@integrity-labs/agt-cli 0.28.596 → 0.28.598

package/dist/{claude-pair-runtime-5WB2FMIX.js → claude-pair-runtime-7CNOVI5H.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-BGMQQYW2.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-5VAAQJQA.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-5WB2FMIX.js.map
+//# sourceMappingURL=claude-pair-runtime-7CNOVI5H.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-EAZQXZ4Q.js";
+} from "../chunk-TJUR7PJ5.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -109,7 +109,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-6NVRWZ5W.js";
+} from "../chunk-4E3L4U34.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -186,7 +186,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-3PNRUCHD.js";
+} from "../chunk-6EBAJFLZ.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -10041,6 +10041,8 @@ var assignChannel = null;
 var configChannel = null;
 var kanbanChannel = null;
 var integrationContextChannel = null;
+var tokenRotationChannels = [];
+var tokenRotationEpoch = 0;
 var connected = false;
 var tearingDown = false;
 function ensureClient(config2) {
@@ -10086,6 +10088,7 @@ function startRealtimeChat(config2) {
       configChannel = null;
       kanbanChannel = null;
       integrationContextChannel = null;
+      tokenRotationChannels = [];
       if (client) {
         try {
           client.removeAllChannels();
@@ -10334,6 +10337,49 @@ function stopRealtimeIntegrationContext() {
   }
   integrationContextChannel = null;
 }
+function startRealtimeTokenRotation(config2) {
+  const { agentIds, onTokenRotated, onSubscriptionLost, log: log2 } = config2;
+  if (agentIds.length === 0) return;
+  stopRealtimeTokenRotation();
+  const epoch = ++tokenRotationEpoch;
+  const sb = ensureClient(config2);
+  for (const agentId of agentIds) {
+    const topic = `token-rotated-agent:${agentId}`;
+    const channel = sb.channel(topic, { config: { private: true } }).on("broadcast", { event: "token.rotated" }, (message) => {
+      const payload = message.payload;
+      if (!payload || typeof payload.integration_id !== "string" || payload.integration_id.length === 0) {
+        log2(`[realtime] token.rotated for agent ${agentId} ignored \u2014 no integration_id in payload`);
+        return;
+      }
+      log2(
+        `[realtime] token.rotated for agent ${agentId} (integration ${payload.integration_id}, ${payload.definition_id ?? "unknown provider"})`
+      );
+      onTokenRotated(agentId, {
+        integration_id: payload.integration_id,
+        definition_id: typeof payload.definition_id === "string" ? payload.definition_id : "unknown",
+        rotated_at: typeof payload.rotated_at === "string" ? payload.rotated_at : (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }).subscribe((status) => {
+      if (epoch !== tokenRotationEpoch) return;
+      if (status === "CLOSED" || status === "CHANNEL_ERROR" || status === "TIMED_OUT") {
+        log2(`[realtime] Token rotation channel for agent ${agentId}: ${status}`);
+        onSubscriptionLost?.(agentId, status);
+      }
+    });
+    tokenRotationChannels.push(channel);
+  }
+  log2(`[realtime] Subscribing to token.rotated for ${agentIds.length} agent(s)`);
+}
+function stopRealtimeTokenRotation() {
+  tokenRotationEpoch += 1;
+  for (const channel of tokenRotationChannels) {
+    try {
+      channel.unsubscribe();
+    } catch {
+    }
+  }
+  tokenRotationChannels = [];
+}
 function isRealtimeConnected() {
   return connected;
 }
@@ -10393,6 +10439,13 @@ function stopRealtimeChat() {
       }
       integrationContextChannel = null;
     }
+    for (const ch of tokenRotationChannels) {
+      try {
+        ch.unsubscribe();
+      } catch {
+      }
+    }
+    tokenRotationChannels = [];
     if (client) {
       try {
         client.removeAllChannels();
@@ -11827,7 +11880,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.596" : "dev";
+var agtCliVersion = true ? "0.28.598" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13134,7 +13187,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-BGMQQYW2.js");
+      const { collectDiagnostics } = await import("../persistent-session-5VAAQJQA.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -13242,7 +13295,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-BGMQQYW2.js");
+      const { collectDiagnostics } = await import("../persistent-session-5VAAQJQA.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor) : void 0;
       let tailscaleHostname;
@@ -13365,7 +13418,7 @@ async function pollCycle() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-VAGPO5FZ.js");
+      } = await import("../responsiveness-probe-AZKD6KEV.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -13456,7 +13509,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-VAGPO5FZ.js");
+        } = await import("../responsiveness-probe-AZKD6KEV.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -13612,7 +13665,7 @@ async function pollCycle() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-CWFGB472.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-5VN6KL6H.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -17040,7 +17093,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-BGMQQYW2.js");
+        const { collectDiagnostics } = await import("../persistent-session-5VAAQJQA.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17091,7 +17144,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-BGMQQYW2.js");
+      const { collectDiagnostics } = await import("../persistent-session-5VAAQJQA.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17239,8 +17292,9 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
   if (activeAgentIds.length === 0) {
     if (subscribedIntegrationContextAgentIds.size > 0) {
       stopRealtimeIntegrationContext();
+      stopRealtimeTokenRotation();
       subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
-      log("[realtime] Integration context subscription torn down (no active agents)");
+      log("[realtime] Integration context + token rotation subscriptions torn down (no active agents)");
     }
     return;
   }
@@ -17250,6 +17304,7 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
   const isResubscribe = subscribedIntegrationContextAgentIds.size > 0;
   if (isResubscribe) {
     stopRealtimeIntegrationContext();
+    stopRealtimeTokenRotation();
   }
   const targetSet = new Set(activeAgentIds);
   subscribedIntegrationContextAgentIds = targetSet;
@@ -17277,8 +17332,24 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
       },
       log
     });
+    startRealtimeTokenRotation({
+      supabaseUrl: exchange.supabaseUrl,
+      supabaseAnonKey: exchange.supabaseAnonKey,
+      token: exchange.token,
+      agentIds: [...targetSet],
+      onTokenRotated: (agentId, event) => {
+        triggerEarlyPoll(
+          `integration token rotated for agent ${agentId} (integration ${event.integration_id}, ${event.definition_id})`
+        );
+      },
+      onSubscriptionLost: (agentId, status) => {
+        log(`[realtime] Token rotation subscription lost for agent ${agentId} (${status}) \u2014 will rebind next tick`);
+        subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
+      },
+      log
+    });
     log(
-      `[realtime] Integration context subscription ${isResubscribe ? "re-bound" : "started"} for ${targetSet.size} agent(s)`
+      `[realtime] Integration context + token rotation subscriptions ${isResubscribe ? "re-bound" : "started"} for ${targetSet.size} agent(s)`
     );
   }).catch((err) => {
     if (subscribedIntegrationContextAgentIds === targetSet) {
@@ -17669,7 +17740,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-5WB2FMIX.js");
+  } = await import("../claude-pair-runtime-7CNOVI5H.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));