@integrity-labs/agt-cli 0.28.790 → 0.28.792

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-R54PIXWM.js";
+} from "../chunk-GQLJGQVM.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-6BD4IUWX.js";
+} from "../chunk-RBRA7WOL.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-RDPAELV2.js";
+} from "../chunk-6DWVW3Y3.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.790" : "dev";
+var cliVersion = true ? "0.28.792" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.790" : "dev";
+var cliVersion2 = true ? "0.28.792" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-RDPAELV2.js → chunk-6DWVW3Y3.js}

@@ -929,6 +929,39 @@ function formatCalendarConfidentialityLines(config) {
   }
   return lines;
 }
+var CHANNEL_ALLOWLIST_KEY = "allowed_channels";
+function hasEmptyChannelAllowlist(g) {
+  const config = g.config ?? {};
+  if (!Object.prototype.hasOwnProperty.call(config, CHANNEL_ALLOWLIST_KEY))
+    return false;
+  const value = config[CHANNEL_ALLOWLIST_KEY];
+  if (!Array.isArray(value))
+    return true;
+  return value.filter((c) => typeof c === "string" && c.trim() !== "").length === 0;
+}
+function effectiveChannelAllowlistEnforcement(g) {
+  if (g.enforcement === "disabled")
+    return g.enforcement;
+  if (g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF)
+    return g.enforcement;
+  if (g.definitionId === CALENDAR_CONFIDENTIALITY_DEF)
+    return g.enforcement;
+  if (!hasEmptyChannelAllowlist(g))
+    return g.enforcement;
+  return "log";
+}
+function formatEmptyChannelAllowlistLines() {
+  return [
+    `  **This guardrail is misconfigured and enforces nothing.** Its channel allowlist`,
+    `  contains no usable channel entry \u2014 it is empty, or holds only blanks or values`,
+    `  that are not channel names \u2014 so it names no permitted channel and no forbidden`,
+    `  one, and nothing in the platform reads it. Do NOT refuse to post on its basis,`,
+    `  and do not treat it as a`,
+    `  list of channels you are approved for. Report it to your operator: this guardrail`,
+    `  was retired from the library in July 2026 (ENG-7476) and this application outlived`,
+    `  the removal (ENG-9663).`
+  ];
+}
 function renderGuardrailBullet(g) {
   const lines = [];
   const header = `- **${g.displayName}** (${g.category}, from ${g.source})`;
@@ -936,7 +969,11 @@ function renderGuardrailBullet(g) {
   if (g.description?.trim()) {
     lines.push(`  ${g.description.trim()}`);
   }
-  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : g.definitionId === CALENDAR_CONFIDENTIALITY_DEF ? formatCalendarConfidentialityLines(g.config) : formatConfigLines(g.config));
+  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : g.definitionId === CALENDAR_CONFIDENTIALITY_DEF ? formatCalendarConfidentialityLines(g.config) : (
+    // ENG-9663: checked AFTER the two named formatters, so an email or
+    // calendar guardrail can never be captured by the structural match.
+    hasEmptyChannelAllowlist(g) ? formatEmptyChannelAllowlistLines() : formatConfigLines(g.config)
+  ));
   return lines.join("\n");
 }
 function renderOverriddenGuardrailBullet(g) {
@@ -950,7 +987,11 @@ function renderOverriddenGuardrailBullet(g) {
   if (g.description?.trim()) {
     lines.push(`  ${g.description.trim()}`);
   }
-  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : g.definitionId === CALENDAR_CONFIDENTIALITY_DEF ? formatCalendarConfidentialityLines(g.config) : formatConfigLines(g.config));
+  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : g.definitionId === CALENDAR_CONFIDENTIALITY_DEF ? formatCalendarConfidentialityLines(g.config) : (
+    // ENG-9663: checked AFTER the two named formatters, so an email or
+    // calendar guardrail can never be captured by the structural match.
+    hasEmptyChannelAllowlist(g) ? formatEmptyChannelAllowlistLines() : formatConfigLines(g.config)
+  ));
   return lines.join("\n");
 }
 function effectiveCalendarEnforcement(g) {
@@ -985,9 +1026,12 @@ function buildGuardrailsSection(guardrails) {
   if (!guardrails || guardrails.length === 0)
     return "";
   const active = guardrails.map((g) => {
-    const enforcement = effectiveEmailEnforcement({
+    const enforcement = effectiveChannelAllowlistEnforcement({
       ...g,
-      enforcement: effectiveCalendarEnforcement(g)
+      enforcement: effectiveEmailEnforcement({
+        ...g,
+        enforcement: effectiveCalendarEnforcement(g)
+      })
     });
     return { ...g, enforcement };
   }).filter((g) => g.enforcement !== "disabled" || !!(g.overrideApplied && g.overrideReason?.trim()));
@@ -1880,7 +1924,29 @@ var INTEGRATION_REGISTRY = [
     premium: {
       pricing: "usage",
       note: "Billed per minute of real-time voice conversation.",
-      meters: [{ event_type: "voice_session", unit: "minute" }]
+      meters: [
+        { event_type: "voice_session", unit: "minute" },
+        // ENG-9870. Ninja Notes cloud transcription, on the SAME definition id
+        // and therefore the SAME $50/org pool as voice conversation — Brad's
+        // call on 2026-09-03, against a recommendation to separate it. Sharing
+        // is by construction rather than by wiring: `evaluateUsageBudget`
+        // iterates every event type under the definition.
+        //
+        // `audio_hour`, not `minute`. The vendor prices per hour and the sell
+        // price is per hour, so hours store exactly (50 minor) where minutes
+        // would be 0.8333 repeating; `integration_usage_events.units` is
+        // `numeric`, so a 30-minute meeting records 0.5 units precisely. This
+        // is the answer to ENG-9773 §10.1's open question about whether hours
+        // convert to minutes or the vocabulary gains hours.
+        //
+        // NOTHING RECORDS THIS EVENT YET. Metering belongs at the chokepoint
+        // where audio is actually sent, and ENG-9868 left the transport
+        // injected with no implementation. The rate card exists first
+        // deliberately: a billable event with no USD rate makes
+        // `evaluateUsageBudget` throw, and on a SHARED pool that would break
+        // Voice Chat's budget check, not just this one.
+        { event_type: "transcription", unit: "audio_hour" }
+      ]
     }
   },
   {
@@ -13527,4 +13593,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-RDPAELV2.js.map
+//# sourceMappingURL=chunk-6DWVW3Y3.js.map