@integrity-labs/agt-cli 0.28.516 → 0.28.518

package/dist/{claude-pair-runtime-FWD7QWAR.js → claude-pair-runtime-4JSAVQLI.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-3SY36KIU.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-ZB5BXOWR.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-FWD7QWAR.js.map
+//# sourceMappingURL=claude-pair-runtime-4JSAVQLI.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-IBI6VSGP.js";
+} from "../chunk-RDDUP6Z4.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -177,7 +177,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-UQ3TQ7M4.js";
+} from "../chunk-SSRYNA7T.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -10106,7 +10106,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.516" : "dev";
+var agtCliVersion = true ? "0.28.518" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11314,7 +11314,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-3SY36KIU.js");
+      const { collectDiagnostics } = await import("../persistent-session-ZB5BXOWR.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11421,7 +11421,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-3SY36KIU.js");
+      const { collectDiagnostics } = await import("../persistent-session-ZB5BXOWR.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11536,7 +11536,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-DSWGHXGG.js");
+      } = await import("../responsiveness-probe-4KU7FOTM.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11600,7 +11600,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-DSWGHXGG.js");
+        } = await import("../responsiveness-probe-4KU7FOTM.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15108,7 +15108,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-3SY36KIU.js");
+        const { collectDiagnostics } = await import("../persistent-session-ZB5BXOWR.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15158,7 +15158,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-3SY36KIU.js");
+      const { collectDiagnostics } = await import("../persistent-session-ZB5BXOWR.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15676,7 +15676,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-FWD7QWAR.js");
+  } = await import("../claude-pair-runtime-4JSAVQLI.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -35550,6 +35550,30 @@ var FLAG_REGISTRY = [
     // must never be serialized into the browser map.
     defaultValue: false
   },
+  {
+    key: "agent-unified-screen",
+    description: 'Unified agent screen redesign (ENG-8478 epic / ENG-8480). When ON, the webapp renders the new single-screen "viewing is editing" agent surface (stripped-back hero, working agent switcher, inline-editable profile, embedded operational panels + a live direct-chat drawer) in place of the separate agent view/edit pages; when OFF, the current view/edit pages are unchanged. Additive UI gate \u2014 no data-model change: each panel reads the same existing endpoints the current pages use. Composes independently with app-top-nav-shell (the two flags are reconciled in ENG-8488). Ships dark.',
+    flagType: "boolean",
+    // Declared safe value is `false` = the current view/edit pages. A flag-DB read
+    // error must fall back to what ships today, never a half-built redesign.
+    defaultValue: false,
+    // Read CLIENT-SIDE by the agent screen ("use client") via usePublicBooleanFlag,
+    // so the key must be in the browser-exposed public map. Additive viewer gate,
+    // resolved within the active-org cookie's scope — not sensitive.
+    public: true
+  },
+  {
+    key: "app-top-nav-shell",
+    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` = the current left sidebar. Fail-closed to the
+    // shell that ships today if the flag DB is unreachable.
+    defaultValue: false,
+    // Read CLIENT-SIDE by the dashboard layout + sidebar ("use client") via
+    // usePublicBooleanFlag, so the key must be in the browser-exposed public map.
+    // Additive layout gate — not sensitive.
+    public: true
+  },
   {
     key: "ninjafy-brand",
     description: 'Present the product under the Ninjafy brand instead of Augmented Team (ENG-8250). This is the UMBRELLA brand gate, not a one-off nav toggle: every subsequent rebrand surface (page titles, email templates, marketing-facing copy) reads THIS key rather than adding its own flag, so the whole rebrand keeps a single kill switch. First surface is the left-hand nav wordmark \u2014 ON replaces the human+robot mark and the "augmented.team" text with italic lowercase "ninjafy"; OFF renders exactly what shipped before. Scope is USER-FACING BRAND TEXT ONLY: it must never gate a code identifier, package name, env var or CLI name, which stay `Augmented`/`agt` per the CLAUDE.md naming contract (the deep code rename is workstream C of docs/runbooks/rebrand-ninjafy-migration.md and is out of scope here). Set the stage-wide default to flip a whole environment, or add a feature_flag_overrides row to pilot one organization while every other org still sees Augmented. Ships dark.',

package/dist/mcp/index.js

@@ -21773,7 +21773,29 @@ function scopeFooter(scope) {
   const visible = scope?.teams_visible;
   const total = scope?.teams_in_org;
   const teams = typeof visible === "number" && typeof total === "number" ? ` (${visible} of ${total} team${total === 1 ? "" : "s"} visible to you)` : "";
-  return `Scope: ${org} only${teams}. Other organizations are not searchable from here, so one match is not proof it is the only one, and no match is not proof there is none.`;
+  return `Scope: ${org} only${teams}. Other organizations are not searchable from here, so one match is not proof it is the only one, and no match is not proof there is none.` + (peopleExclusionNote(scope) ?? "");
+}
+function peopleExclusionNote(scope) {
+  const excluded = scope?.people_excluded;
+  if (typeof excluded !== "number" || excluded <= 0) return null;
+  const by = scope?.people_excluded_by_reason ?? {};
+  const parts = [];
+  const unlinked = by.no_platform_account;
+  if (typeof unlinked === "number" && unlinked > 0) {
+    parts.push(`${unlinked} with no linked console account`);
+  }
+  const infra = by.host_runtime_user;
+  if (typeof infra === "number" && infra > 0) {
+    parts.push(`${infra} infrastructure account${infra === 1 ? "" : "s"}`);
+  }
+  const noEmail = by.no_email;
+  if (typeof noEmail === "number" && noEmail > 0) {
+    parts.push(`${noEmail} with no email on record`);
+  }
+  const because = parts.length > 0 ? ` (${parts.join(", ")})` : "";
+  return `
+
+Note: ${excluded} more ${excluded === 1 ? "person is" : "people are"} in this organization but not listed above${because}. The people list is FILTERED, not complete - do not conclude someone does not exist because they are absent from it. If you needed a Slack id to address a card and found none, that is very likely why; ask a human rather than parking the card on nobody.`;
 }
 function formatDirectoryResult(data, query, slackUserId) {
   const agents = data.agents ?? [];

package/dist/mcp/origami.js

@@ -41452,6 +41452,30 @@ var FLAG_REGISTRY = [
     // must never be serialized into the browser map.
     defaultValue: false
   },
+  {
+    key: "agent-unified-screen",
+    description: 'Unified agent screen redesign (ENG-8478 epic / ENG-8480). When ON, the webapp renders the new single-screen "viewing is editing" agent surface (stripped-back hero, working agent switcher, inline-editable profile, embedded operational panels + a live direct-chat drawer) in place of the separate agent view/edit pages; when OFF, the current view/edit pages are unchanged. Additive UI gate \u2014 no data-model change: each panel reads the same existing endpoints the current pages use. Composes independently with app-top-nav-shell (the two flags are reconciled in ENG-8488). Ships dark.',
+    flagType: "boolean",
+    // Declared safe value is `false` = the current view/edit pages. A flag-DB read
+    // error must fall back to what ships today, never a half-built redesign.
+    defaultValue: false,
+    // Read CLIENT-SIDE by the agent screen ("use client") via usePublicBooleanFlag,
+    // so the key must be in the browser-exposed public map. Additive viewer gate,
+    // resolved within the active-org cookie's scope — not sensitive.
+    public: true
+  },
+  {
+    key: "app-top-nav-shell",
+    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` = the current left sidebar. Fail-closed to the
+    // shell that ships today if the flag DB is unreachable.
+    defaultValue: false,
+    // Read CLIENT-SIDE by the dashboard layout + sidebar ("use client") via
+    // usePublicBooleanFlag, so the key must be in the browser-exposed public map.
+    // Additive layout gate — not sensitive.
+    public: true
+  },
   {
     key: "ninjafy-brand",
     description: 'Present the product under the Ninjafy brand instead of Augmented Team (ENG-8250). This is the UMBRELLA brand gate, not a one-off nav toggle: every subsequent rebrand surface (page titles, email templates, marketing-facing copy) reads THIS key rather than adding its own flag, so the whole rebrand keeps a single kill switch. First surface is the left-hand nav wordmark \u2014 ON replaces the human+robot mark and the "augmented.team" text with italic lowercase "ninjafy"; OFF renders exactly what shipped before. Scope is USER-FACING BRAND TEXT ONLY: it must never gate a code identifier, package name, env var or CLI name, which stay `Augmented`/`agt` per the CLAUDE.md naming contract (the deep code rename is workstream C of docs/runbooks/rebrand-ninjafy-migration.md and is out of scope here). Set the stage-wide default to flip a whole environment, or add a feature_flag_overrides row to pilot one organization while every other org still sees Augmented. Ships dark.',

package/dist/mcp/slack-channel.js

@@ -35719,6 +35719,30 @@ var FLAG_REGISTRY = [
     // must never be serialized into the browser map.
     defaultValue: false
   },
+  {
+    key: "agent-unified-screen",
+    description: 'Unified agent screen redesign (ENG-8478 epic / ENG-8480). When ON, the webapp renders the new single-screen "viewing is editing" agent surface (stripped-back hero, working agent switcher, inline-editable profile, embedded operational panels + a live direct-chat drawer) in place of the separate agent view/edit pages; when OFF, the current view/edit pages are unchanged. Additive UI gate \u2014 no data-model change: each panel reads the same existing endpoints the current pages use. Composes independently with app-top-nav-shell (the two flags are reconciled in ENG-8488). Ships dark.',
+    flagType: "boolean",
+    // Declared safe value is `false` = the current view/edit pages. A flag-DB read
+    // error must fall back to what ships today, never a half-built redesign.
+    defaultValue: false,
+    // Read CLIENT-SIDE by the agent screen ("use client") via usePublicBooleanFlag,
+    // so the key must be in the browser-exposed public map. Additive viewer gate,
+    // resolved within the active-org cookie's scope — not sensitive.
+    public: true
+  },
+  {
+    key: "app-top-nav-shell",
+    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` = the current left sidebar. Fail-closed to the
+    // shell that ships today if the flag DB is unreachable.
+    defaultValue: false,
+    // Read CLIENT-SIDE by the dashboard layout + sidebar ("use client") via
+    // usePublicBooleanFlag, so the key must be in the browser-exposed public map.
+    // Additive layout gate — not sensitive.
+    public: true
+  },
   {
     key: "ninjafy-brand",
     description: 'Present the product under the Ninjafy brand instead of Augmented Team (ENG-8250). This is the UMBRELLA brand gate, not a one-off nav toggle: every subsequent rebrand surface (page titles, email templates, marketing-facing copy) reads THIS key rather than adding its own flag, so the whole rebrand keeps a single kill switch. First surface is the left-hand nav wordmark \u2014 ON replaces the human+robot mark and the "augmented.team" text with italic lowercase "ninjafy"; OFF renders exactly what shipped before. Scope is USER-FACING BRAND TEXT ONLY: it must never gate a code identifier, package name, env var or CLI name, which stay `Augmented`/`agt` per the CLAUDE.md naming contract (the deep code rename is workstream C of docs/runbooks/rebrand-ninjafy-migration.md and is out of scope here). Set the stage-wide default to flip a whole environment, or add a feature_flag_overrides row to pilot one organization while every other org still sees Augmented. Ships dark.',

