@integrity-labs/agt-cli 0.28.578 → 0.28.579

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-5YFIIWS2.js";
+} from "../chunk-Y3ILQRLM.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-L24SX6LH.js";
+} from "../chunk-RC5YRTZU.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4853,7 +4853,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.578" : "dev";
+var cliVersion = true ? "0.28.579" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6031,7 +6031,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.578" : "dev";
+var cliVersion2 = true ? "0.28.579" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-L24SX6LH.js → chunk-RC5YRTZU.js}

@@ -14738,6 +14738,7 @@ function collectMcpServerNames(mcpConfigPath) {
     return [];
   }
 }
+var PANE_AGENT_ID_PROBE_TIMEOUT_MS = 2e3;
 var REQUIRED_SPAWN_ENV = ["AGT_AGENT_ID", "AGT_HOST", "AGT_API_KEY"];
 function buildSpawnEnv(args) {
   const { base, agentId, runId } = args;
@@ -14753,6 +14754,22 @@ function buildSpawnEnv(args) {
 function findMissingSpawnEnv(env2) {
   return REQUIRED_SPAWN_ENV.filter((k) => !env2[k]?.trim());
 }
+function describePaneAgentIdMismatch(args) {
+  const out = args.showEnvOutput.trim();
+  if (!out) return null;
+  if (/unknown variable/i.test(out)) {
+    return `no session-scoped AGT_AGENT_ID \u2014 the pane will inherit the tmux SERVER's global value, which on a shared host belongs to whichever agent started the server (ENG-8800)`;
+  }
+  if (/^-AGT_AGENT_ID$/m.test(out)) {
+    return "AGT_AGENT_ID is explicitly unset at session scope (ENG-8800)";
+  }
+  const match = /^AGT_AGENT_ID=(.*)$/m.exec(out);
+  if (!match) return null;
+  const actual = (match[1] ?? "").trim();
+  if (!actual) return "AGT_AGENT_ID is empty at session scope (ENG-8800)";
+  if (actual === args.expectedAgentId) return null;
+  return `pane has AGT_AGENT_ID=${actual} but this session is agent ${args.expectedAgentId} \u2014 broker lookups keyed on the agent id will resolve to the WRONG agent (ENG-8800)`;
+}
 function findForeignAgentIdsInMcpConfig(args) {
   const { mcpConfigText, agentId } = args;
   const expected = agentId.trim();
@@ -15033,6 +15050,7 @@ function spawnSession(config, session) {
       claudeArgsJoined
     });
     const tmuxSessionEnvArgs = [];
+    tmuxSessionEnvArgs.push("-e", `AGT_AGENT_ID=${config.agentId}`);
     if (openRouterMode) {
       const or = config.openRouter;
       tmuxSessionEnvArgs.push("-e", `ANTHROPIC_BASE_URL=${OPENROUTER_ANTHROPIC_BASE_URL}`);
@@ -15169,6 +15187,65 @@ function spawnSession(config, session) {
         return;
       }
       log2(`[persistent-session] tmux session '${tmuxSession}' created for '${codeName}'`);
+      try {
+        const probe = spawn2("tmux", ["show-environment", "-t", tmuxSession, "AGT_AGENT_ID"], {
+          stdio: ["ignore", "pipe", "pipe"]
+        });
+        let out = "";
+        let done = false;
+        const settle = (output) => {
+          if (done) return;
+          done = true;
+          clearTimeout(deadline);
+          if (output === null) return;
+          const mismatch = describePaneAgentIdMismatch({
+            showEnvOutput: output,
+            expectedAgentId: config.agentId
+          });
+          if (mismatch) {
+            log2(
+              `[persistent-session] PANE AGENT ID MISMATCH agent=${codeName} isolation=${isolationMode(codeName)} \u2014 ${mismatch}`
+            );
+            session.status = "crashed";
+            session.startedAt = Date.now();
+            try {
+              const killer = spawn2("tmux", ["kill-session", "-t", tmuxSession], {
+                stdio: "ignore"
+              });
+              const killDeadline = setTimeout(() => {
+                try {
+                  killer.kill("SIGKILL");
+                } catch {
+                }
+              }, PANE_AGENT_ID_PROBE_TIMEOUT_MS);
+              killDeadline.unref?.();
+              killer.on("error", () => clearTimeout(killDeadline));
+              killer.on("close", () => clearTimeout(killDeadline));
+            } catch {
+            }
+            log2(
+              `[persistent-session] killed session '${tmuxSession}' for '${codeName}' \u2014 refusing to run an agent under another agent's identity (ENG-8800)`
+            );
+          }
+        };
+        const deadline = setTimeout(() => {
+          settle(null);
+          try {
+            probe.kill("SIGKILL");
+          } catch {
+          }
+        }, PANE_AGENT_ID_PROBE_TIMEOUT_MS);
+        deadline.unref?.();
+        probe.stdout?.on("data", (d) => {
+          out += d.toString();
+        });
+        probe.stderr?.on("data", (d) => {
+          out += d.toString();
+        });
+        probe.on("error", () => settle(null));
+        probe.on("close", () => settle(out));
+      } catch {
+      }
       setupPaneLog2(tmuxSession, codeName, log2);
       session.currentSessionId = sessionId;
       acceptDialogs(tmuxSession, codeName, log2, config.primaryModel ?? null, sessionId).catch(() => {
@@ -15903,9 +15980,11 @@ export {
   restartEgressSidecar,
   buildDockerRunCommand,
   writePersistentClaudeWrapper,
+  PANE_AGENT_ID_PROBE_TIMEOUT_MS,
   REQUIRED_SPAWN_ENV,
   buildSpawnEnv,
   findMissingSpawnEnv,
+  describePaneAgentIdMismatch,
   findForeignAgentIdsInMcpConfig,
   paneLogPath,
   rotatePaneLogForDayRollover,
@@ -15934,4 +16013,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-L24SX6LH.js.map
+//# sourceMappingURL=chunk-RC5YRTZU.js.map