@integrity-labs/agt-cli 0.28.941 → 0.28.943

package/dist/{chunk-4ZRXKEXO.js → chunk-HF2GMFMJ.js}

@@ -778,12 +778,16 @@ MCP-authored skills land in the shared \`skill_definitions\` registry and reach
 agent in scope on refresh.
 
 - \`mcp__augmented__skill_create\` \xB7 \`mcp__augmented__skill_update\` (your own
-  agent-scoped only) \xB7 \`mcp__augmented__skill_read\` (read before editing) \xB7
-  \`mcp__augmented__skill_list\` \xB7 \`mcp__augmented__skill_improve\` (targeted edits)
+  agent-scoped only) \xB7 \`mcp__augmented__skill_read\` \xB7
+  \`mcp__augmented__skill_list\`
 - \`mcp__augmented__skill_propose_revision\` \u2014 full-body rewrite of a *shared*
   (team/org) skill you don't own \u2192 operator review
 - \`mcp__augmented__skill_contribute_fragment\` \u2014 an *addition* to one \u2192 operator review
 
+**No targeted-edit tool for a skill you authored** (\`skill_improve\` is
+for installed plugin skills). \`skill_update\`'s \`body\` fully replaces, so
+\`skill_read\` first; to ADD use \`skill_contribute_fragment\`, which appends.
+
 **Editing a shared (team/org) skill you don't own:** \`skill_update\` only edits your
 own **agent-scoped** skills and refuses a team/org one. Don't duplicate it or just
 ask a human \u2014 use \`skill_propose_revision\` to change wording (pass the FULL
@@ -10962,231 +10966,9 @@ function resolveConnectivityProbe(input) {
   }
 }
 
-// ../../packages/core/dist/integrations/mcp-http-probe.js
-var MCP_ACCEPT = "application/json, text/event-stream";
-var DEFAULT_TIMEOUT_MS = 1e4;
-function isRpcEnvelopeFor(msg, expectedId) {
-  return typeof msg === "object" && msg !== null && ("result" in msg || "error" in msg) && msg["id"] === expectedId;
-}
-async function parseRpc(res, expectedId) {
-  const ct = res.headers.get("content-type") ?? "";
-  if (ct.includes("text/event-stream")) {
-    const text = await res.text();
-    let dataLines = [];
-    const tryFrame = () => {
-      if (dataLines.length === 0)
-        return null;
-      try {
-        const msg2 = JSON.parse(dataLines.join("\n"));
-        if (isRpcEnvelopeFor(msg2, expectedId))
-          return msg2;
-      } catch {
-      }
-      return null;
-    };
-    for (const rawLine of text.split(/\r?\n/)) {
-      if (rawLine.startsWith("data:")) {
-        dataLines.push(rawLine.slice(5).trimStart());
-        continue;
-      }
-      if (rawLine === "") {
-        const frame = tryFrame();
-        if (frame)
-          return frame;
-        dataLines = [];
-      }
-    }
-    return tryFrame();
-  }
-  const msg = await res.json().catch(() => null);
-  return isRpcEnvelopeFor(msg, expectedId) ? msg : null;
-}
-function httpStatusOutcome(status, step) {
-  if (status === 401 || status === 403) {
-    return { status: "down", message: `MCP ${step} unauthorized (${status}) \u2014 reconnect required` };
-  }
-  if (status >= 500) {
-    return { status: "transient_error", message: `MCP ${step} returned ${status}` };
-  }
-  return { status: "down", message: `MCP ${step} returned ${status}` };
-}
-async function probeMcpHttp(config, fetchImpl = fetch) {
-  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const baseHeaders = {
-    ...config.headers ?? {},
-    "Content-Type": "application/json",
-    Accept: MCP_ACCEPT
-  };
-  try {
-    const initRes = await fetchImpl(config.url, {
-      method: "POST",
-      headers: baseHeaders,
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-          protocolVersion: "2025-03-26",
-          capabilities: {},
-          clientInfo: { name: "augmented-connectivity-probe", version: "1.0.0" }
-        }
-      }),
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!initRes.ok)
-      return httpStatusOutcome(initRes.status, "initialize");
-    const sessionId = initRes.headers.get("mcp-session-id");
-    const initRpc = await parseRpc(initRes, 1);
-    if (!initRpc) {
-      return { status: "down", message: "MCP initialize returned a non-JSON-RPC response \u2014 not an MCP server" };
-    }
-    if ("error" in initRpc) {
-      const err = initRpc["error"];
-      return { status: "down", message: `MCP initialize error: ${err?.message ?? "unknown"}` };
-    }
-    const sessionHeaders = { ...baseHeaders, ...sessionId ? { "Mcp-Session-Id": sessionId } : {} };
-    const initializedRes = await fetchImpl(config.url, {
-      method: "POST",
-      headers: sessionHeaders,
-      body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
-      signal: AbortSignal.timeout(5e3)
-    });
-    if (!initializedRes.ok)
-      return httpStatusOutcome(initializedRes.status, "initialized");
-    await initializedRes.text().catch(() => "");
-    const listRes = await fetchImpl(config.url, {
-      method: "POST",
-      headers: sessionHeaders,
-      body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" }),
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!listRes.ok)
-      return httpStatusOutcome(listRes.status, "tools/list");
-    const rpc = await parseRpc(listRes, 2);
-    if (!rpc) {
-      return { status: "down", message: "MCP tools/list returned a non-JSON-RPC response \u2014 not an MCP server" };
-    }
-    if ("error" in rpc) {
-      const err = rpc["error"];
-      return { status: "down", message: `MCP tools/list error: ${err?.message ?? "unknown"}` };
-    }
-    const result = rpc["result"];
-    const toolCount = Array.isArray(result?.tools) ? result.tools.length : void 0;
-    const testTool = config.connectivityTest?.tool;
-    if (testTool) {
-      const rawArgs = config.connectivityTest?.args;
-      const toolArgs = rawArgs && !Array.isArray(rawArgs) ? rawArgs : {};
-      const callRes = await fetchImpl(config.url, {
-        method: "POST",
-        headers: sessionHeaders,
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          id: 3,
-          method: "tools/call",
-          params: { name: testTool, arguments: toolArgs }
-        }),
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-      if (!callRes.ok)
-        return httpStatusOutcome(callRes.status, `tools/call ${testTool}`);
-      const callRpc = await parseRpc(callRes, 3);
-      if (!callRpc) {
-        return { status: "down", message: `MCP tools/call ${testTool} returned a non-JSON-RPC response \u2014 not an MCP server` };
-      }
-      if ("error" in callRpc) {
-        const err = callRpc["error"];
-        return { status: "down", message: `MCP tools/call ${testTool} error: ${err?.message ?? "unknown"}` };
-      }
-      const callResult = callRpc["result"];
-      if (callResult?.isError === true) {
-        return { status: "down", message: `MCP tool ${testTool} returned an error result` };
-      }
-      return {
-        status: "ok",
-        message: `${testTool} succeeded`,
-        details: { ...toolCount !== void 0 ? { toolCount } : {}, testTool }
-      };
-    }
-    return handshakeToolsListOutcome(toolCount);
-  } catch (err) {
-    const isAbort = err?.name === "TimeoutError" || err?.name === "AbortError";
-    return {
-      status: "transient_error",
-      message: isAbort ? `MCP handshake timed out after ${timeoutMs / 1e3}s` : `MCP handshake failed: ${err.message}`
-    };
-  }
-}
-
-// ../../packages/core/dist/integrations/composio-fetch.js
-var COMPOSIO_API_BASE = "https://backend.composio.dev";
-var transportResolver = null;
-async function getComposioTransport() {
-  if (!transportResolver)
-    return null;
-  try {
-    return await transportResolver();
-  } catch (err) {
-    console.error("[composio] transport resolver failed; using direct egress", {
-      error: err instanceof Error ? err.message : String(err)
-    });
-    return null;
-  }
-}
-
-// ../../packages/core/dist/integrations/composio-linkage.js
-function assessAuthConfigLinkage(input) {
-  const { accountAuthConfigId, serverAuthConfigIds, serverId } = input;
-  const serverLabel = serverId ? ` (${serverId})` : "";
-  if (serverAuthConfigIds == null || !accountAuthConfigId) {
-    return {
-      linked: null,
-      message: "auth_config linkage not verified \u2014 " + (serverAuthConfigIds == null ? "couldn't read the wired MCP server's auth config binding" : "Composio returned no auth_config for the connected account"),
-      details: {
-        accountAuthConfigId: accountAuthConfigId ?? null,
-        serverAuthConfigIds: serverAuthConfigIds ?? null,
-        serverId: serverId ?? null
-      }
-    };
-  }
-  if (serverAuthConfigIds.length === 0) {
-    return {
-      linked: false,
-      message: `The agent's wired MCP server${serverLabel} has no auth config bound, so it cannot resolve the connected account (bound to auth_config ${accountAuthConfigId}) \u2014 reconnect/rebind required.`,
-      details: { accountAuthConfigId, serverAuthConfigIds, serverId: serverId ?? null }
-    };
-  }
-  if (serverAuthConfigIds.includes(accountAuthConfigId)) {
-    return {
-      linked: true,
-      message: `Connected account's auth_config (${accountAuthConfigId}) matches the wired MCP server binding.`,
-      details: { accountAuthConfigId, serverAuthConfigIds, serverId: serverId ?? null }
-    };
-  }
-  return {
-    linked: false,
-    message: `The connected account is bound to auth_config ${accountAuthConfigId}, but the agent's wired MCP server${serverLabel} resolves auth_config(s) [${serverAuthConfigIds.join(", ")}] \u2014 tool calls will fail with "No connected account found". Reconnect/rebind required.`,
-    details: { accountAuthConfigId, serverAuthConfigIds, serverId: serverId ?? null }
-  };
-}
-
-// ../../packages/core/dist/integrations/composio-account-probe.js
+// ../../packages/core/dist/integrations/connectivity-http-probes.js
 var PROBE_TIMEOUT_MS = 1e4;
-var BODY_SNIPPET_MAX = 300;
-async function readErrorBodySnippet(res, apiKey) {
-  let text;
-  try {
-    text = await res.text();
-  } catch {
-    return void 0;
-  }
-  const redacted = apiKey ? text.split(apiKey).join("\xABredacted\xBB") : text;
-  const trimmed = redacted.trim();
-  if (!trimmed)
-    return void 0;
-  return trimmed.length > BODY_SNIPPET_MAX ? `${trimmed.slice(0, BODY_SNIPPET_MAX)}\u2026` : trimmed;
-}
 var NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 204, 205, 304]);
-var BODY_MAX_BYTES = 1024 * 1024;
 async function timedFetch(fetchImpl, url, init) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
@@ -11194,7 +10976,7 @@ async function timedFetch(fetchImpl, url, init) {
     const res = await fetchImpl(url, { ...init, signal: controller.signal });
     if (NULL_BODY_STATUSES.has(res.status))
       return res;
-    const body = await readBoundedBody(res, controller);
+    const body = await res.text();
     return new Response(body, {
       status: res.status,
       statusText: res.statusText,
@@ -11204,437 +10986,372 @@ async function timedFetch(fetchImpl, url, init) {
     clearTimeout(timer);
   }
 }
-async function readBoundedBody(res, controller) {
-  const stream = res.body;
-  if (!stream)
-    return await res.text();
-  const reader = stream.getReader();
-  const chunks = [];
-  let total = 0;
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done)
-      break;
-    if (!value)
-      continue;
-    total += value.byteLength;
-    if (total > BODY_MAX_BYTES) {
-      controller.abort();
-      await reader.cancel().catch(() => {
-      });
-      throw new Error(`Composio response body exceeded ${BODY_MAX_BYTES} bytes`);
-    }
-    chunks.push(value);
-  }
-  const merged = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    merged.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return new TextDecoder().decode(merged);
-}
-async function probeComposioAccount(params, fetchImpl) {
-  const impl = fetchImpl ?? await getComposioTransport() ?? fetch;
-  const { connectedAccountId, apiKey, expectedUserId } = params;
-  const base = params.apiBase ?? COMPOSIO_API_BASE;
-  if (!connectedAccountId) {
-    return {
-      status: "down",
-      message: "No connected account recorded \u2014 reconnect required"
-    };
-  }
-  if (!apiKey || !expectedUserId) {
-    return {
-      status: "transient_error",
-      message: "Composio probe missing api key or expected user_id"
-    };
-  }
-  let res;
+function isRateLimited(res) {
+  const retryAfter = res.headers.get("retry-after");
+  if (retryAfter !== null && retryAfter.trim() !== "")
+    return true;
+  const remaining = res.headers.get("x-ratelimit-remaining");
+  if (remaining === null || remaining.trim() === "")
+    return false;
+  return Number(remaining) === 0;
+}
+function statusForHttp(httpStatus, opts) {
+  if (httpStatus === 429)
+    return "transient_error";
+  if (httpStatus === 403 && opts?.rateLimited)
+    return "transient_error";
+  if (httpStatus === 401 || httpStatus === 403)
+    return "down";
+  if (httpStatus >= 500)
+    return "transient_error";
+  return "down";
+}
+function causeForHttp(httpStatus, opts) {
+  if (httpStatus === 429)
+    return "rate_limited";
+  if (httpStatus === 403 && opts?.rateLimited)
+    return "rate_limited";
+  if (httpStatus === 401 || httpStatus === 403)
+    return "auth_rejected";
+  if (httpStatus >= 500)
+    return "server_error";
+  return "semantic";
+}
+function rateLimitMessage(provider, httpStatus) {
+  const subject = provider ? `${provider} rate limit` : "Rate limited by the provider";
+  return `${subject} (${httpStatus}) \u2014 not a credential failure`;
+}
+function redactSecret(message, secret) {
+  if (typeof secret !== "string" || secret.length < 4)
+    return message;
+  return message.split(secret).join("[redacted]");
+}
+function networkOutcome(err, secret) {
+  const isAbort = err?.name === "AbortError";
+  const message = isAbort ? `Connection timed out after ${PROBE_TIMEOUT_MS / 1e3}s` : `Connection failed: ${err.message}`;
+  return { status: "transient_error", cause: "unreachable", message: redactSecret(message, secret) };
+}
+async function probeLinear(creds, fetchImpl) {
+  const key = creds.api_key ?? creds.access_token;
+  if (!key)
+    return { status: "down", message: "No Linear credential present" };
   try {
-    res = await timedFetch(impl, `${base}/api/v3/connected_accounts/${encodeURIComponent(connectedAccountId)}`, { headers: { "x-api-key": apiKey } });
+    const res = await timedFetch(fetchImpl, "https://api.linear.app/graphql", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: String(key) },
+      body: JSON.stringify({ query: "{ viewer { id name email } }" })
+    });
+    if (!res.ok) {
+      const rateLimited = isRateLimited(res);
+      const message = res.status === 429 || res.status === 403 && rateLimited ? rateLimitMessage("Linear", res.status) : `Linear API returned ${res.status}`;
+      return {
+        status: statusForHttp(res.status, { rateLimited }),
+        cause: causeForHttp(res.status, { rateLimited }),
+        message
+      };
+    }
+    const body = await res.json();
+    if (body.errors?.length)
+      return { status: "down", message: body.errors[0]?.message ?? "Unknown Linear error" };
+    const viewer = body.data?.viewer;
+    if (!viewer)
+      return { status: "down", message: "Invalid key \u2014 no viewer returned" };
+    return { status: "ok", message: `Connected as ${viewer.name ?? viewer.email ?? "unknown"}` };
   } catch (err) {
-    const isAbort = err?.name === "AbortError";
-    return {
-      status: "transient_error",
-      message: isAbort ? `Composio probe timed out after ${PROBE_TIMEOUT_MS / 1e3}s` : `Composio probe failed: ${err.message}`
-    };
+    return networkOutcome(err, String(key ?? ""));
   }
-  if (!res.ok) {
-    if (res.status >= 500) {
+}
+async function probeBearerJson(url, creds, fetchImpl, interpret, extraHeaders) {
+  const token = creds.access_token ?? creds.api_key;
+  if (!token)
+    return { status: "down", message: "No credential present" };
+  try {
+    const res = await timedFetch(fetchImpl, url, { headers: { Authorization: `Bearer ${token}`, ...extraHeaders } });
+    if (!res.ok) {
+      const rateLimited = isRateLimited(res);
+      const message = res.status === 401 ? "Token expired or revoked \u2014 reconnect required" : res.status === 429 || res.status === 403 && rateLimited ? rateLimitMessage(null, res.status) : `API returned ${res.status}`;
       return {
-        status: "transient_error",
-        message: `Composio unreachable (HTTP ${res.status}) \u2014 retrying`,
-        details: { connectedAccountId, httpStatus: res.status }
+        status: statusForHttp(res.status, { rateLimited }),
+        cause: causeForHttp(res.status, { rateLimited }),
+        message
       };
     }
-    if (res.status === 401 || res.status === 403) {
-      const body = await readErrorBodySnippet(res, apiKey);
+    return interpret(await res.json());
+  } catch (err) {
+    return networkOutcome(err, String(token ?? ""));
+  }
+}
+async function probeBuffer(creds, fetchImpl) {
+  const key = creds.api_key ?? creds.access_token;
+  if (!key)
+    return { status: "down", message: "No Buffer credential present" };
+  try {
+    const res = await timedFetch(fetchImpl, "https://api.buffer.com", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
+      body: JSON.stringify({ query: "{ account { organizations { id name } } }" })
+    });
+    if (!res.ok) {
+      const rateLimited = isRateLimited(res);
+      const message = res.status === 401 ? (
+        // ENG-9809: name the mechanism, because the bare "expired or revoked" sent
+        // two investigations at the wrong thing. Buffer API keys carry a MANDATORY
+        // lifetime chosen at mint time — 7/30/60/90 days or 1 year, defaulting to
+        // 30 days, with no "never expires" option
+        // (support.buffer.com/article/984-how-to-create-your-buffer-api-key). So
+        // every Buffer install on the fleet is on a countdown, and expiry is the
+        // ordinary end of a key's life rather than a customer revoking one.
+        //
+        // All three causes are named, because this one branch answers every Buffer
+        // 401 — a key that lapsed, one that was revoked, and one that was simply
+        // mistyped ("Requests without a valid key will return a 401 Unauthorized",
+        // developers.buffer.com/guides/authentication.html). The status code alone
+        // cannot separate them, so naming expiry as the LIKELIER cause is supported;
+        // asserting it is not, and a message that omitted "invalid" would send
+        // someone who pasted the key wrong looking for an expiry date instead.
+        "Buffer API key expired, invalid, or revoked \u2014 reconnect required. Buffer keys expire by design (30-day default, 1-year maximum), so on a key that was working until now expiry is the likeliest of the three; pick 1 year when minting the replacement."
+      ) : res.status === 429 || res.status === 403 && rateLimited ? rateLimitMessage("Buffer", res.status) : `Buffer API returned ${res.status}`;
       return {
-        status: "unverified",
-        cause: "access_restricted",
-        message: `Composio refused our API key (HTTP ${res.status}) \u2014 access restriction on our side, not a problem with this account; do not reconnect` + (body ? `. Composio said: ${body}` : ""),
-        details: {
-          connectedAccountId,
-          httpStatus: res.status,
-          ...body ? { responseBody: body } : {}
-        }
+        status: statusForHttp(res.status, { rateLimited }),
+        cause: causeForHttp(res.status, { rateLimited }),
+        message
       };
     }
-    return {
-      status: "down",
-      message: `Composio account ${connectedAccountId} not found (HTTP ${res.status}) \u2014 reconnect required`,
-      details: { connectedAccountId, httpStatus: res.status }
-    };
+    const body = await res.json();
+    if (body.errors?.length)
+      return { status: "down", message: body.errors[0]?.message ?? "Unknown Buffer error" };
+    const orgs = body.data?.account?.organizations ?? [];
+    if (!orgs.length)
+      return { status: "down", message: "No Buffer organizations on this account" };
+    return { status: "ok", message: `Connected to ${orgs[0]?.name ?? "Buffer"}` };
+  } catch (err) {
+    return networkOutcome(err, String(key ?? ""));
   }
-  let data;
+}
+async function probeVercel(creds, fetchImpl) {
+  const token = creds.api_key ?? creds.access_token;
+  if (!token)
+    return { status: "down", message: "No Vercel credential present" };
   try {
-    data = await res.json();
+    const res = await timedFetch(fetchImpl, "https://api.vercel.com/v2/user", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) {
+      const message = res.status === 429 ? rateLimitMessage("Vercel", res.status) : res.status === 401 || res.status === 403 ? `Vercel rejected the token (${res.status}) \u2014 invalid or revoked API token` : `Vercel API returned ${res.status}`;
+      return {
+        status: statusForHttp(res.status),
+        cause: causeForHttp(res.status),
+        message
+      };
+    }
+    const body = await res.json();
+    const user = body?.user;
+    const identity = [user?.username, user?.email, user?.name, user?.id].find((value) => typeof value === "string" && value.trim().length > 0);
+    if (!identity)
+      return { status: "down", message: "Vercel returned no user for this token" };
+    return { status: "ok", message: `Connected as ${identity}` };
   } catch (err) {
-    return {
-      status: "transient_error",