package/dist/mcp/telegram-channel.js

@@ -36045,6 +36045,30 @@ var FLAG_REGISTRY = [
     // must never be serialized into the browser map.
     defaultValue: false
   },
+  {
+    key: "agent-unified-screen",
+    description: 'Unified agent screen redesign (ENG-8478 epic / ENG-8480). When ON, the webapp renders the new single-screen "viewing is editing" agent surface (stripped-back hero, working agent switcher, inline-editable profile, embedded operational panels + a live direct-chat drawer) in place of the separate agent view/edit pages; when OFF, the current view/edit pages are unchanged. Additive UI gate \u2014 no data-model change: each panel reads the same existing endpoints the current pages use. Composes independently with app-top-nav-shell (the two flags are reconciled in ENG-8488). Ships dark.',
+    flagType: "boolean",
+    // Declared safe value is `false` = the current view/edit pages. A flag-DB read
+    // error must fall back to what ships today, never a half-built redesign.
+    defaultValue: false,
+    // Read CLIENT-SIDE by the agent screen ("use client") via usePublicBooleanFlag,
+    // so the key must be in the browser-exposed public map. Additive viewer gate,
+    // resolved within the active-org cookie's scope — not sensitive.
+    public: true
+  },
+  {
+    key: "app-top-nav-shell",
+    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` = the current left sidebar. Fail-closed to the
+    // shell that ships today if the flag DB is unreachable.
+    defaultValue: false,
+    // Read CLIENT-SIDE by the dashboard layout + sidebar ("use client") via
+    // usePublicBooleanFlag, so the key must be in the browser-exposed public map.
+    // Additive layout gate — not sensitive.
+    public: true
+  },
   {
     key: "ninjafy-brand",
     description: 'Present the product under the Ninjafy brand instead of Augmented Team (ENG-8250). This is the UMBRELLA brand gate, not a one-off nav toggle: every subsequent rebrand surface (page titles, email templates, marketing-facing copy) reads THIS key rather than adding its own flag, so the whole rebrand keeps a single kill switch. First surface is the left-hand nav wordmark \u2014 ON replaces the human+robot mark and the "augmented.team" text with italic lowercase "ninjafy"; OFF renders exactly what shipped before. Scope is USER-FACING BRAND TEXT ONLY: it must never gate a code identifier, package name, env var or CLI name, which stay `Augmented`/`agt` per the CLAUDE.md naming contract (the deep code rename is workstream C of docs/runbooks/rebrand-ninjafy-migration.md and is out of scope here). Set the stage-wide default to flip a whole environment, or add a feature_flag_overrides row to pilot one organization while every other org still sees Augmented. Ships dark.',

package/dist/mcp/xero.js

@@ -114299,12 +114299,39 @@ var {
 var import_dotenv = __toESM(require_main(), 1);
 var import_xero_node = __toESM(require_dist2(), 1);
 
+// src/helpers/redact-sensitive.ts
+var SENSITIVE_HEADER_NAMES = [
+  "authorization",
+  "proxy-authorization",
+  "www-authenticate",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-access-token",
+  "refresh_token",
+  "access_token",
+  "client_secret"
+];
+var REDACTED = "<redacted>";
+var NAME_ALTERNATION = SENSITIVE_HEADER_NAMES.join("|");
+var JSON_PAIR_RE = new RegExp(
+  `("(?:${NAME_ALTERNATION})"\\s*:\\s*)("(?:[^"\\\\]|\\\\.)*"|\\[[^\\]]*\\])`,
+  "gi"
+);
+var HEADER_LINE_RE = new RegExp(`\\b(${NAME_ALTERNATION})\\s*:\\s*([^\\r\\n,}"]+)`, "gi");
+var BEARER_VALUE_RE = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+function redactSensitiveText(input) {
+  return input.replace(JSON_PAIR_RE, (_m, key) => `${key}"${REDACTED}"`).replace(HEADER_LINE_RE, (_m, name) => `${name}: ${REDACTED}`).replace(BEARER_VALUE_RE, (_m, scheme) => `${scheme} ${REDACTED}`);
+}
+
 // src/helpers/ensure-error.ts
 function ensureError(value) {
   if (value instanceof Error) return value;
   let stringified = "[Unable to stringify the thrown value]";
   try {
-    stringified = JSON.stringify(value);
+    stringified = redactSensitiveText(JSON.stringify(value) ?? String(value));
   } catch {
   }
   const error2 = new Error(`Error thrown: ${stringified}`);
@@ -114692,9 +114719,12 @@ var XeroScopeMissingError = class extends Error {
   }
 };
 function classifyXeroError(error2) {
-  if (!(error2 instanceof AxiosError2)) return null;
-  if (error2.response?.status !== 401) return null;
-  const detail = readXeroDetail(error2.response.data);
+  const rejection = parseXeroApiRejection(error2);
+  const status = rejection ? rejection.statusCode : axiosStatus(error2);
+  if (status !== 401) return null;
+  const detail = readXeroDetail(
+    rejection ? rejection.body : error2.response?.data
+  );
   if (detail !== "AuthorizationUnsuccessful") return null;
   return new XeroScopeMissingError(
     `Xero rejected this call as scope-missing \u2014 the OAuth consent did not grant the scope this endpoint requires. Token refresh will not help: refresh tokens cannot widen scope. Ask the user to click "Reconnect" on the Xero card in the Augmented console so the consent screen requests the scopes the agent's installed skills need.`,
@@ -114702,6 +114732,25 @@ function classifyXeroError(error2) {
     detail
   );
 }
+function axiosStatus(error2) {
+  return error2 instanceof AxiosError2 ? error2.response?.status : void 0;
+}
+function parseXeroApiRejection(error2) {
+  if (typeof error2 !== "string") return null;
+  if (!error2.startsWith("{")) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(error2);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const response = parsed.response;
+  if (!response || typeof response !== "object") return null;
+  const statusCode = response.statusCode;
+  if (typeof statusCode !== "number") return null;
+  return { statusCode, body: response.body };
+}
 function readXeroDetail(data) {
   if (data && typeof data === "object" && "Detail" in data) {
     const d = data.Detail;
@@ -114717,23 +114766,36 @@ function readXeroDetail(data) {
 function formatError2(error2) {
   const scopeMissing = classifyXeroError(error2);
   if (scopeMissing) return scopeMissing.message;
+  const rejection = parseXeroApiRejection(error2);
+  if (rejection) {
+    return messageForStatus(rejection.statusCode, readDetail(rejection.body));
+  }
   if (error2 instanceof AxiosError2) {
-    const status = error2.response?.status;
-    const detail = error2.response?.data?.Detail;
-    switch (status) {
-      case 401:
-        return "Authentication failed. Please check your Xero credentials.";
-      case 403:
-        return "You don't have permission to access this resource in Xero.";
-      case 404:
-        return "The requested resource was not found in Xero.";
-      case 429:
-        return "Too many requests to Xero. Please try again in a moment.";
-      default:
-        return detail || "An error occurred while communicating with Xero.";
-    }
+    return messageForStatus(error2.response?.status, readDetail(error2.response?.data));
   }
-  return error2 instanceof Error ? error2.message : `An unexpected error occurred: ${error2}`;
+  if (error2 instanceof Error) return redactSensitiveText(error2.message);
+  return "An unexpected error occurred while communicating with Xero.";
+}
+function messageForStatus(status, detail) {
+  switch (status) {
+    case 401:
+      return "Authentication failed. Please check your Xero credentials.";
+    case 403:
+      return "You don't have permission to access this resource in Xero.";
+    case 404:
+      return "The requested resource was not found in Xero.";
+    case 429:
+      return "Too many requests to Xero. Please try again in a moment.";
+    default:
+      return detail ? redactSensitiveText(detail) : "An error occurred while communicating with Xero.";
+  }
+}
+function readDetail(body) {
+  if (body && typeof body === "object" && "Detail" in body) {
+    const d = body.Detail;
+    return typeof d === "string" ? d : null;
+  }
+  return null;
 }
 
 // src/helpers/get-package-version.ts

package/dist/{persistent-session-3SY36KIU.js → persistent-session-ZB5BXOWR.js}

@@ -37,7 +37,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-UQ3TQ7M4.js";
+} from "./chunk-SSRYNA7T.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -79,4 +79,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-3SY36KIU.js.map
+//# sourceMappingURL=persistent-session-ZB5BXOWR.js.map

package/dist/{responsiveness-probe-DSWGHXGG.js → responsiveness-probe-4KU7FOTM.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-UQ3TQ7M4.js";
+} from "./chunk-SSRYNA7T.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -662,4 +662,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-DSWGHXGG.js.map
+//# sourceMappingURL=responsiveness-probe-4KU7FOTM.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.516",
+  "version": "0.28.518",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {