@integrity-labs/agt-cli 0.28.525 → 0.28.527

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-NFBAZOKX.js";
+} from "../chunk-HIHBCJWG.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-LBSV575W.js";
+} from "../chunk-Z4P4VEDU.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4834,7 +4834,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.525" : "dev";
+var cliVersion = true ? "0.28.527" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6006,7 +6006,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.525" : "dev";
+var cliVersion2 = true ? "0.28.527" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-NFBAZOKX.js → chunk-HIHBCJWG.js}

@@ -42,7 +42,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-LBSV575W.js";
+} from "./chunk-Z4P4VEDU.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5317,7 +5317,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.525" : "dev";
+var agtCliVersion = true ? "0.28.527" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8629,4 +8629,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-NFBAZOKX.js.map
+//# sourceMappingURL=chunk-HIHBCJWG.js.map

package/dist/{chunk-LBSV575W.js → chunk-Z4P4VEDU.js}

@@ -5240,6 +5240,35 @@ var OAUTH_PROVIDERS = {
         field: "thumbnail",
         pattern: "^\\s*https?://",
         message: "thumbnail takes a relative path inside Kajabi storage, not an external URL. Kajabi accepts a URL here, returns 200 and never ingests it, so the image would silently stay broken. Upload the asset to Kajabi first and pass the storage path it returns."
+      },
+      // CS-1554: `search_contacts` accepts `tag_id`, does not apply it, and
+      // returns the FULL unfiltered contact list with `filters_applied: null`.
+      // Reported first-hand from a live client site (DTI) while auditing which
+      // contacts carried an opt-in tag. Corroborating evidence: Kajabi's own
+      // REST reference filters contacts with `filter[has_tag_id]`, not a bare
+      // `tag_id` — so the argument is dropped as unrecognised and the response
+      // says so, if you read `filters_applied`.
+      //
+      // Worse than the thumbnail case it sits next to. A broken image is
+      // visible; an unfiltered list that reads as filtered produces a confident
+      // wrong ANSWER, which a human then acts on. That is the same shape as the
+      // incident in CS-1554 where the agent told the customer content did not
+      // exist when it did.
+      //
+      // Any value at all is refused: the field is not partially supported, it
+      // is inert. `[\s\S]` matches every stringified scalar including 0 and
+      // false, which a `.`-style pattern anchored on truthiness would miss.
+      //
+      // NOT REPRODUCED BY ME — I have no Kajabi connection. This rests on the
+      // CS-1554 first-hand report plus the REST reference. The file's own bar is
+      // "provably wrong, never a guess", so a reviewer with a live Kajabi
+      // connection should confirm before this merges. If `tag_id` DOES filter
+      // for some tenant, drop this rule and keep the scalar fix.
+      {
+        tool: "search_contacts",
+        field: "tag_id",
+        pattern: "[\\s\\S]",
+        message: "tag_id is accepted by Kajabi and never applied \u2014 the call returns the FULL contact list with filters_applied: null, which reads as a filtered result and is not one. There is no working tag filter on this tool today. Use list_tags plus the per-contact tag data to determine membership, and treat any tag audit built on search_contacts(tag_id) as unfiltered."
       }
     ]
   },
@@ -15364,4 +15393,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-LBSV575W.js.map
+//# sourceMappingURL=chunk-Z4P4VEDU.js.map