@integrity-labs/agt-cli 0.28.772 → 0.28.774

package/dist/bin/agt.js

@@ -2,7 +2,6 @@
 import {
   ApiError,
   DRAIN_MANIFEST_FILENAME,
-  LITERAL_SECRET_PATTERNS,
   PROD_AGT_HOST,
   api,
   buildConnectivityProbeDeps,
@@ -41,17 +40,18 @@ import {
   success,
   table,
   warn
-} from "../chunk-SBAX57SN.js";
+} from "../chunk-BUCKLMKD.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-R6XGVTQS.js";
+} from "../chunk-SXTHAF3R.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
   DEPLOYMENT_TEMPLATES,
+  LITERAL_SECRET_PATTERNS,
   SLACK_SCOPE_CATEGORY_LABELS,
   SLACK_SCOPE_PRESETS,
   SlackApiError,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-UPSDSMNC.js";
+} from "../chunk-PMKI7ZTP.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.772" : "dev";
+var cliVersion = true ? "0.28.774" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.772" : "dev";
+var cliVersion2 = true ? "0.28.774" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-SBAX57SN.js → chunk-BUCKLMKD.js}

@@ -14,7 +14,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-R6XGVTQS.js";
+} from "./chunk-SXTHAF3R.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -36,6 +36,7 @@ import {
   buildForwardHeaders,
   buildIntegrationsSection,
   coerceEnvValue,
+  formatLiteralSecretRejection,
   generateClaudeMd,
   getFlagDefinition,
   getFramework,
@@ -61,82 +62,17 @@ import {
   remoteMcpServerKey,
   resolveAvatarEnvUrl,
   resolveConnectivityProbe,
+  scanConfigForLiteralSecrets,
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-UPSDSMNC.js";
+} from "./chunk-PMKI7ZTP.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
 
 // ../../packages/core/dist/provisioning/mcp-config-guards.js
 import { chmodSync, existsSync, readFileSync, renameSync, writeFileSync, unlinkSync } from "fs";
-
-// ../../packages/core/dist/provisioning/mcp-secret-lint.js
-var LITERAL_SECRET_PATTERNS = [
-  // Slack bot token — `xoxb-<workspace>-<...>`
-  { name: "slack_bot_token", re: /^xoxb-/ },
-  // Slack app-level token (Socket Mode) — `xapp-<...>`
-  { name: "slack_app_token", re: /^xapp-/ },
-  // AGT host API key — `tlk_<...>` (see claudecode-plugin-augmented README).
-  { name: "agt_host_api_key", re: /^tlk_/ },
-  // Composio / generic api-key prefix — `ak_<...>`
-  { name: "composio_api_key", re: /^ak_/ },
-  // Telegram bot token — `<bot id>:AA<...>` (BotFather format). ENG-5901
-  // PR 4: the original `\d{10}:AAE` (from the issue AC) was too narrow —
-  // live tokens on agt-aws-1 carry `AA` + a varying third character
-  // (don/scout/stirling all had AA-not-E tokens the lint and migration
-  // missed). Bot ids are 8–12 digits; the token part always starts `AA`.
-  { name: "telegram_bot_token", re: /^\d{8,12}:AA[A-Za-z0-9_-]/ },
-  // ENG-5901 extension beyond the original AC's five patterns: a literal
-  // JWT (`eyJ...`) is the shape of a leaked AGT_API_KEY, which the
-  // value-prefix patterns above would otherwise miss. Header values often
-  // carry it behind `Bearer ` (or a copy-pasted `Authorization: Bearer `),
-  // so those prefixes are optionally consumed (CodeRabbit #1731).
-  // Templates (`Bearer ${AGT_API_KEY}`) and concrete non-secret values
-  // (UUIDs, hosts) never put `eyJ` after the prefix, so this stays
-  // false-positive-safe inside .mcp.json.
-  { name: "jwt_agt_api_key", re: /^(?:authorization:\s*)?(?:bearer\s+)?eyJ[A-Za-z0-9_-]+\./i }
-];
-function matchLiteralSecret(value) {
-  for (const { name, re } of LITERAL_SECRET_PATTERNS) {
-    if (re.test(value))
-      return name;
-  }
-  return null;
-}
-function scanRecord(server, record, location, findings) {
-  if (!record)
-    return;
-  for (const [field, value] of Object.entries(record)) {
-    if (typeof value !== "string")
-      continue;
-    const pattern = matchLiteralSecret(value);
-    if (pattern)
-      findings.push({ server, field, location, pattern });
-  }
-}
-function scanConfigForLiteralSecrets(config) {
-  const findings = [];
-  if (typeof config !== "object" || config === null)
-    return findings;
-  const servers = config.mcpServers;
-  if (typeof servers !== "object" || servers === null)
-    return findings;
-  for (const [server, raw] of Object.entries(servers)) {
-    if (typeof raw !== "object" || raw === null)
-      continue;
-    const entry = raw;
-    scanRecord(server, entry.env, "env", findings);
-    scanRecord(server, entry.headers, "header", findings);
-  }
-  return findings;
-}
-function formatLiteralSecretRejection(f) {
-  return `[mcp-write] [literal-secret-rejected] field=${f.field} server=${f.server} location=${f.location} pattern=${f.pattern}`;
-}
-
-// ../../packages/core/dist/provisioning/mcp-config-guards.js
 var MCP_FILE_MODE = 384;
 var lastRejectionFingerprintByPath = /* @__PURE__ */ new Map();
 var REQUIRED_ENV_RULES_BY_SERVER = {
@@ -6452,7 +6388,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.772" : "dev";
+var agtCliVersion = true ? "0.28.774" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10566,7 +10502,6 @@ function withEvidence(outcome, evidence) {
 }
 
 export {
-  LITERAL_SECRET_PATTERNS,
   safeWriteJsonAtomic,
   extractCommandNotFound,
   migrateAgentDirToIdKeyed,
@@ -10655,4 +10590,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-SBAX57SN.js.map
+//# sourceMappingURL=chunk-BUCKLMKD.js.map