@integrity-labs/agt-cli 0.28.587 → 0.28.589

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-4BP5X62F.js";
+} from "../chunk-THFO7CK4.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-GMTRKIHI.js";
+} from "../chunk-QDJEEGZB.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4908,7 +4908,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.587" : "dev";
+var cliVersion = true ? "0.28.589" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6088,7 +6088,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.587" : "dev";
+var cliVersion2 = true ? "0.28.589" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-GMTRKIHI.js → chunk-QDJEEGZB.js}

@@ -6448,13 +6448,30 @@ async function timedFetch2(fetchImpl, url, init) {
     clearTimeout(timer);
   }
 }
-function statusForHttp(httpStatus) {
+function isRateLimited(res) {
+  const retryAfter = res.headers.get("retry-after");
+  if (retryAfter !== null && retryAfter.trim() !== "")
+    return true;
+  const remaining = res.headers.get("x-ratelimit-remaining");
+  if (remaining === null || remaining.trim() === "")
+    return false;
+  return Number(remaining) === 0;
+}
+function statusForHttp(httpStatus, opts) {
+  if (httpStatus === 429)
+    return "transient_error";
+  if (httpStatus === 403 && opts?.rateLimited)
+    return "transient_error";
   if (httpStatus === 401 || httpStatus === 403)
     return "down";
   if (httpStatus >= 500)
     return "transient_error";
   return "down";
 }
+function rateLimitMessage(provider, httpStatus) {
+  const subject = provider ? `${provider} rate limit` : "Rate limited by the provider";
+  return `${subject} (${httpStatus}) \u2014 not a credential failure`;
+}
 function redactSecret(message, secret) {
   if (typeof secret !== "string" || secret.length < 4)
     return message;
@@ -6475,8 +6492,11 @@ async function probeLinear(creds, fetchImpl) {
       headers: { "Content-Type": "application/json", Authorization: String(key) },
       body: JSON.stringify({ query: "{ viewer { id name email } }" })
     });
-    if (!res.ok)
-      return { status: statusForHttp(res.status), message: `Linear API returned ${res.status}` };
+    if (!res.ok) {
+      const rateLimited = isRateLimited(res);
+      const message = res.status === 429 || res.status === 403 && rateLimited ? rateLimitMessage("Linear", res.status) : `Linear API returned ${res.status}`;
+      return { status: statusForHttp(res.status, { rateLimited }), message };
+    }
     const body = await res.json();
     if (body.errors?.length)
       return { status: "down", message: body.errors[0]?.message ?? "Unknown Linear error" };
@@ -6495,8 +6515,9 @@ async function probeBearerJson(url, creds, fetchImpl, interpret, extraHeaders) {
   try {
     const res = await timedFetch2(fetchImpl, url, { headers: { Authorization: `Bearer ${token}`, ...extraHeaders } });
     if (!res.ok) {
-      const message = res.status === 401 ? "Token expired or revoked \u2014 reconnect required" : `API returned ${res.status}`;
-      return { status: statusForHttp(res.status), message };
+      const rateLimited = isRateLimited(res);
+      const message = res.status === 401 ? "Token expired or revoked \u2014 reconnect required" : res.status === 429 || res.status === 403 && rateLimited ? rateLimitMessage(null, res.status) : `API returned ${res.status}`;
+      return { status: statusForHttp(res.status, { rateLimited }), message };
     }
     return interpret(await res.json());
   } catch (err) {
@@ -6514,8 +6535,9 @@ async function probeBuffer(creds, fetchImpl) {
       body: JSON.stringify({ query: "{ account { organizations { id name } } }" })
     });
     if (!res.ok) {
-      const message = res.status === 401 ? "Buffer API key expired or revoked \u2014 reconnect required" : `Buffer API returned ${res.status}`;
-      return { status: statusForHttp(res.status), message };
+      const rateLimited = isRateLimited(res);
+      const message = res.status === 401 ? "Buffer API key expired or revoked \u2014 reconnect required" : res.status === 429 || res.status === 403 && rateLimited ? rateLimitMessage("Buffer", res.status) : `Buffer API returned ${res.status}`;
