@integrity-labs/agt-cli 0.28.546 → 0.28.548

package/dist/mcp/augmented-admin.js

@@ -1094,11 +1094,11 @@ var require_util = __commonJS({
       return false;
     }
     exports.schemaHasRules = schemaHasRules;
-    function schemaHasRulesButRef(schema, RULES) {
+    function schemaHasRulesButRef(schema, RULES2) {
       if (typeof schema == "boolean")
         return !schema;
       for (const key in schema)
-        if (key !== "$ref" && RULES.all[key])
+        if (key !== "$ref" && RULES2.all[key])
           return true;
       return false;
     }
@@ -2492,17 +2492,17 @@ var require_validate = __commonJS({
     }
     function schemaKeywords(it, types, typeErrors, errsCount) {
       const { gen, schema, data, allErrors, opts, self } = it;
-      const { RULES } = self;
-      if (schema.$ref && (opts.ignoreKeywordsWithRef || !(0, util_1.schemaHasRulesButRef)(schema, RULES))) {
-        gen.block(() => keywordCode(it, "$ref", RULES.all.$ref.definition));
+      const { RULES: RULES2 } = self;
+      if (schema.$ref && (opts.ignoreKeywordsWithRef || !(0, util_1.schemaHasRulesButRef)(schema, RULES2))) {
+        gen.block(() => keywordCode(it, "$ref", RULES2.all.$ref.definition));
         return;
       }
       if (!opts.jtd)
         checkStrictTypes(it, types);
       gen.block(() => {
-        for (const group of RULES.rules)
+        for (const group of RULES2.rules)
           groupKeywords(group);
-        groupKeywords(RULES.post);
+        groupKeywords(RULES2.post);
       });
       function groupKeywords(group) {
         if (!(0, applicability_1.shouldUseGroup)(schema, group))
@@ -4204,10 +4204,10 @@ var require_core = __commonJS({
       }
       // Remove keyword
       removeKeyword(keyword) {
-        const { RULES } = this;
-        delete RULES.keywords[keyword];
-        delete RULES.all[keyword];
-        for (const group of RULES.rules) {
+        const { RULES: RULES2 } = this;
+        delete RULES2.keywords[keyword];
+        delete RULES2.all[keyword];
+        for (const group of RULES2.rules) {
           const i = group.rules.findIndex((rule) => rule.keyword === keyword);
           if (i >= 0)
             group.rules.splice(i, 1);
@@ -4375,9 +4375,9 @@ var require_core = __commonJS({
     }
     var KEYWORD_NAME = /^[a-z_$][a-z0-9_$:-]*$/i;
     function checkKeyword(keyword, def) {
-      const { RULES } = this;
+      const { RULES: RULES2 } = this;
       (0, util_1.eachItem)(keyword, (kwd) => {
-        if (RULES.keywords[kwd])
+        if (RULES2.keywords[kwd])
           throw new Error(`Keyword ${kwd} is already defined`);
         if (!KEYWORD_NAME.test(kwd))
           throw new Error(`Keyword ${kwd} has invalid name`);
@@ -4393,13 +4393,13 @@ var require_core = __commonJS({
       const post = definition === null || definition === void 0 ? void 0 : definition.post;
       if (dataType && post)
         throw new Error('keyword with "post" flag cannot have "type"');
-      const { RULES } = this;
-      let ruleGroup = post ? RULES.post : RULES.rules.find(({ type: t }) => t === dataType);
+      const { RULES: RULES2 } = this;
+      let ruleGroup = post ? RULES2.post : RULES2.rules.find(({ type: t }) => t === dataType);
       if (!ruleGroup) {
         ruleGroup = { type: dataType, rules: [] };
-        RULES.rules.push(ruleGroup);
+        RULES2.rules.push(ruleGroup);
       }
-      RULES.keywords[keyword] = true;
+      RULES2.keywords[keyword] = true;
       if (!definition)
         return;
       const rule = {
@@ -4414,7 +4414,7 @@ var require_core = __commonJS({
         addBeforeRule.call(this, ruleGroup, rule, definition.before);
       else
         ruleGroup.rules.push(rule);
-      RULES.all[keyword] = rule;
+      RULES2.all[keyword] = rule;
       (_a = definition.implements) === null || _a === void 0 ? void 0 : _a.forEach((kwd) => this.addKeyword(kwd));
     }
     function addBeforeRule(ruleGroup, rule, before) {
@@ -20985,7 +20985,63 @@ var StdioServerTransport = class {
   }
 };
 
+// src/redact.ts
+var REDACTED = "[redacted]";
+var MAX_RELAYED_MESSAGE_CHARS = 600;
+function truncationMarker(dropped) {
+  return `\u2026 [truncated, ${dropped} chars]`;
+}
+function truncateWithMarker(text, max) {
+  if (text.length <= max) return text;
+  let keep = max;
+  for (let i = 0; i < 8; i++) {
+    const candidate = Math.max(0, max - truncationMarker(text.length - keep).length);
+    if (candidate === keep) break;
+    keep = candidate;
+  }
+  return text.slice(0, keep) + truncationMarker(text.length - keep);
+}
+var RULES = [
+  // Authorization headers, with or without a scheme.
+  { name: "authorization-header", pattern: /\b(authorization\s*[:=]\s*)(?:bearer\s+|basic\s+)?\S+/gi, replace: `$1${REDACTED}` },
+  { name: "bearer", pattern: /\bbearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, replace: `Bearer ${REDACTED}` },
+  // Cookies.
+  { name: "cookie-header", pattern: /\b(set-cookie|cookie)\s*[:=]\s*\S+/gi, replace: `$1: ${REDACTED}` },
+  // JWTs — three base64url segments. Caught before generic blobs.
+  { name: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g, replace: REDACTED },
+  // Platform + vendor key prefixes. `tlk_` is ours (host API keys).
+  { name: "prefixed-key", pattern: /\b(?:tlk|sk|pk|rk|gho|ghp|ghu|ghs|ghr|github_pat|xoxb|xoxp|xoxa|xapp|lin_api|shpat|shpss)[_-][A-Za-z0-9_-]{8,}/gi, replace: REDACTED },
+  // AWS access key ids.
+  { name: "aws-access-key-id", pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{12,}\b/g, replace: REDACTED },
+  // Presigned-URL signature params and their friends.
+  { name: "signature-param", pattern: /\b(X-Amz-Signature|X-Amz-Security-Token|X-Amz-Credential|Signature|sig)=[^&\s"']+/gi, replace: `$1=${REDACTED}` },
+  // Generic secret-bearing key=value / key: value pairs.
+  { name: "secret-kv", pattern: /\b(password|passwd|pwd|secret|token|api[-_]?key|access[-_]?key|private[-_]?key|client[-_]?secret|refresh[-_]?token|session[-_]?token|credential)s?\s*[:=]\s*(?:"[^"]*"|'[^']*'|\S+)/gi, replace: `$1=${REDACTED}` },
+  // PEM blocks.
+  { name: "pem", pattern: /-----BEGIN[^-]{0,64}-----[\s\S]*?-----END[^-]{0,64}-----/g, replace: REDACTED }
+];
+function redactSensitive(message) {
+  let out = message;
+  for (const rule of RULES) {
+    out = out.replace(rule.pattern, rule.replace);
+  }
+  out = out.replace(/\s+/g, " ").trim();
+  return truncateWithMarker(out, MAX_RELAYED_MESSAGE_CHARS);
+}
+
 // src/broker-client.ts
+var REDACTED_ONLY = REDACTED;
+function serverMessageFrom(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  for (const key of ["error", "reason"]) {
+    const v = payload[key];
+    if (typeof v === "string" && v.trim() !== "") {
+      const safe = redactSensitive(v);
+      return safe.trim() === "" || safe.trim() === REDACTED_ONLY ? null : safe;
+    }
+  }
+  return null;
+}
 function makeError(status, message, detail) {
   const err = new Error(message);
   err.status = status;
@@ -21070,7 +21126,7 @@ var AdminDebugClient = class _AdminDebugClient {
       parseFailed = true;
     }
     if (!res.ok) {
-      const message = payload && typeof payload === "object" && "error" in payload && typeof payload.error === "string" ? payload.error : `admin-debug request failed: ${res.status}`;
+      const message = serverMessageFrom(payload) ?? `admin-debug request failed: ${res.status}`;
       throw makeError(res.status, message, payload);
     }
     if (parseFailed) {
@@ -21195,7 +21251,7 @@ var AdminDebugClient = class _AdminDebugClient {
       parseFailed = true;
     }
     if (!res.ok) {
-      const message = payload && typeof payload === "object" && "error" in payload && typeof payload.error === "string" ? payload.error : `admin-debug request failed: ${res.status}`;
+      const message = serverMessageFrom(payload) ?? `admin-debug request failed: ${res.status}`;
       throw makeError(res.status, message, payload);
     }
     if (parseFailed) {

package/dist/{persistent-session-FM5746XM.js → persistent-session-KVONGDAL.js}

@@ -41,7 +41,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-QPSEQLSI.js";
+} from "./chunk-ST4PZ6RF.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -87,4 +87,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-FM5746XM.js.map
+//# sourceMappingURL=persistent-session-KVONGDAL.js.map

package/dist/{responsiveness-probe-WZMDBY3T.js → responsiveness-probe-OUHRYJYH.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-QPSEQLSI.js";
+} from "./chunk-ST4PZ6RF.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -689,4 +689,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-WZMDBY3T.js.map
+//# sourceMappingURL=responsiveness-probe-OUHRYJYH.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.546",
+  "version": "0.28.548",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {