@integrity-labs/agt-cli 0.28.1073 → 0.28.1075

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-IAHNUTZX.js";
+} from "../chunk-X6L3BRJI.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-NMPSEFF2.js";
+} from "../chunk-XNIN4UH6.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-6RYGVXLR.js";
+} from "../chunk-HE3ZAMGG.js";
 import "../chunk-OCMJ5E6J.js";
 import "../chunk-XWVM4KPK.js";
 import "../chunk-EL5MWGGH.js";
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1073" : "dev";
+var cliVersion = true ? "0.28.1075" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1073" : "dev";
+var cliVersion2 = true ? "0.28.1075" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-6RYGVXLR.js → chunk-HE3ZAMGG.js}

@@ -1189,11 +1189,67 @@ var ADVISORY_LEVEL_LINE = {
   warn: "Level: warn \u2014 proceed only if clearly justified; say so.",
   log: "Level: log \u2014 informational; proceed."
 };
-function renderAdvisoryGuardrailBullet(g) {
+var REQUIRE_APPROVAL_FOR_ACTIONS_DEF = "require-approval-for-actions";
+var REQUIRE_APPROVAL_HOW = {
+  enforce: [
+    `  To get approval for one of these actions, call \`request_approval\` (it goes to your`,
+    `  manager), tell the user you have asked, and end your turn. Later, call \`check_approval\``,
+    `  with the request_id and act only once it is approved; if it is denied or expires, do`,
+    `  not act, and tell the user. Never just say you are waiting for, or cannot reach, your`,
+    `  manager without filing the request. If \`request_approval\` fails, say so and leave the`,
+    `  action undone.`
+  ],
+  warn: [
+    `  When one of these actions is not clearly justified, ask rather than decline: call`,
+    `  \`request_approval\` (it goes to your manager), end your turn, and act only once`,
+    `  \`check_approval\` says it is approved.`
+  ]
+};
+var REQUIRE_APPROVAL_EMAIL_ACTION = "send_email";
+var EMAIL_REQUIRE_APPROVAL_DEF = "email.require_approval";
+function liveEmailHoldActions(guardrails) {
+  const g = guardrails.find((x) => x.definitionId === EMAIL_REQUIRE_APPROVAL_DEF);
+  if (!g || g.enforcement !== "enforce" || g.emailHold?.live !== true)
+    return null;
+  const raw = g.emailHold.coveredActions;
+  const covered = Array.isArray(raw) ? raw.filter((a) => typeof a === "string" && a.trim() !== "") : [];
+  return covered.length > 0 ? covered : null;
+}
+function requireApprovalEmailException(covered) {
+  return [
+    `  Except \`${REQUIRE_APPROVAL_EMAIL_ACTION}\` with ${covered.map((a) => `\`${a}\``).join(", ")}: your organization's`,
+    `  email approval hold puts every such send in front of a human, so for those do not call`,
+    `  \`request_approval\` and do not decline on this guardrail's basis. Attempt the send and let`,
+    `  that hold decide; asking first would make your manager approve the same email twice. Any`,
+    `  other way of sending email is not held: ask first with \`request_approval\`.`
+  ];
+}
+function requireApprovalActions(config) {
+  const raw = config?.["actions"];
+  if (!Array.isArray(raw))
+    return null;
+  const actions = raw.filter((a) => typeof a === "string" && a.trim() !== "").map((a) => a.trim());
+  return actions.length > 0 ? actions : null;
+}
+function requireApprovalHowLines(g, level, emailHold) {
+  const actions = requireApprovalActions(g.config);
+  const namesEmail = actions === null || actions.includes(REQUIRE_APPROVAL_EMAIL_ACTION);
+  const namesOther = actions === null || actions.some((a) => a !== REQUIRE_APPROVAL_EMAIL_ACTION);
+  const ask = namesOther || namesEmail && emailHold === null;
+  return [
+    ...ask ? REQUIRE_APPROVAL_HOW[level] : [],
+    ...namesEmail && emailHold !== null ? requireApprovalEmailException(emailHold) : []
+  ];
+}
+function renderAdvisoryGuardrailBullet(g, emailHold) {
   const [header, ...rest] = renderGuardrailBullet(g).split("\n");
   const level = g.enforcement === "warn" || g.enforcement === "log" ? g.enforcement : "enforce";
-  return [header, `  ${ADVISORY_LEVEL_LINE[level]}`, ...rest].join("\n");
+  const isRequireApproval = g.definitionId === REQUIRE_APPROVAL_FOR_ACTIONS_DEF;
+  const how = isRequireApproval && level !== "log" ? requireApprovalHowLines(g, level, emailHold) : [];
+  const levelLine = isRequireApproval && level === "enforce" ? REQUIRE_APPROVAL_ENFORCE_LEVEL_LINE : ADVISORY_LEVEL_LINE[level];
+  return [header, `  ${levelLine}`, ...how, ...rest].join("\n");
 }
+var REQUIRE_APPROVAL_ENFORCE_LEVEL_LINE = "Level: enforce \u2014 never take these actions without approval; get it as described below.";
 function renderOverriddenGuardrailBullet(g) {
   const reason = g.overrideReason?.trim() ?? "";
   const lines = [`- **${g.displayName}** (${g.category}, from ${g.source})`];
@@ -1291,7 +1347,8 @@ function buildGuardrailsSection(guardrails) {
   }
   if (advisory.length > 0) {
     blocks.push(``, `### Advisory (policy only \u2014 not enforced by the platform)`, ``, `Follow these as operator instructions, at the level each one states (it`, `replaces the refuse-by-default rule above). No platform control backs them, so`, `never say an action was blocked, held for approval, or audited on their`, `basis \u2014 if you decline, say so and why.`, ``);
-    blocks.push(advisory.map(renderAdvisoryGuardrailBullet).join("\n"));
+    const emailHold = liveEmailHoldActions(active);
+    blocks.push(advisory.map((g) => renderAdvisoryGuardrailBullet(g, emailHold)).join("\n"));
   }
   if (overridden.length > 0) {
     blocks.push(``, `### Approved exceptions (an operator override applies - follow the adjusted policy)`, ``);
@@ -16061,4 +16118,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-6RYGVXLR.js.map
+//# sourceMappingURL=chunk-HE3ZAMGG.js.map