@integrity-labs/agt-cli 0.28.756 → 0.28.758

package/dist/bin/agt.js

@@ -41,12 +41,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-UFL5XDJF.js";
+} from "../chunk-ZUCWB2AP.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-VA6UHKFG.js";
+} from "../chunk-4GGLPSVH.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-GPDHLGBD.js";
+} from "../chunk-SD2Y6ZOB.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.756" : "dev";
+var cliVersion = true ? "0.28.758" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.756" : "dev";
+var cliVersion2 = true ? "0.28.758" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-VA6UHKFG.js → chunk-4GGLPSVH.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-GPDHLGBD.js";
+} from "./chunk-SD2Y6ZOB.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -4934,4 +4934,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-VA6UHKFG.js.map
+//# sourceMappingURL=chunk-4GGLPSVH.js.map

package/dist/{chunk-GPDHLGBD.js → chunk-SD2Y6ZOB.js}

@@ -240,6 +240,31 @@ function identifierMemoryName(url) {
 var AGENT_IDENTIFIER_RULE = "An identifier the work depends on is never an ephemeral detail: when a message gives you a URL, file, folder, document or ticket id, save the identifier itself, verbatim, before you reply \u2014 as its own short entry, not folded into prose. A note that a link is coming is not a substitute for the link. You can always re-derive a summary; you can never re-derive an identifier without asking the person for it again.";
 var EXTRACTOR_IDENTIFIER_RULE = 'An identifier is ALWAYS durable, and is the one exception to "no one-off task details": if the conversation contains a URL, file, folder, document or ticket id that the work depends on, emit it as a "reference" memory with the identifier copied EXACTLY as it appeared \u2014 never paraphrased, never shortened, never described. Conversation history does not survive a restart, so an identifier that is only described is lost.';
 
+// ../../packages/core/dist/provisioning/frameworks/claudecode/agent-rules.js
+var AGENT_RULES_SECTION_START = "<!-- AGT:RULES_START -->";
+var AGENT_RULES_SECTION_END = "<!-- AGT:RULES_END -->";
+var MAX_AGENT_RULES = 8;
+var MAX_AGENT_RULE_CHARS = 200;
+var MAX_AGENT_RULES_CHARS = MAX_AGENT_RULES * (MAX_AGENT_RULE_CHARS + 4);
+function buildAgentRulesSection(rules) {
+  const kept = rules.map((r) => r.text.trim()).filter(Boolean).filter((t) => t.length <= MAX_AGENT_RULE_CHARS).slice(0, MAX_AGENT_RULES);
+  if (kept.length === 0)
+    return "";
+  const lines = kept.map((t) => `- ${t}`).join("\n");
+  return `${AGENT_RULES_SECTION_START}
+## Standing rules from your people
+
+Rules your team has asked you to follow every time, in their words. They are not
+task-specific \u2014 they apply on every turn regardless of what you are doing. If one
+ever conflicts with a guardrail above, the guardrail wins and you should say so
+rather than silently picking one.
+
+${lines}
+${AGENT_RULES_SECTION_END}
+
+`;
+}
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/identity.js
 var SCRATCH_RETENTION_DAYS = 7;
 var CLAUDE_MD_CHARS_PER_TOKEN = 3.57;
@@ -936,6 +961,7 @@ function generateClaudeMd(input) {
   const renderIntegrations = input.renderIntegrationsSection === true;
   const integrationsSection = renderIntegrations ? buildIntegrationsSection(integrations) : "";
   const capabilityPromptSection = buildCapabilityPromptSection(integrations, renderIntegrations);
+  const agentRulesSection = buildAgentRulesSection(input.agentRules ?? []);
   const kanbanWorkPolicySection = buildKanbanWorkPolicySection();
   const platformStorageSection = buildPlatformStorageSection(input.hasWorkflows);
   const skillAuthoringSection = buildSkillAuthoringSection();
@@ -1109,7 +1135,7 @@ are defined in \`CHARTER.md\`.
 - Enforcement: Follow CHARTER.md constraints strictly.
 - Tools: MCP tools in your session are authorized \u2014 call them when the task needs them. A **permission denial** (explicit "not authorized" / 403-with-policy-message) is a guardrail signal: don't retry it. Every other error MUST be re-confirmed by an actual fresh tool call before you tell the user about it \u2014 see \xA7 Integration trust calibration.
 
-${guardrailsSection}## Approval acknowledgements
+${guardrailsSection}${agentRulesSection}## Approval acknowledgements
 
 This applies to **any** deferred-approval tool \u2014 anything returning \`pending\` that
 resolves later via a notification (AWS access grants, channel posts needing a human
@@ -10014,15 +10040,69 @@ function assessAuthConfigLinkage(input) {
 // ../../packages/core/dist/integrations/composio-account-probe.js
 var PROBE_TIMEOUT_MS = 1e4;
 var COMPOSIO_API_BASE = "https://backend.composio.dev";
+var BODY_SNIPPET_MAX = 300;
+async function readErrorBodySnippet(res, apiKey) {
+  let text;
+  try {
+    text = await res.text();
+  } catch {
+    return void 0;
+  }
+  const redacted = apiKey ? text.split(apiKey).join("\xABredacted\xBB") : text;
+  const trimmed = redacted.trim();
+  if (!trimmed)
+    return void 0;
+  return trimmed.length > BODY_SNIPPET_MAX ? `${trimmed.slice(0, BODY_SNIPPET_MAX)}\u2026` : trimmed;
+}
+var NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 204, 205, 304]);
+var BODY_MAX_BYTES = 1024 * 1024;
 async function timedFetch(fetchImpl, url, init) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
   try {
-    return await fetchImpl(url, { ...init, signal: controller.signal });
+    const res = await fetchImpl(url, { ...init, signal: controller.signal });
+    if (NULL_BODY_STATUSES.has(res.status))
+      return res;
+    const body = await readBoundedBody(res, controller);
+    return new Response(body, {
+      status: res.status,
+      statusText: res.statusText,
+      headers: res.headers
+    });
   } finally {
     clearTimeout(timer);
   }
 }
+async function readBoundedBody(res, controller) {
+  const stream = res.body;
+  if (!stream)
+    return await res.text();
+  const reader = stream.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done)
+      break;
+    if (!value)
+      continue;
+    total += value.byteLength;
+    if (total > BODY_MAX_BYTES) {
+      controller.abort();
+      await reader.cancel().catch(() => {
+      });
+      throw new Error(`Composio response body exceeded ${BODY_MAX_BYTES} bytes`);
+    }
+    chunks.push(value);
+  }
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(merged);
+}
 async function probeComposioAccount(params, fetchImpl = fetch) {
   const { connectedAccountId, apiKey, expectedUserId } = params;
   const base = params.apiBase ?? COMPOSIO_API_BASE;
@@ -10056,6 +10136,19 @@ async function probeComposioAccount(params, fetchImpl = fetch) {
         details: { connectedAccountId, httpStatus: res.status }
       };
     }
+    if (res.status === 401 || res.status === 403) {
+      const body = await readErrorBodySnippet(res, apiKey);
+      return {
+        status: "unverified",
+        cause: "access_restricted",
+        message: `Composio refused our API key (HTTP ${res.status}) \u2014 access restriction on our side, not a problem with this account; do not reconnect` + (body ? `. Composio said: ${body}` : ""),
+        details: {
+          connectedAccountId,
+          httpStatus: res.status,
+          ...body ? { responseBody: body } : {}
+        }
+      };
+    }
     return {
       status: "down",
       message: `Composio account ${connectedAccountId} not found (HTTP ${res.status}) \u2014 reconnect required`,
@@ -10499,13 +10592,13 @@ async function probeComposioMcpToolCall(config, fetchImpl = fetch) {
 
 // ../../packages/core/dist/integrations/connectivity-http-probes.js
 var PROBE_TIMEOUT_MS2 = 1e4;
-var NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 204, 205, 304]);
+var NULL_BODY_STATUSES2 = /* @__PURE__ */ new Set([101, 204, 205, 304]);
 async function timedFetch2(fetchImpl, url, init) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS2);
   try {
     const res = await fetchImpl(url, { ...init, signal: controller.signal });
-    if (NULL_BODY_STATUSES.has(res.status))
+    if (NULL_BODY_STATUSES2.has(res.status))
       return res;
     const body = await res.text();
     return new Response(body, {
@@ -13222,4 +13315,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-GPDHLGBD.js.map
+//# sourceMappingURL=chunk-SD2Y6ZOB.js.map