no-mistakes(review): Restore quiet-mode silence; keep provenance on failure alert

scripts/agent-health-check.py

@@ -46,7 +46,7 @@ Changelog:
     a stale-consumer report is distinguishable from a fault at read time.
 """
 
-import subprocess, json, sys, os, time, re
+import subprocess, json, sys, os, time, re, io, contextlib
 from datetime import datetime
 
 LITELLM = "http://192.168.68.116:80"
@@ -659,30 +659,7 @@ def deploy_self():
 # MAIN
 # ═══════════════════════════════════════════════════════════════════
 
-def main():
-    quiet = "--quiet" in sys.argv
-    as_json = "--json" in sys.argv
-
-    # Self-deploy to canonical location
-    if not quiet and "--no-deploy" not in sys.argv:
-        deploy_self()
-
-    # Provenance: a report is only actionable if the reader can tell WHICH copy
-    # of this script produced it. Emit the absolute execution path (script + cwd)
-    # in human, cron-alert, and --json output so a stale-consumer report is
-    # distinguishable from a real fault at read time. The production cron path
-    # runs --quiet, so provenance must NOT be behind the quiet guard.
-    script_path = os.path.abspath(__file__)
-    cwd = os.getcwd()
-
-    if not quiet:
-        print(f"🏥 Agent Health Check v4 — {datetime.now().strftime('%Y-%m-%d %H:%M UTC')}")
-    print(f"📍 executed from: script={script_path} cwd={cwd}")
-    if not quiet:
-        print()
-
-    load_agent_keys()
-
+def _run_checks():
     print("🔑 LiteLLM Keys:")
     check_keys()
     print()
@@ -710,6 +687,37 @@ def main():
     print("🔐 Vault Secrets:")
     check_vault_secrets()
 
+
+def main():
+    quiet = "--quiet" in sys.argv
+    as_json = "--json" in sys.argv
+
+    # Self-deploy to canonical location
+    if not quiet and "--no-deploy" not in sys.argv:
+        deploy_self()
+
+    # Provenance: a report is only actionable if the reader can tell WHICH copy
+    # of this script produced it. A normal run carries it in the header, --json
+    # carries it for machine consumers, and the cron ALERT line carries it on
+    # failure. --quiet is documented as "only output on failure", so the header
+    # is emitted only when not quiet and a healthy quiet run stays silent.
+    script_path = os.path.abspath(__file__)
+    cwd = os.getcwd()
+
+    if quiet:
+        captured = io.StringIO()
+        with contextlib.redirect_stdout(captured):
+            load_agent_keys()
+            _run_checks()
+        if FAIL:
+            sys.stdout.write(captured.getvalue())
+    else:
+        print(f"🏥 Agent Health Check v4 — {datetime.now().strftime('%Y-%m-%d %H:%M UTC')}")
+        print(f"📍 executed from: script={script_path} cwd={cwd}")
+        print()
+        load_agent_keys()
+        _run_checks()
+
     if FAIL:
         print(f"\n❌ {len(FAIL)} FAILURE(S): {' | '.join(FAIL)}")
         if quiet: