@integrity-labs/agt-cli 0.28.522 → 0.28.523

package/dist/{claude-pair-runtime-7W7LSW73.js → claude-pair-runtime-KEG2LDMH.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-5GMZKV37.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-OT66RBK5.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-7W7LSW73.js.map
+//# sourceMappingURL=claude-pair-runtime-KEG2LDMH.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-WIQCLSZY.js";
+} from "../chunk-HERASX7X.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -177,7 +177,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-4GTDD2I5.js";
+} from "../chunk-LBSV575W.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -10106,7 +10106,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.522" : "dev";
+var agtCliVersion = true ? "0.28.523" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11314,7 +11314,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-5GMZKV37.js");
+      const { collectDiagnostics } = await import("../persistent-session-OT66RBK5.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11421,7 +11421,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-5GMZKV37.js");
+      const { collectDiagnostics } = await import("../persistent-session-OT66RBK5.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11536,7 +11536,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-52IZOP2M.js");
+      } = await import("../responsiveness-probe-KW7KQJUY.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11600,7 +11600,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-52IZOP2M.js");
+        } = await import("../responsiveness-probe-KW7KQJUY.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15108,7 +15108,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-5GMZKV37.js");
+        const { collectDiagnostics } = await import("../persistent-session-OT66RBK5.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15158,7 +15158,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-5GMZKV37.js");
+      const { collectDiagnostics } = await import("../persistent-session-OT66RBK5.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15676,7 +15676,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-7W7LSW73.js");
+  } = await import("../claude-pair-runtime-KEG2LDMH.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -32596,7 +32596,14 @@ var REMOTE_MCP_PROXY_ENV = {
   authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
   extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
   toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
-  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS"
+  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
+  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
+  // KNOW the remote accepts and silently ignores is refused before it is
+  // forwarded, rather than returning a 200 that every layer above records as
+  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
+  // we forward, not what an outbound request looks like, so the probe (which
+  // never issues a tools/call) has nothing to reconstruct from it.
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,

package/dist/mcp/origami.js

@@ -38934,7 +38934,14 @@ var REMOTE_MCP_PROXY_ENV = {
   authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
   extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
   toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
-  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS"
+  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
+  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
+  // KNOW the remote accepts and silently ignores is refused before it is
+  // forwarded, rather than returning a 200 that every layer above records as
+  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
+  // we forward, not what an outbound request looks like, so the probe (which
+  // never issues a tools/call) has nothing to reconstruct from it.
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,

