@integrity-labs/agt-cli 0.28.595 → 0.28.597

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-RC6V6QN2.js";
+} from "../chunk-WAQM45OE.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -10041,6 +10041,8 @@ var assignChannel = null;
 var configChannel = null;
 var kanbanChannel = null;
 var integrationContextChannel = null;
+var tokenRotationChannels = [];
+var tokenRotationEpoch = 0;
 var connected = false;
 var tearingDown = false;
 function ensureClient(config2) {
@@ -10086,6 +10088,7 @@ function startRealtimeChat(config2) {
       configChannel = null;
       kanbanChannel = null;
       integrationContextChannel = null;
+      tokenRotationChannels = [];
       if (client) {
         try {
           client.removeAllChannels();
@@ -10334,6 +10337,49 @@ function stopRealtimeIntegrationContext() {
   }
   integrationContextChannel = null;
 }
+function startRealtimeTokenRotation(config2) {
+  const { agentIds, onTokenRotated, onSubscriptionLost, log: log2 } = config2;
+  if (agentIds.length === 0) return;
+  stopRealtimeTokenRotation();
+  const epoch = ++tokenRotationEpoch;
+  const sb = ensureClient(config2);
+  for (const agentId of agentIds) {
+    const topic = `token-rotated-agent:${agentId}`;
+    const channel = sb.channel(topic, { config: { private: true } }).on("broadcast", { event: "token.rotated" }, (message) => {
+      const payload = message.payload;
+      if (!payload || typeof payload.integration_id !== "string" || payload.integration_id.length === 0) {
+        log2(`[realtime] token.rotated for agent ${agentId} ignored \u2014 no integration_id in payload`);
+        return;
+      }
+      log2(
+        `[realtime] token.rotated for agent ${agentId} (integration ${payload.integration_id}, ${payload.definition_id ?? "unknown provider"})`
+      );
+      onTokenRotated(agentId, {
+        integration_id: payload.integration_id,
+        definition_id: typeof payload.definition_id === "string" ? payload.definition_id : "unknown",
+        rotated_at: typeof payload.rotated_at === "string" ? payload.rotated_at : (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }).subscribe((status) => {
+      if (epoch !== tokenRotationEpoch) return;
+      if (status === "CLOSED" || status === "CHANNEL_ERROR" || status === "TIMED_OUT") {
+        log2(`[realtime] Token rotation channel for agent ${agentId}: ${status}`);
+        onSubscriptionLost?.(agentId, status);
+      }
+    });
+    tokenRotationChannels.push(channel);
+  }
+  log2(`[realtime] Subscribing to token.rotated for ${agentIds.length} agent(s)`);
+}
+function stopRealtimeTokenRotation() {
+  tokenRotationEpoch += 1;
+  for (const channel of tokenRotationChannels) {
+    try {
+      channel.unsubscribe();
+    } catch {
+    }
+  }
+  tokenRotationChannels = [];
+}
 function isRealtimeConnected() {
   return connected;
 }
@@ -10393,6 +10439,13 @@ function stopRealtimeChat() {
       }
       integrationContextChannel = null;
     }
+    for (const ch of tokenRotationChannels) {
+      try {
+        ch.unsubscribe();
+      } catch {
+      }
+    }
+    tokenRotationChannels = [];
     if (client) {
       try {
         client.removeAllChannels();
@@ -11827,7 +11880,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.595" : "dev";
+var agtCliVersion = true ? "0.28.597" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -17239,8 +17292,9 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
   if (activeAgentIds.length === 0) {
     if (subscribedIntegrationContextAgentIds.size > 0) {
       stopRealtimeIntegrationContext();
+      stopRealtimeTokenRotation();
       subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
-      log("[realtime] Integration context subscription torn down (no active agents)");
+      log("[realtime] Integration context + token rotation subscriptions torn down (no active agents)");
     }
     return;
   }
@@ -17250,6 +17304,7 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
   const isResubscribe = subscribedIntegrationContextAgentIds.size > 0;
   if (isResubscribe) {
     stopRealtimeIntegrationContext();
+    stopRealtimeTokenRotation();
   }
   const targetSet = new Set(activeAgentIds);
   subscribedIntegrationContextAgentIds = targetSet;
@@ -17277,8 +17332,24 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
       },
       log
     });
+    startRealtimeTokenRotation({
+      supabaseUrl: exchange.supabaseUrl,
+      supabaseAnonKey: exchange.supabaseAnonKey,
+      token: exchange.token,
+      agentIds: [...targetSet],
+      onTokenRotated: (agentId, event) => {
+        triggerEarlyPoll(
+          `integration token rotated for agent ${agentId} (integration ${event.integration_id}, ${event.definition_id})`
+        );
+      },
+      onSubscriptionLost: (agentId, status) => {
+        log(`[realtime] Token rotation subscription lost for agent ${agentId} (${status}) \u2014 will rebind next tick`);
+        subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
+      },
+      log
+    });
     log(
-      `[realtime] Integration context subscription ${isResubscribe ? "re-bound" : "started"} for ${targetSet.size} agent(s)`
+      `[realtime] Integration context + token rotation subscriptions ${isResubscribe ? "re-bound" : "started"} for ${targetSet.size} agent(s)`
     );
   }).catch((err) => {
     if (subscribedIntegrationContextAgentIds === targetSet) {