@integrity-labs/agt-cli 0.28.694 → 0.28.696

package/dist/bin/agt.js

@@ -40,10 +40,10 @@ import {
   success,
   table,
   warn
-} from "../chunk-7F4RC4PU.js";
+} from "../chunk-WB6ERJPU.js";
 import {
   readDirectChatSessionState
-} from "../chunk-YLADZNC5.js";
+} from "../chunk-QCYRC5FK.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -73,7 +73,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-NYWCE5JH.js";
+} from "../chunk-Y7AHOXHP.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.694" : "dev";
+var cliVersion = true ? "0.28.696" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.694" : "dev";
+var cliVersion2 = true ? "0.28.696" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-YLADZNC5.js → chunk-QCYRC5FK.js}

@@ -17,7 +17,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-NYWCE5JH.js";
+} from "./chunk-Y7AHOXHP.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -4531,4 +4531,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-YLADZNC5.js.map
+//# sourceMappingURL=chunk-QCYRC5FK.js.map

package/dist/{chunk-7F4RC4PU.js → chunk-WB6ERJPU.js}

@@ -12,7 +12,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-YLADZNC5.js";
+} from "./chunk-QCYRC5FK.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -59,7 +59,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-NYWCE5JH.js";
+} from "./chunk-Y7AHOXHP.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6329,7 +6329,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.694" : "dev";
+var agtCliVersion = true ? "0.28.696" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10070,4 +10070,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-7F4RC4PU.js.map
+//# sourceMappingURL=chunk-WB6ERJPU.js.map

package/dist/{chunk-NYWCE5JH.js → chunk-Y7AHOXHP.js}

@@ -4936,7 +4936,7 @@ var FLAG_REGISTRY = [
   },
   {
     key: "tool-call-audit",
-    description: "Host-side tool-call audit extraction (ENG-8575, slice 3 of ENG-8427): the manager scans agent transcripts for tool calls, redacts each to identity-without-content, and POSTs them to /host/tool-calls. Boolean gate; ships dark \u2014 when off the manager reads no transcripts and sends nothing, so 0 agent_tool_calls rows fleet-wide is the expected steady state until it is armed. NOT the commercial gate: /host/tool-calls independently re-checks the advanced_governance entitlement and refuses regardless of this flag, because the host is customer-owned infrastructure. This flag is rollout control only.",
+    description: "Host-side tool-call audit extraction (ENG-8575, slice 3 of ENG-8427): the manager scans agent transcripts for tool calls, redacts each to identity-without-content, and POSTs them to /host/tool-calls. Boolean gate; when off the manager reads no transcripts and sends nothing. ARMED STAGE-WIDE SINCE 2026-08-17 \u2014 the compiled default below is what a host resolves when nothing else says otherwise, NOT a description of the fleet. This text once asserted the opposite and outlived its truth by nine days, which is what got ENG-9472 filed to arm an already-armed flag. Query the table, do not infer it from this line. NOT the commercial gate: /host/tool-calls independently re-checks the advanced_governance entitlement and refuses regardless of this flag, because the host is customer-owned infrastructure. This flag is rollout control only.",
     flagType: "boolean",
     // Declared safe value is `false` (no extraction). Fail-safe direction: a
     // flag-DB read error must never start shipping tool-call metadata across the
@@ -11129,6 +11129,111 @@ var SCHEDULED_TURN_MARKER_FILENAME = ".current-scheduled-turn.json";
 // ../../packages/core/dist/liveness/agent-liveness.js
 var FRESH_HEARTBEAT_THRESHOLD_MS = 2 * 60 * 1e3;
 
+// ../../packages/core/dist/claude-code-usage/reset-time.js
+var MONTHS = [
+  "jan",
+  "feb",
+  "mar",
+  "apr",
+  "may",
+  "jun",
+  "jul",
+  "aug",
+  "sep",
+  "oct",
+  "nov",
+  "dec"
+];
+var FULL_MONTHS = [
+  "january",
+  "february",
+  "march",
+  "april",
+  "may",
+  "june",
+  "july",
+  "august",
+  "september",
+  "october",
+  "november",
+  "december"
+];
+var MONTH_TOKENS = new Map([
+  ...MONTHS.map((m, i) => [m, i]),
+  ...FULL_MONTHS.map((m, i) => [m, i]),
+  // "Sept" is the one four-letter abbreviation in common use and is inside the
+  // {3,9} the grammar accepts, so it is reachable and must resolve.
+  ["sept", 8]
+]);
+var TIME_OF_DAY_SOURCE = /\d{1,2}(?::\d{2})?\s*(?:am|pm)(?:\s*\(?UTC\)?)?/.source;
+var RESET_DATE_SOURCE = `(?:[A-Za-z]{3,9}\\s+\\d{1,2}(?:\\s*,\\s*${TIME_OF_DAY_SOURCE})?|${TIME_OF_DAY_SOURCE})`;
+var TIME_TAIL = /,\s*(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\(?UTC\)?)?\s*$/i;
+var TIME_ONLY = /^(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\(?UTC\)?)?$/i;
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+function parseAmPm(hourStr, minStr, ampm) {
+  const rawHour = Number.parseInt(hourStr, 10);
+  if (!Number.isFinite(rawHour) || rawHour < 1 || rawHour > 12)
+    return null;
+  let minute = 0;
+  if (minStr) {
+    minute = Number.parseInt(minStr, 10);
+    if (!Number.isFinite(minute) || minute < 0 || minute > 59)
+      return null;
+  }
+  const isPm = ampm.toLowerCase() === "pm";
+  return { hour: rawHour % 12 + (isPm ? 12 : 0), minute };
+}
+function parseResetDateTime(humanDate, now) {
+  const trimmed = humanDate.trim();
+  const timeOnly = trimmed.match(TIME_ONLY);
+  if (timeOnly) {
+    const hm = parseAmPm(timeOnly[1], timeOnly[2], timeOnly[3]);
+    if (!hm)
+      return null;
+    const todayAt = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), hm.hour, hm.minute);
+    return {
+      at: new Date(todayAt <= now.getTime() ? todayAt + MS_PER_DAY : todayAt),
+      precision: "hour_only"
+    };
+  }
+  const timeMatch = trimmed.match(TIME_TAIL);
+  const dateOnly = timeMatch ? trimmed.slice(0, timeMatch.index).trim() : trimmed;
+  const parts = dateOnly.split(/\s+/);
+  if (parts.length !== 2)
+    return null;
+  const lookedUpMonth = MONTH_TOKENS.get(parts[0].toLowerCase());
+  if (lookedUpMonth === void 0)
+    return null;
+  const month = lookedUpMonth;
+  const day = Number.parseInt(parts[1], 10);
+  if (!Number.isFinite(day) || day < 1 || day > 31)
+    return null;
+  let hour = 0;
+  let minute = 0;
+  if (timeMatch) {
+    const hm = parseAmPm(timeMatch[1], timeMatch[2], timeMatch[3]);
+    if (!hm)
+      return null;
+    hour = hm.hour;
+    minute = hm.minute;
+  }
+  const baseYear = now.getUTCFullYear();
+  let resolved = null;
+  let bestDelta = Number.POSITIVE_INFINITY;
+  for (const y of [baseYear - 1, baseYear, baseYear + 1]) {
+    const candidate = new Date(Date.UTC(y, month, day, hour, minute));
+    if (candidate.getUTCFullYear() !== y || candidate.getUTCMonth() !== month || candidate.getUTCDate() !== day) {
+      continue;
+    }
+    const delta = Math.abs(candidate.getTime() - now.getTime());
+    if (delta < bestDelta) {
+      bestDelta = delta;
+      resolved = candidate;
+    }
+  }
+  return resolved ? { at: resolved, precision: "dated" } : null;
+}
+
 // ../../packages/core/dist/claude-code-usage/banner-parser.js
 var SESSION_QUALIFIER = /^(?:session|\d{1,2}\s*-?\s*hours?|\d{1,2}h)$/i;
 function classifyLimitScope(qualifier) {
@@ -11143,8 +11248,7 @@ function classifyLimitScope(qualifier) {
 }
 var SEP = /[\s·\-–—]+/.source;
 var SUBJECT = /(?:You(?:['’]ve|\s+have)?\s+)?/.source;
-var TIME_OF_DAY = /\d{1,2}(?::\d{2})?\s*(?:am|pm)(?:\s*\(?UTC\)?)?/.source;
-var RESET_DATE = `(?:[A-Za-z]{3,9}\\s+\\d{1,2}(?:\\s*,\\s*${TIME_OF_DAY})?|${TIME_OF_DAY})`;
+var RESET_DATE = RESET_DATE_SOURCE;
 var BANNER_PATTERNS = [
   // Percentage form — pct in group 1, reset in group 2.
   new RegExp(`${SUBJECT}used\\s+(\\d{1,3})%\\s+of\\s+your\\s+weekly\\s+limit${SEP}resets\\s+(${RESET_DATE})`, "i"),
@@ -11219,82 +11323,6 @@ function parseUsageBanner(text, now = /* @__PURE__ */ new Date()) {
   }
   return best;
 }
-var MONTHS = [
-  "jan",
-  "feb",
-  "mar",
-  "apr",
-  "may",
-  "jun",
-  "jul",
-  "aug",
-  "sep",
-  "oct",
-  "nov",
-  "dec"
-];
-var TIME_TAIL = /,\s*(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\(?UTC\)?)?\s*$/i;
-var TIME_ONLY = /^(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\(?UTC\)?)?$/i;
-var MS_PER_DAY = 24 * 60 * 60 * 1e3;
-function parseAmPm(hourStr, minStr, ampm) {
-  const rawHour = Number.parseInt(hourStr, 10);
-  if (!Number.isFinite(rawHour) || rawHour < 1 || rawHour > 12)
-    return null;
-  let minute = 0;
-  if (minStr) {
-    minute = Number.parseInt(minStr, 10);
-    if (!Number.isFinite(minute) || minute < 0 || minute > 59)
-      return null;
-  }
-  const isPm = ampm.toLowerCase() === "pm";
-  return { hour: rawHour % 12 + (isPm ? 12 : 0), minute };
-}
-function parseResetDateTime(humanDate, now) {
-  const trimmed = humanDate.trim();
-  const timeOnly = trimmed.match(TIME_ONLY);
-  if (timeOnly) {
-    const hm = parseAmPm(timeOnly[1], timeOnly[2], timeOnly[3]);
-    if (!hm)
-      return null;
-    const todayAt = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), hm.hour, hm.minute);
-    return {
-      at: new Date(todayAt <= now.getTime() ? todayAt + MS_PER_DAY : todayAt),
-      precision: "hour_only"
-    };
-  }
-  const timeMatch = trimmed.match(TIME_TAIL);
-  const dateOnly = timeMatch ? trimmed.slice(0, timeMatch.index).trim() : trimmed;
-  const parts = dateOnly.split(/\s+/);
-  if (parts.length !== 2)
-    return null;
-  const month = MONTHS.indexOf(parts[0].slice(0, 3).toLowerCase());
-  if (month < 0)
-    return null;
-  const day = Number.parseInt(parts[1], 10);
-  if (!Number.isFinite(day) || day < 1 || day > 31)
-    return null;
-  let hour = 0;
-  let minute = 0;
-  if (timeMatch) {
-    const hm = parseAmPm(timeMatch[1], timeMatch[2], timeMatch[3]);
-    if (!hm)
-      return null;
-    hour = hm.hour;
-    minute = hm.minute;
-  }
-  const baseYear = now.getUTCFullYear();
-  let resolved = null;
-  let bestDelta = Number.POSITIVE_INFINITY;
-  for (const y of [baseYear - 1, baseYear, baseYear + 1]) {
-    const candidate = new Date(Date.UTC(y, month, day, hour, minute));
-    const delta = Math.abs(candidate.getTime() - now.getTime());
-    if (delta < bestDelta) {
-      bestDelta = delta;
-      resolved = candidate;
-    }
-  }
-  return resolved ? { at: resolved, precision: "dated" } : null;
-}
 
 // ../../packages/core/dist/claude-code-usage/transcript-parser.js
 function nonNegInt(value) {
@@ -11521,6 +11549,150 @@ function attributeTranscriptUsageByRun(jsonl) {
   return { perRunModel: [...agg.values()], runIds: [...runIds] };
 }
 
+// ../../packages/core/dist/claude-code-usage/usage-report-parser.js
+var AGGREGATE_BUCKET = "all models";
+var SEP2 = /[\s·\-–—]+/.source;
+var WINDOW_LINE = new RegExp(`^\\s*Current\\s+(session|week)(?:\\s*\\(([^)]*)\\))?\\s*:\\s*(\\d{1,3})%\\s+used(?:${SEP2}resets\\s+(${RESET_DATE_SOURCE}))?\\s*$`, "gim");
+var SUBSCRIPTION_LINE = /using\s+your\s+subscription\s+to\s+power\s+your\s+Claude\s+Code\s+usage/i;
+function parseUsageReport(text, now = /* @__PURE__ */ new Date()) {
+  if (typeof text !== "string" || text.length === 0)
+    return null;
+  const windows = [];
+  const pattern = new RegExp(WINDOW_LINE.source, WINDOW_LINE.flags);
+  let match;
+  while ((match = pattern.exec(text)) !== null) {
+    if (match.index === pattern.lastIndex)
+      pattern.lastIndex++;
+    const kind = match[1].toLowerCase();
+    const bucketRaw = match[2];
+    const pct = Number.parseInt(match[3], 10);
+    const resetStr = match[4];
+    if (!Number.isFinite(pct) || pct < 0 || pct > 100)
+      continue;
+    let resetsAt = null;
+    let resetPrecision = null;
+    if (resetStr) {
+      const resolved = parseResetDateTime(resetStr, now);
+      if (!resolved)
+        continue;
+      resetsAt = resolved.at;
+      resetPrecision = resolved.precision;
+    }
+    windows.push({
+      kind,
+      bucket: bucketRaw === void 0 ? null : bucketRaw.trim(),
+      pct,
+      resetsAt,
+      resetPrecision
+    });
+  }
+  if (windows.length === 0)
+    return null;
+  const session = windows.find((w) => w.kind === "session") ?? null;
+  const weeks = windows.filter((w) => w.kind === "week");
+  const week = weeks.find((w) => (w.bucket ?? "").toLowerCase() === AGGREGATE_BUCKET) ?? // Defensive: if the CLI ever drops the "(all models)" label from the
+  // aggregate, a bucket-less weekly line is still the aggregate. A per-model
+  // bucket always names its model, so this cannot capture one by accident.
+  weeks.find((w) => w.bucket === null) ?? null;
+  const perModelWeek = weeks.filter((w) => w !== week);
+  return {
+    subscription: SUBSCRIPTION_LINE.test(text),
+    session,
+    week,
+    perModelWeek,
+    windows
+  };
+}
+
+// ../../packages/core/dist/claude-code-usage/host-usage-reading.js
+var HOST_USAGE_SOURCE = "cli_print_usage";
+function unknown(reason, readAt, cliVersion) {
+  return {
+    state: "unknown",
+    weekPct: null,
+    weekResetsAt: null,
+    sessionPct: null,
+    sessionResetsAt: null,
+    readAt,
+    cliVersion,
+    source: HOST_USAGE_SOURCE,
+    unknownReason: reason
+  };
+}
+function buildHostUsageReading(input) {
+  const { report, readAt, cliVersion, authMode, pollFailed } = input;
+  if (authMode != null && authMode !== "subscription") {
+    return {
+      state: "not_applicable",
+      weekPct: null,
+      weekResetsAt: null,
+      sessionPct: null,
+      sessionResetsAt: null,
+      readAt,
+      cliVersion,
+      source: HOST_USAGE_SOURCE,
+      unknownReason: null
+    };
+  }
+  if (pollFailed)
+    return unknown("poll_failed", readAt, cliVersion);
+  if (!report)
+    return unknown("unparseable_output", readAt, cliVersion);
+  if (!report.subscription) {
+    return {
+      state: "not_applicable",
+      weekPct: null,
+      weekResetsAt: null,
+      sessionPct: null,
+      sessionResetsAt: null,
+      readAt,
+      cliVersion,
+      source: HOST_USAGE_SOURCE,
+      unknownReason: null
+    };
+  }
+  if (!report.week && !report.session) {
+    return unknown("unparseable_output", readAt, cliVersion);
+  }
+  return {
+    state: "ok",
+    weekPct: report.week?.pct ?? null,
+    // ONLY a DATED reset is stored (CodeRabbit on #4988).
+    //
+    // Print mode has always rendered a date, so `hour_only` here means the CLI
+    // changed its render and `parseResetDateTime` reconstructed the day from an
+    // hour. That reconstruction can never be more than 24h out, and storing it
+    // in a column consumers treat as a measurement is precisely ENG-8472: every
+    // host whose render named the same hour landed on the same millisecond, and
+    // eleven days went into reading that as evidence of a shared subscription.
+    //
+    // The PERCENTAGE survives - it is a real reading either way, and dropping it
+    // would blind the fleet over a formatting change. Only the boundary is
+    // withheld, which degrades an alert to "cannot auto-close at reset" rather
+    // than to "asserts a reset instant nobody measured".
+    weekResetsAt: datedResetOnly(report.week),
+    sessionPct: report.session?.pct ?? null,
+    sessionResetsAt: datedResetOnly(report.session),
+    readAt,
+    cliVersion,
+    source: HOST_USAGE_SOURCE,
+    unknownReason: null
+  };
+}
+function datedResetOnly(window) {
+  if (!window || !window.resetsAt)
+    return null;
+  return window.resetPrecision === "dated" ? window.resetsAt : null;
+}
+var RESET_JITTER_TOLERANCE_MS = 5 * 60 * 1e3;
+function stabiliseResetInstant(previous, next, toleranceMs = RESET_JITTER_TOLERANCE_MS) {
+  if (!next)
+    return null;
+  if (!previous)
+    return next;
+  return Math.abs(next.getTime() - previous.getTime()) <= toleranceMs ? previous : next;
+}
+
 // ../../packages/core/dist/claude-code-usage/rate-limit-classifier.js
 var UNKNOWN_RATE_LIMIT = Object.freeze({
   verdict: "unknown",
@@ -12571,6 +12743,9 @@ export {
   sumTranscriptUsageInWindow,
   isEmptyTotals,
   attributeTranscriptUsageByRun,
+  parseUsageReport,
+  buildHostUsageReading,
+  stabiliseResetInstant,
   UNKNOWN_RATE_LIMIT,
   pickNewerClassification,
   classifyTranscriptRateLimit,
@@ -12622,4 +12797,4 @@ export {
   minutesSinceLocalMidnight,
   peekCurrentSession
 };
-//# sourceMappingURL=chunk-NYWCE5JH.js.map
+//# sourceMappingURL=chunk-Y7AHOXHP.js.map