@integrity-labs/agt-cli 0.28.522 → 0.28.523

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-WIQCLSZY.js";
+} from "../chunk-HERASX7X.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-4GTDD2I5.js";
+} from "../chunk-LBSV575W.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4834,7 +4834,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.522" : "dev";
+var cliVersion = true ? "0.28.523" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6006,7 +6006,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.522" : "dev";
+var cliVersion2 = true ? "0.28.523" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-WIQCLSZY.js → chunk-HERASX7X.js}

@@ -42,7 +42,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-4GTDD2I5.js";
+} from "./chunk-LBSV575W.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5317,7 +5317,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.522" : "dev";
+var agtCliVersion = true ? "0.28.523" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8629,4 +8629,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-WIQCLSZY.js.map
+//# sourceMappingURL=chunk-HERASX7X.js.map

package/dist/{chunk-4GTDD2I5.js → chunk-LBSV575W.js}

@@ -5220,6 +5220,27 @@ var OAUTH_PROVIDERS = {
       "themes",
       "contacts",
       "emails"
+    ],
+    // ENG-8512: `update_course.thumbnail` stores a RELATIVE path into Kajabi's
+    // own storage — it is rendered as
+    //   https://kajabi-storefronts-production.kajabi-cdn.com/kajabi-storefronts-production/<value>
+    // so an absolute http(s) URL is structurally not a valid value for it.
+    // Kajabi accepts one anyway, returns 200, echoes it back, ingests nothing,
+    // and the course shows a broken image. Reported from a live client site
+    // (DTI) via CS-1548 after it produced a false "done" report and three
+    // failed cards.
+    //
+    // Anchored at the start so only an ABSOLUTE URL is refused; every relative
+    // path — the valid shape — passes untouched. This does not enable setting a
+    // thumbnail from a URL (that needs an upload path, CS-1548 item 4). It stops
+    // us reporting success for a write that did not happen.
+    argRejects: [
+      {
+        tool: "update_course",
+        field: "thumbnail",
+        pattern: "^\\s*https?://",
+        message: "thumbnail takes a relative path inside Kajabi storage, not an external URL. Kajabi accepts a URL here, returns 200 and never ingests it, so the image would silently stay broken. Upload the asset to Kajabi first and pass the storage path it returns."
+      }
     ]
   },
   "notion-cli": {
@@ -6361,7 +6382,14 @@ var REMOTE_MCP_PROXY_ENV = {
   authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
   extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
   toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
-  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS"
+  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
+  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
+  // KNOW the remote accepts and silently ignores is refused before it is
+  // forwarded, rather than returning a 200 that every layer above records as
+  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
+  // we forward, not what an outbound request looks like, so the probe (which
+  // never issues a tools/call) has nothing to reconstruct from it.
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,
@@ -11528,6 +11556,12 @@ function buildOAuthRemoteMcpProxyEntry(definitionId, paths, connectionKey) {
       // CS-1446: toolsets to pre-activate at session start so gated tools are
       // advertised in the connect-time tools/list the harness freezes. Omitted
       // when the provider configures none (no pre-enable, the default).
+      // ENG-8512: argument rules for calls the remote would accept and silently
+      // ignore. JSON rather than a delimited list because a rule carries a regex
+      // and a human-readable message, and both can contain any separator we
+      // might have picked. Omitted when the provider declares none, leaving the
+      // proxy's argument checking entirely off.
+      ...provider.argRejects && provider.argRejects.length > 0 ? { AGT_REMOTE_MCP_ARG_REJECTS: JSON.stringify(provider.argRejects) } : {},
       ...provider.preEnableToolsets && provider.preEnableToolsets.length > 0 ? { AGT_REMOTE_MCP_PREENABLE_TOOLSETS: provider.preEnableToolsets.join(",") } : {}
     }
   };
@@ -15330,4 +15364,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-4GTDD2I5.js.map
+//# sourceMappingURL=chunk-LBSV575W.js.map