@integrity-labs/agt-cli 0.28.657 → 0.28.659

package/dist/bin/agt.js

@@ -40,10 +40,10 @@ import {
   success,
   table,
   warn
-} from "../chunk-PHIFSHBS.js";
+} from "../chunk-ACQZZIK6.js";
 import {
   readDirectChatSessionState
-} from "../chunk-OBIOE63G.js";
+} from "../chunk-LUIGOCT4.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -73,7 +73,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-XUJIPPKF.js";
+} from "../chunk-NLCHGFD5.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.657" : "dev";
+var cliVersion = true ? "0.28.659" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.657" : "dev";
+var cliVersion2 = true ? "0.28.659" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-PHIFSHBS.js → chunk-ACQZZIK6.js}

@@ -8,7 +8,7 @@ import {
   isolationMode,
   log,
   parseEnvIntegrations
-} from "./chunk-OBIOE63G.js";
+} from "./chunk-LUIGOCT4.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -55,7 +55,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-XUJIPPKF.js";
+} from "./chunk-NLCHGFD5.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -1076,13 +1076,25 @@ function mcpConfigAgentIds() {
  * process env held a stale one inherited from elsewhere, so the broker was asked
  * for an integration belonging to somebody else and answered, correctly, 404.
  *
+ * ONLY ON A 404, and the gate is the point rather than a tidy-up. The sentence
+ * below does not hedge - it asserts that the broker "answered not found" and
+ * that "your GitHub integration is probably fine". On a 500 both halves are
+ * false: the broker answered nothing, and the state of the integration is
+ * unknown. It used to be appended to EVERY credential-fetch failure, so during
+ * the broker outage of 2026-08-20 any agent whose process env id disagreed with
+ * its .mcp.json would have been told, in confident prose, to go and fix its
+ * provisioner while the actual fault was an outage it had no part in. A
+ * diagnostic that is right about a 404 and wrong about a 500 is worse than no
+ * diagnostic, because it is believed.
+ *
  * DIAGNOSTIC ONLY. It deliberately does NOT fall back to the .mcp.json value.
  * The broker authorises with the HOST key, which covers every agent on the host,
  * so honouring an agent-writable file as the identity would let any agent mint
  * another agent's GitHub token. The process env stays the only accepted source;
  * a mismatch is something an operator fixes at the provisioner.
  */
-function identityMismatchHint() {
+function identityMismatchHint(status) {
+  if (status !== 404) return '';
   const ids = mcpConfigAgentIds();
   if (ids.length === 0 || ids.indexOf(AGT_AGENT_ID) !== -1) return '';
   return (
@@ -1135,7 +1147,14 @@ async function postJson(url, body, headers) {
       const parsed = JSON.parse(text);
       if (parsed && parsed.error) detail = String(parsed.error);
     } catch { /* keep the raw body */ }
-    throw new Error(url + ' returned HTTP ' + res.status + (detail ? ': ' + detail : ''));
+    // The STATUS travels with the error, not just inside its prose. A caller
+    // that needs to branch on it (identityMismatchHint does) would otherwise
+    // have to regex its own message back apart, and a diagnostic built on
+    // string-matching an error it also formats is one wording change from
+    // silently never firing again.
+    const httpError = new Error(url + ' returned HTTP ' + res.status + (detail ? ': ' + detail : ''));
+    httpError.status = res.status;
+    throw httpError;
   }
   try {
     return JSON.parse(text);
@@ -1166,7 +1185,7 @@ async function resolveToken() {
       { Authorization: 'Bearer ' + jwt },
     );
   } catch (err) {
-    fail('broker credential fetch failed - ' + err.message + identityMismatchHint());
+    fail('broker credential fetch failed - ' + err.message + identityMismatchHint(err && err.status));
   }
   const token = credential && credential.access_token;
   if (typeof token !== 'string' || token === '') {
@@ -6073,7 +6092,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.657" : "dev";
+var agtCliVersion = true ? "0.28.659" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9815,4 +9834,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-PHIFSHBS.js.map
+//# sourceMappingURL=chunk-ACQZZIK6.js.map