@integrity-labs/agt-cli 0.28.769 → 0.28.770

package/dist/bin/agt.js

@@ -41,12 +41,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-6XPTQR7W.js";
+} from "../chunk-E4YS6E4T.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-THSP5NB6.js";
+} from "../chunk-R6XGVTQS.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-MBUWL4UL.js";
+} from "../chunk-UPSDSMNC.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.769" : "dev";
+var cliVersion = true ? "0.28.770" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.769" : "dev";
+var cliVersion2 = true ? "0.28.770" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-6XPTQR7W.js → chunk-E4YS6E4T.js}

@@ -14,7 +14,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-THSP5NB6.js";
+} from "./chunk-R6XGVTQS.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -64,7 +64,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-MBUWL4UL.js";
+} from "./chunk-UPSDSMNC.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6452,7 +6452,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.769" : "dev";
+var agtCliVersion = true ? "0.28.770" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10655,4 +10655,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-6XPTQR7W.js.map
+//# sourceMappingURL=chunk-E4YS6E4T.js.map

package/dist/{chunk-THSP5NB6.js → chunk-R6XGVTQS.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-MBUWL4UL.js";
+} from "./chunk-UPSDSMNC.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5141,4 +5141,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-THSP5NB6.js.map
+//# sourceMappingURL=chunk-R6XGVTQS.js.map

package/dist/{chunk-MBUWL4UL.js → chunk-UPSDSMNC.js}

@@ -829,10 +829,18 @@ function formatEmailDomainConfigLines(config) {
   const stage = typeof config.stage === "string" ? config.stage : void 0;
   const enforceLive = config.enforce_live === true;
   const approvalLive = config.approval_live === true;
+  const approvalCoveredActions = stringList(config.approval_covered_actions);
   if (stage) {
     lines.push(`  - stage: ${stage}`);
     if (stage === "require_approval" && approvalLive) {
-      lines.push(`  *Human approval: sending to a non-allowed domain is allowed but held for a person to approve. You MUST attempt the send as you normally would - do NOT refuse it and do NOT tell the user to send it themselves. The platform automatically holds the send and routes it to an approver (an Approve/Deny card); it executes if approved, is blocked if denied, and you are told the outcome. Just send; the approval is handled for you.*`);
+      if (approvalCoveredActions.length > 0) {
+        lines.push(`  *SCOPE - read this before you rely on the hold below. It is not universal. It engages for these mail actions and no others: ${approvalCoveredActions.join(", ")}. Every other route to sending mail is UNHELD and fails open - a provider or tool not named here, a draft-send whose recipients the platform cannot read from the call, a mail rule or filter, or any new integration nobody has wired into the hold yet. Nothing catches those. For them, produce the draft, hand it to a human, and let them send it.*`);
+      } else {
+        lines.push(`  *SCOPE - the hold below does NOT cover every route to sending mail, and this host does not report which routes it covers. Where you cannot confirm a send is covered - an unusual provider or tool, a mail rule or filter, a draft-send whose recipients are not in the call - treat it as unheld: produce the draft and hand it to a human.*`);
+      }
+      lines.push(`  *Human approval: sending to a non-allowed domain is allowed but routed to a person for approval. Attempt the send as you normally would - do NOT refuse it outright, and do NOT tell the user to go and send it themselves: the platform is configured to hold it and route it to an approver (an Approve/Deny card), and you are told the outcome. Two limits on that. (1) An explicit user instruction WINS: if the user asked you to route it for their review, to leave it in drafts, or to check with them before it goes, do THAT - leave the message unsent and tell them it is ready. Their instruction is not satisfied by the platform's hold. (2) Do NOT assume the hold engaged. If the send tool returns a sent/delivered result rather than a pending/held one, the hold did not fire - say so plainly in the same turn, treat the message as already gone, and do not send again to a non-allowed domain until a human confirms the gate is working.*`);
+    } else if (stage === "require_approval") {
+      lines.push(`  *Currently observe-only for approval: the API records the domain decision to guardrail_audit_log but does not block sends at this stage, and approval routing is NOT armed - so nothing would hold a message to a non-allowed domain. It would go straight out. Do NOT send one. Prepare it as a draft, tell the user it is ready and needs them to send it, and let them decide. This is deliberate fail-closed behaviour: a hold the platform cannot confirm is treated as no hold at all. Treat the restriction as authoritative guidance; the runtime flip is operator-side.*`);
     } else if (!(stage === "enforce" && enforceLive)) {
       lines.push(`  *Currently observe-only: the API records domain decisions to guardrail_audit_log but does not block sends at this stage. Honor the restriction as authoritative guidance; the runtime flip is operator-side.*`);
     }
@@ -898,7 +906,7 @@ function effectiveEmailEnforcement(g) {
     return g.enforcement;
   if (stage === "warn")
     return g.enforcement === "enforce" ? "warn" : g.enforcement;
-  if (stage === "require_approval" && g.config?.["approval_live"] === true) {
+  if (stage === "require_approval") {
     return g.enforcement === "enforce" ? "warn" : g.enforcement;
   }
   return "log";
@@ -2831,6 +2839,9 @@ function classifyActor(lastActorId, selfAgentId) {
   return "unknown";
 }
 
+// ../../packages/core/dist/types/model-policy.js
+var KNOWN_MODEL_POLICY_SLOTS = [...KNOWN_MODEL_SLOTS].sort();
+
 // ../../packages/core/dist/types/integration.js
 var HITL_TIER_ORDER = [
   "read",
@@ -13336,4 +13347,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-MBUWL4UL.js.map
+//# sourceMappingURL=chunk-UPSDSMNC.js.map