@integrity-labs/agt-cli 0.28.772 → 0.28.774

package/dist/{chunk-UPSDSMNC.js → chunk-PMKI7ZTP.js}

@@ -240,6 +240,70 @@ function identifierMemoryName(url) {
 var AGENT_IDENTIFIER_RULE = "An identifier the work depends on is never an ephemeral detail: when a message gives you a URL, file, folder, document or ticket id, save the identifier itself, verbatim, before you reply \u2014 as its own short entry, not folded into prose. A note that a link is coming is not a substitute for the link. You can always re-derive a summary; you can never re-derive an identifier without asking the person for it again.";
 var EXTRACTOR_IDENTIFIER_RULE = 'An identifier is ALWAYS durable, and is the one exception to "no one-off task details": if the conversation contains a URL, file, folder, document or ticket id that the work depends on, emit it as a "reference" memory with the identifier copied EXACTLY as it appeared \u2014 never paraphrased, never shortened, never described. Conversation history does not survive a restart, so an identifier that is only described is lost.';
 
+// ../../packages/core/dist/provisioning/mcp-secret-lint.js
+var LITERAL_SECRET_PATTERNS = [
+  // Slack bot token — `xoxb-<workspace>-<...>`
+  { name: "slack_bot_token", re: /^xoxb-/ },
+  // Slack app-level token (Socket Mode) — `xapp-<...>`
+  { name: "slack_app_token", re: /^xapp-/ },
+  // AGT host API key — `tlk_<...>` (see claudecode-plugin-augmented README).
+  { name: "agt_host_api_key", re: /^tlk_/ },
+  // Composio / generic api-key prefix — `ak_<...>`
+  { name: "composio_api_key", re: /^ak_/ },
+  // Telegram bot token — `<bot id>:AA<...>` (BotFather format). ENG-5901
+  // PR 4: the original `\d{10}:AAE` (from the issue AC) was too narrow —
+  // live tokens on agt-aws-1 carry `AA` + a varying third character
+  // (don/scout/stirling all had AA-not-E tokens the lint and migration
+  // missed). Bot ids are 8–12 digits; the token part always starts `AA`.
+  { name: "telegram_bot_token", re: /^\d{8,12}:AA[A-Za-z0-9_-]/ },
+  // ENG-5901 extension beyond the original AC's five patterns: a literal
+  // JWT (`eyJ...`) is the shape of a leaked AGT_API_KEY, which the
+  // value-prefix patterns above would otherwise miss. Header values often
+  // carry it behind `Bearer ` (or a copy-pasted `Authorization: Bearer `),
+  // so those prefixes are optionally consumed (CodeRabbit #1731).
+  // Templates (`Bearer ${AGT_API_KEY}`) and concrete non-secret values
+  // (UUIDs, hosts) never put `eyJ` after the prefix, so this stays
+  // false-positive-safe inside .mcp.json.
+  { name: "jwt_agt_api_key", re: /^(?:authorization:\s*)?(?:bearer\s+)?eyJ[A-Za-z0-9_-]+\./i }
+];
+function matchLiteralSecret(value) {
+  for (const { name, re } of LITERAL_SECRET_PATTERNS) {
+    if (re.test(value))
+      return name;
+  }
+  return null;
+}
+function scanRecord(server, record, location, findings) {
+  if (!record)
+    return;
+  for (const [field, value] of Object.entries(record)) {
+    if (typeof value !== "string")
+      continue;
+    const pattern = matchLiteralSecret(value);
+    if (pattern)
+      findings.push({ server, field, location, pattern });
+  }
+}
+function scanConfigForLiteralSecrets(config) {
+  const findings = [];
+  if (typeof config !== "object" || config === null)
+    return findings;
+  const servers = config.mcpServers;
+  if (typeof servers !== "object" || servers === null)
+    return findings;
+  for (const [server, raw] of Object.entries(servers)) {
+    if (typeof raw !== "object" || raw === null)
+      continue;
+    const entry = raw;
+    scanRecord(server, entry.env, "env", findings);
+    scanRecord(server, entry.headers, "header", findings);
+  }
+  return findings;
+}
+function formatLiteralSecretRejection(f) {
+  return `[mcp-write] [literal-secret-rejected] field=${f.field} server=${f.server} location=${f.location} pattern=${f.pattern}`;
+}
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/agent-rules.js
 var AGENT_RULES_SECTION_START = "<!-- AGT:RULES_START -->";
 var AGENT_RULES_SECTION_END = "<!-- AGT:RULES_END -->";
@@ -6217,6 +6281,74 @@ var FLAG_REGISTRY = [
     // dominant callers. This is precisely the deliberate, audited flip ADR-0022
     // §4 reserves confirmation for.
     sensitive: true
+  },
+  {
+    key: "artefact-export-jobs-serve",
+    description: 'ADR-0077 / ENG-9729 \u2014 the MASTER switch for the async artefact-export lane. ON (default) = a route may resolve an export request to an artefact_export_jobs row: attach to one that is already rendering, or hand back the bytes of one that has completed. OFF = the job lane is invisible and every export renders synchronously, which is the pre-ADR-0077 behaviour. DEFAULT true DOES NOT MEAN ASYNC IS ON. Nothing CREATES a job unless artefact-export-jobs-start is also on, so with the shipped defaults this flag governs an empty table and no caller can tell it exists. WHY THE LANE IS TWO FLAGS AND NOT ONE. Disarming the start lever while renders are in flight must not strand the callers holding their job ids: those renders keep running (a Lambda invocation nobody awaits still runs to completion), and their bytes land in the private bucket regardless. A single flag would take the only door to them away at the moment it was most needed. So "stop creating new jobs" and "keep serving the ones that exist" are separate, and this is the second one. READ-ONLY BY CONSTRUCTION: with start off, the route looks up a REUSABLE row and nothing more \u2014 it never inserts, never requeues a terminal row, and never dispatches a renderer. A requeue mints an attempt and fires an invoke, so a serve lever that requeued would start new renders under a disarmed start lever, which is the exact thing disarming it was meant to stop. Evaluated server-side per request (org-scoped), so a flip applies within the evaluation cache TTL with no deploy and no host update. Deliberately NO envVar: the consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and a literal in sst.config.ts would pin every stage and make the admin control inert (ENG-8303).',
+    flagType: "boolean",
+    // ON is the no-op default here, which looks like the wrong direction until
+    // you read it with the start lever: serving an empty table is
+    // indistinguishable from not serving at all. Shipping it OFF would instead
+    // mean that arming async later takes TWO flips, and that the second one is
+    // the easy one to forget — leaving a fleet that creates jobs it refuses to
+    // serve, i.e. every slow export failing while the flag page reads "async: on".
+    defaultValue: true
+  },
+  {
+    key: "artefact-export-jobs-start",
+    description: "ADR-0077 / ENG-9729 \u2014 whether a route may CREATE an async artefact-export job: insert or requeue an artefact_export_jobs row, dispatch the worker, and answer a caller with a job id instead of bytes when the ~20s grace window is exceeded. OFF (default) = today's synchronous render on every export. THIS IS THE ROLLOUT GATE, AND IT IS ORDERED AGAINST A CLIENT, NOT A DEPLOY. The agent caller is `artefacts_download`, which ships inside the agt CLI to a permanently mixed-version fleet \u2014 hosts self-update overnight and some never do. Arming this against a CLI that cannot read a job-id body does not degrade an export, it BREAKS one: the pre-ENG-9729 tool does Buffer.from(data.base64) with no branch for any other shape, so a job id arrives as a TypeError deep in file-write logic. That is strictly worse than the 503 + Retry-After it would replace, which the tool already understands. A published CLI version is NOT evidence of convergence \u2014 measure hosts.agt_version across recently-seen hosts first. The procedure is docs/runbooks/async-export-rollout.md; arm this only after running it. Turning it back OFF stops new jobs and leaves artefact-export-jobs-serve delivering the in-flight ones, which is why the two are separate. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark. The client half of this change publishes with the same merge, and
+    // the fleet has not converged on it at merge time by construction — see the
+    // runbook. Arming is an operator action taken against a measurement.
+    defaultValue: false,
+    // Arming this changes the RESPONSE SHAPE of a route whose callers include a
+    // binary we do not control the version of. ADR-0022 section 4 reserves
+    // confirmation for exactly this: a flip that a single unguarded write should
+    // not be able to make.
+    sensitive: true,
+    // `since` USED SLIGHTLY OFF-LABEL, AND THAT IS THE POINT.
+    //
+    // The field's docblock says it records the CLI whose build first shipped
+    // this flag's HOST-SIDE READER, and this flag has none — it is evaluated
+    // server-side in the export route, so every host "honors" a flip the instant
+    // it is made. Read literally, `since` should therefore be undefined.
+    //
+    // Undefined is the dangerous answer. `classifyHostReach` returns `honors`
+    // for every host when `since` is unset, so the flip-reach modal — the screen
+    // an operator is looking at AT THE MOMENT OF THE FLIP — would report full
+    // reach for the one flag whose entire purpose is "do not flip this until you
+    // have measured the fleet". It would be telling the truth about the
+    // mechanism (the flip does reach every host immediately) while giving
+    // exactly the wrong answer to the question being asked (can those hosts
+    // survive it). The dependency is real; it is on the CLI's ability to SURVIVE
+    // the flag, not to READ it, and the modal cannot tell those apart.
+    //
+    // Pinned ABOVE every published release on purpose, the `agt-bin-path`
+    // precedent: it classifies EVERY host as `stale`, so the modal reports no
+    // reach rather than reach it has no basis for. A guessed number would be
+    // worse than a placeholder, and the two directions are not symmetric —
+    // too HIGH over-warns (annoying), too LOW promises reach to a build that
+    // answers a job id with a TypeError inside file-write logic (a broken export
+    // reported to the agent as "download failed").
+    //
+    // The exact version cannot be known here: the CLI auto-publishes ON MERGE of
+    // this change, patch-bumping from whatever is current, so any pre-merge
+    // value is a guess. Do NOT read it off `apps/cli/package.json`, and do NOT
+    // trust a version produced by re-running a failed publish job (ENG-9647: a
+    // re-run rebuilds the ORIGINAL tree under a HIGHER number, so the version
+    // string would claim a capability the bytes do not carry).
+    //
+    // AND `since` IS ADVISORY, NOT A GUARD. It is read in exactly one place —
+    // the flip-reach modal. Nothing in the evaluation or override-write path
+    // consults it, so this changes what an operator is TOLD and does not stop a
+    // flip on an under-`since` host. What holds the line is `defaultValue:
+    // false` + `sensitive: true` + the runbook.
+    //
+    // REPLACING IT IS STEP 1 OF THE ARMING PROCEDURE in
+    // docs/runbooks/async-export-rollout.md, so the placeholder has a named
+    // owner and a named moment rather than being a deferral nobody holds.
+    since: "0.29.0"
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
@@ -13184,6 +13316,9 @@ function readDailySessionPin(codeName) {
 }
 
 export {
+  LITERAL_SECRET_PATTERNS,
+  scanConfigForLiteralSecrets,
+  formatLiteralSecretRejection,
   DEFAULT_FRAMEWORK,
   isDeprecatedFramework,
   modelSlotsForFramework,
@@ -13347,4 +13482,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-UPSDSMNC.js.map
+//# sourceMappingURL=chunk-PMKI7ZTP.js.map