@integrity-labs/agt-cli 0.28.1189 → 0.28.1190

package/dist/{chunk-CJ3KE25W.js → chunk-EFTLDAKN.js}

@@ -4,7 +4,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-GYY5LC6U.js";
+} from "./chunk-KV6ZNGTG.js";
 import {
   classifyUnanswerablePane,
   customApiKeyDialogKeys,
@@ -51,7 +51,7 @@ import {
   remoteMcpConnectionEnvInfix,
   remoteMcpConnectionLabel,
   remoteMcpConnectionScopedEnvVar
-} from "./chunk-M5QY6SXB.js";
+} from "./chunk-7GZKHF45.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   approveApiKeyInClaudeConfig,
@@ -6173,4 +6173,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-CJ3KE25W.js.map
+//# sourceMappingURL=chunk-EFTLDAKN.js.map

package/dist/{chunk-GYY5LC6U.js → chunk-KV6ZNGTG.js}

@@ -1,6 +1,6 @@
 import {
   encodeClaudeProjectPath
-} from "./chunk-M5QY6SXB.js";
+} from "./chunk-7GZKHF45.js";
 
 // src/lib/daily-session.ts
 import { randomUUID } from "crypto";
@@ -240,4 +240,4 @@ export {
   peekPreviousSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-GYY5LC6U.js.map
+//# sourceMappingURL=chunk-KV6ZNGTG.js.map

package/dist/{chunk-6C22ELAZ.js → chunk-NVLV6XHL.js}

@@ -16,11 +16,11 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-CJ3KE25W.js";
+} from "./chunk-EFTLDAKN.js";
 import {
   readDailySessionPin,
   sessionTranscriptDir
-} from "./chunk-GYY5LC6U.js";
+} from "./chunk-KV6ZNGTG.js";
 import {
   classifyUnanswerablePane,
   isConsumerTermsDialogVisible,
@@ -91,7 +91,7 @@ import {
   scanConfigForLiteralSecrets,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-M5QY6SXB.js";
+} from "./chunk-7GZKHF45.js";
 import {
   claudeJsonPathFor,
   effectiveClaudeJsonPath,
@@ -8079,7 +8079,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1189" : "dev";
+var agtCliVersion = true ? "0.28.1190" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10623,21 +10623,47 @@ import { delimiter as pathDelimiter, join as join8 } from "path";
 import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir6 } from "os";
 
+// src/lib/probe-message-redact.ts
+var MIN_SECRET_LENGTH = 8;
+function stringsIn(value) {
+  if (typeof value === "string") return [value];
+  if (value === null || typeof value !== "object") return [];
+  return Object.values(value).flatMap(stringsIn);
+}
+function longestKnownValue(sources) {
+  return sources.flatMap(stringsIn).filter((v) => v.length >= MIN_SECRET_LENGTH).reduce((longest, v) => Math.max(longest, v.length), 0);
+}
+function redactKnownValues(text, sources) {
+  const values = sources.flatMap(stringsIn).filter((v) => v.length >= MIN_SECRET_LENGTH).sort((a, b) => b.length - a.length);
+  return values.reduce((out, value) => out.split(value).join("[redacted]"), text);
+}
+
 // src/lib/mcp-stdio-probe.ts
 import { spawn } from "child_process";
 var DEFAULT_TIMEOUT_MS = 15e3;
+var STDERR_TAIL_MAX = 500;
+var STDERR_KEEP_MIN = 64 * 1024;
+var TOOL_ERROR_TEXT_MAX = 1e3;
+function toolErrorText(result, env) {
+  const content = result?.content;
+  if (!Array.isArray(content)) return void 0;
+  const text = content.map((part) => part?.text).filter((t) => typeof t === "string").join(" ");
+  return redactKnownValues(text, [env]).replace(/\s+/g, " ").trim().slice(0, TOOL_ERROR_TEXT_MAX) || void 0;
+}
 async function probeMcpStdio(config) {
   const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const childEnv = { ...process.env, ...config.env ?? {} };
   const child = spawn(config.command, config.args ?? [], {
     // Faithful reproduction of the real spawn: the child inherits the manager's
     // process env (PATH/HOME so `node`/`npx` resolve) with the entry's env
     // overlaid, exactly as Claude Code spawns it.
-    env: { ...process.env, ...config.env ?? {} },
+    env: childEnv,
     cwd: config.cwd,
     stdio: ["pipe", "pipe", "pipe"]
   });
   let stdout = "";
-  let stderrTail = "";
+  let stderrBuffer = "";
+  const stderrKeep = Math.max(STDERR_KEEP_MIN, 2 * longestKnownValue([childEnv]) + STDERR_TAIL_MAX);
   const pending = /* @__PURE__ */ new Map();
   return await new Promise((resolve) => {
     let done = false;
@@ -10650,7 +10676,7 @@ async function probeMcpStdio(config) {
         child.kill("SIGKILL");
       } catch {
       }
-      resolve(outcome);
+      resolve(outcome.message ? { ...outcome, message: redactKnownValues(outcome.message, [childEnv]) } : outcome);
     };
     const timer = setTimeout(() => {
       finish({
@@ -10670,15 +10696,17 @@ async function probeMcpStdio(config) {
       if (!done) {
         finish({
           status: "down",
-          message: `MCP server exited (code ${code ?? "null"})${stderrTail ? `: ${stderrTail.trim().slice(-200)}` : ""}`
+          message: `MCP server exited (code ${code ?? "null"})${stderrBuffer ? `: ${redactKnownValues(stderrBuffer, [childEnv]).trim().slice(-200)}` : ""}`
         });
       }
     });
     child.stdin.on("error", () => {
     });
+    child.stderr.setEncoding("utf8");
     child.stderr.on("data", (d) => {
-      stderrTail = (stderrTail + d.toString()).slice(-500);
+      stderrBuffer = (stderrBuffer + d).slice(-stderrKeep);
     });
+    child.stdout.setEncoding("utf8");
     child.stdout.on("data", (d) => {
       stdout += d.toString();
       let nl;
@@ -10732,7 +10760,11 @@ async function probeMcpStdio(config) {
         if (done) return;
         if (call.error) return finish({ status: "down", message: `MCP tools/call ${testTool} error: ${call.error.message ?? "unknown"}` });
         if (call.result?.isError === true) {
-          return finish({ status: "down", message: `MCP tool ${testTool} returned an error result` });
+          const reason = toolErrorText(call.result, childEnv);
+          return finish({
+            status: "down",
+            message: `MCP tool ${testTool} returned an error result${reason ? `: ${reason}` : ""}`
+          });
         }
         return finish({
           status: "ok",
@@ -10990,13 +11022,13 @@ function didNotRunReasonFor(text, exitCode) {
 }
 var CREDENTIAL_SHAPED = /\b(gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|sk-[A-Za-z0-9]{20,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}|AKIA[0-9A-Z]{16})\b/g;
 var MAX_MESSAGE_CHARS = 200;
-function redactAndBound(line) {
-  const redacted = line.replace(CREDENTIAL_SHAPED, "<redacted>");
+function redactAndBound(line, childEnv) {
+  const redacted = redactKnownValues(line, [childEnv]).replace(CREDENTIAL_SHAPED, "<redacted>");
   return redacted.length > MAX_MESSAGE_CHARS ? `${redacted.slice(0, MAX_MESSAGE_CHARS - 1)}\u2026` : redacted;
 }
-function firstMeaningfulLine(stderr, stdout, fallback) {
+function firstMeaningfulLine(stderr, stdout, fallback, childEnv) {
   const line = firstReasonLine(stderr, "failure") ?? firstReasonLine(stdout, "failure") ?? firstReasonLine(fallback, "failure") ?? "";
-  return redactAndBound(line);
+  return redactAndBound(line, childEnv);
 }
 function firstReasonLine(v, lane = "ok") {
   const contradicts = lane === "failure" ? GH_SUCCESS_MARKER : GH_FAILURE_MARKER;
@@ -11056,7 +11088,7 @@ function runCliProbe(binary, args, opts = {}) {
           const firstLine = firstReasonLine(stdout, "ok");
           resolve({
             status: "ok",
-            message: firstLine ? `${binary}: ${redactAndBound(firstLine)}` : `${binary}: ok`
+            message: firstLine ? `${binary}: ${redactAndBound(firstLine, childEnv)}` : `${binary}: ok`
           });
           return;
         }
@@ -11065,9 +11097,9 @@ function runCliProbe(binary, args, opts = {}) {
           logSearchedPath(binary, childEnv, "ENOENT \u2014 no such binary anywhere on it");
           resolve({
             status: "unverified",
-            // ENG-9173 vocabulary: say WHY in the field that survives. The
+            // ENG-9173 vocabulary: say WHY in the field code can branch on. The
             // status alone cannot distinguish this from any other unverified
-            // row, and the message below is dropped before persistence.
+            // row, and the message below is for humans only.
             cause: "not_run",
             message: `${binary} not found on PATH \u2014 the probe could not run, so this is NOT a verdict about the integration. If the agent uses a per-agent binary (e.g. the .claude/agt-bin shim), the probe's PATH must include it.`
           });
@@ -11094,7 +11126,7 @@ ${e.message}`;
             // catches a shim which started and could not find the tool behind
             // it, which is the shape that actually reaches production.
             cause: "not_run",
-            message: `${binary} probe did not run \u2014 ${didNotRun}. This is NOT a verdict about the integration: ${firstMeaningfulLine(stderr, stdout, e.message)}`
+            message: `${binary} probe did not run \u2014 ${didNotRun}. This is NOT a verdict about the integration: ${firstMeaningfulLine(stderr, stdout, e.message, childEnv)}`
           });
           return;
         }
@@ -11105,14 +11137,14 @@ ${e.message}`;
             // ENG-10529: present only when the matched signature carries one.
             // The broker entry deliberately carries none — see its comment.
             ...transient.cause ? { cause: transient.cause } : {},
-            message: `${binary} probe inconclusive \u2014 ${transient.reason}: ${firstMeaningfulLine(stderr, stdout, e.message)}`
+            message: `${binary} probe inconclusive \u2014 ${transient.reason}: ${firstMeaningfulLine(stderr, stdout, e.message, childEnv)}`
           });
           return;
         }
         resolve({
           status: "down",
           .../* @__PURE__ */ ((c) => c ? { cause: c } : {})(downCauseFor(diagnostic)),
-          message: `${binary} exited non-zero: ${firstMeaningfulLine(stderr, stdout, e.message)}`
+          message: `${binary} exited non-zero: ${firstMeaningfulLine(stderr, stdout, e.message, childEnv)}`
         });
       }
     );
@@ -13579,6 +13611,7 @@ export {
   givenUpMcpServerKeys,
   describeBlockedPromptHold,
   reapMissingMcpSessions,
+  redactKnownValues,
   markQuarantinedForProbe,
   FIRST_CONNECT_WINDOW_MS,
   isWithinReconnectQuiesceWindow,
@@ -13614,4 +13647,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-6C22ELAZ.js.map
+//# sourceMappingURL=chunk-NVLV6XHL.js.map