@integrity-labs/agt-cli 0.27.110 → 0.27.112

package/dist/bin/agt.js

@@ -28,7 +28,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-CS7BEFJ7.js";
+} from "../chunk-ILYN3XBV.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -4934,7 +4934,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.110" : "dev";
+var cliVersion = true ? "0.27.112" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5857,7 +5857,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.110" : "dev";
+var cliVersion2 = true ? "0.27.112" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-CS7BEFJ7.js → chunk-ILYN3XBV.js}

@@ -4746,6 +4746,11 @@ var SECRETS_DENY_PERMISSIONS = [
   "Read(**/credentials/**)",
   "Read(**/credentials.json)",
   "Read(**/.aws/**)",
+  // gcloud stores ADC + cached access/refresh tokens under ~/.config/gcloud/
+  // (application_default_credentials.json, credentials.db, access_tokens.db).
+  // Brokered GCP access flows via CLOUDSDK_AUTH_ACCESS_TOKEN env, never these
+  // files, so denying reads here is the GCP analogue of the .aws/ block.
+  "Read(**/.config/gcloud/**)",
   "Read(**/.ssh/**)",
   "Read(**/config/database.yml)",
   "Read(**/config/credentials.json)",
@@ -7586,4 +7591,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-CS7BEFJ7.js.map
+//# sourceMappingURL=chunk-ILYN3XBV.js.map