npm - @integrity-labs/agt-cli - Versions diffs - 0.28.521 → 0.28.523 - Mend

@integrity-labs/agt-cli 0.28.521 → 0.28.523

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/dist/bin/agt.js CHANGED Viewed

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-UAHIRLPO.js";
+} from "../chunk-HERASX7X.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-STNEJC5S.js";
+} from "../chunk-LBSV575W.js";
 import "../chunk-XWVM4KPK.js";
 // src/bin/agt.ts
@@ -4834,7 +4834,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.521" : "dev";
+var cliVersion = true ? "0.28.523" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6006,7 +6006,7 @@ function handleError(err) {
 }
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.521" : "dev";
+var cliVersion2 = true ? "0.28.523" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-UAHIRLPO.js → chunk-HERASX7X.js} RENAMED Viewed

@@ -42,7 +42,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-STNEJC5S.js";
+} from "./chunk-LBSV575W.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5317,7 +5317,7 @@ function exchangeFailureKind(err) {
 }
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.521" : "dev";
+var agtCliVersion = true ? "0.28.523" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8629,4 +8629,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-UAHIRLPO.js.map
+//# sourceMappingURL=chunk-HERASX7X.js.map

package/dist/{chunk-STNEJC5S.js → chunk-LBSV575W.js} RENAMED Viewed

@@ -4400,6 +4400,11 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   var commentEnabled = false; // armed when the viewer may comment (ENG-6847 right-click)
   var editing = null;         // the element currently in edit mode
   var bar = null;             // the Save/Cancel toolbar
+  // ENG-8477: the viewer has explicitly turned editing ON from the shell. Only
+  // then does the bridge look underneath the artefact's own overlays. See the
+  // long note on the window-capture click handler for why this is a mode and
+  // not just always-on.
+  var editMode = false;
   // Element-child indices from <body> down to el. Counts ELEMENT children only
   // (children, not childNodes), matching how the server walks source_html; our
@@ -4454,6 +4459,55 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
       return null;
     }catch(e){ return null; }
   }
+  // ENG-8477: the topmost element under the pointer that we could actually edit,
+  // looking THROUGH anything the artefact has laid over its own content.
+  //
+  // elementsFromPoint returns the full hit stack, front to back. We walk it from
+  // the front and take the first genuinely editable element, skipping our own
+  // injected UI. An artefact overlay is skipped for free: it is an empty div, so
+  // editable() rejects it on the text check and we keep walking.
+  //
+  // Returns null when there is nothing editable under the pointer at all, which
+  // is the signal to leave the click completely alone.
+  function editableAtPoint(x,y){
+    var stack;
+    try{ stack=document.elementsFromPoint(x,y)||[]; }catch(e){ return null; }
+    for(var i=0;i<stack.length;i++){
+      var el=stack[i];
+      if(!el || el.nodeType!==1) continue;
+      if(el.closest && el.closest('[data-al-noedit]')) continue; // our toolbar, not content
+      if(editable(el)||inlineOnlyEditable(el)) return el;
+    }
+    return null;
+  }
+  // The caret probe (caretRangeFromPoint) reports on the TOPMOST element at the
+  // point, so an overlay swallows it exactly as it swallows the click - it hands
+  // back the overlay div, not the text underneath. Neutralise everything stacked
+  // above the target for the length of the probe, then put it back. The restore
+  // is in a finally and runs before the browser can paint, so nothing flickers
+  // and no artefact state is left modified.
+  // This re-queries elementsFromPoint rather than reusing the caller's stack, so
+  // target is NOT guaranteed to still be in it. Find target's index first and
+  // mute only the prefix in front of it: a not-found target must fall back to the
+  // plain probe, because muting the whole stack would neutralise target and its
+  // ancestors too - a wider style mutation than intended, for a probe whose
+  // result the caller then rejects anyway.
+  function textNodeAtPointThrough(x,y,target){
+    var stack;
+    try{ stack=document.elementsFromPoint(x,y)||[]; }catch(e){ return textNodeAtPoint(x,y); }
+    var cut=-1, i;
+    for(i=0;i<stack.length;i++){ if(stack[i]===target){ cut=i; break; } }
+    if(cut<0) return textNodeAtPoint(x,y);
+    var muted=[];
+    for(i=0;i<cut;i++){
+      muted.push([stack[i], stack[i].style ? stack[i].style.pointerEvents : '']);
+      try{ stack[i].style.pointerEvents='none'; }catch(e){}
+    }
+    try{ return textNodeAtPoint(x,y); }
+    finally{
+      for(i=0;i<muted.length;i++){ try{ muted[i][0].style.pointerEvents=muted[i][1]||''; }catch(e){} }
+    }
+  }
   // Index of a text node among its parent's child TEXT nodes, in order - the same
   // counting the server uses to re-locate it in source_html (ENG-6856).
   function textIndexOf(container, tn){
@@ -4563,6 +4617,105 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
       e.preventDefault(); e.stopPropagation(); startEditTextNode(tn, el);
     }
   }, true);
+  // ENG-8477: reach content the artefact covers with its OWN overlay.
+  //
+  // A deck built from the canonical template lays two full-viewport click zones
+  // over its slides (.clickzone, position:fixed, z-index:40) to page forward and
+  // back. The template's own comment says it plainly: "the click zones sit above
+  // slide content by design, so any interactive element inside a slide needs
+  // position:relative + a higher z-index to stay clickable". Slide TEXT is not an
+  // interactive element and never gets one.
+  //
+  // So every click a viewer aimed at a paragraph landed on #zone-prev/#zone-next.
+  // The handler above read e.target, got an empty div, editable() rejected it on
+  // the text check, and no editor opened - while the zone's own handler paged the
+  // deck. A single-page artefact has no zones and the identical bridge works
+  // perfectly on it, which is precisely why editing "works in web page formats
+  // but not decks". Verified on real published content, not just the template.
+  //
+  // Why a MODE rather than always-on. One press cannot mean both "page the deck"
+  // and "edit this text". The zones are the deck's primary navigation, so
+  // silently stealing clicks from them would trade one broken gesture for
+  // another. The shell gives an armed viewer an explicit Edit-text toggle; until
+  // they turn it on, every line below is inert and the artefact behaves exactly
+  // as it does today. Anonymous viewers never arm at all.
+  //
+  // Why window + capture. Same phase argument as ENG-8500: the artefact's script
+  // is appended before the bridge, so registration order cannot be won, but the
+  // capture path runs window -> document -> ... -> target and therefore beats a
+  // handler bound to the zone itself no matter when it was registered.
+  // stopImmediatePropagation then keeps the deck from also paging.
+  //
+  // Deliberately general: nothing here knows about .clickzone or any class name.
+  // It fixes any artefact that covers its own content.
+  window.addEventListener('click', function(e){
+    if(!editEnabled || !editMode || editing) return;
+    var sel=document.getSelection(); if(sel && String(sel).trim()) return; // selection => comment flow
+    var t=e.target;
+    // Our own toolbar (Save/Cancel) must keep its clicks.
+    if(t && t.closest && t.closest('[data-al-noedit]')) return;
+    // Already directly on editable content: the document-level handler above
+    // covers it, and duplicating the work here would start the edit twice.
+    if(editable(t)||inlineOnlyEditable(t)) return;
+    var el=editableAtPoint(e.clientX, e.clientY);
+    // Nothing editable under the pointer - leave the click completely alone so
+    // click-to-page still works while the viewer is moving between slides.
+    if(!el) return;
+    // Suppress ONLY once an edit is actually starting. Suppressing up front left
+    // the inline-only fallback below as a dead click: no editor opened AND the
+    // deck could not page, because the event was already stopped.
+    if(editable(el)){ e.preventDefault(); e.stopImmediatePropagation(); startEdit(el); return; }
+    var tn=textNodeAtPointThrough(e.clientX, e.clientY, el);
+    if(tn && tn.parentElement===el && (tn.nodeValue||'').trim()){
+      e.preventDefault(); e.stopImmediatePropagation(); startEditTextNode(tn, el); return;
+    }
+    // An inline-only container whose exact text run we could not resolve (no
+    // caret API, or the point fell between runs). Editing the whole container
+    // would flatten its nested markup, so leave the click to the artefact and
+    // let it page as it normally would.
+  }, true);
+  // ENG-8477: the same deck template pulls focus back to the document on every
+  // pointer press, to keep its arrow keys working when the iframe loses focus:
+  //
+  //   function grabFocus(){ try{ window.focus(); document.body.focus(); }catch(e){} }
+  //   addEventListener('pointerdown', grabFocus);
+  //
+  // A bare addEventListener at artefact top level is window + bubble phase, so a
+  // window CAPTURE listener still gets there first. Without this guard, clicking
+  // into an open editor to place the caret hands focus straight to <body> and the
+  // viewer cannot type - a second, independent breaker that would have survived
+  // the overlay fix on its own.
+  //
+  // Scoped as tightly as it can be: only while an edit is open, and only for a
+  // press that lands inside the editor. A press anywhere else is the viewer
+  // leaving, and the artefact keeps it.
+  window.addEventListener('pointerdown', function(e){
+    if(!editing) return;
+    var t=e.target;
+    if(t!==editing && !(editing.contains && t && t.nodeType && editing.contains(t))) return;
+    e.stopImmediatePropagation();
+  }, true);
+  // ENG-8477: the hover affordance has the same blind spot as the click did -
+  // mouseover reports the overlay, so a viewer in edit mode would get no cue that
+  // slide text can be edited at all. Probing the stack on every mousemove would
+  // be wasteful, so this only runs in edit mode, only when the direct target is
+  // not already editable (that case the mouseover handler above still covers),
+  // and no more than once per ~80ms.
+  var hoverProbeAt=0, hoverEl=null;
+  function clearDeepHover(){
+    if(hoverEl && hoverEl!==editing && hoverEl.__alHover){ try{ hoverEl.style.outline=''; }catch(e){} hoverEl.__alHover=0; }
+    hoverEl=null;
+  }
+  document.addEventListener('mousemove', function(e){
+    if(!editEnabled || !editMode || editing){ clearDeepHover(); return; }
+    var t=e.target;
+    if(editable(t)||inlineOnlyEditable(t)){ clearDeepHover(); return; }
+    var now=Date.now(); if(now-hoverProbeAt<80) return; hoverProbeAt=now;
+    var el=editableAtPoint(e.clientX, e.clientY);
+    if(el===hoverEl) return;
+    clearDeepHover();
+    if(el){ try{ el.style.outline=el.style.outline||'1px dashed rgba(110,231,183,.6)'; }catch(e){} el.__alHover=1; hoverEl=el; }
+  });
   // ENG-8500: while the inline editor is focused, the artefact's OWN keyboard
   // handlers must not see the keystroke.
   //
@@ -4654,6 +4807,13 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     var d=e.data; if(!d || d['${MARKUP_CONTROL_MARKER}']!==true) return;
     if(d.type==='enable-edit'){ editEnabled=true; }
     else if(d.type==='enable-comment'){ commentEnabled=true; }
+    // ENG-8477: the viewer toggled Edit text in the shell. Turning it OFF must
+    // also close anything open and drop the hover cue, or the artefact is left
+    // wearing our outlines with no way to clear them.
+    else if(d.type==='set-edit-mode'){
+      editMode = !!d.on;
+      if(!editMode){ if(editing) endEdit(false); clearDeepHover(); }
+    }
     else if(d.type==='edit-result'){
       if(d.ok){ /* republish hot-swaps the iframe; nothing to do */ }
       else { /* leave the (now non-editable) text; the published version is the source of truth */ }
@@ -5060,6 +5220,27 @@ var OAUTH_PROVIDERS = {
       "themes",
       "contacts",
       "emails"
+    ],
+    // ENG-8512: `update_course.thumbnail` stores a RELATIVE path into Kajabi's
+    // own storage — it is rendered as
+    //   https://kajabi-storefronts-production.kajabi-cdn.com/kajabi-storefronts-production/<value>
+    // so an absolute http(s) URL is structurally not a valid value for it.
+    // Kajabi accepts one anyway, returns 200, echoes it back, ingests nothing,
+    // and the course shows a broken image. Reported from a live client site
+    // (DTI) via CS-1548 after it produced a false "done" report and three
+    // failed cards.
+    //
+    // Anchored at the start so only an ABSOLUTE URL is refused; every relative
+    // path — the valid shape — passes untouched. This does not enable setting a
+    // thumbnail from a URL (that needs an upload path, CS-1548 item 4). It stops
+    // us reporting success for a write that did not happen.
+    argRejects: [
+      {
+        tool: "update_course",
+        field: "thumbnail",
+        pattern: "^\\s*https?://",
+        message: "thumbnail takes a relative path inside Kajabi storage, not an external URL. Kajabi accepts a URL here, returns 200 and never ingests it, so the image would silently stay broken. Upload the asset to Kajabi first and pass the storage path it returns."
+      }
     ]
   },
   "notion-cli": {
@@ -6201,7 +6382,14 @@ var REMOTE_MCP_PROXY_ENV = {
   authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
   extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
   toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
-  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS"
+  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
+  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
+  // KNOW the remote accepts and silently ignores is refused before it is
+  // forwarded, rather than returning a 200 that every layer above records as
+  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
+  // we forward, not what an outbound request looks like, so the probe (which
+  // never issues a tools/call) has nothing to reconstruct from it.
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,
@@ -11368,6 +11556,12 @@ function buildOAuthRemoteMcpProxyEntry(definitionId, paths, connectionKey) {
       // CS-1446: toolsets to pre-activate at session start so gated tools are
       // advertised in the connect-time tools/list the harness freezes. Omitted
       // when the provider configures none (no pre-enable, the default).
+      // ENG-8512: argument rules for calls the remote would accept and silently
+      // ignore. JSON rather than a delimited list because a rule carries a regex
+      // and a human-readable message, and both can contain any separator we
+      // might have picked. Omitted when the provider declares none, leaving the
+      // proxy's argument checking entirely off.
+      ...provider.argRejects && provider.argRejects.length > 0 ? { AGT_REMOTE_MCP_ARG_REJECTS: JSON.stringify(provider.argRejects) } : {},
       ...provider.preEnableToolsets && provider.preEnableToolsets.length > 0 ? { AGT_REMOTE_MCP_PREENABLE_TOOLSETS: provider.preEnableToolsets.join(",") } : {}
     }
   };
@@ -15170,4 +15364,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-STNEJC5S.js.map
+//# sourceMappingURL=chunk-LBSV575W.js.map