@integrity-labs/agt-cli 0.28.1166 → 0.28.1168

package/dist/bin/agt.js

@@ -40,17 +40,17 @@ import {
   success,
   table,
   warn
-} from "../chunk-UX3TDTVM.js";
+} from "../chunk-Y4DBRVXD.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-NOCTCO7G.js";
+} from "../chunk-AJTF72A2.js";
 import {
   markDailySessionSpawn,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-ZSCZDOHR.js";
+} from "../chunk-AV4KD3HE.js";
 import "../chunk-B6UYVEMD.js";
 import "../chunk-OAWK4OBN.js";
 import "../chunk-XWVM4KPK.js";
@@ -84,7 +84,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-I5NQ762W.js";
+} from "../chunk-7IAJXJ7C.js";
 import "../chunk-EL5MWGGH.js";
 import "../chunk-DGUM43GV.js";
 
@@ -5513,7 +5513,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1166" : "dev";
+var cliVersion = true ? "0.28.1168" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6773,7 +6773,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1166" : "dev";
+var cliVersion2 = true ? "0.28.1168" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-I5NQ762W.js → chunk-7IAJXJ7C.js}

@@ -1227,8 +1227,8 @@ function effectiveMailRuleEnforcement(g) {
 }
 function renderGuardrailBullet(g) {
   const lines = [];
-  const header = `- **${g.displayName}** (${g.category}, from ${g.source})`;
-  lines.push(header);
+  const header2 = `- **${g.displayName}** (${g.category}, from ${g.source})`;
+  lines.push(header2);
   if (g.description?.trim()) {
     lines.push(`  ${g.description.trim()}`);
   }
@@ -1327,12 +1327,12 @@ function requireApprovalHowLines(g, level, holds) {
   ];
 }
 function renderAdvisoryGuardrailBullet(g, emailHold) {
-  const [header, ...rest] = renderGuardrailBullet(g).split("\n");
+  const [header2, ...rest] = renderGuardrailBullet(g).split("\n");
   const level = g.enforcement === "warn" || g.enforcement === "log" ? g.enforcement : "enforce";
   const isRequireApproval = g.definitionId === REQUIRE_APPROVAL_FOR_ACTIONS_DEF;
   const how = isRequireApproval && level !== "log" ? requireApprovalHowLines(g, level, emailHold) : [];
   const levelLine = isRequireApproval && level === "enforce" ? REQUIRE_APPROVAL_ENFORCE_LEVEL_LINE : ADVISORY_LEVEL_LINE[level];
-  return [header, `  ${levelLine}`, ...how, ...rest].join("\n");
+  return [header2, `  ${levelLine}`, ...how, ...rest].join("\n");
 }
 var REQUIRE_APPROVAL_ENFORCE_LEVEL_LINE = "Level: enforce \u2014 never take these actions without approval; get it as described below.";
 function renderOverriddenGuardrailBullet(g) {
@@ -14507,10 +14507,10 @@ function parseExtraHeaders(raw) {
     const colon = trimmed.indexOf(":");
     if (colon <= 0)
       continue;
-    const header = trimmed.slice(0, colon).trim();
+    const header2 = trimmed.slice(0, colon).trim();
     const varName = trimmed.slice(colon + 1).trim();
-    if (header && varName)
-      out.push({ header, varName });
+    if (header2 && varName)
+      out.push({ header: header2, varName });
   }
   return out;
 }
@@ -14529,8 +14529,8 @@ function buildForwardHeaders(token, authHeader, extras, readVar) {
     headers[authHeader] = token;
   else
     headers["Authorization"] = `Bearer ${token}`;
-  for (const { header, varName } of extras) {
-    headers[header] = readVar(varName) ?? "";
+  for (const { header: header2, varName } of extras) {
+    headers[header2] = readVar(varName) ?? "";
   }
   return headers;
 }
@@ -16803,33 +16803,45 @@ function resolvePreset(config) {
     ...typeof payload === "string" && payload ? { payloadPath: payload } : {}
   };
 }
-function validateWebhookConfig(input) {
-  const out = {};
+function validateOperatorText(input, out) {
   const name = input["name"];
   if (name !== void 0) {
     if (typeof name !== "string")
-      return { ok: false, error: "name must be a string" };
+      return "name must be a string";
     const trimmed = name.trim();
     if (trimmed.length > WEBHOOK_NAME_MAX_CHARS) {
-      return { ok: false, error: `name must be at most ${WEBHOOK_NAME_MAX_CHARS} characters` };
+      return `name must be at most ${WEBHOOK_NAME_MAX_CHARS} characters`;
     }
     if (trimmed)
       out["name"] = trimmed;
   }
   const instruction = input["instruction"];
   if (typeof instruction !== "string" || !instruction.trim()) {
-    return {
-      ok: false,
-      error: "instruction is required: tell the agent what to do when an event arrives"
-    };
+    return "instruction is required: tell the agent what to do when an event arrives";
   }
   if (instruction.trim().length > WEBHOOK_INSTRUCTION_MAX_CHARS) {
-    return {
-      ok: false,
-      error: `instruction must be at most ${WEBHOOK_INSTRUCTION_MAX_CHARS} characters`
-    };
+    return `instruction must be at most ${WEBHOOK_INSTRUCTION_MAX_CHARS} characters`;
   }
   out["instruction"] = instruction.trim();
+  return null;
+}
+function validateRateCapConfig(input, out) {
+  const cap = input["max_events_per_hour"];
+  if (cap !== void 0 && cap !== null) {
+    if (typeof cap !== "number" || !Number.isInteger(cap) || cap < 1 || cap > WEBHOOK_MAX_RATE_CAP) {
+      return `max_events_per_hour must be an integer from 1 to ${WEBHOOK_MAX_RATE_CAP}`;
+    }
+    out["max_events_per_hour"] = cap;
+  } else {
+    out["max_events_per_hour"] = WEBHOOK_DEFAULT_RATE_CAP;
+  }
+  return null;
+}
+function validateWebhookConfig(input) {
+  const out = {};
+  const textError = validateOperatorText(input, out);
+  if (textError)
+    return { ok: false, error: textError };
   const preset = input["preset"] ?? "generic";
   if (typeof preset !== "string" || !Object.prototype.hasOwnProperty.call(WEBHOOK_PRESETS, preset)) {
     return {
@@ -16847,18 +16859,9 @@ function validateWebhookConfig(input) {
     }
     out[key] = v;
   }
-  const cap = input["max_events_per_hour"];
-  if (cap !== void 0 && cap !== null) {
-    if (typeof cap !== "number" || !Number.isInteger(cap) || cap < 1 || cap > WEBHOOK_MAX_RATE_CAP) {
-      return {
-        ok: false,
-        error: `max_events_per_hour must be an integer from 1 to ${WEBHOOK_MAX_RATE_CAP}`
-      };
-    }
-    out["max_events_per_hour"] = cap;
-  } else {
-    out["max_events_per_hour"] = WEBHOOK_DEFAULT_RATE_CAP;
-  }
+  const capError = validateRateCapConfig(input, out);
+  if (capError)
+    return { ok: false, error: capError };
   return { ok: true, config: out };
 }
 function webhookRateCap(trigger) {
@@ -16921,6 +16924,273 @@ var webhookTriggerAdapter = {
 };
 registerTriggerSource(webhookTriggerAdapter);
 
+// ../../packages/core/dist/triggers/adapters/github.js
+var GITHUB_TRIGGER_PROVIDER = "github";
+var GITHUB_MAX_BODY_BYTES = 5 * 1024 * 1024;
+var GITHUB_SIGNATURE_HEADER = "x-hub-signature-256";
+var GITHUB_EVENT_HEADER = "x-github-event";
+var GITHUB_DELIVERY_HEADER = "x-github-delivery";
+var GITHUB_EVENT_RULES = {
+  pull_request: { actions: ["closed", "dequeued", "labeled"] },
+  pull_request_review: { actions: ["submitted"] },
+  check_suite: { actions: ["completed"] },
+  issues: { actions: ["opened", "closed"] },
+  issue_comment: { actions: ["created"] }
+};
+var GITHUB_WEBHOOK_EVENTS = Object.keys(GITHUB_EVENT_RULES);
+var REPO_FULL_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9._-]{1,100}$/;
+var LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})(?:\[bot\])?$/;
+var LABEL_TOKEN = /^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,49}$/;
+var SHA = /^[0-9a-f]{40}$/;
+var GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var REASON_TOKEN = /^(?=.{1,40}$)[a-z]+(?:_[a-z]+){0,3}$/;
+var APP_SLUG = /^[a-z0-9][a-z0-9-]{0,99}$/;
+var REVIEW_STATES = /* @__PURE__ */ new Set(["approved", "changes_requested", "commented", "dismissed"]);
+var CHECK_CONCLUSIONS = /* @__PURE__ */ new Set([
+  "success",
+  "failure",
+  "neutral",
+  "cancelled",
+  "timed_out",
+  "action_required",
+  "stale",
+  "skipped",
+  "startup_failure"
+]);
+var ISSUE_STATE_REASONS = /* @__PURE__ */ new Set(["completed", "not_planned", "reopened", "duplicate"]);
+function asDict(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function shaped(v, re) {
+  const s = str(v);
+  return s !== null && re.test(s) ? s : null;
+}
+function posInt(v) {
+  return typeof v === "number" && Number.isInteger(v) && v > 0 ? v : null;
+}
+function header(headers, name) {
+  const v = headers[name] ?? headers[name.toLowerCase()];
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function inSet(v, set) {
+  const s = str(v)?.toLowerCase() ?? null;
+  return s !== null && set.has(s) ? s : null;
+}
+function extractGithubFacts(event, payload) {
+  const rule = Object.hasOwn(GITHUB_EVENT_RULES, event) ? GITHUB_EVENT_RULES[event] : void 0;
+  if (!rule)
+    return null;
+  const root = asDict(payload);
+  if (!root)
+    return null;
+  const rawAction = str(root["action"]);
+  const action = rule.actions.find((a) => a === rawAction);
+  if (!action)
+    return null;
+  const repo = shaped(asDict(root["repository"])?.["full_name"], REPO_FULL_NAME);
+  if (!repo)
+    return null;
+  const sender = shaped(asDict(root["sender"])?.["login"], LOGIN);
+  const base = `https://github.com/${repo}`;
+  const details = [];
+  if (event === "pull_request") {
+    const pr = asDict(root["pull_request"]);
+    const n2 = pr ? posInt(pr["number"]) : null;
+    if (!pr || n2 === null)
+      return null;
+    let summary;
+    if (action === "closed") {
+      if (pr["merged"] !== true)
+        return null;
+      details.push(["Outcome", "merged"]);
+      const mergedBy = shaped(asDict(pr["merged_by"])?.["login"], LOGIN);
+      if (mergedBy)
+        details.push(["Merged by", mergedBy]);
+      summary = `PR #${n2} merged in ${repo}`;
+    } else if (action === "dequeued") {
+      const reasonRaw = str(root["reason"])?.toLowerCase().replace(/-/g, "_") ?? null;
+      const reason = reasonRaw && REASON_TOKEN.test(reasonRaw) ? reasonRaw : "unknown";
+      details.push(["Removed from merge queue, reason", reason]);
+      if (pr["merged"] === true)
+        details.push(["Merged", "yes"]);
+      summary = `PR #${n2} removed from the merge queue in ${repo}`;
+    } else {
+      const label = shaped(asDict(root["label"])?.["name"], LABEL_TOKEN);
+      details.push(["Label", label ?? "(name withheld: not a plain token)"]);
+      summary = `PR #${n2} labeled in ${repo}`;
+    }
+    const state = str(pr["state"]);
+    if (state === "open" || state === "closed")
+      details.unshift(["State", state]);
+    return {
+      event,
+      action,
+      repo,
+      subject: `Pull request: #${n2}`,
+      url: `${base}/pull/${n2}`,
+      sender,
+      details,
+      summary
+    };
+  }
+  if (event === "pull_request_review") {
+    const pr = asDict(root["pull_request"]);
+    const n2 = pr ? posInt(pr["number"]) : null;
+    if (n2 === null)
+      return null;
+    const review = asDict(root["review"]);
+    const state = inSet(review?.["state"], REVIEW_STATES);
+    details.push(["Review state", state ?? "unknown"]);
+    const reviewId = review ? posInt(review["id"]) : null;
+    return {
+      event,
+      action,
+      repo,
+      subject: `Pull request: #${n2}`,
+      url: reviewId ? `${base}/pull/${n2}#pullrequestreview-${reviewId}` : `${base}/pull/${n2}`,
+      sender,
+      details,
+      summary: `Review ${state ?? "submitted"} on PR #${n2} in ${repo}`
+    };
+  }
+  if (event === "check_suite") {
+    const suite = asDict(root["check_suite"]);
+    if (!suite)
+      return null;
+    const conclusion = inSet(suite["conclusion"], CHECK_CONCLUSIONS);
+    details.push(["Conclusion", conclusion ?? "unknown"]);
+    const app = shaped(asDict(suite["app"])?.["slug"], APP_SLUG);
+    if (app)
+      details.push(["App", app]);
+    const sha = shaped(str(suite["head_sha"])?.toLowerCase(), SHA);
+    if (sha)
+      details.push(["Head commit", sha]);
+    const prs = Array.isArray(suite["pull_requests"]) ? suite["pull_requests"].map((p2) => posInt(asDict(p2)?.["number"])).filter((x) => x !== null).slice(0, 10) : [];
+    if (prs.length > 0)
+      details.push(["Pull requests", prs.map((x) => `#${x}`).join(", ")]);
+    return {
+      event,
+      action,
+      repo,
+      subject: null,
+      url: sha ? `${base}/commit/${sha}` : base,
+      sender,
+      details,
+      summary: `Check suite ${conclusion ?? "completed"} in ${repo}${prs.length > 0 ? ` (PR #${prs[0]})` : ""}`
+    };
+  }
+  if (event === "issues") {
+    const issue2 = asDict(root["issue"]);
+    const n2 = issue2 ? posInt(issue2["number"]) : null;
+    if (!issue2 || n2 === null)
+      return null;
+    if (action === "closed") {
+      const reason = inSet(issue2["state_reason"], ISSUE_STATE_REASONS);
+      if (reason)
+        details.push(["Close reason", reason]);
+    }
+    return {
+      event,
+      action,
+      repo,
+      subject: `Issue: #${n2}`,
+      url: `${base}/issues/${n2}`,
+      sender,
+      details,
+      summary: `Issue #${n2} ${action} in ${repo}`
+    };
+  }
+  const issue = asDict(root["issue"]);
+  const n = issue ? posInt(issue["number"]) : null;
+  if (!issue || n === null)
+    return null;
+  const onPr = asDict(issue["pull_request"]) !== null;
+  const commentId = posInt(asDict(root["comment"])?.["id"]);
+  details.push(["Comment on", onPr ? "pull request" : "issue"]);
+  return {
+    event,
+    action,
+    repo,
+    subject: `${onPr ? "Pull request" : "Issue"}: #${n}`,
+    url: commentId ? `${base}/issues/${n}#issuecomment-${commentId}` : `${base}/issues/${n}`,
+    sender,
+    details,
+    summary: `New comment on ${onPr ? "PR" : "issue"} #${n} in ${repo}`
+  };
+}
+function githubDedupKey(event, rawBody) {
+  return `gh:body:${stableHash(`${event}
+${rawBody}`)}`;
+}
+function buildGithubEvent(req, now = /* @__PURE__ */ new Date()) {
+  const event = header(req.headers, GITHUB_EVENT_HEADER);
+  if (!event)
+    return null;
+  const facts = extractGithubFacts(event, req.body);
+  if (!facts)
+    return null;
+  const raw = req.rawBody ?? JSON.stringify(req.body ?? null);
+  const delivery = header(req.headers, GITHUB_DELIVERY_HEADER);
+  const deliveryGuid = delivery && GUID.test(delivery.toLowerCase()) ? delivery.toLowerCase() : null;
+  const lines = [`GitHub event: ${facts.event} (${facts.action})`, `Repository: ${facts.repo}`];
+  if (facts.subject)
+    lines.push(facts.subject);
+  for (const [k, v] of facts.details)
+    lines.push(`${k}: ${v}`);
+  if (facts.url)
+    lines.push(`URL: ${facts.url}`);
+  if (facts.sender)
+    lines.push(`Sender: ${facts.sender}`);
+  if (deliveryGuid)
+    lines.push(`Delivery: ${deliveryGuid}`);
+  lines.push("", "Titles, descriptions, comment text and commit messages are deliberately not included. Read them with your GitHub tools if you need them.");
+  return {
+    provider: GITHUB_TRIGGER_PROVIDER,
+    occurredAt: now.toISOString(),
+    dedupKey: githubDedupKey(facts.event, raw),
+    sourceTrust: "untrusted",
+    title: facts.summary,
+    body: lines.join("\n"),
+    // Ledger copy only (team-readable event log), never the prompt. Bounded
+    // like the generic source; never headers (the signature rides there).
+    raw: raw.length <= WEBHOOK_RAW_MAX_CHARS ? req.body : { truncated: true, bytes: raw.length, head: raw.slice(0, WEBHOOK_RAW_MAX_CHARS) },
+    meaningful: true
+  };
+}
+function validateGithubConfig(input) {
+  const out = {};
+  const textError = validateOperatorText(input, out);
+  if (textError)
+    return { ok: false, error: textError };
+  const capError = validateRateCapConfig(input, out);
+  if (capError)
+    return { ok: false, error: capError };
+  return { ok: true, config: out };
+}
+var githubTriggerAdapter = {
+  provider: GITHUB_TRIGGER_PROVIDER,
+  kind: "webhook",
+  webhookAuth: "hmac",
+  hmac: { signatureHeader: GITHUB_SIGNATURE_HEADER, signaturePrefix: "sha256=", algorithm: "sha256" },
+  webhookEvents: [...GITHUB_WEBHOOK_EVENTS],
+  // One trigger per repository or org hook, each with its own secret and instruction.
+  multiInstance: true,
+  maxBodyBytes: GITHUB_MAX_BODY_BYTES,
+  validateConfig: validateGithubConfig,
+  // Same breaker, same config key, same defaults as the generic source.
+  rateCapPerHour: (trigger) => webhookRateCap(trigger),
+  // Minted only on the human, agent.edit-gated route (as for `webhook`).
+  operatorInstruction: true,
+  ingest(req) {
+    const event = buildGithubEvent(req);
+    return event ? [event] : [];
+  }
+};
+registerTriggerSource(githubTriggerAdapter);
+
 // ../../packages/core/dist/restart/breaker-thresholds.js
 var RESTART_BREAKER_PROVISIONING_MAX = 5;
 var RESTART_BREAKER_PROVISIONING_WINDOW_MS = 18e5;
@@ -17128,4 +17398,4 @@ export {
   forcedUpdatePendingForMs,
   isForcedUpdatePastDeadline
 };
-//# sourceMappingURL=chunk-I5NQ762W.js.map
+//# sourceMappingURL=chunk-7IAJXJ7C.js.map