@integrity-labs/agt-cli 0.28.936 → 0.28.938

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-LN64VNHI.js";
+} from "../chunk-HEXKSBBV.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.936" : "dev";
+var cliVersion = true ? "0.28.938" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6727,7 +6727,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.936" : "dev";
+var cliVersion2 = true ? "0.28.938" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-LN64VNHI.js → chunk-HEXKSBBV.js}

@@ -6965,7 +6965,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.936" : "dev";
+var agtCliVersion = true ? "0.28.938" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9203,18 +9203,35 @@ var TRANSIENT_SIGNATURES = [
   // Google's quota wording do not use the number at all.
   {
     re: new RegExp(`${STATUS_CTX}429\\b|too many requests|rate limit|secondary rate|quota exceeded|abuse detection`, "i"),
-    reason: "rate limited by the provider"
+    reason: "rate limited by the provider",
+    // BEHAVIOUR CHANGE, and it is the point rather than a side effect.
+    // `rate_limited` is one of the two `isVendorSideCause` members, so
+    // `isTransientStreakPermanent` stops promoting a long 429 streak to the
+    // hard-down path. That is exactly what ENG-9173 asked for: "59 consecutive
+    // Buffer 429s paged at CRITICAL, next to genuinely actionable criticals,
+    // naming no action at all, because nobody can un-429 a vendor." Until now
+    // the cause arrived as `unknown`, which is NOT vendor-side, so the
+    // suppression that ticket built could never fire on this lane.
+    cause: "rate_limited"
   },
   // Vendor-side server errors. Anchored on the phrase or on an explicit
   // HTTP-status context so a bare 3-digit number cannot match.
   {
     re: new RegExp(`${STATUS_CTX}(?:502|503|504)\\b|bad gateway|service unavailable|gateway time-?out|internal server error|server error \\(5\\d\\d\\)`, "i"),
-    reason: "provider returned a server error"
+    reason: "provider returned a server error",
+    // Also vendor-side, same consequence as above and for the same reason:
+    // "the vendor returned 5xx — their fault, ours to watch."
+    cause: "server_error"
   },
   // Transport. The provider may be fine and simply unreachable from here.
   {
     re: /ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|EHOSTUNREACH|ENETUNREACH|connection refused|connection reset|network is unreachable|temporary failure in name resolution|tls handshake|dial tcp/i,
-    reason: "network failure reaching the provider"
+    reason: "network failure reaching the provider",
+    // NOT vendor-side, so escalation is unchanged here — `unreachable` "may be
+    // US, which is why it counts as actionable". Naming it changes what an
+    // operator READS, not whether they are told. Same call `networkOutcome`
+    // made for the HTTP lane.
+    cause: "unreachable"
   },
   // OUR failure, not the credential's. ENG-8344 fetches the token per use
   // through the platform, so an identity-tier outage surfaces here as a
@@ -9224,14 +9241,56 @@ var TRANSIENT_SIGNATURES = [
   {
     re: /credential fetch failed|key exchange failed|host\/exchange|upstream connect error|could not read Username/i,
     reason: "our credential broker could not supply a token"
+    // DELIBERATELY UNCAUSED — the one entry in this table with no `cause`, and
+    // it is a decision, not an oversight. Nothing in the closed vocabulary
+    // describes "our own broker failed":
+    //   - `auth_rejected` is actively wrong. It means the CUSTOMER'S credential
+    //     was refused, and its remedy is "reconnect" — telling a customer to
+    //     re-auth a working token during OUR outage is precisely the 2026-08-14
+    //     fleet-wide misfire this signature was written to prevent.
+    //   - `server_error` means THE VENDOR returned 5xx, and it is vendor-side,
+    //     so it would SUPPRESS escalation of an outage that is ours and that we
+    //     most want to be woken for.
+    //   - `unreachable` is a network fact about the provider; the broker is
+    //     reachable and answering, just not with a token.
+    // So the honest value is `unknown`, which stays actionable, and a wrong
+    // cause is worse than no cause because it sends an operator somewhere
+    // specific. Fixing this properly needs a new enum member (a `broker_*`
+    // cause), which is a schema decision and is out of scope here.
   }
 ];
-function transientReasonFor(text) {
-  for (const { re, reason } of TRANSIENT_SIGNATURES) {
-    if (re.test(text)) return reason;
+function transientSignatureFor(text) {
+  for (const { re, reason, cause } of TRANSIENT_SIGNATURES) {
+    if (re.test(text)) return cause ? { reason, cause } : { reason };
   }
   return null;
 }
+var DOWN_SIGNATURES = [
+  {
+    // MEASURED, not imagined. Captured 2026-09-16 from `gh api user` on this
+    // host against a GitHub App token lacking the permission:
+    //   {"message":"Resource not accessible by integration", … "status":"403"}
+    //   gh: Resource not accessible by integration (HTTP 403)
+    // A 403 that is not throttling — the rate-limit signature is checked first
+    // and owns the throttling 403s, so reaching here means it is not one.
+    //
+    // The rest are GitHub's and git's own refusal wording. `Bad credentials` is
+    // the literal body of GitHub's 401; the "not logged into any … hosts"
+    // sentence is `gh auth status`'s, and is already pinned as a `down` case in
+    // eng-5463-cli-probe-transient.test.ts.
+    re: new RegExp(
+      `resource not accessible by integration|bad credentials|not logged into any\\b[^\\n]*\\bhosts|requires authentication|authentication failed|invalid authentication|${STATUS_CTX}401\\b|unauthorized\\b`,
+      "i"
+    ),
+    cause: "auth_rejected"
+  }
+];
+function downCauseFor(text) {
+  for (const { re, cause } of DOWN_SIGNATURES) {
+    if (re.test(text)) return cause;
+  }
+  return void 0;
+}
 var DID_NOT_RUN_SIGNATURES = [
   {
     re: /the real \S+ binary is not on PATH|only the Augmented shim is/i,
@@ -9433,7 +9492,11 @@ function runCliProbe(binary, args, opts = {}) {
           return;
         }
         if (e.killed || e.signal === "SIGTERM") {
-          resolve({ status: "transient_error", message: `${binary} probe timed out after ${timeoutMs / 1e3}s` });
+          resolve({
+            status: "transient_error",
+            cause: "unreachable",
+            message: `${binary} probe timed out after ${timeoutMs / 1e3}s`
+          });
           return;
         }
         const diagnostic = `${stderr ?? ""}
@@ -9453,16 +9516,20 @@ ${e.message}`;
           });
           return;
         }
-        const transient = transientReasonFor(diagnostic);
+        const transient = transientSignatureFor(diagnostic);
         if (transient) {
           resolve({
             status: "transient_error",
-            message: `${binary} probe inconclusive \u2014 ${transient}: ${firstMeaningfulLine(stderr, stdout, e.message)}`
+            // ENG-10529: present only when the matched signature carries one.
+            // The broker entry deliberately carries none — see its comment.
+            ...transient.cause ? { cause: transient.cause } : {},
+            message: `${binary} probe inconclusive \u2014 ${transient.reason}: ${firstMeaningfulLine(stderr, stdout, e.message)}`
           });
           return;
         }
         resolve({
           status: "down",
+          .../* @__PURE__ */ ((c) => c ? { cause: c } : {})(downCauseFor(diagnostic)),
           message: `${binary} exited non-zero: ${firstMeaningfulLine(stderr, stdout, e.message)}`
         });
       }
@@ -11590,4 +11657,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-LN64VNHI.js.map
+//# sourceMappingURL=chunk-HEXKSBBV.js.map