@integrity-labs/agt-cli 0.28.258 → 0.28.259

package/dist/bin/agt.js

@@ -38,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-2AWMBQJD.js";
+} from "../chunk-VPDUKN7W.js";
 import {
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
@@ -67,7 +67,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-L2GVB37X.js";
+} from "../chunk-22BZ2WQM.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4826,7 +4826,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.258" : "dev";
+var cliVersion = true ? "0.28.259" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5840,7 +5840,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.258" : "dev";
+var cliVersion2 = true ? "0.28.259" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-L2GVB37X.js → chunk-22BZ2WQM.js}

@@ -3645,7 +3645,12 @@ var OAUTH_PROVIDERS = {
     publicClient: true,
     mcpUrl: "https://mcp.kajabi.com/mcp",
     // Curated surface (matches the catalog seed's defined_scopes[].tools). Kajabi's
-    // live MCP advertises ~111 tools; the agent only needs these 25.
+    // live MCP advertises ~111 tools; the agent only needs these 26.
+    // CS-1427: `enable_toolset` is included so an agent can activate its own
+    // products/commerce + analytics toolsets on the connection (Kajabi gates those
+    // tool groups behind a runtime toolset that returns "not active" until enabled).
+    // Low-risk: this proxy still caps every tools/call to the allowlist, so a broad
+    // activation can't widen what's actually callable.
     toolAllowlist: [
       "list_sites",
       "get_site_summary",
@@ -3671,7 +3676,8 @@ var OAUTH_PROVIDERS = {
       "create_broadcast",
       "list_sequences",
       "get_sequence",
-      "create_sequence"
+      "create_sequence",
+      "enable_toolset"
     ]
   },
   "notion-cli": {
@@ -3721,7 +3727,12 @@ var OAUTH_PROVIDERS = {
       // for the surfaces we don't yet need write access on.
       "accounting.payments.read",
       "accounting.banktransactions.read",
-      "accounting.manualjournals.read",
+      // manualjournals: write (CS-1439) enables the xero-broker to post
+      // manual journals (reclasses, accruals, corrections) on approval. The
+      // variant without `.read` is the read+write granular scope. Note: an
+      // existing Xero install must RECONNECT for its token to carry this — the
+      // broker posts journals with the agent's own OAuth access_token.
+      "accounting.manualjournals",
       // accounting.reports.read → granular read-only replacements
       "accounting.reports.balancesheet.read",
       "accounting.reports.profitandloss.read",
@@ -7117,6 +7128,19 @@ var FLAG_REGISTRY = [
     defaultValue: false,
     public: true
   },
+  {
+    key: "onboarding-auto-deploy",
+    description: `Auto-deploy the first agent during onboarding (ENG-7378): the agent edit page's Deploy & Test tab fires the existing deploy (draft -> active) automatically once the agent's host is fully deployed (active + manager heartbeating, not provisioning) AND Claude-authenticated (claude_auth_status=valid), replacing the manual "Deploy Agent" click in the recruit funnel. Only draft, non-system_support agents; a failed or timed-out attempt falls back to the manual button (no auto-retry loop).`,
+    flagType: "boolean",
+    // PUBLIC (ADR-0022 §2): a browser-read UI-behaviour gate (mirrors
+    // direct-chat-drawer). Declared safe value is `false`: auto-deploy flips an
+    // agent's status by itself, so a flag-read error must never switch it on.
+    // Ships dark; enable per-org (or fleet-wide) from the admin Feature Flags
+    // page. When off, the recruit funnel keeps the manual Deploy button. No
+    // envVar: a browser-only gate has no host-side override.
+    defaultValue: false,
+    public: true
+  },
   {
     key: "manager-failure-notify",
     description: "Route terminal integration-failure notifications to the agent's human manager (reports_to \u2192 preferred channel) instead of only the agent's own direct-chat (ENG-6334). Boolean gate; ships dark.",
@@ -9172,4 +9196,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-L2GVB37X.js.map
+//# sourceMappingURL=chunk-22BZ2WQM.js.map