@integrity-labs/agt-cli 0.28.260 → 0.28.261

package/dist/bin/agt.js

@@ -38,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-PZJRZPJF.js";
+} from "../chunk-6R7TDVCE.js";
 import {
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
@@ -67,7 +67,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-22BZ2WQM.js";
+} from "../chunk-RPM3FGSV.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4826,7 +4826,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.260" : "dev";
+var cliVersion = true ? "0.28.261" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5840,7 +5840,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.260" : "dev";
+var cliVersion2 = true ? "0.28.261" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-PZJRZPJF.js → chunk-6R7TDVCE.js}

@@ -18,7 +18,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-22BZ2WQM.js";
+} from "./chunk-RPM3FGSV.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -1861,7 +1861,8 @@ var SENSITIVE_INTEGRATION_FIELDS = [
   "api_key",
   "webhook_secret",
   "signing_secret",
-  "client_secret"
+  "client_secret",
+  "private_key"
 ];
 function decryptIntegrationCredentials(credentials) {
   const out = { ...credentials };
@@ -2745,6 +2746,49 @@ function provisionStopHook(codeName) {
     '    if [ -z "$marker_path" ]; then marker_path="$f"; fi',
     "  done",
     '  if [ -z "$marker_path" ]; then log_ghost "slack skip=no_pending_marker channel=$(safe_id "$channel") thread=$(safe_id "$thread_ts")"; return; fi',
+    "  # CS-1444: precedence guard against cross-thread mis-delivery. The last",
+    "  # <channel> tag can point at a DISCRETIONARY (auto-followed, un-mentioned)",
+    "  # inbound the agent never owed a reply to (ENG-6319). If the trailing text",
+    "  # was produced while working a DIFFERENT, ENGAGED conversation, posting it",
+    "  # into this discretionary thread leaks one conversation into another - the",
+    "  # koda cross-thread failure the recency guard above misses when the agent",
+    "  # replied to NOTHING this turn and only narrated. (CS-1444: an agent filed a",
+    '  # ticket in a DM and ended with "Filed... Standing by"; an unrelated thread B',
+    "  # had an auto_followed pending inbound as the LAST tag, so the DM summary",
+    "  # posted into thread B.) When THIS target marker is discretionary AND an",
+    "  # engaged (non-discretionary, non-undeliverable) marker for another inbound",
+    "  # is also pending, do NOT synthesize a post: leave this marker so the",
+    "  # bounded durable-replay scanner re-delivers the ORIGINAL inbound (convert",
+    "  # mis-deliver -> re-deliver).",
+    "  # Worst case is a re-delivery, never silent loss (the marker is preserved).",
+    "  # The sole-discretionary case (a genuine composed-but-unsent reply to an",
+    "  # auto-followed thread, no competing engaged conversation) is unaffected and",
+    "  # still recovers, so ENG-6319 is preserved. Slack-only: telegram/teams have",
+    "  # no discretionary-marker class (no auto-follow variant).",
+    "  local target_disc engaged_other=0 om_disc om_undel",
+    `  target_disc=$(jq -r '.discretionary // false' "$marker_path" 2>/dev/null || echo false)`,
+    '  if [ "$target_disc" = "true" ]; then',
+    "    shopt -s nullglob",
+    '    for om in "$SL_MARKER_DIR"/*.json; do',
+    '      if [ "$om" != "$marker_path" ]; then',
+    `        om_disc=$(jq -r '.discretionary // false' "$om" 2>/dev/null || echo false)`,
+    `        om_undel=$(jq -r '.undeliverable // false' "$om" 2>/dev/null || echo false)`,
+    "        # An engaged competitor is a marker the agent actually OWES a reply to:",
+    "        # neither discretionary (auto-followed, skippable) nor undeliverable",
+    "        # (ENG-5846: x-acked, could not reply at arrival) - the same owed/engaged",
+    "        # predicate the block-turn-end paths use. Only such a marker outranks a",
+    "        # discretionary target and suppresses recovery.",
+    '        if [ "$om_disc" != "true" ] && [ "$om_undel" != "true" ]; then',
+    "          engaged_other=1",
+    "          break",
+    "        fi",
+    "      fi",
+    "    done",
+    '    if [ "$engaged_other" = "1" ]; then',
+    '      log_ghost "slack skip=discretionary_target_engaged_elsewhere channel=$(safe_id "$channel") thread=$(safe_id "$thread_ts") marker=$(basename "$marker_path") text_len=${#TEXT}"',
+    "      return",
+    "    fi",
+    "  fi",
     "  local TS",
     "  TS=$(date -u +%Y%m%dT%H%M%S%N)",
     '  atomic_write_payload "${AGENT_DIR}/slack-recovery-outbox" "${TS}.json" \\',
@@ -5832,7 +5876,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.260" : "dev";
+var agtCliVersion = true ? "0.28.261" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8102,4 +8146,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-PZJRZPJF.js.map
+//# sourceMappingURL=chunk-6R7TDVCE.js.map