@integrity-labs/agt-cli 0.28.657 → 0.28.659

package/dist/{claude-pair-runtime-3CYAS6UC.js → claude-pair-runtime-ODPRSH45.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-2W67OQUH.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-QVLWWFK3.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-3CYAS6UC.js.map
+//# sourceMappingURL=claude-pair-runtime-ODPRSH45.js.map

package/dist/lib/manager-worker.js

@@ -55,7 +55,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-PHIFSHBS.js";
+} from "../chunk-ACQZZIK6.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -111,7 +111,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-OBIOE63G.js";
+} from "../chunk-LUIGOCT4.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -192,7 +192,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-XUJIPPKF.js";
+} from "../chunk-NLCHGFD5.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -11609,7 +11609,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-44G7U6LR.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-NN4BNX2V.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname10(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -12252,7 +12252,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.657" : "dev";
+var agtCliVersion = true ? "0.28.659" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13562,7 +13562,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-2W67OQUH.js");
+      const { collectDiagnostics } = await import("../persistent-session-QVLWWFK3.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -13678,7 +13678,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-2W67OQUH.js");
+      const { collectDiagnostics } = await import("../persistent-session-QVLWWFK3.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor) : void 0;
       let tailscaleHostname;
@@ -13801,7 +13801,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-44G7U6LR.js");
+      } = await import("../responsiveness-probe-NN4BNX2V.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -13911,7 +13911,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-44G7U6LR.js");
+        } = await import("../responsiveness-probe-NN4BNX2V.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14067,7 +14067,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-TNWKYZIA.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-KD66YN7O.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -17700,7 +17700,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-2W67OQUH.js");
+        const { collectDiagnostics } = await import("../persistent-session-QVLWWFK3.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17751,7 +17751,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-2W67OQUH.js");
+      const { collectDiagnostics } = await import("../persistent-session-QVLWWFK3.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -18348,7 +18348,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-3CYAS6UC.js");
+  } = await import("../claude-pair-runtime-ODPRSH45.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/index.js

@@ -22373,7 +22373,6 @@ import {
   closeSync,
   constants as fsConstants,
   fstatSync,
-  lstatSync,
   openSync,
   readSync,
   realpathSync
@@ -22425,22 +22424,66 @@ function hostFilePathArg(toolName) {
 function allowedHostFileRoots(agentDir, path) {
   return [path.join(agentDir, "project"), path.join(agentDir, "scratch")];
 }
-function assertNoSymlinkComponents(target, roots, path, fs) {
+function openContained(target, roots, opts) {
+  const { path, fs, procFdBase } = opts;
+  if (!procFdBase) {
+    return {
+      ok: false,
+      error: "reading a host path needs descriptor-relative traversal (procfs), which this platform does not provide. Pass the content inline instead."
+    };
+  }
   const root = roots.find((r) => isContained(target, r, path.sep));
-  if (!root) return "resolved outside the allowed roots";
-  const rest = target.slice(root.length).split(path.sep).filter(Boolean);
-  let current = root;
-  for (const segment of rest) {
-    current = path.join(current, segment);
-    try {
-      if (fs.lstatSync(current).isSymbolicLink()) {
-        return `'${current}' is a symlink, so the path changed after it was resolved`;
+  if (!root) return { ok: false, error: "resolved outside the allowed roots" };
+  const segments = target.slice(root.length).split(path.sep).filter(Boolean);
+  const fileName = segments[segments.length - 1];
+  if (fileName === void 0) {
+    return { ok: false, error: `'${target}' is a directory, not a file` };
+  }
+  for (const segment of segments) {
+    if (segment === "." || segment === "..") {
+      return { ok: false, error: `'${target}' contains a '${segment}' component` };
+    }
+  }
+  const dirNames = segments.slice(0, -1);
+  let dirFd;
+  try {
+    dirFd = fs.openSync(root, opts.dirOpenFlags);
+  } catch (err) {
+    return { ok: false, error: `the allowed root '${root}' could not be opened \u2014 ${err.message}` };
+  }
+  try {
+    for (const name of dirNames) {
+      let nextFd;
+      try {
+        nextFd = fs.openSync(path.join(procFdBase, String(dirFd), name), opts.dirOpenFlags);
+      } catch (err) {
+        return {
+          ok: false,
+          error: `'${name}' could not be entered \u2014 it is a symlink, is not a directory, or was replaced mid-traversal (${err.message})`
+        };
+      }
+      try {
+        fs.closeSync(dirFd);
+      } catch {
       }
+      dirFd = nextFd;
+    }
+    let fd;
+    try {
+      fd = fs.openSync(path.join(procFdBase, String(dirFd), fileName), opts.openFlags);
+    } catch (err) {
+      return {
+        ok: false,
+        error: `'${fileName}' could not be opened (a symlink, or replaced mid-check) \u2014 ${err.message}`
+      };
+    }
+    return { ok: true, fd };
+  } finally {
+    try {
+      fs.closeSync(dirFd);
     } catch {
-      return `'${current}' could not be inspected`;
     }
   }
-  return null;
 }
 function isContained(candidate, root, sep2) {
   if (candidate === root) return true;
@@ -22483,24 +22526,9 @@ function resolveHostFilePath(toolName, args, opts) {
       error: `${spec.pathArg} resolves outside your own directories (symlink?). '${raw}' \u2192 '${real}'. Allowed: ${roots.join(", ")}`
     };
   }
-  const walkError = assertNoSymlinkComponents(real, roots, path, fs);
-  if (walkError) return { ok: false, error: `${spec.pathArg}: ${walkError}` };
-  let vetted = null;
-  try {
-    vetted = fs.lstatSync(real);
-  } catch {
-    return { ok: false, error: `${spec.pathArg} vanished before it could be read: '${raw}'` };
-  }
-  let fd;
-  try {
-    fd = fs.openSync(real, opts.openFlags);
-  } catch (err) {
-    const msg = err.message;
-    return {
-      ok: false,
-      error: `${spec.pathArg} could not be opened (it may have been replaced mid-check): '${raw}' \u2014 ${msg}`
-    };
-  }
+  const opened = openContained(real, roots, opts);
+  if (!opened.ok) return { ok: false, error: `${spec.pathArg}: ${opened.error} ('${raw}')` };
+  const fd = opened.fd;
   try {
     let stat;
     try {
@@ -22511,14 +22539,6 @@ function resolveHostFilePath(toolName, args, opts) {
     if (!stat.isFile()) {
       return { ok: false, error: `${spec.pathArg} is not a regular file: '${raw}'` };
     }
-    if (stat.ino !== void 0 && vetted.ino !== void 0) {
-      if (stat.ino !== vetted.ino || stat.dev !== vetted.dev) {
-        return {
-          ok: false,
-          error: `${spec.pathArg} changed identity between the check and the open (it was replaced): '${raw}'`
-        };
-      }
-    }
     if (stat.size > maxBytes) {
       return {
         ok: false,
@@ -44409,6 +44429,48 @@ server.tool(
     }
   }
 );
+server.tool(
+  "kanban_reopen",
+  "Send a card you assigned back to the agent that did the work, WITH your review feedback. Use this when you delegated a task with kanban_assign, the agent completed it, and you reviewed the delivery and found something wrong. The card reopens on THEIR board in todo carrying your feedback, and they are notified on the card itself. This is the only way your review reaches them: their card is not on your board, so notes you write on your own card are invisible to them, and opening a NEW card reframes a correction as fresh work and loses the link to what it corrected. You may only reopen a card YOU assigned, to somebody else, on your own team, that is finished (done or failed). You cannot reopen your own card this way - that would be a way around the rule that closed work stays closed; open a new card instead. BOUNDED: two reopens per card. A third means the two of you have not converged, and the answer to that is a human, not another round - raise it with yours.",
+  {
+    item_id: external_exports.string().describe("The card id, as returned by kanban_assign or shown on the completion notice."),
+    feedback: external_exports.string().trim().min(1, "feedback is required - a reopen with nothing attached just deletes a result nobody replaced").max(2e3, "feedback is too long - send the correction (the criterion, the file, the behaviour), not the whole review").describe(
+      'What is wrong and what you want changed. REQUIRED and it must say something - a reopen with nothing attached just deletes a result nobody replaced. Be specific enough to act on: name the acceptance criterion, the file, or the behaviour, not "needs work".'
+    )
+  },
+  async (params) => {
+    try {
+      const data = await apiPost("/host/kanban/reopen", {
+        agent_id: AGT_AGENT_ID,
+        item_id: params.item_id,
+        feedback: params.feedback
+      });
+      if (!data?.ok) {
+        const detail = data?.error ?? `Could not reopen that card (${data?.reason ?? "unknown"}).`;
+        return { content: [{ type: "text", text: detail }] };
+      }
+      const turns = data.is_last_turn ? " That was the last reopen this card allows - if it comes back wrong again, raise it with a human rather than sending it back." : "";
+      const delivery = data.notified ? " They have been notified on the card." : ` NOTE: the card reopened but the notification did NOT go out${data.notify_error ? ` (${data.notify_error})` : ""}, so they may not know yet - tell them directly.`;
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Reopened "${data.title ?? params.item_id}" on the assignee's board with your feedback (reopen ${data.reopen_count ?? 1} of 2).${delivery}${turns}`
+          }
+        ]
+      };
+    } catch (err) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Could not reopen that card: ${err instanceof Error ? err.message : String(err)}`
+          }
+        ]
+      };
+    }
+  }
+);
 server.tool(
   "kanban_recall",
   'Pull a card you assigned to a HUMAN teammate back onto your own board. Use this when a card shows under "Assigned to a person" in kanban_list and you need to act on it - typically because the person finished the work (or it is no longer needed) and the card has to be closed. While a card is assigned to a person, every kanban write to it is refused; recall makes it yours again so kanban_move / kanban_done / kanban_log work. Recall does NOT complete the card - after recalling, close it yourself with kanban_done and a result. You can only recall a card you assigned.',
@@ -45984,16 +46046,37 @@ async function forwardToolCall(toolName, args) {
       // symlink-resolved, so a symlink at the final component means it was
       // swapped after the check, and this turns that into an ELOOP.
       openFlags: fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW,
+      // ENG-9230. Each intermediate DIRECTORY is opened too, so the walk can be
+      // anchored to descriptors rather than pathnames. O_DIRECTORY alongside
+      // O_NOFOLLOW so a component that stopped being a directory is refused by
+      // the kernel rather than noticed later.
+      dirOpenFlags: fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_DIRECTORY,
+      // ENG-9230. Supplied ONLY on Linux, and its absence is load-bearing:
+      // `openContained` refuses outright rather than falling back to the
+      // pathname walk, because that walk is the vulnerability. On a platform
+      // without procfs the host-path shortcut is simply unavailable and the
+      // agent passes the content inline — slower, and safe.
+      //
+      // `process.platform` rather than probing for /proc: a probe would have to
+      // decide what a read failure means, and "cannot tell" would have to fail
+      // closed anyway. Agent hosts are Linux EC2; this is about local dev on
+      // macOS getting an honest refusal instead of a silent downgrade.
+      ...process.platform === "linux" ? { procFdBase: "/proc/self/fd" } : {},
       fs: {
         realpathSync,
         openSync,
         fstatSync,
         closeSync,
         // Bounded read straight off the descriptor: at most maxBytes + 1 bytes,
-        // so an oversize file is detected rather than buffered whole.
-        lstatSync,
-        // Raw bytes, decoded only after the byte-length check — see
-        // readFdSync's docblock in host-file-path.ts.
+        // so an oversize file is detected rather than buffered whole. Raw bytes,
+        // decoded only after the byte-length check — see readFdSync's docblock
+        // in host-file-path.ts.
+        //
+        // ENG-9230: `lstatSync` used to be injected here and is deliberately
+        // gone. Every remaining member of this seam takes a DESCRIPTOR except
+        // the two that cannot (realpath, and the single open of the allowed
+        // root); handing the resolver a pathname-based stat back would put the
+        // exploitable primitive within reach of the next change.
         readFdSync: (fd, maxBytes) => {
           const buf = Buffer.alloc(maxBytes + 1);
           let read = 0;
@@ -46043,6 +46126,8 @@ var LOCAL_TOOL_NAMES = /* @__PURE__ */ new Set([
   // ENG-8281: the inverse of assign_kanban_to_human — take a human-assigned
   // card back so the agent can finally close it.
   "kanban_recall",
+  // ENG-9050: the return path for delegated work.
+  "kanban_reopen",
   // ENG-6953: agent + people directory lookup (always registered locally).
   "directory_lookup",
   "status_standup",

package/dist/{persistent-session-2W67OQUH.js → persistent-session-QVLWWFK3.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-OBIOE63G.js";
-import "./chunk-XUJIPPKF.js";
+} from "./chunk-LUIGOCT4.js";
+import "./chunk-NLCHGFD5.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-2W67OQUH.js.map
+//# sourceMappingURL=persistent-session-QVLWWFK3.js.map

package/dist/{responsiveness-probe-44G7U6LR.js → responsiveness-probe-NN4BNX2V.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-OBIOE63G.js";
-import "./chunk-XUJIPPKF.js";
+} from "./chunk-LUIGOCT4.js";
+import "./chunk-NLCHGFD5.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -727,4 +727,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-44G7U6LR.js.map
+//# sourceMappingURL=responsiveness-probe-NN4BNX2V.js.map

package/dist/{session-auth-dead-TNWKYZIA.js → session-auth-dead-KD66YN7O.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-XUJIPPKF.js";
+} from "./chunk-NLCHGFD5.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-TNWKYZIA.js.map
+//# sourceMappingURL=session-auth-dead-KD66YN7O.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.657",
+  "version": "0.28.659",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {