@integrity-labs/agt-cli 0.28.706 → 0.28.707

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-XS5RWL77.js";
+} from "../chunk-5U45RQEM.js";
 import {
   readDirectChatSessionState
 } from "../chunk-326G325O.js";
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.706" : "dev";
+var cliVersion = true ? "0.28.707" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.706" : "dev";
+var cliVersion2 = true ? "0.28.707" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-XS5RWL77.js → chunk-5U45RQEM.js}

@@ -6396,7 +6396,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.706" : "dev";
+var agtCliVersion = true ? "0.28.707" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10137,4 +10137,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-XS5RWL77.js.map
+//# sourceMappingURL=chunk-5U45RQEM.js.map

package/dist/lib/manager-worker.js

@@ -54,7 +54,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-XS5RWL77.js";
+} from "../chunk-5U45RQEM.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -12705,7 +12705,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.706" : "dev";
+var agtCliVersion = true ? "0.28.707" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13872,6 +13872,7 @@ var channelWriteFailureCounts = /* @__PURE__ */ new Map();
 var CHANNEL_WRITE_FAILURE_ESCALATE_EVERY = 90;
 var channelSyncFailures = /* @__PURE__ */ new Map();
 var channelSyncAttemptedSets = /* @__PURE__ */ new Map();
+var channelCredentialVerdicts = /* @__PURE__ */ new Map();
 function sameChannelSet(a, b) {
   if (a === void 0) return false;
   if (a.size !== b.size) return false;
@@ -13881,6 +13882,7 @@ function sameChannelSet(a, b) {
 function forgetChannelSyncState(agentId) {
   channelSyncFailures.delete(agentId);
   channelSyncAttemptedSets.delete(agentId);
+  channelCredentialVerdicts.delete(agentId);
 }
 var CHANNEL_SYNC_FREE_ATTEMPTS = 3;
 var CHANNEL_SYNC_MAX_BACKOFF_MS = 5 * 6e4;
@@ -13924,6 +13926,26 @@ function stuckChannelSyncs(failures, now, thresholdMs = CHANNEL_SYNC_STUCK_AFTER
   out.sort((a, b) => b.stuck_for_seconds - a.stuck_for_seconds);
   return out;
 }
+function verifiedChannelCredentials(verdicts) {
+  const out = [];
+  for (const [agentId, channels] of verdicts) {
+    for (const [channelId, verdict] of channels) {
+      out.push({
+        agent_id: agentId,
+        channel_id: channelId,
+        verified: verdict.verified,
+        // Omitted rather than sent as null when converged: a reason only means
+        // anything alongside a failure, and a stale one travelling with
+        // `verified: true` reads as a warning about a healthy channel.
+        ...verdict.verified || !verdict.reason ? {} : { reason: verdict.reason }
+      });
+    }
+  }
+  out.sort(
+    (a, b) => a.agent_id === b.agent_id ? a.channel_id.localeCompare(b.channel_id) : a.agent_id.localeCompare(b.agent_id)
+  );
+  return out;
+}
 var persistedDeliveryBaseline = createDeliveryBaselineMaps();
 function loadSenderPolicyBaseline2() {
   loadSenderPolicyBaseline(persistedDeliveryBaseline, channelHashCacheDir(), log);
@@ -14415,6 +14437,23 @@ async function pollCycleInner() {
         // close a resolved alert on the edge. Omitting it when empty would make
         // "recovered" and "this CLI is too old to report" the same wire value.
         channel_sync_stuck: stuckChannelSyncs(channelSyncFailures, Date.now()),
+        // ENG-9517: the POSITIVE direction of the field above — the current
+        // per-channel on-disk credential verdict. Without it the control plane
+        // could only ever learn that a channel was broken, and only after ten
+        // minutes; it had no way to learn that one was working, so "installed"
+        // and "never reached the host" were the same row.
+        //
+        // SAME absent-vs-empty contract as its neighbours, and it matters more
+        // here because this field drives a UI completion state: an older CLI
+        // omits it and the consumer must change nothing, while `[]` is an
+        // affirmative "this manager checked and has no channels to report".
+        // Collapsing the two would let a stale CLI read as an all-clear.
+        //
+        // Note this is NOT the complement of `channel_sync_stuck`. A channel
+        // can be absent from both — not yet attempted, deferred by the backoff,
+        // or on an adapter that cannot probe — and that third state has to stay
+        // distinguishable from success.
+        channel_credential_status: verifiedChannelCredentials(channelCredentialVerdicts),
         // ENG-9265: agents whose realtime token-rotation subscription has been
         // failing to bind for longer than the stuck threshold. Same contract as
         // the field above — ALWAYS sent, including as an empty array, because
@@ -16042,6 +16081,29 @@ async function processAgent(agent, agentStates, managedToolkits) {
     }
   }
   const channelConfigConvergedThisTick = channelConfigConverged && !channelSyncDeferred;
+  if (agent.status === "active" && !channelSyncDeferred && frameworkAdapter.hasChannelCredentials) {
+    const verdicts = /* @__PURE__ */ new Map();
+    for (const channelId of currentChannelIds) {
+      if (quarantinedChannels.has(channelId)) continue;
+      let onDisk = false;
+      try {
+        onDisk = frameworkAdapter.hasChannelCredentials(agent.code_name, channelId);
+      } catch (err) {
+        onDisk = false;
+        log(
+          `[channels] credential verification threw for '${agent.code_name}/${channelId}': ${err.message} \u2014 reporting as unverified (ENG-9517)`
+        );
+      }
+      verdicts.set(channelId, {
+        verified: onDisk,
+        ...onDisk ? {} : { reason: channelConfigFailureReason || "credential not present on disk" }
+      });
+    }
+    if (verdicts.size > 0) channelCredentialVerdicts.set(agent.agent_id, verdicts);
+    else channelCredentialVerdicts.delete(agent.agent_id);
+  } else {
+    channelCredentialVerdicts.delete(agent.agent_id);
+  }
   const restartDecision = channelConfigConvergedThisTick ? decideChannelRestart({
     previousChannelIds,
     currentChannelIds,
@@ -20446,6 +20508,7 @@ export {
   stopManager,
   stuckChannelSyncs,
   stuckRealtimeRebinds,
-  supersededRuntimeImageIds
+  supersededRuntimeImageIds,
+  verifiedChannelCredentials
 };
 //# sourceMappingURL=manager-worker.js.map