@integrity-labs/agt-cli 0.28.262 → 0.28.263

package/dist/bin/agt.js

@@ -38,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-G3ETF363.js";
+} from "../chunk-77QMM7RI.js";
 import {
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
@@ -67,7 +67,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-DMNWHJ65.js";
+} from "../chunk-E45AAMBQ.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4826,7 +4826,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.262" : "dev";
+var cliVersion = true ? "0.28.263" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5840,7 +5840,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.262" : "dev";
+var cliVersion2 = true ? "0.28.263" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-G3ETF363.js → chunk-77QMM7RI.js}

@@ -18,7 +18,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-DMNWHJ65.js";
+} from "./chunk-E45AAMBQ.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5876,7 +5876,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.262" : "dev";
+var agtCliVersion = true ? "0.28.263" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8146,4 +8146,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-G3ETF363.js.map
+//# sourceMappingURL=chunk-77QMM7RI.js.map

package/dist/{chunk-DMNWHJ65.js → chunk-E45AAMBQ.js}

@@ -3625,19 +3625,27 @@ var OAUTH_PROVIDERS = {
     // registers a client once at deploy time against
     // https://mcp.kajabi.com/mcp/oauth/register; OAUTH_KAJABI_CLIENT_ID is set
     // from its output. Doorkeeper RESTRICTS a dynamic client to the scopes it
-    // registered with, so register with the union of defaultScopes below
-    // (--scope 'read write:contacts write:emails'). The AS advertises the
-    // refresh_token grant (no openid/offline_access scope needed), so the
-    // shared oauth-refresh cron rotates the bearer without operator action.
+    // registered with, so register with at least the union of defaultScopes
+    // below (--scope 'read write:contacts write:emails write:content
+    // write:commerce'). Widening defaultScopes forces a client re-register
+    // (new client_id) AND a per-connection re-consent: existing tokens keep
+    // the old scope set and their refreshes fail under the new client_id, so
+    // each connection flips to needs_reauth until the user re-runs Connect
+    // (ENG-7483). The AS advertises the refresh_token grant (no
+    // openid/offline_access scope needed), so the shared oauth-refresh cron
+    // rotates the bearer without operator action.
     definitionId: "kajabi",
     authorizeUrl: "https://app.kajabi.com/mcp/oauth/authorize",
     tokenUrl: "https://mcp.kajabi.com/mcp/oauth/token",
     revokeUrl: "https://mcp.kajabi.com/mcp/oauth/revoke",
-    // Coarse Doorkeeper scopes (NOT openid-style). Least-privilege v1: cross-
-    // domain reads (`read`) plus the two write surfaces this integration ships
-    // (contact tags/segments, email broadcasts/sequences). Widen here (and
-    // re-register the DCR client) when adding commerce/content/publish scopes.
-    defaultScopes: ["read", "write:contacts", "write:emails"],
+    // Coarse Doorkeeper scopes (NOT openid-style). Cross-domain reads (`read`)
+    // plus the write surfaces this integration ships: contact tags/segments,
+    // email broadcasts/sequences, and course updates (write:content gates
+    // update_course, the course-thumbnail path, ENG-7483). write:commerce is
+    // requested now (Brad's call on ENG-7483) so a later offer/pricing-write
+    // enablement needs no extra re-consent round; the tool allowlist below
+    // still exposes no commerce write, so the callable surface stays minimal.
+    defaultScopes: ["read", "write:contacts", "write:emails", "write:content", "write:commerce"],
     supportsRefresh: true,
     extraAuthorizeParams: {},
     clientAuthMethod: "body",
@@ -3645,12 +3653,16 @@ var OAUTH_PROVIDERS = {
     publicClient: true,
     mcpUrl: "https://mcp.kajabi.com/mcp",
     // Curated surface (matches the catalog seed's defined_scopes[].tools). Kajabi's
-    // live MCP advertises ~111 tools; the agent only needs these 26.
+    // live MCP advertises ~111 tools; the agent only needs these 28.
     // CS-1427: `enable_toolset` is included so an agent can activate its own
     // products/commerce + analytics toolsets on the connection (Kajabi gates those
     // tool groups behind a runtime toolset that returns "not active" until enabled).
     // Low-risk: this proxy still caps every tools/call to the allowlist, so a broad
     // activation can't widen what's actually callable.
+    // ENG-7483: `get_course`/`update_course` enable the course-thumbnail refresh
+    // (update_course covers title/description/thumbnail per Kajabi's MCP docs).
+    // Fail-safe on naming drift: an allowlisted tool the server doesn't advertise
+    // is logged and skipped by the proxy, never a break.
     toolAllowlist: [
       "list_sites",
       "get_site_summary",
@@ -3677,7 +3689,9 @@ var OAUTH_PROVIDERS = {
       "list_sequences",
       "get_sequence",
       "create_sequence",
-      "enable_toolset"
+      "enable_toolset",
+      "get_course",
+      "update_course"
     ]
   },
   "notion-cli": {
@@ -4757,14 +4771,15 @@ var INTEGRATION_REGISTRY = [
     id: "kajabi",
     name: "Kajabi",
     category: "crm",
-    description: "Run a Kajabi creator business from chat: read contacts, products, offers, and analytics, manage contact tags & segments, and draft email broadcasts & sequences.",
+    description: "Run a Kajabi creator business from chat: read contacts, products, offers, and analytics, manage contact tags & segments, draft email broadcasts & sequences, and update course details & thumbnails.",
     // Same remote streamable-HTTP MCP + OAuth pattern as Granola/Brand Ninja.
     // Kajabi's Doorkeeper AS implements the MCP discovery chain (RFC
     // 9728/8414/7591); auth is OAuth 2.0 authorization-code with PKCE (S256)
     // and a public client registered via one-time Dynamic Client Registration
     // (scripts/dcr-register.ts against https://mcp.kajabi.com/mcp/oauth/register
     // → OAUTH_KAJABI_CLIENT_ID; register with --scope 'read write:contacts
-    // write:emails' since Doorkeeper caps a dynamic client to its registered
+    // write:emails write:content write:commerce' (ENG-7483) since Doorkeeper
+    // caps a dynamic client to its registered
     // scopes). End-user consent is brokered by the webapp through the shared
     // /integrations/oauth/authorize → /callback path, and the access_token is
     // injected into .mcp.json via the generic bearer-header path
@@ -4775,7 +4790,8 @@ var INTEGRATION_REGISTRY = [
     capabilities: [
       { id: "kajabi:read", name: "Read & Discover", description: "List sites and read contacts, products, offers, purchases, and revenue/contacts analytics (list_sites, select_site, search_contacts, get_contact, list_offers, get_offer, search_products, get_revenue_analytics, \u2026)", access: "read" },
       { id: "kajabi:contacts", name: "Manage Contacts", description: "Create and apply contact tags, and create/update saved contact segments (create_tag, tag_contact, untag_contact, create_segment, update_segment)", access: "write" },
-      { id: "kajabi:emails", name: "Manage Emails", description: "Read and draft email broadcasts and sequences \u2014 drafts only, sending stays a human action in Kajabi (create_broadcast, create_sequence, list_broadcasts, get_sequence)", access: "write" }
+      { id: "kajabi:emails", name: "Manage Emails", description: "Read and draft email broadcasts and sequences \u2014 drafts only, sending stays a human action in Kajabi (create_broadcast, create_sequence, list_broadcasts, get_sequence)", access: "write" },
+      { id: "kajabi:courses", name: "Manage Courses", description: "Read course structure and update course details: title, description, and thumbnail (get_course, update_course). ENG-7483: the course-thumbnail refresh path.", access: "write" }
     ],
     docs_url: "https://help.kajabi.com/articles/api-integrations/connect-kajabi-to-claude-or-chatgpt",
     beta: true
@@ -9213,4 +9229,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-DMNWHJ65.js.map
+//# sourceMappingURL=chunk-E45AAMBQ.js.map