@integrity-labs/agt-cli 0.28.308 → 0.28.310

package/dist/bin/agt.js

@@ -38,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-XPT5NDBD.js";
+} from "../chunk-J7PAEPOU.js";
 import {
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
@@ -67,7 +67,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-QVYGYEBX.js";
+} from "../chunk-KJE5Y4GF.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4826,7 +4826,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.308" : "dev";
+var cliVersion = true ? "0.28.310" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5843,7 +5843,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.308" : "dev";
+var cliVersion2 = true ? "0.28.310" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-XPT5NDBD.js → chunk-J7PAEPOU.js}

@@ -18,7 +18,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-QVYGYEBX.js";
+} from "./chunk-KJE5Y4GF.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5900,7 +5900,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.308" : "dev";
+var agtCliVersion = true ? "0.28.310" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8199,4 +8199,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-XPT5NDBD.js.map
+//# sourceMappingURL=chunk-J7PAEPOU.js.map

package/dist/{chunk-QVYGYEBX.js → chunk-KJE5Y4GF.js}

@@ -4494,6 +4494,14 @@ var UPSTREAM_AUTH_ERROR_PATTERNS = [
   "access denied",
   "forbidden"
 ];
+var SITE_RESOLUTION_ERROR_PATTERNS = [
+  "dns resolution failed",
+  "getaddrinfo",
+  "enotfound",
+  "could not resolve host",
+  "name resolution",
+  "name not resolved"
+];
 function isReadonlyToolDescriptor(t) {
   if (!t?.name)
     return false;
@@ -4540,11 +4548,17 @@ function isUpstreamAuthError(message) {
 function isComposioFailureEnvelope(text) {
   return /["'\\]*(successful|successfull)["'\\\s]*:\s*false\b/i.test(text);
 }
+function isSiteResolutionError(message) {
+  const m = message.toLowerCase();
+  return SITE_RESOLUTION_ERROR_PATTERNS.some((p2) => m.includes(p2));
+}
 function classifyToolCallFailure(text) {
   if (isAccountResolutionError(text))
     return "account";
   if (isUpstreamAuthError(text))
     return "auth";
+  if (isSiteResolutionError(text))
+    return "site";
   return "benign";
 }
 async function parseRpc2(res, expectedId) {
@@ -4673,6 +4687,13 @@ async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
           details: { ...baseDetails, reason: "upstream_auth_rejected" }
         };
       }
+      if (kind === "site") {
+        return {
+          status: "down",
+          message: `Live tool call '${toolName}' couldn't reach the provider's site - the connection has no valid site URL (reconnect and make sure a site/workspace is granted): ${snippet}`,
+          details: { ...baseDetails, reason: "site_unresolved" }
+        };
+      }
       return { status: "ok", message: `Live tool call '${toolName}' resolved the account (tool error: ${snippet})`, details: baseDetails };
     }
     return { status: "ok", message: `Live tool call '${toolName}' resolved the connected account`, details: baseDetails };
@@ -7361,15 +7382,12 @@ var FLAG_REGISTRY = [
     // spend control, so mutations require explicit confirmation.
     sensitive: true
   },
-  {
-    key: "team-scoped-visibility",
-    description: "Restrict team-scoped reads to direct team members (ENG-7122). By default the API resolves X-Team-Slug for any org member (org-membership fallback), so a plain org member can read a sibling team they are not on (agents, kanban, run-derived spend) because the service-role API filters only by the org-resolved team_id. When ON for an org, the org-membership fallback is dropped for plain org member/viewer (they may only resolve teams they are a direct team_members of), while org owner/admin keep cross-team reach and the admin-onboarding bypass is preserved. The GET /teams listing is narrowed the same way. Boolean gate; default off (current behaviour).",
-    flagType: "boolean",
-    defaultValue: false,
-    // Tightening control: turning this flag OFF *relaxes* a visibility restriction,
-    // so mutations require explicit confirmation per ADR-0022 §4.
-    sensitive: true
-  },
+  // ENG-7754: 'team-scoped-visibility' (ENG-7122) archived - the restriction it
+  // gated is now the unconditional default for every org (a plain org
+  // member/viewer only sees/resolves teams they directly belong to; owner/admin
+  // keep cross-team reach). Enforced in code (routes/teams.ts, middleware/auth.ts,
+  // lib/team-resolver.ts), no longer flag-gated. Override rows dropped by
+  // migration 20260714000005. flag-archive-allow: team-scoped-visibility superseded by unconditional default (ENG-7754)
   {
     key: "channel-busy-ack",
     description: "Busy-but-alive ack notices when an agent is mid-task (ENG-6180). Boolean gate; ships dark.",
@@ -9816,4 +9834,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-QVYGYEBX.js.map
+//# sourceMappingURL=chunk-KJE5Y4GF.js.map