@integrity-labs/agt-cli 0.28.486 → 0.28.488

package/dist/{chunk-SRR5XVWJ.js → chunk-XZI5IHQP.js}

@@ -5090,34 +5090,37 @@ var OAUTH_PROVIDERS = {
     definitionId: "linkedin-ads",
     authorizeUrl: "https://www.linkedin.com/oauth/v2/authorization",
     tokenUrl: "https://www.linkedin.com/oauth/v2/accessToken",
+    // ENG-7897: this list is EXACTLY the Advertising API scope set, because
+    // Advertising API is the only product added to the Brand Ninja app. Every
+    // other scope we used to request here belonged to a product the app does
+    // not hold, and LinkedIn rejects the ENTIRE authorize request with
+    // `unauthorized_scope_error` if ANY single requested scope is ungranted -
+    // so five unapproved scopes bricked the connect for every customer, on
+    // every environment, rather than merely disabling five features.
+    //
+    // Scopes deliberately NOT requested, and the product each needs first:
+    //   openid / profile / email        -> Sign In with LinkedIn (OpenID Connect)
+    //   r_organization_social           -> Community Management API
+    //   r_marketing_leadgen_automation  -> Lead Sync API
+    //
+    // Dropping the OIDC trio costs only the `Connected as <name>` label: the
+    // userInfoUrl fetch in the callback is already best-effort and falls back
+    // to a plain 'Connected'. Do NOT re-add any of these until the matching
+    // product shows under "Added products" on the app - use the
+    // OAUTH_LINKEDIN_ADS_SCOPES override below to widen without a deploy once
+    // an approval lands, and only then promote it into this constant.
     defaultScopes: [
-      "openid",
-      "profile",
-      "email",
       // Advertising API: read + manage campaigns/creatives, and reporting.
       "r_ads",
       "rw_ads",
-      "r_ads_reporting",
-      // Community Management API: organization page/follower/share statistics.
-      "r_organization_social",
-      // Lead Sync API: read lead-generation forms + responses.
-      // linkedin-verify: `linkedin_ads_create_lead_form` WRITES a lead form, and
-      // it is not obvious that `rw_ads` covers that - Lead Sync may need its own
-      // write scope. Resolve this during the verification pass against the app's
-      // approved products. Do NOT guess a scope string here: an ungranted or
-      // misspelled scope makes LinkedIn reject the whole authorize request, so a
-      // wrong guess breaks every connect, not just lead forms.
-      "r_marketing_leadgen_automation"
+      "r_ads_reporting"
     ],
-    // Read-only variant: reporting + organization stats, no campaign/creative
-    // mutation. Used when an install is (re)connected with read_only: true.
+    // Read-only variant: reporting only, no campaign/creative mutation. Used
+    // when an install is (re)connected with read_only: true. Same product
+    // constraint as above - `r_organization_social` was removed with it.
     readOnlyScopes: [
-      "openid",
-      "profile",
-      "email",
       "r_ads",
-      "r_ads_reporting",
-      "r_organization_social"
+      "r_ads_reporting"
     ],
     supportsRefresh: true,
     extraAuthorizeParams: {},
@@ -9249,6 +9252,17 @@ var FLAG_REGISTRY = [
     defaultValue: false,
     envVar: "AGT_FAST_MCP_RESTART_RESPAWN_ENABLED"
   },
+  {
+    key: "never-spawned-session-metric",
+    description: 'Never-spawned session metric (ENG-8204): when ON, the agent-heartbeat-monitor cron emits a `SessionAliveAgeSeconds` datapoint for an ACTIVE agent that has never had a verified session (`last_session_alive_at` null), aged from `created_at`. Without it those agents emit no datapoint at all, and because the session-stale alarm sets `TreatMissingData: notBreaching`, the one alarm built for "fresh heartbeat but no session" can never fire for the very case it describes \u2014 a newly-onboarded agent whose session never spawned. Observe-first rollout gate: the cron logs the never-spawned count and oldest age EVERY run regardless of this flag, so the backlog is measurable before the alarm is armed. The AUGMENTED_NEVER_SPAWNED_SESSION_METRIC_ENABLED env var is the highest-precedence operator override; precedence is env override > flag value > this default.',
+    flagType: "boolean",
+    defaultValue: false,
+    envVar: "AUGMENTED_NEVER_SPAWNED_SESSION_METRIC_ENABLED",
+    // Enabling this pages on every active agent that has never had a session,
+    // which on first flip may surface an existing backlog all at once. Read the
+    // observe-phase log line before flipping.
+    sensitive: true
+  },
   {
     key: "channel-silent-loss-alarm",
     description: "Channel silent-loss alarm (ENG-6728): when ON, the responsiveness-probe route creates a per-agent CloudWatch alarm that pages on a `ChannelDeflections` Cause=replay_orphaned datapoint (a recoverable inbound aged out without delivery). Observe-first rollout gate, flipped stage-wide from the admin Feature Flags page; the underlying metric ships since ENG-6355. The AUGMENTED_CHANNEL_SILENT_LOSS_ALARM_ENABLED env var is retained as the highest-precedence operator override; precedence is env override > flag value > this default.",
@@ -14486,4 +14500,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-SRR5XVWJ.js.map
+//# sourceMappingURL=chunk-XZI5IHQP.js.map