@integrity-labs/agt-cli 0.28.1014 → 0.28.1015

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-7QXIJNLA.js";
+} from "../chunk-GHHDFHKE.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-QBQLG2PY.js";
+} from "../chunk-MHDNKKEO.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-MLCGPEN6.js";
+} from "../chunk-RJ3SI5JG.js";
 import "../chunk-DHWNVVX4.js";
 import "../chunk-XWVM4KPK.js";
 import "../chunk-EL5MWGGH.js";
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1014" : "dev";
+var cliVersion = true ? "0.28.1015" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1014" : "dev";
+var cliVersion2 = true ? "0.28.1015" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-7QXIJNLA.js → chunk-GHHDFHKE.js}

@@ -15,7 +15,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-QBQLG2PY.js";
+} from "./chunk-MHDNKKEO.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -77,7 +77,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-MLCGPEN6.js";
+} from "./chunk-RJ3SI5JG.js";
 import {
   classifyUnanswerablePane,
   summarizeUnanswerablePane
@@ -1965,6 +1965,16 @@ function syncGitHubBrokerCredentialTooling(projectDir, enabled) {
 function getProjectDir2(codeName) {
   return join4(getAgentDir(codeName), "project");
 }
+function reapLegacyTokenFile(codeName, onWarn = void 0) {
+  const tokenFilePath = join4(getAgentDir(codeName), ".tokens.json");
+  try {
+    rmSync2(tokenFilePath, { force: true });
+    return true;
+  } catch (err) {
+    (onWarn ?? ((m) => console.warn(m)))(`[claudecode] ENG-10939: could not remove ${tokenFilePath} (${err.code ?? "unknown"}) \u2014 a plaintext OAuth token file remains on disk for '${codeName}' and needs manual removal`);
+    return false;
+  }
+}
 function getScratchDir(codeName) {
   return join4(getAgentDir(codeName), "scratch");
 }
@@ -6165,6 +6175,7 @@ ${sections}`
       };
     });
     writeIntegrationsSummaryForAgent(codeName, summariesForSidecar);
+    reapLegacyTokenFile(codeName, options?.log);
     const decryptedIntegrations = integrations.map((integration) => ({
       ...integration,
       // atrest-reader-context-allow: host adapter — POST /host/agent-integrations decrypts server-side and returns PLAINTEXT creds (the host holds no AUTH_ENCRYPTION_KEY and ResolvedIntegration carries no org/rowId to build a ref). This decrypt is dead-defensive on plaintext; a v2 (enc:2) blob never reaches the host (ENG-9110 trace).
@@ -6176,30 +6187,27 @@ ${sections}`
       const unscopedPrefix = remoteMcpEnvPrefix(integration.definition_id, null);
       const creds = integration.credentials;
       const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
-      if (integration.credentialDelivery === "broker")
-        continue;
-      let token;
-      if (integration.auth_type === "oauth2" || integration.auth_type === "github_app") {
-        token = creds.access_token;
-        if (token) {
-          envUpdates[`${prefix}_ACCESS_TOKEN`] = token;
+      if (integration.credentialDelivery !== "broker") {
+        let token;
+        if (integration.auth_type === "oauth2" || integration.auth_type === "github_app") {
+          token = creds.access_token;
+          if (token) {
+            envUpdates[`${prefix}_ACCESS_TOKEN`] = token;
+          }
+        } else if (integration.auth_type === "api_key") {
+          token = creds.api_key;
+          if (token) {
+            envUpdates[`${prefix}_API_KEY`] = token;
+          }
         }
-      } else if (integration.auth_type === "api_key") {
-        token = creds.api_key;
-        if (token) {
-          envUpdates[`${prefix}_API_KEY`] = token;
+        if (def?.cli_tool?.env_key && token && !(def.cli_tool.env_key in envUpdates)) {
+          envUpdates[def.cli_tool.env_key] = token;
         }
       }
-      if (def?.cli_tool) {
-        const { env_key, extra_env } = def.cli_tool;
-        if (env_key && token && !(env_key in envUpdates)) {
-          envUpdates[env_key] = token;
-        }
-        if (extra_env) {
-          for (const [k, v] of Object.entries(extra_env)) {
-            if (typeof v === "string" && v && !(k in envUpdates)) {
-              envUpdates[k] = v;
-            }
+      if (def?.cli_tool?.extra_env) {
+        for (const [k, v] of Object.entries(def.cli_tool.extra_env)) {
+          if (typeof v === "string" && v && !(k in envUpdates)) {
+            envUpdates[k] = v;
           }
         }
       }
@@ -6864,29 +6872,6 @@ ${sections}`
       child.on("error", () => {
       });
     });
-  },
-  writeTokenFile(codeName, integrations) {
-    const agentDir = getAgentDir(codeName);
-    mkdirSync3(agentDir, { recursive: true });
-    const tokens = {};
-    for (const integration of integrations) {
-      if (integration.auth_type !== "oauth2" && integration.auth_type !== "github_app")
-        continue;
-      const creds = decryptIntegrationCredentials(integration.credentials);
-      const accessToken = creds.access_token;
-      if (!accessToken)
-        continue;
-      tokens[integration.definition_id] = {
-        access_token: accessToken,
-        ...Object.keys(integration.config).length > 0 ? { config: integration.config } : {},
-        ...creds.token_expires_at ? { expires_at: creds.token_expires_at } : {}
-      };
-    }
-    if (Object.keys(tokens).length === 0)
-      return;
-    const tokenPath = join4(agentDir, ".tokens.json");
-    writeFileSync4(tokenPath, JSON.stringify(tokens, null, 2));
-    chmodSync4(tokenPath, SECRET_FILE_MODE);
   }
 };
 registerFramework(claudeCodeAdapter);
@@ -7008,7 +6993,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1014" : "dev";
+var agtCliVersion = true ? "0.28.1015" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11700,6 +11685,7 @@ export {
   extractCommandNotFound,
   describeChannelWriteFailure,
   migrateAgentDirToIdKeyed,
+  reapLegacyTokenFile,
   provisionStopHook,
   provisionIsolationHook,
   provisionAutoKanbanProgressHook,
@@ -11789,4 +11775,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-7QXIJNLA.js.map
+//# sourceMappingURL=chunk-GHHDFHKE.js.map