@integrity-labs/agt-cli 0.23.1 → 0.24.0

package/dist/bin/agt.js

@@ -26,7 +26,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-Q4QD3TAC.js";
+} from "../chunk-WZTRMJM4.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -52,7 +52,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-2TOCO5D2.js";
+} from "../chunk-HSIESZMZ.js";
 
 // src/bin/agt.ts
 import { join as join10 } from "path";
@@ -3736,7 +3736,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync5, realpathSync } from "fs";
 import chalk17 from "chalk";
 import ora15 from "ora";
-var cliVersion = true ? "0.23.1" : "dev";
+var cliVersion = true ? "0.24.0" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -4268,7 +4268,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.23.1" : "dev";
+var cliVersion2 = true ? "0.24.0" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", (thisCommand) => {

package/dist/{chunk-2TOCO5D2.js → chunk-HSIESZMZ.js}

@@ -1841,6 +1841,11 @@ var integration_metadata_v1_default = {
           type: "array",
           items: { type: "string", enum: ["org", "team", "agent"] },
           description: "Optional subset of the integration's runtime_scopes this tool is exposed under. Default: all scopes the integration declares."
+        },
+        auth_mode: {
+          type: "string",
+          enum: ["required", "optional"],
+          description: "ADR 0010 \u2014 per-tool credential expectation. `required` (default) makes the broker fail closed when no install credential is attached; `optional` lets the broker call the vendor without an `Authorization` header (used by here-now anonymous publish)."
         }
       }
     }
@@ -2233,8 +2238,25 @@ function runCrossFileRules(charter, tools) {
       message: `CHARTER.md version "${charter.version}" does not match TOOLS.md version "${tools.version}"`
     });
   }
+  if (charter.environment === "prod" || charter.risk_tier === "High") {
+    for (let i = 0; i < tools.tools.length; i++) {
+      const tool = tools.tools[i];
+      if (isHereNowAccountPublishTool(tool.id)) {
+        diagnostics.push({
+          file: "CHARTER.md + TOOLS.md",
+          code: "TOOLS.PUBLISH.PUBLIC_EXPOSURE",
+          path: `tools[${i}].id`,
+          severity: "warning",
+          message: `Tool "${tool.id}" grants here.now account publishing (permanent, public) to a ${charter.environment === "prod" ? "production" : "High-risk-tier"} agent. Confirm the public-exposure surface is intended; consider the publish:anonymous scope (24h TTL) for non-permanent output.`
+        });
+      }
+    }
+  }
   return diagnostics;
 }
+function isHereNowAccountPublishTool(id) {
+  return /^here-now-(publish-account|account-publish)$/.test(id);
+}
 
 // ../../packages/core/dist/lint/rules/multi-agent.js
 function runMultiAgentRules(charter, teamPeers, ctx = {}) {
@@ -3187,4 +3209,4 @@ export {
   KANBAN_LOOP_COMMAND,
   KANBAN_CHECK_COMMAND
 };
-//# sourceMappingURL=chunk-2TOCO5D2.js.map
+//# sourceMappingURL=chunk-HSIESZMZ.js.map