@integrity-labs/agt-cli 0.28.1077 → 0.28.1079

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-RAIBOJ2A.js";
+} from "../chunk-TTSW5ZM2.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-QNS7N4QX.js";
+} from "../chunk-OGMCA67P.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-4WAUXFY7.js";
+} from "../chunk-5SASCNYV.js";
 import "../chunk-OCMJ5E6J.js";
 import "../chunk-XWVM4KPK.js";
 import "../chunk-EL5MWGGH.js";
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1077" : "dev";
+var cliVersion = true ? "0.28.1079" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1077" : "dev";
+var cliVersion2 = true ? "0.28.1079" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-4WAUXFY7.js → chunk-5SASCNYV.js}

@@ -1170,6 +1170,34 @@ function formatEmptyChannelAllowlistLines() {
     `  the removal (ENG-9663).`
   ];
 }
+var EMAIL_MAIL_RULES_DEF = "email.mail_rules";
+var MAIL_RULE_DISPOSITION_TEXT = {
+  egress: "forwards or redirects mail to another address",
+  suppression: "hides mail from its owner (trash, delete, archive or mark as read)",
+  opaque: "has an effect that can't be read from the request (including deleting a rule)"
+};
+function formatMailRuleHoldLines(hold) {
+  const which = hold.heldDispositions.map((d) => `  - a rule that ${MAIL_RULE_DISPOSITION_TEXT[d] ?? d}`);
+  if (hold.live) {
+    return [
+      `  The platform holds these mail-rule changes for an Approve/Deny card, and approving`,
+      `  the card releases the change:`,
+      ...which,
+      `  When asked for one, attempt it: do not decline on this guardrail's basis. Tell the`,
+      `  user it is waiting for approval, and do not say it was made until it is approved.`
+    ];
+  }
+  return [`  Not held by the platform yet: these mail-rule changes go through and are only recorded:`, ...which];
+}
+function effectiveMailRuleEnforcement(g) {
+  if (g.definitionId !== EMAIL_MAIL_RULES_DEF)
+    return g.enforcement;
+  if (g.mailRuleHold === void 0)
+    return g.enforcement;
+  if (g.enforcement !== "enforce")
+    return g.enforcement;
+  return g.mailRuleHold.live ? "warn" : "log";
+}
 function renderGuardrailBullet(g) {
   const lines = [];
   const header = `- **${g.displayName}** (${g.category}, from ${g.source})`;
@@ -1177,7 +1205,7 @@ function renderGuardrailBullet(g) {
   if (g.description?.trim()) {
     lines.push(`  ${g.description.trim()}`);
   }
-  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : g.definitionId === CALENDAR_CONFIDENTIALITY_DEF ? formatCalendarConfidentialityLines(g.config) : (
+  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : g.definitionId === CALENDAR_CONFIDENTIALITY_DEF ? formatCalendarConfidentialityLines(g.config) : g.definitionId === EMAIL_MAIL_RULES_DEF && g.mailRuleHold ? formatMailRuleHoldLines(g.mailRuleHold) : (
     // ENG-9663: checked AFTER the two named formatters, so an email or
     // calendar guardrail can never be captured by the structural match.
     hasEmptyChannelAllowlist(g) ? formatEmptyChannelAllowlistLines() : formatConfigLines(g.config)
@@ -1197,16 +1225,18 @@ var REQUIRE_APPROVAL_HOW = {
     `  with the request_id and act only once it is approved; if it is denied or expires, do`,
     `  not act, and tell the user. Never just say you are waiting for, or cannot reach, your`,
     `  manager without filing the request. If \`request_approval\` fails, say so and leave the`,
-    `  action undone. For an email, pass \`detail.email\` = { to, from, subject } so your`,
-    `  manager sees who it goes to.`
+    `  action undone.`
   ],
   warn: [
     `  When one of these actions is not clearly justified, ask rather than decline: call`,
     `  \`request_approval\` (it goes to your manager), end your turn, and act only once`,
-    `  \`check_approval\` says it is approved. For an email, pass \`detail.email\` =`,
-    `  { to, from, subject }.`
+    `  \`check_approval\` says it is approved.`
   ]
 };
+var REQUIRE_APPROVAL_EMAIL_DETAIL = [
+  `  For an email, pass \`detail.email\` = { to, from, subject } so your manager sees who it`,
+  `  goes to.`
+];
 var REQUIRE_APPROVAL_EMAIL_ACTION = "send_email";
 var EMAIL_REQUIRE_APPROVAL_DEF = "email.require_approval";
 function liveEmailHoldActions(guardrails) {
@@ -1223,7 +1253,8 @@ function requireApprovalEmailException(covered) {
     `  email approval hold puts every such send in front of a human, so for those do not call`,
     `  \`request_approval\` and do not decline on this guardrail's basis. Attempt the send and let`,
     `  that hold decide; asking first would make your manager approve the same email twice. Any`,
-    `  other way of sending email is not held: ask first with \`request_approval\`.`
+    `  other way of sending email is not held: ask first with \`request_approval\`, and when you`,
+    `  do, pass \`detail.email\` = { to, from, subject } so your manager sees who it goes to.`
   ];
 }
 function requireApprovalActions(config) {
@@ -1237,9 +1268,11 @@ function requireApprovalHowLines(g, level, emailHold) {
   const actions = requireApprovalActions(g.config);
   const namesEmail = actions === null || actions.includes(REQUIRE_APPROVAL_EMAIL_ACTION);
   const namesOther = actions === null || actions.some((a) => a !== REQUIRE_APPROVAL_EMAIL_ACTION);
-  const ask = namesOther || namesEmail && emailHold === null;
+  const asksAboutEmail = namesEmail && emailHold === null;
+  const ask = namesOther || asksAboutEmail;
   return [
     ...ask ? REQUIRE_APPROVAL_HOW[level] : [],
+    ...asksAboutEmail ? REQUIRE_APPROVAL_EMAIL_DETAIL : [],
     ...namesEmail && emailHold !== null ? requireApprovalEmailException(emailHold) : []
   ];
 }
@@ -1306,9 +1339,12 @@ function buildGuardrailsSection(guardrails) {
   const active = guardrails.map((g) => {
     const enforcement = effectiveChannelAllowlistEnforcement({
       ...g,
-      enforcement: effectiveEmailEnforcement({
+      enforcement: effectiveMailRuleEnforcement({
         ...g,
-        enforcement: effectiveCalendarEnforcement(g)
+        enforcement: effectiveEmailEnforcement({
+          ...g,
+          enforcement: effectiveCalendarEnforcement(g)
+        })
       })
     });
     return { ...g, enforcement };
@@ -7122,6 +7158,17 @@ var FLAG_REGISTRY = [
     // It widens who may DECIDE an approval, so it is a control, not a display toggle.
     sensitive: true
   },
+  {
+    key: "approval-unified-authority",
+    description: "One authority check for every approval ingress (ENG-11207, ADR-0124 Phase 0b): canDecide() runs inside tryDispatchApprovalCore for console, Slack (channel, alerts, Socket Mode, which also carries Telegram) and Direct Chat taps alike. off = not computed. shadow = compute the verdict and log approval_authority_would_reject (ingress, verb, org, reason) for every tap it would refuse, then decide exactly as today. enforce = reserved for the per-(org, verb) allowlist slice; until that ships it behaves as shadow. Evaluated per-org. Ships dark.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Safe/default value is `off` (no computation, no extra reads on the tap path). A flag-DB read
+    // error degrades to this, so an outage can never change who may decide.
+    defaultValue: "off",
+    // Its enforce value will refuse approvals, so mutating it is worth confirming.
+    sensitive: true
+  },
   {
     key: "slack-reply-binding",
     description: "Slack reply-target binding (ENG-7396 / WS2, cross-thread reply routing): the model names which inbound it answers (inbound_id) and the server resolves the destination from its own verified record. shadow = classify + count only, routing unchanged; warn = same routing plus a tool-result note so the model self-corrects; enforce = route a bound reply to the registry thread and REJECT a reply whose target matches no inbound this process delivered. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_SLACK_REPLY_BINDING spawn env (the operator/canary override, ADR-0022). Ships shadow.",
@@ -13057,6 +13104,11 @@ var QUOTA_EXHAUSTED_ERROR_PATTERNS = [
   "usage limit",
   "daily limit exceeded"
 ];
+var PROVIDER_ACCESS_BLOCKED_ERROR_PATTERNS = [
+  "api access blocked",
+  "api access has been blocked",
+  "api access is blocked"
+];
 function isReadonlyToolDescriptor(t) {
   if (!t?.name)
     return false;
@@ -13149,6 +13201,10 @@ function formatRetryWindow(seconds) {
     return `about ${Math.round(hours * 10) / 10} hours`;
   return `about ${Math.round(hours / 24 * 10) / 10} days`;
 }
+function isProviderAccessBlockedError(message) {
+  const m = message.toLowerCase();
+  return PROVIDER_ACCESS_BLOCKED_ERROR_PATTERNS.some((p2) => m.includes(p2));
+}
 function classifyToolCallFailure(text) {
   if (isAccountResolutionError(text))
     return "account";
@@ -13156,6 +13212,8 @@ function classifyToolCallFailure(text) {
     return "quota";
   if (isScopeDeficitError(text))
     return "scope";
+  if (isProviderAccessBlockedError(text))
+    return "blocked";
   if (isUpstreamAuthError(text))
     return "auth";
   if (isSiteResolutionError(text))
@@ -13308,6 +13366,13 @@ async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
           details: { ...baseDetails, reason: "upstream_auth_rejected" }
         };
       }
+      if (kind === "blocked") {
+        return {
+          status: "degraded",
+          message: `Live tool call '${toolName}' reached the provider, which refused API access for this connection's account or app. The credential itself was accepted, so reconnecting alone will not fix it: check that the connecting user still has a role on the account and that the account is not restricted with the provider, then reconnect: ${snippet}`,
+          details: { ...baseDetails, reason: "provider_access_blocked" }
+        };
+      }
       if (kind === "site") {
         return {
           status: "down",
@@ -13315,6 +13380,13 @@ async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
           details: { ...baseDetails, reason: "site_unresolved" }
         };
       }
+      if (resolved.requestedTool && !resolved.fallback && toolName === resolved.requestedTool) {
+        return {
+          status: "degraded",
+          message: `Live tool call '${toolName}' (this integration's connectivity test) failed with an error the probe does not recognise, so the connection cannot be confirmed working: ${snippet}`,
+          details: { ...baseDetails, reason: "connectivity_test_failed", tool_error: snippet }
+        };
+      }
       return {
         status: "ok",
         message: `Live tool call '${toolName}' resolved the account (tool error: ${snippet})`,
@@ -16127,4 +16199,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-4WAUXFY7.js.map
+//# sourceMappingURL=chunk-5SASCNYV.js.map