@integrity-labs/agt-cli 0.28.508 → 0.28.510

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-GK3TSZ4S.js";
+} from "../chunk-EQW3EHDQ.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-LNPJI2AE.js";
+} from "../chunk-7DZNVMMX.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.508" : "dev";
+var cliVersion = true ? "0.28.510" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.508" : "dev";
+var cliVersion2 = true ? "0.28.510" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-LNPJI2AE.js → chunk-7DZNVMMX.js}

@@ -6693,29 +6693,44 @@ var INTEGRATION_REGISTRY = [
     id: "vercel",
     name: "Vercel",
     category: "infrastructure",
-    description: "Check on Vercel app deployments \u2014 status, build/runtime logs \u2014 and search Vercel documentation. Remote streamable-HTTP MCP at https://mcp.vercel.com.",
-    // Same OAuth pattern as Granola/Higgsfield: Claude Code brokers the
-    // browser sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Check on Vercel app deployments \u2014 what's live, deployment status, and build logs \u2014 through Vercel's REST API with your own API token.",
+    // ENG-8421: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Vercel MCP (`https://mcp.vercel.com`) is not completable from the
+    // console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Established empirically 2026-08-03: Dynamic Client
+    // Registration REJECTS an https redirect (`invalid_redirect_uri` — "not
+    // approved for use by this authorization server") and ACCEPTS only
+    // localhost; the device-code grant, the one flow needing no redirect, is
+    // refused to DCR clients (`unauthorized_client`). So the only client
+    // Vercel permits is a local one redirecting to its own ephemeral port —
+    // i.e. Claude Code on the agent's host, driven by an operator running
+    // `/mcp` in tmux. No console work can remove that step.
+    //
+    // The REST API has none of those constraints: plain bearer auth
+    // (unauthenticated → `{"code":"forbidden","missingToken":true}`, bogus
+    // bearer → `{"invalidToken":true}`), so a token the customer creates in
+    // their own Vercel dashboard works directly. That makes this an ordinary
+    // paste-a-key integration, and it means WE hold the credential — so it can
+    // be stored, rotated, revoked and audited, none of which was true when the
+    // grant lived in Claude Code's `~/.claude.json` on the host.
+    //
+    // Tools are declared as data on `integration_definitions.metadata.tools`
+    // and dispatch through the existing Direct HTTP broker (the v0 pattern) —
+    // there is deliberately no bespoke Vercel client and no bespoke broker.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build/runtime logs.", access: "read" },
-      { id: "vercel:search-docs", name: "Search Documentation", description: "Search Vercel platform documentation.", access: "read" }
+      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build logs.", access: "read" }
     ],
-    docs_url: "https://vercel.com/docs/agent-resources/vercel-mcp",
-    // Beta until the headless OAuth flow (and Vercel's OAuth-client allowlist,
-    // which is vendor-side and outside our control) is verified end-to-end.
-    beta: true,
-    // No `auth`/`headers` — host-brokered OAuth (Claude Code authenticates
-    // directly with Vercel; nothing for us to inject). Declaring this here
-    // (rather than a hardcoded buildMcpJson/writeIntegrations branch, the
-    // pre-ENG-8035 Higgsfield-era pattern) lets the generic remote-MCP loop
-    // render the `.mcp.json` entry AND enrolls 'vercel' in the
-    // `registryRemoteMcpKeys` prune universe automatically, so an uninstall
-    // actually removes the entry instead of leaving it stale.
-    remoteMcp: {
-      type: "http",
-      url: "https://mcp.vercel.com"
-    }
+    docs_url: "https://vercel.com/docs/rest-api",
+    // Beta until the REST tool surface has been exercised against a real
+    // customer token. (The previous reason — "until the headless OAuth flow is
+    // verified end-to-end" — is void: there is no OAuth flow any more.)
+    beta: true
+    // NO `remoteMcp`. See the tombstone in the claudecode adapter's prune
+    // universe: dropping this field also drops `vercel` from
+    // `registryRemoteMcpKeys`, which would strand the `.mcp.json` entry on
+    // every host that installed the MCP variant.
   },
   {
     id: "qmd",
@@ -9849,6 +9864,22 @@ var FLAG_REGISTRY = [
     // safe: `since` is excluded from projectDefinition, so it does not roll
     // FLAGS_SCHEMA_VERSION.
   },
+  {
+    key: "agt-version-drift-alarm",
+    description: "Arms the ENG-8341 agt CLI version-drift alert. When a host has fallen behind its EFFECTIVE target (env pin > DB pin > release channel) across two or more of its OWN maintenance windows, the monitor opens a host_agt_version_drift alert. OBSERVE-FIRST rollout gate: the cron computes and LOGS the drift for every host on every run regardless of this flag, so the real fleet spread is measurable before anyone is paged - the ticket asks for the threshold to be set from observed data rather than a guess. Off = compute and log, open nothing. Boolean gate; ships dark. Evaluated API-side, in the cron.",
+    flagType: "boolean",
+    // Declared safe value is `false`. Fail-safe direction for a NEW alerting
+    // cron is silence: ~21 hosts with no prior drift signal means the first
+    // armed pass could open an alert for every host that is behind at once.
+    // The cron also carries a bootstrap floor (agent-stall-monitor.ts's
+    // precedent) so arming it does not retroactively page for drift that
+    // started before the monitor existed.
+    defaultValue: false,
+    // Arming this makes a previously-invisible backlog visible all at once, in
+    // the same shape ENG-8204's never-spawned-session-metric warned about - so
+    // the flip is a deliberate, confirmed one (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",
@@ -14908,4 +14939,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-LNPJI2AE.js.map
+//# sourceMappingURL=chunk-7DZNVMMX.js.map