@integrity-labs/agt-cli 0.28.1051 → 0.28.1052

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-RE4DLJBA.js";
+} from "../chunk-3E63PEXT.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-FNUTMHWV.js";
+} from "../chunk-4ZH75WMF.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1051" : "dev";
+var cliVersion = true ? "0.28.1052" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1051" : "dev";
+var cliVersion2 = true ? "0.28.1052" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-RE4DLJBA.js → chunk-3E63PEXT.js}

@@ -16,7 +16,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-FNUTMHWV.js";
+} from "./chunk-4ZH75WMF.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -7122,7 +7122,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1051" : "dev";
+var agtCliVersion = true ? "0.28.1052" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -12079,4 +12079,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-RE4DLJBA.js.map
+//# sourceMappingURL=chunk-3E63PEXT.js.map

package/dist/{chunk-FNUTMHWV.js → chunk-4ZH75WMF.js}

@@ -7,6 +7,7 @@ import {
   claudeModelAlias,
   containerMemoryForAgentClass,
   encodeClaudeProjectPath,
+  extractFrontmatter,
   getOrCreateDailySession,
   isAutoTier,
   isClaudeFastMode,
@@ -349,6 +350,27 @@ function buildAllowedTools(mcpServerNames, policy) {
   const builtins = BASE_TOOLS.filter((t) => !removable.has(t));
   return [...mcpWildcardsForServers(mcpServerNames), ...builtins].join(",");
 }
+function webFetchDisallowedByNetworkPolicy(toolsFrontmatter) {
+  return toolsFrontmatter?.global_controls?.default_network_policy !== "allow";
+}
+function webFetchDenyFlags(denyWebFetch) {
+  return denyWebFetch === true ? ["--disallowedTools", "WebFetch"] : [];
+}
+function denyWebFetchForToolsContent(raw) {
+  const frontmatter = raw ? extractFrontmatter(raw).frontmatter : null;
+  return webFetchDisallowedByNetworkPolicy(frontmatter);
+}
+function webFetchRestartNeeded(prev, current) {
+  return prev !== current;
+}
+function webFetchBaselineValue(denyWebFetch) {
+  return denyWebFetch ? "deny" : "allow";
+}
+function resolveWebFetchBaseline(inMemory, persisted) {
+  if (inMemory !== void 0) return inMemory;
+  if (persisted === "deny") return true;
+  return false;
+}
 
 // src/lib/mcp-env-probe.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
@@ -4913,6 +4935,7 @@ function spawnSession(config, session) {
     args.push("--allowedTools", buildAllowedTools(mcpServerNames, config.toolPolicy));
     const builtinTools = builtinToolsForPolicy(config.toolPolicy);
     if (builtinTools !== null) args.push("--tools", builtinTools);
+    args.push(...webFetchDenyFlags(config.denyWebFetch));
     const initPrompt = resuming ? "" : 'You are now online. Say "Ready." and wait for incoming messages. Do not run any tools or load any data until a message arrives.';
     const claudeBin = resolveClaudeBinary();
     const claudeArgsJoined = args.map((a) => a.includes(" ") || a.includes("*") ? JSON.stringify(a) : a).join(" ");
@@ -5882,6 +5905,10 @@ export {
   resolveContainerMemory,
   seedContainerMemory,
   syncContainerMemory,
+  denyWebFetchForToolsContent,
+  webFetchRestartNeeded,
+  webFetchBaselineValue,
+  resolveWebFetchBaseline,
   agentRuntimeKey,
   log,
   sha256,
@@ -5984,4 +6011,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-FNUTMHWV.js.map
+//# sourceMappingURL=chunk-4ZH75WMF.js.map