@integrity-labs/agt-cli 0.28.978 → 0.28.980

package/dist/{chunk-7DI7HSGB.js → chunk-Y7FKKMA5.js}

@@ -6967,7 +6967,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.978" : "dev";
+var agtCliVersion = true ? "0.28.980" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11709,4 +11709,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-7DI7HSGB.js.map
+//# sourceMappingURL=chunk-Y7FKKMA5.js.map

package/dist/lib/manager-worker.js

@@ -63,7 +63,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-7DI7HSGB.js";
+} from "../chunk-Y7FKKMA5.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -246,7 +246,7 @@ import {
 
 // src/lib/manager-worker.ts
 import { createHash as createHash20 } from "crypto";
-import { readFileSync as readFileSync33, writeFileSync as writeFileSync18, mkdirSync as mkdirSync15, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync12, statSync as statSync12, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4 } from "fs";
+import { readFileSync as readFileSync33, writeFileSync as writeFileSync18, mkdirSync as mkdirSync15, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync12, statSync as statSync13, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4 } from "fs";
 
 // src/lib/atomic-file-replace.ts
 import { copyFileSync, renameSync, unlinkSync } from "fs";
@@ -5605,6 +5605,36 @@ function bundleFingerprint(files) {
   return sorted.map((f) => `${f.relativePath}\0${f.content}`).join("
");
 }
 
+// src/lib/self-update-device-state-hold.ts
+import { statSync as statSync5 } from "fs";
+import { platform as osPlatform } from "os";
+function realStat(path) {
+  try {
+    return { isFile: statSync5(path).isFile() };
+  } catch (err) {
+    return { errno: err?.code ?? "UNKNOWN" };
+  }
+}
+function deviceStateHoldApplies(inputs) {
+  const { authMode, credentialPaths } = inputs;
+  const platform4 = inputs.platform ?? osPlatform;
+  const statPath = inputs.statPath ?? realStat;
+  if (authMode === null) return { applies: true, because: "mode-unknown" };
+  if (authMode !== "subscription") return { applies: true, because: "non-subscription-mode" };
+  if (platform4() === "darwin") return { applies: true, because: "platform-opaque" };
+  let sawUnknownError = false;
+  for (const path of credentialPaths) {
+    const result = statPath(path);
+    if ("isFile" in result) {
+      if (result.isFile) return { applies: true, because: "paired" };
+      continue;
+    }
+    if (result.errno !== "ENOENT") sawUnknownError = true;
+  }
+  if (sawUnknownError) return { applies: true, because: "credentials-unreadable" };
+  return { applies: false, because: "never-paired" };
+}
+
 // src/lib/channel-config-hash.ts
 import { createHash as createHash8 } from "crypto";
 var DERIVED_PRINCIPAL_ID_LIST_KEYS = [
@@ -5659,7 +5689,7 @@ import {
   readdirSync as readdirSync5,
   renameSync as renameSync5,
   rmSync as rmSync3,
-  statSync as statSync5,
+  statSync as statSync6,
   utimesSync,
   writeFileSync as writeFileSync8
 } from "fs";
@@ -5708,7 +5738,7 @@ function sweepKnowledgeCache(cacheDir, now = Date.now()) {
     for (const name of readdirSync5(cacheDir)) {
       const path = join24(cacheDir, name);
       try {
-        if (now - statSync5(path).mtimeMs > CACHE_TTL_MS) rmSync3(path, { force: true });
+        if (now - statSync6(path).mtimeMs > CACHE_TTL_MS) rmSync3(path, { force: true });
       } catch {
       }
     }
@@ -5762,7 +5792,7 @@ import {
   readdirSync as readdirSync6,
   renameSync as renameSync6,
   rmSync as rmSync4,
-  statSync as statSync6,
+  statSync as statSync7,
   utimesSync as utimesSync2,
   writeFileSync as writeFileSync9
 } from "fs";
@@ -5811,7 +5841,7 @@ function sweepMemoryCache(cacheDir, now = Date.now()) {
     for (const name of readdirSync6(cacheDir)) {
       const path = join25(cacheDir, name);
       try {
-        if (now - statSync6(path).mtimeMs > CACHE_TTL_MS2) rmSync4(path, { force: true });
+        if (now - statSync7(path).mtimeMs > CACHE_TTL_MS2) rmSync4(path, { force: true });
       } catch {
       }
     }
@@ -5871,7 +5901,7 @@ import {
   readdirSync as readdirSync7,
   renameSync as renameSync7,
   rmSync as rmSync5,
-  statSync as statSync7,
+  statSync as statSync8,
   utimesSync as utimesSync3,
   writeFileSync as writeFileSync10
 } from "fs";
@@ -5920,7 +5950,7 @@ function sweepSkillCache(cacheDir, now = Date.now()) {
     for (const name of readdirSync7(cacheDir)) {
       const path = join26(cacheDir, name);
       try {
-        if (now - statSync7(path).mtimeMs > CACHE_TTL_MS3) rmSync5(path, { force: true });
+        if (now - statSync8(path).mtimeMs > CACHE_TTL_MS3) rmSync5(path, { force: true });
       } catch {
       }
     }
@@ -6425,7 +6455,7 @@ function pruneStuckStreaksToAgents(maps, activeAgentIds) {
 }
 
 // src/lib/claude-device-state.ts
-import { readFileSync as readFileSync24, statSync as statSync8 } from "fs";
+import { readFileSync as readFileSync24, statSync as statSync9 } from "fs";
 import { homedir as homedir13 } from "os";
 import { join as join30 } from "path";
 function claudeDeviceStatePath(env = process.env) {
@@ -6433,7 +6463,7 @@ function claudeDeviceStatePath(env = process.env) {
 }
 function checkClaudeDeviceState(path = claudeDeviceStatePath()) {
   try {
-    if (!statSync8(path).isFile()) return { usable: false, reason: "not-a-file" };
+    if (!statSync9(path).isFile()) return { usable: false, reason: "not-a-file" };
   } catch (err) {
     return {
       usable: false,
@@ -7210,7 +7240,7 @@ function clearRestartTiming(codeName) {
 function resolveModelChain(refreshData) {
   const agent = refreshData.agent;
   const modelDefaults = refreshData.model_defaults;
-  const platform3 = modelDefaults?.platform ?? {};
+  const platform4 = modelDefaults?.platform ?? {};
   const org = modelDefaults?.org ?? {};
   function resolve2(tier) {
     const agentField = `${tier}_model`;
@@ -7219,7 +7249,7 @@ function resolveModelChain(refreshData) {
     if (agentVal) return agentVal;
     const orgVal = org?.[platformField];
     if (orgVal) return orgVal;
-    const platformVal = platform3?.[platformField];
+    const platformVal = platform4?.[platformField];
     if (platformVal) return platformVal;
     return void 0;
   }
@@ -8825,7 +8855,7 @@ import { homedir as homedir16 } from "os";
 import { join as join37 } from "path";
 
 // src/lib/agent-serving-probe.ts
-import { readFileSync as readFileSync28, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync28, readdirSync as readdirSync8, statSync as statSync10 } from "fs";
 import { join as join36 } from "path";
 var RATE_LIMIT_WINDOW_MS = 6 * 60 * 60 * 1e3;
 function probeRateLimit(args) {
@@ -8844,7 +8874,7 @@ function probeRateLimit(args) {
     if (!name.endsWith(".jsonl")) continue;
     const path = join36(dir, name);
     try {
-      const st = statSync9(path);
+      const st = statSync10(path);
       if (!st.isFile() || st.mtimeMs < startMs) continue;
     } catch {
       continue;
@@ -8983,7 +9013,7 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
 }
 
 // src/lib/occupancy-gate.ts
-import { closeSync as closeSync2, openSync as openSync2, readdirSync as readdirSync9, readSync as readSync2, statSync as statSync10 } from "fs";
+import { closeSync as closeSync2, openSync as openSync2, readdirSync as readdirSync9, readSync as readSync2, statSync as statSync11 } from "fs";
 import { join as join38 } from "path";
 function rostersMeasuredZero(mode, attested, runtimeRunning) {
   return mode === "enforce" && attested && runtimeRunning;
@@ -8998,7 +9028,7 @@ var brackets = /* @__PURE__ */ new Map();
 function readAlignedTail(path, tailBytes, maxAlignBytes) {
   let fd = null;
   try {
-    const size = statSync10(path).size;
+    const size = statSync11(path).size;
     if (size <= 0) return { content: "", complete: true, truncated: false };
     fd = openSync2(path, "r");
     let readStart = Math.max(0, size - tailBytes);
@@ -9142,7 +9172,7 @@ function collectQualifyingTurns(codeName, nowMs, opts = {}) {
   for (const path of paths) {
     let st;
     try {
-      st = statSync10(path);
+      st = statSync11(path);
     } catch (err) {
       if (!isAbsentDirError(err)) complete = false;
       continue;
@@ -9248,7 +9278,7 @@ function qualifyBuckets(buckets, qualifying, mode, nowMs, neighbourhoodMs = DEFA
 }
 
