@integrity-labs/agt-cli 0.28.706 → 0.28.708

package/dist/bin/agt.js

@@ -40,10 +40,10 @@ import {
   success,
   table,
   warn
-} from "../chunk-XS5RWL77.js";
+} from "../chunk-7ZW4P5EU.js";
 import {
   readDirectChatSessionState
-} from "../chunk-326G325O.js";
+} from "../chunk-VYG4CTEQ.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -73,7 +73,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-QRGNDW6C.js";
+} from "../chunk-NOGQSRQM.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.706" : "dev";
+var cliVersion = true ? "0.28.708" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.706" : "dev";
+var cliVersion2 = true ? "0.28.708" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-XS5RWL77.js → chunk-7ZW4P5EU.js}

@@ -12,7 +12,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-326G325O.js";
+} from "./chunk-VYG4CTEQ.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -59,7 +59,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-QRGNDW6C.js";
+} from "./chunk-NOGQSRQM.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6396,7 +6396,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.706" : "dev";
+var agtCliVersion = true ? "0.28.708" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10137,4 +10137,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-XS5RWL77.js.map
+//# sourceMappingURL=chunk-7ZW4P5EU.js.map

package/dist/{chunk-QRGNDW6C.js → chunk-NOGQSRQM.js}

@@ -12811,4 +12811,4 @@ export {
   minutesSinceLocalMidnight,
   peekCurrentSession
 };
-//# sourceMappingURL=chunk-QRGNDW6C.js.map
+//# sourceMappingURL=chunk-NOGQSRQM.js.map

package/dist/{chunk-326G325O.js → chunk-VYG4CTEQ.js}

@@ -17,7 +17,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-QRGNDW6C.js";
+} from "./chunk-NOGQSRQM.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -4540,4 +4540,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-326G325O.js.map
+//# sourceMappingURL=chunk-VYG4CTEQ.js.map

package/dist/{claude-pair-runtime-HPYSFXPP.js → claude-pair-runtime-CNS5OLQE.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-TPP35O6H.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-GIRGRUMF.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-HPYSFXPP.js.map
+//# sourceMappingURL=claude-pair-runtime-CNS5OLQE.js.map

package/dist/lib/manager-worker.js

@@ -54,7 +54,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-XS5RWL77.js";
+} from "../chunk-7ZW4P5EU.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -112,7 +112,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-326G325O.js";
+} from "../chunk-VYG4CTEQ.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -197,7 +197,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-QRGNDW6C.js";
+} from "../chunk-NOGQSRQM.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -12057,7 +12057,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-3HITHSYU.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-PIRS3LTX.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname10(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -12705,7 +12705,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.706" : "dev";
+var agtCliVersion = true ? "0.28.708" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13872,6 +13872,7 @@ var channelWriteFailureCounts = /* @__PURE__ */ new Map();
 var CHANNEL_WRITE_FAILURE_ESCALATE_EVERY = 90;
 var channelSyncFailures = /* @__PURE__ */ new Map();
 var channelSyncAttemptedSets = /* @__PURE__ */ new Map();
+var channelCredentialVerdicts = /* @__PURE__ */ new Map();
 function sameChannelSet(a, b) {
   if (a === void 0) return false;
   if (a.size !== b.size) return false;
@@ -13881,6 +13882,7 @@ function sameChannelSet(a, b) {
 function forgetChannelSyncState(agentId) {
   channelSyncFailures.delete(agentId);
   channelSyncAttemptedSets.delete(agentId);
+  channelCredentialVerdicts.delete(agentId);
 }
 var CHANNEL_SYNC_FREE_ATTEMPTS = 3;
 var CHANNEL_SYNC_MAX_BACKOFF_MS = 5 * 6e4;
@@ -13924,6 +13926,26 @@ function stuckChannelSyncs(failures, now, thresholdMs = CHANNEL_SYNC_STUCK_AFTER
   out.sort((a, b) => b.stuck_for_seconds - a.stuck_for_seconds);
   return out;
 }
+function verifiedChannelCredentials(verdicts) {
+  const out = [];
+  for (const [agentId, channels] of verdicts) {
+    for (const [channelId, verdict] of channels) {
+      out.push({
+        agent_id: agentId,
+        channel_id: channelId,
+        verified: verdict.verified,
+        // Omitted rather than sent as null when converged: a reason only means
+        // anything alongside a failure, and a stale one travelling with
+        // `verified: true` reads as a warning about a healthy channel.
+        ...verdict.verified || !verdict.reason ? {} : { reason: verdict.reason }
+      });
+    }
+  }
+  out.sort(
+    (a, b) => a.agent_id === b.agent_id ? a.channel_id.localeCompare(b.channel_id) : a.agent_id.localeCompare(b.agent_id)
+  );
+  return out;
+}
 var persistedDeliveryBaseline = createDeliveryBaselineMaps();
 function loadSenderPolicyBaseline2() {
   loadSenderPolicyBaseline(persistedDeliveryBaseline, channelHashCacheDir(), log);
@@ -14210,7 +14232,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-TPP35O6H.js");
+      const { collectDiagnostics } = await import("../persistent-session-GIRGRUMF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -14328,7 +14350,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-TPP35O6H.js");
+      const { collectDiagnostics } = await import("../persistent-session-GIRGRUMF.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -14415,6 +14437,23 @@ async function pollCycleInner() {
         // close a resolved alert on the edge. Omitting it when empty would make
         // "recovered" and "this CLI is too old to report" the same wire value.
         channel_sync_stuck: stuckChannelSyncs(channelSyncFailures, Date.now()),
+        // ENG-9517: the POSITIVE direction of the field above — the current
+        // per-channel on-disk credential verdict. Without it the control plane
+        // could only ever learn that a channel was broken, and only after ten
+        // minutes; it had no way to learn that one was working, so "installed"
+        // and "never reached the host" were the same row.
+        //
+        // SAME absent-vs-empty contract as its neighbours, and it matters more
+        // here because this field drives a UI completion state: an older CLI
+        // omits it and the consumer must change nothing, while `[]` is an
+        // affirmative "this manager checked and has no channels to report".
+        // Collapsing the two would let a stale CLI read as an all-clear.
+        //
+        // Note this is NOT the complement of `channel_sync_stuck`. A channel
+        // can be absent from both — not yet attempted, deferred by the backoff,
+        // or on an adapter that cannot probe — and that third state has to stay
+        // distinguishable from success.
+        channel_credential_status: verifiedChannelCredentials(channelCredentialVerdicts),
         // ENG-9265: agents whose realtime token-rotation subscription has been
         // failing to bind for longer than the stuck threshold. Same contract as
         // the field above — ALWAYS sent, including as an empty array, because
@@ -14480,7 +14519,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-3HITHSYU.js");
+      } = await import("../responsiveness-probe-PIRS3LTX.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -14590,7 +14629,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-3HITHSYU.js");
+        } = await import("../responsiveness-probe-PIRS3LTX.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14746,7 +14785,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-LY5264IN.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-PYWTMI43.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -16042,6 +16081,29 @@ async function processAgent(agent, agentStates, managedToolkits) {
     }
   }
   const channelConfigConvergedThisTick = channelConfigConverged && !channelSyncDeferred;
+  if (agent.status === "active" && !channelSyncDeferred && frameworkAdapter.hasChannelCredentials) {
+    const verdicts = /* @__PURE__ */ new Map();
+    for (const channelId of currentChannelIds) {
+      if (quarantinedChannels.has(channelId)) continue;
+      let onDisk = false;
+      try {
+        onDisk = frameworkAdapter.hasChannelCredentials(agent.code_name, channelId);
+      } catch (err) {
+        onDisk = false;
+        log(
+          `[channels] credential verification threw for '${agent.code_name}/${channelId}': ${err.message} \u2014 reporting as unverified (ENG-9517)`
+        );
+      }
+      verdicts.set(channelId, {
+        verified: onDisk,
+        ...onDisk ? {} : { reason: channelConfigFailureReason || "credential not present on disk" }
+      });
+    }
+    if (verdicts.size > 0) channelCredentialVerdicts.set(agent.agent_id, verdicts);
+    else channelCredentialVerdicts.delete(agent.agent_id);
+  } else {
+    channelCredentialVerdicts.delete(agent.agent_id);
+  }
   const restartDecision = channelConfigConvergedThisTick ? decideChannelRestart({
     previousChannelIds,
     currentChannelIds,
@@ -18525,7 +18587,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-TPP35O6H.js");
+        const { collectDiagnostics } = await import("../persistent-session-GIRGRUMF.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -18576,7 +18638,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-TPP35O6H.js");
+      const { collectDiagnostics } = await import("../persistent-session-GIRGRUMF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -19208,7 +19270,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-HPYSFXPP.js");
+  } = await import("../claude-pair-runtime-CNS5OLQE.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -20446,6 +20508,7 @@ export {
   stopManager,
   stuckChannelSyncs,
   stuckRealtimeRebinds,
-  supersededRuntimeImageIds
+  supersededRuntimeImageIds,
+  verifiedChannelCredentials
 };
 //# sourceMappingURL=manager-worker.js.map