@integrity-labs/agt-cli 0.28.568 → 0.28.570

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-VGMO43EI.js";
+} from "../chunk-LNLLMDJJ.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-FSWAPB5J.js";
+} from "../chunk-6XCGZUSS.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -542,9 +542,28 @@ async function initCommand(opts) {
     loggingMode = await select({
       message: "Logging mode:",
       choices: [
-        { value: "redacted", name: "Redacted \u2014 PII stripped" },
-        { value: "hash-only", name: "Hash-only \u2014 content is hashed" },
-        { value: "full-local", name: "Full local \u2014 plain text (dev only)" }
+        // ENG-8726: all three labels used to promise more than the runtime
+        // delivers, and the operator picks a governance mode from this list.
+        // `hash-only` read "content is hashed" — in the tool-call audit log such
+        // an agent discloses NO target at all, not a hashed one. `redacted` read
+        // "PII stripped", which nothing enforces: normal audit redaction still
+        // emits the program name, the URL host and the MCP tool segment, and a
+        // private host can name a customer. `full-local` read "plain text",
+        // which invites the reading that it unlocks plaintext paths in the
+        // control plane — no mode does; file paths are keyed-hashed for all
+        // three. (CodeRabbit.)
+        {
+          value: "redacted",
+          name: "Redacted \u2014 file paths keyed-hashed; tool, program and URL host still recorded"
+        },
+        {
+          value: "hash-only",
+          name: "Hash-only \u2014 strictest: the audit log records which tool ran, never what it touched"
+        },
+        {
+          value: "full-local",
+          name: "Full local \u2014 same audit redaction as Redacted; plaintext stays host-side (dev only)"
+        }
       ]
     });
   }
@@ -4834,7 +4853,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.568" : "dev";
+var cliVersion = true ? "0.28.570" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6009,7 +6028,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.568" : "dev";
+var cliVersion2 = true ? "0.28.570" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {