@integrity-labs/agt-cli 0.28.749 → 0.28.751

package/dist/bin/agt.js

@@ -41,12 +41,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-WTBSFYTA.js";
+} from "../chunk-QYAJHOZB.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-3LQYVRKX.js";
+} from "../chunk-LCHGVH7O.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-DFOBTAPL.js";
+} from "../chunk-TZOMZFXF.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.749" : "dev";
+var cliVersion = true ? "0.28.751" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6654,7 +6654,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.749" : "dev";
+var cliVersion2 = true ? "0.28.751" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-3LQYVRKX.js → chunk-LCHGVH7O.js}

@@ -17,7 +17,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-DFOBTAPL.js";
+} from "./chunk-TZOMZFXF.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -4929,4 +4929,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-3LQYVRKX.js.map
+//# sourceMappingURL=chunk-LCHGVH7O.js.map

package/dist/{chunk-WTBSFYTA.js → chunk-QYAJHOZB.js}

@@ -13,7 +13,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-3LQYVRKX.js";
+} from "./chunk-LCHGVH7O.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -62,7 +62,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-DFOBTAPL.js";
+} from "./chunk-TZOMZFXF.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6430,7 +6430,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.749" : "dev";
+var agtCliVersion = true ? "0.28.751" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8548,11 +8548,76 @@ var DID_NOT_RUN_SIGNATURES = [
     // would hide a fault worth seeing.
     re: /AGT_AGENT_ID is not set/i,
     reason: "the probe process was spawned without AGT_AGENT_ID, so the credential shim could not identify the agent and nothing was probed (ENG-9005)"
+  },
+  {
+    // THE INTERPRETER NEVER STARTED — the wrapper could not even be launched.
+    //
+    // The ENG-8344 credential shim is a Node script beginning
+    // `#!/usr/bin/env node`. If the PATH handed to the probe omits the
+    // directory holding `node`, the kernel finds and execs the shim, `env`
+    // then fails to resolve its interpreter, and the process dies with exit
+    // 127 and:
+    //
+    //     env: 'node': No such file or directory
+    //
+    // That is a did-not-run in the purest sense — not one byte of `gh` ran —
+    // and until now it matched NOTHING. Not the two entries above (the shim
+    // never got far enough to print its own wording, and never read
+    // AGT_AGENT_ID), and not any TRANSIENT_SIGNATURE (it is not a throttle, a
+    // 5xx or a socket error). So it fell through to the flat `down`,
+    // incrementing consecutive_connectivity_failures and, past the threshold,
+    // opening an `integration_down` alert that reads as a GitHub outage.
+    //
+    // REPRODUCED on agt-aws-1 2026-08-31, not inferred:
+    //   PATH=<agent>/.claude/agt-bin              -> env: 'node': No such file
+    //   PATH=<agent>/.claude/agt-bin:/usr/bin     -> shim runs, finds gh 2.96.0
+    // and through runCliProbe the first case graded:
+    //   status 'down', cause undefined,
+    //   "sh exited non-zero: env: 'node': No such file or directory"
+    //
+    // Worth stating because it corrects a plausible-looking account: a
+    // truncated PATH does NOT reach the shim's own "the real gh binary is not
+    // on PATH (only the Augmented shim is)" message. It cannot — that line is
+    // printed by JavaScript that never executes. Anyone matching the two
+    // symptoms by eye will pair the wrong cause with the wrong effect.
+    //
+    // NARROW, per the file's standing rule that a verdict-softening pattern
+    // must never be the greedy one. A bare "No such file or directory" is far
+    // too broad — a CLI may print it about a config file, a repo path or a key
+    // file while genuinely failing. Both alternatives below are anchored on the
+    // LAUNCH failing: `env`'s own diagnostic, and the shell's `bad interpreter`.
+    // TIGHTENED IN REVIEW, and the tightening is the interesting part.
+    //
+    // My first pattern was `env: .{0,64}: No such file or directory`, which is
+    // exactly the greedy shape this file's header warns against. `env: ` is not
+    // a rare prefix — a CLI is free to print `env: GH_CONFIG_DIR: No such file
+    // or directory` about a variable it was told to read, and that is a REAL
+    // failure. Softening it to `unverified` would have hidden a dead credential
+    // permanently, which the header names as the failure nobody ever finds.
+    //
+    // Two independent narrowings, either of which alone would be weak:
+    //
+    //  - QUOTING. GNU coreutils `env` quotes the command it could not exec:
+    //    `env: 'node': No such file or directory`. A variable name in a
+    //    provider's own diagnostic is not quoted that way. `[^']+` cannot span
+    //    the closing quote, so it cannot drift across a longer message.
+    //  - EXIT STATUS. A launcher that could not exec its target exits 127
+    //    (command not found) or 126 (found, not executable). An ordinary CLI
+    //    failure that merely mentions a missing file exits with its own code —
+    //    1 in every case I could produce.
+    //
+    // Requiring both means a match is a launch failure by two agreeing signals,
+    // not by a substring. (CodeRabbit.)
+    re: /\benv: '[^']+': No such file or directory|: bad interpreter: No such file or directory/i,
+    exitCodes: [126, 127],
+    reason: "the probe's interpreter could not be launched (a truncated PATH omitting the directory that holds `node` does this to the credential shim), so nothing was probed"
   }
 ];
-function didNotRunReasonFor(text) {
-  for (const { re, reason } of DID_NOT_RUN_SIGNATURES) {
-    if (re.test(text)) return reason;
+function didNotRunReasonFor(text, exitCode) {
+  for (const { re, reason, exitCodes } of DID_NOT_RUN_SIGNATURES) {
+    if (!re.test(text)) continue;
+    if (exitCodes && (exitCode === null || !exitCodes.includes(exitCode))) continue;
+    return reason;
   }
   return null;
 }
@@ -8567,13 +8632,27 @@ function firstMeaningfulLine(stderr, stdout, fallback) {
   const line = firstLineOf(stderr) ?? firstLineOf(stdout) ?? firstLineOf(fallback) ?? "";
   return redactAndBound(line);
 }
+function logSearchedPath(binary, env, why) {
+  console.warn(
+    `[connectivity-probe] ${binary} did not run (${why}). PATH searched: ${effectiveSearchPath(env)}`
+  );
+}
+function effectiveSearchPath(env) {
+  if (process.platform === "win32") {
+    const key = Object.keys(env).find((k) => k.toLowerCase() === "path");
+    const value = key ? env[key] : void 0;
+    return value ?? "<no PATH/Path key \u2014 Windows default lookup applies>";
+  }
+  return env.PATH ?? "<PATH unset \u2014 the platform default applies, conventionally /usr/bin:/bin>";
+}
 function runCliProbe(binary, args, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const childEnv = opts.env ?? process.env;
   return new Promise((resolve) => {
     execFile2(
       binary,
       args,
-      { timeout: timeoutMs, env: opts.env ?? process.env, windowsHide: true },
+      { timeout: timeoutMs, env: childEnv, windowsHide: true },
       (err, stdout, stderr) => {
         if (!err) {
           const firstLine = String(stdout).split(/\r?\n/, 1)[0]?.trim();
@@ -8585,8 +8664,13 @@ function runCliProbe(binary, args, opts = {}) {
         }
         const e = err;
         if (e.code === "ENOENT") {
+          logSearchedPath(binary, childEnv, "ENOENT \u2014 no such binary anywhere on it");
           resolve({
             status: "unverified",
+            // ENG-9173 vocabulary: say WHY in the field that survives. The
+            // status alone cannot distinguish this from any other unverified
+            // row, and the message below is dropped before persistence.
+            cause: "not_run",
             message: `${binary} not found on PATH \u2014 the probe could not run, so this is NOT a verdict about the integration. If the agent uses a per-agent binary (e.g. the .claude/agt-bin shim), the probe's PATH must include it.`
           });
           return;
@@ -8598,10 +8682,16 @@ function runCliProbe(binary, args, opts = {}) {
         const diagnostic = `${stderr ?? ""}
 ${stdout ?? ""}
 ${e.message}`;
-        const didNotRun = didNotRunReasonFor(diagnostic);
+        const exitCode = typeof e.code === "number" ? e.code : null;
+        const didNotRun = didNotRunReasonFor(diagnostic, exitCode);
         if (didNotRun) {
+          logSearchedPath(binary, childEnv, didNotRun);
           resolve({
             status: "unverified",
+            // Same reasoning as the ENOENT branch above: this is the arm that
+            // catches a shim which started and could not find the tool behind
+            // it, which is the shape that actually reaches production.
+            cause: "not_run",
             message: `${binary} probe did not run \u2014 ${didNotRun}. This is NOT a verdict about the integration: ${firstMeaningfulLine(stderr, stdout, e.message)}`
           });
           return;
@@ -10476,4 +10566,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-WTBSFYTA.js.map
+//# sourceMappingURL=chunk-QYAJHOZB.js.map