@integrity-labs/agt-cli 0.28.515 → 0.28.517

package/dist/mcp/direct-chat-channel.js

@@ -35665,6 +35665,10 @@ function deriveBindFailureQuarantineThreshold(provisioningMax) {
 }
 var MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING = BIND_FAILURE_QUARANTINE_THRESHOLD + 1;
 
+// ../core/dist/restart/forced-update-deadline.js
+var FORCED_UPDATE_RELAX_AFTER_MS = 7 * 6e4;
+var FORCED_UPDATE_HARD_DEADLINE_MS = 15 * 6e4;
+
 // src/rate-limit-watch.ts
 import { closeSync, fstatSync, openSync, readSync, readdirSync as readdirSync4, statSync } from "fs";
 import { homedir as homedir2 } from "os";

package/dist/mcp/origami.js

@@ -41567,6 +41567,10 @@ function deriveBindFailureQuarantineThreshold(provisioningMax) {
 }
 var MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING = BIND_FAILURE_QUARANTINE_THRESHOLD + 1;
 
+// ../core/dist/restart/forced-update-deadline.js
+var FORCED_UPDATE_RELAX_AFTER_MS = 7 * 6e4;
+var FORCED_UPDATE_HARD_DEADLINE_MS = 15 * 6e4;
+
 // src/identity.ts
 var IdentityError = class extends Error {
   status;

package/dist/mcp/slack-channel.js

@@ -35834,6 +35834,10 @@ function deriveBindFailureQuarantineThreshold(provisioningMax) {
 }
 var MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING = BIND_FAILURE_QUARANTINE_THRESHOLD + 1;
 
+// ../core/dist/restart/forced-update-deadline.js
+var FORCED_UPDATE_RELAX_AFTER_MS = 7 * 6e4;
+var FORCED_UPDATE_HARD_DEADLINE_MS = 15 * 6e4;
+
 // src/account-enforcement-notice.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";

package/dist/mcp/telegram-channel.js

@@ -36160,6 +36160,10 @@ function deriveBindFailureQuarantineThreshold(provisioningMax) {
 }
 var MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING = BIND_FAILURE_QUARANTINE_THRESHOLD + 1;
 
+// ../core/dist/restart/forced-update-deadline.js
+var FORCED_UPDATE_RELAX_AFTER_MS = 7 * 6e4;
+var FORCED_UPDATE_HARD_DEADLINE_MS = 15 * 6e4;
+
 // src/account-enforcement-notice.ts
 import { readFileSync as readFileSync4 } from "fs";
 import { homedir as homedir3 } from "os";

package/dist/mcp/xero.js

@@ -114299,12 +114299,39 @@ var {
 var import_dotenv = __toESM(require_main(), 1);
 var import_xero_node = __toESM(require_dist2(), 1);
 
