@integrity-labs/agt-cli 0.27.69 → 0.27.71

package/dist/bin/agt.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   ApiError,
+  LITERAL_SECRET_PATTERNS,
   PROD_AGT_HOST,
   api,
   error,
@@ -27,7 +28,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-HAM7MGCF.js";
+} from "../chunk-EWWJUVDY.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -2148,7 +2149,7 @@ function rewriteServerEntry(serverName, raw, ctx) {
 }
 function fillIfEmpty(env, key, value) {
   const current = env[key];
-  if (typeof current !== "string" || current.length === 0) {
+  if (typeof current !== "string" || current.length === 0 || current === `\${${key}}`) {
     env[key] = value;
   }
 }
@@ -4929,7 +4930,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.69" : "dev";
+var cliVersion = true ? "0.27.71" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5413,31 +5414,6 @@ import { join as join19 } from "path";
 // src/lib/secret-leak-audit.ts
 import { readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync4 } from "fs";
 import { join as join18 } from "path";
-
-// ../../packages/core/dist/provisioning/mcp-secret-lint.js
-var LITERAL_SECRET_PATTERNS = [
-  // Slack bot token — `xoxb-<workspace>-<...>`
-  { name: "slack_bot_token", re: /^xoxb-/ },
-  // Slack app-level token (Socket Mode) — `xapp-<...>`
-  { name: "slack_app_token", re: /^xapp-/ },
-  // AGT host API key — `tlk_<...>` (see claudecode-plugin-augmented README).
-  { name: "agt_host_api_key", re: /^tlk_/ },
-  // Composio / generic api-key prefix — `ak_<...>`
-  { name: "composio_api_key", re: /^ak_/ },
-  // Telegram bot token — `<10-digit bot id>:AAE<...>` (BotFather format).
-  { name: "telegram_bot_token", re: /^\d{10}:AAE/ },
-  // ENG-5901 extension beyond the original AC's five patterns: a literal
-  // JWT (`eyJ...`) is the shape of a leaked AGT_API_KEY, which the
-  // value-prefix patterns above would otherwise miss. Header values often
-  // carry it behind `Bearer ` (or a copy-pasted `Authorization: Bearer `),
-  // so those prefixes are optionally consumed (CodeRabbit #1731).
-  // Templates (`Bearer ${AGT_API_KEY}`) and concrete non-secret values
-  // (UUIDs, hosts) never put `eyJ` after the prefix, so this stays
-  // false-positive-safe inside .mcp.json.
-  { name: "jwt_agt_api_key", re: /^(?:authorization:\s*)?(?:bearer\s+)?eyJ[A-Za-z0-9_-]+\./i }
-];
-
-// src/lib/secret-leak-audit.ts
 var SECRET_KEY_NAME_RE = /TOKEN|KEY|SECRET|BEARER|PASSWORD/i;
 function isTemplated(value) {
   return value.includes("${");
@@ -5877,7 +5853,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.69" : "dev";
+var cliVersion2 = true ? "0.27.71" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {