@integrity-labs/agt-cli 0.28.779 → 0.28.780

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-3IDAWL35.js";
+} from "../chunk-VYFQRDSP.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-NTWABPKO.js";
+} from "../chunk-HHFDK7WB.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-LLBJLKGL.js";
+} from "../chunk-REPC7LF2.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.779" : "dev";
+var cliVersion = true ? "0.28.780" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.779" : "dev";
+var cliVersion2 = true ? "0.28.780" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-NTWABPKO.js → chunk-HHFDK7WB.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-LLBJLKGL.js";
+} from "./chunk-REPC7LF2.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5141,4 +5141,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-NTWABPKO.js.map
+//# sourceMappingURL=chunk-HHFDK7WB.js.map

package/dist/{chunk-LLBJLKGL.js → chunk-REPC7LF2.js}

@@ -82,6 +82,101 @@ function resolveAvatarEnvUrl(raw) {
   return { url: trimmed };
 }
 
+// ../../packages/core/dist/provisioning/mcp-secret-lint.js
+var LITERAL_SECRET_PATTERNS = [
+  // Slack bot token — `xoxb-<workspace>-<...>`
+  { name: "slack_bot_token", re: /^xoxb-/ },
+  // Slack app-level token (Socket Mode) — `xapp-<...>`
+  { name: "slack_app_token", re: /^xapp-/ },
+  // AGT host API key — `tlk_<...>` (see claudecode-plugin-augmented README).
+  { name: "agt_host_api_key", re: /^tlk_/ },
+  // Composio / generic api-key prefix — `ak_<...>`
+  { name: "composio_api_key", re: /^ak_/ },
+  // Telegram bot token — `<bot id>:AA<...>` (BotFather format). ENG-5901
+  // PR 4: the original `\d{10}:AAE` (from the issue AC) was too narrow —
+  // live tokens on agt-aws-1 carry `AA` + a varying third character
+  // (don/scout/stirling all had AA-not-E tokens the lint and migration
+  // missed). Bot ids are 8–12 digits; the token part always starts `AA`.
+  { name: "telegram_bot_token", re: /^\d{8,12}:AA[A-Za-z0-9_-]/ },
+  // ENG-5901 extension beyond the original AC's five patterns: a literal
+  // JWT (`eyJ...`) is the shape of a leaked AGT_API_KEY, which the
+  // value-prefix patterns above would otherwise miss. Header values often
+  // carry it behind `Bearer ` (or a copy-pasted `Authorization: Bearer `),
+  // so those prefixes are optionally consumed (CodeRabbit #1731).
+  // Templates (`Bearer ${AGT_API_KEY}`) and concrete non-secret values
+  // (UUIDs, hosts) never put `eyJ` after the prefix, so this stays
+  // false-positive-safe inside .mcp.json.
+  { name: "jwt_agt_api_key", re: /^(?:authorization:\s*)?(?:bearer\s+)?eyJ[A-Za-z0-9_-]+\./i }
+];
+function matchLiteralSecret(value) {
+  for (const { name, re } of LITERAL_SECRET_PATTERNS) {
+    if (re.test(value))
+      return name;
+  }
+  return null;
+}
+function scanRecord(server, record, location, findings) {
