@integrity-labs/agt-cli 0.28.663 → 0.28.665

package/dist/{claude-pair-runtime-36KWLDV6.js → claude-pair-runtime-XSUQMCIQ.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-Z2CPEN6A.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-SQWO4TKG.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-36KWLDV6.js.map
+//# sourceMappingURL=claude-pair-runtime-XSUQMCIQ.js.map

package/dist/lib/manager-worker.js

@@ -55,7 +55,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-I7R5DFBQ.js";
+} from "../chunk-FQUJWSWQ.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -111,7 +111,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-ZHLGAOYL.js";
+} from "../chunk-EX5XJEGF.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -192,7 +192,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-MRHKXV7D.js";
+} from "../chunk-FYZOD3SS.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -10651,7 +10651,7 @@ function stopRealtimeIntegrationContext() {
   integrationContextChannel = null;
 }
 function startRealtimeTokenRotation(config2) {
-  const { agentIds, onTokenRotated, onSubscriptionLost, log: log2 } = config2;
+  const { agentIds, onTokenRotated, onSubscriptionLost, onSubscribed, log: log2 } = config2;
   if (agentIds.length === 0) return;
   stopRealtimeTokenRotation();
   const epoch = ++tokenRotationEpoch;
@@ -10677,7 +10677,9 @@ function startRealtimeTokenRotation(config2) {
       if (status === "CLOSED" || status === "CHANNEL_ERROR" || status === "TIMED_OUT") {
         log2(`[realtime] Token rotation channel for agent ${agentId}: ${status}`);
         onSubscriptionLost?.(agentId, status);
+        return;
       }
+      if (status === "SUBSCRIBED") onSubscribed?.(agentId);
     });
     tokenRotationChannels.push(channel);
   }
@@ -11609,7 +11611,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-I3MCPV3Z.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-RWMERSER.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname10(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -12219,6 +12221,7 @@ function resolveAgentFramework(codeName) {
 function clearAgentCaches(agentId, codeName) {
   const channelCacheMutated = clearAgentState(agentId, codeName);
   agentChannelTokens.delete(codeName);
+  forgetRealtimeRebindState(agentId);
   forgetChannelSyncState(agentId);
   sharedBusyBuckets.reset(codeName);
   stopOpencodeSlackIngest(codeName, log);
@@ -12253,7 +12256,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.663" : "dev";
+var agtCliVersion = true ? "0.28.665" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13617,7 +13620,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-Z2CPEN6A.js");
+      const { collectDiagnostics } = await import("../persistent-session-SQWO4TKG.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -13733,7 +13736,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-Z2CPEN6A.js");
+      const { collectDiagnostics } = await import("../persistent-session-SQWO4TKG.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor) : void 0;
       let tailscaleHostname;
@@ -13820,6 +13823,19 @@ async function pollCycleInner() {
         // close a resolved alert on the edge. Omitting it when empty would make
         // "recovered" and "this CLI is too old to report" the same wire value.
         channel_sync_stuck: stuckChannelSyncs(channelSyncFailures, Date.now()),
+        // ENG-9265: agents whose realtime token-rotation subscription has been
+        // failing to bind for longer than the stuck threshold. Same contract as
+        // the field above — ALWAYS sent, including as an empty array, because
+        // that is what lets the API close a resolved alert on the edge. An
+        // absent field means an older CLI that cannot report; an empty one is
+        // the affirmative all-clear.
+        //
+        // This is the ask that matters most on the ticket. A manager churning
+        // subscriptions every tick for half an hour produced NO signal of its
+        // own; the only alert was the host going silent, by which point four
+        // customer agents had been dark for three minutes. Bounding the retry
+        // without this would fix the CPU and leave the blindness.
+        realtime_rebind_stuck: stuckRealtimeRebinds(realtimeRebindFailures, Date.now()),
         // ENG-6251: capability advertisement — the flags schema version this
         // CLI compiled with, so the admin UI can show flip reach across a
         // mixed-CLI fleet (an older CLI sends an older fingerprint).
@@ -13872,7 +13888,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-I3MCPV3Z.js");
+      } = await import("../responsiveness-probe-RWMERSER.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -13982,7 +13998,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-I3MCPV3Z.js");
+        } = await import("../responsiveness-probe-RWMERSER.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14138,7 +14154,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-XHOOI7MT.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-OOWR5BPI.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -17643,6 +17659,69 @@ var realtimeStarted = false;
 var realtimeDriftStarted = false;
 var realtimeKanbanStarted = false;
 var subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
+var realtimeRebindFailures = /* @__PURE__ */ new Map();
+var REALTIME_REBIND_FREE_ATTEMPTS = 2;
+var REALTIME_REBIND_MAX_BACKOFF_MS = 5 * 6e4;
+var REALTIME_REBIND_STUCK_AFTER_MS = 5 * 6e4;
+var REALTIME_REBIND_IN_FLIGHT_GRACE_MS = 15e3;
+function realtimeRebindBackoffMs(attempts) {
+  if (attempts <= REALTIME_REBIND_FREE_ATTEMPTS) return 0;
+  const step = attempts - REALTIME_REBIND_FREE_ATTEMPTS;
+  return Math.min(1e4 * 2 ** (step - 1), REALTIME_REBIND_MAX_BACKOFF_MS);
+}
+function recordRealtimeRebindFailure(failures, agentId, status, now) {
+  const prior = failures.get(agentId);
+  const attempts = (prior?.attempts ?? 0) + 1;
+  const next = {
+    attempts,
+    since: prior?.since ?? now,
+    lastStatus: status,
+    loggedAtAttempt: prior?.loggedAtAttempt ?? 0,
+    nextAttemptAt: now + realtimeRebindBackoffMs(attempts)
+  };
+  failures.set(agentId, next);
+  return next;
+}
+function realtimeRebindDue(failures, now) {
+  for (const state8 of failures.values()) if (now >= state8.nextAttemptAt) return true;
+  return false;
+}
+function stuckRealtimeRebinds(failures, now, thresholdMs = REALTIME_REBIND_STUCK_AFTER_MS) {
+  const out = [];
+  for (const [agentId, state8] of failures) {
+    const stuckForMs = now - state8.since;
+    if (stuckForMs < thresholdMs) continue;
+    out.push({
+      agent_id: agentId,
+      attempts: state8.attempts,
+      stuck_for_seconds: Math.floor(stuckForMs / 1e3),
+      status: state8.lastStatus
+    });
+  }
+  out.sort((a, b) => b.stuck_for_seconds - a.stuck_for_seconds);
+  return out;
+}
+function forgetRealtimeRebindState(agentId) {
+  realtimeRebindFailures.delete(agentId);
+}
+function pruneRealtimeRebindState(failures, liveAgentIds) {
+  const live = liveAgentIds instanceof Set ? liveAgentIds : new Set(liveAgentIds);
+  let dropped = 0;
+  for (const agentId of [...failures.keys()]) {
+    if (!live.has(agentId)) {
+      failures.delete(agentId);
+      dropped++;
+    }
+  }
+  return dropped;
+}
+function holdRealtimeRebindInFlight(failures, agentIds, now, graceMs = REALTIME_REBIND_IN_FLIGHT_GRACE_MS) {
+  const until = now + graceMs;
+  for (const agentId of agentIds) {
+    const state8 = failures.get(agentId);
+    if (state8) state8.nextAttemptAt = Math.max(state8.nextAttemptAt, until);
+  }
+}
 var realtimeAssignStarted = false;
 var realtimeConfigStarted = false;
 var realtimeSubscribedAgentIds = /* @__PURE__ */ new Set();
@@ -17812,7 +17891,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-Z2CPEN6A.js");
+        const { collectDiagnostics } = await import("../persistent-session-SQWO4TKG.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17863,7 +17942,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-Z2CPEN6A.js");
+      const { collectDiagnostics } = await import("../persistent-session-SQWO4TKG.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -18008,6 +18087,12 @@ function activeAgentIdSetsEqual(current, previous) {
 }
 function ensureRealtimeIntegrationContextStarted(agentStates) {
   const activeAgentIds = agentStates.filter((a) => a.status === "active").map((a) => a.agentId);
+  if (realtimeRebindFailures.size > 0) {
+    const dropped = pruneRealtimeRebindState(realtimeRebindFailures, activeAgentIds);
+    if (dropped > 0) {
+      log(`[realtime] Dropped ${dropped} token-rotation rebind streak(s) for no-longer-active agent(s) (ENG-9265)`);
+    }
+  }
