@integrity-labs/agt-cli 0.28.747 → 0.28.749

package/dist/bin/agt.js

@@ -41,12 +41,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-OYASDDR4.js";
+} from "../chunk-WTBSFYTA.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-R35LZDRH.js";
+} from "../chunk-3LQYVRKX.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-62TAD4HO.js";
+} from "../chunk-DFOBTAPL.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.747" : "dev";
+var cliVersion = true ? "0.28.749" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6654,7 +6654,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.747" : "dev";
+var cliVersion2 = true ? "0.28.749" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-R35LZDRH.js → chunk-3LQYVRKX.js}

@@ -17,7 +17,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-62TAD4HO.js";
+} from "./chunk-DFOBTAPL.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -4929,4 +4929,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-R35LZDRH.js.map
+//# sourceMappingURL=chunk-3LQYVRKX.js.map

package/dist/{chunk-62TAD4HO.js → chunk-DFOBTAPL.js}

@@ -77,6 +77,161 @@ function resolveAvatarEnvUrl(raw) {
 // ../../packages/core/dist/provisioning/platform-storage.js
 var PLATFORM_STORAGE_RULE = "Store durable, reusable work you build (repeatable procedures, recurring responsibilities, scheduled automation, orchestration scripts) through the Augmented Team platform tools, never as loose local files, unless the user explicitly requests a different destination. Platform artifacts are versioned, reviewable, and survive re-provisioning; loose local files are wiped on the next provision rebuild, reach no one else, and bypass review. Ephemeral scratch files for the task at hand are fine on disk.";
 
+// ../../packages/core/dist/memory/identifier-capture.js
+var URL_RE = /\bhttps?:\/\/[^\s<>"'`]+/gi;
+var TRAILING_PUNCT = /* @__PURE__ */ new Set([".", ",", ";", ":", "!", "?", ")", "]", "}", ">", '"', "'", "\u2019", "\u201D"]);
+function trimUrlPunctuation(raw) {
+  let out = raw;
+  for (; ; ) {
+    const last = out.at(-1);
+    if (last === void 0 || !TRAILING_PUNCT.has(last))
+      return out;
+    if (last === ")" && countOf(out, "(") >= countOf(out, ")"))
+      return out;
+    out = out.slice(0, -1);
+  }
+}
+function countOf(s, ch) {
+  let n = 0;
+  for (const c of s)
+    if (c === ch)
+      n += 1;
+  return n;
+}
+function findIdentifierUrls(text) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const m of text.matchAll(URL_RE)) {
+    const url = trimUrlPunctuation(m[0]);
+    if (!url || seen.has(url))
+      continue;
+    seen.add(url);
+    out.push(url);
+  }
+  return out;
+}
+var SECRET_PARAM_TOKENS = /* @__PURE__ */ new Set([
+  "token",
+  "password",
+  "passwd",
+  "pwd",
+  "secret",
+  "auth",
+  "bearer",
+  "signature",
+  "sig",
+  "credential",
+  "credentials",
+  "session",
+  "jwt",
+  "apikey",
+  // An OAuth authorization code and a one-time passcode are credentials, not
+  // identifiers (CodeRabbit). `code` does have benign uses (`?code=US`,
+  // `?code=PROMO10`); redacting those costs a query value, whereas persisting a
+  // real authorization code into a durable, searchable store is a credential in
+  // the memory table. Redaction is the cheaper error.
+  "code",
+  "otp"
+]);
+var SECRET_PARAM_SUBSTRINGS = ["apikey", "accesstoken", "authtoken", "sessiontoken"];
+var REDACTED_PARAM_VALUE = "redacted";
+function isSecretParamName(name) {
+  const n = name.toLowerCase();
+  const tokens = n.split(/[^a-z0-9]+/).filter(Boolean);
+  if (tokens.some((t) => SECRET_PARAM_TOKENS.has(t)))
+    return true;
+  return SECRET_PARAM_SUBSTRINGS.some((h) => n.includes(h));
+}
+function scrubUrlSecrets(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return url;
+  }
+  let touched = false;
+  if (u.username || u.password) {
+    u.username = "";
+    u.password = "";
+    touched = true;
+  }
+  for (const key of [...u.searchParams.keys()]) {
+    if (isSecretParamName(key)) {
+      u.searchParams.set(key, REDACTED_PARAM_VALUE);
+      touched = true;
+    }
+  }
+  if (u.hash.includes("=")) {
+    const frag = new URLSearchParams(u.hash.replace(/^#/, ""));
+    let fragTouched = false;
+    for (const key of [...frag.keys()]) {
+      if (isSecretParamName(key)) {
+        frag.set(key, REDACTED_PARAM_VALUE);
+        fragTouched = true;
+      }
+    }
+    if (fragTouched) {
+      u.hash = `#${frag.toString()}`;
+      touched = true;
+    }
+  }
+  return touched ? u.toString() : url;
+}
+function scrubPreservingIdentifiers(text, blobPatterns) {
+  const spans = [];
+  for (const m of text.matchAll(URL_RE)) {
+    const trimmed = trimUrlPunctuation(m[0]);
+    if (!trimmed)
+      continue;
+    const start = m.index ?? -1;
+    if (start < 0)
+      continue;
+    spans.push([start, start + trimmed.length]);
+  }
+  if (spans.length === 0)
+    return applyAll(text, blobPatterns);
+  let out = "";
+  let cursor = 0;
+  for (const [start, end] of spans) {
+    if (start < cursor)
+      continue;
+    out += applyAll(text.slice(cursor, start), blobPatterns);
+    out += scrubUrlSecrets(text.slice(start, end));
+    cursor = end;
+  }
+  return out + applyAll(text.slice(cursor), blobPatterns);
+}
+function applyAll(text, patterns) {
+  let out = text;
+  for (const re of patterns)
+    out = out.replace(re, "[redacted]");
+  return out;
+}
+function fnv1a64(s) {
+  const PRIME = 0x100000001b3n;
+  const MASK = 0xffffffffffffffffn;
+  let h = 0xcbf29ce484222325n;
+  for (let i = 0; i < s.length; i += 1) {
+    h ^= BigInt(s.charCodeAt(i));
+    h = h * PRIME & MASK;
+  }
+  return h.toString(16).padStart(16, "0");
+}
+var IDENTIFIER_MEMORY_NAME_PREFIX = "link:";
+function identifierMemoryName(url) {
+  let host = "";
+  try {
+    host = new URL(url).host.replace(/^www\./, "");
+  } catch {
+    host = "link";
+  }
+  const digest = fnv1a64(url);
+  const name = `${IDENTIFIER_MEMORY_NAME_PREFIX} ${host} ${digest}`;
+  return name.length <= 80 ? name : `${IDENTIFIER_MEMORY_NAME_PREFIX} ${digest}`;
+}
+var AGENT_IDENTIFIER_RULE = "An identifier the work depends on is never an ephemeral detail: when a message gives you a URL, file, folder, document or ticket id, save the identifier itself, verbatim, before you reply \u2014 as its own short entry, not folded into prose. A note that a link is coming is not a substitute for the link. You can always re-derive a summary; you can never re-derive an identifier without asking the person for it again.";
+var EXTRACTOR_IDENTIFIER_RULE = 'An identifier is ALWAYS durable, and is the one exception to "no one-off task details": if the conversation contains a URL, file, folder, document or ticket id that the work depends on, emit it as a "reference" memory with the identifier copied EXACTLY as it appeared \u2014 never paraphrased, never shortened, never described. Conversation history does not survive a restart, so an identifier that is only described is lost.';
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/identity.js
 var SCRATCH_RETENTION_DAYS = 7;
 var CLAUDE_MD_CHARS_PER_TOKEN = 3.57;
@@ -121,7 +276,7 @@ context. Two Markdown file types:
 **Save** when the user says "remember this", and proactively for decisions,
 preferences, non-obvious conventions, corrections to your approach, and important
 outcomes. **Don't save** what's derivable from the codebase or git history,
-ephemeral task details, or anything already in CHARTER.md / TOOLS.md.
+ephemeral task details, or anything already in CHARTER.md / TOOLS.md. ${AGENT_IDENTIFIER_RULE}
 
 **Writing:** append to the daily log (create if missing); update \`MEMORY.md\` by
 topic, editing or removing stale entries rather than only appending. Before the
@@ -12908,6 +13063,10 @@ export {
   MAX_AVATAR_ENV_URL_BYTES,
   resolveAvatarEnvUrl,
   PLATFORM_STORAGE_RULE,
+  findIdentifierUrls,
+  scrubPreservingIdentifiers,
+  identifierMemoryName,
+  EXTRACTOR_IDENTIFIER_RULE,
   SCRATCH_RETENTION_DAYS,
   CLAUDE_MD_CONTEXT_ALARM_CHARS,
   INTEGRATIONS_SECTION_START,
@@ -13052,4 +13211,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-62TAD4HO.js.map
+//# sourceMappingURL=chunk-DFOBTAPL.js.map