@integrity-labs/agt-cli 0.27.27 → 0.27.29

package/dist/bin/agt.js

@@ -27,7 +27,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-ZYFZYWPV.js";
+} from "../chunk-HX74HMG4.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -4643,7 +4643,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.27" : "dev";
+var cliVersion = true ? "0.27.29" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5175,7 +5175,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.27" : "dev";
+var cliVersion2 = true ? "0.27.29" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", (thisCommand) => {

package/dist/{chunk-ZYFZYWPV.js → chunk-HX74HMG4.js}

@@ -2922,6 +2922,16 @@ function formatEmailDomainConfigLines(config) {
   lines.push(`  *Advisory: honor this restriction \u2014 it is guidance in your instructions, not a hard block at send time.*`);
   return lines;
 }
+var CALENDAR_CONFIDENTIALITY_DEF = "calendar.confidentiality";
+function formatCalendarConfidentialityLines(config) {
+  const stage = typeof config.stage === "string" ? config.stage : "shadow";
+  const lines = [`  - stage: ${stage}`];
+  lines.push(`  *Cross-turn re-query: when answering a different person about your principal's calendar, ALWAYS re-query the calendar tool \u2014 never reuse meeting details remembered from an earlier turn that involved a different recipient. The tool's response is filtered per-recipient at the API layer; relying on memory bypasses the filter.*`);
+  if (stage !== "enforce") {
+    lines.push(`  *Currently observe-only \u2014 the API records redaction decisions to guardrail_audit_log but returns calendar responses unchanged. Treat the policy as authoritative anyway; the runtime flip is operator-side.*`);
+  }
+  return lines;
+}
 function renderGuardrailBullet(g) {
   const lines = [];
   const header = `- **${g.displayName}** (${g.category}, from ${g.source})`;
@@ -2929,16 +2939,26 @@ function renderGuardrailBullet(g) {
   if (g.description?.trim()) {
     lines.push(`  ${g.description.trim()}`);
   }
-  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : formatConfigLines(g.config));
+  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : g.definitionId === CALENDAR_CONFIDENTIALITY_DEF ? formatCalendarConfidentialityLines(g.config) : formatConfigLines(g.config));
   if (g.overrideApplied && g.overrideReason?.trim()) {
     lines.push(`  *Override applied: ${g.overrideReason.trim()}*`);
   }
   return lines.join("\n");
 }
+function effectiveCalendarEnforcement(g) {
+  if (g.definitionId !== CALENDAR_CONFIDENTIALITY_DEF)
+    return g.enforcement;
+  const stage = typeof g.config?.["stage"] === "string" ? g.config["stage"] : "shadow";
+  if (stage === "enforce")
+    return "enforce";
+  if (stage === "warn" && g.enforcement !== "enforce")
+    return "warn";
+  return g.enforcement;
+}
 function buildGuardrailsSection(guardrails) {
   if (!guardrails || guardrails.length === 0)
     return "";
-  const active = guardrails.filter((g) => g.enforcement !== "disabled");
+  const active = guardrails.map((g) => ({ ...g, enforcement: effectiveCalendarEnforcement(g) })).filter((g) => g.enforcement !== "disabled");
   if (active.length === 0)
     return "";
   const enforce = active.filter((g) => g.enforcement === "enforce");
@@ -6945,4 +6965,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-ZYFZYWPV.js.map
+//# sourceMappingURL=chunk-HX74HMG4.js.map