@integrity-labs/agt-cli 0.28.588 → 0.28.589

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-4G52LVUD.js";
+} from "../chunk-THFO7CK4.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-BLA56WZF.js";
+} from "../chunk-QDJEEGZB.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4908,7 +4908,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.588" : "dev";
+var cliVersion = true ? "0.28.589" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6088,7 +6088,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.588" : "dev";
+var cliVersion2 = true ? "0.28.589" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-BLA56WZF.js → chunk-QDJEEGZB.js}

@@ -14724,6 +14724,32 @@ function buildDockerRunCommand(args) {
   const runCmd = [
     "exec docker run --rm -it",
     `--name agt-${codeName}`,
+    // ENG-8825: run tini as PID 1 so ADOPTED ORPHANS GET REAPED. Without it the
+    // container's PID 1 is the wrapper script, which execs `claude` - and a
+    // process reparented to PID 1 stays a zombie until PID 1 calls wait(),
+    // which claude does not and should not have to. Every subprocess that
+    // outlives its immediate parent therefore leaks a PID for the life of the
+    // container.
+    //
+    // Measured on a real agent (koda, 2026-08-14) after ~4h of ordinary work -
+    // git, gh, vitest, tsc, shell pipelines:
+    //
+    //     cgroup pids: 479/512   zombies: 403   live procs: 15
+    //
+    // ~100 zombies/hour, so `--pids-limit` two lines below is reached in about
+    // five hours of active use. The limit is deliberate; the leak just eats it.
+    //
+    // What makes this worth a flag rather than a monitoring item is the DISGUISE.
+    // Past the ceiling every spawn returns EAGAIN, and that surfaces inside
+    // whatever unrelated command ran next: vitest reports "no tests" (reads as a
+    // broken suite), tsc dies silently at exit 137 (reads as an OOM - it was
+    // misdiagnosed as one three times before the PID count was checked), esbuild
+    // fails mid-run. An agent hitting this concludes its own code is wrong.
+    //
+    // Docker's bundled tini. Deliberately NOT an in-process SIGCHLD handler in
+    // the harness: reaping adopted orphans is init's job, and re-implementing it
+    // per-application is how it gets forgotten again next time.
+    "--init",
     `--memory ${memory}`,
     `--cpus ${cpus}`,
     `--pids-limit ${pids}`,
@@ -16058,4 +16084,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-BLA56WZF.js.map
+//# sourceMappingURL=chunk-QDJEEGZB.js.map