+// src/helpers/redact-sensitive.ts
+var SENSITIVE_HEADER_NAMES = [
+  "authorization",
+  "proxy-authorization",
+  "www-authenticate",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-access-token",
+  "refresh_token",
+  "access_token",
+  "client_secret"
+];
+var REDACTED = "<redacted>";
+var NAME_ALTERNATION = SENSITIVE_HEADER_NAMES.join("|");
+var JSON_PAIR_RE = new RegExp(
+  `("(?:${NAME_ALTERNATION})"\\s*:\\s*)("(?:[^"\\\\]|\\\\.)*"|\\[[^\\]]*\\])`,
+  "gi"
+);
+var HEADER_LINE_RE = new RegExp(`\\b(${NAME_ALTERNATION})\\s*:\\s*([^\\r\\n,}"]+)`, "gi");
+var BEARER_VALUE_RE = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+function redactSensitiveText(input) {
+  return input.replace(JSON_PAIR_RE, (_m, key) => `${key}"${REDACTED}"`).replace(HEADER_LINE_RE, (_m, name) => `${name}: ${REDACTED}`).replace(BEARER_VALUE_RE, (_m, scheme) => `${scheme} ${REDACTED}`);
+}
+
 // src/helpers/ensure-error.ts
 function ensureError(value) {
   if (value instanceof Error) return value;
   let stringified = "[Unable to stringify the thrown value]";
   try {
-    stringified = JSON.stringify(value);
+    stringified = redactSensitiveText(JSON.stringify(value) ?? String(value));
   } catch {
   }
   const error2 = new Error(`Error thrown: ${stringified}`);
@@ -114692,9 +114719,12 @@ var XeroScopeMissingError = class extends Error {
   }
 };
 function classifyXeroError(error2) {
-  if (!(error2 instanceof AxiosError2)) return null;
-  if (error2.response?.status !== 401) return null;
-  const detail = readXeroDetail(error2.response.data);
+  const rejection = parseXeroApiRejection(error2);
+  const status = rejection ? rejection.statusCode : axiosStatus(error2);
+  if (status !== 401) return null;
+  const detail = readXeroDetail(
+    rejection ? rejection.body : error2.response?.data
+  );
   if (detail !== "AuthorizationUnsuccessful") return null;
   return new XeroScopeMissingError(
     `Xero rejected this call as scope-missing \u2014 the OAuth consent did not grant the scope this endpoint requires. Token refresh will not help: refresh tokens cannot widen scope. Ask the user to click "Reconnect" on the Xero card in the Augmented console so the consent screen requests the scopes the agent's installed skills need.`,
@@ -114702,6 +114732,25 @@ function classifyXeroError(error2) {
     detail
   );
 }
+function axiosStatus(error2) {
+  return error2 instanceof AxiosError2 ? error2.response?.status : void 0;
+}
+function parseXeroApiRejection(error2) {
+  if (typeof error2 !== "string") return null;
+  if (!error2.startsWith("{")) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(error2);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const response = parsed.response;
+  if (!response || typeof response !== "object") return null;
+  const statusCode = response.statusCode;
+  if (typeof statusCode !== "number") return null;
+  return { statusCode, body: response.body };
+}
 function readXeroDetail(data) {
   if (data && typeof data === "object" && "Detail" in data) {
     const d = data.Detail;
@@ -114717,23 +114766,36 @@ function readXeroDetail(data) {
 function formatError2(error2) {
   const scopeMissing = classifyXeroError(error2);
   if (scopeMissing) return scopeMissing.message;
+  const rejection = parseXeroApiRejection(error2);
+  if (rejection) {
+    return messageForStatus(rejection.statusCode, readDetail(rejection.body));
+  }
   if (error2 instanceof AxiosError2) {
-    const status = error2.response?.status;
-    const detail = error2.response?.data?.Detail;
-    switch (status) {
-      case 401:
-        return "Authentication failed. Please check your Xero credentials.";
-      case 403:
-        return "You don't have permission to access this resource in Xero.";
-      case 404:
-        return "The requested resource was not found in Xero.";
-      case 429:
-        return "Too many requests to Xero. Please try again in a moment.";
-      default:
-        return detail || "An error occurred while communicating with Xero.";
-    }
+    return messageForStatus(error2.response?.status, readDetail(error2.response?.data));
   }
-  return error2 instanceof Error ? error2.message : `An unexpected error occurred: ${error2}`;
+  if (error2 instanceof Error) return redactSensitiveText(error2.message);
+  return "An unexpected error occurred while communicating with Xero.";
+}
+function messageForStatus(status, detail) {
+  switch (status) {
+    case 401:
+      return "Authentication failed. Please check your Xero credentials.";
+    case 403:
+      return "You don't have permission to access this resource in Xero.";
+    case 404:
+      return "The requested resource was not found in Xero.";
+    case 429:
+      return "Too many requests to Xero. Please try again in a moment.";
+    default:
+      return detail ? redactSensitiveText(detail) : "An error occurred while communicating with Xero.";
+  }
+}
+function readDetail(body) {
+  if (body && typeof body === "object" && "Detail" in body) {
+    const d = body.Detail;
+    return typeof d === "string" ? d : null;
+  }
+  return null;
 }
 
 // src/helpers/get-package-version.ts

package/dist/{persistent-session-RM5ZY2SB.js → persistent-session-3SY36KIU.js}

@@ -37,7 +37,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-S5RR4UHQ.js";
+} from "./chunk-UQ3TQ7M4.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -79,4 +79,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-RM5ZY2SB.js.map
+//# sourceMappingURL=persistent-session-3SY36KIU.js.map

package/dist/{responsiveness-probe-C4KMTKWR.js → responsiveness-probe-DSWGHXGG.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-S5RR4UHQ.js";
+} from "./chunk-UQ3TQ7M4.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -662,4 +662,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-C4KMTKWR.js.map
+//# sourceMappingURL=responsiveness-probe-DSWGHXGG.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.515",
+  "version": "0.28.517",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {