@integrity-labs/agt-cli 0.28.664 → 0.28.666

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-DFGQKEVY.js";
+} from "../chunk-P7UIFZQO.js";
 import {
   readDirectChatSessionState
 } from "../chunk-EX5XJEGF.js";
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.664" : "dev";
+var cliVersion = true ? "0.28.666" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.664" : "dev";
+var cliVersion2 = true ? "0.28.666" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-DFGQKEVY.js → chunk-P7UIFZQO.js}

@@ -6342,7 +6342,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.664" : "dev";
+var agtCliVersion = true ? "0.28.666" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10084,4 +10084,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-DFGQKEVY.js.map
+//# sourceMappingURL=chunk-P7UIFZQO.js.map

package/dist/lib/manager-worker.js

@@ -55,7 +55,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-DFGQKEVY.js";
+} from "../chunk-P7UIFZQO.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -10651,7 +10651,7 @@ function stopRealtimeIntegrationContext() {
   integrationContextChannel = null;
 }
 function startRealtimeTokenRotation(config2) {
-  const { agentIds, onTokenRotated, onSubscriptionLost, log: log2 } = config2;
+  const { agentIds, onTokenRotated, onSubscriptionLost, onSubscribed, log: log2 } = config2;
   if (agentIds.length === 0) return;
   stopRealtimeTokenRotation();
   const epoch = ++tokenRotationEpoch;
@@ -10677,7 +10677,9 @@ function startRealtimeTokenRotation(config2) {
       if (status === "CLOSED" || status === "CHANNEL_ERROR" || status === "TIMED_OUT") {
         log2(`[realtime] Token rotation channel for agent ${agentId}: ${status}`);
         onSubscriptionLost?.(agentId, status);
+        return;
       }
+      if (status === "SUBSCRIBED") onSubscribed?.(agentId);
     });
     tokenRotationChannels.push(channel);
   }
@@ -12219,6 +12221,7 @@ function resolveAgentFramework(codeName) {
 function clearAgentCaches(agentId, codeName) {
   const channelCacheMutated = clearAgentState(agentId, codeName);
   agentChannelTokens.delete(codeName);
+  forgetRealtimeRebindState(agentId);
   forgetChannelSyncState(agentId);
   sharedBusyBuckets.reset(codeName);
   stopOpencodeSlackIngest(codeName, log);
@@ -12253,7 +12256,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.664" : "dev";
+var agtCliVersion = true ? "0.28.666" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13820,6 +13823,19 @@ async function pollCycleInner() {
         // close a resolved alert on the edge. Omitting it when empty would make
         // "recovered" and "this CLI is too old to report" the same wire value.
         channel_sync_stuck: stuckChannelSyncs(channelSyncFailures, Date.now()),
+        // ENG-9265: agents whose realtime token-rotation subscription has been
+        // failing to bind for longer than the stuck threshold. Same contract as
+        // the field above — ALWAYS sent, including as an empty array, because
+        // that is what lets the API close a resolved alert on the edge. An
+        // absent field means an older CLI that cannot report; an empty one is
+        // the affirmative all-clear.
+        //
+        // This is the ask that matters most on the ticket. A manager churning
+        // subscriptions every tick for half an hour produced NO signal of its
+        // own; the only alert was the host going silent, by which point four
+        // customer agents had been dark for three minutes. Bounding the retry
+        // without this would fix the CPU and leave the blindness.
+        realtime_rebind_stuck: stuckRealtimeRebinds(realtimeRebindFailures, Date.now()),
         // ENG-6251: capability advertisement — the flags schema version this
         // CLI compiled with, so the admin UI can show flip reach across a
         // mixed-CLI fleet (an older CLI sends an older fingerprint).
@@ -17643,6 +17659,69 @@ var realtimeStarted = false;
 var realtimeDriftStarted = false;
 var realtimeKanbanStarted = false;
 var subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
+var realtimeRebindFailures = /* @__PURE__ */ new Map();
+var REALTIME_REBIND_FREE_ATTEMPTS = 2;
+var REALTIME_REBIND_MAX_BACKOFF_MS = 5 * 6e4;
+var REALTIME_REBIND_STUCK_AFTER_MS = 5 * 6e4;
+var REALTIME_REBIND_IN_FLIGHT_GRACE_MS = 15e3;
+function realtimeRebindBackoffMs(attempts) {
+  if (attempts <= REALTIME_REBIND_FREE_ATTEMPTS) return 0;
+  const step = attempts - REALTIME_REBIND_FREE_ATTEMPTS;
+  return Math.min(1e4 * 2 ** (step - 1), REALTIME_REBIND_MAX_BACKOFF_MS);
+}
+function recordRealtimeRebindFailure(failures, agentId, status, now) {
+  const prior = failures.get(agentId);
+  const attempts = (prior?.attempts ?? 0) + 1;
+  const next = {
+    attempts,
+    since: prior?.since ?? now,
+    lastStatus: status,
+    loggedAtAttempt: prior?.loggedAtAttempt ?? 0,
+    nextAttemptAt: now + realtimeRebindBackoffMs(attempts)
+  };
+  failures.set(agentId, next);
+  return next;
+}
+function realtimeRebindDue(failures, now) {
+  for (const state8 of failures.values()) if (now >= state8.nextAttemptAt) return true;
+  return false;
+}
+function stuckRealtimeRebinds(failures, now, thresholdMs = REALTIME_REBIND_STUCK_AFTER_MS) {
+  const out = [];
+  for (const [agentId, state8] of failures) {
+    const stuckForMs = now - state8.since;
+    if (stuckForMs < thresholdMs) continue;
+    out.push({
+      agent_id: agentId,
+      attempts: state8.attempts,
+      stuck_for_seconds: Math.floor(stuckForMs / 1e3),
+      status: state8.lastStatus
+    });
+  }
+  out.sort((a, b) => b.stuck_for_seconds - a.stuck_for_seconds);
+  return out;
+}
+function forgetRealtimeRebindState(agentId) {
+  realtimeRebindFailures.delete(agentId);
+}
+function pruneRealtimeRebindState(failures, liveAgentIds) {
+  const live = liveAgentIds instanceof Set ? liveAgentIds : new Set(liveAgentIds);
+  let dropped = 0;
+  for (const agentId of [...failures.keys()]) {
+    if (!live.has(agentId)) {
+      failures.delete(agentId);
+      dropped++;
+    }
+  }
+  return dropped;
+}
+function holdRealtimeRebindInFlight(failures, agentIds, now, graceMs = REALTIME_REBIND_IN_FLIGHT_GRACE_MS) {
+  const until = now + graceMs;
+  for (const agentId of agentIds) {
+    const state8 = failures.get(agentId);
+    if (state8) state8.nextAttemptAt = Math.max(state8.nextAttemptAt, until);
+  }
+}
 var realtimeAssignStarted = false;
 var realtimeConfigStarted = false;
 var realtimeSubscribedAgentIds = /* @__PURE__ */ new Set();
@@ -18008,6 +18087,12 @@ function activeAgentIdSetsEqual(current, previous) {
 }
 function ensureRealtimeIntegrationContextStarted(agentStates) {
   const activeAgentIds = agentStates.filter((a) => a.status === "active").map((a) => a.agentId);
+  if (realtimeRebindFailures.size > 0) {
+    const dropped = pruneRealtimeRebindState(realtimeRebindFailures, activeAgentIds);
+    if (dropped > 0) {
+      log(`[realtime] Dropped ${dropped} token-rotation rebind streak(s) for no-longer-active agent(s) (ENG-9265)`);
+    }
+  }
   if (activeAgentIds.length === 0) {
     if (subscribedIntegrationContextAgentIds.size > 0) {
       stopRealtimeIntegrationContext();
@@ -18017,6 +18102,9 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
     }
     return;
   }
+  if (realtimeRebindFailures.size > 0 && realtimeRebindDue(realtimeRebindFailures, Date.now()) && subscribedIntegrationContextAgentIds.size > 0) {
+    subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
+  }
   if (activeAgentIdSetsEqual(activeAgentIds, subscribedIntegrationContextAgentIds)) return;
   const apiKey = process.env["AGT_API_KEY"];
   if (!apiKey) return;
@@ -18027,6 +18115,9 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
   }
   const targetSet = new Set(activeAgentIds);
   subscribedIntegrationContextAgentIds = targetSet;
+  if (realtimeRebindFailures.size > 0) {
+    holdRealtimeRebindInFlight(realtimeRebindFailures, targetSet, Date.now());
+  }
   void exchangeApiKey(apiKey).then((exchange) => {
     if (subscribedIntegrationContextAgentIds !== targetSet) return;
     if (!exchange.supabaseUrl || !exchange.supabaseAnonKey) {
@@ -18061,9 +18152,31 @@ function ensureRealtimeIntegrationContextStarted(agentStates) {
           `integration token rotated for agent ${agentId} (integration ${event.integration_id}, ${event.definition_id})`
         );
       },
+      onSubscribed: (agentId) => {
+        const ended = realtimeRebindFailures.get(agentId);
+        if (!ended) return;
+        realtimeRebindFailures.delete(agentId);
+        const stuckForSeconds = Math.floor((Date.now() - ended.since) / 1e3);
+        log(
+          `[realtime] Token rotation subscription for agent ${agentId} recovered after ${ended.attempts} failed attempt(s) over ${stuckForSeconds}s (ENG-9265)`
+        );
+      },
       onSubscriptionLost: (agentId, status) => {
-        log(`[realtime] Token rotation subscription lost for agent ${agentId} (${status}) \u2014 will rebind next tick`);
-        subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
+        const state8 = recordRealtimeRebindFailure(
+          realtimeRebindFailures,
+          agentId,
+          status,
+          Date.now()
+        );
+        const waitMs = realtimeRebindBackoffMs(state8.attempts);
+        if (state8.attempts === 1 || state8.attempts > state8.loggedAtAttempt) {
+          state8.loggedAtAttempt = state8.attempts;
+          const stuckForSeconds = Math.floor((Date.now() - state8.since) / 1e3);
+          log(
+            `[realtime] Token rotation subscription lost for agent ${agentId} (${status}) \u2014 attempt ${state8.attempts}, stuck ${stuckForSeconds}s, next rebind in ${Math.round(waitMs / 1e3)}s (ENG-9265)`
+          );
+        }
+        if (waitMs === 0) subscribedIntegrationContextAgentIds = /* @__PURE__ */ new Set();
       },
       log
     });
@@ -19432,6 +19545,10 @@ export {
   DAY_ROLLOVER_FORCE_GRACE_MIN,
   DAY_ROLLOVER_INBOUND_DEFER_MAX_MIN,
   DAY_ROLLOVER_INBOUND_GRACE_SEC,
+  REALTIME_REBIND_FREE_ATTEMPTS,
+  REALTIME_REBIND_IN_FLIGHT_GRACE_MS,
+  REALTIME_REBIND_MAX_BACKOFF_MS,
+  REALTIME_REBIND_STUCK_AFTER_MS,
   UntrustworthyToolkitResponseError,
   applyRestartAcks,
   cancelKanbanNoticeOnDrain,
@@ -19451,7 +19568,9 @@ export {
   extractCharterTelegramPeers,
   fetchManagedToolkits,
   forgetChannelSyncState,
+  forgetRealtimeRebindState,
   hasRevokedResiduals,
+  holdRealtimeRebindInFlight,
   inboundHoldMinutes,
   isOlderSemverTuple,
   isPrereleaseVersion,
@@ -19459,7 +19578,11 @@ export {
   maybeInjectKanbanCheck,
   maybeProbeClaudeRuntimeAuth,
   maybeUpgradeClaudeCode,
+  pruneRealtimeRebindState,
+  realtimeRebindBackoffMs,
+  realtimeRebindDue,
   recordChannelSyncFailure,
+  recordRealtimeRebindFailure,
   refreshSkillsIndexInClaudeMd,
   reorderRestartedFirst,
   resolveManagedMcpServerId,
@@ -19474,6 +19597,7 @@ export {
   startManager,
   stopManager,
   stuckChannelSyncs,
+  stuckRealtimeRebinds,
   supersededRuntimeImageIds
 };
 //# sourceMappingURL=manager-worker.js.map