@integrity-labs/agt-cli 0.27.168 → 0.27.170

package/dist/{chunk-3A2H4ZLD.js → chunk-YX35EONG.js}

@@ -1490,6 +1490,24 @@ var ACCOUNT_RESOLUTION_ERROR_PATTERNS = [
   "auth config",
   "no connection found"
 ];
+var UPSTREAM_AUTH_ERROR_PATTERNS = [
+  "authentication required",
+  "not authenticated",
+  "unauthorized",
+  "authentication_error",
+  "authentication error",
+  "invalid authentication",
+  "invalid credentials",
+  "invalid api key",
+  "invalid access token",
+  "token expired",
+  "token has expired",
+  "expired access token",
+  "expired credentials",
+  "permission denied",
+  "access denied",
+  "forbidden"
+];
 function isReadonlyToolDescriptor(t) {
   if (!t?.name)
     return false;
@@ -1525,6 +1543,24 @@ function isAccountResolutionError(message) {
   const m = message.toLowerCase();
   return ACCOUNT_RESOLUTION_ERROR_PATTERNS.some((p) => m.includes(p));
 }
+function isUpstreamAuthError(message) {
+  const m = message.toLowerCase();
+  if (UPSTREAM_AUTH_ERROR_PATTERNS.some((p) => m.includes(p)))
+    return true;
+  if (/\b(401|403)\s+client error/.test(m))
+    return true;
+  return /(status(?:_?code)?|http_?status(?:_code)?|mercury_last_http_status_code)["'\\\s]*[:=]["'\\\s]*(401|403)\b/.test(m);
+}
+function isComposioFailureEnvelope(text) {
+  return /["'\\]*(successful|successfull)["'\\\s]*:\s*false\b/i.test(text);
+}
+function classifyToolCallFailure(text) {
+  if (isAccountResolutionError(text))
+    return "account";
+  if (isUpstreamAuthError(text))
+    return "auth";
+  return "benign";
+}
 async function parseRpc(res, expectedId) {
   const ct = res.headers.get("content-type") ?? "";
   if (ct.includes("text/event-stream")) {
@@ -1629,28 +1665,29 @@ async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
       if (raw)
         baseDetails.response = raw.length > 2e3 ? `${raw.slice(0, 2e3)}\u2026` : raw;
     }
-    if (callRpc && "error" in callRpc) {
-      const errMsg = callRpc["error"]?.message ?? "";
-      if (isAccountResolutionError(errMsg)) {
+    const rpcErrMsg = callRpc && "error" in callRpc ? callRpc["error"]?.message ?? "" : "";
+    const result = callRpc?.["result"];
+    const contentText = (result?.content ?? []).map((c) => c.text ?? "").join(" ").trim();
+    const failed = Boolean(rpcErrMsg) || Boolean(result?.isError) || isComposioFailureEnvelope(contentText);
+    if (failed) {
+      const failureText = [rpcErrMsg, contentText].filter(Boolean).join(" ");
+      const snippet = failureText.length > 200 ? `${failureText.slice(0, 200)}\u2026` : failureText;
+      const kind = classifyToolCallFailure(failureText);
+      if (kind === "account") {
         return {
           status: "down",
-          message: `Live tool call '${toolName}' failed to resolve the connected account: ${errMsg}`,
+          message: `Live tool call '${toolName}' failed to resolve the connected account: ${snippet}`,
           details: baseDetails
         };
       }
-      return { status: "ok", message: `Live tool call '${toolName}' resolved the account (tool error: ${errMsg})`, details: baseDetails };
-    }
-    const result = callRpc?.["result"];
-    if (result?.isError) {
-      const text = (result.content ?? []).map((c) => c.text ?? "").join(" ");
-      if (isAccountResolutionError(text)) {
+      if (kind === "auth") {
         return {
           status: "down",
-          message: `Live tool call '${toolName}' failed to resolve the connected account: ${text}`,
-          details: baseDetails
+          message: `Live tool call '${toolName}' was rejected by the provider \u2014 the connection's credential is no longer valid (reconnect required): ${snippet}`,
+          details: { ...baseDetails, reason: "upstream_auth_rejected" }
         };
       }
-      return { status: "ok", message: `Live tool call '${toolName}' resolved the account (tool error)`, details: baseDetails };
+      return { status: "ok", message: `Live tool call '${toolName}' resolved the account (tool error: ${snippet})`, details: baseDetails };
     }
     return { status: "ok", message: `Live tool call '${toolName}' resolved the connected account`, details: baseDetails };
   } catch (err) {
@@ -2372,6 +2409,18 @@ var FLAG_REGISTRY = [
     // Enforcement gate: weakening it (enforce → shadow/off) drops a channel
     // safety control, so mutations require explicit confirmation.
     sensitive: true
+  },
+  {
+    key: "projects-menu",
+    description: "Show the Projects nav item in the webapp (ADR-0017 Projects soft launch, ENG-6342). Replaces the isAdmin/adminOnly gate with a per-org rollout flag.",
+    flagType: "boolean",
+    // PUBLIC (ADR-0022 §2): this is a UI-rollout flag the browser legitimately
+    // needs, so it's the one flag serialized to the client via GET /flags.
+    // Evaluated per the caller's active org — flip it on per-org from the admin
+    // Feature Flags page to reveal Projects for that org. No env override (UI
+    // flag, not an operator gate). Ships dark (default false).
+    public: true,
+    defaultValue: false
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
@@ -5076,4 +5125,4 @@ export {
   coerceEnvValue,
   FLAGS_SCHEMA_VERSION
 };
-//# sourceMappingURL=chunk-3A2H4ZLD.js.map
+//# sourceMappingURL=chunk-YX35EONG.js.map