@integrity-labs/agt-cli 0.28.161 → 0.28.163

package/dist/bin/agt.js

@@ -37,7 +37,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-TNTG4DNQ.js";
+} from "../chunk-BEUGTZ7Z.js";
 import {
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
@@ -65,7 +65,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-CQZDKD2U.js";
+} from "../chunk-MTKFDGXO.js";
 
 // src/bin/agt.ts
 import { join as join22 } from "path";
@@ -4778,7 +4778,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.161" : "dev";
+var cliVersion = true ? "0.28.163" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5792,7 +5792,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.161" : "dev";
+var cliVersion2 = true ? "0.28.163" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-TNTG4DNQ.js → chunk-BEUGTZ7Z.js}

@@ -23,7 +23,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-CQZDKD2U.js";
+} from "./chunk-MTKFDGXO.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -184,7 +184,7 @@ var INTEGRATION_REGISTRY = [
     id: "kajabi",
     name: "Kajabi",
     category: "crm",
-    description: "Run a Kajabi creator business from chat \u2014 read contacts, products, offers, and analytics, manage contact tags & segments, and draft email broadcasts & sequences. Wired as the hosted Kajabi MCP at https://mcp.kajabi.com/mcp.",
+    description: "Run a Kajabi creator business from chat: read contacts, products, offers, and analytics, manage contact tags & segments, and draft email broadcasts & sequences.",
     // Same remote streamable-HTTP MCP + OAuth pattern as Granola/Brand Ninja.
     // Kajabi's Doorkeeper AS implements the MCP discovery chain (RFC
     // 9728/8414/7591); auth is OAuth 2.0 authorization-code with PKCE (S256)
@@ -4079,7 +4079,11 @@ function buildOAuthRemoteMcpProxyEntry(definitionId, paths) {
       AGT_REMOTE_MCP_URL: provider.mcpUrl,
       AGT_REMOTE_MCP_TOKEN_FILE: paths.tokenFile,
       AGT_REMOTE_MCP_TOKEN_VAR: envVarForToken(definitionId),
-      AGT_REMOTE_MCP_LABEL: definitionId
+      AGT_REMOTE_MCP_LABEL: definitionId,
+      // ENG-6948: cap the agent's exposed surface to the curated allowlist. The
+      // proxy filters tools/list and gates tools/call against this set. Omitted
+      // when the provider has no allowlist, leaving the proxy a pass-through.
+      ...provider.toolAllowlist && provider.toolAllowlist.length > 0 ? { AGT_REMOTE_MCP_TOOL_ALLOWLIST: provider.toolAllowlist.join(",") } : {}
     }
   };
 }
@@ -6456,6 +6460,13 @@ ${sections}`
           telegramEnv.TELEGRAM_DIAGNOSTIC_CHAT_IDS = diagnosticChatIds.join(",");
         }
       }
+      const rawPingChatIds = config["ping_allowed_chat_ids"];
+      if (Array.isArray(rawPingChatIds)) {
+        const pingChatIds = rawPingChatIds.map((v) => typeof v === "string" || typeof v === "number" ? String(v).trim() : "").filter((v) => v.length > 0);
+        if (pingChatIds.length > 0) {
+          telegramEnv.TELEGRAM_PING_ALLOWED_CHAT_IDS = pingChatIds.join(",");
+        }
+      }
       const rawPeerAgentMode = config["peer_agent_mode"];
       if (rawPeerAgentMode === "listen" || rawPeerAgentMode === "respond") {
         telegramEnv.TELEGRAM_PEER_AGENT_MODE = rawPeerAgentMode;
@@ -6523,6 +6534,7 @@ ${sections}`
         const ackReaction = (config["ack_reaction"] ?? "").trim() || void 0;
         const skipReaction = (config["skip_reaction"] ?? "").trim() || void 0;
         const allowedUsers = Array.isArray(config["allowed_users"]) ? config["allowed_users"].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [];
+        const pingAllowedUsers = Array.isArray(config["ping_allowed_users"]) ? config["ping_allowed_users"].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [];
         const blockKitDisabled = process.env["SLACK_BLOCK_KIT_DISABLED"] === "true";
         const resolvedAgtHost = process.env["AGT_HOST"]?.trim() || "https://api.augmented.team";
         const blockKitEnv = {
@@ -6642,6 +6654,10 @@ ${sections}`
               // so the host fallback (and the fail-closed /investigate
               // default) still apply to unconfigured agents.
               ...allowedUsers.length > 0 ? { SLACK_ALLOWED_USERS: allowedUsers.join(",") } : {},
+              // ENG-6931: /ping connectivity allowlist (team + manager).
+              // Omitted when empty so the MCP's fail-closed /ping gate keeps
+              // the command disabled for unconfigured agents.
+              ...pingAllowedUsers.length > 0 ? { SLACK_PING_ALLOWED_USERS: pingAllowedUsers.join(",") } : {},
               // ENG-6563 (D16): stamp the verified turn initiator so broker MCPs
               // can forward it when the agent files an approval mid-turn.
               AGT_TURN_INITIATOR_FILE: join4(agentDir, ".current-turn-initiator.json")
@@ -6706,6 +6722,8 @@ ${sections}`
       const slackSkipReactionEnv = slackSkipReaction ? { SLACK_SKIP_REACTION: slackSkipReaction } : {};
       const slackAllowedUsersList = Array.isArray(config["allowed_users"]) ? config["allowed_users"].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [];
       const slackAllowedUsersEnv = slackAllowedUsersList.length > 0 ? { SLACK_ALLOWED_USERS: slackAllowedUsersList.join(",") } : {};
+      const slackPingAllowedUsersList = Array.isArray(config["ping_allowed_users"]) ? config["ping_allowed_users"].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [];
+      const slackPingAllowedUsersEnv = slackPingAllowedUsersList.length > 0 ? { SLACK_PING_ALLOWED_USERS: slackPingAllowedUsersList.join(",") } : {};
       const oneshotBlockKitDisabled = process.env["SLACK_BLOCK_KIT_DISABLED"] === "true";
       const oneshotResolvedAgtHost = process.env["AGT_HOST"]?.trim() || "https://api.augmented.team";
       const oneshotResolvedAgtApiKey = process.env["AGT_API_KEY"]?.trim();
@@ -6772,6 +6790,7 @@ ${sections}`
             ...slackAckReactionEnv,
             ...slackSkipReactionEnv,
             ...slackAllowedUsersEnv,
+            ...slackPingAllowedUsersEnv,
             ...oneshotBlockKitEnv,
             ...slackPeerEnv,
             ...slackAgtAuthEnv,
@@ -6796,6 +6815,7 @@ ${sections}`
             ...slackAckReactionEnv,
             ...slackSkipReactionEnv,
             ...slackAllowedUsersEnv,
+            ...slackPingAllowedUsersEnv,
             ...oneshotBlockKitEnv,
             ...slackPeerEnv,
             ...slackAgtAuthEnv,
@@ -7928,7 +7948,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.161" : "dev";
+var agtCliVersion = true ? "0.28.163" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9233,4 +9253,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-TNTG4DNQ.js.map
+//# sourceMappingURL=chunk-BEUGTZ7Z.js.map