@integrity-labs/agt-cli 0.28.1039 → 0.28.1041

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-X6D6UADI.js";
+} from "../chunk-7ORA3ZVJ.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-TAWCN7OK.js";
+} from "../chunk-OHT4PWAK.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-UB2HLH5P.js";
+} from "../chunk-TXRZFABA.js";
 import "../chunk-TQDIIS3X.js";
 import "../chunk-XWVM4KPK.js";
 import "../chunk-EL5MWGGH.js";
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1039" : "dev";
+var cliVersion = true ? "0.28.1041" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1039" : "dev";
+var cliVersion2 = true ? "0.28.1041" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-X6D6UADI.js → chunk-7ORA3ZVJ.js}

@@ -15,7 +15,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-TAWCN7OK.js";
+} from "./chunk-OHT4PWAK.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -77,7 +77,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-UB2HLH5P.js";
+} from "./chunk-TXRZFABA.js";
 import {
   classifyUnanswerablePane,
   isConsumerTermsDialogVisible,
@@ -7143,7 +7143,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1039" : "dev";
+var agtCliVersion = true ? "0.28.1041" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -12100,4 +12100,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-X6D6UADI.js.map
+//# sourceMappingURL=chunk-7ORA3ZVJ.js.map

package/dist/{chunk-TAWCN7OK.js → chunk-OHT4PWAK.js}

@@ -23,7 +23,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-UB2HLH5P.js";
+} from "./chunk-TXRZFABA.js";
 import {
   classifyUnanswerablePane,
   findUsageLimitResetHint,
@@ -5930,4 +5930,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-TAWCN7OK.js.map
+//# sourceMappingURL=chunk-OHT4PWAK.js.map

package/dist/{chunk-UB2HLH5P.js → chunk-TXRZFABA.js}

@@ -11260,10 +11260,45 @@ var OAUTH_PROVIDERS = {
       // bill at creation time. Read-only would force a follow-up manual
       // upload in Xero; write closes the loop.
       "accounting.attachments",
-      // accounting.transactions.read → granular read-only replacements
-      // for the surfaces we don't yet need write access on.
-      "accounting.payments.read",
-      "accounting.banktransactions.read",
+      // payments: write (CS-1845) enables `xero.payment.create`, which does
+      // PUT /Payments. These two were `.read` only, described as "surfaces we
+      // don't yet need write access on" — but the xero-broker had ALREADY
+      // registered write verbs against both, so the claim was false when it was
+      // written and the verbs could never succeed. A live approval of AUD
+      // 57,748.35 against INV-0407 was approved by a human and then failed with
+      // Xero `401 {Title: Unauthorized, Detail: AuthorizationUnsuccessful}`,
+      // AFTER the handler's single 401 refresh-retry — which is what rules out
+      // an expired token: a freshly refreshed token still 401s when the GRANT
+      // never carried the scope.
+      //
+      // banktransactions: write for the same reason — `xero.bank_transaction.delete`
+      // is registered and would have failed identically the first time anyone
+      // approved one. It is a DESTRUCTIVE verb, so it was one approval away from
+      // being the more alarming report.
+      //
+      // The variant without `.read` is the read+write granular scope, so the
+      // `.read` entries are gone from THIS list.
+      //
+      // That is not the same as "consent asks for them once" (Obi Wan
+      // `167f3932fcdf` on #6564 corrected an earlier version of this comment,
+      // which claimed it was). The authorize route unions `defaultScopes` with
+      // `listAgentRequiredOAuthScopes` (lib/agent-oauth-scope-deficit.ts, called
+      // from routes/integrations-oauth.ts), and the catalog's `xero:read` defined
+      // scope still lists `accounting.payments.read` and
+      // `accounting.banktransactions.read` in its `oauth_scopes` — so an agent
+      // with xero:read installed requests the `.read` variants alongside these.
+      // Harmless, because write implies read, but do not write comments here that
+      // describe the consent string as though this array were all of it.
+      //
+      // DO NOT substitute the broad `accounting.transactions`: Xero rejects the
+      // manifest for apps created after 2026-03-02 (see the note above).
+      //
+      // RECONNECT REQUIRED, same as `accounting.manualjournals` below: the broker
+      // posts with the agent's own OAuth access_token, so every existing install
+      // keeps failing until it reconnects and re-consents. Shipping this scope is
+      // necessary and NOT sufficient.
+      "accounting.payments",
+      "accounting.banktransactions",
       // manualjournals: write (CS-1439) enables the xero-broker to post
       // manual journals (reclasses, accruals, corrections) on approval. The
       // variant without `.read` is the read+write granular scope. Note: an
@@ -15648,4 +15683,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-UB2HLH5P.js.map
+//# sourceMappingURL=chunk-TXRZFABA.js.map