@integrity-labs/agt-cli 0.28.317 → 0.28.319

package/dist/mcp/index.js

@@ -21824,7 +21824,7 @@ server.tool(
   }
 );
 var kanbanMoveStatuses = AGT_KANBAN_WAITING_ENABLED ? ["backlog", "todo", "in_progress", "waiting", "done", "failed"] : ["backlog", "todo", "in_progress", "done", "failed"];
-var kanbanMoveDescription = AGT_KANBAN_WAITING_ENABLED ? 'Move a kanban item to a different status column. Use status="failed" for a task attempted but not completable. Use status="waiting" when you have COMPLETED your part and cannot proceed until one specific external action happens (a person approves/answers/decides, or a dependency like a PR merge or deploy completes). status="waiting" REQUIRES waiting_kind - classify the wait as "pr-review", "pr-merged", "human", "external", or "other" (the catch-all when none fit). For a PR wait ("pr-review"/"pr-merged") set waiting_repo ("owner/repo") and waiting_pr (the number) INSTEAD of waiting_on - the card then links straight to the PR and can auto-resume when it lands. For "human"/"external"/"other" set waiting_on to a one-line ask ("Answer my 5 scoping questions") AND put the full context the person needs to decide - the actual questions, options, links - in waiting_details, so they can answer from the card without opening a ticket. Do NOT use waiting to offload hard work, and do NOT confuse it with a failure. (matches the hosted kanban_move enum).' : 'Move a kanban item to a different status column. Use status="failed" to mark a task that was attempted but could not complete (matches the hosted kanban_move enum).';
+var kanbanMoveDescription = AGT_KANBAN_WAITING_ENABLED ? `Move a kanban item to a different status column. Use status="failed" for a task attempted but not completable. Use status="waiting" when you have COMPLETED your part and cannot proceed until one specific external action happens (a person approves/answers/decides, or a dependency like a PR merge or deploy completes). status="waiting" REQUIRES waiting_kind - classify the wait as "pr-review", "pr-merged", "human", "external", or "other" (the catch-all when none fit). For a PR wait ("pr-review"/"pr-merged") set waiting_repo ("owner/repo") and waiting_pr (the number) INSTEAD of waiting_on - the card then links straight to the PR and can auto-resume when it lands. For "human"/"external"/"other" set waiting_on to a one-line ask ("Answer my 5 scoping questions") AND put the full context the person needs to decide - the actual questions, options, links - in waiting_details, so they can answer from the card without opening a ticket. For "human" ALSO set waiting_on_person to that person's Slack user id, so the card lands in their "Awaiting you" queue and they are notified instead of your ask sitting unseen. Do NOT use waiting to offload hard work, and do NOT confuse it with a failure. (matches the hosted kanban_move enum).` : 'Move a kanban item to a different status column. Use status="failed" to mark a task that was attempted but could not complete (matches the hosted kanban_move enum).';
 var kanbanMoveStatusDescribe = AGT_KANBAN_WAITING_ENABLED ? 'Target status. "waiting" parks the card until one external action happens; it REQUIRES waiting_kind - use "pr-review"/"pr-merged" with waiting_repo + waiting_pr, or "human"/"external"/"other" with a concrete waiting_on. "failed" closes the row as a failed attempt; there is no "cancelled" status, close no-longer-needed work via kanban_done with an explanatory result.' : 'Target status. "failed" closes the row as a failed attempt; there is no "cancelled" status, close no-longer-needed work via kanban_done with an explanatory result.';
 server.tool(
   "kanban_move",
@@ -21850,6 +21850,9 @@ server.tool(
       waiting_pr: external_exports.number().int().positive().optional().describe("Only with a pr-* waiting_kind: the pull request number (e.g. 3120)."),
       waiting_choices: external_exports.array(external_exports.string()).optional().describe(
         'Optional, best with waiting_kind="human": 2-5 short answer options to offer the person as one-click buttons (e.g. ["Ship it", "Hold", "Needs changes"]). Keep them short. They can still add a free-text comment alongside a choice. Omit for an open-ended human wait (they just get a comment box).'
+      ),
+      waiting_on_person: external_exports.string().optional().describe(
+        `Only with waiting_kind="human": the Slack user id of the ONE person whose decision you are parked on (e.g. "U0123ABCD" - the same id you would pass to deliver_to). This puts the card in that person's "Awaiting you" queue and notifies them, so your ask does not sit unseen. It does NOT reassign the card - you still own driving it to done and you resume as soon as they answer. Set it whenever you know who has to act; omit only if genuinely nobody specific does.`
       )
     } : {}
   },
@@ -21884,6 +21887,17 @@ server.tool(
         isError: true
       };
     }
+    if (p.waiting_on_person && p.waiting_kind !== "human") {
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error: waiting_on_person is only valid with waiting_kind="human" (got "${p.waiting_kind ?? "unset"}"). Use waiting_kind="human" when one specific person must decide; for a PR use "pr-review"/"pr-merged" with waiting_repo + waiting_pr, and for a non-human blocker use "external"/"other" with waiting_on.`
+          }
+        ],
+        isError: true
+      };
+    }
     let waitingContext;
     if (isPrKind) {
       waitingContext = { repo: p.waiting_repo, pr_number: p.waiting_pr };
@@ -21903,7 +21917,8 @@ server.tool(
           notes: params.notes,
           waiting_on: isPrKind ? void 0 : p.waiting_on,
           waiting_kind: p.waiting_kind,
-          waiting_context: waitingContext
+          waiting_context: waitingContext,
+          waiting_on_person: p.waiting_on_person
         }
       ]
     });

package/dist/mcp/origami.js

@@ -38801,7 +38801,12 @@ var INTEGRATION_REGISTRY = [
       },
       // ENG-5857 mints the real session id; default empty so the header
       // resolves cleanly (no profile bound → ephemeral session) until then.
-      envDefaults: { ANCHOR_BROWSER_SESSION_ID: "" }
+      envDefaults: { ANCHOR_BROWSER_SESSION_ID: "" },
+      // ENG-7748: route through the stdio remote-MCP proxy so the api-key and
+      // the minted anchor-session-id headers are read LIVE per request. A
+      // re-minted session id then takes effect with no agent respawn (a direct-
+      // HTTP header would be frozen at spawn).
+      liveHeaderRefresh: true
     }
   },
   {

package/dist/mcp/remote-oauth-proxy.js

@@ -12,6 +12,8 @@ var TOKEN_FILE_ENV = "AGT_REMOTE_MCP_TOKEN_FILE";
 var TOKEN_VAR_ENV = "AGT_REMOTE_MCP_TOKEN_VAR";
 var ALLOWLIST_ENV = "AGT_REMOTE_MCP_TOOL_ALLOWLIST";
 var PREENABLE_ENV = "AGT_REMOTE_MCP_PREENABLE_TOOLSETS";
+var AUTH_HEADER_ENV = "AGT_REMOTE_MCP_AUTH_HEADER";
+var EXTRA_HEADERS_ENV = "AGT_REMOTE_MCP_EXTRA_HEADERS";
 var REMOTE_FETCH_TIMEOUT_MS = 3e4;
 var remoteUrl = process.env[URL_ENV] ?? "";
 var tokenFile = process.env[TOKEN_FILE_ENV] ?? "";
@@ -19,6 +21,8 @@ var tokenVar = process.env[TOKEN_VAR_ENV] ?? "";
 var label = process.env["AGT_REMOTE_MCP_LABEL"] || tokenVar || "remote-oauth";
 var toolAllowlist = parseToolAllowlist(process.env[ALLOWLIST_ENV] ?? "");
 var preEnableToolsets = parsePreEnableToolsets(process.env[PREENABLE_ENV] ?? "");
+var authHeaderName = (process.env[AUTH_HEADER_ENV] ?? "").trim();
+var extraHeaderSpecs = parseExtraHeaders(process.env[EXTRA_HEADERS_ENV] ?? "");
 function logErr(msg) {
   process.stderr.write(`[remote-oauth-proxy:${label}] ${msg}
 `);
@@ -91,6 +95,19 @@ function parseToolAllowlist(raw) {
   }
   return out;
 }
+function parseExtraHeaders(raw) {
+  const out = [];
+  for (const part of (raw || "").split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    const colon = trimmed.indexOf(":");
+    if (colon <= 0) continue;
+    const header = trimmed.slice(0, colon).trim();
+    const varName = trimmed.slice(colon + 1).trim();
+    if (header && varName) out.push({ header, varName });
+  }
+  return out;
+}
 function filterToolsListMessage(message, allow) {
   if (allow.size === 0) return { message, total: 0, kept: 0, advertised: [] };
   let obj;
@@ -166,14 +183,25 @@ function extractJsonRpcMessages(contentType, body) {
   }
   return out;
 }
+function buildForwardHeaders(token, authHeader, extras, readVar) {
+  const headers = {
+    "Content-Type": "application/json",
+    Accept: "application/json, text/event-stream"
+  };
+  if (authHeader) headers[authHeader] = token;
+  else headers["Authorization"] = `Bearer ${token}`;
+  for (const { header, varName } of extras) {
+    headers[header] = readVar(varName) ?? "";
+  }
+  return headers;
+}
+function readTokenVar(varName) {
+  return readCurrentToken(tokenFile, varName);
+}
 async function postRpc(token, body) {
   const res = await fetch(remoteUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Accept: "application/json, text/event-stream",
-      Authorization: `Bearer ${token}`
-    },
+    headers: buildForwardHeaders(token, authHeaderName, extraHeaderSpecs, readTokenVar),
     body,
     signal: AbortSignal.timeout(REMOTE_FETCH_TIMEOUT_MS)
   });
@@ -250,11 +278,7 @@ async function forward(line, id, isNotification, method, params) {
   try {
     res = await fetch(remoteUrl, {
       method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Accept: "application/json, text/event-stream",
-        Authorization: `Bearer ${token}`
-      },
+      headers: buildForwardHeaders(token, authHeaderName, extraHeaderSpecs, readTokenVar),
       body: line,
       signal: AbortSignal.timeout(REMOTE_FETCH_TIMEOUT_MS)
     });
@@ -361,6 +385,7 @@ if (invokedDirectly) {
 }
 export {
   buildEnableToolsetRequest,
+  buildForwardHeaders,
   buildToolsListRequest,
   extractJsonRpcMessages,
   extractToolsArray,
@@ -368,6 +393,7 @@ export {
   isToolCallBlocked,
   main,
   parseEnableToolsetResponse,
+  parseExtraHeaders,
   parsePreEnableToolsets,
   parseToolAllowlist,
   readCurrentToken,

package/dist/{persistent-session-UZNQVUYB.js → persistent-session-U5IQYEXX.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-ORTMG5E3.js";
+} from "./chunk-ISHK77EM.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-UZNQVUYB.js.map
+//# sourceMappingURL=persistent-session-U5IQYEXX.js.map

package/dist/{responsiveness-probe-5XF7ZCYF.js → responsiveness-probe-YIESMTKL.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-ORTMG5E3.js";
+} from "./chunk-ISHK77EM.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -427,4 +427,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-5XF7ZCYF.js.map
+//# sourceMappingURL=responsiveness-probe-YIESMTKL.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.317",
+  "version": "0.28.319",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {