@integrity-labs/agt-cli 0.28.40 → 0.28.41

package/dist/{chunk-DA776TZO.js → chunk-GBST6UWT.js}

@@ -3,6 +3,7 @@ import {
   DEFAULT_MODELS,
   OAUTH_PROVIDERS,
   coerceEnvValue,
+  expandTemplateVars,
   formatForOpenClawCli,
   getChannel,
   getFlagDefinition,
@@ -11,10 +12,17 @@ import {
   listFlagDefinitions,
   normalizeFlagValue,
   parseDeliveryTarget,
+  parseEnvIntegrations,
+  probeComposioAccount,
+  probeComposioMcpToolCall,
+  probeHttpProvider,
+  probeMcpHttp,
   registerFramework,
   resolveAvatarEnvUrl,
+  resolveConnectivityProbe,
+  worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-X5E2Q3W2.js";
+} from "./chunk-SJUD2BWU.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -5816,9 +5824,9 @@ ${sections}`
   // so ensureGatewayRunning() returns early with running=false
   async getVersion() {
     try {
-      const { execFile: execFile4 } = await import("child_process");
+      const { execFile: execFile5 } = await import("child_process");
       return new Promise((resolve3) => {
-        execFile4("claude", ["--version"], { timeout: 5e3 }, (err, stdout) => {
+        execFile5("claude", ["--version"], { timeout: 5e3 }, (err, stdout) => {
           if (err) {
             resolve3(null);
             return;
@@ -7266,7 +7274,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.40" : "dev";
+var agtCliVersion = true ? "0.28.41" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7662,27 +7670,177 @@ function provision(input, frameworkId = "openclaw") {
   };
 }
 
+// src/lib/connectivity-probe-context.ts
+import { join as join8 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+
+// src/lib/cli-probe.ts
+import { execFile as execFile4 } from "child_process";
+var DEFAULT_TIMEOUT_MS = 8e3;
+function runCliProbe(binary, args, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Promise((resolve3) => {
+    execFile4(
+      binary,
+      args,
+      { timeout: timeoutMs, env: opts.env ?? process.env, windowsHide: true },
+      (err, stdout) => {
+        if (!err) {
+          const firstLine = String(stdout).split(/\r?\n/, 1)[0]?.trim();
+          resolve3({ status: "ok", message: firstLine ? `${binary}: ${firstLine}` : `${binary}: ok` });
+          return;
+        }
+        const e = err;
+        if (e.code === "ENOENT") {
+          resolve3({ status: "down", message: `${binary} not found on PATH (not installed)` });
+          return;
+        }
+        if (e.killed || e.signal === "SIGTERM") {
+          resolve3({ status: "transient_error", message: `${binary} probe timed out after ${timeoutMs / 1e3}s` });
+          return;
+        }
+        resolve3({ status: "down", message: `${binary} exited non-zero: ${e.message}` });
+      }
+    );
+  });
+}
+
+// src/lib/connectivity-probe-context.ts
+function readMcpHttpServerConfig(projectDir, serverKey, env) {
+  try {
+    const raw = readFileSync8(join8(projectDir, ".mcp.json"), "utf-8");
+    const servers = JSON.parse(raw).mcpServers ?? {};
+    const entry = servers[serverKey];
+    if (entry && typeof entry.url === "string" && (entry.type === "http" || entry.type === void 0)) {
+      const unresolved = /* @__PURE__ */ new Set();
+      const sub = (value) => {
+        if (!env) return value;
+        const r = expandTemplateVars(value, env);
+        for (const name of r.unresolved) unresolved.add(name);
+        return r.value;
+      };
+      const url = sub(entry.url);
+      let headers;
+      if (entry.headers) {
+        headers = {};
+        for (const [k, v] of Object.entries(entry.headers)) headers[k] = sub(v);
+      }
+      return { url, ...headers ? { headers } : {}, unresolved: [...unresolved] };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function deriveMcpServerKey(input) {
+  const kind = resolveConnectivityProbe({
+    definitionId: input.definitionId,
+    sourceType: input.sourceType,
+    authType: input.authType,
+    connectivityTest: input.connectivityTest ?? null
+  }).kind;
+  if (kind !== "mcp_tools_list" && kind !== "managed_composite") return void 0;
+  return input.definitionId.replace(/[^a-z0-9]/gi, "_").toLowerCase();
+}
+function buildProbeEnv(projectDir) {
+  const probeEnv = { ...process.env };
+  try {
+    const envIntPath = join8(projectDir, ".env.integrations");
+    if (existsSync8(envIntPath)) {
+      Object.assign(probeEnv, parseEnvIntegrations(readFileSync8(envIntPath, "utf-8")));
+    }
+  } catch {
+  }
+  return probeEnv;
+}
+function buildConnectivityProbeDeps(projectDir, probeEnv) {
+  return {
+    fetchImpl: fetch,
+    runCli: (binary, args) => runCliProbe(binary, args, { env: probeEnv }),
+    mcpProbe: async (target) => {
+      const cfg = readMcpHttpServerConfig(projectDir, target.serverKey, probeEnv);
+      if (!cfg) {
+        return { status: "transient_error", message: `MCP server '${target.serverKey}' not resolvable from .mcp.json` };
+      }
+      if (cfg.unresolved.length > 0) {
+        return {
+          status: "transient_error",
+          message: `MCP '${target.serverKey}' auth unresolved: ${cfg.unresolved.join(", ")}`
+        };
+      }
+      return probeMcpHttp(cfg);
+    },
+    // ENG-6139: connected-account binding check for managed (Composio) toolkits.
+    // The MCP handshake reads green on a dead/mis-bound account, so the managed
+    // probe also verifies the account is ACTIVE + bound to the entity the agent
+    // queries with. Inputs come from the agent's OWN wired MCP server: the
+    // `x-api-key` header and the `user_id` query param (the agent already
+    // authenticates with these), plus the recorded connected_account_id.
+    composioProbe: async (definitionId, credentials) => {
+      const serverKey = definitionId.replace(/[^a-z0-9]/gi, "_").toLowerCase();
+      const cfg = readMcpHttpServerConfig(projectDir, serverKey, probeEnv);
+      if (!cfg) {
+        return { status: "transient_error", message: `MCP server '${serverKey}' not resolvable from .mcp.json` };
+      }
+      if (cfg.unresolved.length > 0) {
+        return {
+          status: "transient_error",
+          message: `MCP '${serverKey}' auth unresolved: ${cfg.unresolved.join(", ")}`
+        };
+      }
+      const apiKey = Object.entries(cfg.headers ?? {}).find(([k]) => k.toLowerCase() === "x-api-key")?.[1] ?? "";
+      let expectedUserId = "";
+      let serverId;
+      try {
+        const u = new URL(cfg.url);
+        expectedUserId = u.searchParams.get("user_id") ?? "";
+        const m = u.pathname.match(/\/v3\/mcp\/([^/]+)\/mcp/);
+        serverId = m?.[1] ? decodeURIComponent(m[1]) : void 0;
+      } catch {
+        expectedUserId = "";
+      }
+      const connectedAccountId = typeof credentials?.["connected_account_id"] === "string" ? credentials["connected_account_id"] : "";
+      return probeComposioAccount({ connectedAccountId, apiKey, expectedUserId, serverId });
+    },
+    // ENG-6157 (Phase 2): the live tool-call leg. Uses the agent's OWN wired MCP
+    // URL + headers (the exact path tool calls take), so a broken auth_config
+    // linkage surfaces as a real `No connected account found` instead of a
+    // green handshake. Skips (`null`) when no safe read-only tool is callable.
+    composioToolCallProbe: async (target) => {
+      const cfg = readMcpHttpServerConfig(projectDir, target.serverKey, probeEnv);
+      if (!cfg) return null;
+      if (cfg.unresolved.length > 0) return null;
+      return probeComposioMcpToolCall({
+        url: cfg.url,
+        headers: cfg.headers,
+        toolName: target.toolName,
+        toolArgs: target.toolArgs
+      });
+    }
+  };
+}
+
 // src/commands/manager.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync9, realpathSync } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync10, realpathSync } from "fs";
+import { join as join10 } from "path";
 import { homedir as homedir6, userInfo } from "os";
 import { spawn as spawn3 } from "child_process";
 
 // src/lib/watchdog.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync8, mkdirSync as mkdirSync7, openSync as openSync2, closeSync as closeSync2, chmodSync as chmodSync6 } from "fs";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync9, mkdirSync as mkdirSync7, openSync as openSync2, closeSync as closeSync2, chmodSync as chmodSync6 } from "fs";
+import { join as join9 } from "path";
 import { spawn as spawn2, execFileSync } from "child_process";
-var DEFAULT_CONFIG_DIR = join8(process.env["HOME"] ?? "/tmp", ".augmented");
+var DEFAULT_CONFIG_DIR = join9(process.env["HOME"] ?? "/tmp", ".augmented");
 function getManagerPaths(configDir) {
   return {
-    pidFile: join8(configDir, "manager.pid"),
-    stateFile: join8(configDir, "manager-state.json"),
-    logFile: join8(configDir, "manager.log")
+    pidFile: join9(configDir, "manager.pid"),
+    stateFile: join9(configDir, "manager-state.json"),
+    logFile: join9(configDir, "manager.log")
   };
 }
 function ensureDir2(configDir) {
-  if (!existsSync8(configDir)) {
+  if (!existsSync9(configDir)) {
     mkdirSync7(configDir, { recursive: true });
   }
 }
@@ -7692,7 +7850,7 @@ function writePidFile(configDir, pid) {
 }
 function readPidFile(configDir) {
   try {
-    const raw = readFileSync8(getManagerPaths(configDir).pidFile, "utf-8").trim();
+    const raw = readFileSync9(getManagerPaths(configDir).pidFile, "utf-8").trim();
     const pid = parseInt(raw, 10);
     return isNaN(pid) ? null : pid;
   } catch {
@@ -7730,7 +7888,7 @@ function defaultPgrep() {
 }
 function readStateFile(configDir) {
   try {
-    const raw = readFileSync8(getManagerPaths(configDir).stateFile, "utf-8");
+    const raw = readFileSync9(getManagerPaths(configDir).stateFile, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -7786,7 +7944,7 @@ function startWatchdog(opts) {
     const deadline = Date.now() + 5e3;
     const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
     while (Date.now() < deadline) {
-      if (existsSync8(pidFile)) {
+      if (existsSync9(pidFile)) {
         return { pid: child.pid };
       }
       if (child.exitCode !== null) {
@@ -7914,7 +8072,7 @@ function managerStartCommand(opts) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join9(homedir6(), ".augmented");
+  const configDir = opts.configDir ?? join10(homedir6(), ".augmented");
   if (opts.supervise) {
     if (json) {
       jsonOutput({ ok: false, error: "--supervise is not supported with --json" });
@@ -8010,7 +8168,7 @@ function runSupervisorLoop(intervalSec, configDir) {
 }
 async function managerStopCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join9(homedir6(), ".augmented");
+  const configDir = opts.configDir ?? join10(homedir6(), ".augmented");
   try {
     const result = await stopWatchdog(configDir);
     if (!result.stopped && !result.pid) {
@@ -8038,7 +8196,7 @@ async function managerStopCommand(opts = {}) {
 }
 function managerStatusCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join9(homedir6(), ".augmented");
+  const configDir = opts.configDir ?? join10(homedir6(), ".augmented");
   const status = getManagerStatus(configDir);
   if (!status) {
     if (json) {
@@ -8110,7 +8268,7 @@ function resolveStableAgtBin(rawPath) {
   if (!prefix || !formula) return rawPath;
   const candidates = [`${prefix}/bin/${formula}`, `${prefix}/bin/agt`];
   for (const candidate of candidates) {
-    if (!existsSync9(candidate)) continue;
+    if (!existsSync10(candidate)) continue;
     try {
       realpathSync(candidate);
       return candidate;
@@ -8130,7 +8288,7 @@ async function managerInstallCommand(opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join9(homedir6(), ".augmented");
+  const configDir = opts.configDir ?? join10(homedir6(), ".augmented");
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -8143,7 +8301,7 @@ async function managerInstallCommand(opts = {}) {
   if (process.platform === "darwin") {
     const home = homedir6();
     const protectedRoots = ["Documents", "Downloads", "Desktop", "Movies", "Music", "Pictures"];
-    const offending = protectedRoots.map((r) => join9(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
+    const offending = protectedRoots.map((r) => join10(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
     if (offending) {
       const msg = `agt binary at ${agtBin} sits inside a macOS TCC-protected folder (${offending}). launchd-spawned processes cannot read files there and the manager would EPERM on startup. Either install agt globally (\`npm install -g @integrity-labs/agt-cli\`) or copy the dist outside protected folders before running this command.`;
       if (json) jsonOutput({ ok: false, error: msg });
@@ -8211,7 +8369,7 @@ async function managerInstallSystemUnitCommand(opts = {}) {
     return;
   }
   const user = opts.user ?? "root";
-  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join9("/home", user, ".augmented"));
+  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join10("/home", user, ".augmented"));
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -8274,6 +8432,73 @@ async function managerUninstallSystemUnitCommand() {
   }
 }
 
+// src/lib/connectivity-probe-executor.ts
+async function executeConnectivityProbe(target, deps = {}) {
+  const descriptor = resolveConnectivityProbe({
+    definitionId: target.definitionId,
+    sourceType: target.sourceType,
+    authType: target.authType,
+    // ENG-6242: carry the toolkit's connectivity_test override so a managed
+    // descriptor surfaces `probeTool`/`probeArgs` (the prescribed read-only tool)
+    // — without this the hourly probe auto-picked a different tool than the Test
+    // path, the false-RED that flagged every managed Linear install "unreachable".
+    connectivityTest: target.connectivityTest ?? null
+  });
+  if (!descriptor.readOnly) {
+    throw new Error(`Refusing non-read-only probe for ${target.definitionId}`);
+  }
+  switch (descriptor.kind) {
+    case "http_provider":
+      return probeHttpProvider(target.definitionId, target.credentials, deps.fetchImpl ?? fetch);
+    case "composio_account":
+      if (!deps.composioProbe) return null;
+      return deps.composioProbe(target.definitionId, target.credentials);
+    case "managed_composite": {
+      const outcomes = [];
+      if (deps.mcpProbe) {
+        outcomes.push(
+          await deps.mcpProbe({
+            serverKey: target.mcpServerKey ?? target.definitionId,
+            definitionId: target.definitionId
+          })
+        );
+      }
+      if (deps.composioProbe) {
+        outcomes.push(await deps.composioProbe(target.definitionId, target.credentials));
+      }
+      if (deps.composioToolCallProbe) {
+        const toolCall = await deps.composioToolCallProbe({
+          serverKey: target.mcpServerKey ?? target.definitionId,
+          definitionId: target.definitionId,
+          // ENG-6242: thread the prescribed tool through to the live tool-call
+          // leg. resolveConnectivityProbe only sets these for managed toolkits
+          // with a stored override; the probe re-validates read-only and falls
+          // back to auto-pick on drift, so a missing/invalid override is safe.
+          toolName: descriptor.probeTool ?? null,
+          toolArgs: descriptor.probeArgs ?? null
+        });
+        if (toolCall) outcomes.push(toolCall);
+      }
+      if (outcomes.length === 0) return null;
+      return outcomes.reduce((acc, o) => worseConnectivityOutcome(acc, o));
+    }
+    case "mcp_tools_list":
+      if (!deps.mcpProbe) return null;
+      return deps.mcpProbe({
+        serverKey: target.mcpServerKey ?? target.definitionId,
+        definitionId: target.definitionId
+      });
+    case "cli_command":
+      if (!deps.runCli) return null;
+      return deps.runCli(target.cliBinary ?? target.definitionId, descriptor.cliArgs ?? ["--version"]);
+    case "builtin":
+      return { status: "ok", message: `${target.definitionId}: built-in` };
+    case "unsupported":
+    default:
+      return null;
+  }
+}
+
 export {
   getIntegration,
   extractCommandNotFound,
@@ -8315,6 +8540,10 @@ export {
   resolveAllFlags,
   HostFlagStore,
   provision,
+  executeConnectivityProbe,
+  deriveMcpServerKey,
+  buildProbeEnv,
+  buildConnectivityProbeDeps,
   getManagerPaths,
   startWatchdog,
   managerStartCommand,
@@ -8326,4 +8555,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-DA776TZO.js.map
+//# sourceMappingURL=chunk-GBST6UWT.js.map