 // src/lib/pane-occupancy-sampler.ts
-import { statSync as statSync11 } from "fs";
+import { statSync as statSync12 } from "fs";
 var SAMPLE_INTERVAL_MS = 1e4;
 var IDLE_GAP_MS = 12e4;
 var POST_IDLE_CREDIT_MS = 6e4;
@@ -9262,7 +9292,7 @@ function hasFreshPaneObservation(codeName, nowMs, maxAgeMs = OBSERVATION_FRESH_M
 }
 function paneMtimeMs(codeName) {
   try {
-    return statSync11(paneLogPath(codeName)).mtimeMs;
+    return statSync12(paneLogPath(codeName)).mtimeMs;
   } catch {
     return null;
   }
@@ -13235,6 +13265,44 @@ function classifyLazyDayRolloverReset(i) {
   return i.deviceStateReady === false ? "defer-device-state" : "reset";
 }
 var deviceStateRotationGate = new DeviceStateRotationGate();
+var SELF_UPDATE_DEVICE_STATE_HOLD_KEY = "(self-update)";
+var selfUpdateForcedHoldAnnounced = false;
+var forcedUpdateRequestLatch = null;
+function lastForcedOutcomeFor(requestedAt) {
+  return requestedAt !== null && forcedUpdateRequestLatch?.requestedAt === requestedAt ? forcedUpdateRequestLatch.lastOutcome : null;
+}
+var credentialsUnreadableAnnounced = false;
+async function hostShouldHaveClaudeDeviceState() {
+  const verdict = deviceStateHoldApplies({
+    authMode: getCachedClaudeAuthMode(),
+    credentialPaths: await findClaudeCredentialsPaths()
+  });
+  const unreadable = verdict.applies && verdict.because === "credentials-unreadable";
+  if (!unreadable) credentialsUnreadableAnnounced = false;
+  if (unreadable && !credentialsUnreadableAnnounced) {
+    credentialsUnreadableAnnounced = true;
+    log(
+      "[self-update] could not determine whether this host is paired: a Claude credentials path exists but could not be stat'd. Holding the CLI upgrade rather than guessing. Check the permissions on ~/.claude. [ENG-10724]"
+    );
+  }
+  return verdict.applies;
+}
+async function selfUpdateDeviceStateHold(force) {
+  if (!await hostShouldHaveClaudeDeviceState()) return null;
+  const deviceState = deviceStateRotationGate.mayRotate(SELF_UPDATE_DEVICE_STATE_HOLD_KEY, Date.now());
+  if (deviceState.ready) {
+    selfUpdateForcedHoldAnnounced = false;
+    return null;
+  }
+  const announceForced = force && !selfUpdateForcedHoldAnnounced;
+  if (deviceState.firstHold || announceForced) {
+    if (announceForced) selfUpdateForcedHoldAnnounced = true;
+    log(
+      `[self-update] HELD${force ? ' (forced "Update CLI now")' : ""} - the host's ~/.claude.json is not usable (${deviceState.reason}) and this host is paired for Claude Code. A CLI upgrade ends in a manager restart, which would rebuild every isolation container on this host against the missing file and park every agent on the login picker. Keeping the current binary; the upgrade applies on the first check after the file is usable again. Pair the host from the Hosts page. (further holds this episode are not logged) [ENG-10724]`
+    );
+  }
+  return "failed";
+}
 function deviceStateAllowsRollover(codeName, path) {
   const gate = deviceStateRotationGate.mayRotate(codeName, Date.now());
   if (gate.ready) return true;
@@ -13299,7 +13367,7 @@ function performLazyDayRolloverReset(codeName, agentTimezone) {
 }
 function paneLogAgeSecondsFor(codeName) {
   try {
-    const mtimeMs = statSync12(paneLogPath(codeName)).mtimeMs;
+    const mtimeMs = statSync13(paneLogPath(codeName)).mtimeMs;
     return Math.max(0, Math.floor((Date.now() - mtimeMs) / 1e3));
   } catch (err) {
     if (err?.code === "ENOENT") return null;
@@ -13391,6 +13459,13 @@ function runPendingForcedUpdate() {
     forcedUpdateRelaxAnnounced = false;
   }
   if (forcedUpdate === "none" || forcedUpdate === "already-handled") return false;
+  if (forcedUpdateRequestLatch && forcedUpdateRequestLatch.requestedAt !== requestedUpdateAt) {
+    forcedUpdateRequestLatch = null;
+    selfUpdateForcedHoldAnnounced = false;
+  }
+  if (forcedUpdate !== "defer-idle" && forcedUpdateRequestLatch?.requestedAt === requestedUpdateAt && forcedUpdateRequestLatch.lastOutcome !== null && Date.now() - forcedUpdateRequestLatch.lastAttemptMs < UPDATE_CHECK_INTERVAL_MS) {
+    return false;
+  }
   if (forcedUpdate === "defer-idle") {
     forcedUpdateDeferStreak += 1;
     if (forcedUpdateDeferStreak === 1 || forcedUpdateDeferStreak % 10 === 0) {
@@ -13412,17 +13487,30 @@ function runPendingForcedUpdate() {
     );
     return false;
   }
-  log(
-    forcedUpdate === "consume-deadline" ? `[self-update] WARN "Update CLI now" requested at ${requestedUpdateAt} has been pending ${describePendingFor(pendingForMs)} and the host still reads busy \u2014 running the window-bypassing self-update anyway (ENG-8449 hard deadline). A live turn may be interrupted; the operator asked for this update explicitly.` : `[self-update] "Update CLI now" requested at ${requestedUpdateAt} \u2014 running window-bypassing self-update now (host idle${relaxed ? ", relaxed gate" : ""}).`
-  );
+  if (lastForcedOutcomeFor(requestedUpdateAt) === null) {
+    log(
+      forcedUpdate === "consume-deadline" ? `[self-update] WARN "Update CLI now" requested at ${requestedUpdateAt} has been pending ${describePendingFor(pendingForMs)} and the host still reads busy \u2014 running the window-bypassing self-update anyway (ENG-8449 hard deadline). A live turn may be interrupted; the operator asked for this update explicitly.` : `[self-update] "Update CLI now" requested at ${requestedUpdateAt} \u2014 running window-bypassing self-update now (host idle${relaxed ? ", relaxed gate" : ""}).`
+    );
+  }
   const prevProcessedAt = state8.lastUpdateRequestProcessedAt ?? null;
+  const attemptStartedMs = Date.now();
   void checkAndUpdateCli({ force: true }).then((outcome) => {
     if (!shouldConsumeForcedUpdate(outcome)) {
-      log(
-        `[self-update] "Update CLI now" did not complete (no install ran) \u2014 leaving the request pending; the next idle poll retries.`
-      );
+      const previous = lastForcedOutcomeFor(requestedUpdateAt);
+      forcedUpdateRequestLatch = requestedUpdateAt === null ? null : {
+        requestedAt: requestedUpdateAt,
+        lastOutcome: outcome,
+        lastAttemptMs: attemptStartedMs
+      };
+      if (previous !== outcome) {
+        log(
+          `[self-update] "Update CLI now" did not complete (outcome: ${outcome}, no install ran) \u2014 leaving the request pending; the next idle poll retries. (repeats of this outcome are not logged)`
+        );
+      }
       return;
     }
+    forcedUpdateRequestLatch = null;
+    selfUpdateForcedHoldAnnounced = false;
     log(
       outcome === "updated" ? `[self-update] "Update CLI now" completed \u2014 upgrade installed; manager restart scheduled.` : `[self-update] "Update CLI now" completed \u2014 host was already on the latest in-channel build; nothing to install.`
     );
@@ -13867,7 +13955,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.978" : "dev";
+var agtCliVersion = true ? "0.28.980" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -14550,6 +14638,8 @@ async function checkAndUpdateCliViaBrew(force = false) {
         return "noop";
       }
       log(`[self-update] agt CLI update available: ${installed} \u2192 ${latest}. Upgrading via brew${force ? " (forced \u2014 Update CLI now)" : ""}...`);
+      const brewInstallHold = await selfUpdateDeviceStateHold(force);
+      if (brewInstallHold) return brewInstallHold;
       try {
         execFileSync2(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
           timeout: 12e4,
@@ -14606,7 +14696,7 @@ async function checkAndUpdateCliViaNpm(force = false) {
         log(
           `[self-update] URGENT agt CLI hotfix ${agtCliVersion} \u2192 ${urgentTarget2} overrides pin=${pinDecision.version} (AGT_CLI_PIN_ALLOW_URGENT). Upgrading via npm...`
         );
-        return await installAgtCliViaNpm(urgentTarget2, "urgent(pin-allow-urgent)");
+        return await installAgtCliViaNpm(urgentTarget2, "urgent(pin-allow-urgent)", force);
       }
     }
     if (pinDecision.kind === "satisfied") {
@@ -14619,7 +14709,7 @@ async function checkAndUpdateCliViaNpm(force = false) {
     log(
       `[self-update] agt CLI pinned to ${pinDecision.version} (AGT_CLI_PIN_VERSION); installing exact version (${agtCliVersion} \u2192 ${pinDecision.version})...`
     );
-    return await installAgtCliViaNpm(pinDecision.version, `pin=${pinDecision.version}`);
+    return await installAgtCliViaNpm(pinDecision.version, `pin=${pinDecision.version}`, force);
   }
   const REGISTRY_TIMEOUT_MS = 1e4;
   const registryAttempts = force ? 2 : 1;
@@ -14667,7 +14757,7 @@ async function checkAndUpdateCliViaNpm(force = false) {
     log(
       `[self-update] URGENT agt CLI hotfix ${agtCliVersion} \u2192 ${urgentTarget} (overrides channel=${channel} + maintenance window). Upgrading via npm...`
     );
-    return await installAgtCliViaNpm(urgentTarget, "urgent");
+    return await installAgtCliViaNpm(urgentTarget, "urgent", force);
   }
   let shouldUpdate;
   if (channel === "latest") {
@@ -14712,7 +14802,7 @@ async function checkAndUpdateCliViaNpm(force = false) {
     return "noop";
   }
   log(`[self-update] agt CLI update available: ${agtCliVersion} \u2192 ${latest} (channel=${channel}). Upgrading via npm...`);
-  return await installAgtCliViaNpm(latest, `channel=${channel}`);
+  return await installAgtCliViaNpm(latest, `channel=${channel}`, force);
 }
 async function fetchUrgentDistTagVersion() {
   try {
@@ -14727,7 +14817,7 @@ async function fetchUrgentDistTagVersion() {
     return null;
   }
 }
-async function installAgtCliViaNpm(version, reasonLabel) {
+async function installAgtCliViaNpm(version, reasonLabel, force = false) {
   const { execFileSync: execFileSync2 } = await import("child_process");
   const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
   const cmd = isRoot ? "npm" : "sudo";
@@ -14738,6 +14828,8 @@ async function installAgtCliViaNpm(version, reasonLabel) {
     "--registry=https://registry.npmjs.org"
   ];
   const args = isRoot ? installArgs : ["-n", "npm", ...installArgs];
+  const npmInstallHold = await selfUpdateDeviceStateHold(force);
+  if (npmInstallHold) return npmInstallHold;
   try {
     execFileSync2(cmd, args, { timeout: 18e4, stdio: "pipe" });
   } catch (err) {
@@ -21484,7 +21576,7 @@ function reapRetiredMemories(configDir, codeName, log2) {
       if (!file.endsWith(".retired")) continue;
       const path = join42(dir, file);
       try {
-        if (statSync12(path).mtimeMs < cutoff) {
+        if (statSync13(path).mtimeMs < cutoff) {
           unlinkSync6(path);
           reaped++;
         }