@integrity-labs/agt-cli 0.28.497 → 0.28.499

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-I5RQJEM7.js";
+} from "../chunk-Q5O2VAQA.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-UNAP4CMY.js";
+} from "../chunk-5XHO4HKA.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.497" : "dev";
+var cliVersion = true ? "0.28.499" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.497" : "dev";
+var cliVersion2 = true ? "0.28.499" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-UNAP4CMY.js → chunk-5XHO4HKA.js}

@@ -6063,6 +6063,42 @@ function buildForwardHeaders(token, authHeader, extras, readVar) {
   return headers;
 }
 
+// ../../packages/core/dist/integrations/remote-mcp-connection.js
+var DEFAULT_REMOTE_MCP_CONNECTION_KEY = "default";
+function isDefaultRemoteMcpConnection(connectionKey) {
+  return !connectionKey || connectionKey === DEFAULT_REMOTE_MCP_CONNECTION_KEY;
+}
+function sanitizeBase(definitionId) {
+  return definitionId.replace(/[^a-z0-9]/gi, "_").toLowerCase();
+}
+function remoteMcpServerKey(definitionId, connectionKey) {
+  if (isDefaultRemoteMcpConnection(connectionKey))
+    return definitionId;
+  return `${sanitizeBase(definitionId)}-${connectionKey}`;
+}
+function remoteMcpConnectionEnvInfix(connectionKey) {
+  if (isDefaultRemoteMcpConnection(connectionKey))
+    return "";
+  return `__${connectionKey.replace(/-/g, "_").toUpperCase()}`;
+}
+function remoteMcpEnvPrefix(definitionId, connectionKey) {
+  const idPart = definitionId.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+  return `${idPart}${remoteMcpConnectionEnvInfix(connectionKey)}`;
+}
+function remoteMcpConnectionScopedEnvVar(definitionId, varName, connectionKey) {
+  if (isDefaultRemoteMcpConnection(connectionKey))
+    return varName;
+  const idPart = definitionId.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+  if (!varName.startsWith(`${idPart}_`))
+    return varName;
+  return `${idPart}${remoteMcpConnectionEnvInfix(connectionKey)}_${varName.slice(idPart.length + 1)}`;
+}
+function remoteMcpConnectionLabel(definitionId, connectionKey) {
+  if (isDefaultRemoteMcpConnection(connectionKey))
+    return definitionId;
+  return `${definitionId} (${connectionKey})`;
+}
+
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
   {
@@ -7214,6 +7250,11 @@ var AGENT_DIRECTED_KIND_SET = new Set(AGENT_DIRECTED_NOTICE_KINDS);
 // ../../packages/core/dist/direct-chat/cursor-advance.js
 var CURSOR_SHORTFALL_REASONS = [
   "not_found",
+  // ENG-8348: `/consume` only. The row belongs to this agent+session but was
+  // never claimed, so the caller is acking work it cannot have done — the one
+  // case that route's widened predicate deliberately refuses to advance. It has
+  // to be nameable or the refusal is unmeasurable.
+  "unclaimed",
   "gave_up",
   "already_delivered",
   "error",
@@ -10047,6 +10088,18 @@ var FLAG_REGISTRY = [
     // env var is retired.
     envVar: "AUGMENTED_CONNECTIVITY_ESCALATION_ENABLED"
   },
+  {
+    key: "integration-reauth-reminders",
+    description: "Re-notify an integration that stays in needs_reauth (ENG-8370). Failure notification is at-most-once PER TRANSITION, so an integration nobody repairs is announced once and then silent forever - prod carried a row failing every 30-minute tick for ~21 days on a single day-one notification. When on, the IntegrationReauthReminder cron re-fires the existing reconnect notification on a backoff measured from failure ONSET (+1d, +3d, +7d, then weekly), skipping rows an operator has muted. When off the cron still scans and logs what it WOULD have sent, so the volume can be sized before anyone is messaged. Boolean gate; ships dark.",
+    flagType: "boolean",
+    // `false` is both the pre-ENG-8370 fleet behaviour AND the fail-safe
+    // direction: this flag governs how often real humans get messaged, so a
+    // flag-DB read error must never start sending on its own. Turning it on is
+    // a deliberate per-org act from the admin Feature Flags page, never a
+    // side-effect of a deploy. No env override - net-new gate, registry-only
+    // (ADR-0022).
+    defaultValue: false
+  },
   {
     key: "managed-health-connectivity-flip",
     description: "Arm the managed-connection-health status flip on data-plane hard-down (ENG-7539). When on, the managed-connection-health cron flips a managed integration to needs_reauth when the host-side connectivity probe reports a sustained hard-down (consecutive_connectivity_failures at/over the hysteresis threshold with a down observation), even if Composio account-status still reads ACTIVE. When off it keeps the pre-ENG-7539 behaviour: status is driven only by the account-status probe, so a live 401 behind an ACTIVE account never flips status. Boolean gate; ships dark. Sibling of integration-connectivity-escalation: that flag arms the alert; this flag arms the status flip plus the reconnect notification.",
@@ -10760,13 +10813,14 @@ function generateAgentsMd(input) {
 }
 
 // ../../packages/core/dist/provisioning/remote-mcp.js
-function envVarForToken(definitionId) {
-  return `${definitionId.replace(/-/g, "_").toUpperCase()}_ACCESS_TOKEN`;
+function envVarForToken(definitionId, connectionKey) {
+  const idPart = definitionId.replace(/-/g, "_").toUpperCase();
+  return `${idPart}${remoteMcpConnectionEnvInfix(connectionKey)}_ACCESS_TOKEN`;
 }
-function credentialEnvVar(definitionId, credentialRef) {
+function credentialEnvVar(definitionId, credentialRef, connectionKey) {
   const idPart = definitionId.replace(/-/g, "_").toUpperCase();
   const credPart = credentialRef.replace(/-/g, "_").toUpperCase();
-  return `${idPart}_${credPart}`;
+  return `${idPart}${remoteMcpConnectionEnvInfix(connectionKey)}_${credPart}`;
 }
 function assertSafeRemoteMcpUrl(url, definitionId) {
   let u;
@@ -10787,11 +10841,11 @@ function assertSafeRemoteMcpUrl(url, definitionId) {
     throw new Error(`remoteMcp.url for '${definitionId}' resolves to a disallowed (internal/link-local/metadata) host: ${host}`);
   }
 }
-function renderRemoteMcpSpec(definitionId, spec) {
+function renderRemoteMcpSpec(definitionId, spec, connectionKey) {
   assertSafeRemoteMcpUrl(spec.url, definitionId);
   const headers = {};
   if (spec.auth) {
-    const envVar = credentialEnvVar(definitionId, spec.auth.credential_ref);
+    const envVar = credentialEnvVar(definitionId, spec.auth.credential_ref, connectionKey);
     const value = `\${${envVar}}`;
     if (spec.auth.scheme === "bearer") {
       headers["Authorization"] = `Bearer ${value}`;
@@ -10802,17 +10856,24 @@ function renderRemoteMcpSpec(definitionId, spec) {
       headers[spec.auth.header_name] = value;
     }
   }
-  Object.assign(headers, spec.headers ?? {});
+  if (isDefaultRemoteMcpConnection(connectionKey)) {
+    Object.assign(headers, spec.headers ?? {});
+  } else {
+    for (const [header, value] of Object.entries(spec.headers ?? {})) {
+      const varName = extractHeaderVarName(value);
+      headers[header] = varName ? `\${${remoteMcpConnectionScopedEnvVar(definitionId, varName, connectionKey)}}` : value;
+    }
+  }
   return {
     type: spec.type ?? "http",
     url: spec.url,
     ...Object.keys(headers).length > 0 ? { headers } : {}
   };
 }
-function buildRemoteMcpEntry(definitionId, dbSpec) {
+function buildRemoteMcpEntry(definitionId, dbSpec, connectionKey) {
   const spec = dbSpec ?? INTEGRATION_REGISTRY.find((d) => d.id === definitionId)?.remoteMcp;
   if (spec) {
-    return renderRemoteMcpSpec(definitionId, spec);
+    return renderRemoteMcpSpec(definitionId, spec, connectionKey);
   }
   const provider = OAUTH_PROVIDERS[definitionId];
   if (!provider?.mcpUrl)
@@ -10821,7 +10882,7 @@ function buildRemoteMcpEntry(definitionId, dbSpec) {
     type: "http",
     url: provider.mcpUrl,
     headers: {
-      Authorization: `Bearer \${${envVarForToken(definitionId)}}`
+      Authorization: `Bearer \${${envVarForToken(definitionId, connectionKey)}}`
     }
   };
 }
@@ -10832,7 +10893,7 @@ function extractHeaderVarName(value) {
   const m = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(value.trim());
   return m ? m[1] : null;
 }
-function buildLiveHeaderRemoteMcpProxyEntry(definitionId, dbSpec, paths) {
+function buildLiveHeaderRemoteMcpProxyEntry(definitionId, dbSpec, paths, connectionKey) {
   const spec = dbSpec ?? INTEGRATION_REGISTRY.find((d) => d.id === definitionId)?.remoteMcp;
   if (!spec?.liveHeaderRefresh)
     return null;
@@ -10843,8 +10904,9 @@ function buildLiveHeaderRemoteMcpProxyEntry(definitionId, dbSpec, paths) {
   const extraPairs = [];
   for (const [header, value] of Object.entries(spec.headers ?? {})) {
     const varName = extractHeaderVarName(value);
-    if (varName)
-      extraPairs.push(`${header}:${varName}`);
+    if (varName) {
+      extraPairs.push(`${header}:${remoteMcpConnectionScopedEnvVar(definitionId, varName, connectionKey)}`);
+    }
   }
   return {
     command: "node",
@@ -10852,14 +10914,14 @@ function buildLiveHeaderRemoteMcpProxyEntry(definitionId, dbSpec, paths) {
     env: {
       AGT_REMOTE_MCP_URL: spec.url,
       AGT_REMOTE_MCP_TOKEN_FILE: paths.tokenFile,
-      AGT_REMOTE_MCP_TOKEN_VAR: credentialEnvVar(definitionId, spec.auth.credential_ref),
+      AGT_REMOTE_MCP_TOKEN_VAR: credentialEnvVar(definitionId, spec.auth.credential_ref, connectionKey),
       AGT_REMOTE_MCP_AUTH_HEADER: spec.auth.header_name,
-      AGT_REMOTE_MCP_LABEL: definitionId,
+      AGT_REMOTE_MCP_LABEL: remoteMcpConnectionLabel(definitionId, connectionKey),
       ...extraPairs.length > 0 ? { AGT_REMOTE_MCP_EXTRA_HEADERS: extraPairs.join(",") } : {}
     }
   };
 }
-function buildOAuthRemoteMcpProxyEntry(definitionId, paths) {
+function buildOAuthRemoteMcpProxyEntry(definitionId, paths, connectionKey) {
   const def = INTEGRATION_REGISTRY.find((d) => d.id === definitionId);
   if (def?.remoteMcp)
     return null;
@@ -10872,8 +10934,8 @@ function buildOAuthRemoteMcpProxyEntry(definitionId, paths) {
     env: {
       AGT_REMOTE_MCP_URL: provider.mcpUrl,
       AGT_REMOTE_MCP_TOKEN_FILE: paths.tokenFile,
-      AGT_REMOTE_MCP_TOKEN_VAR: envVarForToken(definitionId),
-      AGT_REMOTE_MCP_LABEL: definitionId,
+      AGT_REMOTE_MCP_TOKEN_VAR: envVarForToken(definitionId, connectionKey),
+      AGT_REMOTE_MCP_LABEL: remoteMcpConnectionLabel(definitionId, connectionKey),
       // ENG-6948: cap the agent's exposed surface to the curated allowlist. The
       // proxy filters tools/list and gates tools/call against this set. Omitted
       // when the provider has no allowlist, leaving the proxy a pass-through.
@@ -14490,6 +14552,10 @@ export {
   INTEGRATION_REGISTRY,
   getIntegration,
   OAUTH_PROVIDERS,
+  isDefaultRemoteMcpConnection,
+  remoteMcpServerKey,
+  remoteMcpEnvPrefix,
+  remoteMcpConnectionScopedEnvVar,
   buildRemoteMcpEntry,
   buildHostBrokeredRemoteMcpEntry,
   buildLiveHeaderRemoteMcpProxyEntry,
@@ -14647,4 +14713,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-UNAP4CMY.js.map
+//# sourceMappingURL=chunk-5XHO4HKA.js.map