@integrity-labs/agt-cli 0.28.1097 → 0.28.1099

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-3RGBEI34.js";
+} from "../chunk-XLY3X6VS.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-EGVRUVOF.js";
+} from "../chunk-WQQGPPQW.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-I7XCW4G6.js";
+} from "../chunk-AVM2BBSX.js";
 import "../chunk-OCMJ5E6J.js";
 import "../chunk-XWVM4KPK.js";
 import "../chunk-EL5MWGGH.js";
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1097" : "dev";
+var cliVersion = true ? "0.28.1099" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1097" : "dev";
+var cliVersion2 = true ? "0.28.1099" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-I7XCW4G6.js → chunk-AVM2BBSX.js}

@@ -341,6 +341,17 @@ function resolveCanBlock(definitionId, lookup) {
   }
 }
 
+// ../../packages/core/dist/guardrails/email-domains.js
+var EMAIL_GUARD_STAGES = ["shadow", "require_approval", "enforce"];
+var EMAIL_GUARD_STAGE_LABELS = {
+  shadow: "Off",
+  require_approval: "Require approval",
+  enforce: "Block"
+};
+function isEmailGuardStage(value) {
+  return EMAIL_GUARD_STAGES.includes(value);
+}
+
 // ../../packages/core/dist/provisioning/platform-storage.js
 var PLATFORM_STORAGE_RULE = "Store durable, reusable work you build (repeatable procedures, recurring responsibilities, scheduled automation, orchestration scripts) through the Ninjafy platform tools, never as loose local files, unless the user explicitly requests a different destination. Platform artifacts are versioned, reviewable, and survive re-provisioning; loose local files are wiped on the next provision rebuild, reach no one else, and bypass review. Ephemeral scratch files for the task at hand are fine on disk.";
 
@@ -1109,7 +1120,8 @@ function formatEmailDomainConfigLines(config) {
   const approvalLive = config.approval_live === true;
   const approvalCoveredActions = stringList(config.approval_covered_actions);
   if (stage) {
-    lines.push(`  - stage: ${stage}`);
+    const stageName = isEmailGuardStage(stage) ? EMAIL_GUARD_STAGE_LABELS[stage] : stage;
+    lines.push(stageName === stage ? `  - setting: ${stage}` : `  - setting: ${stageName} (stage ${stage})`);
     if (stage === "require_approval" && approvalLive) {
       if (approvalCoveredActions.length > 0) {
         lines.push(`  *SCOPE - read this before you rely on the hold below. It is not universal. It engages for these mail actions and no others: ${approvalCoveredActions.join(", ")}. Every other route to sending mail is UNHELD and fails open - a provider or tool not named here, a draft-send whose recipients the platform cannot read from the call, a mail rule or filter, or any new integration nobody has wired into the hold yet. Nothing catches those. For them, produce the draft, hand it to a human, and let them send it.*`);
@@ -1349,8 +1361,6 @@ function effectiveEmailEnforcement(g) {
   const enforceLive = g.config?.["enforce_live"] === true;
   if (stage === "enforce" && enforceLive)
     return g.enforcement;
-  if (stage === "warn")
-    return g.enforcement === "enforce" ? "warn" : g.enforcement;
   if (stage === "require_approval") {
     return g.enforcement === "enforce" ? "warn" : g.enforcement;
   }
@@ -7277,6 +7287,17 @@ var FLAG_REGISTRY = [
     // deliberate, audited per-org flip (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "email-guard-sole-decider",
+    description: "ENG-11190 PR1: make the email guardrail (`email.domain_restrict`) the ONLY decider for email sends. Today two gates judge every send: the email guard (by its stage) and the Composio tool-tier HITL (OUTLOOK_SEND_EMAIL / GMAIL_SEND_EMAIL resolve to `write_high_risk`, so every send is held whatever the guard says). Brad, 6 Oct (Two Tractors / Horatio): a guard set to Shadow must not still produce an approval card. When ON for an org, the tier gate stops re-deciding a registered composing email send for an agent that HAS an active email guardrail AND whose stage is in force: the guard, which already ran first in callIntegrationTool and holds or blocks by its own stage, is the verdict. A stage whose enable flag is off (Require approval or Block that is not yet enabled for the org) only observes, so it is NOT a verdict and the tier hold stays (Obi Wan on #6816). An agent with no email guardrail (or a disabled one) keeps the tier hold, so turning this on never removes the only hold an org has. Draft-sends (recipients on the stored draft) keep the tier hold in this slice. Every deferred send is still audited. Evaluated per-org. Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` (both gates, today's behaviour). A flag-DB read error
+    // degrades here, so a flags outage keeps the tier hold rather than silently loosening it.
+    defaultValue: false,
+    // Turning it on lets external email go out WITHOUT the tier hold where the guard allows
+    // it (e.g. Shadow), so it is a deliberate, audited per-org flip (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "email-require-approval-enforcement",
     description: 'Enforcement gate for the `email.require_approval` guardrail (ENG-9611). That guardrail has been `default_for_new_orgs` since ~2026-05-03 and its display text promises "Require human approval before sending any email", but nothing ever read it: its only runtime path was toGuardrailForPrompt, i.e. a line in the agent CLAUDE.md. When ON for an org, a DISPATCHING email send (never a draft-create, ENG-7980) is held and routed to Human Approval regardless of recipient domain \u2014 which is what "any email" means, and is what distinguishes it from email-guard-require-approval-enabled, whose require_approval stage only intercepts a would-be DOMAIN block. Deliberately separate from the guardrail row: roughly four months of orgs already carry an inert `enforce`-level row, so reading the row alone would arm a blocking control across all of them on deploy. New orgs are no longer armed (ENG-11234). Orgs created while the ENG-9629/9675 new-org arm was live keep their org-scoped ON override until an operator flips them per org. Evaluated per-org. Ships dark.',
@@ -16519,4 +16540,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-I7XCW4G6.js.map
+//# sourceMappingURL=chunk-AVM2BBSX.js.map