@integrity-labs/agt-cli 0.28.72 → 0.28.74

package/dist/bin/agt.js

@@ -37,7 +37,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-IL4CR6YM.js";
+} from "../chunk-WNUAEC22.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -64,7 +64,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-Z2BMTZQK.js";
+} from "../chunk-PXMYLQWB.js";
 
 // src/bin/agt.ts
 import { join as join22 } from "path";
@@ -4777,7 +4777,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.72" : "dev";
+var cliVersion = true ? "0.28.74" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5791,7 +5791,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.72" : "dev";
+var cliVersion2 = true ? "0.28.74" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-36O7GO5B.js → chunk-AB57D3NN.js}

@@ -3,7 +3,7 @@ import {
   formatMissingVar,
   isClaudeFastMode,
   probeMcpEnvSubstitution
-} from "./chunk-Z2BMTZQK.js";
+} from "./chunk-PXMYLQWB.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -1395,4 +1395,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-36O7GO5B.js.map
+//# sourceMappingURL=chunk-AB57D3NN.js.map

package/dist/{chunk-Z2BMTZQK.js → chunk-PXMYLQWB.js}

@@ -1039,6 +1039,18 @@ var FLAG_REGISTRY = [
     // approval requests; flipping it is a capability change worth confirming.
     sensitive: true
   },
+  {
+    key: "approval-sod",
+    description: "Separation-of-duties (SoD) guard for the HITL approval FSM (ENG-6459): off = disabled, shadow = resolve principals + audit conflicts only (no block), enforce = fail-closed refuse of a self-approval or an unresolvable approver. Compares approver vs requesting-human on a canonical organization_people.person_id. Ships dark (off); soak in shadow before enforce.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    defaultValue: "off",
+    envVar: "AGT_APPROVAL_SOD_MODE",
+    // Access-control gate: flipping to enforce can REFUSE approvals (incl. a
+    // legitimate approver whose Slack id isn't linked to a person row), so it
+    // must soak in shadow first and is worth confirming on mutation.
+    sensitive: true
+  },
   {
     key: "direct-chat-doorbell",
     description: "Direct-chat doorbell + pull-cursor delivery (ENG-5927, ADR-0020): the manager rings a content-free doorbell and the agent's in-session MCP pulls via the capped /host/direct-chat/poll claim, replacing send-keys/one-shot delivery. Boolean gate; ships dark.",
@@ -5563,4 +5575,4 @@ export {
   parseEnvIntegrations,
   probeMcpEnvSubstitution
 };
-//# sourceMappingURL=chunk-Z2BMTZQK.js.map
+//# sourceMappingURL=chunk-PXMYLQWB.js.map