@integrity-labs/agt-cli 0.28.297 → 0.28.299

package/dist/bin/agt.js

@@ -38,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-VTSO7X7P.js";
+} from "../chunk-V23GLSEX.js";
 import {
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
@@ -67,7 +67,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-QXU5FMXN.js";
+} from "../chunk-KMJHNKPQ.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4826,7 +4826,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.297" : "dev";
+var cliVersion = true ? "0.28.299" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5843,7 +5843,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.297" : "dev";
+var cliVersion2 = true ? "0.28.299" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-QXU5FMXN.js → chunk-KMJHNKPQ.js}

@@ -5064,7 +5064,10 @@ var INTEGRATION_REGISTRY = [
       note: "Billed per second of generated video; the rate depends on the resolution.",
       meters: [
         { event_type: "grok_imagine_video_1_5_480p", unit: "second" },
-        { event_type: "grok_imagine_video_1_5_720p", unit: "second" }
+        { event_type: "grok_imagine_video_1_5_720p", unit: "second" },
+        // 1080p is image-to-video only (xAI restriction); metered when the
+        // agent supplies image_url (ENG-7675).
+        { event_type: "grok_imagine_video_1_5_1080p", unit: "second" }
       ]
     }
   },
@@ -7537,6 +7540,41 @@ var FLAG_REGISTRY = [
     // safety control, so mutations require explicit confirmation.
     sensitive: true
   },
+  {
+    key: "composio-hitl-mode",
+    description: "Composio managed-toolkits HITL gate (ENG-6027): off = kill switch, shadow = resolve + audit the tier decision but never block, enforce = block write_high_risk+ calls (routed to approval when hitl-approval-routing is on). Per-org rollout from the admin Feature Flags page; ENG-7672 migrated this off the fleet-wide COMPOSIO_HITL_MODE env var.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Declared safe value is `shadow` (resolve + audit, never block) — NOT `off`.
+    // shadow keeps the control evaluating + producing enforce-flip evidence while
+    // staying non-blocking, and matches the pre-flag compiled default so migrating
+    // onto the flag (ENG-7672) preserves fleet behaviour. A flag-DB read error
+    // degrades here. `enforce` is the deliberate, audited flip.
+    defaultValue: "shadow",
+    // Migration override (ADR-0022): the pre-flags env gate stays the
+    // highest-precedence operator override. It is only injected onto the Lambdas
+    // when an operator explicitly sets it (sst.config.ts) — otherwise this flag governs.
+    envVar: "COMPOSIO_HITL_MODE",
+    // enforce blocks prod tool calls, so weakening it (enforce → shadow/off) drops a
+    // safety control — mutations require explicit confirmation.
+    sensitive: true
+  },
+  {
+    key: "hitl-approval-routing",
+    description: "Routing for HITL-blocked integration calls (ENG-6028): off = blocked calls return the terminal block, on = route them into the approval-core flow (approval_requests row + Slack approval card). Needs a block first (composio-hitl-mode=enforce, or the always-on Direct-HTTP lane). Per-org rollout; ENG-7672 migrated this off the fleet-wide HITL_APPROVAL_ROUTING env var.",
+    flagType: "enum",
+    allowedValues: ["off", "on"],
+    // Declared safe value is `off` (terminal block, no new side effects) — the
+    // most-restrictive-known state, matching the pre-flag default. A flag-DB read
+    // error degrades here.
+    defaultValue: "off",
+    // Migration override (ADR-0022): only injected onto the Lambdas when an operator
+    // explicitly sets it (sst.config.ts) — otherwise this flag governs.
+    envVar: "HITL_APPROVAL_ROUTING",
+    // Turning routing on starts minting approval cards / approval_requests rows — an
+    // egress + workflow change worth an explicit confirm.
+    sensitive: true
+  },
   {
     key: "slack-reply-binding",
     description: "Slack reply-target binding (ENG-7396 / WS2, cross-thread reply routing): the model names which inbound it answers (inbound_id) and the server resolves the destination from its own verified record. shadow = classify + count only, routing unchanged; warn = same routing plus a tool-result note so the model self-corrects; enforce = route a bound reply to the registry thread and REJECT a reply whose target matches no inbound this process delivered. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_SLACK_REPLY_BINDING spawn env (the operator/canary override, ADR-0022). Ships shadow.",
@@ -9472,4 +9510,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-QXU5FMXN.js.map
+//# sourceMappingURL=chunk-KMJHNKPQ.js.map