@integrity-labs/agt-cli 0.28.670 → 0.28.672

package/dist/{chunk-5GDKWIB3.js → chunk-YAVWYI5S.js}

@@ -16,7 +16,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-HGVJVYKW.js";
+} from "./chunk-YOID6KOQ.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -200,6 +200,70 @@ import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, wr
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 
+// ../../packages/core/dist/provisioning/env-integrations-file.js
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+var CHANNEL_SECRET_ENV_KEYS = [
+  "SLACK_BOT_TOKEN",
+  "SLACK_APP_TOKEN",
+  "TELEGRAM_BOT_TOKEN",
+  "MSTEAMS_CLIENT_SECRET"
+];
+var MCP_SERVER_SECRET_ENV_KEYS = [
+  "COMPOSIO_API_KEY",
+  "PIPEDREAM_CLIENT_SECRET"
+];
+var PRESERVED_ENV_KEYS = [
+  ...CHANNEL_SECRET_ENV_KEYS,
+  ...MCP_SERVER_SECRET_ENV_KEYS
+];
+var HEADER = "# Augmented integrations \u2014 auto-generated, do not edit";
+function parseEnvFileEntries(content) {
+  const out = /* @__PURE__ */ new Map();
+  for (const line2 of content.split("\n")) {
+    if (!line2 || line2.startsWith("#") || !line2.includes("="))
+      continue;
+    const eqIdx = line2.indexOf("=");
+    out.set(line2.slice(0, eqIdx), line2.slice(eqIdx + 1));
+  }
+  return out;
+}
+function renderEnvIntegrations(entries) {
+  const lines = [HEADER];
+  for (const [key, rendered] of entries)
+    lines.push(`${key}=${rendered}`);
+  return lines.join("\n") + "\n";
+}
+function mergeEnvIntegrationsContent(existing, args) {
+  const current = existing === null ? /* @__PURE__ */ new Map() : parseEnvFileEntries(existing);
+  let next;
+  if (args.mode === "upsert") {
+    next = new Map(current);
+    for (const [key, raw] of Object.entries(args.updates)) {
+      if (raw === null)
+        next.delete(key);
+      else
+        next.set(key, shellQuote(raw));
+    }
+  } else {
+    next = /* @__PURE__ */ new Map();
+    for (const [key, raw] of Object.entries(args.updates)) {
+      if (raw !== null)
+        next.set(key, shellQuote(raw));
+    }
+    const preserve = args.preserveKeys ?? PRESERVED_ENV_KEYS;
+    for (const key of preserve) {
+      if (key in args.updates)
+        continue;
+      if (!next.has(key) && current.has(key)) {
+        next.set(key, current.get(key));
+      }
+    }
+  }
+  return renderEnvIntegrations(next);
+}
+
 // ../../packages/core/dist/provisioning/channel-env.js
 function buildChannelCredentialEnv(channelId, config) {
   const env = {};
@@ -242,6 +306,21 @@ function buildChannelCredentialEnv(channelId, config) {
   }
   return { env, secrets };
 }
+function collectChannelSpawnSecrets(channelConfigs) {
+  const allowed = new Set(CHANNEL_SECRET_ENV_KEYS);
+  const out = {};
+  for (const [channelId, entry] of Object.entries(channelConfigs ?? {})) {
+    if (!entry || !(entry.status === "active" || entry.status === "pending") || !entry.config)
+      continue;
+    const config = entry.config;
+    const { secrets } = buildChannelCredentialEnv(channelId, config);
+    for (const [key, value] of Object.entries(secrets)) {
+      if (allowed.has(key))
+        out[key] = value;
+    }
+  }
+  return out;
+}
 function peerModeEnv(prefix, config) {
   const env = {};
   const mode = config["peer_agent_mode"];
@@ -3018,7 +3097,7 @@ function restartEgressSidecar(codeName) {
   }
 }
 function buildDockerRunCommand(args) {
-  const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, egress, forwardSlackReplyBinding, forwardBlockTurnEndAllMarkers, forwardKanbanWaiting, forwardNotifyDispatch, forwardTurnFailureNotice } = args;
+  const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, egress, forwardSlackReplyBinding, forwardBlockTurnEndAllMarkers, forwardKanbanWaiting, forwardNotifyDispatch, forwardTurnFailureNotice, forwardChannelSecrets } = args;
   const q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
   const agentDir2 = join6(homeDir, ".augmented", codeName);
   const agentIdDir = join6(homeDir, ".augmented", agentId);
@@ -3057,6 +3136,9 @@ function buildDockerRunCommand(args) {
   if (forwardKanbanWaiting) envArgs.push("-e AGT_KANBAN_WAITING_ENABLED");
   if (forwardNotifyDispatch) envArgs.push("-e AGT_NOTIFY_DISPATCH");
   if (forwardTurnFailureNotice) envArgs.push("-e AGT_WEDGE_TRANSIENT_NOTICE_ENABLED");
+  for (const name of forwardChannelSecrets ?? []) {
+    envArgs.push(`-e ${name}`);
+  }
   const egressImage = process.env.AGT_EGRESS_IMAGE || "agt-squid:latest";
   const internalNet = `agt-net-${codeName}`;
   const squidName = `agt-squid-${codeName}`;
@@ -3517,6 +3599,9 @@ function spawnSession(config, session) {
     if (config.turnFailureNoticeEnabled && !process.env["AGT_WEDGE_TRANSIENT_NOTICE_ENABLED"]) {
       tmuxSessionEnvArgs.push("-e", "AGT_WEDGE_TRANSIENT_NOTICE_ENABLED=true");
     }
+    for (const [key, value] of Object.entries(config.channelSpawnSecrets ?? {})) {
+      tmuxSessionEnvArgs.push("-e", `${key}=${value}`);
+    }
     const sessionHomeDir = process.env.HOME?.trim() || homedir5();
     let egress;
     if (egressMode(codeName) === "allowlist") {
@@ -3556,7 +3641,14 @@ function spawnSession(config, session) {
       // container boundary and the notice stays dark for exactly the isolated
       // agents it was added for (CodeRabbit, PR #3907).
       forwardTurnFailureNotice: !!process.env["AGT_WEDGE_TRANSIENT_NOTICE_ENABLED"] || // feature-gate-allow: registry-flag envVar operator-override precedence, not a new gate
-      !!config.turnFailureNoticeEnabled
+      !!config.turnFailureNoticeEnabled,
+      // ENG-9350: name-forward this agent's channel bot-token vars into the
+      // container (value from the session-shell env, same ps-hiding posture
+      // as AGT_API_KEY). REQUIRED under isolation in spawn-env mode: the file
+      // no longer carries them for the in-container wrapper to source, so
+      // without the forward `${SLACK_BOT_TOKEN}` resolves empty and the
+      // channel MCP dies. Empty/undef ⇒ no forwards (file-sourced as before).
+      forwardChannelSecrets: config.channelSpawnSecrets ? Object.keys(config.channelSpawnSecrets) : void 0
     }) : JSON.stringify(wrapperPath);
     const tmuxEnv = buildSpawnEnv({
       base: process.env,
@@ -3570,15 +3662,17 @@ function spawnSession(config, session) {
       ANTHROPIC_MODEL: config.openRouter.model,
       ...config.openRouter.smallFastModel ? { ANTHROPIC_SMALL_FAST_MODEL: config.openRouter.smallFastModel } : {}
     } : {};
+    const channelSecretEnv = config.channelSpawnSecrets ?? {};
     const probeBaseEnv = isolationMode(codeName) === "docker" ? {
       HOME: tmuxEnv["HOME"],
       ...apiKeyEnv,
       ...openRouterEnv,
+      ...channelSecretEnv,
       ...config.runId ? { AGT_RUN_ID: config.runId } : {},
       AGT_API_KEY: tmuxEnv["AGT_API_KEY"],
       AGT_HOST: tmuxEnv["AGT_HOST"],
       AGT_AGENT_ID: config.agentId
-    } : { ...tmuxEnv, ...apiKeyEnv, ...openRouterEnv };
+    } : { ...tmuxEnv, ...apiKeyEnv, ...openRouterEnv, ...channelSecretEnv };
     for (const f of probeMcpEnvSubstitution({
       mcpConfigPath,
       envIntegrationsPath: join6(projectDir, ".env.integrations"),
@@ -3871,6 +3965,20 @@ var defaultHygieneKeySender = async (tmuxSession, keys, interKeyDelayMs) => {
   }
 };
 var hygieneKeySender = defaultHygieneKeySender;
+var SESSION_CREATED_TIMEOUT_MS = 3e3;
+function defaultSessionCreatedProbe(tmuxSession) {
+  try {
+    const created = execFileSync3("tmux", ["display", "-p", "-t", tmuxSession, "#{session_created}"], {
+      encoding: "utf-8",
+      timeout: SESSION_CREATED_TIMEOUT_MS
+    }).trim();
+    const secs = Number(created);
+    return Number.isFinite(secs) && secs > 0 ? secs * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+var sessionCreatedProbe = defaultSessionCreatedProbe;
 async function preSendPaneHygiene(tmuxSession, codeName, log2) {
   try {
     let screen = paneCapture(tmuxSession);
@@ -3939,6 +4047,13 @@ var _internals = {
   __setHygieneKeySender(fn) {
     hygieneKeySender = fn ?? defaultHygieneKeySender;
   },
+  // ENG-9321 test seam: swap the tmux `#{session_created}` probe so the
+  // reattach-startedAt contract can be asserted exactly, without a real tmux
+  // server whose latency under load would otherwise decide the result.
+  // null restores the real probe.
+  __setSessionCreatedProbe(fn) {
+    sessionCreatedProbe = fn ?? defaultSessionCreatedProbe;
+  },
   // Test-only resets so each test starts from a clean slate.
   __resetZombieState() {
     zombieProbeCache.clear();
@@ -4044,16 +4159,7 @@ function isSessionHealthy(codeName) {
     return false;
   }
   if (!sessions2.has(codeName)) {
-    let startedAt2 = Date.now();
-    try {
-      const created = execFileSync3("tmux", ["display", "-p", "-t", tmuxSession, "#{session_created}"], {
-        encoding: "utf-8",
-        timeout: 3e3
-      }).trim();
-      const secs = Number(created);
-      if (Number.isFinite(secs) && secs > 0) startedAt2 = secs * 1e3;
-    } catch {
-    }
+    const startedAt2 = sessionCreatedProbe(tmuxSession) ?? Date.now();
     sessions2.set(codeName, {
       codeName,
       startedAt: startedAt2,
@@ -4265,6 +4371,11 @@ export {
   buildLiveHeaderRemoteMcpProxyEntry,
   buildOAuthRemoteMcpProxyEntry,
   buildNativeMcpEntry,
+  shellQuote,
+  CHANNEL_SECRET_ENV_KEYS,
+  parseEnvFileEntries,
+  mergeEnvIntegrationsContent,
+  collectChannelSpawnSecrets,
   toOpencodeModel,
   mergeOpencodeConfigArtifact,
   readChannelServerEnv,
@@ -4335,4 +4446,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-5GDKWIB3.js.map
+//# sourceMappingURL=chunk-YAVWYI5S.js.map