@integrity-labs/agt-cli 0.28.672 → 0.28.674

package/dist/{chunk-YOID6KOQ.js → chunk-AJNES24H.js}

@@ -5538,14 +5538,13 @@ var FLAG_REGISTRY = [
     // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
     defaultValue: false,
     // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
-    // dist carries this host-side reader. That build is the one THIS PR's merge
-    // auto-publishes — unknown until then, and every already-published version
-    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
-    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
-    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
-    // while they still write tokens to disk). MUST be updated to the actual
-    // published version once the release lands (tracked on ENG-9350).
-    since: "99.0.0"
+    // dist carries this host-side reader. The ENG-9350 merge auto-published
+    // 0.28.672, and `npm pack @integrity-labs/agt-cli@0.28.672` confirms its
+    // bundled dist contains `spawn-inject-channel-secrets` (the reader) — every
+    // earlier 0.28.x lacks it. So hosts on ≥ 0.28.672 honor a flip; older ones
+    // no-op until they self-update. (Replaced the 99.0.0 fail-safe placeholder
+    // the flag shipped with before this build was known.)
+    since: "0.28.672"
   },
   {
     key: "scheduled-task-confirmation-card",
@@ -10559,6 +10558,30 @@ var USER_PRINCIPAL_SCOPE_LABELS = {
 // ../../packages/core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
+// ../../packages/core/dist/redaction/index.js
+var SECRET_PATTERNS = [
+  // Augmented host API keys
+  { re: /tlk_[A-Za-z0-9]{8,}/g, label: "agt-api-key" },
+  // Slack tokens: bot/app/user/refresh/config
+  { re: /x(?:ox[abprs]|app)-[A-Za-z0-9-]{8,}/g, label: "slack-token" },
+  // JWTs (three base64url segments, first always starts with eyJ)
+  { re: /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, label: "jwt" },
+  // OpenAI / Anthropic-style keys (sk-..., sk-ant-...)
+  { re: /sk-[A-Za-z0-9_-]{16,}/g, label: "sk-key" },
+  // AWS access key IDs
+  { re: /(?:AKIA|ASIA)[0-9A-Z]{16}/g, label: "aws-key" },
+  // GitHub tokens
+  { re: /gh[pousr]_[A-Za-z0-9]{20,}/g, label: "github-token" },
+  // Telegram bot tokens: <8-10 digit bot id>:<35-char secret> (ENG-9353).
+  { re: /[0-9]{8,10}:[A-Za-z0-9_-]{35}/g, label: "telegram-bot-token" },
+  // Bearer authorization tokens (opaque or JWT). The 16+ length floor keeps
+  // ordinary "Bearer authentication" prose intact — real bearer tokens are far
+  // longer than any common word. `[ \t]+` (not `\s+`) so the match cannot span a
+  // newline and swallow the line break, changing the log's line structure
+  // (ENG-9353).
+  { re: /[Bb]earer[ \t]+[A-Za-z0-9._-]{16,}/g, label: "bearer-token" }
+];
+
 // ../../packages/core/dist/drift/comparators.js
 function compareToolPolicy(expected, actual) {
   const findings = [];
@@ -12404,6 +12427,7 @@ export {
   describeOnboardingChannel,
   coerceOnboardingState,
   laneTagFragment,
+  SECRET_PATTERNS,
   detectDrift,
   SUPPRESS_SENTINEL,
   classifyOutput,
@@ -12474,4 +12498,4 @@ export {
   minutesSinceLocalMidnight,
   peekCurrentSession
 };
-//# sourceMappingURL=chunk-YOID6KOQ.js.map
+//# sourceMappingURL=chunk-AJNES24H.js.map