@integrity-labs/agt-cli 0.28.1020 → 0.28.1021

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-WFAXPLGT.js";
+} from "../chunk-SGAW3XWQ.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1020" : "dev";
+var cliVersion = true ? "0.28.1021" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1020" : "dev";
+var cliVersion2 = true ? "0.28.1021" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-WFAXPLGT.js → chunk-SGAW3XWQ.js}

@@ -1134,12 +1134,53 @@ var DecryptContextRequiredError = class extends SecretDecryptError {
   scope = "caller";
 };
 
+// ../../packages/core/dist/crypto/kek-ref.js
+var APP_KID_RE = /^[0-9a-f]{8}$/;
+var KMS_KEY_ARN_RE = /^arn:(aws|aws-cn|aws-us-gov|aws-iso[a-z-]*):kms:([a-z0-9-]+):(\d{12}):key\/(mrk-[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;
+var BARE_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function reject(ref, why) {
+  throw new MalformedEnvelopeError(`envelope: wrap entry ref ${JSON.stringify(ref)} ${why}`);
+}
+function parseKekRef(ref) {
+  const sep2 = ref.indexOf(":");
+  if (sep2 <= 0) {
+    if (BARE_UUID_RE.test(ref)) {
+      reject(ref, "is a bare epoch_id \u2014 that form was WITHDRAWN with A5 option (1) (ADR-0062, ENG-10908); a ref must be app:<kid> or kms:<arn>");
+    }
+    reject(ref, "has no namespace \u2014 expected app:<kid> or kms:<arn>");
+  }
+  const namespace = ref.slice(0, sep2);
+  const rest = ref.slice(sep2 + 1);
+  if (namespace === "app") {
+    if (!APP_KID_RE.test(rest)) {
+      reject(ref, "is not app:<kid> with kid = 8 lowercase hex chars");
+    }
+    return { namespace: "app", kid: rest };
+  }
+  if (namespace === "kms") {
+    const m = KMS_KEY_ARN_RE.exec(rest);
+    if (!m) {
+      if (/^arn:[^:]+:kms:[^:]*:\d{12}:alias\//.test(rest)) {
+        reject(ref, "is a KMS ALIAS arn \u2014 an alias is a mutable pointer, so it cannot bind custody (ADR-0062 A6); use the key arn (\u2026:key/<key-id>)");
+      }
+      reject(ref, "is not kms:<key arn> (arn:<partition>:kms:<region>:<account>:key/<key-id>)");
+    }
+    return {
+      namespace: "kms",
+      arn: rest,
+      region: m[2],
+      accountId: m[3],
+      keyId: m[4]
+    };
+  }
+  reject(ref, `has unknown namespace ${JSON.stringify(namespace)} \u2014 expected one of app, kms`);
+}
+
 // ../../packages/core/dist/crypto/envelope.js
 var PREFIX = "enc:";
 var V2_MARKER = "2";
 var IV_LENGTH = 12;
 var AUTH_TAG_LENGTH = 16;
-var KID_RE = /^[0-9a-f]{8}$/;
 function deriveKid(key) {
   return createHash("sha256").update(key).digest("hex").slice(0, 8);
 }
@@ -1161,6 +1202,7 @@ function decodeWrapList(w) {
     if (typeof entry.ref !== "string" || typeof entry.dek !== "string") {
       throw new MalformedEnvelopeError("envelope: wrap entry ref/dek must be strings");
     }
+    parseKekRef(entry.ref);
     return { ref: entry.ref, dek: entry.dek };
   });
 }
@@ -1179,7 +1221,7 @@ function decodeHeader(bytes) {
     if (keys.length !== 2 || keys[0] !== "kid" || keys[1] !== "s") {
       throw new MalformedEnvelopeError("envelope: scheme a header must have exactly {s, kid}");
     }
-    if (typeof decoded.kid !== "string" || !KID_RE.test(decoded.kid)) {
+    if (typeof decoded.kid !== "string" || !APP_KID_RE.test(decoded.kid)) {
       throw new MalformedEnvelopeError("envelope: scheme a kid must be 8 lowercase hex chars");
     }
     return { s: "a", kid: decoded.kid };
@@ -1250,6 +1292,36 @@ function buildAad(headerBytes, ctx) {
 // ../../packages/core/dist/crypto/secret.js
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
 
+// ../../packages/core/dist/crypto/dek-cache.js
+var DEFAULT_DEK_CACHE_TTL_MS = 5 * 6e4;
+var cache = /* @__PURE__ */ new Map();
+var failures = /* @__PURE__ */ new Map();
+function cacheKey(entry) {
+  return `${entry.ref}\0${entry.dek}`;
+}
+function getDekFailure(entry) {
+  const key = cacheKey(entry);
+  const hit = failures.get(key);
+  if (!hit)
+    return null;
+  if (hit.expiresAt <= Date.now()) {
+    failures.delete(key);
+    return null;
+  }
+  return hit.err;
+}
+function getCachedDek(entry) {
+  const key = cacheKey(entry);
+  const hit = cache.get(key);
+  if (!hit)
+    return null;
+  if (hit.expiresAt <= Date.now()) {
+    cache.delete(key);
+    return null;
+  }
+  return hit.dek;
+}
+
 // ../../packages/core/dist/crypto/keyring.js
 var ACTIVE_ENV = "AUTH_ENCRYPTION_KEY";
 var PREVIOUS_ENV = "AUTH_ENCRYPTION_KEY_PREVIOUS";
@@ -1321,13 +1393,42 @@ function decryptSecret(encoded, context) {
         throw new AeadAuthFailureError(`scheme-a decrypt failed authentication for kid ${parsed.header.kid} (AAD mismatch or tampering)`, { cause });
       }
     }
-    // Schemes k/c are grammar this build parses but cannot unwrap — the KEK/DEK
-    // path is ADR-0062. A blob under either cannot exist in a 0061-only fleet
-    // (the writer never emits them); these throw so dispatch is total and typed.
+    // Schemes k/c: the value is under a DEK, and the DEK is wrapped inline in the
+    // header's `w` list (ADR-0062 A5 option 2). The unwrap is ASYNC and this
+    // function is not, so the DEK must already be in the process cache — phase
+    // (2) of the two-phase read (`collectWrapEntries` + `await primeDeks`) puts
+    // it there. See dek-cache.ts for why the seam is shaped this way.
     case "k":
-      throw new PlatformKekUnavailableError("scheme k (platform-CMK DEK) unwrap is not available in this build (ADR-0062)");
-    case "c":
-      throw new CustomerKekUnavailableError("scheme c (customer-CMK DEK) unwrap is not available in this build (ADR-0062)");
+    case "c": {
+      const scheme = parsed.header.s;
+      if (!context) {
+        throw new DecryptContextRequiredError("decryptSecret: a v2 envelope requires a DecryptContext to reconstruct its AAD");
+      }
+      if (scheme === "c" && parsed.header.w.length > 1) {
+        throw new CustomerKekUnavailableError(`scheme c: this row dual-wraps ${parsed.header.w.length} DEK entries, and which custody may satisfy it is an ADR-0062 increment D decision that has not been made \u2014 refusing rather than letting a platform wrap override a revoked customer KEK`);
+      }
+      let dek = null;
+      for (const entry of parsed.header.w) {
+        dek = getCachedDek(entry);
+        if (dek)
+          break;
+      }
+      if (!dek) {
+        for (const entry of parsed.header.w) {
+          const failure = getDekFailure(entry);
+          if (failure)
+            throw failure;
+        }
+        const detail = `no unwrapped DEK cached for any of this row's ${parsed.header.w.length} wrap entries \u2014 either the KEK is unavailable, or the read path did not prime the cache (collectWrapEntries + await primeDeks) before decrypting`;
+        throw scheme === "k" ? new PlatformKekUnavailableError(`scheme k: ${detail}`) : new CustomerKekUnavailableError(`scheme c: ${detail}`);
+      }
+      const aad = buildAad(parsed.headerBytes, context);
+      try {
+        return gcmDecrypt(dek, parsed.iv, parsed.data, aad);
+      } catch (cause) {
+        throw new AeadAuthFailureError(`scheme-${scheme} decrypt failed authentication (AAD mismatch or tampering)`, { cause });
+      }
+    }
   }
 }
 function decryptV1(iv, data) {
@@ -2454,13 +2555,26 @@ function provisionStopHook(codeName) {
     'rm -f "$MARKER"',
     'AGT_HOST="${AGT_HOST:-}"; AGT_API_KEY="${AGT_API_KEY:-}"',
     'if [ -z "$AGT_HOST" ] || [ -z "$AGT_API_KEY" ]; then exit 0; fi',
-    'JWT=$(curl -sf -X POST "${AGT_HOST}/host/exchange" -H "Content-Type: application/json" -d "{\\"api_key\\": \\"${AGT_API_KEY}\\"}" | jq -r \'.token // empty\' 2>/dev/null || true)',
+    // CS-1787: the key goes in on STDIN, never in argv. Every agent on a host
+    // runs as root and /proc/<pid>/cmdline is world-readable (0444), so a shell
+    // that expands a secret into a command-line argument publishes it to every
+    // other tenant on the box for the lifetime of the call.
+    //
+    // `AGT_API_KEY=... jq` is a command PREFIX assignment, so the value travels
+    // in the environment rather than argv, and jq reads it with `env.` — which
+    // also makes the body JSON-safe, unlike the string interpolation this
+    // replaces. `-d @-` tells curl to read the body from stdin.
+    //
+    // `printf ... | curl --config -` for the bearer token, which is the form
+    // `STDIN_CREDENTIAL_EXAMPLE` in security/argv-credentials.ts prescribes.
+    // printf is a shell BUILTIN, so it forks nothing and has no argv to read.
+    `JWT=$(AGT_API_KEY="$AGT_API_KEY" jq -nc '{api_key: env.AGT_API_KEY}' | curl -sf -X POST "\${AGT_HOST}/host/exchange" -H "Content-Type: application/json" -d @- | jq -r '.token // empty' 2>/dev/null || true)`,
     'if [ -z "$JWT" ]; then exit 0; fi',
     'case "$TEMPLATE_ID" in',
     "  daily-standup|standup|weekly-standup)",
-    `    curl -sf -X POST "\${AGT_HOST}/host/agent-status" -H "Content-Type: application/json" -H "Authorization: Bearer $JWT" -d "$(jq -n --arg a \\"$AGENT_ID\\" --arg s \\"$RESP\\" '{agent_id:$a,standup:$s,current_status:"idle"}')" >/dev/null 2>&1 & ;;`,
+    `    printf 'header = "Authorization: Bearer %s"\\n' "$JWT" | curl -sf --config - -X POST "\${AGT_HOST}/host/agent-status" -H "Content-Type: application/json" -d "$(jq -n --arg a \\"$AGENT_ID\\" --arg s \\"$RESP\\" '{agent_id:$a,standup:$s,current_status:"idle"}')" >/dev/null 2>&1 & ;;`,
     "  *)",
-    `    curl -sf -X POST "\${AGT_HOST}/host/agent-status" -H "Content-Type: application/json" -H "Authorization: Bearer $JWT" -d "$(jq -n --arg a \\"$AGENT_ID\\" --arg t \\"$RESP\\" '{agent_id:$a,current_tasks:$t}')" >/dev/null 2>&1 & ;;`,
+    `    printf 'header = "Authorization: Bearer %s"\\n' "$JWT" | curl -sf --config - -X POST "\${AGT_HOST}/host/agent-status" -H "Content-Type: application/json" -d "$(jq -n --arg a \\"$AGENT_ID\\" --arg t \\"$RESP\\" '{agent_id:$a,current_tasks:$t}')" >/dev/null 2>&1 & ;;`,
     "esac",
     "exit 0"
   ].join("\n") + "\n";
@@ -3785,10 +3899,19 @@ HOST="\${AGT_HOST:-}"
 KEY="\${AGT_API_KEY:-}"
 [ -n "$AGENT_ID" ] && [ -n "$HOST" ] && [ -n "$KEY" ] || exit 0
 
-JWT="$(curl -sf --connect-timeout 2 --max-time 5 -X POST "\${HOST}/host/exchange" -H 'Content-Type: application/json' -d "$(jq -n --arg k "$KEY" '{api_key:$k}')" 2>/dev/null | jq -r '.token // empty' 2>/dev/null || true)"
+# CS-1787: the key goes in on STDIN, never in argv (/proc/<pid>/cmdline is
+# world-readable 0444 and every agent here runs as root). The form this
+# replaces leaked TWICE: the command substitution ran first, so jq held the
+# key in its own argv before curl ever saw it. A command PREFIX assignment
+# passes it through the environment instead, and jq's env. lookup keeps the body
+# JSON-safe into the bargain.
+JWT="$(AGT_API_KEY="$KEY" jq -nc '{api_key: env.AGT_API_KEY}' | curl -sf --connect-timeout 2 --max-time 5 -X POST "\${HOST}/host/exchange" -H 'Content-Type: application/json' -d @- 2>/dev/null | jq -r '.token // empty' 2>/dev/null || true)"
 [ -n "$JWT" ] || exit 0
 
-BOARD="$(curl -sf --connect-timeout 2 --max-time 5 -X POST "\${HOST}/host/my-kanban" -H 'Content-Type: application/json' -H "Authorization: Bearer $JWT" -d "$(jq -n --arg a "$AGENT_ID" '{agent_id:$a}')" 2>/dev/null || true)"
+# Bearer on stdin via a curl config, per STDIN_CREDENTIAL_EXAMPLE in
+# security/argv-credentials.ts. printf is a shell builtin, so it forks
+# nothing and there is no argv to read.
+BOARD="$(printf 'header = "Authorization: Bearer %s"\\n' "$JWT" | curl -sf --config - --connect-timeout 2 --max-time 5 -X POST "\${HOST}/host/my-kanban" -H 'Content-Type: application/json' -d "$(jq -n --arg a "$AGENT_ID" '{agent_id:$a}')" 2>/dev/null || true)"
 [ -n "$BOARD" ] || exit 0
 
 # The counts that matter. \`waiting\` is deliberately NOT counted as work: a card
@@ -3944,9 +4067,14 @@ if [ -f "$TOKEN_FILE" ]; then
   [ $(( T_EXP - NOW )) -gt 300 ] && TOKEN="$(jq -r '.token // empty' "$TOKEN_FILE" 2>/dev/null || true)"
 fi
 if [ -z "$TOKEN" ]; then
-  EX="$(curl -fsS --max-time 5 -X POST "$HOST/host/exchange" \\
+  # CS-1787: key on STDIN, never in argv. /proc/<pid>/cmdline is world-readable
+  # (0444) and every agent on this host runs as root, so an expanded secret is
+  # readable by every other tenant for the life of the call. jq's env. lookup also
+  # makes the body JSON-safe, which the interpolation it replaces was not.
+  EX="$(AGT_API_KEY="$KEY" jq -nc '{host_key: env.AGT_API_KEY}' \\
+        | curl -fsS --max-time 5 -X POST "$HOST/host/exchange" \\
         -H 'Content-Type: application/json' \\
-        -d "{\\"host_key\\":\\"$KEY\\"}" 2>/dev/null || true)"
+        -d @- 2>/dev/null || true)"
   TOKEN="$(printf '%s' "$EX" | jq -r '.token // empty' 2>/dev/null || true)"
   [ -n "$TOKEN" ] || exit 0
   EXP_ISO="$(printf '%s' "$EX" | jq -r '.expires_at // empty' 2>/dev/null || true)"
@@ -3960,9 +4088,14 @@ fi
 
 # Fire-and-forget the push (never block the agent's tool flow).
 BODY="$(jq -nc --arg a "$AGENT_ID" --arg s "$STEP" '{agent_id:$a, step:$s}' 2>/dev/null || printf '{"agent_id":"%s","step":"%s"}' "$AGENT_ID" "$STEP")"
-( curl -fsS --max-time 4 -X POST "$HOST/host/kanban/auto-progress" \\
+# CS-1787: bearer on stdin via a curl config, per STDIN_CREDENTIAL_EXAMPLE in
+# security/argv-credentials.ts. This one the existing header predicate already
+# matched - the $TOKEN name is credential-shaped and sits inside a -H argument - so
+# wiring the guard into the hook-script tests forces it fixed alongside the
+# three -d bodies. printf is a shell builtin: nothing forks, no argv to read.
+( printf 'header = "Authorization: Bearer %s"\\n' "$TOKEN" \\
+    | curl -fsS --config - --max-time 4 -X POST "$HOST/host/kanban/auto-progress" \\
     -H 'Content-Type: application/json' \\
-    -H "Authorization: Bearer $TOKEN" \\
     -d "$BODY" >/dev/null 2>&1 || true ) &
 
 exit 0
@@ -7007,7 +7140,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1020" : "dev";
+var agtCliVersion = true ? "0.28.1021" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7332,8 +7465,8 @@ function writeFlagsCache(path, file) {
   atomicWriteFileSync(path, `${JSON.stringify(file, null, 2)}
 `);
 }
-function flagsCacheAgeSeconds(cache2, path, now = /* @__PURE__ */ new Date()) {
-  const fromRecorded = Date.parse(cache2.updated_at);
+function flagsCacheAgeSeconds(cache3, path, now = /* @__PURE__ */ new Date()) {
+  const fromRecorded = Date.parse(cache3.updated_at);
   if (!Number.isNaN(fromRecorded)) {
     return Math.max(0, (now.getTime() - fromRecorded) / 1e3);
   }
@@ -10767,7 +10900,7 @@ import { spawn as spawn2 } from "child_process";
 import { readFileSync as readFileSync9 } from "fs";
 var DEFAULT_ARCHIVE_ADDRESS_PATH = "/var/lib/augmented/session-archive-address.json";
 var CACHE_TTL_MS = 5 * 60 * 1e3;
-var cache = /* @__PURE__ */ new Map();
+var cache2 = /* @__PURE__ */ new Map();
 function str(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
@@ -10776,7 +10909,7 @@ function str(value) {
 function readHostArchiveAddress(path) {
   const file = path ?? process.env["ARCHIVE_ADDRESS_FILE"]?.trim() ?? process.env["AGT_SESSION_ARCHIVE_ADDRESS_FILE"]?.trim() ?? DEFAULT_ARCHIVE_ADDRESS_PATH;
   const now = Date.now();
-  const hit = cache.get(file);
+  const hit = cache2.get(file);
   if (hit && now - hit.at < CACHE_TTL_MS) return hit.value;
   let value = null;
   try {
@@ -10798,7 +10931,7 @@ function readHostArchiveAddress(path) {
   } catch {
     value = null;
   }
-  cache.set(file, { at: now, value });
+  cache2.set(file, { at: now, value });
   return value;
 }
 
@@ -11961,4 +12094,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-WFAXPLGT.js.map
+//# sourceMappingURL=chunk-SGAW3XWQ.js.map