@integrity-labs/agt-cli 0.28.958 → 0.28.960

package/dist/{chunk-F47LQPDM.js → chunk-SQGW4VAW.js}

@@ -4,6 +4,7 @@ import {
   PLATFORM_STORAGE_RULE,
   SECRET_PATTERNS,
   claudeModelAlias,
+  containerMemoryForAgentClass,
   encodeClaudeProjectPath,
   getOrCreateDailySession,
   isClaudeFastMode,
@@ -19,7 +20,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-CCQ3WAVH.js";
+} from "./chunk-GSRUWWT6.js";
 import {
   classifyUnanswerablePane,
   findUsageLimitResetHint,
@@ -146,6 +147,121 @@ function hardBoundedCapture(file, args, opts) {
   return r.kind === "ok" ? r.stdout : null;
 }
 
+// src/lib/container-memory-sync.ts
+var DOCKER_MEMORY_OVERRIDE = /^[1-9]\d*[bkmg]?$/i;
+var DOCKER_MIN_MEMORY_BYTES = 6 * 1024 ** 2;
+function validMemoryOverride() {
+  const raw = process.env.AGT_ISOLATION_MEMORY?.trim();
+  if (!raw || !DOCKER_MEMORY_OVERRIDE.test(raw)) return null;
+  const bytes = parseDockerMemoryBytes(raw);
+  return bytes !== null && bytes >= DOCKER_MIN_MEMORY_BYTES ? raw : null;
+}
+function isInvalidMemoryOverride() {
+  const raw = process.env.AGT_ISOLATION_MEMORY?.trim();
+  return !!raw && validMemoryOverride() === null;
+}
+function resolveContainerMemory(agentClass) {
+  return validMemoryOverride() ?? containerMemoryForAgentClass(agentClass);
+}
+var UNIT_BYTES = {
+  "": 1,
+  k: 1024,
+  m: 1024 ** 2,
+  g: 1024 ** 3,
+  t: 1024 ** 4
+};
+function parseDockerMemoryBytes(value) {
+  const m = /^\s*(\d+(?:\.\d+)?)\s*([kmgt]?)(?:i?b)?\s*$/i.exec(value);
+  if (!m) return null;
+  const bytes = Math.floor(Number(m[1]) * UNIT_BYTES[m[2].toLowerCase()]);
+  return Number.isSafeInteger(bytes) && bytes > 0 ? bytes : null;
+}
+var defaultDeps = (log2) => ({
+  exec: (args) => hardBoundedExecFile("docker", args, { timeoutMs: 15e3 }),
+  log: log2
+});
+var appliedBytesBySession = /* @__PURE__ */ new Map();
+var lastLogBySession = /* @__PURE__ */ new Map();
+function logOnce(deps, codeName, msg) {
+  if (lastLogBySession.get(codeName) === msg) return;
+  lastLogBySession.set(codeName, msg);
+  deps.log(msg);
+}
+function seedContainerMemory(codeName, memory) {
+  const bytes = parseDockerMemoryBytes(memory);
+  if (bytes === null) appliedBytesBySession.delete(codeName);
+  else appliedBytesBySession.set(codeName, bytes);
+  lastLogBySession.delete(codeName);
+}
+function syncContainerMemory(codeName, agentClass, log2, deps = defaultDeps(log2)) {
+  const desired = resolveContainerMemory(agentClass);
+  const desiredBytes = parseDockerMemoryBytes(desired);
+  const container = `agt-${codeName}`;
+  if (isInvalidMemoryOverride()) {
+    logOnce(
+      deps,
+      `${codeName}:override`,
+      `[isolation-memory] AGT_ISOLATION_MEMORY='${process.env.AGT_ISOLATION_MEMORY}' is not a valid Docker memory size (integer with optional b/k/m/g, at least 6m) \u2014 ignored; using the agent_class ceiling ${desired}`
+    );
+  }
+  if (desiredBytes === null) {
+    logOnce(deps, codeName, `[isolation-memory] '${codeName}': unparseable memory ceiling '${desired}' \u2014 not applied`);
+    return "failed";
+  }
+  let currentBytes = appliedBytesBySession.get(codeName);
+  if (currentBytes === void 0) {
+    const inspected = deps.exec(["inspect", "-f", "{{.HostConfig.Memory}}", container]);
+    const parsed = inspected.kind === "ok" ? Number(inspected.stdout.trim()) : NaN;
+    if (!Number.isSafeInteger(parsed) || parsed < 0) {
+      logOnce(
+        deps,
+        codeName,
+        `[isolation-memory] '${codeName}': could not read ${container}'s memory ceiling (${describe(inspected)}) \u2014 will retry`
+      );
+      return "failed";
+    }
+    currentBytes = parsed === 0 ? Number.POSITIVE_INFINITY : parsed;
+    appliedBytesBySession.set(codeName, currentBytes);
+  }
+  if (currentBytes === desiredBytes) {
+    lastLogBySession.delete(codeName);
+    return "unchanged";
+  }
+  if (currentBytes > desiredBytes) {
+    logOnce(
+      deps,
+      codeName,
+      `[isolation-memory] '${codeName}': ceiling ${formatBytes(currentBytes)} -> ${desired} (agent_class=${String(agentClass)}) is a decrease \u2014 deferred to the next respawn, not applied live (lowering memory.max under use OOM-kills inside the container)`
+    );
+    return "deferred-lower";
+  }
+  const updated = deps.exec(["update", "--memory", desired, "--memory-swap", desired, container]);
+  if (updated.kind !== "ok") {
+    logOnce(
+      deps,
+      codeName,
+      `[isolation-memory] '${codeName}': docker update to ${desired} failed (${describe(updated)}) \u2014 will retry`
+    );
+    return "failed";
+  }
+  appliedBytesBySession.set(codeName, desiredBytes);
+  lastLogBySession.delete(codeName);
+  deps.log(
+    `[isolation-memory] '${codeName}': ceiling ${formatBytes(currentBytes)} -> ${desired} (agent_class=${String(agentClass)}), applied live`
+  );
+  return "raised";
+}
+function describe(r) {
+  if (r.kind === "ok") return `unexpected output '${r.stdout.trim().slice(0, 80)}'`;
+  if (r.kind === "timed-out") return "timed out";
+  return r.message.trim().slice(0, 200) || `exit ${r.status}`;
+}
+function formatBytes(bytes) {
+  if (!Number.isFinite(bytes)) return "unlimited";
+  const gib = bytes / 1024 ** 3;
+  return Number.isInteger(gib) ? `${gib}g` : `${Math.round(bytes / 1024 ** 2)}m`;
+}
+
 // src/lib/persistent-session.ts
 import { join as join7, dirname as dirname5 } from "path";
 import { homedir as homedir5, platform, userInfo as userInfo2 } from "os";
@@ -3735,7 +3851,7 @@ function ensureClaudeStateLayout(args) {
   mkdirSync6(join7(projects, encodeClaudeProjectPath(args.projectDir)), { recursive: true });
 }
 function buildDockerRunCommand(args) {
-  const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, passModelPolicyGateway, passModelPolicyModel, egress, forwardSlackReplyBinding, forwardBlockTurnEndAllMarkers, forwardKanbanWaiting, forwardNotifyDispatch, forwardTurnFailureNotice, forwardChannelSecrets } = args;
+  const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, passModelPolicyGateway, passModelPolicyModel, egress, forwardSlackReplyBinding, forwardBlockTurnEndAllMarkers, forwardKanbanWaiting, forwardNotifyDispatch, forwardTurnFailureNotice, forwardChannelSecrets, agentClass } = args;
   const q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
   const agentDir2 = join7(homeDir, ".augmented", codeName);
   const agentIdDir = join7(homeDir, ".augmented", agentId);
@@ -3761,7 +3877,7 @@ function buildDockerRunCommand(args) {
     ...CLAUDE_NULLED_FILES.map((name) => `-v ${q(`/dev/null:${join7(claudeHome, name)}`)}`)
   ];
   const image = process.env.AGT_ISOLATION_IMAGE || "agt-runtime:latest";
-  const memory = process.env.AGT_ISOLATION_MEMORY || "2g";
+  const memory = resolveContainerMemory(agentClass);
   const memorySwap = memory;
   const cpus = process.env.AGT_ISOLATION_CPUS || "1.0";
   const pids = process.env.AGT_ISOLATION_PIDS || "512";
@@ -4574,7 +4690,9 @@ function spawnSession(config, session) {
       // no longer carries them for the in-container wrapper to source, so
       // without the forward `${SLACK_BOT_TOKEN}` resolves empty and the
       // channel MCP dies. Empty/undef ⇒ no forwards (file-sourced as before).
-      forwardChannelSecrets: config.channelSpawnSecrets ? Object.keys(config.channelSpawnSecrets) : void 0
+      forwardChannelSecrets: config.channelSpawnSecrets ? Object.keys(config.channelSpawnSecrets) : void 0,
+      // ENG-10641: the memory ceiling follows the agent's class.
+      agentClass: config.agentClass
     }) : JSON.stringify(wrapperPath);
     const tmuxEnv = buildSpawnEnv({
       base: process.env,
@@ -5357,6 +5475,9 @@ export {
   LATE_BOUND_VARS,
   expandTemplateVars,
   parseEnvIntegrations,
+  resolveContainerMemory,
+  seedContainerMemory,
+  syncContainerMemory,
   agentRuntimeKey,
   log,
   sha256,
@@ -5454,4 +5575,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-F47LQPDM.js.map
+//# sourceMappingURL=chunk-SQGW4VAW.js.map