@integrity-labs/agt-cli 0.28.516 → 0.28.517

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-IBI6VSGP.js";
+} from "../chunk-P2WZKAPY.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4834,7 +4834,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.516" : "dev";
+var cliVersion = true ? "0.28.517" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6006,7 +6006,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.516" : "dev";
+var cliVersion2 = true ? "0.28.517" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-IBI6VSGP.js → chunk-P2WZKAPY.js}

@@ -5317,7 +5317,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.516" : "dev";
+var agtCliVersion = true ? "0.28.517" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8629,4 +8629,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-IBI6VSGP.js.map
+//# sourceMappingURL=chunk-P2WZKAPY.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-IBI6VSGP.js";
+} from "../chunk-P2WZKAPY.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -10106,7 +10106,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.516" : "dev";
+var agtCliVersion = true ? "0.28.517" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/xero.js

@@ -114299,12 +114299,39 @@ var {
 var import_dotenv = __toESM(require_main(), 1);
 var import_xero_node = __toESM(require_dist2(), 1);
 
+// src/helpers/redact-sensitive.ts
+var SENSITIVE_HEADER_NAMES = [
+  "authorization",
+  "proxy-authorization",
+  "www-authenticate",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-access-token",
+  "refresh_token",
+  "access_token",
+  "client_secret"
+];
+var REDACTED = "<redacted>";
+var NAME_ALTERNATION = SENSITIVE_HEADER_NAMES.join("|");
+var JSON_PAIR_RE = new RegExp(
+  `("(?:${NAME_ALTERNATION})"\\s*:\\s*)("(?:[^"\\\\]|\\\\.)*"|\\[[^\\]]*\\])`,
+  "gi"
+);
+var HEADER_LINE_RE = new RegExp(`\\b(${NAME_ALTERNATION})\\s*:\\s*([^\\r\\n,}"]+)`, "gi");
+var BEARER_VALUE_RE = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+function redactSensitiveText(input) {
+  return input.replace(JSON_PAIR_RE, (_m, key) => `${key}"${REDACTED}"`).replace(HEADER_LINE_RE, (_m, name) => `${name}: ${REDACTED}`).replace(BEARER_VALUE_RE, (_m, scheme) => `${scheme} ${REDACTED}`);
+}
+
 // src/helpers/ensure-error.ts
 function ensureError(value) {
   if (value instanceof Error) return value;
   let stringified = "[Unable to stringify the thrown value]";
   try {
-    stringified = JSON.stringify(value);
+    stringified = redactSensitiveText(JSON.stringify(value) ?? String(value));
   } catch {
   }
   const error2 = new Error(`Error thrown: ${stringified}`);
@@ -114692,9 +114719,12 @@ var XeroScopeMissingError = class extends Error {
   }
 };
 function classifyXeroError(error2) {
-  if (!(error2 instanceof AxiosError2)) return null;
-  if (error2.response?.status !== 401) return null;
-  const detail = readXeroDetail(error2.response.data);
+  const rejection = parseXeroApiRejection(error2);
+  const status = rejection ? rejection.statusCode : axiosStatus(error2);
+  if (status !== 401) return null;
+  const detail = readXeroDetail(
+    rejection ? rejection.body : error2.response?.data
+  );
   if (detail !== "AuthorizationUnsuccessful") return null;
   return new XeroScopeMissingError(
     `Xero rejected this call as scope-missing \u2014 the OAuth consent did not grant the scope this endpoint requires. Token refresh will not help: refresh tokens cannot widen scope. Ask the user to click "Reconnect" on the Xero card in the Augmented console so the consent screen requests the scopes the agent's installed skills need.`,
@@ -114702,6 +114732,25 @@ function classifyXeroError(error2) {
     detail
   );
 }
+function axiosStatus(error2) {
+  return error2 instanceof AxiosError2 ? error2.response?.status : void 0;
+}
+function parseXeroApiRejection(error2) {
+  if (typeof error2 !== "string") return null;
+  if (!error2.startsWith("{")) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(error2);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const response = parsed.response;
+  if (!response || typeof response !== "object") return null;
+  const statusCode = response.statusCode;
+  if (typeof statusCode !== "number") return null;
+  return { statusCode, body: response.body };
+}
 function readXeroDetail(data) {
   if (data && typeof data === "object" && "Detail" in data) {
     const d = data.Detail;
@@ -114717,23 +114766,36 @@ function readXeroDetail(data) {
 function formatError2(error2) {
   const scopeMissing = classifyXeroError(error2);
   if (scopeMissing) return scopeMissing.message;
+  const rejection = parseXeroApiRejection(error2);
+  if (rejection) {
+    return messageForStatus(rejection.statusCode, readDetail(rejection.body));
+  }
   if (error2 instanceof AxiosError2) {
-    const status = error2.response?.status;
-    const detail = error2.response?.data?.Detail;
-    switch (status) {
-      case 401:
-        return "Authentication failed. Please check your Xero credentials.";
-      case 403:
-        return "You don't have permission to access this resource in Xero.";
-      case 404:
-        return "The requested resource was not found in Xero.";
-      case 429:
-        return "Too many requests to Xero. Please try again in a moment.";
-      default:
-        return detail || "An error occurred while communicating with Xero.";
-    }
+    return messageForStatus(error2.response?.status, readDetail(error2.response?.data));
   }
-  return error2 instanceof Error ? error2.message : `An unexpected error occurred: ${error2}`;
+  if (error2 instanceof Error) return redactSensitiveText(error2.message);
+  return "An unexpected error occurred while communicating with Xero.";
+}
+function messageForStatus(status, detail) {
+  switch (status) {
+    case 401:
+      return "Authentication failed. Please check your Xero credentials.";
+    case 403:
+      return "You don't have permission to access this resource in Xero.";
+    case 404:
+      return "The requested resource was not found in Xero.";
+    case 429:
+      return "Too many requests to Xero. Please try again in a moment.";
+    default:
+      return detail ? redactSensitiveText(detail) : "An error occurred while communicating with Xero.";
+  }
+}
+function readDetail(body) {
+  if (body && typeof body === "object" && "Detail" in body) {
+    const d = body.Detail;
+    return typeof d === "string" ? d : null;
+  }
+  return null;
 }
 
 // src/helpers/get-package-version.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.516",
+  "version": "0.28.517",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {