@integrity-labs/agt-cli 0.28.579 → 0.28.580

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-Y3ILQRLM.js";
+} from "../chunk-YU2B3L6G.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4853,7 +4853,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.579" : "dev";
+var cliVersion = true ? "0.28.580" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6031,7 +6031,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.579" : "dev";
+var cliVersion2 = true ? "0.28.580" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-Y3ILQRLM.js → chunk-YU2B3L6G.js}

@@ -5971,7 +5971,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.579" : "dev";
+var agtCliVersion = true ? "0.28.580" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9347,4 +9347,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-Y3ILQRLM.js.map
+//# sourceMappingURL=chunk-YU2B3L6G.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-Y3ILQRLM.js";
+} from "../chunk-YU2B3L6G.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -122,6 +122,7 @@ import {
   isAgentTimezoneOverrideExpired,
   isBareAck,
   isBucketQualified,
+  isControlPlaneOnlyConfigKey,
   isControlPlaneOnlyEnvVar,
   isConversationFailureCategory,
   isEmptyTotals,
@@ -332,9 +333,18 @@ function canonicalize(value) {
   }
   return value;
 }
+function hashableConfig(config2) {
+  if (!config2) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(config2)) {
+    if (isControlPlaneOnlyConfigKey(key)) continue;
+    out[key] = value;
+  }
+  return out;
+}
 function computeIntegrationsHash(integrations) {
   const payload = integrations.map(
-    (i) => `${i.definition_id}:${JSON.stringify(canonicalize(i.credentials ?? {}))}:${JSON.stringify(canonicalize(i.config ?? {}))}`
+    (i) => `${i.definition_id}:${JSON.stringify(canonicalize(i.credentials ?? {}))}:${JSON.stringify(canonicalize(hashableConfig(i.config)))}`
   ).sort();
   return createHash2("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
 }
@@ -347,6 +357,16 @@ function computeCapabilitySurfaceHash(integrations) {
 }
 
 // src/lib/host-integration-mapping.ts
+var RECOGNISED_CREDENTIAL_DELIVERY = /* @__PURE__ */ new Set(["env", "broker"]);
+var MAX_SHOWN_VALUE_CHARS = 120;
+function describeUnrecognisedCredentialDelivery(value) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value === "string" && RECOGNISED_CREDENTIAL_DELIVERY.has(value)) return null;
+  const shown = typeof value === "string" ? JSON.stringify(
+    value.length > MAX_SHOWN_VALUE_CHARS ? `${value.slice(0, MAX_SHOWN_VALUE_CHARS)}\u2026` : value
+  ) : `<${typeof value}>`;
+  return `unrecognised credential_delivery ${shown} \u2014 treating as env delivery. If this row is a github_app under the github-broker-credentials flag, the API has stripped its token AND the broker helper will be removed, leaving the agent with no GitHub credential at all (ENG-8800 AC5)`;
+}
 function withResolvedRemoteMcp(integration) {
   return {
     ...integration,
@@ -356,9 +376,17 @@ function withResolvedRemoteMcp(integration) {
     // row into use-time credential delivery — anything else (including a value
     // a newer API might add later) reads as today's env delivery, so an
     // unrecognised value can never strip an agent's `git`/`gh` credentials.
-    credentialDelivery: integration.credential_delivery === "broker" ? "broker" : void 0
+    credentialDelivery: normalizeCredentialDelivery(integration.credential_delivery)
   };
 }
+function normalizeCredentialDelivery(value) {
+  const anomaly = describeUnrecognisedCredentialDelivery(value);
+  if (anomaly) {
+    process.stderr.write(`[host-integrations] [credential-delivery] ${anomaly}
+`);
+  }
+  return value === "broker" ? "broker" : void 0;
+}
 
 // src/lib/anchor-session-lifecycle.ts
 var DEFAULT_ANCHOR_SESSION_MAX_DURATION_MINUTES = 60;
@@ -11596,7 +11624,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.579" : "dev";
+var agtCliVersion = true ? "0.28.580" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();