@integrity-labs/agt-cli 0.28.486 → 0.28.487

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-XP53UXQR.js";
+} from "../chunk-H5H4IVQC.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-SRR5XVWJ.js";
+} from "../chunk-XZI5IHQP.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.486" : "dev";
+var cliVersion = true ? "0.28.487" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.486" : "dev";
+var cliVersion2 = true ? "0.28.487" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-XP53UXQR.js → chunk-H5H4IVQC.js}

@@ -30,7 +30,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-SRR5XVWJ.js";
+} from "./chunk-XZI5IHQP.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -4938,7 +4938,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.486" : "dev";
+var agtCliVersion = true ? "0.28.487" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7667,4 +7667,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-XP53UXQR.js.map
+//# sourceMappingURL=chunk-H5H4IVQC.js.map

package/dist/{chunk-SRR5XVWJ.js → chunk-XZI5IHQP.js}

@@ -5090,34 +5090,37 @@ var OAUTH_PROVIDERS = {
     definitionId: "linkedin-ads",
     authorizeUrl: "https://www.linkedin.com/oauth/v2/authorization",
     tokenUrl: "https://www.linkedin.com/oauth/v2/accessToken",
+    // ENG-7897: this list is EXACTLY the Advertising API scope set, because
+    // Advertising API is the only product added to the Brand Ninja app. Every
+    // other scope we used to request here belonged to a product the app does
+    // not hold, and LinkedIn rejects the ENTIRE authorize request with
+    // `unauthorized_scope_error` if ANY single requested scope is ungranted -
+    // so five unapproved scopes bricked the connect for every customer, on
+    // every environment, rather than merely disabling five features.
+    //
+    // Scopes deliberately NOT requested, and the product each needs first:
+    //   openid / profile / email        -> Sign In with LinkedIn (OpenID Connect)
+    //   r_organization_social           -> Community Management API
+    //   r_marketing_leadgen_automation  -> Lead Sync API
+    //
+    // Dropping the OIDC trio costs only the `Connected as <name>` label: the
+    // userInfoUrl fetch in the callback is already best-effort and falls back
+    // to a plain 'Connected'. Do NOT re-add any of these until the matching
+    // product shows under "Added products" on the app - use the
+    // OAUTH_LINKEDIN_ADS_SCOPES override below to widen without a deploy once
+    // an approval lands, and only then promote it into this constant.
     defaultScopes: [
-      "openid",
-      "profile",
-      "email",
       // Advertising API: read + manage campaigns/creatives, and reporting.
       "r_ads",
       "rw_ads",
-      "r_ads_reporting",
-      // Community Management API: organization page/follower/share statistics.
-      "r_organization_social",
-      // Lead Sync API: read lead-generation forms + responses.
-      // linkedin-verify: `linkedin_ads_create_lead_form` WRITES a lead form, and
-      // it is not obvious that `rw_ads` covers that - Lead Sync may need its own
-      // write scope. Resolve this during the verification pass against the app's
-      // approved products. Do NOT guess a scope string here: an ungranted or
-      // misspelled scope makes LinkedIn reject the whole authorize request, so a
-      // wrong guess breaks every connect, not just lead forms.
-      "r_marketing_leadgen_automation"
+      "r_ads_reporting"
     ],
-    // Read-only variant: reporting + organization stats, no campaign/creative
-    // mutation. Used when an install is (re)connected with read_only: true.
+    // Read-only variant: reporting only, no campaign/creative mutation. Used
+    // when an install is (re)connected with read_only: true. Same product
+    // constraint as above - `r_organization_social` was removed with it.
     readOnlyScopes: [
-      "openid",
-      "profile",
-      "email",
       "r_ads",
-      "r_ads_reporting",
-      "r_organization_social"
+      "r_ads_reporting"
     ],
     supportsRefresh: true,
     extraAuthorizeParams: {},
@@ -9249,6 +9252,17 @@ var FLAG_REGISTRY = [
     defaultValue: false,
     envVar: "AGT_FAST_MCP_RESTART_RESPAWN_ENABLED"
   },
+  {
+    key: "never-spawned-session-metric",
+    description: 'Never-spawned session metric (ENG-8204): when ON, the agent-heartbeat-monitor cron emits a `SessionAliveAgeSeconds` datapoint for an ACTIVE agent that has never had a verified session (`last_session_alive_at` null), aged from `created_at`. Without it those agents emit no datapoint at all, and because the session-stale alarm sets `TreatMissingData: notBreaching`, the one alarm built for "fresh heartbeat but no session" can never fire for the very case it describes \u2014 a newly-onboarded agent whose session never spawned. Observe-first rollout gate: the cron logs the never-spawned count and oldest age EVERY run regardless of this flag, so the backlog is measurable before the alarm is armed. The AUGMENTED_NEVER_SPAWNED_SESSION_METRIC_ENABLED env var is the highest-precedence operator override; precedence is env override > flag value > this default.',
+    flagType: "boolean",
+    defaultValue: false,
+    envVar: "AUGMENTED_NEVER_SPAWNED_SESSION_METRIC_ENABLED",
+    // Enabling this pages on every active agent that has never had a session,
+    // which on first flip may surface an existing backlog all at once. Read the
+    // observe-phase log line before flipping.
+    sensitive: true
+  },
   {
     key: "channel-silent-loss-alarm",
     description: "Channel silent-loss alarm (ENG-6728): when ON, the responsiveness-probe route creates a per-agent CloudWatch alarm that pages on a `ChannelDeflections` Cause=replay_orphaned datapoint (a recoverable inbound aged out without delivery). Observe-first rollout gate, flipped stage-wide from the admin Feature Flags page; the underlying metric ships since ENG-6355. The AUGMENTED_CHANNEL_SILENT_LOSS_ALARM_ENABLED env var is retained as the highest-precedence operator override; precedence is env override > flag value > this default.",
@@ -14486,4 +14500,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-SRR5XVWJ.js.map
+//# sourceMappingURL=chunk-XZI5IHQP.js.map