@integrity-labs/agt-cli 0.27.69 → 0.27.71

package/dist/{chunk-HAM7MGCF.js → chunk-EWWJUVDY.js}

@@ -2358,6 +2358,68 @@ registerFramework(nemoClawAdapter);
 
 // ../../packages/core/dist/provisioning/mcp-config-guards.js
 import { chmodSync as chmodSync4, existsSync as existsSync4, readFileSync as readFileSync4, renameSync as renameSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3 } from "fs";
+
+// ../../packages/core/dist/provisioning/mcp-secret-lint.js
+var LITERAL_SECRET_PATTERNS = [
+  // Slack bot token — `xoxb-<workspace>-<...>`
+  { name: "slack_bot_token", re: /^xoxb-/ },
+  // Slack app-level token (Socket Mode) — `xapp-<...>`
+  { name: "slack_app_token", re: /^xapp-/ },
+  // AGT host API key — `tlk_<...>` (see claudecode-plugin-augmented README).
+  { name: "agt_host_api_key", re: /^tlk_/ },
+  // Composio / generic api-key prefix — `ak_<...>`
+  { name: "composio_api_key", re: /^ak_/ },
+  // Telegram bot token — `<10-digit bot id>:AAE<...>` (BotFather format).
+  { name: "telegram_bot_token", re: /^\d{10}:AAE/ },
+  // ENG-5901 extension beyond the original AC's five patterns: a literal
+  // JWT (`eyJ...`) is the shape of a leaked AGT_API_KEY, which the
+  // value-prefix patterns above would otherwise miss. Header values often
+  // carry it behind `Bearer ` (or a copy-pasted `Authorization: Bearer `),
+  // so those prefixes are optionally consumed (CodeRabbit #1731).
+  // Templates (`Bearer ${AGT_API_KEY}`) and concrete non-secret values
+  // (UUIDs, hosts) never put `eyJ` after the prefix, so this stays
+  // false-positive-safe inside .mcp.json.
+  { name: "jwt_agt_api_key", re: /^(?:authorization:\s*)?(?:bearer\s+)?eyJ[A-Za-z0-9_-]+\./i }
+];
+function matchLiteralSecret(value) {
+  for (const { name, re } of LITERAL_SECRET_PATTERNS) {
+    if (re.test(value))
+      return name;
+  }
+  return null;
+}
+function scanRecord(server, record, location, findings) {
+  if (!record)
+    return;
+  for (const [field, value] of Object.entries(record)) {
+    if (typeof value !== "string")
+      continue;
+    const pattern = matchLiteralSecret(value);
+    if (pattern)
+      findings.push({ server, field, location, pattern });
+  }
+}
+function scanConfigForLiteralSecrets(config) {
+  const findings = [];
+  if (typeof config !== "object" || config === null)
+    return findings;
+  const servers = config.mcpServers;
+  if (typeof servers !== "object" || servers === null)
+    return findings;
+  for (const [server, raw] of Object.entries(servers)) {
+    if (typeof raw !== "object" || raw === null)
+      continue;
+    const entry = raw;
+    scanRecord(server, entry.env, "env", findings);
+    scanRecord(server, entry.headers, "header", findings);
+  }
+  return findings;
+}
+function formatLiteralSecretRejection(f) {
+  return `[mcp-write] [literal-secret-rejected] field=${f.field} server=${f.server} location=${f.location} pattern=${f.pattern}`;
+}
+
+// ../../packages/core/dist/provisioning/mcp-config-guards.js
 var MCP_FILE_MODE = 384;
 var REQUIRED_ENV_RULES_BY_SERVER = {
   "cloud-broker": [
@@ -2507,6 +2569,21 @@ function safeWriteMcpJson(path, config) {
   if (!validation.ok) {
     return { written: false, errors: validation.errors };
   }
+  const secretFindings = scanConfigForLiteralSecrets(config);
+  if (secretFindings.length > 0) {
+    for (const f of secretFindings) {
+      process.stderr.write(`${formatLiteralSecretRejection(f)}
+`);
+    }
+    return {
+      written: false,
+      errors: secretFindings.map((f) => ({
+        kind: "literal_secret",
+        server: f.server,
+        message: `literal secret in ${f.location} field '${f.field}' (pattern ${f.pattern}); expected a \${VAR} template`
+      }))
+    };
+  }
   safeWriteJsonAtomic(path, JSON.stringify(config, null, 2), { mode: MCP_FILE_MODE });
   return { written: true, errors: [] };
 }
@@ -3761,11 +3838,102 @@ function resolveTemplate(input, ctx) {
   return { value, omit };
 }
 
+// ../../packages/core/dist/provisioning/env-integrations-file.js
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+var CHANNEL_SECRET_ENV_KEYS = [
+  "SLACK_BOT_TOKEN",
+  "SLACK_APP_TOKEN",
+  "TELEGRAM_BOT_TOKEN",
+  "MSTEAMS_CLIENT_SECRET"
+];
+var MCP_SERVER_SECRET_ENV_KEYS = [
+  "COMPOSIO_API_KEY",
+  "PIPEDREAM_CLIENT_SECRET"
+];
+var PRESERVED_ENV_KEYS = [
+  ...CHANNEL_SECRET_ENV_KEYS,
+  ...MCP_SERVER_SECRET_ENV_KEYS
+];
+var HEADER = "# Augmented integrations \u2014 auto-generated, do not edit";
+function parseEnvFileEntries(content) {
+  const out = /* @__PURE__ */ new Map();
+  for (const line of content.split("\n")) {
+    if (!line || line.startsWith("#") || !line.includes("="))
+      continue;
+    const eqIdx = line.indexOf("=");
+    out.set(line.slice(0, eqIdx), line.slice(eqIdx + 1));
+  }
+  return out;
+}
+function renderEnvIntegrations(entries) {
+  const lines = [HEADER];
+  for (const [key, rendered] of entries)
+    lines.push(`${key}=${rendered}`);
+  return lines.join("\n") + "\n";
+}
+function mergeEnvIntegrationsContent(existing, args) {
+  const current = existing === null ? /* @__PURE__ */ new Map() : parseEnvFileEntries(existing);
+  let next;
+  if (args.mode === "upsert") {
+    next = new Map(current);
+    for (const [key, raw] of Object.entries(args.updates)) {
+      if (raw === null)
+        next.delete(key);
+      else
+        next.set(key, shellQuote(raw));
+    }
+  } else {
+    next = /* @__PURE__ */ new Map();
+    for (const [key, raw] of Object.entries(args.updates)) {
+      if (raw !== null)
+        next.set(key, shellQuote(raw));
+    }
+    const preserve = args.preserveKeys ?? PRESERVED_ENV_KEYS;
+    for (const key of preserve) {
+      if (key in args.updates)
+        continue;
+      if (!next.has(key) && current.has(key)) {
+        next.set(key, current.get(key));
+      }
+    }
+  }
+  return renderEnvIntegrations(next);
+}
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
 var VALID_CODE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var SECRET_FILE_MODE = 384;
-function shellQuote(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
+function writeEnvIntegrationsForAgent(codeName, args) {
+  const agentDir = getAgentDir(codeName);
+  const envPath = join4(agentDir, ".env.integrations");
+  let existing = null;
+  try {
+    existing = readFileSync5(envPath, "utf-8");
+  } catch {
+  }
+  if (existing === null && Object.keys(args.updates).length === 0)
+    return;
+  const content = mergeEnvIntegrationsContent(existing, args);
+  writeFileSync5(envPath, content, { mode: SECRET_FILE_MODE });
+  try {
+    chmodSync5(envPath, SECRET_FILE_MODE);
+  } catch {
+  }
+  try {
+    const projectDir = getProjectDir(codeName);
+    mkdirSync4(projectDir, { recursive: true });
+    const dest = join4(projectDir, ".env.integrations");
+    writeFileSync5(dest, content, { mode: SECRET_FILE_MODE });
+    try {
+      chmodSync5(dest, SECRET_FILE_MODE);
+    } catch {
+    }
+  } catch (err) {
+    process.stderr.write(`[env-integrations] [mirror-write-failed] agent=${codeName} error=${err.message}
+`);
+  }
 }
 function assertValidCodeName(codeName) {
   if (!VALID_CODE_NAME.test(codeName)) {
@@ -4070,14 +4238,23 @@ function deployArtifactsToProject(codeName, provisionDir) {
       return !(entry && typeof entry["url"] === "string" && entry["url"].startsWith("/"));
     }));
     projectMcp["mcpServers"] = { ...stripRelativeUrls(projectServers), ...stripRelativeUrls(agentServers) };
-    writeFileSync5(projectMcpPath, JSON.stringify(projectMcp, null, 2));
+    writeFileSync5(projectMcpPath, JSON.stringify(projectMcp, null, 2), { mode: MCP_FILE_MODE });
+    try {
+      chmodSync5(projectMcpPath, MCP_FILE_MODE);
+    } catch {
+    }
   } catch {
   }
   const agentDir = getAgentDir(codeName);
   for (const envFile of [".env", ".env.integrations"]) {
     try {
       const content = readFileSync5(join4(agentDir, envFile), "utf-8");
-      writeFileSync5(join4(projectDir, envFile), content);
+      const envDest = join4(projectDir, envFile);
+      writeFileSync5(envDest, content, { mode: SECRET_FILE_MODE });
+      try {
+        chmodSync5(envDest, SECRET_FILE_MODE);
+      } catch {
+      }
     } catch {
     }
   }
@@ -4751,7 +4928,13 @@ function buildMcpJson(input) {
     args: [localMcpPath],
     env: {
       AGT_HOST: process.env["AGT_HOST"] ?? "",
-      AGT_API_KEY: process.env["AGT_API_KEY"] ?? "",
+      // ENG-5901 Track D: templated — the manager exports AGT_API_KEY to
+      // every spawn env (getApiKey()), and Claude Code substitutes at
+      // MCP-launch (same contract as AGT_RUN_ID below). The impersonation
+      // redeem path renders this server-side with no AGT_API_KEY in env;
+      // impersonate-mcp-rewrite.ts treats the literal `${AGT_API_KEY}`
+      // placeholder as fillable and swaps in the operator token.
+      AGT_API_KEY: "${AGT_API_KEY}",
       AGT_AGENT_ID: input.agent.agent_id,
       AGT_AGENT_CODE_NAME: input.agent.code_name,
       // ENG-4561: Claude Code substitutes `${VAR}` in .mcp.json env values
@@ -5151,11 +5334,15 @@ ${sections}`
       const localTelegramChannel = join4(getHomeDir3(), ".augmented", "_mcp", "telegram-channel.js");
       const resolvedAgtHostForTelegram = process.env["AGT_HOST"]?.trim() || "https://api.augmented.team";
       const resolvedAgtApiKeyForTelegram = process.env["AGT_API_KEY"]?.trim();
+      writeEnvIntegrationsForAgent(codeName, {
+        mode: "upsert",
+        updates: { TELEGRAM_BOT_TOKEN: botToken }
+      });
       const telegramEnv = {
-        TELEGRAM_BOT_TOKEN: botToken,
+        TELEGRAM_BOT_TOKEN: "${TELEGRAM_BOT_TOKEN}",
         AGT_AGENT_CODE_NAME: codeName,
         AGT_HOST: resolvedAgtHostForTelegram,
-        ...resolvedAgtApiKeyForTelegram ? { AGT_API_KEY: resolvedAgtApiKeyForTelegram } : {},
+        ...resolvedAgtApiKeyForTelegram ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
         ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {},
         ...tzEnv
       };
@@ -5235,7 +5422,9 @@ ${sections}`
           ...blockKitAskUserEnabled ? { SLACK_BLOCK_KIT_ASK_USER_ENABLED: "true" } : {},
           ...blockKitDisabled ? { SLACK_BLOCK_KIT_DISABLED: "true" } : {},
           ...blockKitAskUserEnabled ? { AGT_HOST: resolvedAgtHost } : {},
-          ...blockKitAskUserEnabled && process.env["AGT_API_KEY"] ? { AGT_API_KEY: process.env["AGT_API_KEY"] } : {},
+          // ENG-5901 Track D: template (manager exports the real value
+          // to every spawn env); gate unchanged.
+          ...blockKitAskUserEnabled && process.env["AGT_API_KEY"] ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
           ...blockKitAskUserEnabled && options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
         } : {};
         if (botToken) {
@@ -5264,16 +5453,26 @@ ${sections}`
           const slackResolvedAgtApiKey = process.env["AGT_API_KEY"]?.trim();
           const slackAgtAuthEnv = {
             AGT_HOST: resolvedAgtHost,
-            ...slackResolvedAgtApiKey ? { AGT_API_KEY: slackResolvedAgtApiKey } : {},
+            // ENG-5901 Track D: template — manager exports AGT_API_KEY to
+            // every spawn env (getApiKey()); the gate still keys off the
+            // manager actually having one.
+            ...slackResolvedAgtApiKey ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
             ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
           };
+          writeEnvIntegrationsForAgent(codeName, {
+            mode: "upsert",
+            updates: {
+              SLACK_BOT_TOKEN: botToken,
+              ...appToken ? { SLACK_APP_TOKEN: appToken } : {}
+            }
+          });
           const localSlackChannel = join4(getHomeDir3(), ".augmented", "_mcp", "slack-channel.js");
           const slackEntry = {
             command: existsSync5(localSlackChannel) ? "node" : "npx",
             args: existsSync5(localSlackChannel) ? [localSlackChannel] : ["-y", "@augmented/claude-code-channel-slack"],
             env: {
-              SLACK_BOT_TOKEN: botToken,
-              ...appToken ? { SLACK_APP_TOKEN: appToken } : {},
+              SLACK_BOT_TOKEN: "${SLACK_BOT_TOKEN}",
+              ...appToken ? { SLACK_APP_TOKEN: "${SLACK_APP_TOKEN}" } : {},
               ...threadAutoFollow && threadAutoFollow !== "off" ? { SLACK_THREAD_AUTO_FOLLOW: threadAutoFollow } : {},
               // ENG-4464: only emit when non-default — `mention_only` is the
               // default in slack-response-mode.ts, so omitting keeps the env
@@ -5384,7 +5583,8 @@ ${sections}`
         ...oneshotBlockKitAskUserEnabled ? { SLACK_BLOCK_KIT_ASK_USER_ENABLED: "true" } : {},
         ...oneshotBlockKitDisabled ? { SLACK_BLOCK_KIT_DISABLED: "true" } : {},
         ...oneshotBlockKitAskUserEnabled ? { AGT_HOST: oneshotResolvedAgtHost } : {},
-        ...oneshotBlockKitAskUserEnabled && process.env["AGT_API_KEY"] ? { AGT_API_KEY: process.env["AGT_API_KEY"] } : {},
+        // ENG-5901 Track D: template; manager spawn env carries the value.
+        ...oneshotBlockKitAskUserEnabled && process.env["AGT_API_KEY"] ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
         ...oneshotBlockKitAskUserEnabled && options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
       } : {};
       const slackPeerEnv = {};
@@ -5417,16 +5617,24 @@ ${sections}`
       const slackAgtAuthEnv = {
         AGT_HOST: process.env["AGT_HOST"]?.trim() || "https://api.augmented.team",
         AGT_AGENT_CODE_NAME: codeName,
-        ...slackResolvedAgtApiKey ? { AGT_API_KEY: slackResolvedAgtApiKey } : {},
+        // ENG-5901 Track D: template; manager spawn env carries the value.
+        ...slackResolvedAgtApiKey ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
         ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
       };
+      writeEnvIntegrationsForAgent(codeName, {
+        mode: "upsert",
+        updates: {
+          SLACK_BOT_TOKEN: botToken,
+          ...appToken ? { SLACK_APP_TOKEN: appToken } : {}
+        }
+      });
       if (isPersistent && existsSync5(localSlackChannel)) {
         mcpServers["slack"] = {
           command: "node",
           args: [localSlackChannel],
           env: {
-            SLACK_BOT_TOKEN: botToken,
-            ...appToken ? { SLACK_APP_TOKEN: appToken } : {},
+            SLACK_BOT_TOKEN: "${SLACK_BOT_TOKEN}",
+            ...appToken ? { SLACK_APP_TOKEN: "${SLACK_APP_TOKEN}" } : {},
             ...slackAutoFollowEnv,
             ...slackResponseModeEnv,
             ...oneshotBlockKitEnv,
@@ -5440,8 +5648,8 @@ ${sections}`
           command: "npx",
           args: ["-y", "@augmented/claude-code-channel-slack"],
           env: {
-            SLACK_BOT_TOKEN: botToken,
-            ...appToken ? { SLACK_APP_TOKEN: appToken } : {},
+            SLACK_BOT_TOKEN: "${SLACK_BOT_TOKEN}",
+            ...appToken ? { SLACK_APP_TOKEN: "${SLACK_APP_TOKEN}" } : {},
             ...slackAutoFollowEnv,
             ...slackResponseModeEnv,
             ...oneshotBlockKitEnv,
@@ -5478,12 +5686,17 @@ ${sections}`
       const msteamsAgtAuthEnv = {
         AGT_HOST: process.env["AGT_HOST"]?.trim() || "https://api.augmented.team",
         AGT_AGENT_CODE_NAME: codeName,
-        ...msResolvedAgtApiKey ? { AGT_API_KEY: msResolvedAgtApiKey } : {},
+        // ENG-5901 Track D: template; manager spawn env carries the value.
+        ...msResolvedAgtApiKey ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
         ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
       };
+      writeEnvIntegrationsForAgent(codeName, {
+        mode: "upsert",
+        updates: { MSTEAMS_CLIENT_SECRET: clientSecret }
+      });
       const teamsEnv = {
         MSTEAMS_APP_ID: appId,
-        MSTEAMS_CLIENT_SECRET: clientSecret,
+        MSTEAMS_CLIENT_SECRET: "${MSTEAMS_CLIENT_SECRET}",
         MSTEAMS_TENANT_ID: tenantId,
         ...botObjectId ? { MSTEAMS_BOT_OBJECT_ID: botObjectId } : {},
         ...allowedTeamIds.length > 0 ? { MSTEAMS_ALLOWED_TEAMS: allowedTeamIds.join(",") } : {},
@@ -5601,19 +5814,19 @@ ${sections}`
       ...integration,
       credentials: decryptIntegrationCredentials(integration.credentials)
     }));
-    const envLines = ["# Augmented integrations \u2014 auto-generated, do not edit"];
+    const envUpdates = {};
     for (const integration of decryptedIntegrations) {
       const prefix = integration.definition_id.toUpperCase().replace(/[^A-Z0-9]/g, "_");
       const creds = integration.credentials;
       if (integration.auth_type === "oauth2") {
         const accessToken = creds.access_token;
         if (accessToken) {
-          envLines.push(`${prefix}_ACCESS_TOKEN=${shellQuote(accessToken)}`);
+          envUpdates[`${prefix}_ACCESS_TOKEN`] = accessToken;
         }
       } else if (integration.auth_type === "api_key") {
         const apiKey = creds.api_key;
         if (apiKey) {
-          envLines.push(`${prefix}_API_KEY=${shellQuote(apiKey)}`);
+          envUpdates[`${prefix}_API_KEY`] = apiKey;
         }
       }
       if (integration.config) {
@@ -5622,7 +5835,7 @@ ${sections}`
           if (typeof value === "string" && value) {
             const upperKey = key.toUpperCase();
             const envKey = upperKey.startsWith(`${prefix}_`) ? upperKey : `${prefix}_${upperKey}`;
-            envLines.push(`${envKey}=${shellQuote(value)}`);
+            envUpdates[envKey] = value;
           }
         }
       }
@@ -5633,16 +5846,15 @@ ${sections}`
       if (!defaults)
         continue;
       for (const [key, value] of Object.entries(defaults)) {
-        if (envLines.some((line) => line.startsWith(`${key}=`)))
+        if (key in envUpdates)
           continue;
-        envLines.push(`${key}=${shellQuote(value)}`);
+        envUpdates[key] = value;
       }
     }
-    if (envLines.length > 1) {
-      const envPath = join4(agentDir, ".env.integrations");
-      writeFileSync5(envPath, envLines.join("\n") + "\n");
-      chmodSync5(envPath, SECRET_FILE_MODE);
-    }
+    writeEnvIntegrationsForAgent(codeName, {
+      mode: "replace-preserving",
+      updates: envUpdates
+    });
     writeXurlStoreForIntegrations(decryptedIntegrations);
     for (const integration of decryptedIntegrations) {
       const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
@@ -5763,7 +5975,12 @@ ${sections}`
       const envSrc = join4(agentDir2, ".env.integrations");
       try {
         const envContent = readFileSync5(envSrc, "utf-8");
-        writeFileSync5(join4(projectDir, ".env.integrations"), envContent);
+        const envDest = join4(projectDir, ".env.integrations");
+        writeFileSync5(envDest, envContent, { mode: SECRET_FILE_MODE });
+        try {
+          chmodSync5(envDest, SECRET_FILE_MODE);
+        } catch {
+        }
       } catch {
       }
     } catch {
@@ -5788,6 +6005,26 @@ ${sections}`
     let serverEntry;
     if ("url" in config) {
       serverEntry = buildUrlMcpServerEntry(config.url, config.headers, config.type);
+      const hoisted = {};
+      const entryHeaders = serverEntry.headers;
+      if (entryHeaders) {
+        const composioKey = entryHeaders["x-api-key"];
+        if (composioKey && !composioKey.includes("${")) {
+          hoisted["COMPOSIO_API_KEY"] = composioKey;
+          entryHeaders["x-api-key"] = "${COMPOSIO_API_KEY}";
+        }
+      }
+      const entryEnv = serverEntry.env;
+      if (entryEnv) {
+        const pdSecret = entryEnv["PIPEDREAM_CLIENT_SECRET"];
+        if (pdSecret && !pdSecret.includes("${")) {
+          hoisted["PIPEDREAM_CLIENT_SECRET"] = pdSecret;
+          entryEnv["PIPEDREAM_CLIENT_SECRET"] = "${PIPEDREAM_CLIENT_SECRET}";
+        }
+      }
+      if (Object.keys(hoisted).length > 0) {
+        writeEnvIntegrationsForAgent(codeName, { mode: "upsert", updates: hoisted });
+      }
     } else {
       serverEntry = { command: config.command };
       if (config.args?.length)
@@ -7213,6 +7450,7 @@ async function managerUninstallSystemUnitCommand() {
 export {
   getIntegration,
   extractCommandNotFound,
+  LITERAL_SECRET_PATTERNS,
   safeWriteJsonAtomic,
   INTEGRATIONS_SECTION_START,
   INTEGRATIONS_SECTION_END,
@@ -7250,4 +7488,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-HAM7MGCF.js.map
+//# sourceMappingURL=chunk-EWWJUVDY.js.map