@integrity-labs/agt-cli 0.28.746 → 0.28.748

package/dist/bin/agt.js

@@ -41,12 +41,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-EQMRNMLX.js";
+} from "../chunk-G7GWXCPV.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-4JHG7DJW.js";
+} from "../chunk-3LQYVRKX.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-PD3Y3C46.js";
+} from "../chunk-DFOBTAPL.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.746" : "dev";
+var cliVersion = true ? "0.28.748" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6654,7 +6654,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.746" : "dev";
+var cliVersion2 = true ? "0.28.748" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-4JHG7DJW.js → chunk-3LQYVRKX.js}

@@ -17,7 +17,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-PD3Y3C46.js";
+} from "./chunk-DFOBTAPL.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -4929,4 +4929,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-4JHG7DJW.js.map
+//# sourceMappingURL=chunk-3LQYVRKX.js.map

package/dist/{chunk-PD3Y3C46.js → chunk-DFOBTAPL.js}

@@ -77,6 +77,161 @@ function resolveAvatarEnvUrl(raw) {
 // ../../packages/core/dist/provisioning/platform-storage.js
 var PLATFORM_STORAGE_RULE = "Store durable, reusable work you build (repeatable procedures, recurring responsibilities, scheduled automation, orchestration scripts) through the Augmented Team platform tools, never as loose local files, unless the user explicitly requests a different destination. Platform artifacts are versioned, reviewable, and survive re-provisioning; loose local files are wiped on the next provision rebuild, reach no one else, and bypass review. Ephemeral scratch files for the task at hand are fine on disk.";
 
+// ../../packages/core/dist/memory/identifier-capture.js
+var URL_RE = /\bhttps?:\/\/[^\s<>"'`]+/gi;
+var TRAILING_PUNCT = /* @__PURE__ */ new Set([".", ",", ";", ":", "!", "?", ")", "]", "}", ">", '"', "'", "\u2019", "\u201D"]);
+function trimUrlPunctuation(raw) {
+  let out = raw;
+  for (; ; ) {
+    const last = out.at(-1);
+    if (last === void 0 || !TRAILING_PUNCT.has(last))
+      return out;
+    if (last === ")" && countOf(out, "(") >= countOf(out, ")"))
+      return out;
+    out = out.slice(0, -1);
+  }
+}
+function countOf(s, ch) {
+  let n = 0;
+  for (const c of s)
+    if (c === ch)
+      n += 1;
+  return n;
+}
+function findIdentifierUrls(text) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const m of text.matchAll(URL_RE)) {
+    const url = trimUrlPunctuation(m[0]);
+    if (!url || seen.has(url))
+      continue;
+    seen.add(url);
+    out.push(url);
+  }
+  return out;
+}
+var SECRET_PARAM_TOKENS = /* @__PURE__ */ new Set([
+  "token",
+  "password",
+  "passwd",
+  "pwd",
+  "secret",
+  "auth",
+  "bearer",
+  "signature",
+  "sig",
+  "credential",
+  "credentials",
+  "session",
+  "jwt",
+  "apikey",
+  // An OAuth authorization code and a one-time passcode are credentials, not
+  // identifiers (CodeRabbit). `code` does have benign uses (`?code=US`,
+  // `?code=PROMO10`); redacting those costs a query value, whereas persisting a
+  // real authorization code into a durable, searchable store is a credential in
+  // the memory table. Redaction is the cheaper error.
+  "code",
+  "otp"
+]);
+var SECRET_PARAM_SUBSTRINGS = ["apikey", "accesstoken", "authtoken", "sessiontoken"];
+var REDACTED_PARAM_VALUE = "redacted";
+function isSecretParamName(name) {
+  const n = name.toLowerCase();
+  const tokens = n.split(/[^a-z0-9]+/).filter(Boolean);
+  if (tokens.some((t) => SECRET_PARAM_TOKENS.has(t)))
+    return true;
+  return SECRET_PARAM_SUBSTRINGS.some((h) => n.includes(h));
+}
+function scrubUrlSecrets(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return url;
+  }
+  let touched = false;
+  if (u.username || u.password) {
+    u.username = "";
+    u.password = "";
+    touched = true;
+  }
+  for (const key of [...u.searchParams.keys()]) {
+    if (isSecretParamName(key)) {
+      u.searchParams.set(key, REDACTED_PARAM_VALUE);
+      touched = true;
+    }
+  }
+  if (u.hash.includes("=")) {
+    const frag = new URLSearchParams(u.hash.replace(/^#/, ""));
+    let fragTouched = false;
+    for (const key of [...frag.keys()]) {
+      if (isSecretParamName(key)) {
+        frag.set(key, REDACTED_PARAM_VALUE);
+        fragTouched = true;
+      }
+    }
+    if (fragTouched) {
+      u.hash = `#${frag.toString()}`;
+      touched = true;
+    }
+  }
+  return touched ? u.toString() : url;
+}
+function scrubPreservingIdentifiers(text, blobPatterns) {
+  const spans = [];
+  for (const m of text.matchAll(URL_RE)) {
+    const trimmed = trimUrlPunctuation(m[0]);
+    if (!trimmed)
+      continue;
+    const start = m.index ?? -1;
+    if (start < 0)
+      continue;
+    spans.push([start, start + trimmed.length]);
+  }
+  if (spans.length === 0)
+    return applyAll(text, blobPatterns);
+  let out = "";
+  let cursor = 0;
+  for (const [start, end] of spans) {
+    if (start < cursor)
+      continue;
+    out += applyAll(text.slice(cursor, start), blobPatterns);
+    out += scrubUrlSecrets(text.slice(start, end));
+    cursor = end;
+  }
+  return out + applyAll(text.slice(cursor), blobPatterns);
+}
+function applyAll(text, patterns) {
+  let out = text;
+  for (const re of patterns)
+    out = out.replace(re, "[redacted]");
+  return out;
+}
+function fnv1a64(s) {
+  const PRIME = 0x100000001b3n;
+  const MASK = 0xffffffffffffffffn;
+  let h = 0xcbf29ce484222325n;
+  for (let i = 0; i < s.length; i += 1) {
+    h ^= BigInt(s.charCodeAt(i));
+    h = h * PRIME & MASK;
+  }
+  return h.toString(16).padStart(16, "0");
+}
+var IDENTIFIER_MEMORY_NAME_PREFIX = "link:";
+function identifierMemoryName(url) {
+  let host = "";
+  try {
+    host = new URL(url).host.replace(/^www\./, "");
+  } catch {
+    host = "link";
+  }
+  const digest = fnv1a64(url);
+  const name = `${IDENTIFIER_MEMORY_NAME_PREFIX} ${host} ${digest}`;
+  return name.length <= 80 ? name : `${IDENTIFIER_MEMORY_NAME_PREFIX} ${digest}`;
+}
+var AGENT_IDENTIFIER_RULE = "An identifier the work depends on is never an ephemeral detail: when a message gives you a URL, file, folder, document or ticket id, save the identifier itself, verbatim, before you reply \u2014 as its own short entry, not folded into prose. A note that a link is coming is not a substitute for the link. You can always re-derive a summary; you can never re-derive an identifier without asking the person for it again.";
+var EXTRACTOR_IDENTIFIER_RULE = 'An identifier is ALWAYS durable, and is the one exception to "no one-off task details": if the conversation contains a URL, file, folder, document or ticket id that the work depends on, emit it as a "reference" memory with the identifier copied EXACTLY as it appeared \u2014 never paraphrased, never shortened, never described. Conversation history does not survive a restart, so an identifier that is only described is lost.';
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/identity.js
 var SCRATCH_RETENTION_DAYS = 7;
 var CLAUDE_MD_CHARS_PER_TOKEN = 3.57;
@@ -121,7 +276,7 @@ context. Two Markdown file types:
 **Save** when the user says "remember this", and proactively for decisions,
 preferences, non-obvious conventions, corrections to your approach, and important
 outcomes. **Don't save** what's derivable from the codebase or git history,
-ephemeral task details, or anything already in CHARTER.md / TOOLS.md.
+ephemeral task details, or anything already in CHARTER.md / TOOLS.md. ${AGENT_IDENTIFIER_RULE}
 
 **Writing:** append to the daily log (create if missing); update \`MEMORY.md\` by
 topic, editing or removing stale entries rather than only appending. Before the
@@ -4808,6 +4963,21 @@ var FLAG_REGISTRY = [
     // approval requests; flipping it is a capability change worth confirming.
     sensitive: true
   },
+  {
+    key: "agent-self-pause",
+    description: "CS-1632: let an agent stop ITSELF via the self_pause tool when it believes its channel is compromised or is being used to inject instructions. Writes agents.status=paused with paused_reason=agent_self_pause, and only a human can resume from the console. DEFAULTS ON, unlike most gates here: a safety control that has to be armed in advance is missing on every agent nobody armed, including the one being attacked. Turn it OFF per org if an agent misuses it \u2014 that is the reverse lever, and it is instant and central, which a host env var would not be. NO envVar: the consumer is the API route, and a bare AGT_*_ENABLED gate would trip check-new-env-gates.sh (same reasoning as v2-writes above).",
+    flagType: "boolean",
+    // Declared safe value is TRUE, and that inverts the usual posture on purpose.
+    // For most gates the safe default is "off, ships dark". Here OFF means an
+    // agent under a suspected compromise cannot stop, so a flag-read error must
+    // NOT disable the control — the route evaluates this fail-OPEN.
+    defaultValue: true,
+    // Turning it off removes an agent's ability to stop itself during an
+    // injection attempt; turning it on grants a (possibly prompt-injected) agent
+    // a denial-of-service primitive against itself. Both directions are a
+    // capability change worth confirming.
+    sensitive: true
+  },
   {
     key: "approval-sod",
     description: "Separation-of-duties (SoD) guard for the HITL approval FSM (ENG-6459): off = disabled, shadow = resolve principals + audit conflicts only (no block), enforce = fail-closed refuse of a self-approval or an unresolvable approver. Compares approver vs requesting-human on a canonical organization_people.person_id. This is the org-wide DEFAULT; a per-(team, verb) approval_policies.sod_mode row overrides it (ENG-6678: relax low-risk verbs while keeping enforce on money verbs). Ships dark (off); soak in shadow before enforce.",
@@ -12893,6 +13063,10 @@ export {
   MAX_AVATAR_ENV_URL_BYTES,
   resolveAvatarEnvUrl,
   PLATFORM_STORAGE_RULE,
+  findIdentifierUrls,
+  scrubPreservingIdentifiers,
+  identifierMemoryName,
+  EXTRACTOR_IDENTIFIER_RULE,
   SCRATCH_RETENTION_DAYS,
   CLAUDE_MD_CONTEXT_ALARM_CHARS,
   INTEGRATIONS_SECTION_START,
@@ -13037,4 +13211,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-PD3Y3C46.js.map
+//# sourceMappingURL=chunk-DFOBTAPL.js.map