@integrity-labs/agt-cli 0.28.1096 → 0.28.1097

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-WFKQVAYW.js";
+} from "../chunk-3RGBEI34.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-CRVS3GGR.js";
+} from "../chunk-EGVRUVOF.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-DH3QU73N.js";
+} from "../chunk-I7XCW4G6.js";
 import "../chunk-OCMJ5E6J.js";
 import "../chunk-XWVM4KPK.js";
 import "../chunk-EL5MWGGH.js";
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1096" : "dev";
+var cliVersion = true ? "0.28.1097" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1096" : "dev";
+var cliVersion2 = true ? "0.28.1097" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-WFKQVAYW.js → chunk-3RGBEI34.js}

@@ -16,7 +16,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-CRVS3GGR.js";
+} from "./chunk-EGVRUVOF.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -79,7 +79,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-DH3QU73N.js";
+} from "./chunk-I7XCW4G6.js";
 import {
   classifyUnanswerablePane,
   isConsumerTermsDialogVisible,
@@ -7122,7 +7122,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1096" : "dev";
+var agtCliVersion = true ? "0.28.1097" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -12095,4 +12095,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-WFKQVAYW.js.map
+//# sourceMappingURL=chunk-3RGBEI34.js.map

package/dist/{chunk-CRVS3GGR.js → chunk-EGVRUVOF.js}

@@ -24,7 +24,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-DH3QU73N.js";
+} from "./chunk-I7XCW4G6.js";
 import {
   classifyUnanswerablePane,
   findUsageLimitResetHint,
@@ -6113,4 +6113,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-CRVS3GGR.js.map
+//# sourceMappingURL=chunk-EGVRUVOF.js.map

package/dist/{chunk-DH3QU73N.js → chunk-I7XCW4G6.js}

@@ -9000,8 +9000,8 @@ var integration_metadata_v1_default = {
     },
     auth_encoding: {
       type: "string",
-      enum: ["basic_username", "raw"],
-      description: "How the credential is encoded into Authorization (ENG-10524). `basic_username` sends it as the HTTP Basic username with an empty password (`Authorization: Basic base64(<credential>:)`), Sportsyear's API-key form. `raw` sends the credential itself as the header value with no scheme word (`Authorization: <credential>`), AppsFlyer OneLink's form (CS-1918). Omit for `<auth_scheme> <credential>`. Must not be combined with `auth_scheme`."
+      enum: ["basic_username", "basic_pair", "raw"],
+      description: "How the credential is encoded into Authorization (ENG-10524). `basic_username` sends it as the HTTP Basic username with an empty password (`Authorization: Basic base64(<credential>:)`), Sportsyear's API-key form. `basic_pair` splits the credential on its first `:` and sends `Authorization: Basic base64(<username>:<password>)`, Projectworks' API-account form (CS-1980). `raw` sends the credential itself as the header value with no scheme word (`Authorization: <credential>`), AppsFlyer OneLink's form (CS-1918). Omit for `<auth_scheme> <credential>`. Must not be combined with `auth_scheme`."
     },
     runtime_scopes: {
       type: "object",
@@ -9226,6 +9226,25 @@ function basicUsernameAuthorization(credential) {
     binary += String.fromCharCode(b);
   return `Basic ${btoa(binary)}`;
 }
+function basicPairAuthorization(credential) {
+  const colon = credential.indexOf(":");
+  if (colon === -1) {
+    throw new TemplateError('credential for basic_pair auth must be "<username>:<password>"');
+  }
+  const username = credential.slice(0, colon);
+  const password = credential.slice(colon + 1);
+  if (username.trim() === "" || password.trim() === "") {
+    throw new TemplateError("credential for basic_pair auth has an empty username or password");
+  }
+  if (!isValidHeaderValue(username) || !isValidHeaderValue(password)) {
+    throw new TemplateError("credential for basic_pair auth contains control characters");
+  }
+  const bytes = new TextEncoder().encode(`${username}:${password}`);
+  let binary = "";
+  for (const b of bytes)
+    binary += String.fromCharCode(b);
+  return `Basic ${btoa(binary)}`;
+}
 function isValidHeaderValue(value) {
   return !/[\x00-\x1f\x7f]/.test(value);
 }
@@ -11994,6 +12013,11 @@ var HTTP_PROBE_PROVIDERS = /* @__PURE__ */ new Set([
   // otherwise surface as empty compliance reports rather than a failed write.
   // Routes to `probeMitti` against `GET /scheduling/v1/feed/schedules?limit=1`.
   "mitti",
+  // CS-1980: Projectworks, added with the integration for the same reason as
+  // Mitti. It is read-only, so a deleted API account or a rotated secret would
+  // otherwise surface as empty project reports rather than a failed write.
+  // Routes to `probeProjectworks` against `GET /api/v1/Projects?pageSize=1`.
+  "projectworks",
   // CS-1863: Storrito, added with the integration. A deleted API credential
   // answers with a redirect to the login page rather than a 401, so without a
   // probe a dead token would surface only as failed story posts.
@@ -12528,6 +12552,54 @@ async function probeMitti(creds, fetchImpl) {
     return networkOutcome(err, String(token));
   }
 }
+async function probeProjectworks(creds, fetchImpl) {
+  const pair = creds.api_key ?? creds.access_token;
+  if (!pair)
+    return { status: "down", message: "No Projectworks credential present" };
+  let authorization;
+  try {
+    authorization = basicPairAuthorization(String(pair));
+  } catch {
+    return {
+      status: "down",
+      message: "Projectworks credential needs both the consumer key and the consumer secret - re-enter them from Admin > Integration > API Accounts"
+    };
+  }
+  try {
+    const res = await timedFetch(fetchImpl, "https://api.projectworksapp.com/api/v1/Projects?pageSize=1", {
+      headers: { Authorization: authorization, Accept: "application/json" }
+    });
+    if (res.status === 403) {
+      return {
+        status: "degraded",
+        cause: "auth_rejected",
+        message: "Projectworks denied access (403) - the API account is valid but lacks permission to read projects; check its permissions under Admin > Integration > API Accounts"
+      };
+    }
+    if (!res.ok) {
+      const message = res.status === 401 ? "Projectworks rejected the API account (401) - wrong consumer key or secret, or the API account was deleted" : res.status === 429 ? rateLimitMessage("Projectworks", res.status) : `Projectworks API returned ${res.status}`;
+      return { status: statusForHttp(res.status), cause: causeForHttp(res.status), message };
+    }
+    let body = null;
+    try {
+      body = await res.json();
+    } catch {
+      body = null;
+    }
+    if (!Array.isArray(body)) {
+      return { status: "down", message: "Projectworks returned 200 without a project list - not a Projectworks API response" };
+    }
+    return { status: "ok", message: "Connected to Projectworks" };
+  } catch (err) {
+    const raw = String(pair);
+    const secretHalf = raw.slice(raw.indexOf(":") + 1);
+    const outcome = networkOutcome(err, raw);
+    return outcome.message === void 0 ? outcome : {
+      ...outcome,
+      message: redactSecret(redactSecret(outcome.message, secretHalf), authorization.slice("Basic ".length))
+    };
+  }
+}
 async function probeStorrito(creds, fetchImpl, config) {
   const token = creds.api_key ?? creds.access_token;
   if (!token)
@@ -12649,6 +12721,8 @@ async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch, c
       return probeInstantly(credentials, fetchImpl);
     case "mitti":
       return probeMitti(credentials, fetchImpl);
+    case "projectworks":
+      return probeProjectworks(credentials, fetchImpl);
     case "google-workspace":
       return probeBearerJson("https://www.googleapis.com/oauth2/v2/userinfo", credentials, fetchImpl, (body) => {
         const info = body;
@@ -16445,4 +16519,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-DH3QU73N.js.map
+//# sourceMappingURL=chunk-I7XCW4G6.js.map