@integrity-labs/agt-cli 0.28.318 → 0.28.319

package/dist/mcp/origami.js

@@ -38801,7 +38801,12 @@ var INTEGRATION_REGISTRY = [
       },
       // ENG-5857 mints the real session id; default empty so the header
       // resolves cleanly (no profile bound → ephemeral session) until then.
-      envDefaults: { ANCHOR_BROWSER_SESSION_ID: "" }
+      envDefaults: { ANCHOR_BROWSER_SESSION_ID: "" },
+      // ENG-7748: route through the stdio remote-MCP proxy so the api-key and
+      // the minted anchor-session-id headers are read LIVE per request. A
+      // re-minted session id then takes effect with no agent respawn (a direct-
+      // HTTP header would be frozen at spawn).
+      liveHeaderRefresh: true
     }
   },
   {

package/dist/mcp/remote-oauth-proxy.js

@@ -12,6 +12,8 @@ var TOKEN_FILE_ENV = "AGT_REMOTE_MCP_TOKEN_FILE";
 var TOKEN_VAR_ENV = "AGT_REMOTE_MCP_TOKEN_VAR";
 var ALLOWLIST_ENV = "AGT_REMOTE_MCP_TOOL_ALLOWLIST";
 var PREENABLE_ENV = "AGT_REMOTE_MCP_PREENABLE_TOOLSETS";
+var AUTH_HEADER_ENV = "AGT_REMOTE_MCP_AUTH_HEADER";
+var EXTRA_HEADERS_ENV = "AGT_REMOTE_MCP_EXTRA_HEADERS";
 var REMOTE_FETCH_TIMEOUT_MS = 3e4;
 var remoteUrl = process.env[URL_ENV] ?? "";
 var tokenFile = process.env[TOKEN_FILE_ENV] ?? "";
@@ -19,6 +21,8 @@ var tokenVar = process.env[TOKEN_VAR_ENV] ?? "";
 var label = process.env["AGT_REMOTE_MCP_LABEL"] || tokenVar || "remote-oauth";
 var toolAllowlist = parseToolAllowlist(process.env[ALLOWLIST_ENV] ?? "");
 var preEnableToolsets = parsePreEnableToolsets(process.env[PREENABLE_ENV] ?? "");
+var authHeaderName = (process.env[AUTH_HEADER_ENV] ?? "").trim();
+var extraHeaderSpecs = parseExtraHeaders(process.env[EXTRA_HEADERS_ENV] ?? "");
 function logErr(msg) {
   process.stderr.write(`[remote-oauth-proxy:${label}] ${msg}
 `);
@@ -91,6 +95,19 @@ function parseToolAllowlist(raw) {
   }
   return out;
 }
+function parseExtraHeaders(raw) {
+  const out = [];
+  for (const part of (raw || "").split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    const colon = trimmed.indexOf(":");
+    if (colon <= 0) continue;
+    const header = trimmed.slice(0, colon).trim();
+    const varName = trimmed.slice(colon + 1).trim();
+    if (header && varName) out.push({ header, varName });
+  }
+  return out;
+}
 function filterToolsListMessage(message, allow) {
   if (allow.size === 0) return { message, total: 0, kept: 0, advertised: [] };
   let obj;
@@ -166,14 +183,25 @@ function extractJsonRpcMessages(contentType, body) {
   }
   return out;
 }
+function buildForwardHeaders(token, authHeader, extras, readVar) {
+  const headers = {
+    "Content-Type": "application/json",
+    Accept: "application/json, text/event-stream"
+  };
+  if (authHeader) headers[authHeader] = token;
+  else headers["Authorization"] = `Bearer ${token}`;
+  for (const { header, varName } of extras) {
+    headers[header] = readVar(varName) ?? "";
+  }
+  return headers;
+}
+function readTokenVar(varName) {
+  return readCurrentToken(tokenFile, varName);
+}
 async function postRpc(token, body) {
   const res = await fetch(remoteUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Accept: "application/json, text/event-stream",
-      Authorization: `Bearer ${token}`
-    },
+    headers: buildForwardHeaders(token, authHeaderName, extraHeaderSpecs, readTokenVar),
     body,
     signal: AbortSignal.timeout(REMOTE_FETCH_TIMEOUT_MS)
   });
@@ -250,11 +278,7 @@ async function forward(line, id, isNotification, method, params) {
   try {
     res = await fetch(remoteUrl, {
       method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Accept: "application/json, text/event-stream",
-        Authorization: `Bearer ${token}`
-      },
+      headers: buildForwardHeaders(token, authHeaderName, extraHeaderSpecs, readTokenVar),
       body: line,
       signal: AbortSignal.timeout(REMOTE_FETCH_TIMEOUT_MS)
     });
@@ -361,6 +385,7 @@ if (invokedDirectly) {
 }
 export {
   buildEnableToolsetRequest,
+  buildForwardHeaders,
   buildToolsListRequest,
   extractJsonRpcMessages,
   extractToolsArray,
@@ -368,6 +393,7 @@ export {
   isToolCallBlocked,
   main,
   parseEnableToolsetResponse,
+  parseExtraHeaders,
   parsePreEnableToolsets,
   parseToolAllowlist,
   readCurrentToken,

package/dist/{persistent-session-VSSEZTY7.js → persistent-session-U5IQYEXX.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-4DHYHNCV.js";
+} from "./chunk-ISHK77EM.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-VSSEZTY7.js.map
+//# sourceMappingURL=persistent-session-U5IQYEXX.js.map

package/dist/{responsiveness-probe-I6YFUKYD.js → responsiveness-probe-YIESMTKL.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-4DHYHNCV.js";
+} from "./chunk-ISHK77EM.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -427,4 +427,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-I6YFUKYD.js.map
+//# sourceMappingURL=responsiveness-probe-YIESMTKL.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.318",
+  "version": "0.28.319",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {