@integrity-labs/agt-cli 0.28.472 → 0.28.473

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-KCU4ZTE4.js";
+} from "../chunk-VHWLFDME.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.472" : "dev";
+var cliVersion = true ? "0.28.473" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.472" : "dev";
+var cliVersion2 = true ? "0.28.473" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-KCU4ZTE4.js → chunk-VHWLFDME.js}

@@ -4932,7 +4932,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.472" : "dev";
+var agtCliVersion = true ? "0.28.473" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7661,4 +7661,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-KCU4ZTE4.js.map
+//# sourceMappingURL=chunk-VHWLFDME.js.map

package/dist/lib/manager-worker.js

@@ -44,7 +44,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-KCU4ZTE4.js";
+} from "../chunk-VHWLFDME.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -10038,7 +10038,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.472" : "dev";
+var agtCliVersion = true ? "0.28.473" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -10995,6 +10995,8 @@ function loadChannelHashCache2() {
 function saveChannelHashCache2() {
   saveChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
 }
+var channelWriteFailureCounts = /* @__PURE__ */ new Map();
+var CHANNEL_WRITE_FAILURE_ESCALATE_EVERY = 90;
 var persistedDeliveryBaseline = createDeliveryBaselineMaps();
 function loadSenderPolicyBaseline2() {
   loadSenderPolicyBaseline(persistedDeliveryBaseline, channelHashCacheDir(), log);
@@ -12660,9 +12662,24 @@ async function processAgent(agent, agentStates) {
                 agentAvatarUrl
               }
             );
-            agentState.knownChannelConfigHashes.set(cacheKey, configHash);
-            saveChannelHashCache2();
-            log(`Channel credentials written for '${agent.code_name}/${channelId}' (reason=${reason}, hash=${configHash.slice(0, 8)}${prevHash ? `, prev=${prevHash.slice(0, 8)}` : ""})`);
+            const landed = frameworkAdapter.hasChannelCredentials?.(agent.code_name, channelId) ?? true;
+            if (!landed) {
+              channelConfigConverged = false;
+              const attempts = (channelWriteFailureCounts.get(cacheKey) ?? 0) + 1;
+              channelWriteFailureCounts.set(cacheKey, attempts);
+              if (attempts === 1 || attempts % CHANNEL_WRITE_FAILURE_ESCALATE_EVERY === 0) {
+                log(
+                  `ERROR: channel credentials for '${agent.code_name}/${channelId}' did NOT land on disk after a write that reported no error (reason=${reason}, attempt ${attempts}). The write was silently skipped \u2014 likely a missing credential field, or the guarded .mcp.json write was rejected by the secret lint / config validator (its reason is printed once per fingerprint on stderr). The channel will stay unusable until this is resolved; not re-logging every cycle.`
+                );
+              }
+            } else {
+              if (channelWriteFailureCounts.delete(cacheKey)) {
+                log(`Channel credentials for '${agent.code_name}/${channelId}' landed on disk after ${reason} \u2014 recovered.`);
+              }
+              agentState.knownChannelConfigHashes.set(cacheKey, configHash);
+              saveChannelHashCache2();
+              log(`Channel credentials written for '${agent.code_name}/${channelId}' (reason=${reason}, hash=${configHash.slice(0, 8)}${prevHash ? `, prev=${prevHash.slice(0, 8)}` : ""})`);
+            }
           } catch (err) {
             channelConfigConverged = false;
             log(`Failed to write channel credentials for '${agent.code_name}/${channelId}': ${err.message}`);