@integrity-labs/agt-cli 0.28.617 → 0.28.618

package/dist/{claude-pair-runtime-QCL2TB6N.js → claude-pair-runtime-3356FFTC.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-GM3EH2ZU.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-AGPLISL3.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-QCL2TB6N.js.map
+//# sourceMappingURL=claude-pair-runtime-3356FFTC.js.map

package/dist/lib/manager-worker.js

@@ -34,6 +34,7 @@ import {
   liveProxyTokenVars,
   markQuarantinedForProbe,
   migrateAgentDirToIdKeyed,
+  mintAgentKey,
   pinAllowsUrgent,
   provision,
   provisionAutoKanbanProgressHook,
@@ -53,7 +54,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-NJHZL7CZ.js";
+} from "../chunk-CKCXOIN3.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -109,7 +110,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-6SJJM4FT.js";
+} from "../chunk-RXC3MTSN.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -186,7 +187,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-TYVQNCBU.js";
+} from "../chunk-P6KFZVKA.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -4696,6 +4697,13 @@ function classifyPollError(message) {
   return "other";
 }
 
+// src/lib/per-agent-key.ts
+async function resolvePerAgentApiKey(opts) {
+  const isPool = opts.hostKind === "pool";
+  if (!isPool && !opts.dedicatedEnabled) return null;
+  return await opts.mint(opts.rawHostKey, opts.agentId);
+}
+
 // src/lib/integration-context-render.ts
 var PLUGIN_CONTEXT_PLACEHOLDER_RE = /\{\{\s*context\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
 var TEAM_OVERRIDES_HEADER = "## Team Overrides\n\n> **The following overrides anything you've read above.** If any rule here conflicts with earlier instructions in this skill, follow what is written here. These are user-supplied directives that take precedence over the plugin's default guidance.\n";
@@ -11330,7 +11338,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-VSSJC3MN.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-ITYPPSHM.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname9(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -11969,7 +11977,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.617" : "dev";
+var agtCliVersion = true ? "0.28.618" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13276,7 +13284,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-GM3EH2ZU.js");
+      const { collectDiagnostics } = await import("../persistent-session-AGPLISL3.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -13392,7 +13400,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-GM3EH2ZU.js");
+      const { collectDiagnostics } = await import("../persistent-session-AGPLISL3.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor) : void 0;
       let tailscaleHostname;
@@ -13515,7 +13523,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-VSSJC3MN.js");
+      } = await import("../responsiveness-probe-ITYPPSHM.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -13621,7 +13629,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-VSSJC3MN.js");
+        } = await import("../responsiveness-probe-ITYPPSHM.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -13777,7 +13785,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-KOKVXPPQ.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-Y6ABNWNM.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -16659,6 +16667,8 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   let claudeAuthMode;
   let anthropicApiKey;
   let anthropicApiKeyFingerprint;
+  let hostKind = null;
+  let rawHostKey = null;
   try {
     const apiKey = getApiKey();
     if (!apiKey) {
@@ -16673,6 +16683,8 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     claudeAuthMode = exchange.claudeAuthMode;
     anthropicApiKey = exchange.anthropicApiKey;
     anthropicApiKeyFingerprint = exchange.anthropicApiKeyFingerprint;
+    hostKind = exchange.hostKind;
+    rawHostKey = apiKey;
   } catch (err) {
     const msg = err.message;
     const healthyBefore = isSessionHealthy(codeName);
@@ -16923,6 +16935,37 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash17("sha256")
       refreshData.tools?.raw_content
     );
     egressAllowlistBySession.set(codeName, egressAllowlist);
+    let perAgentApiKey = null;
+    try {
+      perAgentApiKey = await resolvePerAgentApiKey({
+        hostKind,
+        // Non-null on every path that reaches here: the auth block above returns
+        // 'skipped-no-api-key' when getApiKey() is empty. `?? ''` keeps the types
+        // honest without inventing a fallback credential — an empty key cannot
+        // authenticate the mint, so it fails closed like any other bad key.
+        rawHostKey: rawHostKey ?? "",
+        agentId: agent.agent_id,
+        dedicatedEnabled: hostFlagStore().getBoolean("per-agent-host-credentials"),
+        mint: mintAgentKey
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      log(
+        `[persistent-session] '${codeName}' (host_kind=${hostKind ?? "dedicated"}): per-agent key mint FAILED (${msg}) \u2014 refusing to spawn rather than fall back to the shared host key`
+      );
+      closeSessionRunForCode(codeName, "failed", "per-agent key mint failed");
+      return {
+        decision: "skipped-per-agent-key-mint-failed",
+        spawnAttempted: false,
+        sessionHealthyAfter: isSessionHealthy(codeName),
+        detail: msg
+      };
+    }
+    if (perAgentApiKey) {
+      log(
+        `[persistent-session] '${codeName}' (host_kind=${hostKind ?? "dedicated"}): injecting per-agent org-scoped key (ADR-0042 pt3b)`
+      );
+    }
     startPersistentSession({
       codeName,
       agentId: agent.agent_id,
@@ -16971,6 +17014,9 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash17("sha256")
       // this the flip reaches nothing running under Docker isolation.
       turnFailureNoticeEnabled: hostFlagStore().getBoolean("wedge-transient-notice"),
       egressAllowlist,
+      // ADR-0042 pt3b (ENG-7607 / ENG-8992): this agent's own org-scoped key
+      // (null when unarmed). The spawn env carries it as this agent's AGT_API_KEY.
+      perAgentApiKey,
       log
     });
     agentState.persistentSessionAgents.add(codeName);
@@ -17266,7 +17312,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-GM3EH2ZU.js");
+        const { collectDiagnostics } = await import("../persistent-session-AGPLISL3.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17317,7 +17363,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-GM3EH2ZU.js");
+      const { collectDiagnostics } = await import("../persistent-session-AGPLISL3.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17913,7 +17959,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-QCL2TB6N.js");
+  } = await import("../claude-pair-runtime-3356FFTC.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));