@integrity-labs/agt-cli 0.28.467 → 0.28.468

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-P5NFIZI4.js";
+} from "../chunk-Y2XU2XWM.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.467" : "dev";
+var cliVersion = true ? "0.28.468" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.467" : "dev";
+var cliVersion2 = true ? "0.28.468" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-P5NFIZI4.js → chunk-Y2XU2XWM.js}

@@ -4910,8 +4910,29 @@ function requireHost() {
   return getHost();
 }
 
+// src/lib/auth-exchange-error.ts
+var ApiKeyExchangeError = class extends Error {
+  constructor(message, status, transient) {
+    super(message);
+    this.status = status;
+    this.transient = transient;
+    this.name = "ApiKeyExchangeError";
+  }
+};
+function isTransientExchangeStatus(status) {
+  return status >= 500 || status === 429;
+}
+function isTransientAuthFailure(err) {
+  return err instanceof ApiKeyExchangeError && err.transient;
+}
+function exchangeFailureKind(err) {
+  if (!(err instanceof ApiKeyExchangeError)) return "unclassified";
+  const status = err.status === null ? "transport" : String(err.status);
+  return err.transient ? `transient-${status}` : `verdict-${status}`;
+}
+
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.467" : "dev";
+var agtCliVersion = true ? "0.28.468" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -4952,7 +4973,42 @@ async function exchangeApiKey(rawKey, retried = false, opts = {}) {
     exchangeInFlight = null;
   }
 }
+var DEFAULT_EXCHANGE_RETRY_ATTEMPTS = 2;
+var DEFAULT_EXCHANGE_RETRY_BASE_MS = 500;
+function exchangeRetryAttempts() {
+  const raw = process.env["AGT_AUTH_EXCHANGE_RETRY_ATTEMPTS"];
+  const parsed = raw ? parseInt(raw, 10) : NaN;
+  if (Number.isFinite(parsed) && parsed >= 0) return Math.min(parsed, 5);
+  return DEFAULT_EXCHANGE_RETRY_ATTEMPTS;
+}
+function exchangeRetryBaseMs() {
+  const raw = process.env["AGT_AUTH_EXCHANGE_RETRY_BASE_MS"];
+  const parsed = raw ? parseInt(raw, 10) : NaN;
+  if (Number.isFinite(parsed) && parsed > 0) return Math.min(parsed, 5e3);
+  return DEFAULT_EXCHANGE_RETRY_BASE_MS;
+}
+function asExchangeError(err) {
+  if (err instanceof ApiKeyExchangeError) return err;
+  const message = err instanceof Error ? err.message : String(err);
+  return new ApiKeyExchangeError(message, null, true);
+}
 async function doExchange(rawKey, retried) {
+  const maxRetries = exchangeRetryAttempts();
+  const baseMs = exchangeRetryBaseMs();
+  let lastErr;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      return await attemptExchange(rawKey, retried);
+    } catch (err) {
+      const exchangeErr = asExchangeError(err);
+      if (!exchangeErr.transient || attempt === maxRetries) throw exchangeErr;
+      lastErr = exchangeErr;
+      await new Promise((resolve) => setTimeout(resolve, baseMs * 2 ** attempt));
+    }
+  }
+  throw lastErr ?? new ApiKeyExchangeError("API key exchange failed", null, true);
+}
+async function attemptExchange(rawKey, retried) {
   const res = await fetch(`${requireHost()}/host/exchange`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -4964,20 +5020,28 @@ async function doExchange(rawKey, retried) {
     const host = requireHost();
     const obfuscated = rawKey.length > 12 ? `${rawKey.slice(0, 8)}${"*".repeat(rawKey.length - 12)}${rawKey.slice(-4)}` : rawKey.slice(0, 4) + "****";
     if (res.status >= 502 && res.status <= 504) {
-      throw new Error(`API unreachable (${res.status}): ${host} \u2014 is the API server running?`);
+      throw new ApiKeyExchangeError(
+        `API unreachable (${res.status}): ${host} \u2014 is the API server running?`,
+        res.status,
+        true
+      );
     }
     if (errorMsg.includes("revoked") && !retried) {
       reloadFromShellProfile();
       const freshKey = getApiKey();
       if (freshKey && freshKey !== rawKey) {
-        return doExchange(freshKey, true);
+        return attemptExchange(freshKey, true);
       }
     }
-    throw new Error(`API key exchange failed: ${errorMsg} (host=${host}, key=${obfuscated})`);
+    throw new ApiKeyExchangeError(
+      `API key exchange failed: ${errorMsg} (host=${host}, key=${obfuscated})`,
+      res.status,
+      isTransientExchangeStatus(res.status)
+    );
   }
   const data = await res.json();
   if (!data.token) {
-    throw new Error("API key exchange returned no token");
+    throw new ApiKeyExchangeError("API key exchange returned no token", null, true);
   }
   const claudeAuthMode = data.claude_auth_mode === "api_key" ? "api_key" : data.claude_auth_mode === "openrouter" ? "openrouter" : "subscription";
   cachedExchange = {
@@ -7544,6 +7608,8 @@ export {
   PROD_AGT_HOST,
   getHost,
   requireHost,
+  isTransientAuthFailure,
+  exchangeFailureKind,
   setConfigHash,
   getCachedClaudeAuthMode,
   exchangeApiKey,
@@ -7595,4 +7661,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-P5NFIZI4.js.map
+//# sourceMappingURL=chunk-Y2XU2XWM.js.map