@integrity-labs/agt-cli 0.28.594 → 0.28.596

package/dist/{chunk-U7DHWGAZ.js → chunk-EAZQXZ4Q.js}

@@ -1,9 +1,18 @@
+import {
+  LATE_BOUND_VARS,
+  buildLiveHeaderRemoteMcpProxyEntry,
+  buildNativeMcpEntry,
+  buildOAuthRemoteMcpProxyEntry,
+  buildRemoteMcpEntry,
+  expandTemplateVars,
+  isolationMode,
+  parseEnvIntegrations
+} from "./chunk-6NVRWZ5W.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
   INTEGRATION_REGISTRY,
-  LATE_BOUND_VARS,
   MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING,
   OAUTH_PROVIDERS,
   REMOTE_MCP_PROXY_ENV,
@@ -16,23 +25,16 @@ import {
   bestConnectivityEvidence,
   buildForwardHeaders,
   buildIntegrationsSection,
-  buildLiveHeaderRemoteMcpProxyEntry,
-  buildNativeMcpEntry,
-  buildOAuthRemoteMcpProxyEntry,
-  buildRemoteMcpEntry,
   coerceEnvValue,
-  expandTemplateVars,
   generateClaudeMd,
   getFlagDefinition,
   getFramework,
   handshakeToolsListOutcome,
   isControlPlaneOnlyConfigKey,
   isDefaultRemoteMcpConnection,
-  isolationMode,
   listFlagDefinitions,
   mcpWildcardsForServers,
   normalizeFlagValue,
-  parseEnvIntegrations,
   probeComposioAccount,
   probeComposioMcpToolCall,
   probeHttpProvider,
@@ -46,7 +48,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-74UJCPIS.js";
+} from "./chunk-3PNRUCHD.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -627,9 +629,6 @@ function writeXurlStoreForIntegrations(integrations, filePath = getXurlStorePath
   return filePath;
 }
 
-// ../../packages/core/dist/crypto/secret.js
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-
 // ../../packages/core/dist/crypto/envelope.js
 import { createHash } from "crypto";
 
@@ -869,10 +868,23 @@ function parseEnvelope(encoded) {
 function contextString(ctx) {
   return `org:${ctx.orgId}:${ctx.table}:${ctx.column}:${ctx.field}:${ctx.rowId}`;
 }
+var DIRECT_COLUMN_FIELD_SENTINEL = "";
+function buildDecryptContext(coords, runtime) {
+  return {
+    orgId: runtime.orgId,
+    table: coords.table,
+    column: coords.column,
+    field: coords.field ?? DIRECT_COLUMN_FIELD_SENTINEL,
+    rowId: runtime.rowId
+  };
+}
 function buildAad(headerBytes, ctx) {
   return Buffer.concat([headerBytes, Buffer.from(contextString(ctx), "utf8")]);
 }
 
+// ../../packages/core/dist/crypto/secret.js
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+
 // ../../packages/core/dist/crypto/keyring.js
 var ACTIVE_ENV = "AUTH_ENCRYPTION_KEY";
 var PREVIOUS_ENV = "AUTH_ENCRYPTION_KEY_PREVIOUS";
@@ -982,12 +994,16 @@ var SENSITIVE_INTEGRATION_FIELDS = [
   "client_secret",
   "private_key"
 ];
-function decryptIntegrationCredentials(credentials) {
+var SENSITIVE_SET = new Set(SENSITIVE_INTEGRATION_FIELDS);
+function integrationCredentialsFieldContext(row, field) {
+  return buildDecryptContext({ table: row.table, column: "credentials", field }, { orgId: row.orgId, rowId: row.rowId });
+}
+function decryptIntegrationCredentials(credentials, row) {
   const out = { ...credentials };
   for (const field of SENSITIVE_INTEGRATION_FIELDS) {
     const value = out[field];
     if (typeof value === "string" && value && isEncrypted(value)) {
-      out[field] = decryptSecret(value);
+      out[field] = decryptSecret(value, row ? integrationCredentialsFieldContext(row, field) : void 0);
     }
   }
   return out;
@@ -5971,7 +5987,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.594" : "dev";
+var agtCliVersion = true ? "0.28.596" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7831,7 +7847,7 @@ function verdictForUnavailableMcpConfig(cause, ctx) {
 }
 
 // src/lib/connectivity-probe-context.ts
-import { join as join5 } from "path";
+import { delimiter as pathDelimiter, join as join5 } from "path";
 import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
 
 // src/lib/mcp-stdio-probe.ts
@@ -8016,7 +8032,10 @@ function runCliProbe(binary, args, opts = {}) {
         }
         const e = err;
         if (e.code === "ENOENT") {
-          resolve({ status: "down", message: `${binary} not found on PATH (not installed)` });
+          resolve({
+            status: "unverified",
+            message: `${binary} not found on PATH \u2014 the probe could not run, so this is NOT a verdict about the integration. If the agent uses a per-agent binary (e.g. the .claude/agt-bin shim), the probe's PATH must include it.`
+          });
           return;
         }
         if (e.killed || e.signal === "SIGTERM") {
@@ -8319,6 +8338,13 @@ function buildProbeEnv(projectDir) {
     }
   } catch {
   }
+  try {
+    const agentBinDir = join5(projectDir, ".claude", "agt-bin");
+    if (existsSync6(agentBinDir)) {
+      probeEnv.PATH = probeEnv.PATH ? `${agentBinDir}${pathDelimiter}${probeEnv.PATH}` : agentBinDir;
+    }
+  } catch {
+  }
   return probeEnv;
 }
 function buildConnectivityProbeDeps(projectDir, probeEnv) {
@@ -9416,4 +9442,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-U7DHWGAZ.js.map
+//# sourceMappingURL=chunk-EAZQXZ4Q.js.map