@integrity-labs/agt-cli 0.28.511 → 0.28.513

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-I3DZ3LI5.js";
+} from "../chunk-PZ3RIMNA.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-OQBHTDWK.js";
+} from "../chunk-MDEA3PIS.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.511" : "dev";
+var cliVersion = true ? "0.28.513" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.511" : "dev";
+var cliVersion2 = true ? "0.28.513" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-OQBHTDWK.js → chunk-MDEA3PIS.js}

@@ -826,6 +826,11 @@ var integration_metadata_v1_default = {
       pattern: "^https://",
       description: "Absolute HTTPS URL the broker uses as the vendor API root. Required when any tool descriptor relies on http_templater (i.e. whenever `tools[]` is non-empty)."
     },
+    auth_scheme: {
+      type: "string",
+      pattern: "^[A-Za-z0-9!#$%&'*+.^_`|~-]+$",
+      description: "Authorization scheme word placed before the credential, e.g. `Key` for Higgsfield's `Authorization: Key KEY_ID:KEY_SECRET` (ENG-8440). Omit for the `Bearer` default. Constrained to a single RFC 7230 token because it is concatenated straight into a header value."
+    },
     runtime_scopes: {
       type: "object",
       description: "Per-runtime-scope support map. Each slot is either null (the integration does not support installs at this scope) or an object describing how token resolution and auth work for that scope.",
@@ -5231,7 +5236,18 @@ var HTTP_PROBE_PROVIDERS = /* @__PURE__ */ new Set([
   // so its honest health signal is the same: a central read-only check that the
   // stored token still authenticates. Routes to the OIDC userinfo probe in
   // connectivity-http-probes.ts.
-  "linkedin-ads"
+  "linkedin-ads",
+  // ENG-8422: Vercel is `source_type: 'native'`, so without this entry it falls
+  // through to the `builtin` branch below — a hardcoded `unverified` verdict
+  // having contacted nothing. `unverified` is neutral to hysteresis, so such an
+  // integration can never report itself broken however bad its credential is.
+  // That was tolerable while Vercel's auth was browser-OAuth brokered by Claude
+  // Code (no server-held credential to check); ENG-8421 made it a
+  // customer-supplied API token, at which point a revoked or mistyped token
+  // became both the likeliest failure AND an invisible one. This entry is what
+  // routes it to the real `api.vercel.com/v2/user` probe — `probeVercel` is
+  // unreachable without it.
+  "vercel"
   // ENG-6100: GitHub is deliberately NOT here. This set drives the ASYNC
   // connectivity monitor's routing, where github (source_type='native')
   // stays host-side (cli_command — `gh`, the credential the agent actually
@@ -5931,12 +5947,15 @@ function statusForHttp(httpStatus) {
     return "transient_error";
   return "down";
 }
-function networkOutcome(err) {
+function redactSecret(message, secret) {
+  if (typeof secret !== "string" || secret.length < 4)
+    return message;
+  return message.split(secret).join("[redacted]");
+}
+function networkOutcome(err, secret) {
   const isAbort = err?.name === "AbortError";
-  return {
-    status: "transient_error",
-    message: isAbort ? `Connection timed out after ${PROBE_TIMEOUT_MS2 / 1e3}s` : `Connection failed: ${err.message}`
-  };
+  const message = isAbort ? `Connection timed out after ${PROBE_TIMEOUT_MS2 / 1e3}s` : `Connection failed: ${err.message}`;
+  return { status: "transient_error", message: redactSecret(message, secret) };
 }
 async function probeLinear(creds, fetchImpl) {
   const key = creds.api_key ?? creds.access_token;
@@ -5958,7 +5977,7 @@ async function probeLinear(creds, fetchImpl) {
       return { status: "down", message: "Invalid key \u2014 no viewer returned" };
     return { status: "ok", message: `Connected as ${viewer.name ?? viewer.email ?? "unknown"}` };
   } catch (err) {
-    return networkOutcome(err);
+    return networkOutcome(err, String(key ?? ""));
   }
 }
 async function probeBearerJson(url, creds, fetchImpl, interpret, extraHeaders) {
@@ -5973,7 +5992,7 @@ async function probeBearerJson(url, creds, fetchImpl, interpret, extraHeaders) {
     }
     return interpret(await res.json());
   } catch (err) {
-    return networkOutcome(err);
+    return networkOutcome(err, String(token ?? ""));
   }
 }
 async function probeBuffer(creds, fetchImpl) {
@@ -5998,7 +6017,32 @@ async function probeBuffer(creds, fetchImpl) {
       return { status: "down", message: "No Buffer organizations on this account" };
     return { status: "ok", message: `Connected to ${orgs[0]?.name ?? "Buffer"}` };
   } catch (err) {
-    return networkOutcome(err);
+    return networkOutcome(err, String(key ?? ""));
+  }
+}
+async function probeVercel(creds, fetchImpl) {
+  const token = creds.api_key ?? creds.access_token;
+  if (!token)
+    return { status: "down", message: "No Vercel credential present" };
+  try {
+    const res = await timedFetch2(fetchImpl, "https://api.vercel.com/v2/user", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) {
+      if (res.status === 429) {
+        return { status: "transient_error", message: "Vercel rate limit (429) \u2014 not a credential failure" };
+      }
+      const message = res.status === 401 || res.status === 403 ? `Vercel rejected the token (${res.status}) \u2014 invalid or revoked API token` : `Vercel API returned ${res.status}`;
+      return { status: statusForHttp(res.status), message };
+    }
+    const body = await res.json();
+    const user = body?.user;
+    const identity = [user?.username, user?.email, user?.name, user?.id].find((value) => typeof value === "string" && value.trim().length > 0);
+    if (!identity)
+      return { status: "down", message: "Vercel returned no user for this token" };
+    return { status: "ok", message: `Connected as ${identity}` };
+  } catch (err) {
+    return networkOutcome(err, String(token ?? ""));
   }
 }
 async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch) {
@@ -6007,6 +6051,8 @@ async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch) {
       return probeLinear(credentials, fetchImpl);
     case "buffer":
       return probeBuffer(credentials, fetchImpl);
+    case "vercel":
+      return probeVercel(credentials, fetchImpl);
     case "google-workspace":
       return probeBearerJson("https://www.googleapis.com/oauth2/v2/userinfo", credentials, fetchImpl, (body) => {
         const info = body;
@@ -6677,16 +6723,43 @@ var INTEGRATION_REGISTRY = [
     id: "higgsfield",
     name: "Higgsfield",
     category: "media",
-    description: "Generative media \u2014 image (Soul, Nano Banana) and video (Kling, Veo, Seedance) generation, character training (Soul ID), and generation history. Remote streamable-HTTP MCP at https://mcp.higgsfield.ai/mcp.",
-    // Same OAuth pattern as Granola: Claude Code brokers the browser
-    // sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Generative media \u2014 Soul text-to-image with style presets and trained-character consistency, DoP image-to-video with motion presets, and lip-synced talking video. Uses Higgsfield's REST API with your own API key.",
+    // ENG-8440: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Higgsfield MCP (`https://mcp.higgsfield.ai/mcp`) cannot be completed from
+    // the console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Its `oauth-protected-resource` metadata offers two flows and
+    // names the clients each is for: the redirect flow lists
+    // ["anthropic","claude","claude-ai","claude-code"] and the device-code flow
+    // lists ["openclaw","hermes","memoclaw"]. Our console appears in neither,
+    // and the device authorization server
+    // (`fnf-device-auth.higgsfield.ai/.well-known/oauth-authorization-server`)
+    // still returns 404, so there is no discovery document to probe either.
+    // The only client Higgsfield permits is Claude Code on the agent's own
+    // host, driven by an operator in tmux — no console work removes that step.
+    //
+    // The REST API (`platform.higgsfield.ai`) has none of those constraints: a
+    // static key pair the customer creates in their own Higgsfield account,
+    // sent as `Authorization: Key KEY_ID:KEY_SECRET`. That makes this an
+    // ordinary paste-a-key integration, and it means WE hold the credential —
+    // storable, rotatable, revocable and auditable, none of which was true
+    // under the MCP.
+    //
+    // Bring-your-own-key: generations bill to the customer's own Higgsfield
+    // account, so an install is never metered by Augmented Team.
+    //
+    // NOTE: this entry carries no `remoteMcp`, so it contributes nothing to
+    // `registryRemoteMcpKeys` and cannot prune the `higgsfield` key an older
+    // host already wrote to `.mcp.json`. That pruning is why `'higgsfield'` is
+    // a literal in `integrationDerivedKeys` in the claudecode adapter — do not
+    // drop it while any host may still be carrying the retired MCP entry.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create images via Soul, Nano Banana, and other image models \u2014 up to 4K. Includes Soul ID character consistency.", access: "write" },
-      { id: "higgsfield:generate-video", name: "Generate Video", description: "Create videos via Kling, Veo, Seedance \u2014 up to 15s. Includes UGC, product review, TV spot presets.", access: "write" },
-      { id: "higgsfield:read-history", name: "Read History", description: "Browse generation history for iterative workflows; reuse prior outputs as references.", access: "read" }
+      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create stills with Soul \u2014 style presets, plus trained-character consistency for a repeated face or product.", access: "write" },
+      { id: "higgsfield:generate-video", name: "Generate Video", description: "Animate a still into a short clip with DoP motion presets, or lip-sync a talking video from an image plus audio.", access: "write" },
+      { id: "higgsfield:read-jobs", name: "Poll Jobs & Presets", description: "Poll asynchronous generations to completion, and list the style and motion presets the generate tools accept.", access: "read" }
     ],
-    docs_url: "https://higgsfield.ai/mcp",
+    docs_url: "https://docs.higgsfield.ai/",
     beta: true
   },
   {
@@ -11083,9 +11156,6 @@ function buildRemoteMcpEntry(definitionId, dbSpec, connectionKey) {
     }
   };
 }
-function buildHostBrokeredRemoteMcpEntry(url) {
-  return { type: "http", url };
-}
 function extractHeaderVarName(value) {
   const m = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(value.trim());
   return m ? m[1] : null;
@@ -14780,7 +14850,6 @@ export {
   remoteMcpEnvPrefix,
   remoteMcpConnectionScopedEnvVar,
   buildRemoteMcpEntry,
-  buildHostBrokeredRemoteMcpEntry,
   buildLiveHeaderRemoteMcpProxyEntry,
   buildOAuthRemoteMcpProxyEntry,
   buildNativeMcpEntry,
@@ -14939,4 +15008,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-OQBHTDWK.js.map
+//# sourceMappingURL=chunk-MDEA3PIS.js.map