@integrity-labs/agt-cli 0.28.1196 → 0.28.1197

package/dist/bin/agt.js

@@ -40,17 +40,17 @@ import {
   success,
   table,
   warn
-} from "../chunk-YYUYLLIX.js";
+} from "../chunk-2IQ6KNPD.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-O5LKHDN7.js";
+} from "../chunk-QAOYRG2J.js";
 import {
   markDailySessionSpawn,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-L5QCDOM2.js";
+} from "../chunk-LBQSZVUX.js";
 import "../chunk-OO36JBFI.js";
 import "../chunk-6HBXEJHO.js";
 import "../chunk-XWVM4KPK.js";
@@ -83,7 +83,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-2NWHS53N.js";
+} from "../chunk-I2ZT7SV2.js";
 import "../chunk-AIUIMEUS.js";
 import "../chunk-DGUM43GV.js";
 
@@ -5200,7 +5200,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk17 from "chalk";
 import ora15 from "ora";
-var cliVersion = true ? "0.28.1196" : "dev";
+var cliVersion = true ? "0.28.1197" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6460,7 +6460,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1196" : "dev";
+var cliVersion2 = true ? "0.28.1197" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-YYUYLLIX.js → chunk-2IQ6KNPD.js}

@@ -16,11 +16,11 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-O5LKHDN7.js";
+} from "./chunk-QAOYRG2J.js";
 import {
   readDailySessionPin,
   sessionTranscriptDir
-} from "./chunk-L5QCDOM2.js";
+} from "./chunk-LBQSZVUX.js";
 import {
   classifyUnanswerablePane,
   isConsumerTermsDialogVisible,
@@ -92,7 +92,7 @@ import {
   scanConfigForLiteralSecrets,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-2NWHS53N.js";
+} from "./chunk-I2ZT7SV2.js";
 import {
   claudeJsonPathFor,
   effectiveClaudeJsonPath,
@@ -8082,7 +8082,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1196" : "dev";
+var agtCliVersion = true ? "0.28.1197" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -13682,4 +13682,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-YYUYLLIX.js.map
+//# sourceMappingURL=chunk-2IQ6KNPD.js.map

package/dist/{chunk-2NWHS53N.js → chunk-I2ZT7SV2.js}

@@ -8663,7 +8663,7 @@ var FLAG_REGISTRY = [
     sensitive: true
     // Not public: the browser makes no decision from this. The only consumer is
     // packages/api/src/middleware/ip-allowlist.ts.
-  }
+  },
   // THERE IS DELIBERATELY NO `ip-allowlist-enforce-mcp` FLAG.
   //
   // The per-agent MCP surface (POST /agents/:codeName/mcp) is allowlist
@@ -8699,6 +8699,16 @@ var FLAG_REGISTRY = [
   // adding the flag here and a key in ENFORCE_FLAG is a small diff - but it is a
   // decision to own someone else's egress, not a discovery that the population
   // was allowlistable all along.
+  {
+    key: "composio-arm-key-at-mint",
+    description: "ENG-11446 - mint a new org's Composio project key with its IP allowlist already set, from composio-approved-egress.json. OFF (default) = keys are minted unrestricted, as before, and an operator arms them in the dashboard. ON = armed in the create call. Off by default because a wrong set is unrepairable from here: there is no API to read or edit the allowlist, so every key minted from a stale file refuses its callers until someone edits it by hand. Turn on per stage only after the file is confirmed current and a key armed from it returns 200 from an agt-hosts instance (probe-allowed-ips.ts --host-verify). Prod only for now: the file holds prod addresses, so an armed test-stage key would refuse test hosts. Turning it off affects future mints only; keys already armed stay armed.",
+    flagType: "boolean",
+    defaultValue: false,
+    sensitive: true,
+    // Fleet-wide security posture, not an org's choice: an org override must not be able
+    // to arm or unarm its own keys (CodeRabbit on #7359).
+    platformAdminOnly: true
+  }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 function getFlagDefinition(key) {
@@ -14238,6 +14248,7 @@ var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
 var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
+var SELF_HOST_SILENCE_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/core/dist/integrations/composio-tool-call-probe.js
 var MCP_ACCEPT2 = "application/json, text/event-stream";
@@ -17694,4 +17705,4 @@ export {
   HOST_ROTATE_KEY_CONFLICT,
   shouldMintReplacementKey
 };
-//# sourceMappingURL=chunk-2NWHS53N.js.map
+//# sourceMappingURL=chunk-I2ZT7SV2.js.map