@integrity-labs/agt-cli 0.28.333 → 0.28.334

package/dist/bin/agt.js

@@ -38,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-RQOJLHYA.js";
+} from "../chunk-ZBLSH3CX.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4827,7 +4827,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.333" : "dev";
+var cliVersion = true ? "0.28.334" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5931,7 +5931,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.333" : "dev";
+var cliVersion2 = true ? "0.28.334" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-RQOJLHYA.js → chunk-ZBLSH3CX.js}

@@ -971,7 +971,16 @@ function formatEmailDomainConfigLines(config) {
   } else if (mode === "internal_only") {
     lines.push(`  - only your organization's own email domain is permitted`);
   }
-  lines.push(`  *Advisory: honor this restriction \u2014 it is guidance in your instructions, not a hard block at send time.*`);
+  const stage = typeof config.stage === "string" ? config.stage : void 0;
+  const enforceLive = config.enforce_live === true;
+  if (stage) {
+    lines.push(`  - stage: ${stage}`);
+    if (!(stage === "enforce" && enforceLive)) {
+      lines.push(`  *Currently observe-only: the API records domain decisions to guardrail_audit_log but does not block sends at this stage. Honor the restriction as authoritative guidance; the runtime flip is operator-side.*`);
+    }
+  } else {
+    lines.push(`  *Advisory: honor this restriction \u2014 it is guidance in your instructions, not a hard block at send time.*`);
+  }
   return lines;
 }
 var CALENDAR_CONFIDENTIALITY_DEF = "calendar.confidentiality";
@@ -1018,10 +1027,31 @@ function effectiveCalendarEnforcement(g) {
     return "warn";
   return g.enforcement;
 }
+function effectiveEmailEnforcement(g) {
+  if (g.definitionId !== EMAIL_DOMAIN_RESTRICT_DEF)
+    return g.enforcement;
+  if (g.enforcement === "disabled")
+    return g.enforcement;
+  const stage = typeof g.config?.["stage"] === "string" ? g.config["stage"] : void 0;
+  if (stage === void 0)
+    return g.enforcement;
+  const enforceLive = g.config?.["enforce_live"] === true;
+  if (stage === "enforce" && enforceLive)
+    return g.enforcement;
+  if (stage === "warn")
+    return g.enforcement === "enforce" ? "warn" : g.enforcement;
+  return "log";
+}
 function buildGuardrailsSection(guardrails) {
   if (!guardrails || guardrails.length === 0)
     return "";
-  const active = guardrails.map((g) => ({ ...g, enforcement: effectiveCalendarEnforcement(g) })).filter((g) => g.enforcement !== "disabled" || !!(g.overrideApplied && g.overrideReason?.trim()));
+  const active = guardrails.map((g) => {
+    const enforcement = effectiveEmailEnforcement({
+      ...g,
+      enforcement: effectiveCalendarEnforcement(g)
+    });
+    return { ...g, enforcement };
+  }).filter((g) => g.enforcement !== "disabled" || !!(g.overrideApplied && g.overrideReason?.trim()));
   if (active.length === 0)
     return "";
   const isOverridden = (g) => !!(g.overrideApplied && g.overrideReason?.trim());
@@ -6956,7 +6986,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.333" : "dev";
+var agtCliVersion = true ? "0.28.334" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9353,4 +9383,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-RQOJLHYA.js.map
+//# sourceMappingURL=chunk-ZBLSH3CX.js.map