@integrity-labs/agt-cli 0.28.725 → 0.28.726

package/dist/bin/agt.js

@@ -41,12 +41,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-MHB3SEYC.js";
+} from "../chunk-Z3N7J2MG.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-ATJU3SDV.js";
+} from "../chunk-ZCTFF4PA.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.725" : "dev";
+var cliVersion = true ? "0.28.726" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6654,7 +6654,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.725" : "dev";
+var cliVersion2 = true ? "0.28.726" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-MHB3SEYC.js → chunk-Z3N7J2MG.js}

@@ -13,7 +13,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-ATJU3SDV.js";
+} from "./chunk-ZCTFF4PA.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -6428,7 +6428,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.725" : "dev";
+var agtCliVersion = true ? "0.28.726" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10474,4 +10474,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-MHB3SEYC.js.map
+//# sourceMappingURL=chunk-Z3N7J2MG.js.map

package/dist/{chunk-ATJU3SDV.js → chunk-ZCTFF4PA.js}

@@ -3134,6 +3134,150 @@ function trackUnclaimedDialog(codeName, hash, io, config) {
 var unclaimedDialogCounts = /* @__PURE__ */ new Map();
 var unclaimedDialogSeen = /* @__PURE__ */ new Map();
 
+// src/lib/model-policy.ts
+var TRANSPORTS = ["anthropic-direct", "bedrock", "gateway"];
+var WIRE_SCHEMAS = ["anthropic_messages", "openai_chat_completions"];
+var CREDENTIAL_SOURCES = [
+  "max_subscription",
+  "api_key",
+  "gateway_token",
+  "aws_role"
+];
+var ROLES = ["primary", "secondary"];
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function parseBinding(raw) {
+  if (!isRecord(raw)) return null;
+  const role = raw["role"];
+  const transport = raw["transport"];
+  const wireSchema = raw["wire_schema"];
+  const credentialSource = raw["credential_source"];
+  if (typeof role !== "string" || !ROLES.includes(role)) return null;
+  if (typeof transport !== "string" || !TRANSPORTS.includes(transport)) return null;
+  if (typeof wireSchema !== "string" || !WIRE_SCHEMAS.includes(wireSchema)) return null;
+  if (typeof credentialSource !== "string" || !CREDENTIAL_SOURCES.includes(credentialSource)) {
+    return null;
+  }
+  const baseUrlRaw = raw["base_url"];
+  const baseUrl = typeof baseUrlRaw === "string" && baseUrlRaw.trim() !== "" ? baseUrlRaw : null;
+  if (transport === "gateway" !== (baseUrl !== null)) return null;
+  return {
+    role,
+    transport,
+    wireSchema,
+    baseUrl,
+    credentialSource
+  };
+}
+function parseModelPolicy(raw) {
+  if (!isRecord(raw)) return null;
+  const policyId = raw["policy_id"];
+  const name = raw["name"];
+  const revision = raw["revision"];
+  const resolvedFrom = raw["resolved_from"];
+  if (typeof policyId !== "string" || policyId === "") return null;
+  if (typeof name !== "string") return null;
+  if (typeof revision !== "number" || !Number.isFinite(revision)) return null;
+  if (typeof resolvedFrom !== "string" || !["agent", "host", "organization"].includes(resolvedFrom)) {
+    return null;
+  }
+  const bindingsRaw = raw["bindings"];
+  if (!Array.isArray(bindingsRaw) || bindingsRaw.length === 0) return null;
+  const bindings = [];
+  for (const b of bindingsRaw) {
+    const parsed = parseBinding(b);
+    if (!parsed) return null;
+    bindings.push(parsed);
