@integrity-labs/agt-cli 0.28.500 → 0.28.501

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-ICNRQ4L5.js";
+} from "../chunk-N4Y5IBZR.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.500" : "dev";
+var cliVersion = true ? "0.28.501" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.500" : "dev";
+var cliVersion2 = true ? "0.28.501" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-ICNRQ4L5.js → chunk-N4Y5IBZR.js}

@@ -1,10 +1,14 @@
 import {
+  BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
   INTEGRATION_REGISTRY,
   LATE_BOUND_VARS,
+  MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING,
   OAUTH_PROVIDERS,
   REMOTE_MCP_PROXY_ENV,
+  RESTART_BREAKER_PROVISIONING_MAX,
+  RESTART_BREAKER_PROVISIONING_WINDOW_MS,
   bestConnectivityEvidence,
   buildForwardHeaders,
   buildHostBrokeredRemoteMcpEntry,
@@ -5057,7 +5061,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.500" : "dev";
+var agtCliVersion = true ? "0.28.501" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -6420,6 +6424,363 @@ function reapMissingMcpSessions(args) {
   };
 }
 
+// src/lib/restart-breaker.ts
+function reaperRestartBreakerReason(activeKeys) {
+  return activeKeys.length >= 2 ? "mcp-presence-reaper" : void 0;
+}
+var KNOWN_REASON_CLASS_MAP = {
+  crash: true,
+  provisioning: true,
+  "credential-rotation": true,
+  // ENG-8215: the self-healing class (bind-remediation - the manager's OWN
+  // repair attempts, which must never count toward a trip). Adding it here is
+  // forced by the Record type, which is exactly why that shape was chosen over
+  // a Set literal (ENG-7577, CodeRabbit on #3861) - a new union member cannot
+  // be silently omitted from the rehydration allowlist.
+  "self-healing": true
+};
+var KNOWN_REASON_CLASSES = new Set(
+  Object.keys(KNOWN_REASON_CLASS_MAP)
+);
+var PROVISIONING_RELOAD_REASONS = /* @__PURE__ */ new Set([
+  "hot-reload-mcp",
+  "managed-mcp-churn",
+  // ENG-8215: 'bind-remediation' MOVED OUT of this set into SELF_HEALING_REASONS.
+  // It is the manager repairing itself, not a config reload, and counting it
+  // meant the harder the platform tried to fix an agent the more certain it
+  // became that it should give up. Deliberately NOT re-added here.
+  // ENG-7576: the dashboard integration-add stop itself - the first restart of
+  // the very burst this class exists for, previously uncounted entirely.
+  "integration-change",
+  // ENG-7771: a sender_policy delivery restart is a deliberate config-delivery
+  // reload (operator changed the policy, or the fail-closed first-poll verify
+  // after a manager restart with no persisted baseline), not a crash. On the
+  // tight crash tally, a host whose sender-policy-baseline.json write keeps
+  // failing (disk full, permissions) would convert the fail-closed restart
+  // into repeated crash tallies across a multi-deploy day and trip the
+  // breaker - taking the agent DOWN, which is strictly worse than the stale
+  // policy the restart exists to fix. The looser provisioning tally still
+  // trips + pages on sustained thrash.
+  "sender-policy-change"
+]);
+function isProvisioningReloadReason(reason) {
+  return PROVISIONING_RELOAD_REASONS.has(reason);
+}
+var CREDENTIAL_ROTATION_REASONS = /* @__PURE__ */ new Set([
+  "credential-rotation"
+]);
+function isCredentialRotationReason(reason) {
+  return CREDENTIAL_ROTATION_REASONS.has(reason);
+}
+var SELF_HEALING_REASONS = /* @__PURE__ */ new Set([
+  "bind-remediation"
+]);
+function isSelfHealingReason(reason) {
+  return SELF_HEALING_REASONS.has(reason);
+}
+function restartReasonClass(reason) {
+  if (isCredentialRotationReason(reason)) return "credential-rotation";
+  if (isSelfHealingReason(reason)) return "self-healing";
+  return isProvisioningReloadReason(reason) ? "provisioning" : "crash";
+}
+function countByClass(events) {
+  let crash = 0;
+  let provisioning = 0;
+  let credentialRotation = 0;
+  let selfHealing = 0;
+  for (const e of events) {
+    const klass = restartReasonClass(e.reason);
+    if (klass === "provisioning") provisioning += 1;
+    else if (klass === "credential-rotation") credentialRotation += 1;
+    else if (klass === "self-healing") selfHealing += 1;
+    else crash += 1;
+  }
+  return {
+    crash,
+    provisioning,
+    "credential-rotation": credentialRotation,
+    "self-healing": selfHealing
+  };
+}
+function maxProvisioningBucket(events) {
+  const buckets = /* @__PURE__ */ new Map();
+  for (const e of events) {
+    if (!isProvisioningReloadReason(e.reason)) continue;
+    const key = e.integrationKey ?? "";
+    buckets.set(key, (buckets.get(key) ?? 0) + 1);
+  }
+  let best = { count: 0, key: "" };
+  for (const [key, count] of buckets) {
+    if (count > best.count) best = { count, key };
+  }
+  return best;
+}
+function tripClass(trip) {
+  if (trip.trippedClass) return trip.trippedClass;
+  if (!Array.isArray(trip.eventsAtTrip) || trip.eventsAtTrip.length === 0) return "crash";
+  return trip.eventsAtTrip.every((e) => isProvisioningReloadReason(e.reason)) ? "provisioning" : "crash";
+}
+var DEFAULT_MAX = 2;
+var DEFAULT_WINDOW_MS = 6e5;
+var DEFAULT_PROVISIONING_MAX = RESTART_BREAKER_PROVISIONING_MAX;
+var DEFAULT_PROVISIONING_WINDOW_MS = RESTART_BREAKER_PROVISIONING_WINDOW_MS;
+function readEnvNumber(name, fallback) {
+  const raw = process.env[name];
+  if (!raw) return fallback;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+var RestartBreaker = class {
+  max;
+  windowMs;
+  /**
+   * ENG-8215: NOT readonly - the constructor may clamp it upward to preserve the
+   * quarantine-fires-first ordering against a runtime override. Never mutated
+   * after construction.
+   */
+  provisioningMax;
+  provisioningWindowMs;
+  /** Longest window either tally needs — how long the events log must retain. */
+  retentionMs;
+  now;
+  events = /* @__PURE__ */ new Map();
+  trips = /* @__PURE__ */ new Map();
+  /**
+   * ENG-8215: set when a supplied `provisioningMax` was raised to keep MCP
+   * quarantine ahead of the breaker. Read once by the manager at construction so
+   * an overridden-and-clamped value is visible in manager.log rather than
+   * silently discarded.
+   */
+  quarantineOrderingClamped;
+  constructor(opts = {}) {
+    this.max = opts.max ?? readEnvNumber("AGT_RESTART_BREAKER_MAX", DEFAULT_MAX);
+    this.windowMs = opts.windowMs ?? readEnvNumber("AGT_RESTART_BREAKER_WINDOW_MS", DEFAULT_WINDOW_MS);
+    this.provisioningMax = opts.provisioningMax ?? readEnvNumber("AGT_RESTART_BREAKER_PROVISIONING_MAX", DEFAULT_PROVISIONING_MAX);
+    this.provisioningWindowMs = opts.provisioningWindowMs ?? readEnvNumber("AGT_RESTART_BREAKER_PROVISIONING_WINDOW_MS", DEFAULT_PROVISIONING_WINDOW_MS);
+    this.now = opts.now ?? Date.now;
+    if (!Number.isFinite(this.max) || this.max < 1) {
+      throw new Error("restart-breaker max must be a finite number >= 1");
+    }
+    if (!Number.isFinite(this.windowMs) || this.windowMs < 1e3) {
+      throw new Error("restart-breaker windowMs must be a finite number >= 1000");
+    }
+    if (!Number.isFinite(this.provisioningMax) || this.provisioningMax < 1) {
+      throw new Error("restart-breaker provisioningMax must be a finite number >= 1");
+    }
+    if (this.provisioningMax < MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING) {
+      this.quarantineOrderingClamped = {
+        requested: this.provisioningMax,
+        applied: MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING,
+        quarantineThreshold: BIND_FAILURE_QUARANTINE_THRESHOLD
+      };
+      this.provisioningMax = MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING;
+    }
+    if (!Number.isFinite(this.provisioningWindowMs) || this.provisioningWindowMs < 1e3) {
+      throw new Error("restart-breaker provisioningWindowMs must be a finite number >= 1000");
+    }
+    this.retentionMs = Math.max(this.windowMs, this.provisioningWindowMs);
+  }
+  /**
+   * ENG-8215: the clamp record, if the configured provisioning max had to be
+   * raised to keep MCP quarantine ahead of the breaker. `undefined` when the
+   * configured value already satisfied the ordering.
