@integrity-labs/agt-cli 0.28.1006 → 0.28.1008

package/dist/{chunk-Z5UDL4AB.js → chunk-VBQU3ATJ.js}

@@ -15,7 +15,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-O6R6HS2Z.js";
+} from "./chunk-7IA22OU6.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -75,7 +75,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-XWMUQR65.js";
+} from "./chunk-KGVYZBS2.js";
 import {
   classifyUnanswerablePane,
   summarizeUnanswerablePane
@@ -83,6 +83,11 @@ import {
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
+import {
+  claudeJsonPathFor,
+  effectiveClaudeJsonPath,
+  inspectClaudeConfig
+} from "./chunk-EL5MWGGH.js";
 
 // ../../packages/core/dist/provisioning/mcp-config-guards.js
 import { chmodSync, existsSync, readFileSync, renameSync, writeFileSync, unlinkSync } from "fs";
@@ -2166,10 +2171,24 @@ function resolveBrokerAgentId(codeName, fallback) {
   return void 0;
 }
 function ensureWorkspaceTrusted(projectDir) {
-  const configPath = join4(homedir3(), ".claude.json");
+  const configPath = effectiveClaudeJsonPath();
   try {
     let config = {};
-    if (existsSync4(configPath)) {
+    const inConfigDir = claudeJsonPathFor();
+    if (configPath !== inConfigDir) {
+      const dirState = inspectClaudeConfig(inConfigDir);
+      if (dirState === "unreadable" || dirState === "symlink") {
+        process.stderr.write(`[workspace-trust] [config-dir-unusable] state=${dirState} path=${inConfigDir} \u2014 writing the trust flag to ${configPath}, which is what agents on this host read
+`);
+      }
+    }
+    const state = inspectClaudeConfig(configPath);
+    if (state === "symlink") {
+      process.stderr.write(`[workspace-trust] [refused-symlink] project=${projectDir} path=${configPath}
+`);
+      return;
+    }
+    if (state !== "missing") {
       const raw = readFileSync4(configPath, "utf-8");
       if (raw.trim()) {
         config = JSON.parse(raw);
@@ -2182,9 +2201,22 @@ function ensureWorkspaceTrusted(projectDir) {
     entry["hasTrustDialogAccepted"] = true;
     projects[projectDir] = entry;
     config["projects"] = projects;
+    mkdirSync3(dirname3(configPath), { recursive: true });
     const tmpPath = `${configPath}.agt-${process.pid}.tmp`;
-    writeFileSync4(tmpPath, `${JSON.stringify(config, null, 2)}
-`, { mode: 384 });
+    try {
+      writeFileSync4(tmpPath, `${JSON.stringify(config, null, 2)}
+`, {
+        mode: 384,
+        flag: "wx"
+      });
+    } catch (err) {
+      if (err.code === "EEXIST") {
+        process.stderr.write(`[workspace-trust] [refused-temp-exists] project=${projectDir} path=${tmpPath} \u2014 something is already at the manager's temp path; refusing to write through it
+`);
+        return;
+      }
+      throw err;
+    }
     renameSync4(tmpPath, configPath);
     process.stderr.write(`[workspace-trust] [accepted] project=${projectDir}
 `);
@@ -6974,7 +7006,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1006" : "dev";
+var agtCliVersion = true ? "0.28.1008" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11755,4 +11787,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-Z5UDL4AB.js.map
+//# sourceMappingURL=chunk-VBQU3ATJ.js.map