@integrity-labs/agt-cli 0.28.370 → 0.28.371

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-TDZFQHXC.js";
+} from "../chunk-D6BJJ334.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -70,7 +70,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-NEM6OQLG.js";
+} from "../chunk-NDF3YMP5.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4829,7 +4829,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.370" : "dev";
+var cliVersion = true ? "0.28.371" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6001,7 +6001,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.370" : "dev";
+var cliVersion2 = true ? "0.28.371" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-TDZFQHXC.js → chunk-D6BJJ334.js}

@@ -3,6 +3,11 @@ import {
   LATE_BOUND_VARS,
   OAUTH_PROVIDERS,
   PLATFORM_STORAGE_RULE,
+  buildHostBrokeredRemoteMcpEntry,
+  buildLiveHeaderRemoteMcpProxyEntry,
+  buildNativeMcpEntry,
+  buildOAuthRemoteMcpProxyEntry,
+  buildRemoteMcpEntry,
   coerceEnvValue,
   expandTemplateVars,
   getFlagDefinition,
@@ -20,7 +25,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-NEM6OQLG.js";
+} from "./chunk-NDF3YMP5.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -1983,193 +1988,6 @@ function decryptIntegrationCredentials(credentials) {
   return out;
 }
 
-// ../../packages/core/dist/provisioning/remote-mcp.js
-function envVarForToken(definitionId) {
-  return `${definitionId.replace(/-/g, "_").toUpperCase()}_ACCESS_TOKEN`;
-}
-function credentialEnvVar(definitionId, credentialRef) {
-  const idPart = definitionId.replace(/-/g, "_").toUpperCase();
-  const credPart = credentialRef.replace(/-/g, "_").toUpperCase();
-  return `${idPart}_${credPart}`;
-}
-function assertSafeRemoteMcpUrl(url, definitionId) {
-  let u;
-  try {
-    u = new URL(url);
-  } catch {
-    throw new Error(`remoteMcp.url for '${definitionId}' is not a valid URL: ${url}`);
-  }
-  if (u.protocol !== "https:") {
-    throw new Error(`remoteMcp.url for '${definitionId}' must be https (got ${u.protocol}//): ${url}`);
-  }
-  const host = u.hostname.toLowerCase();
-  const blocked = host === "localhost" || host === "169.254.169.254" || // AWS/GCP/Azure instance metadata
-  host === "metadata.google.internal" || /^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^169\.254\./.test(host) || // link-local
-  /^172\.(1[6-9]|2\d|3[01])\./.test(host) || // 172.16.0.0/12
-  host.endsWith(".internal") || host.endsWith(".local");
-  if (blocked) {
-    throw new Error(`remoteMcp.url for '${definitionId}' resolves to a disallowed (internal/link-local/metadata) host: ${host}`);
-  }
-}
-function renderRemoteMcpSpec(definitionId, spec) {
-  assertSafeRemoteMcpUrl(spec.url, definitionId);
-  const headers = {};
-  if (spec.auth) {
-    const envVar = credentialEnvVar(definitionId, spec.auth.credential_ref);
-    const value = `\${${envVar}}`;
-    if (spec.auth.scheme === "bearer") {
-      headers["Authorization"] = `Bearer ${value}`;
-    } else {
-      if (!spec.auth.header_name) {
-        throw new Error(`remoteMcp.auth for '${definitionId}' uses scheme 'header' but no header_name`);
-      }
-      headers[spec.auth.header_name] = value;
-    }
-  }
-  Object.assign(headers, spec.headers ?? {});
-  return {
-    type: spec.type ?? "http",
-    url: spec.url,
-    ...Object.keys(headers).length > 0 ? { headers } : {}
-  };
-}
-function buildRemoteMcpEntry(definitionId, dbSpec) {
-  const spec = dbSpec ?? INTEGRATION_REGISTRY.find((d) => d.id === definitionId)?.remoteMcp;
-  if (spec) {
-    return renderRemoteMcpSpec(definitionId, spec);
-  }
-  const provider = OAUTH_PROVIDERS[definitionId];
-  if (!provider?.mcpUrl)
-    return null;
-  return {
-    type: "http",
-    url: provider.mcpUrl,
-    headers: {
-      Authorization: `Bearer \${${envVarForToken(definitionId)}}`
-    }
-  };
-}
-function buildHostBrokeredRemoteMcpEntry(url) {
-  return { type: "http", url };
-}
-function extractHeaderVarName(value) {
-  const m = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(value.trim());
-  return m ? m[1] : null;
-}
-function buildLiveHeaderRemoteMcpProxyEntry(definitionId, dbSpec, paths) {
-  const spec = dbSpec ?? INTEGRATION_REGISTRY.find((d) => d.id === definitionId)?.remoteMcp;
-  if (!spec?.liveHeaderRefresh)
-    return null;
-  assertSafeRemoteMcpUrl(spec.url, definitionId);
-  if (!spec.auth || spec.auth.scheme !== "header" || !spec.auth.header_name) {
-    throw new Error(`remoteMcp.liveHeaderRefresh for '${definitionId}' requires a header-scheme 'auth' with a header_name`);
-  }
-  const extraPairs = [];
-  for (const [header, value] of Object.entries(spec.headers ?? {})) {
-    const varName = extractHeaderVarName(value);
-    if (varName)
-      extraPairs.push(`${header}:${varName}`);
-  }
-  return {
-    command: "node",
-    args: [paths.proxyPath],
-    env: {
-      AGT_REMOTE_MCP_URL: spec.url,
-      AGT_REMOTE_MCP_TOKEN_FILE: paths.tokenFile,
-      AGT_REMOTE_MCP_TOKEN_VAR: credentialEnvVar(definitionId, spec.auth.credential_ref),
-      AGT_REMOTE_MCP_AUTH_HEADER: spec.auth.header_name,
-      AGT_REMOTE_MCP_LABEL: definitionId,
-      ...extraPairs.length > 0 ? { AGT_REMOTE_MCP_EXTRA_HEADERS: extraPairs.join(",") } : {}
-    }
-  };
-}
-function buildOAuthRemoteMcpProxyEntry(definitionId, paths) {
-  const def = INTEGRATION_REGISTRY.find((d) => d.id === definitionId);
-  if (def?.remoteMcp)
-    return null;
-  const provider = OAUTH_PROVIDERS[definitionId];
-  if (!provider?.mcpUrl)
-    return null;
-  return {
-    command: "node",
-    args: [paths.proxyPath],
-    env: {
-      AGT_REMOTE_MCP_URL: provider.mcpUrl,
-      AGT_REMOTE_MCP_TOKEN_FILE: paths.tokenFile,
-      AGT_REMOTE_MCP_TOKEN_VAR: envVarForToken(definitionId),
-      AGT_REMOTE_MCP_LABEL: definitionId,
-      // ENG-6948: cap the agent's exposed surface to the curated allowlist. The
-      // proxy filters tools/list and gates tools/call against this set. Omitted
-      // when the provider has no allowlist, leaving the proxy a pass-through.
-      ...provider.toolAllowlist && provider.toolAllowlist.length > 0 ? { AGT_REMOTE_MCP_TOOL_ALLOWLIST: provider.toolAllowlist.join(",") } : {},
-      // CS-1446: toolsets to pre-activate at session start so gated tools are
-      // advertised in the connect-time tools/list the harness freezes. Omitted
-      // when the provider configures none (no pre-enable, the default).
-      ...provider.preEnableToolsets && provider.preEnableToolsets.length > 0 ? { AGT_REMOTE_MCP_PREENABLE_TOOLSETS: provider.preEnableToolsets.join(",") } : {}
-    }
-  };
-}
-
-// ../../packages/core/dist/provisioning/native-mcp.js
-function buildNativeMcpEntry(spec, ctx) {
-  const resolvedCommand = resolveTemplate(spec.command, ctx);
-  if (resolvedCommand.omit) {
-    throw new Error("NativeMcpSpec: empty_if_no_env is only valid in env values (not in `command`)");
-  }
-  const command = resolvedCommand.value;
-  const args = spec.args.map((a, i) => {
-    const resolved = resolveTemplate(a, ctx);
-    if (resolved.omit) {
-      throw new Error(`NativeMcpSpec: empty_if_no_env is only valid in env values (not in args[${i}])`);
-    }
-    return resolved.value;
-  });
-  if (spec.env === void 0) {
-    return { command, args };
-  }
-  const env = {};
-  for (const [k, raw] of Object.entries(spec.env)) {
-    const { value, omit } = resolveTemplate(raw, ctx);
-    if (omit)
-      continue;
-    env[k] = value;
-  }
-  return { command, args, env };
-}
-function resolveTemplate(input, ctx) {
-  const TOKEN = /\{\{([^}]+)\}\}/g;
-  const hasEmptyIfNoEnv = /\{\{\s*empty_if_no_env\./.test(input);
-  const isWholeValueEmptyIfNoEnv = /^\{\{\s*empty_if_no_env\.[^}]+\}\}$/.test(input);
-  if (hasEmptyIfNoEnv && !isWholeValueEmptyIfNoEnv) {
-    throw new Error(`NativeMcpSpec: empty_if_no_env must be the sole content of the value, never mixed with literal text or other tokens (value: ${JSON.stringify(input)})`);
-  }
-  let omit = false;
-  const value = input.replace(TOKEN, (whole, expr) => {
-    const trimmed = expr.trim();
-    if (trimmed === "agent_id")
-      return ctx.agentId;
-    if (trimmed === "agent_code_name")
-      return ctx.agentCodeName;
-    if (trimmed === "integration_id")
-      return ctx.integration?.id ?? "";
-    if (trimmed.startsWith("process_env.")) {
-      const name = trimmed.slice("process_env.".length);
-      return process.env[name] ?? "";
-    }
-    if (trimmed.startsWith("empty_if_no_env.")) {
-      const name = trimmed.slice("empty_if_no_env.".length);
-      const v = process.env[name] ?? "";
-      if (v.length === 0) {
-        omit = true;
-        return "";
-      }
-      return v;
-    }
-    return whole;
-  });
-  return { value, omit };
-}
-
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
 var VALID_CODE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var SECRET_FILE_MODE = 384;
@@ -6348,7 +6166,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.370" : "dev";
+var agtCliVersion = true ? "0.28.371" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8794,4 +8612,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-TDZFQHXC.js.map
+//# sourceMappingURL=chunk-D6BJJ334.js.map