@integrity-labs/agt-cli 0.28.883 → 0.28.885

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-B3WKENVI.js";
+} from "../chunk-MT3CF4UQ.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-PZHDYVFU.js";
+} from "../chunk-FP5M5OVX.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.883" : "dev";
+var cliVersion = true ? "0.28.885" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.883" : "dev";
+var cliVersion2 = true ? "0.28.885" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-PZHDYVFU.js → chunk-FP5M5OVX.js}

@@ -3825,6 +3825,7 @@ function buildDockerRunCommand(args) {
   ];
   const image = process.env.AGT_ISOLATION_IMAGE || "agt-runtime:latest";
   const memory = process.env.AGT_ISOLATION_MEMORY || "2g";
+  const memorySwap = memory;
   const cpus = process.env.AGT_ISOLATION_CPUS || "1.0";
   const pids = process.env.AGT_ISOLATION_PIDS || "512";
   const envArgs = [`-e ${q(`HOME=${homeDir}`)}`];
@@ -3881,7 +3882,13 @@ function buildDockerRunCommand(args) {
       // squid processes untrusted agent traffic - give it the same hardening as
       // the agent container (drop all caps, block privilege escalation). squid
       // binds 3128 (>1024) and needs no capabilities; verified it still boots.
-      `docker run -d --name ${squidName} --network ${internalNet} --restart unless-stopped --memory 128m --cap-drop ALL --security-opt no-new-privileges -v ${q(`${egress.allowlistHostPath}:/etc/squid/allowlist.txt:ro`)} ${q(egressImage)} >/dev/null`,
+      // ENG-10369: `--memory-swap 128m` equal to `--memory 128m`, same reasoning
+      // as the agent container above. squid is small and steady-state, so the
+      // phantom 256m grant was never load-bearing - but leaving ONE container on
+      // the implicit-doubling path is how the next host-swap change finds a way
+      // back in, and an exemption nobody wrote down is an exemption nobody
+      // re-checks.
+      `docker run -d --name ${squidName} --network ${internalNet} --restart unless-stopped --memory 128m --memory-swap 128m --cap-drop ALL --security-opt no-new-privileges -v ${q(`${egress.allowlistHostPath}:/etc/squid/allowlist.txt:ro`)} ${q(egressImage)} >/dev/null`,
       `docker network connect agt-egress ${squidName} >/dev/null 2>&1`
     ].join(" && ");
   }
@@ -3915,6 +3922,9 @@ function buildDockerRunCommand(args) {
     // per-application is how it gets forgotten again next time.
     "--init",
     `--memory ${memory}`,
+    // ENG-10369 - equal to `--memory`, so the container gets no swap access.
+    // See the `memorySwap` definition above for why this is not optional.
+    `--memory-swap ${memorySwap}`,
     `--cpus ${cpus}`,
     `--pids-limit ${pids}`,
     // Defence in depth (red-team 2026-06-16): drop all Linux capabilities and
@@ -3975,6 +3985,77 @@ function collectMcpServerNames(mcpConfigPath) {
   }
 }
 var PANE_AGENT_ID_PROBE_TIMEOUT_MS = 2e3;
+function applyPaneAgentIdVerdict(args) {
+  const { session, mismatch, codeName, tmuxSession, log: log2 } = args;
+  if (!mismatch) return false;
+  log2(
+    `[persistent-session] PANE AGENT ID MISMATCH agent=${codeName} isolation=${args.isolation} \u2014 ${mismatch}`
+  );
+  session.status = "crashed";
+  session.startedAt = args.now ? args.now() : Date.now();
+  log2(
+    `[persistent-session] requesting kill of session '${tmuxSession}' for '${codeName}' \u2014 refusing to run an agent under another agent's identity (ENG-8800)`
+  );
+  let teardown;
+  try {
+    teardown = Promise.resolve(args.killSession(tmuxSession));
+  } catch (err) {
+    teardown = Promise.resolve({
+      ok: false,
+      reason: `could not start the kill: ${err instanceof Error ? err.message : String(err)}`
+    });
+  }
+  void teardown.catch((err) => ({
+    ok: false,
+    reason: `the kill rejected: ${err instanceof Error ? err.message : String(err)}`
+  })).then((result) => {
+    if (result?.ok) {
+      log2(`[persistent-session] killed session '${tmuxSession}' for '${codeName}' (ENG-8800)`);
+    } else {
+      const reason = result && !result.ok ? result.reason : "no result from the kill";
+      log2(
+        `[persistent-session] FAILED TO KILL session '${tmuxSession}' for '${codeName}': ${reason}. It is marked crashed, but its pane may still be running under another agent's identity. Kill it by hand: tmux kill-session -t ${tmuxSession} (ENG-8800)`
+      );
+    }
+    args.onTeardownSettled?.(result ?? { ok: false, reason: "no result from the kill" });
+  });
+  return true;
+}
+function killTmuxSessionBounded(tmuxSession, deps = {}) {
+  const spawnFn = deps.spawnFn ?? spawn2;
+  const timeoutMs = deps.timeoutMs ?? PANE_AGENT_ID_PROBE_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    let deadline;
+    let settled = false;
+    const settle = (result) => {
+      if (settled) return;
+      settled = true;
+      if (deadline) clearTimeout(deadline);
+      resolve(result);
+    };
+    let killer;
+    try {
+      killer = spawnFn("tmux", ["kill-session", "-t", tmuxSession], { stdio: "ignore" });
+    } catch (err) {
+      settle({ ok: false, reason: `could not spawn tmux: ${err instanceof Error ? err.message : String(err)}` });
+      return;
+    }
+    deadline = setTimeout(() => {
+      try {
+        killer.kill("SIGKILL");
+      } catch {
+      }
+      settle({ ok: false, reason: `tmux kill-session did not exit within ${timeoutMs}ms` });
+    }, timeoutMs);
+    deadline.unref?.();
+    killer.on("error", (err) => {
+      settle({ ok: false, reason: `tmux kill-session could not run: ${err.message}` });
+    });
+    killer.on("close", (code, signal) => {
+      settle(code === 0 ? { ok: true } : { ok: false, reason: `tmux kill-session exited ${code ?? signal}` });
+    });
+  });
+}
 var REQUIRED_SPAWN_ENV = ["AGT_AGENT_ID", "AGT_HOST", "AGT_API_KEY"];
 function buildSpawnEnv(args) {
   const { base, agentId, runId } = args;
@@ -4660,31 +4741,15 @@ function spawnSession(config, session) {
             showEnvOutput: output,
             expectedAgentId: config.agentId
           });
-          if (mismatch) {
-            log2(
-              `[persistent-session] PANE AGENT ID MISMATCH agent=${codeName} isolation=${effectiveMode} \u2014 ${mismatch}`
-            );
-            session.status = "crashed";
-            session.startedAt = Date.now();
-            try {
-              const killer = spawn2("tmux", ["kill-session", "-t", tmuxSession], {
-                stdio: "ignore"
-              });
-              const killDeadline = setTimeout(() => {
-                try {
-                  killer.kill("SIGKILL");
-                } catch {
-                }
-              }, PANE_AGENT_ID_PROBE_TIMEOUT_MS);
-              killDeadline.unref?.();
-              killer.on("error", () => clearTimeout(killDeadline));
-              killer.on("close", () => clearTimeout(killDeadline));
-            } catch {
-            }
-            log2(
-              `[persistent-session] killed session '${tmuxSession}' for '${codeName}' \u2014 refusing to run an agent under another agent's identity (ENG-8800)`
-            );
-          }
+          applyPaneAgentIdVerdict({
+            session,
+            mismatch,
+            codeName,
+            tmuxSession,
+            isolation: effectiveMode,
+            log: log2,
+            killSession: killTmuxSessionBounded
+          });
         };
         const deadline = setTimeout(() => {
           settle(null);
@@ -5391,6 +5456,8 @@ export {
   buildDockerRunCommand,
   writePersistentClaudeWrapper,
   PANE_AGENT_ID_PROBE_TIMEOUT_MS,
+  applyPaneAgentIdVerdict,
+  killTmuxSessionBounded,
   REQUIRED_SPAWN_ENV,
   buildSpawnEnv,
   findMissingSpawnEnv,
@@ -5431,4 +5498,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-PZHDYVFU.js.map
+//# sourceMappingURL=chunk-FP5M5OVX.js.map