@integrity-labs/agt-cli 0.28.853 → 0.28.855

package/dist/{chunk-6BA2US4B.js → chunk-RKCG63PT.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-XCAI3GSF.js";
+} from "./chunk-7YVKIYVW.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -76,7 +76,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-WUXQVP7A.js";
+} from "./chunk-IHBWFKOW.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6566,7 +6566,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.853" : "dev";
+var agtCliVersion = true ? "0.28.855" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10924,4 +10924,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-6BA2US4B.js.map
+//# sourceMappingURL=chunk-RKCG63PT.js.map

package/dist/{claude-pair-runtime-CJXQTVSC.js → claude-pair-runtime-FFUPKRVC.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-YGK7YHPR.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-CNVU25IF.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-CJXQTVSC.js.map
+//# sourceMappingURL=claude-pair-runtime-FFUPKRVC.js.map

package/dist/lib/manager-worker.js

@@ -60,7 +60,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-6BA2US4B.js";
+} from "../chunk-RKCG63PT.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -126,7 +126,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-XCAI3GSF.js";
+} from "../chunk-7YVKIYVW.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -221,7 +221,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-WUXQVP7A.js";
+} from "../chunk-IHBWFKOW.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -2194,7 +2194,8 @@ async function reportModelApiError(opts) {
       model_id: opts.modelId ?? null,
       // Content-free by contract, but bound it defensively.
       detail: opts.detail ? opts.detail.slice(0, 500) : null,
-      occurred_at: opts.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      occurred_at: opts.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      policy_id: opts.policyId ?? null
     });
   } catch (err) {
     opts.log?.(
@@ -13000,7 +13001,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-NGWO3JK3.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-TZOKOH6C.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13668,7 +13669,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.853" : "dev";
+var agtCliVersion = true ? "0.28.855" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15258,7 +15259,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-YGK7YHPR.js");
+      const { collectDiagnostics } = await import("../persistent-session-CNVU25IF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15313,7 +15314,7 @@ async function pollCycleInner() {
         stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason);
         agentState.persistentSessionAgents.delete(codeName);
         claudeAuthTupleBySession.delete(codeName);
-        modelPolicyModelBySession.delete(codeName);
+        clearSessionPolicyBaseline(codeName);
       },
       getTelegramTokens: (codeName) => {
         const t = agentChannelTokens.get(codeName);
@@ -15400,7 +15401,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-YGK7YHPR.js");
+      const { collectDiagnostics } = await import("../persistent-session-CNVU25IF.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15569,7 +15570,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-NGWO3JK3.js");
+      } = await import("../responsiveness-probe-TZOKOH6C.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -15686,7 +15687,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-NGWO3JK3.js");
+        } = await import("../responsiveness-probe-TZOKOH6C.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15842,7 +15843,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-4UZR5655.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-GRYXFDYD.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -15871,6 +15872,11 @@ async function pollCycleInner() {
               errorClass: observedErr.errorClass,
               httpStatus: observedErr.httpStatus,
               agentCodeName: codeName,
+              // ENG-10156: the policy this session was LAUNCHED under, read from
+              // the baseline rather than resolved now — see
+              // `modelPolicyIdBySession`. Absent for an unpoliced agent, and for
+              // one whose policy did not shape the session.
+              policyId: modelPolicyIdBySession.get(codeName) ?? null,
               detail: `agent pane: ${observedErr.errorClass}`,
               log
             });
@@ -19124,6 +19130,17 @@ var DAY_ROLLOVER_INBOUND_DEFER_MAX_MIN = 10;
 var persistentSessionStuckTracker = new PersistentSessionStuckTracker();
 var claudeAuthTupleBySession = /* @__PURE__ */ new Map();
 var modelPolicyModelBySession = /* @__PURE__ */ new Map();
+var modelPolicyIdBySession = /* @__PURE__ */ new Map();
+function recordSessionPolicyBaseline(codeName, policyModel, policyId) {
+  if (policyModel) modelPolicyModelBySession.set(codeName, policyModel);
+  else modelPolicyModelBySession.delete(codeName);
+  if (policyId) modelPolicyIdBySession.set(codeName, policyId);
+  else modelPolicyIdBySession.delete(codeName);
+}
+function clearSessionPolicyBaseline(codeName) {
+  modelPolicyModelBySession.delete(codeName);
+  modelPolicyIdBySession.delete(codeName);
+}
 var opencodeCredentialFingerprintBySession = /* @__PURE__ */ new Map();
 var egressAllowlistBySession = /* @__PURE__ */ new Map();
 function deriveEgressAllowlist(toolsRaw, policy) {
@@ -19334,7 +19351,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       });
       agentState.persistentSessionAgents.delete(codeName);
       claudeAuthTupleBySession.delete(codeName);
-      modelPolicyModelBySession.delete(codeName);
+      clearSessionPolicyBaseline(codeName);
     }
     return {
       decision: "skipped-auth-resolve-failed",
@@ -19398,6 +19415,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     gatewayToken: null,
     codeName
   });
+  const currentPolicyId = currentPolicyModel ? modelPolicy?.policyId ?? null : null;
   const recordedAuthTuple = claudeAuthTupleBySession.get(codeName);
   const recordedPolicyModel = modelPolicyModelBySession.get(codeName);
   if (recordedAuthTuple && recordedAuthTuple !== currentAuthTuple && isSessionHealthy(codeName)) {
@@ -19709,8 +19727,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash20("sha256")
     });
     agentState.persistentSessionAgents.add(codeName);
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
-    if (currentPolicyModel) modelPolicyModelBySession.set(codeName, currentPolicyModel);
-    else modelPolicyModelBySession.delete(codeName);
+    recordSessionPolicyBaseline(codeName, currentPolicyModel, currentPolicyId);
     seedSessionLaunchBaselines(codeName, projectDir);
     return {
       decision: "spawn",
@@ -19750,8 +19767,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash20("sha256")
   }
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
-    if (currentPolicyModel) modelPolicyModelBySession.set(codeName, currentPolicyModel);
-    else modelPolicyModelBySession.delete(codeName);
+    recordSessionPolicyBaseline(codeName, currentPolicyModel, currentPolicyId);
   }
   const stableTasksHash = createHash20("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
@@ -20055,7 +20071,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-NGWO3JK3.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-TZOKOH6C.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20093,7 +20109,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-YGK7YHPR.js");
+        const { collectDiagnostics } = await import("../persistent-session-CNVU25IF.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20139,7 +20155,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-YGK7YHPR.js");
+      const { collectDiagnostics } = await import("../persistent-session-CNVU25IF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20775,7 +20791,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-CJXQTVSC.js");
+  } = await import("../claude-pair-runtime-FFUPKRVC.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));