@integrity-labs/agt-cli 0.28.507 → 0.28.509

package/dist/{chunk-75NQ7UBH.js → chunk-S5X4XFAC.js}

@@ -43,7 +43,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-4PRR22KH.js";
+} from "./chunk-7U63M5R6.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -665,6 +665,228 @@ function decryptIntegrationCredentials(credentials) {
   return out;
 }
 
+// ../../packages/core/dist/provisioning/github-broker-credentials.js
+var GITHUB_BROKER_BIN_DIR = ".claude/agt-bin";
+var GIT_CREDENTIAL_HELPER_BASENAME = "git-credential-agt-github";
+var GH_SHIM_BASENAME = "gh";
+var GITHUB_CREDENTIAL_PATH = "/host/agent-integrations/github/credential";
+var BROKER_SCRIPT_MODE = 448;
+function buildGitCredentialEnv(helperPath) {
+  return {
+    GIT_CONFIG_COUNT: "2",
+    GIT_CONFIG_KEY_0: "credential.https://github.com.helper",
+    GIT_CONFIG_VALUE_0: "",
+    GIT_CONFIG_KEY_1: "credential.https://github.com.helper",
+    GIT_CONFIG_VALUE_1: helperPath,
+    GIT_TERMINAL_PROMPT: "0"
+  };
+}
+var GITHUB_BROKER_ENV_KEYS = Object.keys(buildGitCredentialEnv(""));
+var TOKEN_RESOLVER_PRELUDE = `
+const AGT_HOST = (process.env.AGT_HOST || '').replace(/\\/+$/, '');
+const AGT_API_KEY = process.env.AGT_API_KEY || '';
+const AGT_AGENT_ID = process.env.AGT_AGENT_ID || '';
+
+/**
+ * Every failure exits through here, so an operator always gets a sentence that
+ * names the credential fetch as the failing step. A bare 401 from GitHub sends
+ * people auditing App permissions; "broker credential fetch failed: 503" sends
+ * them at the API. Constraint D of ENG-8344.
+ */
+function fail(reason) {
+  process.stderr.write(
+    'augmented: GitHub credential fetch failed: ' + reason + '\\n' +
+    'augmented: the token is fetched per use from ' + (AGT_HOST || '<AGT_HOST unset>') +
+    '${GITHUB_CREDENTIAL_PATH}' + ' (ENG-8344). This is NOT a GitHub permissions problem.\\n',
+  );
+  process.exit(1);
+}
+
+async function postJson(url, body, headers) {
+  let res;
+  try {
+    res = await fetch(url, {
+      method: 'POST',
+      headers: Object.assign({ 'Content-Type': 'application/json' }, headers || {}),
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(15000),
+    });
+  } catch (err) {
+    throw new Error('cannot reach ' + url + ' (' + (err && err.message ? err.message : String(err)) + ')');
+  }
+  const text = await res.text().catch(() => '');
+  if (!res.ok) {
+    let detail = text.slice(0, 300);
+    try {
+      const parsed = JSON.parse(text);
+      if (parsed && parsed.error) detail = String(parsed.error);
+    } catch { /* keep the raw body */ }
+    throw new Error(url + ' returned HTTP ' + res.status + (detail ? ': ' + detail : ''));
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(url + ' returned a non-JSON body');
+  }
+}
+
+async function resolveToken() {
+  if (!AGT_HOST) fail('AGT_HOST is not set in this process environment');
+  if (!AGT_API_KEY) fail('AGT_API_KEY is not set in this process environment');
+  if (!AGT_AGENT_ID) fail('AGT_AGENT_ID is not set in this process environment');
+
+  let jwt;
+  try {
+    const exchanged = await postJson(AGT_HOST + '/host/exchange', { host_key: AGT_API_KEY });
+    jwt = exchanged && exchanged.token;
+  } catch (err) {
+    fail('host key exchange failed - ' + err.message);
+  }
+  if (!jwt) fail('host key exchange returned no token');
+
+  let credential;
+  try {
+    credential = await postJson(
+      AGT_HOST + '${GITHUB_CREDENTIAL_PATH}',
+      { agent_id: AGT_AGENT_ID },
+      { Authorization: 'Bearer ' + jwt },
+    );
+  } catch (err) {
+    fail('broker credential fetch failed - ' + err.message);
+  }
+  const token = credential && credential.access_token;
+  if (typeof token !== 'string' || token === '') {
+    fail('the broker returned no access_token for the github integration (is it still connected?)');
+  }
+  return token;
+}
+`;
+var GENERATED_BANNER = `#!/usr/bin/env node
+// Auto-generated by Augmented (ENG-8344) \u2014 do not edit.
+// Canonical source: packages/core/src/provisioning/github-broker-credentials.ts
+`;
+function renderGitCredentialHelper() {
+  return `${GENERATED_BANNER}${TOKEN_RESOLVER_PRELUDE}
+function readStdin() {
+  return new Promise((resolve) => {
+    let buf = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => { buf += chunk; });
+    process.stdin.on('end', () => resolve(buf));
+    process.stdin.on('error', () => resolve(buf));
+  });
+}
+
+function parseCredentialRequest(input) {
+  const out = {};
+  for (const line of String(input).split('\\n')) {
+    if (line === '') continue;
+    const eq = line.indexOf('=');
+    if (eq <= 0) continue;
+    out[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  return out;
+}
+
+async function main() {
+  const operation = process.argv[2] || '';
+  // Nothing is persisted, so there is nothing to store or erase. Exit clean so
+  // a successful push does not print a helper error on the way out.
+  if (operation !== 'get') process.exit(0);
+
+  const request = parseCredentialRequest(await readStdin());
+
+  // Only ever answer for github.com over https. Any other host gets silence,
+  // which git treats as "this helper has no credential" and falls through to
+  // the next one - never a GitHub token handed to an unrelated server.
+  const host = request.host || '';
+  const protocol = request.protocol || '';
+  if (host !== 'github.com' || (protocol && protocol !== 'https')) process.exit(0);
+
+  const token = await resolveToken();
+  // x-access-token is the username GitHub expects for an App installation token.
+  process.stdout.write(
+    'protocol=https\\n' +
+    'host=github.com\\n' +
+    'username=x-access-token\\n' +
+    'password=' + token + '\\n' +
+    '\\n',
+  );
+}
+
+main().catch((err) => fail(err && err.message ? err.message : String(err)));
+`;
+}
+function renderGhShim() {
+  return `${GENERATED_BANNER}${TOKEN_RESOLVER_PRELUDE}
+const { spawnSync } = require('node:child_process');
+const { accessSync, constants, realpathSync } = require('node:fs');
+const { join, delimiter } = require('node:path');
+const { constants: osConstants } = require('node:os');
+const signals = osConstants.signals;
+
+const SELF = (() => {
+  try { return realpathSync(__filename); } catch { return __filename; }
+})();
+
+/**
+ * First executable named 'gh' on PATH that is NOT this shim. Skipping by
+ * resolved path (not by directory string) means a symlinked or relocated bin
+ * dir cannot trick the search into re-entering the shim.
+ */
+function findRealGh() {
+  for (const dir of (process.env.PATH || '').split(delimiter)) {
+    if (!dir) continue;
+    const candidate = join(dir, 'gh');
+    let resolved;
+    try {
+      accessSync(candidate, constants.X_OK);
+      resolved = realpathSync(candidate);
+    } catch { continue; }
+    if (resolved === SELF) continue;
+    return candidate;
+  }
+  return null;
+}
+
+async function main() {
+  const realGh = findRealGh();
+  if (!realGh) {
+    process.stderr.write(
+      'augmented: the real gh binary is not on PATH (only the Augmented shim is). ' +
+      'Install gh, or unset the broker credential path.\\n',
+    );
+    process.exit(127);
+  }
+
+  const token = await resolveToken();
+  // Token lives ONLY in this child's environment, for this one command.
+  const env = Object.assign({}, process.env, {
+    GH_TOKEN: token,
+    GITHUB_TOKEN: token,
+  });
+  const result = spawnSync(realGh, process.argv.slice(2), { stdio: 'inherit', env });
+  if (result.error) {
+    process.stderr.write('augmented: failed to run ' + realGh + ': ' + result.error.message + '\\n');
+    process.exit(126);
+  }
+  // Report a signal death as the shell convention 128+n, with n the REAL signal
+  // number from os.constants.signals. \`result.signal\` is a name ('SIGINT'), not
+  // a number, so a truthiness check would collapse every signal to 129 and a
+  // Ctrl-C would report 129 instead of 130 - wrong in exactly the case a caller
+  // inspects the code to tell "interrupted" from "failed". Unknown name falls
+  // back to 128, which reads as "died on a signal we could not name".
+  if (result.status === null) {
+    const number = signals[result.signal];
+    process.exit(128 + (typeof number === 'number' ? number : 0));
+  }
+  process.exit(result.status);
+}
+
+main().catch((err) => fail(err && err.message ? err.message : String(err)));
+`;
+}
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
 var VALID_CODE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var SECRET_FILE_MODE = 384;
@@ -934,6 +1156,21 @@ function migrateLegacyClaudecodeDir(codeName, log) {
     emit(`[migrate] '${codeName}': migration failed \u2014 leaving legacy dir in place: ${err.message}`);
   }
 }
+function syncGitHubBrokerCredentialTooling(projectDir, enabled) {
+  const binDir = join2(projectDir, GITHUB_BROKER_BIN_DIR);
+  if (!enabled) {
+    rmSync(binDir, { recursive: true, force: true });
+    return {};
+  }
+  const helperPath = join2(binDir, GIT_CREDENTIAL_HELPER_BASENAME);
+  const shimPath = join2(binDir, GH_SHIM_BASENAME);
+  mkdirSync2(binDir, { recursive: true });
+  writeFileSync3(helperPath, renderGitCredentialHelper(), { mode: BROKER_SCRIPT_MODE });
+  chmodSync3(helperPath, BROKER_SCRIPT_MODE);
+  writeFileSync3(shimPath, renderGhShim(), { mode: BROKER_SCRIPT_MODE });
+  chmodSync3(shimPath, BROKER_SCRIPT_MODE);
+  return buildGitCredentialEnv(helperPath);
+}
 function getProjectDir(codeName) {
   return join2(getAgentDir(codeName), "project");
 }
@@ -4310,6 +4547,8 @@ ${sections}`
       const unscopedPrefix = remoteMcpEnvPrefix(integration.definition_id, null);
       const creds = integration.credentials;
       const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+      if (integration.credentialDelivery === "broker")
+        continue;
       let token;
       if (integration.auth_type === "oauth2" || integration.auth_type === "github_app") {
         token = creds.access_token;
@@ -4357,6 +4596,7 @@ ${sections}`
         envUpdates[scoped] = value;
       }
     }
+    Object.assign(envUpdates, syncGitHubBrokerCredentialTooling(getProjectDir(codeName), decryptedIntegrations.some((i) => i.definition_id === "github" && i.credentialDelivery === "broker")));
     writeEnvIntegrationsForAgent(codeName, {
       mode: "replace-preserving",
       updates: envUpdates
@@ -4550,6 +4790,18 @@ ${sections}`
         // that removing the integration OR flipping the catalog stdio_mcp
         // flag back (rollback) prunes the entry symmetrically.
         "origami",
+        // ENG-8421 retirement tombstone. Vercel moved from a remote MCP
+        // (`https://mcp.vercel.com`) to an api_key Direct HTTP integration, so
+        // its registry entry no longer carries `remoteMcp` — which means it no
+        // longer contributes to `registryRemoteMcpKeys` above. Without this
+        // literal, a host that installed the MCP variant would keep its
+        // `vercel` entry in `.mcp.json` FOREVER: nothing declares it any more,
+        // and the prune can only remove keys it knows about. The stale server
+        // would keep resolving against Claude Code's still-valid stored OAuth
+        // grant, so the agent would see the retired MCP tools AND the new
+        // Direct HTTP ones at once. Inert on a host that never had the MCP
+        // variant; keep until the fleet has refreshed past the retirement.
+        "vercel",
         ...nativeMcpKeys,
         ...registryRemoteMcpKeys,
         ...Object.entries(OAUTH_PROVIDERS).filter(([, provider]) => Boolean(provider.mcpUrl)).map(([id]) => id)
@@ -5062,7 +5314,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.507" : "dev";
+var agtCliVersion = true ? "0.28.509" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8368,4 +8620,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-75NQ7UBH.js.map
+//# sourceMappingURL=chunk-S5X4XFAC.js.map