@integrity-labs/agt-cli 0.28.546 → 0.28.547

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-7WHF3QRW.js";
+} from "../chunk-SYHPBJK7.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-QPSEQLSI.js";
+} from "../chunk-ST4PZ6RF.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4834,7 +4834,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.546" : "dev";
+var cliVersion = true ? "0.28.547" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6006,7 +6006,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.546" : "dev";
+var cliVersion2 = true ? "0.28.547" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-QPSEQLSI.js → chunk-ST4PZ6RF.js}

@@ -15694,4 +15694,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-QPSEQLSI.js.map
+//# sourceMappingURL=chunk-ST4PZ6RF.js.map

package/dist/{chunk-7WHF3QRW.js → chunk-SYHPBJK7.js}

@@ -42,7 +42,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-QPSEQLSI.js";
+} from "./chunk-ST4PZ6RF.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5549,7 +5549,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.546" : "dev";
+var agtCliVersion = true ? "0.28.547" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8861,4 +8861,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-7WHF3QRW.js.map
+//# sourceMappingURL=chunk-SYHPBJK7.js.map

package/dist/{claude-pair-runtime-R3R5OWDM.js → claude-pair-runtime-TZKJGXZU.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-FM5746XM.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-KVONGDAL.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-R3R5OWDM.js.map
+//# sourceMappingURL=claude-pair-runtime-TZKJGXZU.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-7WHF3QRW.js";
+} from "../chunk-SYHPBJK7.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -181,7 +181,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-QPSEQLSI.js";
+} from "../chunk-ST4PZ6RF.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -10455,7 +10455,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.546" : "dev";
+var agtCliVersion = true ? "0.28.547" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11759,7 +11759,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-FM5746XM.js");
+      const { collectDiagnostics } = await import("../persistent-session-KVONGDAL.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11867,7 +11867,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-FM5746XM.js");
+      const { collectDiagnostics } = await import("../persistent-session-KVONGDAL.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11990,7 +11990,7 @@ async function pollCycle() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-WZMDBY3T.js");
+      } = await import("../responsiveness-probe-OUHRYJYH.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -12081,7 +12081,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-WZMDBY3T.js");
+        } = await import("../responsiveness-probe-OUHRYJYH.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15611,7 +15611,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-FM5746XM.js");
+        const { collectDiagnostics } = await import("../persistent-session-KVONGDAL.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15661,7 +15661,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-FM5746XM.js");
+      const { collectDiagnostics } = await import("../persistent-session-KVONGDAL.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -16185,7 +16185,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-R3R5OWDM.js");
+  } = await import("../claude-pair-runtime-TZKJGXZU.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/augmented-admin.js

@@ -1094,11 +1094,11 @@ var require_util = __commonJS({
       return false;
     }
     exports.schemaHasRules = schemaHasRules;
-    function schemaHasRulesButRef(schema, RULES) {
+    function schemaHasRulesButRef(schema, RULES2) {
       if (typeof schema == "boolean")
         return !schema;
       for (const key in schema)
-        if (key !== "$ref" && RULES.all[key])
+        if (key !== "$ref" && RULES2.all[key])
           return true;
       return false;
     }
@@ -2492,17 +2492,17 @@ var require_validate = __commonJS({
     }
     function schemaKeywords(it, types, typeErrors, errsCount) {
       const { gen, schema, data, allErrors, opts, self } = it;
-      const { RULES } = self;
-      if (schema.$ref && (opts.ignoreKeywordsWithRef || !(0, util_1.schemaHasRulesButRef)(schema, RULES))) {
-        gen.block(() => keywordCode(it, "$ref", RULES.all.$ref.definition));
+      const { RULES: RULES2 } = self;
+      if (schema.$ref && (opts.ignoreKeywordsWithRef || !(0, util_1.schemaHasRulesButRef)(schema, RULES2))) {
+        gen.block(() => keywordCode(it, "$ref", RULES2.all.$ref.definition));
         return;
       }
       if (!opts.jtd)
         checkStrictTypes(it, types);
       gen.block(() => {
-        for (const group of RULES.rules)
+        for (const group of RULES2.rules)
           groupKeywords(group);
-        groupKeywords(RULES.post);
+        groupKeywords(RULES2.post);
       });
       function groupKeywords(group) {
         if (!(0, applicability_1.shouldUseGroup)(schema, group))
@@ -4204,10 +4204,10 @@ var require_core = __commonJS({
       }
       // Remove keyword
       removeKeyword(keyword) {
-        const { RULES } = this;
-        delete RULES.keywords[keyword];
-        delete RULES.all[keyword];
-        for (const group of RULES.rules) {
+        const { RULES: RULES2 } = this;
+        delete RULES2.keywords[keyword];
+        delete RULES2.all[keyword];
+        for (const group of RULES2.rules) {
           const i = group.rules.findIndex((rule) => rule.keyword === keyword);
           if (i >= 0)
             group.rules.splice(i, 1);
@@ -4375,9 +4375,9 @@ var require_core = __commonJS({
     }
     var KEYWORD_NAME = /^[a-z_$][a-z0-9_$:-]*$/i;
     function checkKeyword(keyword, def) {
-      const { RULES } = this;
+      const { RULES: RULES2 } = this;
       (0, util_1.eachItem)(keyword, (kwd) => {
-        if (RULES.keywords[kwd])
+        if (RULES2.keywords[kwd])
           throw new Error(`Keyword ${kwd} is already defined`);
         if (!KEYWORD_NAME.test(kwd))
           throw new Error(`Keyword ${kwd} has invalid name`);
@@ -4393,13 +4393,13 @@ var require_core = __commonJS({
       const post = definition === null || definition === void 0 ? void 0 : definition.post;
       if (dataType && post)
         throw new Error('keyword with "post" flag cannot have "type"');
-      const { RULES } = this;
-      let ruleGroup = post ? RULES.post : RULES.rules.find(({ type: t }) => t === dataType);
+      const { RULES: RULES2 } = this;
+      let ruleGroup = post ? RULES2.post : RULES2.rules.find(({ type: t }) => t === dataType);
       if (!ruleGroup) {
         ruleGroup = { type: dataType, rules: [] };
-        RULES.rules.push(ruleGroup);
+        RULES2.rules.push(ruleGroup);
       }
-      RULES.keywords[keyword] = true;
+      RULES2.keywords[keyword] = true;
       if (!definition)
         return;
       const rule = {
@@ -4414,7 +4414,7 @@ var require_core = __commonJS({
         addBeforeRule.call(this, ruleGroup, rule, definition.before);
       else
         ruleGroup.rules.push(rule);
-      RULES.all[keyword] = rule;
+      RULES2.all[keyword] = rule;
       (_a = definition.implements) === null || _a === void 0 ? void 0 : _a.forEach((kwd) => this.addKeyword(kwd));
     }
     function addBeforeRule(ruleGroup, rule, before) {
@@ -20985,7 +20985,63 @@ var StdioServerTransport = class {
   }
 };
 
+// src/redact.ts
+var REDACTED = "[redacted]";
+var MAX_RELAYED_MESSAGE_CHARS = 600;
+function truncationMarker(dropped) {
+  return `\u2026 [truncated, ${dropped} chars]`;
+}
+function truncateWithMarker(text, max) {
+  if (text.length <= max) return text;
+  let keep = max;
+  for (let i = 0; i < 8; i++) {
+    const candidate = Math.max(0, max - truncationMarker(text.length - keep).length);
+    if (candidate === keep) break;
+    keep = candidate;
+  }
+  return text.slice(0, keep) + truncationMarker(text.length - keep);
+}
+var RULES = [
+  // Authorization headers, with or without a scheme.
+  { name: "authorization-header", pattern: /\b(authorization\s*[:=]\s*)(?:bearer\s+|basic\s+)?\S+/gi, replace: `$1${REDACTED}` },
+  { name: "bearer", pattern: /\bbearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, replace: `Bearer ${REDACTED}` },
+  // Cookies.
+  { name: "cookie-header", pattern: /\b(set-cookie|cookie)\s*[:=]\s*\S+/gi, replace: `$1: ${REDACTED}` },
+  // JWTs — three base64url segments. Caught before generic blobs.
+  { name: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g, replace: REDACTED },
+  // Platform + vendor key prefixes. `tlk_` is ours (host API keys).
+  { name: "prefixed-key", pattern: /\b(?:tlk|sk|pk|rk|gho|ghp|ghu|ghs|ghr|github_pat|xoxb|xoxp|xoxa|xapp|lin_api|shpat|shpss)[_-][A-Za-z0-9_-]{8,}/gi, replace: REDACTED },
+  // AWS access key ids.
+  { name: "aws-access-key-id", pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{12,}\b/g, replace: REDACTED },
+  // Presigned-URL signature params and their friends.
+  { name: "signature-param", pattern: /\b(X-Amz-Signature|X-Amz-Security-Token|X-Amz-Credential|Signature|sig)=[^&\s"']+/gi, replace: `$1=${REDACTED}` },
+  // Generic secret-bearing key=value / key: value pairs.
+  { name: "secret-kv", pattern: /\b(password|passwd|pwd|secret|token|api[-_]?key|access[-_]?key|private[-_]?key|client[-_]?secret|refresh[-_]?token|session[-_]?token|credential)s?\s*[:=]\s*(?:"[^"]*"|'[^']*'|\S+)/gi, replace: `$1=${REDACTED}` },
+  // PEM blocks.
+  { name: "pem", pattern: /-----BEGIN[^-]{0,64}-----[\s\S]*?-----END[^-]{0,64}-----/g, replace: REDACTED }
+];
+function redactSensitive(message) {
+  let out = message;
+  for (const rule of RULES) {
+    out = out.replace(rule.pattern, rule.replace);
+  }
+  out = out.replace(/\s+/g, " ").trim();
+  return truncateWithMarker(out, MAX_RELAYED_MESSAGE_CHARS);
+}
+
 // src/broker-client.ts
+var REDACTED_ONLY = REDACTED;
+function serverMessageFrom(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  for (const key of ["error", "reason"]) {
+    const v = payload[key];
+    if (typeof v === "string" && v.trim() !== "") {
+      const safe = redactSensitive(v);
+      return safe.trim() === "" || safe.trim() === REDACTED_ONLY ? null : safe;
+    }
+  }
+  return null;
+}
 function makeError(status, message, detail) {
   const err = new Error(message);
   err.status = status;
@@ -21070,7 +21126,7 @@ var AdminDebugClient = class _AdminDebugClient {
       parseFailed = true;
     }
     if (!res.ok) {
-      const message = payload && typeof payload === "object" && "error" in payload && typeof payload.error === "string" ? payload.error : `admin-debug request failed: ${res.status}`;
+      const message = serverMessageFrom(payload) ?? `admin-debug request failed: ${res.status}`;
       throw makeError(res.status, message, payload);
     }
     if (parseFailed) {
@@ -21195,7 +21251,7 @@ var AdminDebugClient = class _AdminDebugClient {
       parseFailed = true;
     }
     if (!res.ok) {
-      const message = payload && typeof payload === "object" && "error" in payload && typeof payload.error === "string" ? payload.error : `admin-debug request failed: ${res.status}`;
+      const message = serverMessageFrom(payload) ?? `admin-debug request failed: ${res.status}`;
       throw makeError(res.status, message, payload);
     }
     if (parseFailed) {

package/dist/{persistent-session-FM5746XM.js → persistent-session-KVONGDAL.js}

@@ -41,7 +41,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-QPSEQLSI.js";
+} from "./chunk-ST4PZ6RF.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -87,4 +87,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-FM5746XM.js.map
+//# sourceMappingURL=persistent-session-KVONGDAL.js.map

package/dist/{responsiveness-probe-WZMDBY3T.js → responsiveness-probe-OUHRYJYH.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-QPSEQLSI.js";
+} from "./chunk-ST4PZ6RF.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -689,4 +689,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-WZMDBY3T.js.map
+//# sourceMappingURL=responsiveness-probe-OUHRYJYH.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.546",
+  "version": "0.28.547",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {