@integrity-labs/agt-cli 0.28.64 → 0.28.66

package/dist/bin/agt.js

@@ -37,7 +37,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-JY3LAHBG.js";
+} from "../chunk-MYAMDJGD.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -4777,7 +4777,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.64" : "dev";
+var cliVersion = true ? "0.28.66" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5791,7 +5791,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.64" : "dev";
+var cliVersion2 = true ? "0.28.66" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-JY3LAHBG.js → chunk-MYAMDJGD.js}

@@ -7347,7 +7347,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.64" : "dev";
+var agtCliVersion = true ? "0.28.66" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8643,4 +8643,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-JY3LAHBG.js.map
+//# sourceMappingURL=chunk-MYAMDJGD.js.map

package/dist/lib/manager-worker.js

@@ -27,7 +27,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-JY3LAHBG.js";
+} from "../chunk-MYAMDJGD.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -6734,7 +6734,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.64" : "dev";
+var agtCliVersion = true ? "0.28.66" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/index.js

@@ -21078,6 +21078,129 @@ function writeAgentRestartFlag(codeName, reason, nowMs) {
   return path;
 }
 
+// src/approval-tools.ts
+function statusToOutcome(status) {
+  switch (status) {
+    case "active":
+    case "auto_approve":
+      return "approved";
+    case "denied":
+    case "hard_deny":
+      return "denied";
+    case "expired":
+      return "timed_out";
+    case "cancelled":
+    case "revoked":
+      return "cancelled";
+    case "pending":
+      return "pending";
+    default:
+      return "error";
+  }
+}
+function render(result) {
+  const lines = [result.note ?? "", JSON.stringify({
+    request_id: result.request_id,
+    outcome: result.outcome,
+    ...result.reason ? { reason: result.reason } : {},
+    ...result.result_payload != null ? { result_payload: result.result_payload } : {},
+    ...result.expires_at ? { expires_at: result.expires_at } : {}
+  })].filter(Boolean);
+  return { content: [{ type: "text", text: lines.join("\n") }] };
+}
+function registerApprovalTools(server2, deps) {
+  const { agentId, apiPost: apiPost2, apiGet: apiGet2 } = deps;
+  server2.tool(
+    "request_approval",
+    "Ask a human (your Manager) to approve an action before you take it, then END YOUR TURN \u2014 this does NOT block your session. You get back a request_id; later call check_approval(request_id) to see the verdict (it survives a restart \u2014 re-attach by the same id). NOTIFY-ONLY: on approval the platform does nothing \u2014 YOU perform the action. Use for actions outside your standing authority where a person must sign off.",
+    {
+      summary: external_exports.string().min(1).max(280).describe('One line describing the action you want approved (shown to the approver). E.g. "Send the Q3 report to the external auditor".'),
+      reason: external_exports.string().min(1).max(280).describe("Why you need it / context for the approver. Keep it specific."),
+      idempotency_key: external_exports.string().min(1).max(200).describe("A stable exactly-once key YOU choose for this ask (e.g. a task id + action). Retrying with the same key + same details re-attaches to the same request instead of filing a duplicate."),
+      detail: external_exports.record(external_exports.unknown()).optional().describe("Optional structured context for the approver (display + audit only; never executed)."),
+      ttl_seconds: external_exports.number().int().optional().describe("How long the request stays open before it times out (default 3600; clamped to [60, 86400]).")
+    },
+    async (params) => {
+      try {
+        const resp = await apiPost2("/approvals", {
+          agent_id: agentId,
+          summary: params.summary,
+          reason: params.reason,
+          idempotency_key: params.idempotency_key,
+          detail: params.detail,
+          ttl_seconds: params.ttl_seconds
+        });
+        const outcome = resp.outcome ?? statusToOutcome(resp.status);
+        const note = resp.duplicate ? `An open request for this idempotency_key already exists \u2014 re-attached to it (request_id ${resp.request_id}). Poll it with check_approval.` : resp.notification_status === "failed" ? `Approval filed (request_id ${resp.request_id}) but the Manager notification failed (${resp.notification_failure_reason ?? "unknown"}) \u2014 tell your operator. Poll with check_approval.` : `Approval requested (request_id ${resp.request_id}). Your Manager was notified. End your turn; poll with check_approval later.`;
+        return render({ request_id: resp.request_id, outcome, expires_at: resp.expires_at ?? null, note });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Could not file the approval request: ${msg}
+` + JSON.stringify({ request_id: "", outcome: "error", reason: msg })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server2.tool(
+    "check_approval",
+    "Check the verdict on an approval you requested earlier (by request_id from request_approval). Returns one of: approved | denied | timed_out | cancelled | pending | error. While 'pending', do nothing and check again later. Safe to call after a restart \u2014 the request is durable and you re-attach by id.",
+    {
+      request_id: external_exports.string().min(1).describe("The request_id returned by request_approval.")
+    },
+    async (params) => {
+      try {
+        const resp = await apiGet2(
+          `/approvals/${encodeURIComponent(params.request_id)}?agent_id=${encodeURIComponent(agentId)}`
+        );
+        return render({
+          request_id: resp.request_id,
+          outcome: resp.outcome,
+          reason: resp.reason,
+          result_payload: resp.result_payload,
+          expires_at: resp.expires_at
+        });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+          content: [{ type: "text", text: `Could not check approval ${params.request_id}: ${msg}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server2.tool(
+    "cancel_approval",
+    "Withdraw an approval request you no longer need (only works while it is still pending). The Manager stops being asked. Use when the underlying need went away.",
+    {
+      request_id: external_exports.string().min(1).describe("The request_id to withdraw."),
+      reason: external_exports.string().max(280).optional().describe("Optional short note on why you are withdrawing.")
+    },
+    async (params) => {
+      try {
+        const resp = await apiPost2(
+          `/approvals/${encodeURIComponent(params.request_id)}/cancel`,
+          { agent_id: agentId, reason: params.reason ?? "" }
+        );
+        const note = resp.outcome === "cancelled" ? `Withdrew approval request ${resp.request_id}.` : `Could not withdraw \u2014 the request is already ${resp.status}.`;
+        return render({ request_id: resp.request_id, outcome: resp.outcome, note });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+          content: [{ type: "text", text: `Could not cancel approval ${params.request_id}: ${msg}` }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
 // src/index.ts
 import { spawn } from "child_process";
 var DeliveryTargetSchema = external_exports.union([
@@ -21198,10 +21321,47 @@ async function apiPost(path, body, retried = false, timeoutMs = 15e3) {
     clearTimeout(timeout);
   }
 }
+async function apiGet(path, retried = false, timeoutMs = 15e3) {
+  const token = await getToken();
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(`${AGT_HOST}${path}`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+    if (res.status === 401 && AGT_API_KEY && !AGT_AGENT_SESSION_TOKEN && !retried) {
+      clearTimeout(timeout);
+      tokenExpiresAt = 0;
+      return apiGet(path, true, timeoutMs);
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => res.statusText);
+      if (res.status === 401 && AGT_AGENT_SESSION_TOKEN) {
+        throw new Error(
+          `API ${path} returned 401: agent-session rejected (expired or revoked). Re-run \`agt impersonate connect\` to mint a fresh session. (${text})`
+        );
+      }
+      throw new Error(`API ${path} returned ${res.status}: ${text}`);
+    }
+    return await res.json();
+  } catch (err) {
+    if (err instanceof DOMException && err.name === "AbortError") {
+      throw new Error(`API ${path} timed out after ${timeoutMs}ms`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 var server = new McpServer({
   name: "augmented",
   version: "0.1.0"
 });
+if (AGT_AGENT_ID) {
+  registerApprovalTools(server, { agentId: AGT_AGENT_ID, apiPost, apiGet });
+}
 server.tool(
   "kanban_list",
   'List kanban board items for this agent. Returns active items plus only the most recently completed work (last 24h). This is a NARROW, recency-windowed view \u2014 older done cards are NOT here (only done cards are windowed; failed and active cards always show). Before telling anyone you have "no record" of past work, use kanban_search, which covers your full history.',
@@ -22387,6 +22547,10 @@ async function forwardToolCall(toolName, args) {
   );
 }
 var LOCAL_TOOL_NAMES = /* @__PURE__ */ new Set([
+  // ENG-6452: generic agent-approval seam (always registered locally).
+  "request_approval",
+  "check_approval",
+  "cancel_approval",
   "kanban_list",
   "kanban_search",
   "kanban_add",

package/dist/mcp/slack-channel.js

@@ -17853,15 +17853,13 @@ async function forwardOnboardingSlashCommand(opts) {
     return;
   }
   try {
-    const res = await fetch(`${AGT_HOST}/host${path}`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json; charset=utf-8",
-        Authorization: `Bearer ${AGT_API_KEY}`
-      },
-      body: JSON.stringify({ agent_id: AGT_AGENT_ID }),
-      signal: AbortSignal.timeout(SLACK_DOWNLOAD_TIMEOUT_MS)
-    });
+    const { apiCall: apiCall2 } = await Promise.resolve().then(() => (init_ask_user_runtime(), ask_user_runtime_exports));
+    const cfg = {
+      apiHost: AGT_HOST,
+      apiKey: AGT_API_KEY,
+      agentId: AGT_AGENT_ID
+    };
+    const res = await apiCall2(cfg, "POST", `/host${path}`, { agent_id: AGT_AGENT_ID });
     const data = await res.json();
     const text = data.ok ? `\u{1F504} ${data.message ?? "Onboarding updated."}` : `:x: \`${verb}\` failed${data.error ? `: ${data.error}` : "."}`;
     await postEphemeralViaResponseUrl(responseUrl, text, codeName);

package/dist/mcp/telegram-channel.js

@@ -17123,14 +17123,14 @@ async function handleOnboardingCommand(opts) {
     return;
   }
   try {
-    const res = await fetch(`${AGT_HOST}/host/onboarding/${opts.mode}`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json; charset=utf-8",
-        Authorization: `Bearer ${AGT_API_KEY}`
-      },
-      body: JSON.stringify({ agent_id: AGT_AGENT_ID }),
-      signal: AbortSignal.timeout(1e4)
+    const { apiCall: apiCall2 } = await Promise.resolve().then(() => (init_ask_user_runtime(), ask_user_runtime_exports));
+    const cfg = {
+      apiHost: AGT_HOST,
+      apiKey: AGT_API_KEY,
+      agentId: AGT_AGENT_ID
+    };
+    const res = await apiCall2(cfg, "POST", `/host/onboarding/${opts.mode}`, {
+      agent_id: AGT_AGENT_ID
     });
     const data = await res.json();
     process.stderr.write(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.64",
+  "version": "0.28.66",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {