@integrity-labs/agt-cli 0.28.541 → 0.28.542

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-JQNSKZIC.js";
+} from "../chunk-GVYAIEFA.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4834,7 +4834,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.541" : "dev";
+var cliVersion = true ? "0.28.542" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6006,7 +6006,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.541" : "dev";
+var cliVersion2 = true ? "0.28.542" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-JQNSKZIC.js → chunk-GVYAIEFA.js}

@@ -5549,7 +5549,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.541" : "dev";
+var agtCliVersion = true ? "0.28.542" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8861,4 +8861,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-JQNSKZIC.js.map
+//# sourceMappingURL=chunk-GVYAIEFA.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-JQNSKZIC.js";
+} from "../chunk-GVYAIEFA.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -4557,6 +4557,14 @@ function foldRuntimeAuthVerdict(input) {
 function heartbeatRuntimeAuthReport(probeVerdict) {
   return probeVerdict ?? void 0;
 }
+function heartbeatRuntimeAuthFields(probeVerdict) {
+  const reported = heartbeatRuntimeAuthReport(probeVerdict);
+  if (reported === void 0) return {};
+  return {
+    agent_runtime_authenticated: reported,
+    agent_runtime_auth_observed: true
+  };
+}
 
 // src/lib/manager/kanban/parsers.ts
 import { existsSync as existsSync8, readFileSync as readFileSync15 } from "fs";
@@ -10429,7 +10437,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.541" : "dev";
+var agtCliVersion = true ? "0.28.542" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11890,8 +11898,11 @@ async function pollCycle() {
         // ENG-8623: the probe's verdict, or the field is OMITTED. The column is
         // named for a runtime observation and the API now stamps a freshness
         // timestamp beside it, so a file-derived value here would manufacture an
-        // observation nobody made. See `heartbeatRuntimeAuthReport`.
-        agent_runtime_authenticated: heartbeatRuntimeAuthReport(runtimeAuthProbeVerdict),
+        // observation nobody made. Spread as ONE unit: the boolean and its
+        // provenance marker must never diverge, so they are produced together
+        // rather than as two fields a future edit could separate. See
+        // `heartbeatRuntimeAuthFields`.
+        ...heartbeatRuntimeAuthFields(runtimeAuthProbeVerdict),
         agent_diagnostics: agentDiagnostics,
         hostname: tailscaleHostname,
         os_username: osUsername,