@integrity-labs/agt-cli 0.28.579 → 0.28.581

package/dist/{claude-pair-runtime-44HJ5UBR.js → claude-pair-runtime-MKWK27KO.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-TLF2BQRN.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-MHBLUAOV.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-44HJ5UBR.js.map
+//# sourceMappingURL=claude-pair-runtime-MKWK27KO.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-Y3ILQRLM.js";
+} from "../chunk-VLAPXDCM.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -122,6 +122,7 @@ import {
   isAgentTimezoneOverrideExpired,
   isBareAck,
   isBucketQualified,
+  isControlPlaneOnlyConfigKey,
   isControlPlaneOnlyEnvVar,
   isConversationFailureCategory,
   isEmptyTotals,
@@ -182,7 +183,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-RC5YRTZU.js";
+} from "../chunk-RDBPQZVG.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -332,9 +333,18 @@ function canonicalize(value) {
   }
   return value;
 }
+function hashableConfig(config2) {
+  if (!config2) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(config2)) {
+    if (isControlPlaneOnlyConfigKey(key)) continue;
+    out[key] = value;
+  }
+  return out;
+}
 function computeIntegrationsHash(integrations) {
   const payload = integrations.map(
-    (i) => `${i.definition_id}:${JSON.stringify(canonicalize(i.credentials ?? {}))}:${JSON.stringify(canonicalize(i.config ?? {}))}`
+    (i) => `${i.definition_id}:${JSON.stringify(canonicalize(i.credentials ?? {}))}:${JSON.stringify(canonicalize(hashableConfig(i.config)))}`
   ).sort();
   return createHash2("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
 }
@@ -347,6 +357,16 @@ function computeCapabilitySurfaceHash(integrations) {
 }
 
 // src/lib/host-integration-mapping.ts
+var RECOGNISED_CREDENTIAL_DELIVERY = /* @__PURE__ */ new Set(["env", "broker"]);
+var MAX_SHOWN_VALUE_CHARS = 120;
+function describeUnrecognisedCredentialDelivery(value) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value === "string" && RECOGNISED_CREDENTIAL_DELIVERY.has(value)) return null;
+  const shown = typeof value === "string" ? JSON.stringify(
+    value.length > MAX_SHOWN_VALUE_CHARS ? `${value.slice(0, MAX_SHOWN_VALUE_CHARS)}\u2026` : value
+  ) : `<${typeof value}>`;
+  return `unrecognised credential_delivery ${shown} \u2014 treating as env delivery. If this row is a github_app under the github-broker-credentials flag, the API has stripped its token AND the broker helper will be removed, leaving the agent with no GitHub credential at all (ENG-8800 AC5)`;
+}
 function withResolvedRemoteMcp(integration) {
   return {
     ...integration,
@@ -356,9 +376,17 @@ function withResolvedRemoteMcp(integration) {
     // row into use-time credential delivery — anything else (including a value
     // a newer API might add later) reads as today's env delivery, so an
     // unrecognised value can never strip an agent's `git`/`gh` credentials.
-    credentialDelivery: integration.credential_delivery === "broker" ? "broker" : void 0
+    credentialDelivery: normalizeCredentialDelivery(integration.credential_delivery)
   };
 }
+function normalizeCredentialDelivery(value) {
+  const anomaly = describeUnrecognisedCredentialDelivery(value);
+  if (anomaly) {
+    process.stderr.write(`[host-integrations] [credential-delivery] ${anomaly}
+`);
+  }
+  return value === "broker" ? "broker" : void 0;
+}
 
 // src/lib/anchor-session-lifecycle.ts
 var DEFAULT_ANCHOR_SESSION_MAX_DURATION_MINUTES = 60;
@@ -11596,7 +11624,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.579" : "dev";
+var agtCliVersion = true ? "0.28.581" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -12903,7 +12931,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-TLF2BQRN.js");
+      const { collectDiagnostics } = await import("../persistent-session-MHBLUAOV.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics)
@@ -13011,7 +13039,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-TLF2BQRN.js");
+      const { collectDiagnostics } = await import("../persistent-session-MHBLUAOV.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics) : void 0;
       let tailscaleHostname;
@@ -13134,7 +13162,7 @@ async function pollCycle() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-XEE6AST5.js");
+      } = await import("../responsiveness-probe-XGMKVWSH.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -13225,7 +13253,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-XEE6AST5.js");
+        } = await import("../responsiveness-probe-XGMKVWSH.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16795,7 +16823,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-TLF2BQRN.js");
+        const { collectDiagnostics } = await import("../persistent-session-MHBLUAOV.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics)
@@ -16846,7 +16874,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-TLF2BQRN.js");
+      const { collectDiagnostics } = await import("../persistent-session-MHBLUAOV.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics)
@@ -17424,7 +17452,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-44HJ5UBR.js");
+  } = await import("../claude-pair-runtime-MKWK27KO.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));