@integrity-labs/agt-cli 0.28.511 → 0.28.512

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-I3DZ3LI5.js";
+} from "../chunk-Z7DMKSCU.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-OQBHTDWK.js";
+} from "../chunk-M3ICTPSG.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.511" : "dev";
+var cliVersion = true ? "0.28.512" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.511" : "dev";
+var cliVersion2 = true ? "0.28.512" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-OQBHTDWK.js → chunk-M3ICTPSG.js}

@@ -5231,7 +5231,18 @@ var HTTP_PROBE_PROVIDERS = /* @__PURE__ */ new Set([
   // so its honest health signal is the same: a central read-only check that the
   // stored token still authenticates. Routes to the OIDC userinfo probe in
   // connectivity-http-probes.ts.
-  "linkedin-ads"
+  "linkedin-ads",
+  // ENG-8422: Vercel is `source_type: 'native'`, so without this entry it falls
+  // through to the `builtin` branch below — a hardcoded `unverified` verdict
+  // having contacted nothing. `unverified` is neutral to hysteresis, so such an
+  // integration can never report itself broken however bad its credential is.
+  // That was tolerable while Vercel's auth was browser-OAuth brokered by Claude
+  // Code (no server-held credential to check); ENG-8421 made it a
+  // customer-supplied API token, at which point a revoked or mistyped token
+  // became both the likeliest failure AND an invisible one. This entry is what
+  // routes it to the real `api.vercel.com/v2/user` probe — `probeVercel` is
+  // unreachable without it.
+  "vercel"
   // ENG-6100: GitHub is deliberately NOT here. This set drives the ASYNC
   // connectivity monitor's routing, where github (source_type='native')
   // stays host-side (cli_command — `gh`, the credential the agent actually
@@ -5931,12 +5942,15 @@ function statusForHttp(httpStatus) {
     return "transient_error";
   return "down";
 }
-function networkOutcome(err) {
+function redactSecret(message, secret) {
+  if (typeof secret !== "string" || secret.length < 4)
+    return message;
+  return message.split(secret).join("[redacted]");
+}
+function networkOutcome(err, secret) {
   const isAbort = err?.name === "AbortError";
-  return {
-    status: "transient_error",
-    message: isAbort ? `Connection timed out after ${PROBE_TIMEOUT_MS2 / 1e3}s` : `Connection failed: ${err.message}`
-  };
+  const message = isAbort ? `Connection timed out after ${PROBE_TIMEOUT_MS2 / 1e3}s` : `Connection failed: ${err.message}`;
+  return { status: "transient_error", message: redactSecret(message, secret) };
 }
 async function probeLinear(creds, fetchImpl) {
   const key = creds.api_key ?? creds.access_token;
@@ -5958,7 +5972,7 @@ async function probeLinear(creds, fetchImpl) {
       return { status: "down", message: "Invalid key \u2014 no viewer returned" };
     return { status: "ok", message: `Connected as ${viewer.name ?? viewer.email ?? "unknown"}` };
   } catch (err) {
-    return networkOutcome(err);
+    return networkOutcome(err, String(key ?? ""));
   }
 }
 async function probeBearerJson(url, creds, fetchImpl, interpret, extraHeaders) {
@@ -5973,7 +5987,7 @@ async function probeBearerJson(url, creds, fetchImpl, interpret, extraHeaders) {
     }
     return interpret(await res.json());
   } catch (err) {
-    return networkOutcome(err);
+    return networkOutcome(err, String(token ?? ""));
   }
 }
 async function probeBuffer(creds, fetchImpl) {
@@ -5998,7 +6012,32 @@ async function probeBuffer(creds, fetchImpl) {
       return { status: "down", message: "No Buffer organizations on this account" };
     return { status: "ok", message: `Connected to ${orgs[0]?.name ?? "Buffer"}` };
   } catch (err) {
-    return networkOutcome(err);
+    return networkOutcome(err, String(key ?? ""));
+  }
+}
+async function probeVercel(creds, fetchImpl) {
+  const token = creds.api_key ?? creds.access_token;
+  if (!token)
+    return { status: "down", message: "No Vercel credential present" };
+  try {
+    const res = await timedFetch2(fetchImpl, "https://api.vercel.com/v2/user", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) {
+      if (res.status === 429) {
+        return { status: "transient_error", message: "Vercel rate limit (429) \u2014 not a credential failure" };
+      }
+      const message = res.status === 401 || res.status === 403 ? `Vercel rejected the token (${res.status}) \u2014 invalid or revoked API token` : `Vercel API returned ${res.status}`;
+      return { status: statusForHttp(res.status), message };
+    }
+    const body = await res.json();
+    const user = body?.user;
+    const identity = [user?.username, user?.email, user?.name, user?.id].find((value) => typeof value === "string" && value.trim().length > 0);
+    if (!identity)
+      return { status: "down", message: "Vercel returned no user for this token" };
+    return { status: "ok", message: `Connected as ${identity}` };
+  } catch (err) {
+    return networkOutcome(err, String(token ?? ""));
   }
 }
 async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch) {
@@ -6007,6 +6046,8 @@ async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch) {
       return probeLinear(credentials, fetchImpl);
     case "buffer":
       return probeBuffer(credentials, fetchImpl);
+    case "vercel":
+      return probeVercel(credentials, fetchImpl);
     case "google-workspace":
       return probeBearerJson("https://www.googleapis.com/oauth2/v2/userinfo", credentials, fetchImpl, (body) => {
         const info = body;
@@ -14939,4 +14980,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-OQBHTDWK.js.map
+//# sourceMappingURL=chunk-M3ICTPSG.js.map