package/dist/mcp/remote-oauth-proxy.js

@@ -17,7 +17,14 @@ var REMOTE_MCP_PROXY_ENV = {
   authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
   extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
   toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
-  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS"
+  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
+  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
+  // KNOW the remote accepts and silently ignores is refused before it is
+  // forwarded, rather than returning a 200 that every layer above records as
+  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
+  // we forward, not what an outbound request looks like, so the probe (which
+  // never issues a tools/call) has nothing to reconstruct from it.
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,
@@ -67,6 +74,7 @@ var TOKEN_FILE_ENV = REMOTE_MCP_PROXY_ENV.tokenFile;
 var TOKEN_VAR_ENV = REMOTE_MCP_PROXY_ENV.tokenVar;
 var ALLOWLIST_ENV = REMOTE_MCP_PROXY_ENV.toolAllowlist;
 var PREENABLE_ENV = REMOTE_MCP_PROXY_ENV.preEnableToolsets;
+var ARG_REJECTS_ENV = REMOTE_MCP_PROXY_ENV.argRejects;
 var REMOTE_FETCH_TIMEOUT_MS = 3e4;
 var remoteUrl = process.env[URL_ENV] ?? "";
 var tokenFile = process.env[TOKEN_FILE_ENV] ?? "";
@@ -74,6 +82,7 @@ var tokenVar = process.env[TOKEN_VAR_ENV] ?? "";
 var label = process.env[REMOTE_MCP_PROXY_ENV.label] || tokenVar || "remote-oauth";
 var toolAllowlist = parseToolAllowlist(process.env[ALLOWLIST_ENV] ?? "");
 var preEnableToolsets = parsePreEnableToolsets(process.env[PREENABLE_ENV] ?? "");
+var argRejects = parseArgRejects(process.env[ARG_REJECTS_ENV] ?? "");
 var { authHeader: authHeaderName, extras: extraHeaderSpecs } = readRemoteMcpAuthConfig(process.env);
 function logErr(msg) {
   process.stderr.write(`[remote-oauth-proxy:${label}] ${msg}
@@ -183,6 +192,70 @@ function isToolCallBlocked(method, params, allow) {
   if (name && !allow.has(name)) return { blocked: true, name };
   return { blocked: false, name };
 }
+function parseArgRejects(raw) {
+  if (!raw || !raw.trim()) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  const out = [];
+  for (const entry of parsed) {
+    if (!entry || typeof entry !== "object") continue;
+    const e = entry;
+    const tool = typeof e["tool"] === "string" ? e["tool"] : "";
+    const field = typeof e["field"] === "string" ? e["field"] : "";
+    const pattern = typeof e["pattern"] === "string" ? e["pattern"] : "";
+    const message = typeof e["message"] === "string" ? e["message"] : "";
+    if (!tool || !field || !pattern || !message) continue;
+    try {
+      out.push({ tool, field, re: new RegExp(pattern), message });
+    } catch {
+    }
+  }
+  return out;
+}
+function isToolArgRejected(method, params, rules) {
+  const none = { rejected: false, name: "", field: "", message: "" };
+  if (rules.length === 0 || method !== "tools/call") return none;
+  if (!params || typeof params !== "object") return none;
+  const p = params;
+  const name = typeof p.name === "string" ? p.name : "";
+  if (!name) return none;
+  const args = p.arguments;
+  if (!args || typeof args !== "object") return none;
+  const bag = args;
+  for (const rule of rules) {
+    if (rule.tool !== name) continue;
+    const value = bag[rule.field];
+    if (typeof value !== "string") continue;
+    if (rule.re.test(value)) {
+      return { rejected: true, name, field: rule.field, message: rule.message };
+    }
+  }
+  return none;
+}
+function callRefusal(method, params, allow, rules, label2) {
+  const block = isToolCallBlocked(method, params, allow);
+  if (block.blocked) {
+    return {
+      log: `blocked tools/call to non-allowlisted tool "${block.name}"`,
+      code: -32601,
+      message: `${label2}: tool "${block.name}" is not enabled for this integration`
+    };
+  }
+  const argReject = isToolArgRejected(method, params, rules);
+  if (argReject.rejected) {
+    return {
+      log: `rejected tools/call "${argReject.name}": argument "${argReject.field}" would be silently ignored by the remote`,
+      code: -32602,
+      message: `${label2}: ${argReject.name} refused - ${argReject.message}`
+    };
+  }
+  return null;
+}
 function readCurrentToken(file, varName) {
   let raw;
   try {
@@ -426,17 +499,16 @@ async function main() {
     }
     const isNotification = !("id" in parsed);
     const id = parsed.id;
-    if (!isNotification) {
-      const block = isToolCallBlocked(parsed.method, parsed.params, toolAllowlist);
-      if (block.blocked) {
-        logErr(`blocked tools/call to non-allowlisted tool "${block.name}"`);
-        const task2 = writeReplies([
-          jsonRpcError(id, -32601, `${label}: tool "${block.name}" is not enabled for this integration`)
-        ]).catch((err) => logErr(`handler error: ${err.message}`));
-        inflight.add(task2);
-        void task2.finally(() => inflight.delete(task2));
-        return;
-      }
+    const refusal = callRefusal(parsed.method, parsed.params, toolAllowlist, argRejects, label);
+    if (refusal) {
+      logErr(isNotification ? `${refusal.log} (notification, no reply sent)` : refusal.log);
+      if (isNotification) return;
+      const task2 = writeReplies([jsonRpcError(id, refusal.code, refusal.message)]).catch(
+        (err) => logErr(`handler error: ${err.message}`)
+      );
+      inflight.add(task2);
+      void task2.finally(() => inflight.delete(task2));
+      return;
     }
     const task = forward(text, id, isNotification, parsed.method, parsed.params).then(writeReplies).catch((err) => {
       logErr(`handler error: ${err.message}`);
@@ -466,13 +538,16 @@ export {
   buildEnableToolsetRequest,
   buildForwardHeaders,
   buildToolsListRequest,
+  callRefusal,
   extractJsonRpcMessages,
   extractToolsArray,
   filterToolsListMessage,
   forward,
   isManagedActivationCall,
+  isToolArgRejected,
   isToolCallBlocked,
   main,
+  parseArgRejects,
   parseEnableToolsetResponse,
   parseExtraHeaders,
   parsePreEnableToolsets,

package/dist/mcp/slack-channel.js

@@ -32818,7 +32818,14 @@ var REMOTE_MCP_PROXY_ENV = {
   authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
   extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
   toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
-  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS"
+  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
+  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
+  // KNOW the remote accepts and silently ignores is refused before it is
+  // forwarded, rather than returning a 200 that every layer above records as
+  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
+  // we forward, not what an outbound request looks like, so the probe (which
+  // never issues a tools/call) has nothing to reconstruct from it.
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,

package/dist/mcp/telegram-channel.js

@@ -33144,7 +33144,14 @@ var REMOTE_MCP_PROXY_ENV = {
   authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
   extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
   toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
-  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS"
+  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
+  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
+  // KNOW the remote accepts and silently ignores is refused before it is
+  // forwarded, rather than returning a 200 that every layer above records as
+  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
+  // we forward, not what an outbound request looks like, so the probe (which
+  // never issues a tools/call) has nothing to reconstruct from it.
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,

package/dist/{persistent-session-5GMZKV37.js → persistent-session-OT66RBK5.js}

@@ -37,7 +37,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-4GTDD2I5.js";
+} from "./chunk-LBSV575W.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -79,4 +79,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-5GMZKV37.js.map
+//# sourceMappingURL=persistent-session-OT66RBK5.js.map

package/dist/{responsiveness-probe-52IZOP2M.js → responsiveness-probe-KW7KQJUY.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-4GTDD2I5.js";
+} from "./chunk-LBSV575W.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -662,4 +662,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-52IZOP2M.js.map
+//# sourceMappingURL=responsiveness-probe-KW7KQJUY.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.522",
+  "version": "0.28.523",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {