@integrity-labs/agt-cli 0.28.661 → 0.28.662

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-WDCI3FYP.js";
+} from "../chunk-77YTVCXK.js";
 import {
   readDirectChatSessionState
 } from "../chunk-5JAUM7J2.js";
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.661" : "dev";
+var cliVersion = true ? "0.28.662" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.661" : "dev";
+var cliVersion2 = true ? "0.28.662" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-WDCI3FYP.js → chunk-77YTVCXK.js}

@@ -6342,7 +6342,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.661" : "dev";
+var agtCliVersion = true ? "0.28.662" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10084,4 +10084,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-WDCI3FYP.js.map
+//# sourceMappingURL=chunk-77YTVCXK.js.map

package/dist/lib/manager-worker.js

@@ -55,7 +55,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-WDCI3FYP.js";
+} from "../chunk-77YTVCXK.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -12219,6 +12219,7 @@ function resolveAgentFramework(codeName) {
 function clearAgentCaches(agentId, codeName) {
   const channelCacheMutated = clearAgentState(agentId, codeName);
   agentChannelTokens.delete(codeName);
+  forgetChannelSyncState(agentId);
   sharedBusyBuckets.reset(codeName);
   stopOpencodeSlackIngest(codeName, log);
   stopOpencodeTelegramIngest(codeName, log);
@@ -12252,7 +12253,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.661" : "dev";
+var agtCliVersion = true ? "0.28.662" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13355,6 +13356,60 @@ function saveChannelHashCache2() {
 }
 var channelWriteFailureCounts = /* @__PURE__ */ new Map();
 var CHANNEL_WRITE_FAILURE_ESCALATE_EVERY = 90;
+var channelSyncFailures = /* @__PURE__ */ new Map();
+var channelSyncAttemptedSets = /* @__PURE__ */ new Map();
+function sameChannelSet(a, b) {
+  if (a === void 0) return false;
+  if (a.size !== b.size) return false;
+  for (const v of b) if (!a.has(v)) return false;
+  return true;
+}
+function forgetChannelSyncState(agentId) {
+  channelSyncFailures.delete(agentId);
+  channelSyncAttemptedSets.delete(agentId);
+}
+var CHANNEL_SYNC_FREE_ATTEMPTS = 3;
+var CHANNEL_SYNC_MAX_BACKOFF_MS = 5 * 6e4;
+var CHANNEL_SYNC_STUCK_AFTER_MS = 10 * 6e4;
+function channelSyncBackoffMs(attempts) {
+  if (attempts <= CHANNEL_SYNC_FREE_ATTEMPTS) return 0;
+  const step = attempts - CHANNEL_SYNC_FREE_ATTEMPTS;
+  const delay = 1e4 * 2 ** (step - 1);
+  return Math.min(delay, CHANNEL_SYNC_MAX_BACKOFF_MS);
+}
+function recordChannelSyncFailure(failures, agentId, reason, now) {
+  const prior = failures.get(agentId);
+  const attempts = (prior?.attempts ?? 0) + 1;
+  const next = {
+    attempts,
+    since: prior?.since ?? now,
+    lastReason: reason,
+    loggedAtAttempt: prior?.loggedAtAttempt ?? 0,
+    nextAttemptAt: now + channelSyncBackoffMs(attempts)
+  };
+  failures.set(agentId, next);
+  return next;
+}
+function shouldLogChannelSyncFailure(state8) {
+  if (state8.attempts === 1) return true;
+  if (state8.attempts <= CHANNEL_SYNC_FREE_ATTEMPTS) return false;
+  return state8.attempts > state8.loggedAtAttempt;
+}
+function stuckChannelSyncs(failures, now, thresholdMs = CHANNEL_SYNC_STUCK_AFTER_MS) {
+  const out = [];
+  for (const [agentId, state8] of failures) {
+    const stuckForMs = now - state8.since;
+    if (stuckForMs < thresholdMs) continue;
+    out.push({
+      agent_id: agentId,
+      attempts: state8.attempts,
+      stuck_for_seconds: Math.floor(stuckForMs / 1e3),
+      reason: state8.lastReason
+    });
+  }
+  out.sort((a, b) => b.stuck_for_seconds - a.stuck_for_seconds);
+  return out;
+}
 var persistedDeliveryBaseline = createDeliveryBaselineMaps();
 function loadSenderPolicyBaseline2() {
   loadSenderPolicyBaseline(persistedDeliveryBaseline, channelHashCacheDir(), log);
@@ -13749,6 +13804,22 @@ async function pollCycleInner() {
         // Omitted (undefined) on hosts that haven't run the assertion
         // (non-claude-code frameworks).
         channels_setting_status: lastManagedSettingsStatus ?? void 0,
+        // ENG-9252: agents whose channel credential sync has failed to converge
+        // for longer than CHANNEL_SYNC_STUCK_AFTER_MS. The API opens/closes a
+        // per-agent alert on the edge, exactly as it does for
+        // `channels_setting_status` above.
+        //
+        // This field is the whole point of the ticket. The retry loop it
+        // reports on ran for over three hours on a customer host and raised
+        // NOTHING: non-convergence moves no heartbeat, no session-health signal
+        // and no restart counter, so every projection an operator would consult
+        // read healthy while the manager span. A bounded retry that is still
+        // silent would have fixed the CPU and left the invisibility.
+        //
+        // ALWAYS SENT, including as an empty array — that is what lets the API
+        // close a resolved alert on the edge. Omitting it when empty would make
+        // "recovered" and "this CLI is too old to report" the same wire value.
+        channel_sync_stuck: stuckChannelSyncs(channelSyncFailures, Date.now()),
         // ENG-6251: capability advertisement — the flags schema version this
         // CLI compiled with, so the admin UI can show flip reach across a
         // mixed-CLI fleet (an older CLI sends an older fingerprint).
@@ -14678,6 +14749,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
   const adapter = resolveAgentFramework(agent.code_name);
   let agentDir = join36(adapter.getAgentDir(agent.code_name), "provision");
   if (agent.status === "draft" || agent.status === "paused") {
+    forgetChannelSyncState(agent.agent_id);
     if (previousKnownStatus !== agent.status) {
       log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
     }
@@ -14881,6 +14953,14 @@ async function processAgent(agent, agentStates, managedToolkits) {
   const previousChannelIds = agentState.knownChannels.get(agent.agent_id);
   const channelsChanged = !previousChannelIds || currentChannelIds.size !== previousChannelIds.size || [...currentChannelIds].some((ch) => !previousChannelIds.has(ch)) || [...previousChannelIds].some((ch) => !currentChannelIds.has(ch));
   let channelConfigConverged = true;
+  let channelConfigFailureReason = "";
+  const attemptedChannelIds = channelSyncAttemptedSets.get(agent.agent_id);
+  const channelSetChangedSinceAttempt = !sameChannelSet(attemptedChannelIds, currentChannelIds);
+  if (attemptedChannelIds !== void 0 && channelSetChangedSinceAttempt && channelSyncFailures.delete(agent.agent_id)) {
+    log(
+      `[channels] channel set changed for '${agent.code_name}' since the last attempt \u2014 clearing the credential-sync backoff and retrying immediately (ENG-9252)`
+    );
+  }
   if (previousChannelIds && channelsChanged && frameworkAdapter.removeChannelCredentials) {
     for (const ch of previousChannelIds) {
       if (!currentChannelIds.has(ch)) {
@@ -14889,6 +14969,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
           log(`Removed ${ch} credentials for '${agent.code_name}'`);
         } catch (err) {
           channelConfigConverged = false;
+          channelConfigFailureReason = `removing ${ch} credentials threw: ${err.message}`;
           log(`Failed to remove ${ch} credentials for '${agent.code_name}': ${err.message}`);
         }
       }
@@ -15152,7 +15233,12 @@ async function processAgent(agent, agentStates, managedToolkits) {
       agentChannelTokens.delete(agent.code_name);
     }
   }
-  if (refreshData.channel_configs && frameworkAdapter.writeChannelCredentials) {
+  const channelSyncBackoff = channelSyncFailures.get(agent.agent_id);
+  const channelSyncDeferred = channelSyncBackoff !== void 0 && Date.now() < channelSyncBackoff.nextAttemptAt;
+  if (!channelSyncDeferred) {
+    channelSyncAttemptedSets.set(agent.agent_id, new Set(currentChannelIds));
+  }
+  if (refreshData.channel_configs && frameworkAdapter.writeChannelCredentials && !channelSyncDeferred) {
     if (agent.status === "active") {
       for (const [channelId, entry] of Object.entries(refreshData.channel_configs)) {
         if (quarantinedChannels.has(channelId)) {
@@ -15257,6 +15343,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
             const landed = frameworkAdapter.hasChannelCredentials?.(agent.code_name, channelId) ?? true;
             if (!landed) {
               channelConfigConverged = false;
+              channelConfigFailureReason = `credentials for ${channelId} reported a clean write but did not land on disk (reason=${reason}) \u2014 likely a missing credential field, or the guarded .mcp.json write was rejected by the secret lint / config validator`;
               const attempts = (channelWriteFailureCounts.get(cacheKey) ?? 0) + 1;
               channelWriteFailureCounts.set(cacheKey, attempts);
               if (attempts === 1 || attempts % CHANNEL_WRITE_FAILURE_ESCALATE_EVERY === 0) {
