@integrity-labs/agt-cli 0.28.94 → 0.28.96

package/dist/{claude-pair-runtime-FA7DXRHH.js → claude-pair-runtime-2ISKH4M2.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-4HWN54DY.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-KAOPVQPC.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-FA7DXRHH.js.map
+//# sourceMappingURL=claude-pair-runtime-2ISKH4M2.js.map

package/dist/lib/manager-worker.js

@@ -28,7 +28,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-7IEFSTN5.js";
+} from "../chunk-LFTKXQEA.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -38,8 +38,10 @@ import {
 } from "../chunk-I3YS5WFV.js";
 import {
   buildAllowedTools,
+  buildEgressAllowlist,
   checkChannelInputs,
   creditWatchdogGiveUpCount,
+  egressMode,
   getLastFailureContext,
   getProjectDir,
   getSessionState,
@@ -53,8 +55,10 @@ import {
   peekCurrentSession,
   prepareForRespawn,
   readPaneLogTail,
+  reloadEgressSidecar,
   resetRestartCount,
   resolveClaudeBinary,
+  restartEgressSidecar,
   rotateSessionForWedge,
   sanitizeMcpJson,
   sendToAgent,
@@ -65,8 +69,9 @@ import {
   subagentActivityAgeSeconds,
   takeWatchdogGiveUpCount,
   takeZombieDetection,
-  transcriptActivityAgeSeconds
-} from "../chunk-CSTDOXOK.js";
+  transcriptActivityAgeSeconds,
+  writeEgressAllowlist
+} from "../chunk-5NQ652SP.js";
 import {
   FLAGS_SCHEMA_VERSION,
   FLAG_REGISTRY,
@@ -101,7 +106,7 @@ import {
   resolveDmTarget,
   sumTranscriptUsageInWindow,
   wrapScheduledTaskPrompt
-} from "../chunk-GLBWCCZD.js";
+} from "../chunk-TRKWWYRN.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -850,10 +855,20 @@ import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFi
 import { dirname as dirname2 } from "path";
 var ONBOARDING_REINJECT_INTERVAL_MS = 5 * 6e4;
 var ONBOARDING_MAX_NUDGES = 3;
-function decideOnboardingDrive(step, marker, nowMs, reinjectIntervalMs = ONBOARDING_REINJECT_INTERVAL_MS, maxNudges = ONBOARDING_MAX_NUDGES) {
+function decideOnboardingDrive(step, marker, nowMs, generation = 0, reinjectIntervalMs = ONBOARDING_REINJECT_INTERVAL_MS, maxNudges = ONBOARDING_MAX_NUDGES) {
   if (isOnboardingArea(step)) {
     const sameStep = marker?.step === step;
     const current = sameStep ? marker : null;
+    const genChanged = current !== null && current.generation !== generation;
+    if (genChanged) {
+      return {
+        inject: true,
+        clearMarker: false,
+        nextMarker: { step, injectedAtMs: nowMs, nudgeCount: 1, gaveUp: false, generation },
+        reminder: false,
+        standDown: false
+      };
+    }
     if (current?.gaveUp) {
       return { inject: false, clearMarker: false, nextMarker: current, reminder: false, standDown: false };
     }
@@ -867,7 +882,7 @@ function decideOnboardingDrive(step, marker, nowMs, reinjectIntervalMs = ONBOARD
     return {
       inject: true,
       clearMarker: false,
-      nextMarker: { step, injectedAtMs: nowMs, nudgeCount, gaveUp: isFinal },
+      nextMarker: { step, injectedAtMs: nowMs, nudgeCount, gaveUp: isFinal, generation },
       // A middle re-fire (not fresh, not final) is a gentle "still waiting"
       // reminder; the final one is a stand-down, not a reminder.
       reminder: !fresh && !isFinal,
@@ -905,10 +920,12 @@ function readOnboardingDriveMarker(path) {
     const raw = JSON.parse(readFileSync2(path, "utf8"));
     if (typeof raw.step === "string" && isOnboardingArea(raw.step) && typeof raw.injectedAtMs === "number" && Number.isFinite(raw.injectedAtMs)) {
       const nudgeCount = typeof raw.nudgeCount === "number" && Number.isFinite(raw.nudgeCount) && raw.nudgeCount >= 1 ? Math.floor(raw.nudgeCount) : 1;
+      const generation = typeof raw.generation === "number" && Number.isFinite(raw.generation) && raw.generation >= 0 ? Math.floor(raw.generation) : 0;
       return {
         step: raw.step,
         injectedAtMs: raw.injectedAtMs,
         nudgeCount,
+        generation,
         gaveUp: raw.gaveUp === true
       };
     }
@@ -6936,7 +6953,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.94" : "dev";
+var agtCliVersion = true ? "0.28.96" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -8047,7 +8064,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-4HWN54DY.js");
+      const { collectDiagnostics } = await import("../persistent-session-KAOPVQPC.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -8148,7 +8165,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-C2N4UJSE.js");
+      } = await import("../responsiveness-probe-OJPF6XDF.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8180,7 +8197,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-C2N4UJSE.js");
+        } = await import("../responsiveness-probe-OJPF6XDF.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -10448,7 +10465,7 @@ In progress for ${age} minutes \u2014 auto-failed`).catch(() => {
       const obStep = obState.step;
       const markerPath = join16(homedir9(), ".augmented", agent.code_name, "onboarding-drive.json");
       const marker = readOnboardingDriveMarker(markerPath);
-      const decision = decideOnboardingDrive(obStep, marker, Date.now());
+      const decision = decideOnboardingDrive(obStep, marker, Date.now(), obState.generation ?? 0);
       if (decision.clearMarker) {
         clearOnboardingDriveMarker(markerPath);
       } else if (decision.inject && isOnboardingArea(obStep) && isSessionHealthy(agent.code_name)) {
@@ -10629,6 +10646,13 @@ function cleanupOldFiles(dir, maxAgeDays, ext) {
 var lastMcpFailedBannerCount = /* @__PURE__ */ new Map();
 var persistentSessionStuckTracker = new PersistentSessionStuckTracker();
 var claudeAuthTupleBySession = /* @__PURE__ */ new Map();
+var egressAllowlistBySession = /* @__PURE__ */ new Map();
+function deriveEgressAllowlist(toolsRaw) {
+  return buildEgressAllowlist(
+    toolsRaw ? extractFrontmatter(toolsRaw).frontmatter : null
+  );
+}
+var egressAllowlistEqual = (a, b) => a.length === b.length && a.every((d, i) => d === b[i]);
 async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
   const projectDir = getProjectDir(codeName);
@@ -10819,6 +10843,10 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash9("sha256").
       metadata: { type: "persistent_session_boot" }
     });
     const spawnPrimaryModel = resolveModelChain(refreshData).primary ?? refreshData.agent?.["primary_model"] ?? null;
+    const egressAllowlist = deriveEgressAllowlist(
+      refreshData.tools?.raw_content
+    );
+    egressAllowlistBySession.set(codeName, egressAllowlist);
     startPersistentSession({
       codeName,
       agentId: agent.agent_id,
@@ -10833,6 +10861,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash9("sha256").
       primaryModel: spawnPrimaryModel,
       runId: sessionRunResult.run_id,
       agentTimezone,
+      egressAllowlist,
       log
     });
     agentState.persistentSessionAgents.add(codeName);
@@ -10845,6 +10874,33 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash9("sha256").
     };
   }
   resetRestartCount(codeName);
+  if (egressMode(codeName) === "allowlist") {
+    const allowlist = deriveEgressAllowlist(
+      refreshData.tools?.raw_content
+    );
+    const prev = egressAllowlistBySession.get(codeName);
+    if (!prev || !egressAllowlistEqual(prev, allowlist)) {
+      try {
+        writeEgressAllowlist(codeName, allowlist);
+        const removed = prev ? prev.some((d) => !allowlist.includes(d)) : true;
+        const applied = removed ? restartEgressSidecar(codeName) : reloadEgressSidecar(codeName);
+        if (applied) {
+          egressAllowlistBySession.set(codeName, allowlist);
+          log(
+            `[persistent-session] egress allowlist for '${codeName}' changed (${allowlist.length} domains), ${removed ? "restarted" : "reloaded"} squid sidecar`
+          );
+        } else {
+          log(
+            `[persistent-session] egress allowlist for '${codeName}' written (${allowlist.length} domains) but sidecar not running; will apply on next tick/spawn`
+          );
+        }
+      } catch (err) {
+        log(
+          `[persistent-session] egress allowlist refresh for '${codeName}' failed (will retry next tick): ${err.message}`
+        );
+      }
+    }
+  }
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
@@ -11666,7 +11722,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-FA7DXRHH.js");
+  } = await import("../claude-pair-runtime-2ISKH4M2.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));