@integrity-labs/agt-cli 0.28.343 → 0.28.345

package/dist/{chunk-7OBFGSQS.js → chunk-O5IINJDB.js}

@@ -6835,14 +6835,18 @@ var FRESH_HEARTBEAT_THRESHOLD_MS = 2 * 60 * 1e3;
 // ../../packages/core/dist/claude-code-usage/banner-parser.js
 var SEP = /[\s·\-–—]+/.source;
 var SUBJECT = /(?:You(?:['’]ve|\s+have)?\s+)?/.source;
-var RESET_DATE = /[A-Za-z]{3,9}\s+\d{1,2}(?:\s*,\s*\d{1,2}(?::\d{2})?\s*(?:am|pm)(?:\s*\(?UTC\)?)?)?/.source;
+var TIME_OF_DAY = /\d{1,2}(?::\d{2})?\s*(?:am|pm)(?:\s*\(?UTC\)?)?/.source;
+var RESET_DATE = `(?:[A-Za-z]{3,9}\\s+\\d{1,2}(?:\\s*,\\s*${TIME_OF_DAY})?|${TIME_OF_DAY})`;
 var BANNER_PATTERNS = [
   // Percentage form — pct in group 1, reset in group 2.
   new RegExp(`${SUBJECT}used\\s+(\\d{1,3})%\\s+of\\s+your\\s+weekly\\s+limit${SEP}resets\\s+(${RESET_DATE})`, "i"),
-  // Saturated form (ENG-5434) — no pct, reset in group 1. Wrapped to keep
-  // the per-pattern shape consistent with the percentage form: the parser
-  // checks group 1 for a digit string and treats a missing one as pct=100.
-  new RegExp(`${SUBJECT}hit\\s+your\\s+limit${SEP}resets\\s+(${RESET_DATE})`, "i")
+  // Saturated form (ENG-5434, extended by ENG-7904) — no pct, reset in group 1.
+  // An optional qualifier word ("weekly", "5-hour", …) may sit between "your"
+  // and "limit"; matching it keeps the parser resilient to CC's phrasing drift.
+  // Wrapped to keep the per-pattern shape consistent with the percentage form:
+  // the parser checks group 1 for a digit string and treats a missing one as
+  // pct=100.
+  new RegExp(`${SUBJECT}hit\\s+your\\s+(?:[a-z0-9-]+\\s+)?limit${SEP}resets\\s+(${RESET_DATE})`, "i")
 ];
 function parseUsageBanner(text, now = /* @__PURE__ */ new Date()) {
   let bestIndex = -1;
@@ -6890,8 +6894,31 @@ var MONTHS = [
   "dec"
 ];
 var TIME_TAIL = /,\s*(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\(?UTC\)?)?\s*$/i;
+var TIME_ONLY = /^(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\(?UTC\)?)?$/i;
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+function parseAmPm(hourStr, minStr, ampm) {
+  const rawHour = Number.parseInt(hourStr, 10);
+  if (!Number.isFinite(rawHour) || rawHour < 1 || rawHour > 12)
+    return null;
+  let minute = 0;
+  if (minStr) {
+    minute = Number.parseInt(minStr, 10);
+    if (!Number.isFinite(minute) || minute < 0 || minute > 59)
+      return null;
+  }
+  const isPm = ampm.toLowerCase() === "pm";
+  return { hour: rawHour % 12 + (isPm ? 12 : 0), minute };
+}
 function parseResetDateTime(humanDate, now) {
   const trimmed = humanDate.trim();
+  const timeOnly = trimmed.match(TIME_ONLY);
+  if (timeOnly) {
+    const hm = parseAmPm(timeOnly[1], timeOnly[2], timeOnly[3]);
+    if (!hm)
+      return null;
+    const todayAt = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), hm.hour, hm.minute);
+    return new Date(todayAt <= now.getTime() ? todayAt + MS_PER_DAY : todayAt);
+  }
   const timeMatch = trimmed.match(TIME_TAIL);
   const dateOnly = timeMatch ? trimmed.slice(0, timeMatch.index).trim() : trimmed;
   const parts = dateOnly.split(/\s+/);
@@ -6906,16 +6933,11 @@ function parseResetDateTime(humanDate, now) {
   let hour = 0;
   let minute = 0;
   if (timeMatch) {
-    const rawHour = Number.parseInt(timeMatch[1], 10);
-    if (!Number.isFinite(rawHour) || rawHour < 1 || rawHour > 12)
+    const hm = parseAmPm(timeMatch[1], timeMatch[2], timeMatch[3]);
+    if (!hm)
       return null;
-    if (timeMatch[2]) {
-      minute = Number.parseInt(timeMatch[2], 10);
-      if (!Number.isFinite(minute) || minute < 0 || minute > 59)
-        return null;
-    }
-    const isPm = timeMatch[3].toLowerCase() === "pm";
-    hour = rawHour % 12 + (isPm ? 12 : 0);
+    hour = hm.hour;
+    minute = hm.minute;
   }
   const baseYear = now.getUTCFullYear();
   let resolved = null;
@@ -7162,6 +7184,17 @@ function attributeTranscriptUsageByRun(jsonl) {
   return { perRunModel: [...agg.values()], runIds: [...runIds] };
 }
 
+// ../../packages/core/dist/claude-code-usage/usage-limit-marker.js
+var USAGE_LIMIT_MARKER_FILENAME = "claude-usage-limit.json";
+var USAGE_LIMIT_MARKER_VERSION = 1;
+function serializeUsageLimitMarker(limitedUntil) {
+  const marker = {
+    version: USAGE_LIMIT_MARKER_VERSION,
+    limited_until: limitedUntil.toISOString()
+  };
+  return JSON.stringify(marker);
+}
+
 // ../../packages/core/dist/loops/kanban-check.js
 var KANBAN_CHECK_COMMAND = "kanban_list \u2014 pick up any actionable items if you are free.";
 var KANBAN_NUDGE_ACTIONABLE_STATUSES = ["todo", "in_progress"];
@@ -8141,6 +8174,18 @@ var FLAG_REGISTRY = [
     // flipping it on is worth an explicit confirm (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "email-guard-enforce-enabled",
+    description: "Platform enable-gate for the email-domain guardrail ENFORCE stage (ENG-5827 / A5, migrated to a flag under ENG-7899 / ADR-0022). When ON for an org, an org (or scope) at email_guard_stage=enforce actually BLOCKS sends to non-allowed domains: the rollout UI unlocks the Enforce option and PUT /email-guard accepts enforce. When OFF (default) a per-org enforce stage degrades to observe-only (would_block, never blocks) and the UI shows Enforce as not yet available. Ungates a control that blocks real customer email, so flip on per org only once block-spike alerting (ENG-5847) is firing. Evaluated per-org. Operator override: env EMAIL_DOMAIN_ENFORCE_ENABLED (an explicitly-set value wins over the flag; highest precedence per host). Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` (enforce degrades to observe-only = today's behaviour).
+    // A flag-DB read error degrades here, so a flags outage can never silently start blocking
+    // real email - the fail-closed direction for a blocking compliance control.
+    defaultValue: false,
+    // Flipping it on ARMS a control that blocks real customer email, so it is a
+    // deliberate, audited per-org flip (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "slack-reply-binding",
     description: "Slack reply-target binding (ENG-7396 / WS2, cross-thread reply routing): the model names which inbound it answers (inbound_id) and the server resolves the destination from its own verified record. shadow = classify + count only, routing unchanged; warn = same routing plus a tool-result note so the model self-corrects; enforce = route a bound reply to the registry thread and REJECT a reply whose target matches no inbound this process delivered. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_SLACK_REPLY_BINDING spawn env (the operator/canary override, ADR-0022). Ships shadow.",
@@ -10038,6 +10083,8 @@ export {
   sumTranscriptUsageInWindow,
   isEmptyTotals,
   attributeTranscriptUsageByRun,
+  USAGE_LIMIT_MARKER_FILENAME,
+  serializeUsageLimitMarker,
   KANBAN_CHECK_COMMAND,
   KANBAN_NUDGE_ACTIONABLE_STATUSES,
   isSystemInjectedContent,
@@ -10102,4 +10149,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-7OBFGSQS.js.map
+//# sourceMappingURL=chunk-O5IINJDB.js.map