@integrity-labs/agt-cli 0.28.990 → 0.28.992

package/dist/{claude-pair-runtime-GQM26I3M.js → claude-pair-runtime-EVAYZI57.js}

@@ -258,7 +258,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-PYYD53GZ.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-HBUVJYYR.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -580,4 +580,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-GQM26I3M.js.map
+//# sourceMappingURL=claude-pair-runtime-EVAYZI57.js.map

package/dist/lib/manager-worker.js

@@ -63,7 +63,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-P7B5IRH5.js";
+} from "../chunk-PNQCXCEY.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -74,6 +74,7 @@ import {
 import {
   BLOCKED_ON_PROMPT_DECISION,
   CHANNEL_SECRET_ENV_KEYS,
+  CLAUDE_MANAGED_SETTINGS_DIR,
   ChildProcessError,
   agentRuntimeKey,
   applyBlockedPromptVerdict,
@@ -140,7 +141,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-6KYXH6ZZ.js";
+} from "../chunk-NF7LESJA.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -153,6 +154,7 @@ import {
   FLAG_REGISTRY,
   FORCED_UPDATE_HARD_DEADLINE_MS,
   FORCED_UPDATE_RELAX_AFTER_MS,
+  HITL_TIER_ORDER,
   HOST_USAGE_POLL_INTERVAL_MS,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
@@ -238,7 +240,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-TGCA3LTI.js";
+} from "../chunk-C72SNMP6.js";
 import "../chunk-DHWNVVX4.js";
 import {
   reapOrphanChannelMcps
@@ -583,6 +585,11 @@ function withResolvedRemoteMcp(integration) {
     ...integration,
     remoteMcp: integration.remote_mcp ?? void 0,
     stdioMcp: integration.stdio_mcp === true ? true : void 0,
+    // ENG-10614: same seam as remoteMcp above. An EMPTY object maps to
+    // undefined deliberately - the proxy reads an empty table as "authoritative,
+    // every tool unknown" and refuses every call, so a definition that happens
+    // to have zero rows must stay ungated rather than be bricked.
+    toolTiers: normalizeToolTiers(integration.tool_tiers),
     // ENG-8344: same seam, same reason. Only the exact string 'broker' opts a
     // row into use-time credential delivery — anything else (including a value
     // a newer API might add later) reads as today's env delivery, so an
@@ -590,6 +597,17 @@ function withResolvedRemoteMcp(integration) {
     credentialDelivery: normalizeCredentialDelivery(integration.credential_delivery)
   };
 }
+function normalizeToolTiers(raw) {
+  if (!raw) return void 0;
+  const out = {};
+  for (const [tool, tier] of Object.entries(raw)) {
+    if (typeof tool !== "string" || !tool) continue;
+    if (typeof tier !== "string") continue;
+    if (!HITL_TIER_ORDER.includes(tier)) continue;
+    out[tool] = tier;
+  }
+  return out;
+}
 function normalizeCredentialDelivery(value) {
   const anomaly = describeUnrecognisedCredentialDelivery(value);
   if (anomaly) {
@@ -13292,7 +13310,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-JENZOOKG.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-AIBA25OP.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14035,7 +14053,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.990" : "dev";
+var agtCliVersion = true ? "0.28.992" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -14362,7 +14380,7 @@ function runAsync(cmd, args, opts) {
   });
 }
 function claudeManagedSettingsPath() {
-  return process.platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json" : "/etc/claude-code/managed-settings.json";
+  return join42(CLAUDE_MANAGED_SETTINGS_DIR, "managed-settings.json");
 }
 var MANAGED_SETTINGS_KEYS = ["channelsEnabled", "enableAllProjectMcpServers"];
 var MANAGED_SETTINGS_ENV = { DISABLE_AUTOUPDATER: "1" };
@@ -15651,7 +15669,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
+      const { collectDiagnostics } = await import("../persistent-session-HBUVJYYR.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15793,7 +15811,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
+      const { collectDiagnostics } = await import("../persistent-session-HBUVJYYR.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15969,7 +15987,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-JENZOOKG.js");
+      } = await import("../responsiveness-probe-AIBA25OP.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16086,7 +16104,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-JENZOOKG.js");
+        } = await import("../responsiveness-probe-AIBA25OP.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16242,7 +16260,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-BGXRQB27.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-XTMVOHUX.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20530,7 +20548,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-JENZOOKG.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-AIBA25OP.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20573,7 +20591,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
+        const { collectDiagnostics } = await import("../persistent-session-HBUVJYYR.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20624,7 +20642,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
+      const { collectDiagnostics } = await import("../persistent-session-HBUVJYYR.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -21268,7 +21286,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-GQM26I3M.js");
+  } = await import("../claude-pair-runtime-EVAYZI57.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));