+  }
+  return {
+    policyId,
+    name,
+    revision,
+    resolvedFrom,
+    bindings
+  };
+}
+function modelPolicyAuthComponent(policy) {
+  if (!policy) return null;
+  return `${policy.policyId}@${policy.revision}`;
+}
+function modelPolicyEgressDomains(policy) {
+  if (!policy) return [];
+  const out = /* @__PURE__ */ new Set();
+  for (const b of policy.bindings) {
+    if (!b.baseUrl) continue;
+    try {
+      const host = new URL(b.baseUrl).hostname.trim().toLowerCase();
+      if (host) out.add(host);
+    } catch {
+    }
+  }
+  return [...out];
+}
+function resolveBindingCredential(binding, availableGatewayToken) {
+  switch (binding.transport) {
+    case "anthropic-direct":
+      return { kind: "host-default" };
+    case "bedrock":
+      return { kind: "blocked", reason: "bedrock-not-implemented" };
+    case "gateway": {
+      if (!binding.baseUrl) return { kind: "blocked", reason: "credential-path-not-built" };
+      if (!availableGatewayToken) {
+        return { kind: "blocked", reason: "credential-path-not-built" };
+      }
+      return { kind: "gateway", baseUrl: binding.baseUrl, authToken: availableGatewayToken };
+    }
+  }
+}
+function primaryBinding(policy) {
+  if (!policy) return null;
+  return policy.bindings.find((b) => b.role === "primary") ?? null;
+}
+function sourceSetsAnthropicApiKey(source) {
+  switch (source) {
+    case "max_subscription":
+      return false;
+    case "api_key":
+      return false;
+    case "gateway_token":
+      return false;
+    case "aws_role":
+      return false;
+  }
+}
+function policyPutsAnthropicApiKeyInEnv(policy) {
+  if (!policy) return false;
+  return policy.bindings.some((b) => sourceSetsAnthropicApiKey(b.credentialSource));
+}
+function resolveModelPolicySpawnEnv(input) {
+  const { policy, openRouterMode, gatewayToken, codeName } = input;
+  const primary = primaryBinding(policy);
+  if (!policy || !primary) return { env: {}, notice: null };
+  if (openRouterMode) {
+    return {
+      env: {},
+      notice: `[model-policy] '${codeName}' has policy '${policy.name}' but is in OpenRouter mode \u2014 OpenRouter wins, policy not applied (ENG-9483: unifying the two actuators is a separate migration)`
+    };
+  }
+  const resolution = resolveBindingCredential(primary, gatewayToken);
+  switch (resolution.kind) {
+    case "gateway":
+      return {
+        env: {
+          ANTHROPIC_BASE_URL: resolution.baseUrl,
+          ANTHROPIC_AUTH_TOKEN: resolution.authToken
+        },
+        notice: `[model-policy] '${codeName}' inference via gateway ${resolution.baseUrl} (policy '${policy.name}' rev ${policy.revision}, from ${policy.resolvedFrom})`
+      };
+    case "blocked":
+      return {
+        env: {},
+        notice: `[model-policy] '${codeName}' policy '${policy.name}' NOT applied \u2014 reason=${resolution.reason}; keeping existing auth (transport=${primary.transport}, credential_source=${primary.credentialSource})`
+      };
+    case "host-default":
+      return { env: {}, notice: null };
+  }
+}
+
 // src/lib/persistent-session.ts
 var OPENROUTER_ANTHROPIC_BASE_URL = "https://openrouter.ai/api";
 function syncClaudeCredsToRoot() {
@@ -3170,7 +3314,8 @@ function syncClaudeCredsToRoot() {
     return false;
   }
 }
-function resolveOAuthCredAction(claudeAuthMode, openRouterMode) {
+function resolveOAuthCredAction(claudeAuthMode, openRouterMode, policy, policyApplied) {
