@integrity-labs/agt-cli 0.27.82 → 0.27.83

package/dist/bin/agt.js

@@ -28,7 +28,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-AN5X6CN2.js";
+} from "../chunk-HTXXJBB7.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -4930,7 +4930,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.82" : "dev";
+var cliVersion = true ? "0.27.83" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5853,7 +5853,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.82" : "dev";
+var cliVersion2 = true ? "0.27.83" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-AN5X6CN2.js → chunk-HTXXJBB7.js}

@@ -2369,8 +2369,12 @@ var LITERAL_SECRET_PATTERNS = [
   { name: "agt_host_api_key", re: /^tlk_/ },
   // Composio / generic api-key prefix — `ak_<...>`
   { name: "composio_api_key", re: /^ak_/ },
-  // Telegram bot token — `<10-digit bot id>:AAE<...>` (BotFather format).
-  { name: "telegram_bot_token", re: /^\d{10}:AAE/ },
+  // Telegram bot token — `<bot id>:AA<...>` (BotFather format). ENG-5901
+  // PR 4: the original `\d{10}:AAE` (from the issue AC) was too narrow —
+  // live tokens on agt-aws-1 carry `AA` + a varying third character
+  // (don/scout/stirling all had AA-not-E tokens the lint and migration
+  // missed). Bot ids are 8–12 digits; the token part always starts `AA`.
+  { name: "telegram_bot_token", re: /^\d{8,12}:AA[A-Za-z0-9_-]/ },
   // ENG-5901 extension beyond the original AC's five patterns: a literal
   // JWT (`eyJ...`) is the shape of a leaked AGT_API_KEY, which the
   // value-prefix patterns above would otherwise miss. Header values often
@@ -3963,27 +3967,30 @@ function migrateExistingLiteralSecrets(codeName) {
     existingEnvKeys = new Set(parseEnvFileEntries(readFileSync5(join4(getAgentDir(codeName), ".env.integrations"), "utf-8")).keys());
   } catch {
   }
-  const findings = scanConfigForLiteralSecrets(config);
-  if (findings.length === 0)
-    return;
   const updates = {};
-  const unmapped = [];
   let hoisted = 0;
-  for (const f of findings) {
-    const entry = config.mcpServers?.[f.server];
-    const block = f.location === "env" ? entry?.env : entry?.headers;
-    const envVar = MIGRATABLE_FIELD_TO_ENV_VAR[f.field];
-    const value = block?.[f.field];
-    if (!block || !envVar || typeof value !== "string") {
-      unmapped.push(`${f.server}.${f.field}`);
+  for (const raw of Object.values(config.mcpServers ?? {})) {
+    if (typeof raw !== "object" || raw === null)
       continue;
+    const entry = raw;
+    for (const block of [entry.env, entry.headers]) {
+      if (!block)
+        continue;
+      for (const [field, envVar] of Object.entries(MIGRATABLE_FIELD_TO_ENV_VAR)) {
+        const value = block[field];
+        if (typeof value !== "string" || value.length === 0 || value.includes("${"))
+          continue;
+        if (envVar !== "AGT_API_KEY" && !existingEnvKeys.has(envVar)) {
+          updates[envVar] = value;
+        }
+        block[field] = `\${${envVar}}`;
+        hoisted++;
+      }
     }
-    if (envVar !== "AGT_API_KEY" && !existingEnvKeys.has(envVar)) {
-      updates[envVar] = value;
-    }
-    block[f.field] = `\${${envVar}}`;
-    hoisted++;
   }
+  const unmapped = scanConfigForLiteralSecrets(config).map((f) => `${f.server}.${f.field}`);
+  if (hoisted === 0 && unmapped.length === 0)
+    return;
   if (hoisted === 0) {
     process.stderr.write(`[mcp-migrate] [no-mappable-literals] agent=${codeName} unmapped=${unmapped.join(",")}
 `);
@@ -7557,4 +7564,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-AN5X6CN2.js.map
+//# sourceMappingURL=chunk-HTXXJBB7.js.map