@integrity-labs/agt-cli 0.27.118 → 0.27.119

package/dist/bin/agt.js

@@ -28,7 +28,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-WQV2432Z.js";
+} from "../chunk-SUSXP7ZY.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -54,7 +54,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-MTKM655R.js";
+} from "../chunk-Z6JJRLHH.js";
 
 // src/bin/agt.ts
 import { join as join20 } from "path";
@@ -4934,7 +4934,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.118" : "dev";
+var cliVersion = true ? "0.27.119" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5857,7 +5857,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.118" : "dev";
+var cliVersion2 = true ? "0.27.119" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-IUN5LBTQ.js → chunk-AZEYTJ4L.js}

@@ -1,7 +1,7 @@
 import {
   claudeModelAlias,
   isClaudeFastMode
-} from "./chunk-MTKM655R.js";
+} from "./chunk-Z6JJRLHH.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -1584,4 +1584,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-IUN5LBTQ.js.map
+//# sourceMappingURL=chunk-AZEYTJ4L.js.map

package/dist/{chunk-WQV2432Z.js → chunk-SUSXP7ZY.js}

@@ -9,7 +9,7 @@ import {
   parseDeliveryTarget,
   registerFramework,
   wrapScheduledTaskPrompt
-} from "./chunk-MTKM655R.js";
+} from "./chunk-Z6JJRLHH.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -7603,4 +7603,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-WQV2432Z.js.map
+//# sourceMappingURL=chunk-SUSXP7ZY.js.map

package/dist/{chunk-MTKM655R.js → chunk-Z6JJRLHH.js}

@@ -1267,6 +1267,42 @@ var HOURLY_BY_REGION = {
 };
 var KNOWN_PRICING_REGIONS = Object.keys(HOURLY_BY_REGION);
 
+// ../../packages/core/dist/integrations/composio-linkage.js
+function assessAuthConfigLinkage(input) {
+  const { accountAuthConfigId, serverAuthConfigIds, serverId } = input;
+  const serverLabel = serverId ? ` (${serverId})` : "";
+  if (serverAuthConfigIds == null || !accountAuthConfigId) {
+    return {
+      linked: null,
+      message: "auth_config linkage not verified \u2014 " + (serverAuthConfigIds == null ? "couldn't read the wired MCP server's auth config binding" : "Composio returned no auth_config for the connected account"),
+      details: {
+        accountAuthConfigId: accountAuthConfigId ?? null,
+        serverAuthConfigIds: serverAuthConfigIds ?? null,
+        serverId: serverId ?? null
+      }
+    };
+  }
+  if (serverAuthConfigIds.length === 0) {
+    return {
+      linked: false,
+      message: `The agent's wired MCP server${serverLabel} has no auth config bound, so it cannot resolve the connected account (bound to auth_config ${accountAuthConfigId}) \u2014 reconnect/rebind required.`,
+      details: { accountAuthConfigId, serverAuthConfigIds, serverId: serverId ?? null }
+    };
+  }
+  if (serverAuthConfigIds.includes(accountAuthConfigId)) {
+    return {
+      linked: true,
+      message: `Connected account's auth_config (${accountAuthConfigId}) matches the wired MCP server binding.`,
+      details: { accountAuthConfigId, serverAuthConfigIds, serverId: serverId ?? null }
+    };
+  }
+  return {
+    linked: false,
+    message: `The connected account is bound to auth_config ${accountAuthConfigId}, but the agent's wired MCP server${serverLabel} resolves auth_config(s) [${serverAuthConfigIds.join(", ")}] \u2014 tool calls will fail with "No connected account found". Reconnect/rebind required.`,
+    details: { accountAuthConfigId, serverAuthConfigIds, serverId: serverId ?? null }
+  };
+}
+
 // ../../packages/core/dist/integrations/composio-account-probe.js
 var PROBE_TIMEOUT_MS = 1e4;
 var COMPOSIO_API_BASE = "https://backend.composio.dev";
@@ -1350,12 +1386,214 @@ async function probeComposioAccount(params, fetchImpl = fetch) {
       details: { connectedAccountId, status: accountStatus, boundUserId, expectedUserId }
     };
   }
+  const accountAuthConfigId = data.auth_config_id ?? data.auth_config?.id;
+  if (params.serverId) {
+    const serverAuthConfigIds = await fetchServerAuthConfigIds(fetchImpl, base, params.serverId, apiKey);
+    const linkage = assessAuthConfigLinkage({
+      accountAuthConfigId,
+      serverAuthConfigIds,
+      serverId: params.serverId
+    });
+    if (linkage.linked === false) {
+      return {
+        status: "down",
+        message: linkage.message,
+        details: { connectedAccountId, status: accountStatus, boundUserId, ...linkage.details }
+      };
+    }
+  }
   return {
     status: "ok",
     message: `Connected (account ${connectedAccountId}, status=ACTIVE)`,
-    details: { connectedAccountId, status: accountStatus, boundUserId }
+    details: {
+      connectedAccountId,
+      status: accountStatus,
+      boundUserId,
+      ...accountAuthConfigId ? { authConfigId: accountAuthConfigId } : {}
+    }
   };
 }
+async function fetchServerAuthConfigIds(fetchImpl, base, serverId, apiKey) {
+  let res;
+  try {
+    res = await timedFetch(fetchImpl, `${base}/api/v3/mcp/${encodeURIComponent(serverId)}`, { headers: { "x-api-key": apiKey } });
+  } catch {
+    return null;
+  }
+  if (!res.ok)
+    return null;
+  try {
+    const data = await res.json();
+    return data.auth_config_ids ?? data.auth_configs?.map((c) => c.id).filter((id) => typeof id === "string" && id.length > 0) ?? [];
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/core/dist/integrations/composio-tool-call-probe.js
+var MCP_ACCEPT = "application/json, text/event-stream";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var READONLY_VERB_TOKENS = [
+  "LIST",
+  "GET",
+  "FIND",
+  "SEARCH",
+  "FETCH",
+  "COUNT",
+  "RETRIEVE",
+  "READ"
+];
+var ACCOUNT_RESOLUTION_ERROR_PATTERNS = [
+  "no connected account",
+  "connected account not found",
+  "no account found",
+  "could not be resolved",
+  "auth config",
+  "no connection found"
+];
+function pickSafeReadonlyTool(tools) {
+  for (const t of tools) {
+    if (!t?.name)
+      continue;
+    const upper = t.name.toUpperCase();
+    const hasReadVerb = READONLY_VERB_TOKENS.some((v) => upper.includes(v));
+    if (!hasReadVerb)
+      continue;
+    const required = t.inputSchema?.required ?? [];
+    if (Array.isArray(required) && required.length > 0)
+      continue;
+    return t.name;
+  }
+  return null;
+}
+function isAccountResolutionError(message) {
+  const m = message.toLowerCase();
+  return ACCOUNT_RESOLUTION_ERROR_PATTERNS.some((p) => m.includes(p));
+}
+async function parseRpc(res, expectedId) {
+  const ct = res.headers.get("content-type") ?? "";
+  if (ct.includes("text/event-stream")) {
+    const text = await res.text();
+    let dataLines = [];
+    for (const rawLine of text.split(/\r?\n/)) {
+      if (rawLine.startsWith("data:")) {
+        dataLines.push(rawLine.slice(5).trimStart());
+        continue;
+      }
+      if (rawLine === "" && dataLines.length > 0) {
+        try {
+          const msg2 = JSON.parse(dataLines.join("\n"));
+          if (("result" in msg2 || "error" in msg2) && msg2["id"] === expectedId)
+            return msg2;
+        } catch {
+        }
+        dataLines = [];
+      }
+    }
+    return null;
+  }
+  const msg = await res.json().catch(() => null);
+  if (msg && ("result" in msg || "error" in msg) && msg["id"] === expectedId)
+    return msg;
+  return null;
+}
+async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const baseHeaders = {
+    ...config.headers ?? {},
+    "Content-Type": "application/json",
+    Accept: MCP_ACCEPT
+  };
+  try {
+    const initRes = await fetchImpl(config.url, {
+      method: "POST",
+      headers: baseHeaders,
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-03-26",
+          capabilities: {},
+          clientInfo: { name: "augmented-toolcall-probe", version: "1.0.0" }
+        }
+      }),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!initRes.ok) {
+      return initRes.status >= 500 ? { status: "transient_error", message: `MCP initialize returned ${initRes.status}` } : null;
+    }
+    const sessionId = initRes.headers.get("mcp-session-id");
+    await parseRpc(initRes, 1);
+    const sessionHeaders = { ...baseHeaders, ...sessionId ? { "Mcp-Session-Id": sessionId } : {} };
+    const initializedRes = await fetchImpl(config.url, {
+      method: "POST",
+      headers: sessionHeaders,
+      body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
+      signal: AbortSignal.timeout(5e3)
+    });
+    await initializedRes.text().catch(() => "");
+    const listRes = await fetchImpl(config.url, {
+      method: "POST",
+      headers: sessionHeaders,
+      body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" }),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!listRes.ok) {
+      return listRes.status >= 500 ? { status: "transient_error", message: `MCP tools/list returned ${listRes.status}` } : null;
+    }
+    const listRpc = await parseRpc(listRes, 2);
+    const tools = listRpc?.["result"]?.tools ?? [];
+    const toolName = pickSafeReadonlyTool(tools);
+    if (!toolName)
+      return null;
+    const callRes = await fetchImpl(config.url, {
+      method: "POST",
+      headers: sessionHeaders,
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 3,
+        method: "tools/call",
+        params: { name: toolName, arguments: {} }
+      }),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!callRes.ok) {
+      return callRes.status >= 500 ? { status: "transient_error", message: `MCP tools/call returned ${callRes.status}` } : null;
+    }
+    const callRpc = await parseRpc(callRes, 3);
+    if (callRpc && "error" in callRpc) {
+      const errMsg = callRpc["error"]?.message ?? "";
+      if (isAccountResolutionError(errMsg)) {
+        return {
+          status: "down",
+          message: `Live tool call '${toolName}' failed to resolve the connected account: ${errMsg}`,
+          details: { tool: toolName }
+        };
+      }
+      return { status: "ok", message: `Live tool call '${toolName}' resolved the account (tool error: ${errMsg})`, details: { tool: toolName } };
+    }
+    const result = callRpc?.["result"];
+    if (result?.isError) {
+      const text = (result.content ?? []).map((c) => c.text ?? "").join(" ");
+      if (isAccountResolutionError(text)) {
+        return {
+          status: "down",
+          message: `Live tool call '${toolName}' failed to resolve the connected account: ${text}`,
+          details: { tool: toolName }
+        };
+      }
+      return { status: "ok", message: `Live tool call '${toolName}' resolved the account (tool error)`, details: { tool: toolName } };
+    }
+    return { status: "ok", message: `Live tool call '${toolName}' resolved the connected account`, details: { tool: toolName } };
+  } catch (err) {
+    const isAbort = err?.name === "TimeoutError" || err?.name === "AbortError";
+    return {
+      status: "transient_error",
+      message: isAbort ? `MCP tool-call probe timed out after ${timeoutMs / 1e3}s` : `MCP tool-call probe failed: ${err.message}`
+    };
+  }
+}
 
 // ../../packages/core/dist/integrations/context-validator.js
 import Ajv2020 from "ajv/dist/2020.js";
@@ -1596,6 +1834,31 @@ var OAUTH_PROVIDERS = {
       "accounting.reports.executivesummary.read",
       "accounting.reports.aged.read"
     ],
+    // Read-only variant (ENG-6170): the `.read` granular scope for every
+    // surface, so a token granted under it cannot create bills/invoices or
+    // mutate contacts/attachments. Used when an install is (re)connected with
+    // `read_only: true` — e.g. to lock a production-books integration to reads
+    // until per-vendor broker mediation (ENG-4922) gates its writes.
+    readOnlyScopes: [
+      "openid",
+      "profile",
+      "email",
+      "offline_access",
+      "accounting.settings.read",
+      "accounting.contacts.read",
+      "accounting.invoices.read",
+      "accounting.attachments.read",
+      "accounting.payments.read",
+      "accounting.banktransactions.read",
+      "accounting.manualjournals.read",
+      "accounting.reports.balancesheet.read",
+      "accounting.reports.profitandloss.read",
+      "accounting.reports.trialbalance.read",
+      "accounting.reports.budgetsummary.read",
+      "accounting.reports.banksummary.read",
+      "accounting.reports.executivesummary.read",
+      "accounting.reports.aged.read"
+    ],
     supportsRefresh: true,
     extraAuthorizeParams: {},
     clientAuthMethod: "basic",
@@ -4388,6 +4651,7 @@ export {
   worseConnectivityOutcome,
   resolveConnectivityProbe,
   probeComposioAccount,
+  probeComposioMcpToolCall,
   probeHttpProvider,
   detectDrift,
   SUPPRESS_SENTINEL,
@@ -4399,4 +4663,4 @@ export {
   attributeTranscriptUsageByRun,
   KANBAN_CHECK_COMMAND
 };
-//# sourceMappingURL=chunk-MTKM655R.js.map
+//# sourceMappingURL=chunk-Z6JJRLHH.js.map