+      return { status: statusForHttp(res.status, { rateLimited }), message };
     }
     const body = await res.json();
     if (body.errors?.length)
@@ -6537,10 +6559,7 @@ async function probeVercel(creds, fetchImpl) {
       headers: { Authorization: `Bearer ${token}` }
     });
     if (!res.ok) {
-      if (res.status === 429) {
-        return { status: "transient_error", message: "Vercel rate limit (429) \u2014 not a credential failure" };
-      }
-      const message = res.status === 401 || res.status === 403 ? `Vercel rejected the token (${res.status}) \u2014 invalid or revoked API token` : `Vercel API returned ${res.status}`;
+      const message = res.status === 429 ? rateLimitMessage("Vercel", res.status) : res.status === 401 || res.status === 403 ? `Vercel rejected the token (${res.status}) \u2014 invalid or revoked API token` : `Vercel API returned ${res.status}`;
       return { status: statusForHttp(res.status), message };
     }
     const body = await res.json();
@@ -6568,9 +6587,6 @@ async function probeHiggsfield(creds, fetchImpl) {
       headers: { Authorization: `Key ${token}` }
     });
     if (!res.ok) {
-      if (res.status === 429) {
-        return { status: "transient_error", message: "Higgsfield rate limit (429) \u2014 not a credential failure" };
-      }
       const body = await res.text().catch(() => "");
       if (res.status === 403 && /credit/i.test(body)) {
         return {
@@ -6578,7 +6594,7 @@ async function probeHiggsfield(creds, fetchImpl) {
           message: "Higgsfield authenticated, but the account is out of credits \u2014 generation will fail"
         };
       }
-      const message = res.status === 401 || res.status === 403 ? `Higgsfield rejected the key pair (${res.status}) \u2014 invalid or revoked API key` : `Higgsfield API returned ${res.status}`;
+      const message = res.status === 429 ? rateLimitMessage("Higgsfield", res.status) : res.status === 401 || res.status === 403 ? `Higgsfield rejected the key pair (${res.status}) \u2014 invalid or revoked API key` : `Higgsfield API returned ${res.status}`;
       return { status: statusForHttp(res.status), message };
     }
     const motions = await res.json();
@@ -14708,6 +14724,32 @@ function buildDockerRunCommand(args) {
   const runCmd = [
     "exec docker run --rm -it",
     `--name agt-${codeName}`,
+    // ENG-8825: run tini as PID 1 so ADOPTED ORPHANS GET REAPED. Without it the
+    // container's PID 1 is the wrapper script, which execs `claude` - and a
+    // process reparented to PID 1 stays a zombie until PID 1 calls wait(),
+    // which claude does not and should not have to. Every subprocess that
+    // outlives its immediate parent therefore leaks a PID for the life of the
+    // container.
+    //
+    // Measured on a real agent (koda, 2026-08-14) after ~4h of ordinary work -
+    // git, gh, vitest, tsc, shell pipelines:
+    //
+    //     cgroup pids: 479/512   zombies: 403   live procs: 15
+    //
+    // ~100 zombies/hour, so `--pids-limit` two lines below is reached in about
+    // five hours of active use. The limit is deliberate; the leak just eats it.
+    //
+    // What makes this worth a flag rather than a monitoring item is the DISGUISE.
+    // Past the ceiling every spawn returns EAGAIN, and that surfaces inside
+    // whatever unrelated command ran next: vitest reports "no tests" (reads as a
+    // broken suite), tsc dies silently at exit 137 (reads as an OOM - it was
+    // misdiagnosed as one three times before the PID count was checked), esbuild
+    // fails mid-run. An agent hitting this concludes its own code is wrong.
+    //
+    // Docker's bundled tini. Deliberately NOT an in-process SIGCHLD handler in
+    // the harness: reaping adopted orphans is init's job, and re-implementing it
+    // per-application is how it gets forgotten again next time.
+    "--init",
     `--memory ${memory}`,
     `--cpus ${cpus}`,
     `--pids-limit ${pids}`,
@@ -16042,4 +16084,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-GMTRKIHI.js.map
+//# sourceMappingURL=chunk-QDJEEGZB.js.map