firstConnectUnsettledByAgent.get(codeName) ?? false,
             deferralsSoFar: deferrals,
             maxDeferrals: BIND_REMEDIATION_MAX_CONNECTIVITY_DEFERRALS
@@ -9826,9 +9847,15 @@ function verifyPendingRestarts(now) {
             `[restart-verify] ERROR '${codeName}' did NOT respawn healthy after ${outcome.attempt} attempts following an MCP change \u2014 the live session may be stuck on its pre-restart tools. Check session health / manager.log; a manual session restart may be required (ENG-6174)`
           );
           finishRestartTiming(codeName, "failed", `${outcome.attempt} verify attempts`, log, now);
+          if (bindRemediationEnabled() && spawnWasRefusedWithNoSession(codeName)) {
+            log(
+              `[bind-remediation] '${codeName}' NOT remediating \u2014 the last spawn was refused and no session is running (e.g. the host cannot authenticate to Claude). A re-respawn cannot bind tools when nothing can start, so this would loop without the breaker ever seeing it (ENG-8581). Fix the host, not the session.`
+            );
+          }
           if (shouldRemediateUnverifiedRestart(outcome, {
             enabled: bindRemediationEnabled(),
-            breakerTripped: restartBreaker.isTripped(codeName)
+            breakerTripped: restartBreaker.isTripped(codeName),
+            authSkipped: spawnWasRefusedWithNoSession(codeName)
           })) {
             const jitterMs = Math.floor(Math.random() * BIND_REMEDIATION_JITTER_MS);
             log(
@@ -10455,7 +10482,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.547" : "dev";
+var agtCliVersion = true ? "0.28.549" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -14365,6 +14392,10 @@ async function processAgent(agent, agentStates) {
     log(
       `[persistent-session-decision] agent=${agent.code_name} decision=${psResult.decision} spawn_attempted=${psResult.spawnAttempted} session_healthy_after=${psResult.sessionHealthyAfter}${detailSuffix}`
     );
+    lastSpawnOutcomeByAgent.set(agent.code_name, {
+      spawnAttempted: psResult.spawnAttempted,
+      sessionHealthyAfter: psResult.sessionHealthyAfter
+    });
     const stuck = persistentSessionStuckTracker.record({
       codeName: agent.code_name,
       sessionHealthy: psResult.sessionHealthyAfter,