-      message: `Composio probe response unparseable: ${err.message}`
-    };
-  }
-  const accountStatus = data.status ?? "unknown";
-  if (accountStatus !== "ACTIVE") {
-    return {
-      status: "down",
-      message: `Composio account ${connectedAccountId} status=${accountStatus} \u2014 reconnect required`,
-      details: { connectedAccountId, status: accountStatus, boundUserId: data.user_id ?? null }
-    };
-  }
-  const boundUserId = data.user_id;
-  if (!boundUserId) {
-    return {
-      status: "down",
-      message: `Composio account ${connectedAccountId} is ACTIVE but returned no user_id binding \u2014 runtime queries as '${expectedUserId}', so tool calls can't be confirmed`,
-      details: { connectedAccountId, status: accountStatus, boundUserId: null, expectedUserId }
-    };
+    return networkOutcome(err, String(token ?? ""));
   }
-  if (boundUserId !== expectedUserId) {
+}
+async function probeHiggsfield(creds, fetchImpl) {
+  const token = creds.api_key ?? creds.access_token;
+  if (!token)
+    return { status: "down", message: "No Higgsfield credential present" };
+  if (!token.includes(":")) {
     return {
       status: "down",
-      message: `Composio account ${connectedAccountId} is bound to user_id '${boundUserId}' but the agent runtime queries as '${expectedUserId}' \u2014 tool calls will fail. Reconnect to bind correctly.`,
-      details: { connectedAccountId, status: accountStatus, boundUserId, expectedUserId }
+      message: "Higgsfield credential is not in KEY_ID:KEY_SECRET form \u2014 re-paste it from cloud.higgsfield.ai/api-keys"
     };
   }
-  const accountAuthConfigId = data.auth_config_id ?? data.auth_config?.id;
-  if (params.serverId) {
-    const serverAuthConfigIds = await fetchServerAuthConfigIds(impl, base, params.serverId, apiKey);
-    const linkage = assessAuthConfigLinkage({
-      accountAuthConfigId,
-      serverAuthConfigIds,
-      serverId: params.serverId
+  try {
+    const res = await timedFetch(fetchImpl, "https://platform.higgsfield.ai/v1/motions", {
+      headers: { Authorization: `Key ${token}` }
     });
-    if (linkage.linked === false) {
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      if (res.status === 403 && /credit/i.test(body)) {
+        return {
+          status: "degraded",
+          message: "Higgsfield authenticated, but the account is out of credits \u2014 generation will fail"
+        };
+      }
+      const message = res.status === 429 ? rateLimitMessage("Higgsfield", res.status) : res.status === 401 || res.status === 403 ? `Higgsfield rejected the key pair (${res.status}) \u2014 invalid or revoked API key` : `Higgsfield API returned ${res.status}`;
       return {
-        status: "down",
-        message: linkage.message,
-        details: { connectedAccountId, status: accountStatus, boundUserId, ...linkage.details }
+        status: statusForHttp(res.status),
+        cause: causeForHttp(res.status),
+        message
       };
     }
-  }
-  return {
-    status: "ok",
-    message: `Connected (account ${connectedAccountId}, status=ACTIVE)`,
-    details: {
-      connectedAccountId,
-      status: accountStatus,
-      boundUserId,
-      ...accountAuthConfigId ? { authConfigId: accountAuthConfigId } : {}
+    const motions = await res.json();
+    if (!Array.isArray(motions) || motions.length === 0) {
+      return { status: "down", message: "Higgsfield returned no motion presets for this key" };
     }
-  };
+    return { status: "ok", message: `Higgsfield reachable \u2014 ${motions.length} motion presets` };
+  } catch (err) {
+    return networkOutcome(err, String(token ?? ""));
+  }
 }
-async function fetchServerAuthConfigIds(fetchImpl, base, serverId, apiKey) {
-  let res;
+async function probeSportsyear(creds, fetchImpl) {
+  const key = creds.api_key ?? creds.access_token;
+  if (!key)
+    return { status: "down", message: "No Sportsyear credential present" };
+  let authorization;
   try {
-    res = await timedFetch(fetchImpl, `${base}/api/v3/mcp/${encodeURIComponent(serverId)}`, { headers: { "x-api-key": apiKey } });
+    authorization = basicUsernameAuthorization(String(key));
   } catch {
-    return null;
+    return {
+      status: "down",
+      message: 'Sportsyear credential is not a bare API key (it contains ":") \u2014 paste the key alone, not email:password'
+    };
   }
-  if (!res.ok)
-    return null;
+  const encoded = authorization.slice("Basic ".length);
   try {
-    const data = await res.json();
-    return data.auth_config_ids ?? data.auth_configs?.map((c) => c.id).filter((id) => typeof id === "string" && id.length > 0) ?? [];
-  } catch {
-    return null;
-  }
-}
-
-// ../../packages/core/dist/integrations/composio-approved-egress.json
-var composio_approved_egress_default = {
-  $comment: [
-    "ADR-0032 Part 3, gate item 2 + gate item 3 (ENG-9684). THE single recorded source",
-    "for the addresses Composio's per-key IP allowlist is expected to hold. Read by BOTH",
-    "scripts/fleet-egress-enum.sh (the operator's pre-arming instrument) and the",
-    "ComposioEgressAddressDrift cron (the between-armings watch). They must agree, which",
-    "is why neither carries its own copy.",
-    "",
-    "WHY A REPO FILE AND NOT SSM. Composio's allowlist has no read API, so its contents",
-    "can never be queried - only inferred from a refusal. This file is therefore not a",
-    "cache of vendor state; it is a DECLARATION of what a human pasted into a dashboard.",
-    "A PR is the right ceremony for changing a security boundary nobody can read back.",
-    "SSM would also hit registerCron's five-parameter grant scope (ENG-9940), where a",
-    "sixth parameter fails silently.",
-    "",
-    "THE COMPARISON IS ON `ip` AND NOTHING ELSE. `seenAsGateway` is informational. A NAT",
-    "rebuild that re-adopts the same EIP keeps egress correct while changing the gateway",
-    "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
-    "EIP adoption exists to create.",
-    "",
-    "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
-    "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
-    "address: add it here in the same change that lands it, or the detector correctly",
-    "reports that hosts are leaving from an address no key allows. Do not loosen the check."
-  ],
-  account: "711726113003",
-  homeRegion: "ap-southeast-2",
-  addresses: [
-    {
-      ip: "32.236.6.24",
-      stage: "prod",
-      seenAsGateway: "nat-00a3dac969c0641a6",
-      note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
-    },
-    {
-      ip: "15.135.204.192",
-      stage: "dev",
-      seenAsGateway: "nat-01122e6efaf4c4eaa",
-      note: "Dev-stage hosts NAT, same account. 2 instances measured 2026-09-12; their host rows live in the dev Supabase project."
+    const res = await timedFetch(fetchImpl, "https://sportsyear.com.au/api/v1/member", {
+      headers: { Authorization: authorization, Accept: "application/json" }
+    });
+    if (!res.ok) {
+      const message = res.status === 429 ? rateLimitMessage("Sportsyear", res.status) : res.status === 401 || res.status === 403 ? `Sportsyear rejected the API key (${res.status}) \u2014 removed, regenerated, or API access disabled on the member account` : `Sportsyear API returned ${res.status}`;
+      return {
+        status: statusForHttp(res.status),
+        cause: causeForHttp(res.status),
+        message
+      };
     }
-  ]
-};
-
-// ../../packages/core/dist/integrations/composio-approved-egress.js
-var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
-var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
-var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
-
-// ../../packages/core/dist/integrations/composio-tool-call-probe.js
-var MCP_ACCEPT2 = "application/json, text/event-stream";
-var DEFAULT_TIMEOUT_MS2 = 1e4;
-var READONLY_VERB_TOKENS = [
-  "LIST",
-  "GET",
-  "FIND",
-  "SEARCH",
-  "FETCH",
-  "COUNT",
-  "RETRIEVE",
-  "READ"
-];
-var ACCOUNT_RESOLUTION_ERROR_PATTERNS = [
-  "no connected account",
-  "connected account not found",
-  "no account found",
-  "could not be resolved",
-  "auth config",
-  "no connection found"
-];
-var UPSTREAM_AUTH_ERROR_PATTERNS = [
-  "authentication required",
-  "not authenticated",
-  "unauthorized",
-  "authentication_error",
-  "authentication error",
-  "invalid authentication",
-  "invalid credentials",
-  "invalid api key",
-  "invalid access token",
-  "token expired",
-  "token has expired",
-  "expired access token",
-  "expired credentials",
-  "permission denied",
-  "access denied",
-  "forbidden"
-];
-var SITE_RESOLUTION_ERROR_PATTERNS = [
-  "dns resolution failed",
-  "getaddrinfo",
-  "enotfound",
-  "could not resolve host",
-  "name resolution",
-  "name not resolved"
-];
-var SCOPE_DEFICIT_ERROR_PATTERNS = [
-  "insufficient_scope",
-  "insufficient scope",
-  "insufficient permission",
-  "missing scope",
-  "required scope",
-  "requires the scope",
-  "requires the following scope",
-  "scope is required",
-  "access scope",
-  "oauth scope",
-  // Shopify custom-app specifics.
-  "read_content",
-  "write_content",
-  "sales channel is not enabled"
-];
-var QUOTA_EXHAUSTED_ERROR_PATTERNS = [
-  "resource_exhausted",
-  "resource has been exhausted",
-  "rate limit",
-  "rate_limit",
-  "ratelimit",
-  "ratescope",
-  "rate_scope",
-  "too many requests",
-  "quota exceeded",
-  "quota_exceeded",
-  "quotaexceeded",
-  "quota error",
-  "quotaerror",
-  "quota_error",
-  "exceeded your quota",
-  "out of quota",
-  "insufficient quota",
-  "check quota",
-  "usage limit",
-  "daily limit exceeded"
-];
-function isReadonlyToolDescriptor(t) {
-  if (!t?.name)
-    return false;
-  const tokens = t.name.toUpperCase().split(/[^A-Z0-9]+/).filter(Boolean);
-  const hasReadVerb = tokens.some((tok) => READONLY_VERB_TOKENS.includes(tok));
-  if (!hasReadVerb)
-    return false;
-  const required = t.inputSchema?.required ?? [];
-  return !(Array.isArray(required) && required.length > 0);
+    const body = await res.json();
+    const member = typeof body === "object" && body !== null && !Array.isArray(body) ? body : null;
+    const id = member?.id;
+    if (typeof id !== "number" && !(typeof id === "string" && id.trim() !== "")) {
+      return { status: "down", message: "Sportsyear returned no member account for this API key" };
+    }
+    const label = typeof member?.organisation === "string" && member.organisation.trim() !== "" ? member.organisation.trim() : `member ${String(id)}`;
+    return { status: "ok", message: `Reached Sportsyear as ${redactSecret(redactSecret(label, String(key)), encoded)}` };
+  } catch (err) {
+    const outcome = networkOutcome(err, String(key));
+    return outcome.message === void 0 ? outcome : { ...outcome, message: redactSecret(outcome.message, encoded) };
+  }
 }
-function pickSafeReadonlyTool(tools) {
-  for (const t of tools) {
-    if (isReadonlyToolDescriptor(t))
-      return t.name;
+async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch) {
+  switch (definitionId) {
+    case "linear":
+      return probeLinear(credentials, fetchImpl);
+    case "buffer":
+      return probeBuffer(credentials, fetchImpl);
+    case "vercel":
+      return probeVercel(credentials, fetchImpl);
+    case "higgsfield":
+      return probeHiggsfield(credentials, fetchImpl);
+    case "sportsyear":
+      return probeSportsyear(credentials, fetchImpl);
+    case "google-workspace":
+      return probeBearerJson("https://www.googleapis.com/oauth2/v2/userinfo", credentials, fetchImpl, (body) => {
+        const info = body;
+        return { status: "ok", message: `Connected as ${info.name ?? info.email ?? "unknown"}` };
+      });
+    case "xero":
+      return probeBearerJson("https://api.xero.com/connections", credentials, fetchImpl, (body) => {
+        const conns = body ?? [];
+        if (!conns.length)
+          return { status: "down", message: "No Xero organisations connected" };
+        return { status: "ok", message: `Connected to ${conns[0]?.tenantName ?? "Xero"}` };
+      });
+    case "linkedin-ads":
+      return probeBearerJson("https://api.linkedin.com/v2/userinfo", credentials, fetchImpl, (body) => {
+        const user = body;
+        return { status: "ok", message: `Connected as ${user.name ?? user.email ?? "unknown"}` };
+      });
+    case "v0":
+      return probeBearerJson("https://api.v0.dev/v1/user", credentials, fetchImpl, (body) => {
+        const user = body;
+        return { status: "ok", message: `Connected as ${user.name ?? user.email ?? "unknown"}` };
+      });
+    case "sprout-social":
+      return probeBearerJson("https://api.sproutsocial.com/v1/metadata/client", credentials, fetchImpl, (body) => {
+        const data = body?.data;
+        const clients = Array.isArray(data) ? data.filter((row) => {
+          if (typeof row !== "object" || row === null)
+            return false;
+          const id = row.customer_id;
+          return typeof id === "string" || typeof id === "number";
+        }) : [];
+        if (!clients.length) {
+          return { status: "down", message: "Sprout Social returned no usable client account for this token" };
+        }
+        return {
+          status: "ok",
+          message: `Reached Sprout Social \u2014 ${clients.length} client account(s), incl. ${clients[0]?.name ?? "unnamed"}`
+        };
+      });
+    case "github":
+      return probeBearerJson("https://api.github.com/user", credentials, fetchImpl, (body) => {
+        const u = body;
+        return { status: "ok", message: `Reached GitHub as ${u.login ?? u.name ?? "unknown"}` };
+      }, { "User-Agent": "augmented-team-connectivity-probe", "X-GitHub-Api-Version": "2026-03-10" });
+    default:
+      return null;
   }
-  return null;
 }
-function resolveProbeTool(tools, override) {
-  const requested = override?.tool?.trim();
-  if (!requested) {
-    return { toolName: pickSafeReadonlyTool(tools), args: {} };
-  }
-  const match = tools.find((t) => t?.name === requested);
-  if (!match) {
-    return { toolName: pickSafeReadonlyTool(tools), args: {}, fallback: "seed-drift", requestedTool: requested };
-  }
-  if (!isReadonlyToolDescriptor(match)) {
-    return { toolName: pickSafeReadonlyTool(tools), args: {}, fallback: "seed-invalid", requestedTool: requested };
-  }
-  return { toolName: requested, args: override?.args ?? {}, requestedTool: requested };
-}
-function isAccountResolutionError(message) {
-  const m = message.toLowerCase();
-  return ACCOUNT_RESOLUTION_ERROR_PATTERNS.some((p2) => m.includes(p2));
-}
-function isUpstreamAuthError(message) {
-  const m = message.toLowerCase();
-  if (UPSTREAM_AUTH_ERROR_PATTERNS.some((p2) => m.includes(p2)))
-    return true;
-  if (/\b(401|403)\s+client error/.test(m))
-    return true;
-  return /(status(?:_?code)?|http_?status(?:_code)?|mercury_last_http_status_code)["'\\\s]*[:=]["'\\\s]*(401|403)\b/.test(m);
-}
-function isComposioFailureEnvelope(text) {
-  return /["'\\]*(successful|successfull)["'\\\s]*:\s*false\b/i.test(text);
-}
-function isSiteResolutionError(message) {
-  const m = message.toLowerCase();
-  return SITE_RESOLUTION_ERROR_PATTERNS.some((p2) => m.includes(p2));
-}
-function isScopeDeficitError(message) {
-  const m = message.toLowerCase();
-  if (SCOPE_DEFICIT_ERROR_PATTERNS.some((p2) => m.includes(p2)))
-    return true;
-  return m.includes("scope") && ["doesn't have", "does not have", "not have the", "not granted", "lacks the", "not authorized for"].some((p2) => m.includes(p2));
-}
-function isQuotaExhaustedError(message) {
-  const m = message.toLowerCase();
-  if (QUOTA_EXHAUSTED_ERROR_PATTERNS.some((p2) => m.includes(p2)))
-    return true;
-  if (/\b429\s+client error/.test(m))
-    return true;
-  return /(status(?:_?code)?|http_?status(?:_code)?|mercury_last_http_status_code|["'\\]code)["'\\\s]*[:=]["'\\\s]*429\b/.test(m);
-}
-function extractRetryAfterSeconds(message) {
-  const m = message.toLowerCase();
-  const patterns = [
-    /retry\s+in\s+(\d+)\s*(?:s\b|sec\b|secs\b|second)/,
-    /retry[-_ ]?after["'\\\s]*[:=]["'\\\s]*(\d+)/,
-    /retry_?delay["'\\\s]*[:=]["'\\\s]*"?(\d+)s?/
-  ];
-  for (const re of patterns) {
-    const hit = re.exec(m);
-    if (!hit?.[1])
-      continue;
-    const seconds = Number(hit[1]);
-    if (Number.isFinite(seconds) && seconds > 0)
-      return seconds;
-  }
-  return null;
-}
-function formatRetryWindow(seconds) {
-  if (seconds < 90)
-    return `${seconds} seconds`;
-  const minutes = seconds / 60;
-  if (minutes < 90)
-    return `about ${Math.round(minutes)} minutes`;
-  const hours = minutes / 60;
-  if (hours < 24)
-    return `about ${Math.round(hours * 10) / 10} hours`;
-  return `about ${Math.round(hours / 24 * 10) / 10} days`;
-}
-function classifyToolCallFailure(text) {
-  if (isAccountResolutionError(text))
-    return "account";
-  if (isQuotaExhaustedError(text))
-    return "quota";
-  if (isScopeDeficitError(text))
-    return "scope";
-  if (isUpstreamAuthError(text))
-    return "auth";
-  if (isSiteResolutionError(text))
-    return "site";
-  return "benign";
+
+// ../../packages/core/dist/integrations/mcp-http-probe.js
+var MCP_ACCEPT = "application/json, text/event-stream";
+var DEFAULT_TIMEOUT_MS = 1e4;
+function isRpcEnvelopeFor(msg, expectedId) {
+  return typeof msg === "object" && msg !== null && ("result" in msg || "error" in msg) && msg["id"] === expectedId;
 }
-async function parseRpc2(res, expectedId) {
+async function parseRpc(res, expectedId) {
   const ct = res.headers.get("content-type") ?? "";
   if (ct.includes("text/event-stream")) {
     const text = await res.text();
     let dataLines = [];
+    const tryFrame = () => {
+      if (dataLines.length === 0)
+        return null;
+      try {
+        const msg2 = JSON.parse(dataLines.join("\n"));
+        if (isRpcEnvelopeFor(msg2, expectedId))
+          return msg2;
+      } catch {
+      }
+      return null;
+    };
     for (const rawLine of text.split(/\r?\n/)) {
       if (rawLine.startsWith("data:")) {
         dataLines.push(rawLine.slice(5).trimStart());
         continue;
       }
-      if (rawLine === "" && dataLines.length > 0) {
-        try {
-          const msg2 = JSON.parse(dataLines.join("\n"));
-          if (("result" in msg2 || "error" in msg2) && msg2["id"] === expectedId)
-            return msg2;
-        } catch {
-        }
+      if (rawLine === "") {
+        const frame = tryFrame();
+        if (frame)
+          return frame;
         dataLines = [];
       }
     }
-    return null;
+    return tryFrame();
   }
   const msg = await res.json().catch(() => null);
-  if (msg && ("result" in msg || "error" in msg) && msg["id"] === expectedId)
-    return msg;
-  return null;
+  return isRpcEnvelopeFor(msg, expectedId) ? msg : null;
 }
-async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
-  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+function httpStatusOutcome(status, step) {
+  const graded = statusForHttp(status);
+  const cause = causeForHttp(status);
+  if (status === 401 || status === 403) {
+    return { status: graded, cause, message: `MCP ${step} unauthorized (${status}) \u2014 reconnect required` };
+  }
+  if (status === 429) {
+    return {
+      status: graded,
+      cause,
+      message: `MCP ${step} rate limited (${status}) \u2014 not a credential failure`
+    };
+  }
+  return { status: graded, cause, message: `MCP ${step} returned ${status}` };
+}
+async function probeMcpHttp(config, fetchImpl = fetch) {
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const baseHeaders = {
     ...config.headers ?? {},
     "Content-Type": "application/json",
-    Accept: MCP_ACCEPT2
+    Accept: MCP_ACCEPT
   };
   try {
     const initRes = await fetchImpl(config.url, {
@@ -11647,16 +11364,22 @@ async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
         params: {
           protocolVersion: "2025-03-26",
           capabilities: {},
-          clientInfo: { name: "augmented-toolcall-probe", version: "1.0.0" }
+          clientInfo: { name: "augmented-connectivity-probe", version: "1.0.0" }
         }
       }),
       signal: AbortSignal.timeout(timeoutMs)
     });
-    if (!initRes.ok) {
-      return initRes.status >= 500 ? { status: "transient_error", message: `MCP initialize returned ${initRes.status}` } : null;
-    }
+    if (!initRes.ok)
+      return httpStatusOutcome(initRes.status, "initialize");
     const sessionId = initRes.headers.get("mcp-session-id");
-    await parseRpc2(initRes, 1);
+    const initRpc = await parseRpc(initRes, 1);
+    if (!initRpc) {
+      return { status: "down", message: "MCP initialize returned a non-JSON-RPC response \u2014 not an MCP server" };
+    }
+    if ("error" in initRpc) {
+      const err = initRpc["error"];
+      return { status: "down", message: `MCP initialize error: ${err?.message ?? "unknown"}` };
+    }
     const sessionHeaders = { ...baseHeaders, ...sessionId ? { "Mcp-Session-Id": sessionId } : {} };
     const initializedRes = await fetchImpl(config.url, {
       method: "POST",
@@ -11664,6 +11387,8 @@ async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
       body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
       signal: AbortSignal.timeout(5e3)
     });
+    if (!initializedRes.ok)
+      return httpStatusOutcome(initializedRes.status, "initialized");
     await initializedRes.text().catch(() => "");
     const listRes = await fetchImpl(config.url, {
       method: "POST",
@@ -11671,430 +11396,719 @@ async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
       body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" }),
       signal: AbortSignal.timeout(timeoutMs)
     });
-    if (!listRes.ok) {
-      return listRes.status >= 500 ? { status: "transient_error", message: `MCP tools/list returned ${listRes.status}` } : null;
-    }
-    const listRpc = await parseRpc2(listRes, 2);
-    const tools = listRpc?.["result"]?.tools ?? [];
-    const resolved = resolveProbeTool(tools, { tool: config.toolName, args: config.toolArgs });
-    const toolName = resolved.toolName;
-    if (!toolName)
-      return null;
-    const baseDetails = {
-      tool: toolName,
-      ...resolved.fallback ? { override_fallback: resolved.fallback, requested_tool: resolved.requestedTool } : {}
-    };
-    const callRes = await fetchImpl(config.url, {
-      method: "POST",
-      headers: sessionHeaders,
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 3,
-        method: "tools/call",
-        params: { name: toolName, arguments: resolved.args }
-      }),
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!callRes.ok) {
-      return callRes.status >= 500 ? { status: "transient_error", message: `MCP tools/call returned ${callRes.status}` } : null;
+    if (!listRes.ok)
+      return httpStatusOutcome(listRes.status, "tools/list");
+    const rpc = await parseRpc(listRes, 2);
+    if (!rpc) {
+      return { status: "down", message: "MCP tools/list returned a non-JSON-RPC response \u2014 not an MCP server" };
     }
-    const callRpc = await parseRpc2(callRes, 3);
-    {
-      const errText = callRpc?.["error"]?.message;
-      const resContent = callRpc?.["result"]?.content;
-      const raw = errText ?? (resContent ?? []).map((c) => c.text ?? "").join(" ").trim();
-      if (raw)
-        baseDetails.response = raw.length > 2e3 ? `${raw.slice(0, 2e3)}\u2026` : raw;
+    if ("error" in rpc) {
+      const err = rpc["error"];
+      return { status: "down", message: `MCP tools/list error: ${err?.message ?? "unknown"}` };
     }
-    const rpcErrMsg = callRpc && "error" in callRpc ? callRpc["error"]?.message ?? "" : "";
-    const result = callRpc?.["result"];
-    const contentText2 = (result?.content ?? []).map((c) => c.text ?? "").join(" ").trim();
-    const failed = Boolean(rpcErrMsg) || Boolean(result?.isError) || isComposioFailureEnvelope(contentText2);
-    if (failed) {
-      const failureText = [rpcErrMsg, contentText2].filter(Boolean).join(" ");
-      const snippet = failureText.length > 200 ? `${failureText.slice(0, 200)}\u2026` : failureText;
-      const kind = classifyToolCallFailure(failureText);
-      if (kind === "account") {
-        return {
-          status: "down",
-          message: `Live tool call '${toolName}' failed to resolve the connected account: ${snippet}`,
-          details: baseDetails
-        };
+    const result = rpc["result"];
+    const toolCount = Array.isArray(result?.tools) ? result.tools.length : void 0;
+    const testTool = config.connectivityTest?.tool;
+    if (testTool) {
+      const rawArgs = config.connectivityTest?.args;
+      const toolArgs = rawArgs && !Array.isArray(rawArgs) ? rawArgs : {};
+      const callRes = await fetchImpl(config.url, {
+        method: "POST",
+        headers: sessionHeaders,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 3,
+          method: "tools/call",
+          params: { name: testTool, arguments: toolArgs }
+        }),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!callRes.ok)
+        return httpStatusOutcome(callRes.status, `tools/call ${testTool}`);
+      const callRpc = await parseRpc(callRes, 3);
+      if (!callRpc) {
+        return { status: "down", message: `MCP tools/call ${testTool} returned a non-JSON-RPC response \u2014 not an MCP server` };
       }
-      if (kind === "quota") {
-        const retryAfterSeconds = extractRetryAfterSeconds(failureText);
-        const retryPhrase = retryAfterSeconds ? ` The provider says to retry in ${formatRetryWindow(retryAfterSeconds)}.` : "";
-        return {
-          status: "degraded",
-          message: `Live tool call '${toolName}' reached the provider and was refused: a quota or rate limit is exhausted. The connection itself is valid \u2014 do NOT reconnect, this resolves when the window resets.${retryPhrase} ${snippet}`,
-          details: {
-            ...baseDetails,
-            reason: "quota_exhausted",
-            ...retryAfterSeconds ? { retry_after_seconds: retryAfterSeconds } : {}
-          }
-        };
+      if ("error" in callRpc) {
+        const err = callRpc["error"];
+        return { status: "down", message: `MCP tools/call ${testTool} error: ${err?.message ?? "unknown"}` };
       }
-      if (kind === "scope") {
-        return {
-          status: "degraded",
-          message: `Live tool call '${toolName}' was refused for a missing permission \u2014 the connection is valid, but its app/token isn't granted the scope this tool needs. Grant the required scope in the provider app and re-authorise (this is NOT a reconnect): ${snippet}`,
-          details: { ...baseDetails, reason: "scope_deficit" }
-        };
-      }
-      if (kind === "auth") {
-        return {
-          status: "down",
-          message: `Live tool call '${toolName}' was rejected by the provider \u2014 the connection's credential is no longer valid (reconnect required): ${snippet}`,
-          details: { ...baseDetails, reason: "upstream_auth_rejected" }
-        };
-      }
-      if (kind === "site") {
-        return {
-          status: "down",
-          message: `Live tool call '${toolName}' couldn't reach the provider's site - the connection has no valid site URL (reconnect and make sure a site/workspace is granted): ${snippet}`,
-          details: { ...baseDetails, reason: "site_unresolved" }
-        };
+      const callResult = callRpc["result"];
+      if (callResult?.isError === true) {
+        return { status: "down", message: `MCP tool ${testTool} returned an error result` };
       }
       return {
         status: "ok",
-        message: `Live tool call '${toolName}' resolved the account (tool error: ${snippet})`,
-        details: { ...baseDetails, tool_error: snippet }
+        message: `${testTool} succeeded`,
+        details: { ...toolCount !== void 0 ? { toolCount } : {}, testTool }
       };
     }
-    return { status: "ok", message: `Live tool call '${toolName}' resolved the connected account`, details: baseDetails };
+    return handshakeToolsListOutcome(toolCount);
   } catch (err) {
     const isAbort = err?.name === "TimeoutError" || err?.name === "AbortError";
     return {
       status: "transient_error",
-      message: isAbort ? `MCP tool-call probe timed out after ${timeoutMs / 1e3}s` : `MCP tool-call probe failed: ${err.message}`
+      // ENG-10574: a timeout, DNS failure or refused connection - "network
+      // failure, DNS, or our own timeout". Same call `networkOutcome` makes for
+      // the central lane. Not vendor-side, so escalation is unchanged.
+      cause: "unreachable",
+      message: isAbort ? `MCP handshake timed out after ${timeoutMs / 1e3}s` : `MCP handshake failed: ${err.message}`
+    };
+  }
+}
+
+// ../../packages/core/dist/integrations/composio-fetch.js
+var COMPOSIO_API_BASE = "https://backend.composio.dev";
+var transportResolver = null;
+async function getComposioTransport() {
+  if (!transportResolver)
+    return null;
+  try {
+    return await transportResolver();
+  } catch (err) {
+    console.error("[composio] transport resolver failed; using direct egress", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return null;
+  }
+}
+
+// ../../packages/core/dist/integrations/composio-linkage.js
+function assessAuthConfigLinkage(input) {
+  const { accountAuthConfigId, serverAuthConfigIds, serverId } = input;
+  const serverLabel = serverId ? ` (${serverId})` : "";
+  if (serverAuthConfigIds == null || !accountAuthConfigId) {
+    return {
+      linked: null,
+      message: "auth_config linkage not verified \u2014 " + (serverAuthConfigIds == null ? "couldn't read the wired MCP server's auth config binding" : "Composio returned no auth_config for the connected account"),
+      details: {
+        accountAuthConfigId: accountAuthConfigId ?? null,
+        serverAuthConfigIds: serverAuthConfigIds ?? null,
+        serverId: serverId ?? null
+      }
     };
   }
+  if (serverAuthConfigIds.length === 0) {
+    return {
+      linked: false,
+      message: `The agent's wired MCP server${serverLabel} has no auth config bound, so it cannot resolve the connected account (bound to auth_config ${accountAuthConfigId}) \u2014 reconnect/rebind required.`,
+      details: { accountAuthConfigId, serverAuthConfigIds, serverId: serverId ?? null }
+    };
+  }
+  if (serverAuthConfigIds.includes(accountAuthConfigId)) {
+    return {
+      linked: true,
+      message: `Connected account's auth_config (${accountAuthConfigId}) matches the wired MCP server binding.`,
+      details: { accountAuthConfigId, serverAuthConfigIds, serverId: serverId ?? null }
+    };
+  }
+  return {
+    linked: false,
+    message: `The connected account is bound to auth_config ${accountAuthConfigId}, but the agent's wired MCP server${serverLabel} resolves auth_config(s) [${serverAuthConfigIds.join(", ")}] \u2014 tool calls will fail with "No connected account found". Reconnect/rebind required.`,
+    details: { accountAuthConfigId, serverAuthConfigIds, serverId: serverId ?? null }
+  };
+}
+
+// ../../packages/core/dist/integrations/composio-account-probe.js
+var PROBE_TIMEOUT_MS2 = 1e4;
+var BODY_SNIPPET_MAX = 300;
+async function readErrorBodySnippet(res, apiKey) {
+  let text;
+  try {
+    text = await res.text();
+  } catch {
+    return void 0;
+  }
+  const redacted = apiKey ? text.split(apiKey).join("\xABredacted\xBB") : text;
+  const trimmed = redacted.trim();
+  if (!trimmed)
+    return void 0;
+  return trimmed.length > BODY_SNIPPET_MAX ? `${trimmed.slice(0, BODY_SNIPPET_MAX)}\u2026` : trimmed;
+}
+var NULL_BODY_STATUSES2 = /* @__PURE__ */ new Set([101, 204, 205, 304]);
+var BODY_MAX_BYTES = 1024 * 1024;
+async function timedFetch2(fetchImpl, url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS2);
+  try {
+    const res = await fetchImpl(url, { ...init, signal: controller.signal });
+    if (NULL_BODY_STATUSES2.has(res.status))
+      return res;
+    const body = await readBoundedBody(res, controller);
+    return new Response(body, {
+      status: res.status,
+      statusText: res.statusText,
+      headers: res.headers
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function readBoundedBody(res, controller) {
+  const stream = res.body;
+  if (!stream)
+    return await res.text();
+  const reader = stream.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done)
+      break;
+    if (!value)
+      continue;
+    total += value.byteLength;
+    if (total > BODY_MAX_BYTES) {
+      controller.abort();
+      await reader.cancel().catch(() => {
+      });
+      throw new Error(`Composio response body exceeded ${BODY_MAX_BYTES} bytes`);
+    }
+    chunks.push(value);
+  }
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(merged);
+}
+async function probeComposioAccount(params, fetchImpl) {
+  const impl = fetchImpl ?? await getComposioTransport() ?? fetch;
+  const { connectedAccountId, apiKey, expectedUserId } = params;
+  const base = params.apiBase ?? COMPOSIO_API_BASE;
+  if (!connectedAccountId) {
+    return {
+      status: "down",
+      message: "No connected account recorded \u2014 reconnect required"
+    };
+  }
+  if (!apiKey || !expectedUserId) {
+    return {
+      status: "transient_error",
+      message: "Composio probe missing api key or expected user_id"
+    };
+  }
+  let res;
+  try {
+    res = await timedFetch2(impl, `${base}/api/v3/connected_accounts/${encodeURIComponent(connectedAccountId)}`, { headers: { "x-api-key": apiKey } });
+  } catch (err) {
+    const isAbort = err?.name === "AbortError";
+    return {
+      status: "transient_error",
+      message: isAbort ? `Composio probe timed out after ${PROBE_TIMEOUT_MS2 / 1e3}s` : `Composio probe failed: ${err.message}`
+    };
+  }
+  if (!res.ok) {
+    if (res.status >= 500) {
+      return {
+        status: "transient_error",
+        message: `Composio unreachable (HTTP ${res.status}) \u2014 retrying`,
+        details: { connectedAccountId, httpStatus: res.status }
+      };
+    }
+    if (res.status === 401 || res.status === 403) {
+      const body = await readErrorBodySnippet(res, apiKey);
+      return {
+        status: "unverified",
+        cause: "access_restricted",
+        message: `Composio refused our API key (HTTP ${res.status}) \u2014 access restriction on our side, not a problem with this account; do not reconnect` + (body ? `. Composio said: ${body}` : ""),
+        details: {
+          connectedAccountId,
+          httpStatus: res.status,
+          ...body ? { responseBody: body } : {}
+        }
+      };
+    }
+    return {
+      status: "down",
+      message: `Composio account ${connectedAccountId} not found (HTTP ${res.status}) \u2014 reconnect required`,
+      details: { connectedAccountId, httpStatus: res.status }
+    };
+  }
+  let data;
+  try {
+    data = await res.json();
+  } catch (err) {
+    return {
+      status: "transient_error",
+      message: `Composio probe response unparseable: ${err.message}`
+    };
+  }
+  const accountStatus = data.status ?? "unknown";
+  if (accountStatus !== "ACTIVE") {
+    return {
+      status: "down",
+      message: `Composio account ${connectedAccountId} status=${accountStatus} \u2014 reconnect required`,
+      details: { connectedAccountId, status: accountStatus, boundUserId: data.user_id ?? null }
+    };
+  }
+  const boundUserId = data.user_id;
+  if (!boundUserId) {
+    return {
+      status: "down",
+      message: `Composio account ${connectedAccountId} is ACTIVE but returned no user_id binding \u2014 runtime queries as '${expectedUserId}', so tool calls can't be confirmed`,
+      details: { connectedAccountId, status: accountStatus, boundUserId: null, expectedUserId }
+    };
+  }
+  if (boundUserId !== expectedUserId) {
+    return {
+      status: "down",
+      message: `Composio account ${connectedAccountId} is bound to user_id '${boundUserId}' but the agent runtime queries as '${expectedUserId}' \u2014 tool calls will fail. Reconnect to bind correctly.`,
+      details: { connectedAccountId, status: accountStatus, boundUserId, expectedUserId }
+    };
+  }
+  const accountAuthConfigId = data.auth_config_id ?? data.auth_config?.id;
+  if (params.serverId) {
+    const serverAuthConfigIds = await fetchServerAuthConfigIds(impl, base, params.serverId, apiKey);
+    const linkage = assessAuthConfigLinkage({
+      accountAuthConfigId,
+      serverAuthConfigIds,
+      serverId: params.serverId
+    });
+    if (linkage.linked === false) {
+      return {
+        status: "down",
+        message: linkage.message,
+        details: { connectedAccountId, status: accountStatus, boundUserId, ...linkage.details }
+      };
+    }
+  }
+  return {
+    status: "ok",
+    message: `Connected (account ${connectedAccountId}, status=ACTIVE)`,
+    details: {
+      connectedAccountId,
+      status: accountStatus,
+      boundUserId,
+      ...accountAuthConfigId ? { authConfigId: accountAuthConfigId } : {}
+    }
+  };
+}
+async function fetchServerAuthConfigIds(fetchImpl, base, serverId, apiKey) {
+  let res;
+  try {
+    res = await timedFetch2(fetchImpl, `${base}/api/v3/mcp/${encodeURIComponent(serverId)}`, { headers: { "x-api-key": apiKey } });
+  } catch {
+    return null;
+  }
+  if (!res.ok)
+    return null;
+  try {
+    const data = await res.json();
+    return data.auth_config_ids ?? data.auth_configs?.map((c) => c.id).filter((id) => typeof id === "string" && id.length > 0) ?? [];
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/core/dist/integrations/composio-approved-egress.json
+var composio_approved_egress_default = {
+  $comment: [
+    "ADR-0032 Part 3, gate item 2 + gate item 3 (ENG-9684). THE single recorded source",
+    "for the addresses Composio's per-key IP allowlist is expected to hold. Read by BOTH",
+    "scripts/fleet-egress-enum.sh (the operator's pre-arming instrument) and the",
+    "ComposioEgressAddressDrift cron (the between-armings watch). They must agree, which",
+    "is why neither carries its own copy.",
+    "",
+    "WHY A REPO FILE AND NOT SSM. Composio's allowlist has no read API, so its contents",
+    "can never be queried - only inferred from a refusal. This file is therefore not a",
+    "cache of vendor state; it is a DECLARATION of what a human pasted into a dashboard.",
+    "A PR is the right ceremony for changing a security boundary nobody can read back.",
+    "SSM would also hit registerCron's five-parameter grant scope (ENG-9940), where a",
+    "sixth parameter fails silently.",
+    "",
+    "THE COMPARISON IS ON `ip` AND NOTHING ELSE. `seenAsGateway` is informational. A NAT",
+    "rebuild that re-adopts the same EIP keeps egress correct while changing the gateway",
+    "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
+    "EIP adoption exists to create.",
+    "",
+    "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
+    "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
+    "address: add it here in the same change that lands it, or the detector correctly",
+    "reports that hosts are leaving from an address no key allows. Do not loosen the check."
+  ],
+  account: "711726113003",
+  homeRegion: "ap-southeast-2",
+  addresses: [
+    {
+      ip: "32.236.6.24",
+      stage: "prod",
+      seenAsGateway: "nat-00a3dac969c0641a6",
+      note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
+    },
+    {
+      ip: "15.135.204.192",
+      stage: "dev",
+      seenAsGateway: "nat-01122e6efaf4c4eaa",
+      note: "Dev-stage hosts NAT, same account. 2 instances measured 2026-09-12; their host rows live in the dev Supabase project."
+    }
+  ]
+};
+
+// ../../packages/core/dist/integrations/composio-approved-egress.js
+var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
+var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
+var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+
+// ../../packages/core/dist/integrations/composio-tool-call-probe.js
+var MCP_ACCEPT2 = "application/json, text/event-stream";
+var DEFAULT_TIMEOUT_MS2 = 1e4;
+var READONLY_VERB_TOKENS = [
+  "LIST",
+  "GET",
+  "FIND",
+  "SEARCH",
+  "FETCH",
+  "COUNT",
+  "RETRIEVE",
+  "READ"
+];
+var ACCOUNT_RESOLUTION_ERROR_PATTERNS = [
+  "no connected account",
+  "connected account not found",
+  "no account found",
+  "could not be resolved",
+  "auth config",
+  "no connection found"
+];
+var UPSTREAM_AUTH_ERROR_PATTERNS = [
+  "authentication required",
+  "not authenticated",
+  "unauthorized",
+  "authentication_error",
+  "authentication error",
+  "invalid authentication",
+  "invalid credentials",
+  "invalid api key",
+  "invalid access token",
+  "token expired",
+  "token has expired",
+  "expired access token",
+  "expired credentials",
+  "permission denied",
+  "access denied",
+  "forbidden"
+];
+var SITE_RESOLUTION_ERROR_PATTERNS = [
+  "dns resolution failed",
+  "getaddrinfo",
+  "enotfound",
+  "could not resolve host",
+  "name resolution",
+  "name not resolved"
+];
+var SCOPE_DEFICIT_ERROR_PATTERNS = [
+  "insufficient_scope",
+  "insufficient scope",
+  "insufficient permission",
+  "missing scope",
+  "required scope",
+  "requires the scope",
+  "requires the following scope",
+  "scope is required",
+  "access scope",
+  "oauth scope",
+  // Shopify custom-app specifics.
+  "read_content",
+  "write_content",
+  "sales channel is not enabled"
+];
+var QUOTA_EXHAUSTED_ERROR_PATTERNS = [
+  "resource_exhausted",
+  "resource has been exhausted",
+  "rate limit",
+  "rate_limit",
+  "ratelimit",
+  "ratescope",
+  "rate_scope",
+  "too many requests",
+  "quota exceeded",
+  "quota_exceeded",
+  "quotaexceeded",
+  "quota error",
+  "quotaerror",
+  "quota_error",
+  "exceeded your quota",
+  "out of quota",
+  "insufficient quota",
+  "check quota",
+  "usage limit",
+  "daily limit exceeded"
+];
+function isReadonlyToolDescriptor(t) {
+  if (!t?.name)
+    return false;
+  const tokens = t.name.toUpperCase().split(/[^A-Z0-9]+/).filter(Boolean);
+  const hasReadVerb = tokens.some((tok) => READONLY_VERB_TOKENS.includes(tok));
+  if (!hasReadVerb)
+    return false;
+  const required = t.inputSchema?.required ?? [];
+  return !(Array.isArray(required) && required.length > 0);
+}
+function pickSafeReadonlyTool(tools) {
+  for (const t of tools) {
+    if (isReadonlyToolDescriptor(t))
+      return t.name;
+  }
+  return null;
 }
-
-// ../../packages/core/dist/integrations/connectivity-http-probes.js
-var PROBE_TIMEOUT_MS2 = 1e4;
-var NULL_BODY_STATUSES2 = /* @__PURE__ */ new Set([101, 204, 205, 304]);
-async function timedFetch2(fetchImpl, url, init) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS2);
-  try {
-    const res = await fetchImpl(url, { ...init, signal: controller.signal });
-    if (NULL_BODY_STATUSES2.has(res.status))
-      return res;
-    const body = await res.text();
-    return new Response(body, {
-      status: res.status,
-      statusText: res.statusText,
-      headers: res.headers
-    });
-  } finally {
-    clearTimeout(timer);
+function resolveProbeTool(tools, override) {
+  const requested = override?.tool?.trim();
+  if (!requested) {
+    return { toolName: pickSafeReadonlyTool(tools), args: {} };
   }
+  const match = tools.find((t) => t?.name === requested);
+  if (!match) {
+    return { toolName: pickSafeReadonlyTool(tools), args: {}, fallback: "seed-drift", requestedTool: requested };
+  }
+  if (!isReadonlyToolDescriptor(match)) {
+    return { toolName: pickSafeReadonlyTool(tools), args: {}, fallback: "seed-invalid", requestedTool: requested };
+  }
+  return { toolName: requested, args: override?.args ?? {}, requestedTool: requested };
 }
-function isRateLimited(res) {
-  const retryAfter = res.headers.get("retry-after");
-  if (retryAfter !== null && retryAfter.trim() !== "")
-    return true;
-  const remaining = res.headers.get("x-ratelimit-remaining");
-  if (remaining === null || remaining.trim() === "")
-    return false;
-  return Number(remaining) === 0;
+function isAccountResolutionError(message) {
+  const m = message.toLowerCase();
+  return ACCOUNT_RESOLUTION_ERROR_PATTERNS.some((p2) => m.includes(p2));
 }
-function statusForHttp(httpStatus, opts) {
-  if (httpStatus === 429)
-    return "transient_error";
-  if (httpStatus === 403 && opts?.rateLimited)
-    return "transient_error";
-  if (httpStatus === 401 || httpStatus === 403)
-    return "down";
-  if (httpStatus >= 500)
-    return "transient_error";
-  return "down";
+function isUpstreamAuthError(message) {
+  const m = message.toLowerCase();
+  if (UPSTREAM_AUTH_ERROR_PATTERNS.some((p2) => m.includes(p2)))
+    return true;
+  if (/\b(401|403)\s+client error/.test(m))
+    return true;
+  return /(status(?:_?code)?|http_?status(?:_code)?|mercury_last_http_status_code)["'\\\s]*[:=]["'\\\s]*(401|403)\b/.test(m);
 }
-function causeForHttp(httpStatus, opts) {
-  if (httpStatus === 429)
-    return "rate_limited";
-  if (httpStatus === 403 && opts?.rateLimited)
-    return "rate_limited";
-  if (httpStatus === 401 || httpStatus === 403)
-    return "auth_rejected";
-  if (httpStatus >= 500)
-    return "server_error";
-  return "semantic";
+function isComposioFailureEnvelope(text) {
+  return /["'\\]*(successful|successfull)["'\\\s]*:\s*false\b/i.test(text);
 }
-function rateLimitMessage(provider, httpStatus) {
-  const subject = provider ? `${provider} rate limit` : "Rate limited by the provider";
-  return `${subject} (${httpStatus}) \u2014 not a credential failure`;
+function isSiteResolutionError(message) {
+  const m = message.toLowerCase();
+  return SITE_RESOLUTION_ERROR_PATTERNS.some((p2) => m.includes(p2));
 }
-function redactSecret(message, secret) {
-  if (typeof secret !== "string" || secret.length < 4)
-    return message;
-  return message.split(secret).join("[redacted]");
+function isScopeDeficitError(message) {
+  const m = message.toLowerCase();
+  if (SCOPE_DEFICIT_ERROR_PATTERNS.some((p2) => m.includes(p2)))
+    return true;
+  return m.includes("scope") && ["doesn't have", "does not have", "not have the", "not granted", "lacks the", "not authorized for"].some((p2) => m.includes(p2));
 }
-function networkOutcome(err, secret) {
-  const isAbort = err?.name === "AbortError";
-  const message = isAbort ? `Connection timed out after ${PROBE_TIMEOUT_MS2 / 1e3}s` : `Connection failed: ${err.message}`;
-  return { status: "transient_error", cause: "unreachable", message: redactSecret(message, secret) };
+function isQuotaExhaustedError(message) {
+  const m = message.toLowerCase();
+  if (QUOTA_EXHAUSTED_ERROR_PATTERNS.some((p2) => m.includes(p2)))
+    return true;
+  if (/\b429\s+client error/.test(m))
+    return true;
+  return /(status(?:_?code)?|http_?status(?:_code)?|mercury_last_http_status_code|["'\\]code)["'\\\s]*[:=]["'\\\s]*429\b/.test(m);
 }
-async function probeLinear(creds, fetchImpl) {
-  const key = creds.api_key ?? creds.access_token;
-  if (!key)
-    return { status: "down", message: "No Linear credential present" };
-  try {
-    const res = await timedFetch2(fetchImpl, "https://api.linear.app/graphql", {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: String(key) },
-      body: JSON.stringify({ query: "{ viewer { id name email } }" })
-    });
-    if (!res.ok) {
-      const rateLimited = isRateLimited(res);
-      const message = res.status === 429 || res.status === 403 && rateLimited ? rateLimitMessage("Linear", res.status) : `Linear API returned ${res.status}`;
-      return {
-        status: statusForHttp(res.status, { rateLimited }),
-        cause: causeForHttp(res.status, { rateLimited }),
-        message
-      };
-    }
-    const body = await res.json();
-    if (body.errors?.length)
-      return { status: "down", message: body.errors[0]?.message ?? "Unknown Linear error" };
-    const viewer = body.data?.viewer;
-    if (!viewer)
-      return { status: "down", message: "Invalid key \u2014 no viewer returned" };
-    return { status: "ok", message: `Connected as ${viewer.name ?? viewer.email ?? "unknown"}` };
-  } catch (err) {
-    return networkOutcome(err, String(key ?? ""));
+function extractRetryAfterSeconds(message) {
+  const m = message.toLowerCase();
+  const patterns = [
+    /retry\s+in\s+(\d+)\s*(?:s\b|sec\b|secs\b|second)/,
+    /retry[-_ ]?after["'\\\s]*[:=]["'\\\s]*(\d+)/,
+    /retry_?delay["'\\\s]*[:=]["'\\\s]*"?(\d+)s?/
+  ];
+  for (const re of patterns) {
+    const hit = re.exec(m);
+    if (!hit?.[1])
+      continue;
+    const seconds = Number(hit[1]);
+    if (Number.isFinite(seconds) && seconds > 0)
+      return seconds;
   }
+  return null;
 }
-async function probeBearerJson(url, creds, fetchImpl, interpret, extraHeaders) {
-  const token = creds.access_token ?? creds.api_key;
-  if (!token)
-    return { status: "down", message: "No credential present" };
-  try {
-    const res = await timedFetch2(fetchImpl, url, { headers: { Authorization: `Bearer ${token}`, ...extraHeaders } });
-    if (!res.ok) {
-      const rateLimited = isRateLimited(res);
-      const message = res.status === 401 ? "Token expired or revoked \u2014 reconnect required" : res.status === 429 || res.status === 403 && rateLimited ? rateLimitMessage(null, res.status) : `API returned ${res.status}`;
-      return {
-        status: statusForHttp(res.status, { rateLimited }),
-        cause: causeForHttp(res.status, { rateLimited }),
-        message
-      };
+function formatRetryWindow(seconds) {
+  if (seconds < 90)
+    return `${seconds} seconds`;
+  const minutes = seconds / 60;
+  if (minutes < 90)
+    return `about ${Math.round(minutes)} minutes`;
+  const hours = minutes / 60;
+  if (hours < 24)
+    return `about ${Math.round(hours * 10) / 10} hours`;
+  return `about ${Math.round(hours / 24 * 10) / 10} days`;
+}
+function classifyToolCallFailure(text) {
+  if (isAccountResolutionError(text))
+    return "account";
+  if (isQuotaExhaustedError(text))
+    return "quota";
+  if (isScopeDeficitError(text))
+    return "scope";
+  if (isUpstreamAuthError(text))
+    return "auth";
+  if (isSiteResolutionError(text))
+    return "site";
+  return "benign";
+}
+async function parseRpc2(res, expectedId) {
+  const ct = res.headers.get("content-type") ?? "";
+  if (ct.includes("text/event-stream")) {
+    const text = await res.text();
+    let dataLines = [];
+    for (const rawLine of text.split(/\r?\n/)) {
+      if (rawLine.startsWith("data:")) {
+        dataLines.push(rawLine.slice(5).trimStart());
+        continue;
+      }
+      if (rawLine === "" && dataLines.length > 0) {
+        try {
+          const msg2 = JSON.parse(dataLines.join("\n"));
+          if (("result" in msg2 || "error" in msg2) && msg2["id"] === expectedId)
+            return msg2;
+        } catch {
+        }
+        dataLines = [];
+      }
     }
-    return interpret(await res.json());
-  } catch (err) {
-    return networkOutcome(err, String(token ?? ""));
+    return null;
   }
+  const msg = await res.json().catch(() => null);
+  if (msg && ("result" in msg || "error" in msg) && msg["id"] === expectedId)
+    return msg;
+  return null;
 }
-async function probeBuffer(creds, fetchImpl) {
-  const key = creds.api_key ?? creds.access_token;
-  if (!key)
-    return { status: "down", message: "No Buffer credential present" };
+async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const baseHeaders = {
+    ...config.headers ?? {},
+    "Content-Type": "application/json",
+    Accept: MCP_ACCEPT2
+  };
   try {
-    const res = await timedFetch2(fetchImpl, "https://api.buffer.com", {
+    const initRes = await fetchImpl(config.url, {
       method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
-      body: JSON.stringify({ query: "{ account { organizations { id name } } }" })
+      headers: baseHeaders,
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-03-26",
+          capabilities: {},
+          clientInfo: { name: "augmented-toolcall-probe", version: "1.0.0" }
+        }
+      }),
+      signal: AbortSignal.timeout(timeoutMs)
     });
-    if (!res.ok) {
-      const rateLimited = isRateLimited(res);
-      const message = res.status === 401 ? (
-        // ENG-9809: name the mechanism, because the bare "expired or revoked" sent
-        // two investigations at the wrong thing. Buffer API keys carry a MANDATORY
-        // lifetime chosen at mint time — 7/30/60/90 days or 1 year, defaulting to
-        // 30 days, with no "never expires" option
-        // (support.buffer.com/article/984-how-to-create-your-buffer-api-key). So
-        // every Buffer install on the fleet is on a countdown, and expiry is the
-        // ordinary end of a key's life rather than a customer revoking one.
-        //
-        // All three causes are named, because this one branch answers every Buffer
-        // 401 — a key that lapsed, one that was revoked, and one that was simply
-        // mistyped ("Requests without a valid key will return a 401 Unauthorized",
-        // developers.buffer.com/guides/authentication.html). The status code alone
-        // cannot separate them, so naming expiry as the LIKELIER cause is supported;
-        // asserting it is not, and a message that omitted "invalid" would send
-        // someone who pasted the key wrong looking for an expiry date instead.
-        "Buffer API key expired, invalid, or revoked \u2014 reconnect required. Buffer keys expire by design (30-day default, 1-year maximum), so on a key that was working until now expiry is the likeliest of the three; pick 1 year when minting the replacement."
-      ) : res.status === 429 || res.status === 403 && rateLimited ? rateLimitMessage("Buffer", res.status) : `Buffer API returned ${res.status}`;
-      return {
-        status: statusForHttp(res.status, { rateLimited }),
-        cause: causeForHttp(res.status, { rateLimited }),
-        message
-      };
+    if (!initRes.ok) {
+      return initRes.status >= 500 ? { status: "transient_error", message: `MCP initialize returned ${initRes.status}` } : null;
     }
-    const body = await res.json();
-    if (body.errors?.length)
-      return { status: "down", message: body.errors[0]?.message ?? "Unknown Buffer error" };
-    const orgs = body.data?.account?.organizations ?? [];
-    if (!orgs.length)
-      return { status: "down", message: "No Buffer organizations on this account" };
-    return { status: "ok", message: `Connected to ${orgs[0]?.name ?? "Buffer"}` };
-  } catch (err) {
-    return networkOutcome(err, String(key ?? ""));
-  }
-}
-async function probeVercel(creds, fetchImpl) {
-  const token = creds.api_key ?? creds.access_token;
-  if (!token)
-    return { status: "down", message: "No Vercel credential present" };
-  try {
-    const res = await timedFetch2(fetchImpl, "https://api.vercel.com/v2/user", {
-      headers: { Authorization: `Bearer ${token}` }
+    const sessionId = initRes.headers.get("mcp-session-id");
+    await parseRpc2(initRes, 1);
+    const sessionHeaders = { ...baseHeaders, ...sessionId ? { "Mcp-Session-Id": sessionId } : {} };
+    const initializedRes = await fetchImpl(config.url, {
+      method: "POST",
+      headers: sessionHeaders,
+      body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
+      signal: AbortSignal.timeout(5e3)
     });
-    if (!res.ok) {
-      const message = res.status === 429 ? rateLimitMessage("Vercel", res.status) : res.status === 401 || res.status === 403 ? `Vercel rejected the token (${res.status}) \u2014 invalid or revoked API token` : `Vercel API returned ${res.status}`;
-      return {
-        status: statusForHttp(res.status),
-        cause: causeForHttp(res.status),
-        message
-      };
+    await initializedRes.text().catch(() => "");
+    const listRes = await fetchImpl(config.url, {
+      method: "POST",
+      headers: sessionHeaders,
+      body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" }),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!listRes.ok) {
+      return listRes.status >= 500 ? { status: "transient_error", message: `MCP tools/list returned ${listRes.status}` } : null;
     }
-    const body = await res.json();
-    const user = body?.user;
-    const identity = [user?.username, user?.email, user?.name, user?.id].find((value) => typeof value === "string" && value.trim().length > 0);
-    if (!identity)
-      return { status: "down", message: "Vercel returned no user for this token" };
-    return { status: "ok", message: `Connected as ${identity}` };
-  } catch (err) {
-    return networkOutcome(err, String(token ?? ""));
-  }
-}
-async function probeHiggsfield(creds, fetchImpl) {
-  const token = creds.api_key ?? creds.access_token;
-  if (!token)
-    return { status: "down", message: "No Higgsfield credential present" };
-  if (!token.includes(":")) {
-    return {
-      status: "down",
-      message: "Higgsfield credential is not in KEY_ID:KEY_SECRET form \u2014 re-paste it from cloud.higgsfield.ai/api-keys"
+    const listRpc = await parseRpc2(listRes, 2);
+    const tools = listRpc?.["result"]?.tools ?? [];
+    const resolved = resolveProbeTool(tools, { tool: config.toolName, args: config.toolArgs });
+    const toolName = resolved.toolName;
+    if (!toolName)
+      return null;
+    const baseDetails = {
+      tool: toolName,
+      ...resolved.fallback ? { override_fallback: resolved.fallback, requested_tool: resolved.requestedTool } : {}
     };
-  }
-  try {
-    const res = await timedFetch2(fetchImpl, "https://platform.higgsfield.ai/v1/motions", {
-      headers: { Authorization: `Key ${token}` }
+    const callRes = await fetchImpl(config.url, {
+      method: "POST",
+      headers: sessionHeaders,
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 3,
+        method: "tools/call",
+        params: { name: toolName, arguments: resolved.args }
+      }),
+      signal: AbortSignal.timeout(timeoutMs)
     });
-    if (!res.ok) {
-      const body = await res.text().catch(() => "");
-      if (res.status === 403 && /credit/i.test(body)) {
+    if (!callRes.ok) {
+      return callRes.status >= 500 ? { status: "transient_error", message: `MCP tools/call returned ${callRes.status}` } : null;
+    }
+    const callRpc = await parseRpc2(callRes, 3);
+    {
+      const errText = callRpc?.["error"]?.message;
+      const resContent = callRpc?.["result"]?.content;
+      const raw = errText ?? (resContent ?? []).map((c) => c.text ?? "").join(" ").trim();
+      if (raw)
+        baseDetails.response = raw.length > 2e3 ? `${raw.slice(0, 2e3)}\u2026` : raw;
+    }
+    const rpcErrMsg = callRpc && "error" in callRpc ? callRpc["error"]?.message ?? "" : "";
+    const result = callRpc?.["result"];
+    const contentText2 = (result?.content ?? []).map((c) => c.text ?? "").join(" ").trim();
+    const failed = Boolean(rpcErrMsg) || Boolean(result?.isError) || isComposioFailureEnvelope(contentText2);
+    if (failed) {
+      const failureText = [rpcErrMsg, contentText2].filter(Boolean).join(" ");
+      const snippet = failureText.length > 200 ? `${failureText.slice(0, 200)}\u2026` : failureText;
+      const kind = classifyToolCallFailure(failureText);
+      if (kind === "account") {
+        return {
+          status: "down",
+          message: `Live tool call '${toolName}' failed to resolve the connected account: ${snippet}`,
+          details: baseDetails
+        };
+      }
+      if (kind === "quota") {
+        const retryAfterSeconds = extractRetryAfterSeconds(failureText);
+        const retryPhrase = retryAfterSeconds ? ` The provider says to retry in ${formatRetryWindow(retryAfterSeconds)}.` : "";
         return {
           status: "degraded",
-          message: "Higgsfield authenticated, but the account is out of credits \u2014 generation will fail"
+          message: `Live tool call '${toolName}' reached the provider and was refused: a quota or rate limit is exhausted. The connection itself is valid \u2014 do NOT reconnect, this resolves when the window resets.${retryPhrase} ${snippet}`,
+          details: {
+            ...baseDetails,
+            reason: "quota_exhausted",
+            ...retryAfterSeconds ? { retry_after_seconds: retryAfterSeconds } : {}
+          }
+        };
+      }
+      if (kind === "scope") {
+        return {
+          status: "degraded",
+          message: `Live tool call '${toolName}' was refused for a missing permission \u2014 the connection is valid, but its app/token isn't granted the scope this tool needs. Grant the required scope in the provider app and re-authorise (this is NOT a reconnect): ${snippet}`,
+          details: { ...baseDetails, reason: "scope_deficit" }
+        };
+      }
+      if (kind === "auth") {
+        return {
+          status: "down",
+          message: `Live tool call '${toolName}' was rejected by the provider \u2014 the connection's credential is no longer valid (reconnect required): ${snippet}`,
+          details: { ...baseDetails, reason: "upstream_auth_rejected" }
+        };
+      }
+      if (kind === "site") {
+        return {
+          status: "down",
+          message: `Live tool call '${toolName}' couldn't reach the provider's site - the connection has no valid site URL (reconnect and make sure a site/workspace is granted): ${snippet}`,
+          details: { ...baseDetails, reason: "site_unresolved" }
         };
       }
-      const message = res.status === 429 ? rateLimitMessage("Higgsfield", res.status) : res.status === 401 || res.status === 403 ? `Higgsfield rejected the key pair (${res.status}) \u2014 invalid or revoked API key` : `Higgsfield API returned ${res.status}`;
       return {
-        status: statusForHttp(res.status),
-        cause: causeForHttp(res.status),
-        message
+        status: "ok",
+        message: `Live tool call '${toolName}' resolved the account (tool error: ${snippet})`,
+        details: { ...baseDetails, tool_error: snippet }
       };
     }
-    const motions = await res.json();
-    if (!Array.isArray(motions) || motions.length === 0) {
-      return { status: "down", message: "Higgsfield returned no motion presets for this key" };
-    }
-    return { status: "ok", message: `Higgsfield reachable \u2014 ${motions.length} motion presets` };
+    return { status: "ok", message: `Live tool call '${toolName}' resolved the connected account`, details: baseDetails };
   } catch (err) {
-    return networkOutcome(err, String(token ?? ""));
-  }
-}
-async function probeSportsyear(creds, fetchImpl) {
-  const key = creds.api_key ?? creds.access_token;
-  if (!key)
-    return { status: "down", message: "No Sportsyear credential present" };
-  let authorization;
-  try {
-    authorization = basicUsernameAuthorization(String(key));
-  } catch {
+    const isAbort = err?.name === "TimeoutError" || err?.name === "AbortError";
     return {
-      status: "down",
-      message: 'Sportsyear credential is not a bare API key (it contains ":") \u2014 paste the key alone, not email:password'
+      status: "transient_error",
+      message: isAbort ? `MCP tool-call probe timed out after ${timeoutMs / 1e3}s` : `MCP tool-call probe failed: ${err.message}`
     };
   }
-  const encoded = authorization.slice("Basic ".length);
-  try {
-    const res = await timedFetch2(fetchImpl, "https://sportsyear.com.au/api/v1/member", {
-      headers: { Authorization: authorization, Accept: "application/json" }
-    });
-    if (!res.ok) {
-      const message = res.status === 429 ? rateLimitMessage("Sportsyear", res.status) : res.status === 401 || res.status === 403 ? `Sportsyear rejected the API key (${res.status}) \u2014 removed, regenerated, or API access disabled on the member account` : `Sportsyear API returned ${res.status}`;
-      return {
-        status: statusForHttp(res.status),
-        cause: causeForHttp(res.status),
-        message
-      };
-    }
-    const body = await res.json();
-    const member = typeof body === "object" && body !== null && !Array.isArray(body) ? body : null;
-    const id = member?.id;
-    if (typeof id !== "number" && !(typeof id === "string" && id.trim() !== "")) {
-      return { status: "down", message: "Sportsyear returned no member account for this API key" };
-    }
-    const label = typeof member?.organisation === "string" && member.organisation.trim() !== "" ? member.organisation.trim() : `member ${String(id)}`;
-    return { status: "ok", message: `Reached Sportsyear as ${redactSecret(redactSecret(label, String(key)), encoded)}` };
-  } catch (err) {
-    const outcome = networkOutcome(err, String(key));
-    return outcome.message === void 0 ? outcome : { ...outcome, message: redactSecret(outcome.message, encoded) };
-  }
-}
-async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch) {
-  switch (definitionId) {
-    case "linear":
-      return probeLinear(credentials, fetchImpl);
-    case "buffer":
-      return probeBuffer(credentials, fetchImpl);
-    case "vercel":
-      return probeVercel(credentials, fetchImpl);
-    case "higgsfield":
-      return probeHiggsfield(credentials, fetchImpl);
-    case "sportsyear":
-      return probeSportsyear(credentials, fetchImpl);
-    case "google-workspace":
-      return probeBearerJson("https://www.googleapis.com/oauth2/v2/userinfo", credentials, fetchImpl, (body) => {
-        const info = body;
-        return { status: "ok", message: `Connected as ${info.name ?? info.email ?? "unknown"}` };
-      });
-    case "xero":
-      return probeBearerJson("https://api.xero.com/connections", credentials, fetchImpl, (body) => {
-        const conns = body ?? [];
-        if (!conns.length)
-          return { status: "down", message: "No Xero organisations connected" };
-        return { status: "ok", message: `Connected to ${conns[0]?.tenantName ?? "Xero"}` };
-      });
-    case "linkedin-ads":
-      return probeBearerJson("https://api.linkedin.com/v2/userinfo", credentials, fetchImpl, (body) => {
-        const user = body;
-        return { status: "ok", message: `Connected as ${user.name ?? user.email ?? "unknown"}` };
-      });
-    case "v0":
-      return probeBearerJson("https://api.v0.dev/v1/user", credentials, fetchImpl, (body) => {
-        const user = body;
-        return { status: "ok", message: `Connected as ${user.name ?? user.email ?? "unknown"}` };
-      });
-    case "sprout-social":
-      return probeBearerJson("https://api.sproutsocial.com/v1/metadata/client", credentials, fetchImpl, (body) => {
-        const data = body?.data;
-        const clients = Array.isArray(data) ? data.filter((row) => {
-          if (typeof row !== "object" || row === null)
-            return false;
-          const id = row.customer_id;
-          return typeof id === "string" || typeof id === "number";
-        }) : [];
-        if (!clients.length) {
-          return { status: "down", message: "Sprout Social returned no usable client account for this token" };
-        }
-        return {
-          status: "ok",
-          message: `Reached Sprout Social \u2014 ${clients.length} client account(s), incl. ${clients[0]?.name ?? "unnamed"}`
-        };
-      });
-    case "github":
-      return probeBearerJson("https://api.github.com/user", credentials, fetchImpl, (body) => {
-        const u = body;
-        return { status: "ok", message: `Reached GitHub as ${u.login ?? u.name ?? "unknown"}` };
-      }, { "User-Agent": "augmented-team-connectivity-probe", "X-GitHub-Api-Version": "2026-03-10" });
-    default:
-      return null;
-  }
 }
 
 // ../../packages/core/dist/integrations/probe-path.js
@@ -14667,10 +14681,10 @@ export {
   bestConnectivityEvidence,
   worseConnectivityOutcome,
   resolveConnectivityProbe,
+  probeHttpProvider,
   probeMcpHttp,
   probeComposioAccount,
   probeComposioMcpToolCall,
-  probeHttpProvider,
   PROBE_TOOLKIT_PATH_DIRS,
   PROBE_HOME_RELATIVE_PATH_SEGMENTS,
   PROBE_SYSTEM_PATH_FLOOR,
@@ -14769,4 +14783,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-4ZRXKEXO.js.map
+//# sourceMappingURL=chunk-HF2GMFMJ.js.map