@integrity-labs/agt-cli 0.28.591 → 0.28.593

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-KR4AZ4EF.js";
+} from "../chunk-BYCE4V7Q.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-QDJEEGZB.js";
+} from "../chunk-TKWDYMM3.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4908,7 +4908,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.591" : "dev";
+var cliVersion = true ? "0.28.593" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6088,7 +6088,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.591" : "dev";
+var cliVersion2 = true ? "0.28.593" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-KR4AZ4EF.js → chunk-BYCE4V7Q.js}

@@ -46,7 +46,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-QDJEEGZB.js";
+} from "./chunk-TKWDYMM3.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5971,7 +5971,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.591" : "dev";
+var agtCliVersion = true ? "0.28.593" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7952,6 +7952,52 @@ async function probeMcpStdio(config) {
 // src/lib/cli-probe.ts
 import { execFile as execFile2 } from "child_process";
 var DEFAULT_TIMEOUT_MS2 = 8e3;
+var STATUS_CTX = String.raw`(?:\bhttps?\/?\s*(?:1\.[01]\s+)?|\bstatus(?:\s*code)?\s*[:=]?\s*|\bcode\s*[:=]?\s*|\breturned\s+(?:http\s*)?)`;
+var TRANSIENT_SIGNATURES = [
+  // Vendor rate limiting. RFC 6585 for 429; GitHub's secondary limits and
+  // Google's quota wording do not use the number at all.
+  {
+    re: new RegExp(`${STATUS_CTX}429\\b|too many requests|rate limit|secondary rate|quota exceeded|abuse detection`, "i"),
+    reason: "rate limited by the provider"
+  },
+  // Vendor-side server errors. Anchored on the phrase or on an explicit
+  // HTTP-status context so a bare 3-digit number cannot match.
+  {
+    re: new RegExp(`${STATUS_CTX}(?:502|503|504)\\b|bad gateway|service unavailable|gateway time-?out|internal server error|server error \\(5\\d\\d\\)`, "i"),
+    reason: "provider returned a server error"
+  },
+  // Transport. The provider may be fine and simply unreachable from here.
+  {
+    re: /ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|EHOSTUNREACH|ENETUNREACH|connection refused|connection reset|network is unreachable|temporary failure in name resolution|tls handshake|dial tcp/i,
+    reason: "network failure reaching the provider"
+  },
+  // OUR failure, not the credential's. ENG-8344 fetches the token per use
+  // through the platform, so an identity-tier outage surfaces here as a
+  // non-zero exit from a CLI whose credential never became available. Grading
+  // that `down` blames the customer's token for our own outage — it is the
+  // exact case that would have paged the fleet on 2026-08-14.
+  {
+    re: /credential fetch failed|key exchange failed|host\/exchange|upstream connect error|could not read Username/i,
+    reason: "our credential broker could not supply a token"
+  }
+];
+function transientReasonFor(text) {
+  for (const { re, reason } of TRANSIENT_SIGNATURES) {
+    if (re.test(text)) return reason;
+  }
+  return null;
+}
+var CREDENTIAL_SHAPED = /\b(gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|sk-[A-Za-z0-9]{20,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}|AKIA[0-9A-Z]{16})\b/g;
+var MAX_MESSAGE_CHARS = 200;
+function redactAndBound(line) {
+  const redacted = line.replace(CREDENTIAL_SHAPED, "<redacted>");
+  return redacted.length > MAX_MESSAGE_CHARS ? `${redacted.slice(0, MAX_MESSAGE_CHARS - 1)}\u2026` : redacted;
+}
+function firstMeaningfulLine(stderr, stdout, fallback) {
+  const firstLineOf = (v) => String(v ?? "").split(/\r?\n/).map((l) => l.trim()).find((l) => l.length > 0);
+  const line = firstLineOf(stderr) ?? firstLineOf(stdout) ?? firstLineOf(fallback) ?? "";
+  return redactAndBound(line);
+}
 function runCliProbe(binary, args, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
   return new Promise((resolve) => {
@@ -7959,10 +8005,13 @@ function runCliProbe(binary, args, opts = {}) {
       binary,
       args,
       { timeout: timeoutMs, env: opts.env ?? process.env, windowsHide: true },
-      (err, stdout) => {
+      (err, stdout, stderr) => {
         if (!err) {
           const firstLine = String(stdout).split(/\r?\n/, 1)[0]?.trim();
-          resolve({ status: "ok", message: firstLine ? `${binary}: ${firstLine}` : `${binary}: ok` });
+          resolve({
+            status: "ok",
+            message: firstLine ? `${binary}: ${redactAndBound(firstLine)}` : `${binary}: ok`
+          });
           return;
         }
         const e = err;
@@ -7974,7 +8023,21 @@ function runCliProbe(binary, args, opts = {}) {
           resolve({ status: "transient_error", message: `${binary} probe timed out after ${timeoutMs / 1e3}s` });
           return;
         }
-        resolve({ status: "down", message: `${binary} exited non-zero: ${e.message}` });
+        const diagnostic = `${stderr ?? ""}
+${stdout ?? ""}
+${e.message}`;
+        const transient = transientReasonFor(diagnostic);
+        if (transient) {
+          resolve({
+            status: "transient_error",
+            message: `${binary} probe inconclusive \u2014 ${transient}: ${firstMeaningfulLine(stderr, stdout, e.message)}`
+          });
+          return;
+        }
+        resolve({
+          status: "down",
+          message: `${binary} exited non-zero: ${firstMeaningfulLine(stderr, stdout, e.message)}`
+        });
       }
     );
   });
@@ -9353,4 +9416,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-KR4AZ4EF.js.map
+//# sourceMappingURL=chunk-BYCE4V7Q.js.map