+  if (!record)
+    return;
+  for (const [field, value] of Object.entries(record)) {
+    if (typeof value !== "string")
+      continue;
+    const pattern = matchLiteralSecret(value);
+    if (pattern)
+      findings.push({ server, field, location, pattern });
+  }
+}
+function scanConfigForLiteralSecrets(config) {
+  const findings = [];
+  if (typeof config !== "object" || config === null)
+    return findings;
+  const servers = config.mcpServers;
+  if (typeof servers !== "object" || servers === null)
+    return findings;
+  for (const [server, raw] of Object.entries(servers)) {
+    if (typeof raw !== "object" || raw === null)
+      continue;
+    const entry = raw;
+    scanRecord(server, entry.env, "env", findings);
+    scanRecord(server, entry.headers, "header", findings);
+  }
+  return findings;
+}
+function formatLiteralSecretRejection(f) {
+  return `[mcp-write] [literal-secret-rejected] field=${f.field} server=${f.server} location=${f.location} pattern=${f.pattern}`;
+}
+
+// ../../packages/core/dist/provisioning/frameworks/claudecode/agent-rules.js
+var AGENT_RULES_SECTION_START = "<!-- AGT:RULES_START -->";
+var AGENT_RULES_SECTION_END = "<!-- AGT:RULES_END -->";
+var MAX_AGENT_RULES = 8;
+var MAX_AGENT_RULE_CHARS = 200;
+var MAX_AGENT_RULES_CHARS = MAX_AGENT_RULES * (MAX_AGENT_RULE_CHARS + 4);
+function agentRulesRestartBasis(rules) {
+  return [...rules].map((r) => r.text.trim()).filter((t) => t.length > 0).sort().join("\0");
+}
+function agentHasRules(rules) {
+  return rules.some((r) => r.text.trim().length > 0);
+}
+function buildAgentRulesSection(rules) {
+  const kept = rules.map((r) => r.text.trim()).filter(Boolean).filter((t) => t.length <= MAX_AGENT_RULE_CHARS).slice(0, MAX_AGENT_RULES);
+  if (kept.length === 0)
+    return "";
+  const lines = kept.map((t) => `- ${t}`).join("\n");
+  return `${AGENT_RULES_SECTION_START}
+## Standing rules from your people
+
+Rules your team has asked you to follow every time, in their words. They are not
+task-specific \u2014 they apply on every turn regardless of what you are doing. If one
+ever conflicts with a guardrail above, the guardrail wins and you should say so
+rather than silently picking one.
+
+${lines}
+${AGENT_RULES_SECTION_END}
+
+`;
+}
+
 // ../../packages/core/dist/provisioning/platform-storage.js
 var PLATFORM_STORAGE_RULE = "Store durable, reusable work you build (repeatable procedures, recurring responsibilities, scheduled automation, orchestration scripts) through the Augmented Team platform tools, never as loose local files, unless the user explicitly requests a different destination. Platform artifacts are versioned, reviewable, and survive re-provisioning; loose local files are wiped on the next provision rebuild, reach no one else, and bypass review. Ephemeral scratch files for the task at hand are fine on disk.";
 
