@integrity-labs/agt-cli 0.28.456 → 0.28.458

package/dist/{chunk-FNEUIWJJ.js → chunk-QIQQ46NH.js}

@@ -4,6 +4,7 @@ import {
   INTEGRATION_REGISTRY,
   LATE_BOUND_VARS,
   OAUTH_PROVIDERS,
+  bestConnectivityEvidence,
   buildHostBrokeredRemoteMcpEntry,
   buildIntegrationsSection,
   buildLiveHeaderRemoteMcpProxyEntry,
@@ -29,7 +30,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-UIUYOGPK.js";
+} from "./chunk-KAIH24HZ.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -4910,7 +4911,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.456" : "dev";
+var agtCliVersion = true ? "0.28.458" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7275,24 +7276,43 @@ async function executeConnectivityProbe(target, deps = {}) {
     throw new Error(`Refusing non-read-only probe for ${target.definitionId}`);
   }
   switch (descriptor.kind) {
-    case "http_provider":
-      return probeHttpProvider(target.definitionId, target.credentials, deps.fetchImpl ?? fetch);
-    case "composio_account":
+    case "http_provider": {
+      const outcome = await probeHttpProvider(target.definitionId, target.credentials, deps.fetchImpl ?? fetch);
+      return outcome ? withEvidence(outcome, "live_call") : outcome;
+    }
+    case "composio_account": {
       if (!deps.composioProbe) return null;
-      return deps.composioProbe(target.mcpServerKey ?? target.definitionId, target.credentials, target.inlineServerEntry);
+      const outcome = await deps.composioProbe(
+        target.mcpServerKey ?? target.definitionId,
+        target.credentials,
+        target.inlineServerEntry
+      );
+      return outcome ? withEvidence(outcome, "record_only") : outcome;
+    }
     case "managed_composite": {
       const outcomes = [];
       if (deps.mcpProbe) {
         outcomes.push(
-          await deps.mcpProbe({
-            serverKey: target.mcpServerKey ?? target.definitionId,
-            definitionId: target.definitionId,
-            inlineServerEntry: target.inlineServerEntry
-          })
+          withEvidence(
+            await deps.mcpProbe({
+              serverKey: target.mcpServerKey ?? target.definitionId,
+              definitionId: target.definitionId,
+              inlineServerEntry: target.inlineServerEntry
+            }),
+            // ENG-8226: initialize + tools/list. The transport answered; no
+            // authenticated operation ran. The dwight `needs_reauth` rows all
+            // had healthy handshakes — this is why it is not enough for green.
+            "handshake"
+          )
         );
       }
       if (deps.composioProbe) {
-        outcomes.push(await deps.composioProbe(target.mcpServerKey ?? target.definitionId, target.credentials, target.inlineServerEntry));
+        outcomes.push(
+          withEvidence(
+            await deps.composioProbe(target.mcpServerKey ?? target.definitionId, target.credentials, target.inlineServerEntry),
+            "record_only"
+          )
+        );
       }
       if (deps.composioToolCallProbe) {
         const toolCall = await deps.composioToolCallProbe({
@@ -7306,37 +7326,55 @@ async function executeConnectivityProbe(target, deps = {}) {
           toolName: descriptor.probeTool ?? null,
           toolArgs: descriptor.probeArgs ?? null
         });
-        if (toolCall) outcomes.push(toolCall);
+        if (toolCall) outcomes.push(withEvidence(toolCall, "live_call"));
       }
       if (outcomes.length === 0) return null;
-      return outcomes.reduce((acc, o) => worseConnectivityOutcome(acc, o));
+      const worst = outcomes.reduce((acc, o) => worseConnectivityOutcome(acc, o));
+      const evidence = outcomes.reduce(
+        (acc, o) => bestConnectivityEvidence(acc, o.evidence ?? "none"),
+        "none"
+      );
+      return { ...worst, evidence };
     }
-    case "mcp_tools_list":
+    case "mcp_tools_list": {
       if (!deps.mcpProbe) return null;
-      return deps.mcpProbe({
+      const outcome = await deps.mcpProbe({
         serverKey: target.mcpServerKey ?? target.definitionId,
         definitionId: target.definitionId,
         inlineServerEntry: target.inlineServerEntry
       });
-    case "mcp_stdio":
+      return withEvidence(outcome, "handshake");
+    }
+    case "mcp_stdio": {
       if (!deps.mcpStdioProbe) return null;
-      return deps.mcpStdioProbe({
+      const outcome = await deps.mcpStdioProbe({
         serverKey: target.mcpServerKey ?? target.definitionId,
         definitionId: target.definitionId,
         inlineServerEntry: target.inlineServerEntry,
         toolName: descriptor.probeTool ?? null,
         toolArgs: descriptor.probeArgs ?? null
       });
-    case "cli_command":
+      return withEvidence(outcome, descriptor.probeTool ? "live_call" : "handshake");
+    }
+    case "cli_command": {
       if (!deps.runCli) return null;
-      return deps.runCli(target.cliBinary ?? target.definitionId, descriptor.cliArgs ?? ["--version"]);
+      const outcome = await deps.runCli(target.cliBinary ?? target.definitionId, descriptor.cliArgs ?? ["--version"]);
+      return withEvidence(outcome, descriptor.cliArgs ? "live_call" : "handshake");
+    }
     case "builtin":
-      return { status: "ok", message: `${target.definitionId}: built-in` };
+      return {
+        status: "unverified",
+        message: `${target.definitionId}: built-in module \u2014 no live check available, not verified`,
+        evidence: "none"
+      };
     case "unsupported":
     default:
       return null;
   }
 }
+function withEvidence(outcome, evidence) {
+  return outcome.evidence ? outcome : { ...outcome, evidence };
+}
 
 export {
   LITERAL_SECRET_PATTERNS,
@@ -7411,4 +7449,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-FNEUIWJJ.js.map
+//# sourceMappingURL=chunk-QIQQ46NH.js.map