@integrity-labs/agt-cli 0.28.95 → 0.28.96

package/dist/lib/manager-worker.js

@@ -28,7 +28,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-QQYVNV5N.js";
+} from "../chunk-LFTKXQEA.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -38,8 +38,10 @@ import {
 } from "../chunk-I3YS5WFV.js";
 import {
   buildAllowedTools,
+  buildEgressAllowlist,
   checkChannelInputs,
   creditWatchdogGiveUpCount,
+  egressMode,
   getLastFailureContext,
   getProjectDir,
   getSessionState,
@@ -53,8 +55,10 @@ import {
   peekCurrentSession,
   prepareForRespawn,
   readPaneLogTail,
+  reloadEgressSidecar,
   resetRestartCount,
   resolveClaudeBinary,
+  restartEgressSidecar,
   rotateSessionForWedge,
   sanitizeMcpJson,
   sendToAgent,
@@ -65,8 +69,9 @@ import {
   subagentActivityAgeSeconds,
   takeWatchdogGiveUpCount,
   takeZombieDetection,
-  transcriptActivityAgeSeconds
-} from "../chunk-JYSWJMXU.js";
+  transcriptActivityAgeSeconds,
+  writeEgressAllowlist
+} from "../chunk-5NQ652SP.js";
 import {
   FLAGS_SCHEMA_VERSION,
   FLAG_REGISTRY,
@@ -6948,7 +6953,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.95" : "dev";
+var agtCliVersion = true ? "0.28.96" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -8059,7 +8064,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-X62FQ2TN.js");
+      const { collectDiagnostics } = await import("../persistent-session-KAOPVQPC.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -8160,7 +8165,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-PYEWQCIU.js");
+      } = await import("../responsiveness-probe-OJPF6XDF.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8192,7 +8197,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-PYEWQCIU.js");
+        } = await import("../responsiveness-probe-OJPF6XDF.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -10641,6 +10646,13 @@ function cleanupOldFiles(dir, maxAgeDays, ext) {
 var lastMcpFailedBannerCount = /* @__PURE__ */ new Map();
 var persistentSessionStuckTracker = new PersistentSessionStuckTracker();
 var claudeAuthTupleBySession = /* @__PURE__ */ new Map();
+var egressAllowlistBySession = /* @__PURE__ */ new Map();
+function deriveEgressAllowlist(toolsRaw) {
+  return buildEgressAllowlist(
+    toolsRaw ? extractFrontmatter(toolsRaw).frontmatter : null
+  );
+}
+var egressAllowlistEqual = (a, b) => a.length === b.length && a.every((d, i) => d === b[i]);
 async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
   const projectDir = getProjectDir(codeName);
@@ -10831,6 +10843,10 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash9("sha256").
       metadata: { type: "persistent_session_boot" }
     });
     const spawnPrimaryModel = resolveModelChain(refreshData).primary ?? refreshData.agent?.["primary_model"] ?? null;
+    const egressAllowlist = deriveEgressAllowlist(
+      refreshData.tools?.raw_content
+    );
+    egressAllowlistBySession.set(codeName, egressAllowlist);
     startPersistentSession({
       codeName,
       agentId: agent.agent_id,
@@ -10845,6 +10861,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash9("sha256").
       primaryModel: spawnPrimaryModel,
       runId: sessionRunResult.run_id,
       agentTimezone,
+      egressAllowlist,
       log
     });
     agentState.persistentSessionAgents.add(codeName);
@@ -10857,6 +10874,33 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash9("sha256").
     };
   }
   resetRestartCount(codeName);
+  if (egressMode(codeName) === "allowlist") {
+    const allowlist = deriveEgressAllowlist(
+      refreshData.tools?.raw_content
+    );
+    const prev = egressAllowlistBySession.get(codeName);
+    if (!prev || !egressAllowlistEqual(prev, allowlist)) {
+      try {
+        writeEgressAllowlist(codeName, allowlist);
+        const removed = prev ? prev.some((d) => !allowlist.includes(d)) : true;
+        const applied = removed ? restartEgressSidecar(codeName) : reloadEgressSidecar(codeName);
+        if (applied) {
+          egressAllowlistBySession.set(codeName, allowlist);
+          log(
+            `[persistent-session] egress allowlist for '${codeName}' changed (${allowlist.length} domains), ${removed ? "restarted" : "reloaded"} squid sidecar`
+          );
+        } else {
+          log(
+            `[persistent-session] egress allowlist for '${codeName}' written (${allowlist.length} domains) but sidecar not running; will apply on next tick/spawn`
+          );
+        }
+      } catch (err) {
+        log(
+          `[persistent-session] egress allowlist refresh for '${codeName}' failed (will retry next tick): ${err.message}`
+        );
+      }
+    }
+  }
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
@@ -11678,7 +11722,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-DMC3ID2A.js");
+  } = await import("../claude-pair-runtime-2ISKH4M2.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));