@integrity-labs/agt-cli 0.28.329 → 0.28.330

package/dist/bin/agt.js

@@ -38,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-AOSBSVNB.js";
+} from "../chunk-CDRVXSQ3.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4827,7 +4827,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.329" : "dev";
+var cliVersion = true ? "0.28.330" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5931,7 +5931,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.329" : "dev";
+var cliVersion2 = true ? "0.28.330" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-AOSBSVNB.js → chunk-CDRVXSQ3.js}

@@ -6797,7 +6797,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.329" : "dev";
+var agtCliVersion = true ? "0.28.330" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9194,4 +9194,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-AOSBSVNB.js.map
+//# sourceMappingURL=chunk-CDRVXSQ3.js.map

package/dist/lib/manager-worker.js

@@ -43,7 +43,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-AOSBSVNB.js";
+} from "../chunk-CDRVXSQ3.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -8386,7 +8386,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.329" : "dev";
+var agtCliVersion = true ? "0.28.330" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/xero.js

@@ -114409,7 +114409,8 @@ var BrokerCredentialClient = class {
           accessToken: res.data.access_token,
           tenantId: res.data.tenant_id ?? null,
           expiresAt: res.data.expires_at ?? null,
-          grantedScopes: res.data.granted_scopes ?? null
+          grantedScopes: res.data.granted_scopes ?? null,
+          effectiveScopes: res.data.effective_scopes ?? null
         };
       } catch (err) {
         if (err.status !== void 0) throw err;
@@ -120511,38 +120512,80 @@ function writesGoViaBroker() {
   const raw = (process.env.XERO_WRITES_VIA_BROKER ?? "").trim().toLowerCase();
   return raw === "true" || raw === "1" || raw === "yes";
 }
-function ToolFactory(server) {
+var SCOPE_GATES = [
+  { family: /payroll/i, requiresScope: "payroll" }
+];
+function makeToolGate(effectiveScopes) {
+  if (effectiveScopes == null) return () => true;
+  const scopes = effectiveScopes.toLowerCase();
+  return (toolName) => {
+    for (const gate of SCOPE_GATES) {
+      if (gate.family.test(toolName) && !scopes.includes(gate.requiresScope)) {
+        return false;
+      }
+    }
+    return true;
+  };
+}
+function ToolFactory(server, effectiveScopes = null) {
   const readOnly = writesGoViaBroker();
+  const allow = makeToolGate(effectiveScopes);
   if (readOnly) {
     console.error(
       "xero-mcp-server: XERO_WRITES_VIA_BROKER is set \u2014 registering read-only tools only (Get/List). Create/Update/Delete are gated through the Augmented xero-broker (HITL)."
     );
   }
-  GetTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
-  ListTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
+  if (effectiveScopes != null && !effectiveScopes.toLowerCase().includes("payroll")) {
+    console.error(
+      "xero-mcp-server: agent policy excludes payroll scopes \u2014 payroll tools not registered (ENG-7824)."
+    );
+  }
+  GetTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  ListTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
   AttachmentTools.map((tool) => tool()).forEach(
     (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
   );
   if (readOnly) return;
-  DeleteTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
-  CreateTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
-  UpdateTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
+  DeleteTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  CreateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  UpdateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
 }
 
 // src/index.ts
+async function resolveEffectiveScopes() {
+  const host = process.env.AGT_HOST;
+  const agentId = process.env.AGT_AGENT_ID;
+  const integrationId = process.env.AGT_INTEGRATION_ID;
+  const initialToken = process.env.AGT_TOKEN;
+  const apiKey = process.env.AGT_API_KEY;
+  const brokerMode = Boolean(host && agentId && integrationId && (initialToken || apiKey));
+  if (!brokerMode) return null;
+  try {
+    const client = new BrokerCredentialClient({
+      host,
+      initialToken,
+      apiKey,
+      agentId,
+      integrationId
+    });
+    const cred = await Promise.race([
+      client.fetchCredential(),
+      new Promise(
+        (_, reject) => setTimeout(() => reject(new Error("effective-scope resolution timed out")), 8e3)
+      )
+    ]);
+    return cred.effectiveScopes;
+  } catch (err) {
+    console.error(
+      `xero-mcp-server: effective-scope resolution failed, registering all tools (fail-open): ${err.message}`
+    );
+    return null;
+  }
+}
 var main = async () => {
   const server = XeroMcpServer.GetServer();
-  ToolFactory(server);
+  const effectiveScopes = await resolveEffectiveScopes();
+  ToolFactory(server, effectiveScopes);
   const transport = new StdioServerTransport();
   await server.connect(transport);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.329",
+  "version": "0.28.330",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {