@integrity-labs/agt-cli 0.28.440 → 0.28.442

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-V3G7G4QM.js";
+} from "../chunk-JIZ6Z6EX.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-R6GVWACQ.js";
+} from "../chunk-XMJ5VMWV.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.440" : "dev";
+var cliVersion = true ? "0.28.442" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.440" : "dev";
+var cliVersion2 = true ? "0.28.442" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-V3G7G4QM.js → chunk-JIZ6Z6EX.js}

@@ -29,7 +29,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-R6GVWACQ.js";
+} from "./chunk-XMJ5VMWV.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -4901,7 +4901,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.440" : "dev";
+var agtCliVersion = true ? "0.28.442" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7402,4 +7402,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-V3G7G4QM.js.map
+//# sourceMappingURL=chunk-JIZ6Z6EX.js.map

package/dist/{chunk-R6GVWACQ.js → chunk-XMJ5VMWV.js}

@@ -4,9 +4,9 @@ import {
 
 // src/lib/persistent-session.ts
 import { spawn as spawn2, execSync as execSync2, execFileSync as execFileSync3 } from "child_process";
-import { join as join6, dirname as dirname3 } from "path";
-import { homedir as homedir6, platform, userInfo as userInfo2 } from "os";
-import { existsSync as existsSync6, readFileSync as readFileSync8, readdirSync as readdirSync3, writeFileSync as writeFileSync6, appendFileSync as appendFileSync2, mkdirSync as mkdirSync6, chmodSync as chmodSync3, copyFileSync, rmSync as rmSync4 } from "fs";
+import { join as join5, dirname as dirname3 } from "path";
+import { homedir as homedir5, platform, userInfo as userInfo2 } from "os";
+import { existsSync as existsSync6, readFileSync as readFileSync7, readdirSync as readdirSync3, writeFileSync as writeFileSync5, appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, chmodSync as chmodSync3, copyFileSync, rmSync as rmSync3 } from "fs";
 
 // src/lib/mcp-sanitize.ts
 import { readFileSync, writeFileSync } from "fs";
@@ -1325,8 +1325,31 @@ var DEFAULT_SCOPES = [
   // links an inbound Slack sender to their organization_people record (inbound
   // identity reconcile). Existing installs without it degrade gracefully - the
   // reconcile no-ops until the bot is re-authorised with the wider scope set.
-  "users:read.email",
-  "users.profile:write"
+  "users:read.email"
+  // ENG-8203: 'users.profile:write' is deliberately NOT here.
+  //
+  // It is registered with `token_type: 'user'` (ENG-4812 — Slack rejects it
+  // under oauth_config.scopes.bot with `illegal_bot_scopes`). The MANIFEST
+  // generator partitions on that flag; the OAuth install-URL builder does not —
+  // `buildSlackAuthorizeUrl` puts every stored scope into `scope=` — so a
+  // default-scoped OAuth install sent a user-only scope as a bot scope and
+  // Slack rejected the whole authorization with "Invalid permissions
+  // requested". That blocked EVERY new install on the default set.
+  //
+  // Removing it rather than routing it to `user_scope=` is deliberate: the
+  // callback destructures `authed_user?: { id?: string }` and persists only the
+  // BOT token (oauth-callback/route.ts:217,246). `authed_user.access_token` is
+  // never read, so asking for the scope would put an extra consent screen in
+  // front of the installing admin and then discard the token it returned.
+  //
+  // Nothing is lost. `users.profile.set` needs an `xoxp-` user token, which no
+  // OAuth-installed agent has ever had — the bot-status/live-presence indicator
+  // only ever worked where an operator pasted a user token into the wizard by
+  // hand, and that path is untouched. The registry definition stays so existing
+  // configs still render and the `token_type: 'user'` knowledge is preserved.
+  //
+  // Wiring the indicator for OAuth installs means persisting
+  // `authed_user.access_token` first, THEN adding `user_scope=`. Separate work.
 ];
 function getDefaultSlackScopes() {
   return [...DEFAULT_SCOPES];
@@ -11859,8 +11882,8 @@ function stopTranscriptRefresher(codeName) {
     transcriptTimers.delete(codeName);
   }
 }
-function readProvisionedOpencodeModel(agentDir3) {
-  return readOpencodeModelString(join3(agentDir3, "provision", "opencode.json"));
+function readProvisionedOpencodeModel(agentDir2) {
+  return readOpencodeModelString(join3(agentDir2, "provision", "opencode.json"));
 }
 function readOpencodeModelString(configPath2) {
   try {
@@ -12798,58 +12821,13 @@ function creditWatchdogGiveUpCount(codeName, count) {
   giveUpCounts.set(codeName, (giveUpCounts.get(codeName) ?? 0) + count);
 }
 
-// src/lib/usage-limit-marker-file.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
-function agentDir2(codeName) {
-  return join5(homedir5(), ".augmented", codeName);
-}
-function usageLimitMarkerPath(codeName) {
-  return join5(agentDir2(codeName), USAGE_LIMIT_MARKER_FILENAME);
-}
-function writeUsageLimitMarker(codeName, limitedUntil, log2) {
-  try {
-    mkdirSync5(agentDir2(codeName), { recursive: true });
-    writeFileSync5(usageLimitMarkerPath(codeName), serializeUsageLimitMarker(limitedUntil), "utf-8");
-  } catch (err) {
-    log2(`[usage-banner] usage-limit marker sync failed for '${codeName}': ${err.message}`);
-  }
-}
-function clearUsageLimitMarker(codeName, log2) {
-  try {
-    rmSync3(usageLimitMarkerPath(codeName), { force: true });
-  } catch (err) {
-    log2(`[usage-banner] usage-limit marker clear failed for '${codeName}': ${err.message}`);
-  }
-}
-function readUsageLimitUntil(opts) {
-  const path = opts.filePath ?? (opts.codeName ? usageLimitMarkerPath(opts.codeName) : null);
-  if (!path) return null;
-  let raw;
-  try {
-    raw = readFileSync7(path, "utf-8");
-  } catch {
-    return null;
-  }
-  return resolveUsageLimitUntil(parseUsageLimitMarker(raw), opts.now ?? /* @__PURE__ */ new Date());
-}
-var loggedUsageCapDeferral = /* @__PURE__ */ new Map();
-function shouldLogUsageCapDeferral(site, codeName, limitedUntil) {
-  const key = `${site}:${codeName}`;
-  const at = limitedUntil.getTime();
-  if (loggedUsageCapDeferral.get(key) === at) return false;
-  loggedUsageCapDeferral.set(key, at);
-  return true;
-}
-
 // src/lib/persistent-session.ts
 var OPENROUTER_ANTHROPIC_BASE_URL = "https://openrouter.ai/api";
 function syncClaudeCredsToRoot() {
   if (platform() !== "linux") return true;
   if (typeof process.getuid !== "function" || process.getuid() !== 0) return true;
   for (const filename of [".credentials.json", "credentials.json"]) {
-    if (existsSync6(join6("/root/.claude", filename))) return true;
+    if (existsSync6(join5("/root/.claude", filename))) return true;
   }
   let sourcePath = null;
   try {
@@ -12857,7 +12835,7 @@ function syncClaudeCredsToRoot() {
     outer: for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       for (const filename of [".credentials.json", "credentials.json"]) {
-        const candidate = join6("/home", entry.name, ".claude", filename);
+        const candidate = join5("/home", entry.name, ".claude", filename);
         if (existsSync6(candidate)) {
           sourcePath = candidate;
           break outer;
@@ -12869,9 +12847,9 @@ function syncClaudeCredsToRoot() {
   if (!sourcePath) return false;
   const targetDir = "/root/.claude";
   const sourceFilename = sourcePath.endsWith("credentials.json") && !sourcePath.endsWith(".credentials.json") ? "credentials.json" : ".credentials.json";
-  const targetPath = join6(targetDir, sourceFilename);
+  const targetPath = join5(targetDir, sourceFilename);
   try {
-    if (!existsSync6(targetDir)) mkdirSync6(targetDir, { recursive: true, mode: 448 });
+    if (!existsSync6(targetDir)) mkdirSync5(targetDir, { recursive: true, mode: 448 });
     copyFileSync(sourcePath, targetPath);
     chmodSync3(targetPath, 384);
     return true;
@@ -12948,13 +12926,13 @@ function buildEgressAllowlist(toolsFrontmatter) {
   return [...domains].sort();
 }
 function egressAllowlistHostPath(codeName, homeDir) {
-  const home = homeDir ?? (process.env.HOME?.trim() || homedir6());
-  return join6(home, ".augmented", "_egress", `${codeName}.txt`);
+  const home = homeDir ?? (process.env.HOME?.trim() || homedir5());
+  return join5(home, ".augmented", "_egress", `${codeName}.txt`);
 }
 function writeEgressAllowlist(codeName, domains, homeDir) {
   const p2 = egressAllowlistHostPath(codeName, homeDir);
-  mkdirSync6(dirname3(p2), { recursive: true });
-  writeFileSync6(p2, domains.join("\n") + "\n", { mode: 420 });
+  mkdirSync5(dirname3(p2), { recursive: true });
+  writeFileSync5(p2, domains.join("\n") + "\n", { mode: 420 });
   return p2;
 }
 var EGRESS_DOCKER_TIMEOUT_MS = 1e4;
@@ -12990,13 +12968,13 @@ function restartEgressSidecar(codeName) {
 function buildDockerRunCommand(args) {
   const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, egress, forwardSlackReplyBinding, forwardBlockTurnEndAllMarkers, forwardKanbanWaiting, forwardNotifyDispatch } = args;
   const q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
-  const agentDir3 = join6(homeDir, ".augmented", codeName);
-  const agentIdDir = join6(homeDir, ".augmented", agentId);
-  const mcpDir = join6(homeDir, ".augmented", "_mcp");
-  const claudeHome = join6(homeDir, ".claude");
-  const claudeJson = join6(homeDir, ".claude.json");
+  const agentDir2 = join5(homeDir, ".augmented", codeName);
+  const agentIdDir = join5(homeDir, ".augmented", agentId);
+  const mcpDir = join5(homeDir, ".augmented", "_mcp");
+  const claudeHome = join5(homeDir, ".claude");
+  const claudeJson = join5(homeDir, ".claude.json");
   const mounts = [
-    `-v ${q(`${agentDir3}:${agentDir3}`)}`,
+    `-v ${q(`${agentDir2}:${agentDir2}`)}`,
     `-v ${q(`${agentIdDir}:${agentIdDir}`)}`,
     `-v ${q(`${mcpDir}:${mcpDir}:ro`)}`,
     `-v ${q(`${claudeHome}:${claudeHome}`)}`,
@@ -13007,7 +12985,7 @@ function buildDockerRunCommand(args) {
   const cpus = process.env.AGT_ISOLATION_CPUS || "1.0";
   const pids = process.env.AGT_ISOLATION_PIDS || "512";
   const envArgs = [`-e ${q(`HOME=${homeDir}`)}`];
-  envArgs.push(`-e ${q(`npm_config_cache=${join6(agentDir3, ".npm-cache")}`)}`);
+  envArgs.push(`-e ${q(`npm_config_cache=${join5(agentDir2, ".npm-cache")}`)}`);
   if (passApiKey) envArgs.push("-e ANTHROPIC_API_KEY");
   if (passOpenRouter) {
     envArgs.push("-e ANTHROPIC_BASE_URL");
@@ -13074,8 +13052,8 @@ function buildDockerRunCommand(args) {
 }
 function writePersistentClaudeWrapper(args) {
   const { projectDir, claudeBin, initPrompt, claudeArgsJoined } = args;
-  const envIntegrationsPath = join6(projectDir, ".env.integrations");
-  const wrapperPath = join6(projectDir, ".claude", "persistent-claude.sh");
+  const envIntegrationsPath = join5(projectDir, ".env.integrations");
+  const wrapperPath = join5(projectDir, ".claude", "persistent-claude.sh");
   const wrapperLines = [
     "#!/usr/bin/env bash",
     "set -e",
@@ -13094,15 +13072,15 @@ function writePersistentClaudeWrapper(args) {
   wrapperLines.push(
     `exec ${JSON.stringify(claudeBin)} ${initPromptArg}${claudeArgsJoined}`
   );
-  mkdirSync6(join6(projectDir, ".claude"), { recursive: true });
-  writeFileSync6(wrapperPath, wrapperLines.join("\n") + "\n", { mode: 448 });
+  mkdirSync5(join5(projectDir, ".claude"), { recursive: true });
+  writeFileSync5(wrapperPath, wrapperLines.join("\n") + "\n", { mode: 448 });
   chmodSync3(wrapperPath, 448);
   return wrapperPath;
 }
 function collectMcpServerNames(mcpConfigPath) {
   if (!existsSync6(mcpConfigPath)) return [];
   try {
-    const data = JSON.parse(readFileSync8(mcpConfigPath, "utf-8"));
+    const data = JSON.parse(readFileSync7(mcpConfigPath, "utf-8"));
     const servers = data.mcpServers;
     return servers ? Object.keys(servers) : [];
   } catch {
@@ -13110,15 +13088,15 @@ function collectMcpServerNames(mcpConfigPath) {
   }
 }
 var sessions2 = /* @__PURE__ */ new Map();
-var PANE_LOG_DIR = join6(homedir6(), ".augmented");
+var PANE_LOG_DIR = join5(homedir5(), ".augmented");
 var PANE_TAIL_LINES = 20;
 function paneLogPath(codeName) {
-  return join6(PANE_LOG_DIR, codeName, "pane.log");
+  return join5(PANE_LOG_DIR, codeName, "pane.log");
 }
 function setupPaneLog2(tmuxSession, codeName, log2) {
   const logPath = paneLogPath(codeName);
   try {
-    mkdirSync6(dirname3(logPath), { recursive: true });
+    mkdirSync5(dirname3(logPath), { recursive: true });
     appendFileSync2(
       logPath,
       `
@@ -13138,7 +13116,7 @@ function readPaneLogTail(codeName, lines = PANE_TAIL_LINES) {
   const logPath = paneLogPath(codeName);
   if (!existsSync6(logPath)) return null;
   try {
-    const raw = readFileSync8(logPath, "utf-8");
+    const raw = readFileSync7(logPath, "utf-8");
     if (!raw) return null;
     const stripped = raw.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "");
     const all = stripped.split("\n").filter((l) => l.length > 0);
@@ -13209,11 +13187,11 @@ function resolveSessionSpawnDecision(args) {
   };
 }
 function directChatSessionStatePath(agentId) {
-  return join6(homedir6(), ".augmented", agentId, "direct-chat-session.json");
+  return join5(homedir5(), ".augmented", agentId, "direct-chat-session.json");
 }
 function readDirectChatSessionState(agentId) {
   try {
-    const parsed = JSON.parse(readFileSync8(directChatSessionStatePath(agentId), "utf-8"));
+    const parsed = JSON.parse(readFileSync7(directChatSessionStatePath(agentId), "utf-8"));
     if (!parsed || typeof parsed !== "object") return null;
     const state = parsed;
     state.mcpServerKeys = Array.isArray(state.mcpServerKeys) ? state.mcpServerKeys.filter((k) => typeof k === "string") : void 0;
@@ -13224,8 +13202,8 @@ function readDirectChatSessionState(agentId) {
 }
 function writeDirectChatSessionState(agentId, state) {
   const p2 = directChatSessionStatePath(agentId);
-  mkdirSync6(dirname3(p2), { recursive: true });
-  writeFileSync6(p2, JSON.stringify(state));
+  mkdirSync5(dirname3(p2), { recursive: true });
+  writeFileSync5(p2, JSON.stringify(state));
 }
 function startPersistentSession(config) {
   const existing = sessions2.get(config.codeName);
@@ -13281,12 +13259,12 @@ function spawnSession(config, session) {
         log2(`[persistent-session] No Claude Code credentials found under /root/.claude or /home/*. Pair via browser from the host page, or run 'claude /login' on the host.`);
       }
     } else {
-      const claudeDir = join6(homedir6(), ".claude");
+      const claudeDir = join5(homedir5(), ".claude");
       for (const filename of [".credentials.json", "credentials.json"]) {
-        const p2 = join6(claudeDir, filename);
+        const p2 = join5(claudeDir, filename);
         if (existsSync6(p2)) {
           try {
-            rmSync4(p2, { force: true });
+            rmSync3(p2, { force: true });
             log2(`[persistent-session] Removed ${p2} (api_key mode active \u2014 preventing OAuth fallback)`);
           } catch {
           }
@@ -13378,7 +13356,7 @@ function spawnSession(config, session) {
     if (config.notifyDispatchMode && config.notifyDispatchMode !== "off" && !process.env["AGT_NOTIFY_DISPATCH"]) {
       tmuxSessionEnvArgs.push("-e", `AGT_NOTIFY_DISPATCH=${config.notifyDispatchMode}`);
     }
-    const sessionHomeDir = process.env.HOME?.trim() || homedir6();
+    const sessionHomeDir = process.env.HOME?.trim() || homedir5();
     let egress;
     if (egressMode(codeName) === "allowlist") {
       const allowlist = config.egressAllowlist ?? buildEgressAllowlist(null);
@@ -13417,7 +13395,7 @@ function spawnSession(config, session) {
       // Treat empty-string as missing too — `HOME=""` makes ~ resolve
       // to cwd, which is the same broken outcome as no HOME, just
       // better hidden.
-      HOME: process.env.HOME?.trim() || homedir6(),
+      HOME: process.env.HOME?.trim() || homedir5(),
       USER: process.env.USER?.trim() || userInfo2().username
     };
     if (config.runId) {
@@ -13441,7 +13419,7 @@ function spawnSession(config, session) {
     } : { ...tmuxEnv, ...apiKeyEnv, ...openRouterEnv };
     for (const f of probeMcpEnvSubstitution({
       mcpConfigPath,
-      envIntegrationsPath: join6(projectDir, ".env.integrations"),
+      envIntegrationsPath: join5(projectDir, ".env.integrations"),
       baseEnv: probeBaseEnv
     })) {
       log2(`[persistent-session] ${formatMissingVar(f)} agent=${codeName}`);
@@ -13470,7 +13448,6 @@ function spawnSession(config, session) {
       }
       log2(`[persistent-session] tmux session '${tmuxSession}' created for '${codeName}'`);
       setupPaneLog2(tmuxSession, codeName, log2);
-      clearUsageLimitMarker(codeName, log2);
       session.currentSessionId = sessionId;
       acceptDialogs(tmuxSession, codeName, log2, config.primaryModel ?? null, sessionId).catch(() => {
       });
@@ -14000,7 +13977,7 @@ async function stopAllSessionsAndWait(log2, opts) {
   await new Promise((resolve) => setTimeout(resolve, Math.min(opts.timeoutMs, 2e3)));
 }
 function getProjectDir(codeName) {
-  return join6(homedir6(), ".augmented", codeName, "project");
+  return join5(homedir5(), ".augmented", codeName, "project");
 }
 
 export {
@@ -14087,6 +14064,10 @@ export {
   sumTranscriptUsageInWindow,
   isEmptyTotals,
   attributeTranscriptUsageByRun,
+  USAGE_LIMIT_MARKER_FILENAME,
+  serializeUsageLimitMarker,
+  parseUsageLimitMarker,
+  resolveUsageLimitUntil,
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   serializeAccountEnforcementMarker,
   KANBAN_CHECK_COMMAND,
@@ -14129,10 +14110,6 @@ export {
   checkChannelInputs,
   takeWatchdogGiveUpCount,
   creditWatchdogGiveUpCount,
-  writeUsageLimitMarker,
-  clearUsageLimitMarker,
-  readUsageLimitUntil,
-  shouldLogUsageCapDeferral,
   resolveOAuthCredAction,
   resolveClaudeBinary,
   isolationMode,
@@ -14171,4 +14148,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-R6GVWACQ.js.map
+//# sourceMappingURL=chunk-XMJ5VMWV.js.map