   if (activeAgentIds.length === 0) {
     if (subscribedIntegrationContextAgentIds.size > 0) {
       stopRealtimeIntegrationContext();
@@ -18017,6 +18102,9 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
     }
     return;
   }
+  if (realtimeRebindFailures.size > 0 && realtimeRebindDue(realtimeRebindFailures, Date.now()) && subscribedIntegrationContextAgentIds.size > 0) {
+    subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
+  }
   if (activeAgentIdSetsEqual(activeAgentIds, subscribedIntegrationContextAgentIds)) return;
   const apiKey = process.env["AGT_API_KEY"];
   if (!apiKey) return;
@@ -18027,6 +18115,9 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
   }
   const targetSet = new Set(activeAgentIds);
   subscribedIntegrationContextAgentIds = targetSet;
+  if (realtimeRebindFailures.size > 0) {
+    holdRealtimeRebindInFlight(realtimeRebindFailures, targetSet, Date.now());
+  }
   void exchangeApiKey(apiKey).then((exchange) => {
     if (subscribedIntegrationContextAgentIds !== targetSet) return;
     if (!exchange.supabaseUrl || !exchange.supabaseAnonKey) {
@@ -18061,9 +18152,31 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
           `integration token rotated for agent ${agentId} (integration ${event.integration_id}, ${event.definition_id})`
         );
       },
+      onSubscribed: (agentId) => {
+        const ended = realtimeRebindFailures.get(agentId);
+        if (!ended) return;
+        realtimeRebindFailures.delete(agentId);
+        const stuckForSeconds = Math.floor((Date.now() - ended.since) / 1e3);
+        log(
+          `[realtime] Token rotation subscription for agent ${agentId} recovered after ${ended.attempts} failed attempt(s) over ${stuckForSeconds}s (ENG-9265)`
+        );
+      },
       onSubscriptionLost: (agentId, status) => {
-        log(`[realtime] Token rotation subscription lost for agent ${agentId} (${status}) \u2014 will rebind next tick`);
-        subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
+        const state8 = recordRealtimeRebindFailure(
+          realtimeRebindFailures,
+          agentId,
+          status,
+          Date.now()
+        );
+        const waitMs = realtimeRebindBackoffMs(state8.attempts);
+        if (state8.attempts === 1 || state8.attempts > state8.loggedAtAttempt) {
+          state8.loggedAtAttempt = state8.attempts;
+          const stuckForSeconds = Math.floor((Date.now() - state8.since) / 1e3);
+          log(
+            `[realtime] Token rotation subscription lost for agent ${agentId} (${status}) \u2014 attempt ${state8.attempts}, stuck ${stuckForSeconds}s, next rebind in ${Math.round(waitMs / 1e3)}s (ENG-9265)`
+          );
+        }
+        if (waitMs === 0) subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
       },
       log
     });
@@ -18460,7 +18573,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-36KWLDV6.js");
+  } = await import("../claude-pair-runtime-XSUQMCIQ.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -19432,6 +19545,10 @@ export {
   DAY_ROLLOVER_FORCE_GRACE_MIN,
   DAY_ROLLOVER_INBOUND_DEFER_MAX_MIN,
   DAY_ROLLOVER_INBOUND_GRACE_SEC,
+  REALTIME_REBIND_FREE_ATTEMPTS,
+  REALTIME_REBIND_IN_FLIGHT_GRACE_MS,
+  REALTIME_REBIND_MAX_BACKOFF_MS,
+  REALTIME_REBIND_STUCK_AFTER_MS,
   UntrustworthyToolkitResponseError,
   applyRestartAcks,
   cancelKanbanNoticeOnDrain,
@@ -19451,7 +19568,9 @@ export {
   extractCharterTelegramPeers,
   fetchManagedToolkits,
   forgetChannelSyncState,
+  forgetRealtimeRebindState,
   hasRevokedResiduals,
+  holdRealtimeRebindInFlight,
   inboundHoldMinutes,
   isOlderSemverTuple,
   isPrereleaseVersion,
@@ -19459,7 +19578,11 @@ export {
   maybeInjectKanbanCheck,
   maybeProbeClaudeRuntimeAuth,
   maybeUpgradeClaudeCode,
+  pruneRealtimeRebindState,
+  realtimeRebindBackoffMs,
+  realtimeRebindDue,
   recordChannelSyncFailure,
+  recordRealtimeRebindFailure,
   refreshSkillsIndexInClaudeMd,
   reorderRestartedFirst,
   resolveManagedMcpServerId,
@@ -19474,6 +19597,7 @@ export {
   startManager,
   stopManager,
   stuckChannelSyncs,
+  stuckRealtimeRebinds,
   supersededRuntimeImageIds
 };
 //# sourceMappingURL=manager-worker.js.map