@@ -15274,6 +15361,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
             }
           } catch (err) {
             channelConfigConverged = false;
+            channelConfigFailureReason = `writing ${channelId} credentials threw: ${err.message}`;
             log(`Failed to write channel credentials for '${agent.code_name}/${channelId}': ${err.message}`);
           }
         }
@@ -15287,11 +15375,35 @@ async function processAgent(agent, agentStates, managedToolkits) {
     }
   }
   if (channelConfigConverged) {
-    agentState.knownChannels.set(agent.agent_id, currentChannelIds);
+    const ended = channelSyncFailures.get(agent.agent_id);
+    if (ended && !channelSyncDeferred) {
+      channelSyncFailures.delete(agent.agent_id);
+      const stuckForSeconds = Math.floor((Date.now() - ended.since) / 1e3);
+      log(
+        `[channels] Credential sync for '${agent.code_name}' converged after ${ended.attempts} failed attempt(s) over ${stuckForSeconds}s \u2014 recovered (ENG-9252)`
+      );
+    }
+    if (!channelSyncDeferred) {
+      agentState.knownChannels.set(agent.agent_id, currentChannelIds);
+    }
   } else {
-    log(`[channels] Credential sync did not converge for '${agent.code_name}' \u2014 leaving diff live for next tick retry`);
+    const state8 = recordChannelSyncFailure(
+      channelSyncFailures,
+      agent.agent_id,
+      channelConfigFailureReason || "reason not recorded",
+      Date.now()
+    );
+    if (shouldLogChannelSyncFailure(state8)) {
+      state8.loggedAtAttempt = state8.attempts;
+      const stuckForSeconds = Math.floor((Date.now() - state8.since) / 1e3);
+      const waitMs = channelSyncBackoffMs(state8.attempts);
+      log(
+        `[channels] Credential sync did not converge for '${agent.code_name}' \u2014 attempt ${state8.attempts}, stuck ${stuckForSeconds}s, next retry in ${Math.round(waitMs / 1e3)}s. Cause: ${state8.lastReason}. Diff left live (ENG-9252).`
+      );
+    }
   }
-  const restartDecision = channelConfigConverged ? decideChannelRestart({
+  const channelConfigConvergedThisTick = channelConfigConverged && !channelSyncDeferred;
+  const restartDecision = channelConfigConvergedThisTick ? decideChannelRestart({
     previousChannelIds,
     currentChannelIds,
     sessionMode: refreshData.agent.session_mode,
@@ -15343,7 +15455,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       writeDmNoticeMarkers
     );
   }
-  if (channelConfigConverged) {
+  if (channelConfigConvergedThisTick) {
     const hasSenderPolicyChannel = currentChannelIds.has("slack") || currentChannelIds.has("msteams");
     const senderPolicyForRestartHash = refreshData.sender_policy ?? null;
     const senderPolicyHash = computeSenderPolicyRestartHash(senderPolicyForRestartHash);
@@ -16376,7 +16488,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       } catch (err) {
         log(`[hot-reload] .mcp.json drift check failed for '${agent.code_name}': ${err.message}`);
       }
-      if (channelConfigConverged) {
+      if (channelConfigConvergedThisTick) {
         try {
           checkChannelSecretDriftAndScheduleRestart(agent.code_name, getProjectDir(agent.code_name));
         } catch (err) {
@@ -19314,12 +19426,16 @@ process.on("disconnect", () => {
 });
 export {
   BACK_ONLINE_GREETING_GUIDANCE,
+  CHANNEL_SYNC_FREE_ATTEMPTS,
+  CHANNEL_SYNC_MAX_BACKOFF_MS,
+  CHANNEL_SYNC_STUCK_AFTER_MS,
   DAY_ROLLOVER_FORCE_GRACE_MIN,
   DAY_ROLLOVER_INBOUND_DEFER_MAX_MIN,
   DAY_ROLLOVER_INBOUND_GRACE_SEC,
   UntrustworthyToolkitResponseError,
   applyRestartAcks,
   cancelKanbanNoticeOnDrain,
+  channelSyncBackoffMs,
   classifyLazyDayRolloverReset,
   claudeCodeUpgradeMarkerPath,
   claudeCodeUpgradeThrottled,
@@ -19334,6 +19450,7 @@ export {
   extractCharterSlackPeers,
   extractCharterTelegramPeers,
   fetchManagedToolkits,
+  forgetChannelSyncState,
   hasRevokedResiduals,
   inboundHoldMinutes,
   isOlderSemverTuple,
@@ -19342,10 +19459,13 @@ export {
   maybeInjectKanbanCheck,
   maybeProbeClaudeRuntimeAuth,
   maybeUpgradeClaudeCode,
+  recordChannelSyncFailure,
   refreshSkillsIndexInClaudeMd,
   reorderRestartedFirst,
   resolveManagedMcpServerId,
   restartReasonBindsNewMcp,
+  sameChannelSet,
+  shouldLogChannelSyncFailure,
   shouldReapOnRetag,
   shouldReportRestartToAudit,
   shouldSkipRevokedCleanup,
@@ -19353,6 +19473,7 @@ export {
   stampClaudeCodeUpgradeMarker,
   startManager,
   stopManager,
+  stuckChannelSyncs,
   supersededRuntimeImageIds
 };
 //# sourceMappingURL=manager-worker.js.map