@integrity-labs/agt-cli 0.27.65 → 0.27.67

package/dist/bin/agt.js

@@ -27,7 +27,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-UMFTYZO7.js";
+} from "../chunk-EYWW624B.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -53,11 +53,11 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-PM3CC2SJ.js";
+} from "../chunk-KPD5KJY7.js";
 
 // src/bin/agt.ts
-import { join as join18 } from "path";
-import { homedir as homedir8 } from "os";
+import { join as join20 } from "path";
+import { homedir as homedir9 } from "os";
 import { Command } from "commander";
 
 // src/commands/whoami.ts
@@ -551,11 +551,11 @@ async function lintCommand(path) {
       process.exitCode = 1;
       return;
     }
-    const { readdirSync: readdirSync6, statSync: statSync4 } = await import("fs");
-    const entries = readdirSync6(augmentedDir);
+    const { readdirSync: readdirSync7, statSync: statSync5 } = await import("fs");
+    const entries = readdirSync7(augmentedDir);
     for (const entry of entries) {
       const entryPath = join2(augmentedDir, entry);
-      if (statSync4(entryPath).isDirectory()) {
+      if (statSync5(entryPath).isDirectory()) {
         dirs.push({ name: entry, dir: entryPath });
       }
     }
@@ -4929,7 +4929,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.65" : "dev";
+var cliVersion = true ? "0.27.67" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5406,6 +5406,176 @@ async function auditMcpRenderCommand(options = {}) {
   }
 }
 