@@ -240,95 +335,6 @@ function identifierMemoryName(url) {
 var AGENT_IDENTIFIER_RULE = "An identifier the work depends on is never an ephemeral detail: when a message gives you a URL, file, folder, document or ticket id, save the identifier itself, verbatim, before you reply \u2014 as its own short entry, not folded into prose. A note that a link is coming is not a substitute for the link. You can always re-derive a summary; you can never re-derive an identifier without asking the person for it again.";
 var EXTRACTOR_IDENTIFIER_RULE = 'An identifier is ALWAYS durable, and is the one exception to "no one-off task details": if the conversation contains a URL, file, folder, document or ticket id that the work depends on, emit it as a "reference" memory with the identifier copied EXACTLY as it appeared \u2014 never paraphrased, never shortened, never described. Conversation history does not survive a restart, so an identifier that is only described is lost.';
 
-// ../../packages/core/dist/provisioning/mcp-secret-lint.js
-var LITERAL_SECRET_PATTERNS = [
-  // Slack bot token — `xoxb-<workspace>-<...>`
-  { name: "slack_bot_token", re: /^xoxb-/ },
-  // Slack app-level token (Socket Mode) — `xapp-<...>`
-  { name: "slack_app_token", re: /^xapp-/ },
-  // AGT host API key — `tlk_<...>` (see claudecode-plugin-augmented README).
-  { name: "agt_host_api_key", re: /^tlk_/ },
-  // Composio / generic api-key prefix — `ak_<...>`
-  { name: "composio_api_key", re: /^ak_/ },
-  // Telegram bot token — `<bot id>:AA<...>` (BotFather format). ENG-5901
-  // PR 4: the original `\d{10}:AAE` (from the issue AC) was too narrow —
-  // live tokens on agt-aws-1 carry `AA` + a varying third character
-  // (don/scout/stirling all had AA-not-E tokens the lint and migration
-  // missed). Bot ids are 8–12 digits; the token part always starts `AA`.
-  { name: "telegram_bot_token", re: /^\d{8,12}:AA[A-Za-z0-9_-]/ },
-  // ENG-5901 extension beyond the original AC's five patterns: a literal
-  // JWT (`eyJ...`) is the shape of a leaked AGT_API_KEY, which the
-  // value-prefix patterns above would otherwise miss. Header values often
-  // carry it behind `Bearer ` (or a copy-pasted `Authorization: Bearer `),
-  // so those prefixes are optionally consumed (CodeRabbit #1731).
-  // Templates (`Bearer ${AGT_API_KEY}`) and concrete non-secret values
-  // (UUIDs, hosts) never put `eyJ` after the prefix, so this stays
-  // false-positive-safe inside .mcp.json.
-  { name: "jwt_agt_api_key", re: /^(?:authorization:\s*)?(?:bearer\s+)?eyJ[A-Za-z0-9_-]+\./i }
-];
-function matchLiteralSecret(value) {
-  for (const { name, re } of LITERAL_SECRET_PATTERNS) {
-    if (re.test(value))
-      return name;
-  }
-  return null;
-}
-function scanRecord(server, record, location, findings) {
-  if (!record)
-    return;
-  for (const [field, value] of Object.entries(record)) {
-    if (typeof value !== "string")
-      continue;
-    const pattern = matchLiteralSecret(value);
-    if (pattern)
-      findings.push({ server, field, location, pattern });
-  }
-}
-function scanConfigForLiteralSecrets(config) {
-  const findings = [];
-  if (typeof config !== "object" || config === null)
-    return findings;
-  const servers = config.mcpServers;
-  if (typeof servers !== "object" || servers === null)
-    return findings;
-  for (const [server, raw] of Object.entries(servers)) {
-    if (typeof raw !== "object" || raw === null)
-      continue;
-    const entry = raw;
-    scanRecord(server, entry.env, "env", findings);
-    scanRecord(server, entry.headers, "header", findings);
-  }
-  return findings;
-}
-function formatLiteralSecretRejection(f) {
-  return `[mcp-write] [literal-secret-rejected] field=${f.field} server=${f.server} location=${f.location} pattern=${f.pattern}`;
-}
-
-// ../../packages/core/dist/provisioning/frameworks/claudecode/agent-rules.js
-var AGENT_RULES_SECTION_START = "<!-- AGT:RULES_START -->";
-var AGENT_RULES_SECTION_END = "<!-- AGT:RULES_END -->";
-var MAX_AGENT_RULES = 8;
-var MAX_AGENT_RULE_CHARS = 200;
-var MAX_AGENT_RULES_CHARS = MAX_AGENT_RULES * (MAX_AGENT_RULE_CHARS + 4);
-function buildAgentRulesSection(rules) {
-  const kept = rules.map((r) => r.text.trim()).filter(Boolean).filter((t) => t.length <= MAX_AGENT_RULE_CHARS).slice(0, MAX_AGENT_RULES);
-  if (kept.length === 0)
-    return "";
-  const lines = kept.map((t) => `- ${t}`).join("\n");
-  return `${AGENT_RULES_SECTION_START}
-## Standing rules from your people
-
-Rules your team has asked you to follow every time, in their words. They are not
-task-specific \u2014 they apply on every turn regardless of what you are doing. If one
-ever conflicts with a guardrail above, the guardrail wins and you should say so
-rather than silently picking one.
-
-${lines}
-${AGENT_RULES_SECTION_END}
-
-`;
-}
-
 // ../../packages/core/dist/provisioning/frameworks/claudecode/identity.js
 var SCRATCH_RETENTION_DAYS = 7;
 var CLAUDE_MD_CHARS_PER_TOKEN = 3.57;
@@ -13341,6 +13347,8 @@ export {
   scrubPreservingIdentifiers,
   identifierMemoryName,
   EXTRACTOR_IDENTIFIER_RULE,
+  agentRulesRestartBasis,
+  agentHasRules,
   SCRATCH_RETENTION_DAYS,
   CLAUDE_MD_CONTEXT_ALARM_CHARS,
   INTEGRATIONS_SECTION_START,
@@ -13485,4 +13493,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-LLBJLKGL.js.map
+//# sourceMappingURL=chunk-REPC7LF2.js.map