@integrity-labs/agt-cli 0.28.536 → 0.28.538

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-NOOKTWZP.js";
+} from "../chunk-XREQUTXK.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-TPJ57PWU.js";
+} from "../chunk-N6HD5UG4.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4834,7 +4834,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.536" : "dev";
+var cliVersion = true ? "0.28.538" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6006,7 +6006,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.536" : "dev";
+var cliVersion2 = true ? "0.28.538" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-TPJ57PWU.js → chunk-N6HD5UG4.js}

@@ -10050,6 +10050,18 @@ var FLAG_REGISTRY = [
     // so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "kanban-push-status",
+    description: "Write a kanban card's status back to the ticket it was imported from (ENG-8384). When ON for a team, a status change on an external-origin card (source=integration) is enqueued by a DB trigger and drained by the kanban-status-push cron, which calls the adapter's optional pushStatus - Linear resolves the target workflow state for the issue's own team and calls LINEAR_UPDATE_ISSUE. When OFF (default) the outbox rows are drained straight to skipped and the team sees ZERO upstream writes, which is the whole point of the gate: this is the first code path that MUTATES a customer's own Jira/Linear instance, so it must never be silently-on. Adapters that cannot honestly push (Jira has no transition tool in its Composio pack) omit pushStatus and their cards report local-only regardless of this flag. Boolean gate; ships dark; evaluated per-team at drain time.",
+    flagType: "boolean",
+    // Declared safe value is `false` = do not write to customer systems. A flag
+    // outage must degrade to "don't touch their tracker", never to an
+    // unattributed mutation in someone else's tool.
+    defaultValue: false,
+    // Turning it ON starts writing into a customer-owned system. That is exactly
+    // the deliberate, audited decision ADR-0022 §4 reserves confirmation for.
+    sensitive: true
+  },
   {
     key: "augmented-live-stream-producer",
     description: "Augmented Live live-preview streaming producer (ENG-7210). The receiver (codec, artifact-draft channel, stream route, console Live Preview tab) shipped under ENG-6234 but never engages because nothing writes the working file the manager scanner watches. When ON for an org, a host-side PostToolUse hook mirrors agt-live.publish/editing content to ~/.augmented/{codeName}/artifacts/<slug>/index.html, so the scanner mints a draft and streams a keyframe to the console Live Preview tab. Additive, best-effort. Boolean gate; ships dark. Materialized to the host flags-cache; the bash hook reads it (operator/canary override AGT_LIVE_STREAM_PRODUCER_ENABLED).",
@@ -14513,6 +14525,18 @@ function buildSpawnEnv(args) {
 function findMissingSpawnEnv(env2) {
   return REQUIRED_SPAWN_ENV.filter((k) => !env2[k]?.trim());
 }
+function findForeignAgentIdsInMcpConfig(args) {
+  const { mcpConfigText, agentId } = args;
+  const expected = agentId.trim();
+  const out = [];
+  for (const m of mcpConfigText.matchAll(/"AGT_AGENT_ID"\s*:\s*"([^"]+)"/g)) {
+    const found = (m[1] ?? "").trim();
+    if (!found || found.startsWith("$")) continue;
+    if (found === expected) continue;
+    if (!out.includes(found)) out.push(found);
+  }
+  return out;
+}
 var sessions2 = /* @__PURE__ */ new Map();
 var PANE_LOG_DIR = join6(homedir6(), ".augmented");
 var PANE_TAIL_LINES = 20;
@@ -14882,6 +14906,18 @@ function spawnSession(config, session) {
         `[persistent-session] MISSING SPAWN ENV ${key} agent=${codeName} isolation=${isolationMode(codeName)} \u2014 programs reading process.env.${key} will fail (e.g. the agt-bin/gh GitHub credential shim hard-exits without AGT_AGENT_ID, taking every git fetch/push with it)`
       );
     }
+    try {
+      const foreign = findForeignAgentIdsInMcpConfig({
+        mcpConfigText: readFileSync7(mcpConfigPath, "utf8"),
+        agentId: config.agentId
+      });
+      if (foreign.length > 0) {
+        log2(
+          `[persistent-session] AGENT ID CONFLICT agent=${codeName} spawning-as=${config.agentId} but .mcp.json carries ${foreign.join(", ")} \u2014 broker lookups keyed on the agent id (the agt-bin/gh GitHub shim) will resolve to the wrong agent and return "Integration not found"`
+        );
+      }
+    } catch {
+    }
     const child = spawn2("tmux", [
       "new-session",
       "-d",
@@ -15627,6 +15663,7 @@ export {
   REQUIRED_SPAWN_ENV,
   buildSpawnEnv,
   findMissingSpawnEnv,
+  findForeignAgentIdsInMcpConfig,
   paneLogPath,
   rotatePaneLogForDayRollover,
   readPaneLogTail,
@@ -15654,4 +15691,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-TPJ57PWU.js.map
+//# sourceMappingURL=chunk-N6HD5UG4.js.map