+   */
+  getQuarantineOrderingClamp() {
+    return this.quarantineOrderingClamped;
+  }
+  /** True if this agent's breaker is currently tripped (manager must skip spawn). */
+  isTripped(codeName) {
+    return this.trips.has(codeName);
+  }
+  getTrip(codeName) {
+    return this.trips.get(codeName);
+  }
+  /**
+   * Record a restart event. If recording this event puts the count
+   * inside the window above `max`, the breaker trips and the call site
+   * should NOT respawn.
+   *
+   * Idempotent on already-tripped breakers: returns the existing trip
+   * without double-counting events. Callers may still record the reason
+   * via the decision-log for forensics.
+   */
+  record(codeName, reason, integrationKey) {
+    const existing = this.trips.get(codeName);
+    if (existing) {
+      const bucket = maxProvisioningBucket(existing.eventsAtTrip);
+      return {
+        tripped: false,
+        trip: existing,
+        windowCount: existing.eventsAtTrip.length,
+        classCounts: countByClass(existing.eventsAtTrip),
+        maxProvisioningBucket: bucket.count,
+        maxProvisioningBucketKey: bucket.key
+      };
+    }
+    const at = this.now();
+    const retentionCutoff = at - this.retentionMs;
+    const prior = (this.events.get(codeName) ?? []).filter((e) => e.at >= retentionCutoff);
+    prior.push(
+      isProvisioningReloadReason(reason) && integrationKey ? { reason, at, integrationKey } : { reason, at }
+    );
+    this.events.set(codeName, prior);
+    const crashCount = prior.filter(
+      (e) => e.at >= at - this.windowMs && restartReasonClass(e.reason) === "crash"
+    ).length;
+    const provEvents = prior.filter(
+      (e) => e.at >= at - this.provisioningWindowMs && isProvisioningReloadReason(e.reason)
+    );
+    const credRotCount = prior.filter(
+      (e) => e.at >= at - this.provisioningWindowMs && isCredentialRotationReason(e.reason)
+    ).length;
+    const selfHealCount = prior.filter(
+      (e) => e.at >= at - this.provisioningWindowMs && isSelfHealingReason(e.reason)
+    ).length;
+    const windowCount = prior.filter((e) => e.at >= at - this.windowMs).length;
+    const classCounts = {
+      crash: crashCount,
+      provisioning: provEvents.length,
+      "credential-rotation": credRotCount,
+      "self-healing": selfHealCount
+    };
+    const provBucket = maxProvisioningBucket(provEvents);
+    let trippedClass;
+    let tripEvents;
+    let tripWindowMs = this.windowMs;
+    if (crashCount > this.max) {
+      trippedClass = "crash";
+      tripEvents = prior.filter(
+        (e) => e.at >= at - this.windowMs && restartReasonClass(e.reason) === "crash"
+      );
+      tripWindowMs = this.windowMs;
+    } else if (provBucket.count > this.provisioningMax) {
+      trippedClass = "provisioning";
+      tripEvents = provEvents.filter((e) => (e.integrationKey ?? "") === provBucket.key);
+      tripWindowMs = this.provisioningWindowMs;
+    }
+    if (trippedClass && tripEvents) {
+      const trip = {
+        trippedAt: at,
+        eventsAtTrip: [...tripEvents],
+        statusMessage: formatStatusMessage(tripEvents, tripWindowMs, trippedClass, provBucket.key),
+        // ENG-7577: persist the tripping class so the recovery path can gate on
+        // it after a manager restart, without re-deriving it from prose.
+        trippedClass
+      };
+      this.trips.set(codeName, trip);
+      this.events.delete(codeName);
+      return {
+        tripped: true,
+        trip,
+        windowCount,
+        classCounts,
+        trippedClass,
+        maxProvisioningBucket: provBucket.count,
+        maxProvisioningBucketKey: provBucket.key
+      };
+    }
+    return {
+      tripped: false,
+      windowCount,
+      classCounts,
+      maxProvisioningBucket: provBucket.count,
+      maxProvisioningBucketKey: provBucket.key
+    };
+  }
+  /** Operator-initiated reset: drops the trip + the events log for this agent. */
+  clear(codeName) {
+    this.trips.delete(codeName);
+    this.events.delete(codeName);
+  }
+  /** Snapshot tripped agents for `manager-state.json`. */
+  serialize() {
+    return Object.fromEntries(this.trips.entries());
+  }
+  /**
+   * Rehydrate trip state from `manager-state.json`. Called once at
+   * worker startup. Window history is intentionally NOT persisted — only
+   * tripped state. A tripped breaker survives manager restart; an
+   * un-tripped one starts a fresh window in the new worker.
+   */
+  hydrate(saved) {
+    if (!saved) return;
+    for (const [codeName, trip] of Object.entries(saved)) {
+      if (trip && typeof trip.trippedAt === "number" && Array.isArray(trip.eventsAtTrip)) {
+        const klass = trip.trippedClass;
+        this.trips.set(
+          codeName,
+          klass === void 0 || KNOWN_REASON_CLASSES.has(klass) ? trip : { ...trip, trippedClass: void 0 }
+        );
+      }
+    }
+  }
+  /** Test helper — current in-window event count for `codeName`. */
+  windowCount(codeName) {
+    const cutoff = this.now() - this.windowMs;
+    return (this.events.get(codeName) ?? []).filter((e) => e.at >= cutoff).length;
+  }
+};
+function formatStatusMessage(events, windowMs, klass = "crash", integrationKey = "") {
+  const last = events[events.length - 1];
+  const windowLabel = windowMs < 6e4 ? `${Math.round(windowMs / 1e3)}s` : `${(windowMs / 6e4).toFixed(1).replace(/\.0$/, "")}min`;
+  const reasonCounts = /* @__PURE__ */ new Map();
+  for (const e of events) reasonCounts.set(e.reason, (reasonCounts.get(e.reason) ?? 0) + 1);
+  const breakdown = Array.from(reasonCounts.entries()).map(([r, n]) => `${r}=${n}`).join(", ");
+  const classLabel = klass === "provisioning" ? "provisioning-reload " : "";
+  const integrationLabel = klass === "provisioning" && integrationKey ? ` for integration '${integrationKey}'` : "";
+  return `Circuit breaker tripped: ${events.length} ${classLabel}restarts in ${windowLabel}${integrationLabel} (${breakdown}); most recent=${last.reason} at ${new Date(last.at).toISOString()}`;
+}
+
+// src/lib/mcp-config-lookup.ts
+function markQuarantinedForProbe(rows) {
+  return rows.map((row) => ({ ...row, quarantined: true }));
+}
+function inlineEntryLookup(value) {
+  return value ? { ok: true, value } : { ok: false, cause: "wrong-shape" };
+}
+var FIRST_CONNECT_WINDOW_MS = readEnvNumber(
+  "AGT_BIND_REMEDIATION_FIRST_CONNECT_WINDOW_MS",
+  9e5
+  // 15 min
+);
+function isWithinFirstConnectWindow(createdAt, now, windowMs = FIRST_CONNECT_WINDOW_MS) {
+  if (!createdAt) return true;
+  const addedAt = Date.parse(createdAt);
+  if (!Number.isFinite(addedAt)) return true;
+  return now - addedAt <= windowMs;
+}
+function verdictForUnavailableMcpConfig(cause, ctx) {
+  const where = `MCP ${ctx.transport} server '${ctx.serverKey}'`;
+  if (cause === "file-unreadable") {
+    return { status: "transient_error", message: `${where}: ${ctx.source} unreadable or unparseable` };
+  }
+  if (cause === "key-absent") {
+    if (ctx.expectedAbsent) {
+      return {
+        status: "transient_error",
+        message: `${where}: not in ${ctx.source} (quarantined \u2014 absence expected)`
+      };
+    }
+    if (isWithinFirstConnectWindow(ctx.createdAt, ctx.now, ctx.windowMs)) {
+      return {
+        status: "transient_error",
+        message: `${where}: not yet written to ${ctx.source} (within first-connect window)`
+      };
+    }
+    return { status: "down", message: `${where}: not wired in ${ctx.source}` };
+  }
+  if (ctx.expectedAbsent) {
+    return {
+      status: "transient_error",
+      message: `${where}: reconstructed ${ctx.source} entry is not ${ctx.transport}-probeable (quarantined)`
+    };
+  }
+  return {
+    status: "down",
+    message: `${where}: ${ctx.source} entry is not ${ctx.transport}-probeable`
+  };
+}
+
 // src/lib/connectivity-probe-context.ts
 import { join as join5 } from "path";
 import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
@@ -6753,15 +7114,17 @@ function resolveHttpServerEntry(entry, env) {
   return null;
 }
 function readMcpHttpServerConfig(projectDir, serverKey, env) {
+  let servers;
   try {
     const raw = readFileSync6(join5(projectDir, ".mcp.json"), "utf-8");
-    const servers = JSON.parse(raw).mcpServers ?? {};
-    const entry = servers[serverKey];
-    if (!entry) return null;
-    return resolveHttpServerEntry(entry, env);
+    servers = JSON.parse(raw).mcpServers ?? {};
   } catch {
-    return null;
+    return { ok: false, cause: "file-unreadable" };
   }
+  const entry = servers[serverKey];
+  if (!entry) return { ok: false, cause: "key-absent" };
+  const value = resolveHttpServerEntry(entry, env);
+  return value ? { ok: true, value } : { ok: false, cause: "wrong-shape" };
 }
 function resolveDeclaredServerKey(projectDir, definitionId, derivedKey) {
   try {
@@ -6805,15 +7168,17 @@ function resolveStdioServerEntry(entry, env) {
   };
 }
 function readMcpStdioServerConfig(projectDir, serverKey, env) {
+  let servers;
   try {
     const raw = readFileSync6(join5(projectDir, ".mcp.json"), "utf-8");
-    const servers = JSON.parse(raw).mcpServers ?? {};
-    const entry = servers[serverKey];
-    if (!entry) return null;
-    return resolveStdioServerEntry(entry, env);
+    servers = JSON.parse(raw).mcpServers ?? {};
   } catch {
-    return null;
+    return { ok: false, cause: "file-unreadable" };
   }
+  const entry = servers[serverKey];
+  if (!entry) return { ok: false, cause: "key-absent" };
+  const value = resolveStdioServerEntry(entry, env);
+  return value ? { ok: true, value } : { ok: false, cause: "wrong-shape" };
 }
 function deriveMcpServerKey(input) {
   const kind = resolveConnectivityProbe({
@@ -6844,11 +7209,18 @@ function buildConnectivityProbeDeps(projectDir, probeEnv) {
     runCli: (binary, args) => runCliProbe(binary, args, { env: probeEnv }),
     mcpProbe: async (target) => {
       const serverKey = target.inlineServerEntry ? target.serverKey : resolveDeclaredServerKey(projectDir, target.definitionId, target.serverKey) ?? target.serverKey;
-      const cfg = target.inlineServerEntry ? resolveHttpServerEntry(target.inlineServerEntry, probeEnv) : readMcpHttpServerConfig(projectDir, serverKey, probeEnv);
-      if (!cfg) {
-        const src = target.inlineServerEntry ? "inline config" : ".mcp.json";
-        return { status: "transient_error", message: `MCP server '${serverKey}' not resolvable from ${src}` };
+      const lookup = target.inlineServerEntry ? inlineEntryLookup(resolveHttpServerEntry(target.inlineServerEntry, probeEnv)) : readMcpHttpServerConfig(projectDir, serverKey, probeEnv);
+      if (!lookup.ok) {
+        return verdictForUnavailableMcpConfig(lookup.cause, {
+          serverKey,
+          transport: "http",
+          source: target.inlineServerEntry ? "inline config" : ".mcp.json",
+          createdAt: target.createdAt,
+          expectedAbsent: target.expectedAbsent || Boolean(target.inlineServerEntry),
+          now: Date.now()
+        });
       }
+      const cfg = lookup.value;
       if (cfg.unresolved.length > 0) {
         return {
           status: "transient_error",
@@ -6861,15 +7233,28 @@ function buildConnectivityProbeDeps(projectDir, probeEnv) {
     // the agent's env (the exact command/args/env from `.mcp.json`), handshakes,
     // and calls the read-only `connectivity_test` tool when the descriptor set
     // one (threaded via target.toolName). An unresolvable `${VAR}` in the spawn
-    // env → skip as non-escalating, never spawn a doomed server. A missing
-    // server entry is a real `down` — the tools aren't wired.
+    // env → skip as non-escalating, never spawn a doomed server.
+    //
+    // ENG-8363: a missing server entry is no longer a flat `down`. It still is
+    // one once the writer has had its chance, but the manager probes BEFORE it
+    // writes `.mcp.json` in the same poll, so the first probe of every
+    // newly-added integration necessarily finds the key absent — that window
+    // reads `transient_error` (and is what keeps ENG-7575's first-connect
+    // backoff engaged). `verdictForUnavailableMcpConfig` owns the distinction.
     mcpStdioProbe: async (target) => {
       const serverKey = target.inlineServerEntry ? target.serverKey : resolveDeclaredServerKey(projectDir, target.definitionId, target.serverKey) ?? target.serverKey;
-      const cfg = target.inlineServerEntry ? resolveStdioServerEntry(target.inlineServerEntry, probeEnv) : readMcpStdioServerConfig(projectDir, serverKey, probeEnv);
-      if (!cfg) {
-        const src = target.inlineServerEntry ? "inline config" : ".mcp.json";
-        return { status: "down", message: `MCP stdio server '${serverKey}' not wired in ${src}` };
+      const lookup = target.inlineServerEntry ? inlineEntryLookup(resolveStdioServerEntry(target.inlineServerEntry, probeEnv)) : readMcpStdioServerConfig(projectDir, serverKey, probeEnv);
+      if (!lookup.ok) {
+        return verdictForUnavailableMcpConfig(lookup.cause, {
+          serverKey,
+          transport: "stdio",
+          source: target.inlineServerEntry ? "inline config" : ".mcp.json",
+          createdAt: target.createdAt,
+          expectedAbsent: target.expectedAbsent || Boolean(target.inlineServerEntry),
+          now: Date.now()
+        });
       }
+      const cfg = lookup.value;
       if (cfg.unresolved.length > 0) {
         return {
           status: "transient_error",
@@ -6890,12 +7275,19 @@ function buildConnectivityProbeDeps(projectDir, probeEnv) {
     // queries with. Inputs come from the agent's OWN wired MCP server: the
     // `x-api-key` header and the `user_id` query param (the agent already
     // authenticates with these), plus the recorded connected_account_id.
-    composioProbe: async (serverKey, credentials, inlineServerEntry) => {
-      const cfg = inlineServerEntry ? resolveHttpServerEntry(inlineServerEntry, probeEnv) : readMcpHttpServerConfig(projectDir, serverKey, probeEnv);
-      if (!cfg) {
-        const src = inlineServerEntry ? "inline config" : ".mcp.json";
-        return { status: "transient_error", message: `MCP server '${serverKey}' not resolvable from ${src}` };
+    composioProbe: async (serverKey, credentials, inlineServerEntry, rowCtx) => {
+      const lookup = inlineServerEntry ? inlineEntryLookup(resolveHttpServerEntry(inlineServerEntry, probeEnv)) : readMcpHttpServerConfig(projectDir, serverKey, probeEnv);
+      if (!lookup.ok) {
+        return verdictForUnavailableMcpConfig(lookup.cause, {
+          serverKey,
+          transport: "http",
+          source: inlineServerEntry ? "inline config" : ".mcp.json",
+          createdAt: rowCtx?.createdAt,
+          expectedAbsent: rowCtx?.expectedAbsent || Boolean(inlineServerEntry),
+          now: Date.now()
+        });
       }
+      const cfg = lookup.value;
       if (cfg.unresolved.length > 0) {
         return {
           status: "transient_error",
@@ -6921,8 +7313,9 @@ function buildConnectivityProbeDeps(projectDir, probeEnv) {
     // linkage surfaces as a real `No connected account found` instead of a
     // green handshake. Skips (`null`) when no safe read-only tool is callable.
     composioToolCallProbe: async (target) => {
-      const cfg = target.inlineServerEntry ? resolveHttpServerEntry(target.inlineServerEntry, probeEnv) : readMcpHttpServerConfig(projectDir, target.serverKey, probeEnv);
-      if (!cfg) return null;
+      const lookup = target.inlineServerEntry ? inlineEntryLookup(resolveHttpServerEntry(target.inlineServerEntry, probeEnv)) : readMcpHttpServerConfig(projectDir, target.serverKey, probeEnv);
+      if (!lookup.ok) return null;
+      const cfg = lookup.value;
       if (cfg.unresolved.length > 0) return null;
       return probeComposioMcpToolCall({
         url: cfg.url,
@@ -7688,6 +8081,10 @@ async function executeConnectivityProbe(target, deps = {}) {
   if (!descriptor.readOnly) {
     throw new Error(`Refusing non-read-only probe for ${target.definitionId}`);
   }
+  const rowFacts = {
+    createdAt: target.createdAt ?? null,
+    expectedAbsent: target.expectedAbsent ?? false
+  };
   switch (descriptor.kind) {
     case "http_provider": {
       const outcome = await probeHttpProvider(target.definitionId, target.credentials, deps.fetchImpl ?? fetch);
@@ -7698,7 +8095,8 @@ async function executeConnectivityProbe(target, deps = {}) {
       const outcome = await deps.composioProbe(
         target.mcpServerKey ?? target.definitionId,
         target.credentials,
-        target.inlineServerEntry
+        target.inlineServerEntry,
+        rowFacts
       );
       return outcome ? withEvidence(outcome, "record_only") : outcome;
     }
@@ -7710,7 +8108,8 @@ async function executeConnectivityProbe(target, deps = {}) {
             await deps.mcpProbe({
               serverKey: target.mcpServerKey ?? target.definitionId,
               definitionId: target.definitionId,
-              inlineServerEntry: target.inlineServerEntry
+              inlineServerEntry: target.inlineServerEntry,
+              ...rowFacts
             }),
             // ENG-8226: initialize + tools/list. The transport answered; no
             // authenticated operation ran. The dwight `needs_reauth` rows all
@@ -7722,7 +8121,7 @@ async function executeConnectivityProbe(target, deps = {}) {
       if (deps.composioProbe) {
         outcomes.push(
           withEvidence(
-            await deps.composioProbe(target.mcpServerKey ?? target.definitionId, target.credentials, target.inlineServerEntry),
+            await deps.composioProbe(target.mcpServerKey ?? target.definitionId, target.credentials, target.inlineServerEntry, rowFacts),
             "record_only"
           )
         );
@@ -7732,6 +8131,7 @@ async function executeConnectivityProbe(target, deps = {}) {
           serverKey: target.mcpServerKey ?? target.definitionId,
           definitionId: target.definitionId,
           inlineServerEntry: target.inlineServerEntry,
+          ...rowFacts,
           // ENG-6242: thread the prescribed tool through to the live tool-call
           // leg. resolveConnectivityProbe only sets these for managed toolkits
           // with a stored override; the probe re-validates read-only and falls
@@ -7754,7 +8154,8 @@ async function executeConnectivityProbe(target, deps = {}) {
       const outcome = await deps.mcpProbe({
         serverKey: target.mcpServerKey ?? target.definitionId,
         definitionId: target.definitionId,
-        inlineServerEntry: target.inlineServerEntry
+        inlineServerEntry: target.inlineServerEntry,
+        ...rowFacts
       });
       return withEvidence(outcome, "handshake");
     }
@@ -7764,6 +8165,7 @@ async function executeConnectivityProbe(target, deps = {}) {
         serverKey: target.mcpServerKey ?? target.definitionId,
         definitionId: target.definitionId,
         inlineServerEntry: target.inlineServerEntry,
+        ...rowFacts,
         toolName: descriptor.probeTool ?? null,
         toolArgs: descriptor.probeArgs ?? null
       });
@@ -7849,6 +8251,13 @@ export {
   clearPresenceReaperStateForKeys,
   givenUpMcpServerKeys,
   reapMissingMcpSessions,
+  reaperRestartBreakerReason,
+  isProvisioningReloadReason,
+  tripClass,
+  readEnvNumber,
+  RestartBreaker,
+  markQuarantinedForProbe,
+  FIRST_CONNECT_WINDOW_MS,
   deriveMcpServerKey,
   buildProbeEnv,
   buildConnectivityProbeDeps,
@@ -7871,4 +8280,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-ICNRQ4L5.js.map
+//# sourceMappingURL=chunk-N4Y5IBZR.js.map