+  if (policy && policyApplied) return policyPutsAnthropicApiKeyInEnv(policy) ? "purge" : "sync";
   if (openRouterMode) return "sync";
   return claudeAuthMode === "api_key" ? "purge" : "sync";
 }
@@ -3227,8 +3372,13 @@ function egressMode(codeName) {
   return "allowlist";
 }
 var VALID_EGRESS_DOMAIN = /^\.?([a-z0-9-]+\.)+[a-z0-9-]+$/;
-function buildEgressAllowlist(toolsFrontmatter) {
+function buildEgressAllowlist(toolsFrontmatter, policyDomains = []) {
   const domains = new Set(EGRESS_BASELINE_DOMAINS);
+  for (const d of policyDomains) {
+    if (typeof d !== "string") continue;
+    const norm = d.trim().toLowerCase();
+    if (VALID_EGRESS_DOMAIN.test(norm)) domains.add(norm);
+  }
   for (const tool of toolsFrontmatter?.tools ?? []) {
     for (const d of tool.network?.allowlist_domains ?? []) {
       if (typeof d !== "string") continue;
@@ -3279,7 +3429,7 @@ function restartEgressSidecar(codeName) {
   }
 }
 function buildDockerRunCommand(args) {
-  const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, egress, forwardSlackReplyBinding, forwardBlockTurnEndAllMarkers, forwardKanbanWaiting, forwardNotifyDispatch, forwardTurnFailureNotice, forwardChannelSecrets } = args;
+  const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, passModelPolicyGateway, egress, forwardSlackReplyBinding, forwardBlockTurnEndAllMarkers, forwardKanbanWaiting, forwardNotifyDispatch, forwardTurnFailureNotice, forwardChannelSecrets } = args;
   const q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
   const agentDir2 = join6(homeDir, ".augmented", codeName);
   const agentIdDir = join6(homeDir, ".augmented", agentId);
@@ -3307,6 +3457,10 @@ function buildDockerRunCommand(args) {
     envArgs.push("-e ANTHROPIC_MODEL");
     envArgs.push("-e ANTHROPIC_SMALL_FAST_MODEL");
   }
+  if (passModelPolicyGateway) {
+    envArgs.push("-e ANTHROPIC_BASE_URL");
+    envArgs.push("-e ANTHROPIC_AUTH_TOKEN");
+  }
   if (runId) envArgs.push(`-e ${q(`AGT_RUN_ID=${runId}`)}`);
   envArgs.push("-e AGT_API_KEY");
   envArgs.push("-e AGT_HOST");
@@ -3694,6 +3848,14 @@ function spawnSession(config, session) {
   const { codeName, projectDir, mcpConfigPath, claudeMdPath, channels, devChannels, apiHost, log: log2 } = config;
   const claudeAuthMode = config.claudeAuthMode ?? "subscription";
   const openRouterMode = !!config.openRouter;
+  const { env: policyEnv, notice: policyNotice } = resolveModelPolicySpawnEnv({
+    policy: config.modelPolicy ?? null,
+    openRouterMode,
+    gatewayToken: config.modelPolicyGatewayToken ?? null,
+    codeName
+  });
+  if (policyNotice) log2(policyNotice);
+  const policyEnvActive = Object.keys(policyEnv).length > 0;
   const tmuxSession = `agt-${codeName}`;
   log2(
     `[persistent-session] Starting tmux session '${tmuxSession}' for '${codeName}' (auth=${openRouterMode ? "openrouter" : claudeAuthMode})`
@@ -3714,7 +3876,14 @@ function spawnSession(config, session) {
       execSync2(`tmux kill-session -t ${tmuxSession} 2>/dev/null`, { stdio: "ignore" });
     } catch {
     }
-    if (resolveOAuthCredAction(claudeAuthMode, openRouterMode) === "sync") {
+    if (resolveOAuthCredAction(
+      claudeAuthMode,
+      openRouterMode,
+      config.modelPolicy ?? null,
+      // Not `!!config.modelPolicy`: a blocked binding means the agent is still
+      // on its legacy auth, so the legacy purge rule must govern it.
+      policyEnvActive
+    ) === "sync") {
       const credsSynced = syncClaudeCredsToRoot();
       const onLinuxRoot = platform() === "linux" && typeof process.getuid === "function" && process.getuid() === 0;
       if (openRouterMode) {
@@ -3817,6 +3986,10 @@ function spawnSession(config, session) {
       if (or.smallFastModel) {
         tmuxSessionEnvArgs.push("-e", `ANTHROPIC_SMALL_FAST_MODEL=${or.smallFastModel}`);
       }
+    } else if (policyEnvActive) {
+      for (const [k, v] of Object.entries(policyEnv)) {
+        tmuxSessionEnvArgs.push("-e", `${k}=${v}`);
+      }
     } else if (claudeAuthMode === "api_key" && config.anthropicApiKey) {
       tmuxSessionEnvArgs.push("-e", `ANTHROPIC_API_KEY=${config.anthropicApiKey}`);
     }
@@ -3853,10 +4026,19 @@ function spawnSession(config, session) {
       projectDir,
       homeDir: sessionHomeDir,
       runId: config.runId ?? void 0,
-      passApiKey: !openRouterMode && claudeAuthMode === "api_key" && !!config.anthropicApiKey,
+      // ENG-9483 slice 2: `!policyEnvActive` mirrors the tmux `-e` chain's
+      // precedence exactly. Without it an api_key host with a gateway policy
+      // would forward BOTH the policy's auth token and the host's
+      // ANTHROPIC_API_KEY into the container — the confused-deputy state the
+      // purge exists to prevent, reintroduced through the docker boundary.
+      passApiKey: !openRouterMode && !policyEnvActive && claudeAuthMode === "api_key" && !!config.anthropicApiKey,
       // ENG-7152: forward the OpenRouter ANTHROPIC_* vars (by name) from the
       // session-shell env into the container, same posture as passApiKey.
       passOpenRouter: openRouterMode,
+      // ENG-9483 slice 2: for an isolated agent, claude sees ONLY what is
+      // forwarded here — see the flag's docblock for why omitting this is a
+      // silent fallback to the host's auth rather than a visible failure.
+      passModelPolicyGateway: policyEnvActive,
       egress,
       // ENG-6476: forward the reply-routing flag env if it will be present in the
       // session env (operator-set OR materialized from the flag above).
@@ -3891,7 +4073,7 @@ function spawnSession(config, session) {
       agentId: config.agentId,
       runId: config.runId
     });
-    const apiKeyEnv = !openRouterMode && claudeAuthMode === "api_key" && config.anthropicApiKey ? { ANTHROPIC_API_KEY: config.anthropicApiKey } : {};
+    const apiKeyEnv = !openRouterMode && !policyEnvActive && claudeAuthMode === "api_key" && config.anthropicApiKey ? { ANTHROPIC_API_KEY: config.anthropicApiKey } : {};
     const openRouterEnv = openRouterMode ? {
       ANTHROPIC_BASE_URL: OPENROUTER_ANTHROPIC_BASE_URL,
       ANTHROPIC_AUTH_TOKEN: config.openRouter.authToken,
@@ -3903,6 +4085,7 @@ function spawnSession(config, session) {
       HOME: tmuxEnv["HOME"],
       ...apiKeyEnv,
       ...openRouterEnv,
+      ...policyEnv,
       ...channelSecretEnv,
       ...config.runId ? { AGT_RUN_ID: config.runId } : {},
       AGT_API_KEY: tmuxEnv["AGT_API_KEY"],
@@ -4646,6 +4829,9 @@ export {
   checkChannelInputs,
   takeWatchdogGiveUpCount,
   creditWatchdogGiveUpCount,
+  parseModelPolicy,
+  modelPolicyAuthComponent,
+  modelPolicyEgressDomains,
   resolveOAuthCredAction,
   resolveClaudeBinary,
   isolationMode,
@@ -4694,4 +4880,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-ATJU3SDV.js.map
+//# sourceMappingURL=chunk-ZCTFF4PA.js.map