@integrity-labs/agt-cli 0.28.181 → 0.28.183

package/dist/bin/agt.js

@@ -37,7 +37,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-4PUAP6TD.js";
+} from "../chunk-3QVZSJZF.js";
 import {
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
@@ -65,7 +65,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-J36USBIR.js";
+} from "../chunk-IDAJRLPK.js";
 
 // src/bin/agt.ts
 import { join as join22 } from "path";
@@ -4749,7 +4749,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.181" : "dev";
+var cliVersion = true ? "0.28.183" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5763,7 +5763,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.181" : "dev";
+var cliVersion2 = true ? "0.28.183" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-4PUAP6TD.js → chunk-3QVZSJZF.js}

@@ -16,7 +16,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-J36USBIR.js";
+} from "./chunk-IDAJRLPK.js";
 
 // ../../packages/core/dist/provisioning/mcp-config-guards.js
 import { chmodSync, existsSync, readFileSync, renameSync, writeFileSync, unlinkSync } from "fs";
@@ -6120,7 +6120,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.181" : "dev";
+var agtCliVersion = true ? "0.28.183" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7425,4 +7425,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-4PUAP6TD.js.map
+//# sourceMappingURL=chunk-3QVZSJZF.js.map

package/dist/{chunk-J36USBIR.js → chunk-IDAJRLPK.js}

@@ -1450,6 +1450,15 @@ var FLAG_REGISTRY = [
     // spend control, so mutations require explicit confirmation.
     sensitive: true
   },
+  {
+    key: "team-scoped-visibility",
+    description: "Restrict team-scoped reads to direct team members (ENG-7122). By default the API resolves X-Team-Slug for any org member (org-membership fallback), so a plain org member can read a sibling team they are not on (agents, kanban, run-derived spend) because the service-role API filters only by the org-resolved team_id. When ON for an org, the org-membership fallback is dropped for plain org member/viewer (they may only resolve teams they are a direct team_members of), while org owner/admin keep cross-team reach and the admin-onboarding bypass is preserved. The GET /teams listing is narrowed the same way. Boolean gate; default off (current behaviour).",
+    flagType: "boolean",
+    defaultValue: false,
+    // Tightening control: turning this flag OFF *relaxes* a visibility restriction,
+    // so mutations require explicit confirmation per ADR-0022 §4.
+    sensitive: true
+  },
   {
     key: "channel-busy-ack",
     description: "Busy-but-alive ack notices when an agent is mid-task (ENG-6180). Boolean gate; ships dark.",
@@ -1826,7 +1835,7 @@ var FLAG_REGISTRY = [
   },
   {
     key: "augmented-support-auto-provision",
-    description: 'Org-create auto-provision of the per-org system_support concierge agent ("Augmented Support") (ENG-7026, ADR-0032 \xA77). This is the FINAL rollout stage: when on, every newly created organization gets a support agent provisioned (in draft - arming still needs first-run consent) by a best-effort hook in the org-create handler. The earlier rollout stages (dogfood Integrity Labs, then design partners) are driven by the explicit admin command (provision-support --org <slug>), NOT this flag. Ships dark: default OFF means the hook is inert, so there is no fleet-wide first deploy - existing orgs are never touched and new orgs get nothing until this is flipped on. The DB stage value is the control (no env override).',
+    description: 'Org-create auto-provision of the per-org system_support concierge agent ("Sherlock") (ENG-7026, ADR-0032 \xA77). This is the FINAL rollout stage: when on, every newly created organization gets a support agent provisioned (in draft - arming still needs first-run consent) by a best-effort hook in the org-create handler. The earlier rollout stages (dogfood Integrity Labs, then design partners) are driven by the explicit admin command (provision-support --org <slug>), NOT this flag. Ships dark: default OFF means the hook is inert, so there is no fleet-wide first deploy - existing orgs are never touched and new orgs get nothing until this is flipped on. The DB stage value is the control (no env override).',
     flagType: "boolean",
     // Declared safe value is `false`: the fail-safe / absent-flag direction is
     // "no org auto-provisions a support agent", so a misread can never silently
@@ -6581,4 +6590,4 @@ export {
   parseEnvIntegrations,
   probeMcpEnvSubstitution
 };
-//# sourceMappingURL=chunk-J36USBIR.js.map
+//# sourceMappingURL=chunk-IDAJRLPK.js.map