+// src/commands/audit-secrets.ts
+import { homedir as homedir8 } from "os";
+import { join as join19 } from "path";
+
+// src/lib/secret-leak-audit.ts
+import { readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync4 } from "fs";
+import { join as join18 } from "path";
+
+// ../../packages/core/dist/provisioning/mcp-secret-lint.js
+var LITERAL_SECRET_PATTERNS = [
+  // Slack bot token — `xoxb-<workspace>-<...>`
+  { name: "slack_bot_token", re: /^xoxb-/ },
+  // Slack app-level token (Socket Mode) — `xapp-<...>`
+  { name: "slack_app_token", re: /^xapp-/ },
+  // AGT host API key — `tlk_<...>` (see claudecode-plugin-augmented README).
+  { name: "agt_host_api_key", re: /^tlk_/ },
+  // Composio / generic api-key prefix — `ak_<...>`
+  { name: "composio_api_key", re: /^ak_/ },
+  // Telegram bot token — `<10-digit bot id>:AAE<...>` (BotFather format).
+  { name: "telegram_bot_token", re: /^\d{10}:AAE/ },
+  // ENG-5901 extension beyond the original AC's five patterns: a literal
+  // JWT (`eyJ...`) is the shape of a leaked AGT_API_KEY, which the
+  // value-prefix patterns above would otherwise miss. Header values often
+  // carry it behind `Bearer ` (or a copy-pasted `Authorization: Bearer `),
+  // so those prefixes are optionally consumed (CodeRabbit #1731).
+  // Templates (`Bearer ${AGT_API_KEY}`) and concrete non-secret values
+  // (UUIDs, hosts) never put `eyJ` after the prefix, so this stays
+  // false-positive-safe inside .mcp.json.
+  { name: "jwt_agt_api_key", re: /^(?:authorization:\s*)?(?:bearer\s+)?eyJ[A-Za-z0-9_-]+\./i }
+];
+
+// src/lib/secret-leak-audit.ts
+var SECRET_KEY_NAME_RE = /TOKEN|KEY|SECRET|BEARER|PASSWORD/i;
+function isTemplated(value) {
+  return value.includes("${");
+}
+function matchesKnownSecretShape(value) {
+  return LITERAL_SECRET_PATTERNS.some(({ re }) => re.test(value));
+}
+function isWorldReadable(mode) {
+  return (mode & 63) !== 0;
+}
+function octal(mode) {
+  return `0${(mode & 511).toString(8)}`;
+}
+function scanMcpFile(file, agent2, findings) {
+  let mode = null;
+  try {
+    mode = statSync4(file).mode;
+  } catch {
+    return;
+  }
+  if (mode !== null && isWorldReadable(mode)) {
+    findings.push({ kind: "world-readable-secret-file", file, agent: agent2, mode: octal(mode) });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync11(file, "utf-8"));
+  } catch {
+    return;
+  }
+  const servers = parsed?.mcpServers;
+  if (typeof servers !== "object" || servers === null) return;
+  for (const [server, raw] of Object.entries(servers)) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const entry = raw;
+    const blocks = [
+      [entry.env, "env"],
+      [entry.headers, "header"]
+    ];
+    for (const [block, location] of blocks) {
+      if (!block) continue;
+      for (const [field, value] of Object.entries(block)) {
+        if (typeof value !== "string" || value.length === 0) continue;
+        if (isTemplated(value)) continue;
+        if (!SECRET_KEY_NAME_RE.test(field) && !matchesKnownSecretShape(value)) continue;
+        findings.push({ kind: "literal-secret-in-mcp", file, agent: agent2, server, field, location });
+      }
+    }
+  }
+}
+function scanEnvIntegrations(file, agent2, findings) {
+  let mode;
+  try {
+    mode = statSync4(file).mode;
+  } catch {
+    return;
+  }
+  if (isWorldReadable(mode)) {
+    findings.push({ kind: "world-readable-secret-file", file, agent: agent2, mode: octal(mode) });
+  }
+}
+function auditSecretLeaks(augmentedRoot) {
+  const findings = [];
+  let agents;
+  try {
+    agents = readdirSync6(augmentedRoot);
+  } catch {
+    return findings;
+  }
+  for (const agent2 of agents) {
+    const agentDir = join18(augmentedRoot, agent2);
+    try {
+      if (!statSync4(agentDir).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    scanMcpFile(join18(agentDir, "provision", ".mcp.json"), agent2, findings);
+    scanMcpFile(join18(agentDir, "project", ".mcp.json"), agent2, findings);
+    scanEnvIntegrations(join18(agentDir, ".env.integrations"), agent2, findings);
+  }
+  return findings;
+}
+function formatSecretFinding(f) {
+  const parts = [
+    "[audit-secrets]",
+    `kind=${f.kind}`,
+    `agent=${f.agent}`,
+    `file=${f.file}`
+  ];
+  if (f.server) parts.push(`server=${f.server}`);
+  if (f.field) parts.push(`field=${f.field}`);
+  if (f.location) parts.push(`location=${f.location}`);
+  if (f.mode) parts.push(`mode=${f.mode}`);
+  return parts.join(" ");
+}
+
+// src/commands/audit-secrets.ts
+function describe(f) {
+  if (f.kind === "literal-secret-in-mcp") {
+    return `literal secret in ${f.location} field '${f.field}' of server '${f.server}'`;
+  }
+  return `secret file is mode ${f.mode} (expected 0600)`;
+}
+async function auditSecretsCommand(options = {}) {
+  const root = options.root ?? join19(homedir8(), ".augmented");
+  const findings = auditSecretLeaks(root);
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify({ findings, root }, null, 2)}
+`);
+  } else if (findings.length === 0) {
+    process.stdout.write(
+      `No literal secrets or world-readable secret files found under ${root}.
+`
+    );
+  } else {
+    process.stdout.write(
+      `Found ${findings.length} secret-handling issue${findings.length === 1 ? "" : "s"} under ${root}:
+
+`
+    );
+    for (const f of findings) {
+      process.stdout.write(`  \u2022 [${f.agent}] ${describe(f)}
+`);
+      process.stdout.write(`    ${f.file}
+`);
+    }
+    process.stdout.write(
+      "\nLiteral secrets in .mcp.json should be `${VAR}` placeholders with the raw value in .env.integrations (mode 0600). See docs/operator/credential-migration-eng5898.md.\n"
+    );
+    for (const f of findings) {
+      process.stderr.write(`${formatSecretFinding(f)}
+`);
+    }
+  }
+  if (options.strict && findings.length > 0) {
+    process.exit(2);
+  }
+}
+
 // src/commands/integration.ts
 import chalk19 from "chalk";
 import ora17 from "ora";
@@ -5707,7 +5877,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.65" : "dev";
+var cliVersion2 = true ? "0.27.67" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {
@@ -5800,16 +5970,16 @@ host.command("pair <host-name>").description("Start an SSM port-forward + shell
   })
 );
 var manager = program.command("manager").description("Host config sync daemon \u2014 keeps local agent files in sync with API");
-manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
-manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).action(managerStopCommand);
-manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).action(managerStatusCommand);
-manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
-manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).action(managerInstallCommand);
+manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
+manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).action(managerStopCommand);
+manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).action(managerStatusCommand);
+manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
+manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).action(managerInstallCommand);
 manager.command("uninstall").description("Remove the OS-level supervisor (launchctl unload + delete plist on macOS). Idempotent.").action(managerUninstallCommand);
 manager.command("install-system-unit").description("Install a system-level systemd unit (Linux, root) so the manager auto-starts on every boot. For headless EC2 hosts \u2014 survives reboot without `loginctl enable-linger`. (ENG-4706)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files (defaults to /root/.augmented or /home/<user>/.augmented)").option("--user <name>", "Unix user the manager runs as", "root").action(managerInstallSystemUnitCommand);
 manager.command("uninstall-system-unit").description("Remove the system-level systemd unit (Linux, root). Idempotent. (ENG-4706)").action(managerUninstallSystemUnitCommand);
 var agent = program.command("agent").description("Inspect and manage agents");
-agent.command("show <code-name>").description("Display an agent's provisioned OpenClaw configuration").option("--config-dir <dir>", "Config directory", join18(homedir8(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
+agent.command("show <code-name>").description("Display an agent's provisioned OpenClaw configuration").option("--config-dir <dir>", "Config directory", join20(homedir9(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
 var kanban = program.command("kanban").description("Manage agent kanban boards");
 kanban.command("list").description("List kanban board items for an agent").requiredOption("--agent <code-name>", "Agent code name").action(kanbanListCommand);
 kanban.command("add <title>").description("Add a new item to an agent kanban board").requiredOption("--agent <code-name>", "Agent code name").option("--priority <1|2|3>", "Priority: 1=high, 2=medium, 3=low", "2").option("--status <status>", "Initial status: backlog | todo | in_progress", "todo").option("--description <text>", "Item description").option("--estimate <minutes>", "Estimated time in minutes").option("--deliverable <text>", "Expected output/deliverable").action(kanbanAddCommand);
@@ -5840,6 +6010,7 @@ program.command("update").description("Check for and install CLI updates").optio
 var audit = program.command("audit").description("Operator audits \u2014 sub-agent MCP bindings, etc.");
 audit.command("subagents").description("Find sub-agents whose tools allowlist would block mcp__* calls on dispatch (ENG-5897)").option("--strict", "Exit with code 2 if any findings (suitable for CI gating)").option("--json", "Emit findings as JSON to stdout").action(auditSubagentsCommand);
 audit.command("mcp-render").description("Find managed agents whose subagent .md tools allowlist is stale vs .mcp.json (ENG-5922)").option("--strict", "Exit with code 2 if any findings (suitable for CI gating)").option("--json", "Emit findings as JSON to stdout").action(auditMcpRenderCommand);
+audit.command("secrets").description("Find literal secrets in .mcp.json and world-readable secret files (ENG-5901)").option("--strict", "Exit with code 2 if any findings (suitable for CI gating)").option("--json", "Emit findings as JSON to stdout").action(auditSecretsCommand);
 var skipUpdateCheck = process.argv.includes("--skip-update-check") || process.argv.includes("--json") || process.argv[2] === "update";
 if (!skipUpdateCheck) {
   checkForUpdateOnStartup().catch(() => {