@integrity-labs/agt-cli 0.28.129 → 0.28.130

package/dist/bin/agt.js

@@ -37,7 +37,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-KIHRKGQI.js";
+} from "../chunk-RTSX4A54.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -64,7 +64,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-NCRDTQ54.js";
+} from "../chunk-RIT2OY5S.js";
 
 // src/bin/agt.ts
 import { join as join22 } from "path";
@@ -4777,7 +4777,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.129" : "dev";
+var cliVersion = true ? "0.28.130" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5791,7 +5791,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.129" : "dev";
+var cliVersion2 = true ? "0.28.130" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-NCRDTQ54.js → chunk-RIT2OY5S.js}

@@ -1930,20 +1930,33 @@ var charter_frontmatter_v1_default = {
     },
     tools: {
       type: "object",
-      description: "ENG-4588: gates on agent-driven actions (currently the skill-management MCP tools).",
+      description: "ENG-6707: agent-driven skill authoring is governed by the SkillSpector scanner gate; tools.skills carries only the shared-scope kill switch.",
       properties: {
         skills: {
           type: "object",
           properties: {
+            shared_authoring: {
+              type: "boolean",
+              default: true,
+              description: "ENG-6707 kill switch for agent-driven shared-scope (team/organization) skill authoring. Default true (open): shared skills auto-publish on a clean SkillSpector scan, else land as drafts for operator review (fail-closed). Set false to revoke shared-scope authoring for a compromised agent; agent-scope authoring stays available."
+            },
             write_team: {
               type: "boolean",
               default: false,
-              description: "Allow the agent's MCP tools to write skill_definitions rows at team scope. Default false \u2014 agents start untrusted."
+              deprecated: true,
+              description: "DEPRECATED (ENG-6707): ignored. Superseded by the scanner gate + shared_authoring kill switch. Retained so charters written before the migration still validate."
+            },
+            write_organization: {
+              type: "boolean",
+              default: false,
+              deprecated: true,
+              description: "DEPRECATED (ENG-6707): ignored. Org-scope authoring is governed by the same scanner gate + shared_authoring kill switch as team scope. Retained so charters written before the migration still validate."
             },
             publish: {
               type: "boolean",
               default: false,
-              description: "Skip the pending-publication review for agent-authored skills. Default false \u2014 drafts go to operator review (ENG-4589)."
+              deprecated: true,
+              description: "DEPRECATED (ENG-6707): ignored. Auto-publish is now driven by a clean SkillSpector scan, not this flag. Retained for back-compat."
             }
           },
           additionalProperties: false
@@ -2488,13 +2501,16 @@ ${desc}
 
 ## Optional permissions
 
-These fields default to off. Add them to the YAML frontmatter above to enable.
+Agents may author skills at any scope by default. Shared-scope (team /
+organization) skills auto-publish on a clean SkillSpector scan and land as
+drafts for operator review otherwise. To REVOKE shared-scope authoring for a
+compromised agent, add the kill switch below to the YAML frontmatter above
+(agent-scope authoring stays available).
 
 \`\`\`yaml
 tools:
   skills:
-    write_team: false  # ENG-4588: allow agent MCP to write team-scoped skills
-    publish: false     # ENG-4588: skip operator review for agent-authored skills
+    shared_authoring: false  # ENG-6707: revoke this agent's team/org skill authoring (default: true / open)
 \`\`\`
 `;
 }
@@ -2613,22 +2629,14 @@ function runSemanticRules(file, charter) {
       }
     }
   }
-  if (charter.risk_tier === "High" && charter.tools?.skills?.publish === true) {
+  const skillsTools = charter.tools?.skills;
+  if (skillsTools && (skillsTools.write_team !== void 0 || skillsTools.publish !== void 0 || skillsTools.write_organization !== void 0)) {
     diagnostics.push({
       file,
-      code: "CHARTER.SEMANTIC.HIGH_RISK_SKILL_PUBLISH",
-      path: "tools.skills.publish",
-      severity: "warning",
-      message: "High-risk agents should not have tools.skills.publish enabled \u2014 keep operator review on agent-authored skills"
-    });
-  }
-  if (charter.risk_tier === "High" && charter.tools?.skills?.write_team === true) {
-    diagnostics.push({
-      file,
-      code: "CHARTER.SEMANTIC.HIGH_RISK_SKILL_WRITE_TEAM",
-      path: "tools.skills.write_team",
-      severity: "warning",
-      message: "High-risk agents should not be granted tools.skills.write_team \u2014 they can pollute the shared team catalog"
+      code: "CHARTER.SEMANTIC.SKILL_FLAGS_DEPRECATED",
+      path: "tools.skills",
+      severity: "info",
+      message: "tools.skills.write_team / publish / write_organization are deprecated and ignored (ENG-6707). Agent-driven skill authoring is governed by the SkillSpector scan; set tools.skills.shared_authoring: false to revoke shared-scope authoring for a compromised agent."
     });
   }
   return diagnostics;
@@ -5780,4 +5788,4 @@ export {
   parseEnvIntegrations,
   probeMcpEnvSubstitution
 };
-//# sourceMappingURL=chunk-NCRDTQ54.js.map
+//# sourceMappingURL=chunk-RIT2OY5S.js.map