@integrity-labs/agt-cli 0.28.835 → 0.28.836

package/dist/assets/review/obiwan-auth.mjs

@@ -4,10 +4,12 @@
  * copy is downstream. Delivered alongside `post-review-findings.mjs` by
  * `provisionReviewPoster()` (apps/cli/src/lib/review-poster-asset.ts).
  *
- * Expected to diverge from the origin: `resolveIdentity` must gain a
- * fail-closed unattended mode that verifies the token's login is
- * `obi-wan-shinobi-reviewer[bot]` rather than announcing FALLBACK and posting
- * anyway (ENG-10001 item 3). Not done yet — nothing calls this on a host.
+ * DIVERGED FROM THE ORIGIN, deliberately (ENG-10001). `resolveIdentity` now
+ * VERIFIES with GitHub that the App it minted for is the one named in
+ * `EXPECTED_APP_SLUG`, and throws when it is not; `post-review-findings.mjs`
+ * refuses to write anything at all without that verified identity. The plugin
+ * copy stays permissive because a human runs it and can see whose name ends up
+ * on the comment. This copy's only caller is an unattended agent, which cannot.
  */
 /**
  * obiwan-auth — mint a GitHub App installation token for the review bot.
@@ -42,6 +44,13 @@
 import { createSign, randomUUID } from 'node:crypto';
 import { readFileSync, statSync } from 'node:fs';
 
+/**
+ * The App this reviewer is, as GitHub spells it. `slug` — not the display name,
+ * not the app id — is what forms the comment author `<slug>[bot]`, so it is the
+ * only value that answers "whose name will be on the finding".
+ */
+export const EXPECTED_APP_SLUG = 'obi-wan-shinobi-reviewer';
+
 const b64url = (buf) =>
   Buffer.from(buf).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 
@@ -134,6 +143,23 @@ export async function ghFetch(url, jwt, method = 'GET', fetchImpl = fetch, timeo
 export async function mintInstallationToken({ repo, appId, privateKey, request = ghFetch }) {
   const jwt = buildAppJwt({ appId, privateKey });
 
+  // WHO WE ACTUALLY ARE, asked of GitHub rather than inferred from config.
+  // `appId` is operator-supplied, and a wrong one does not fail — it mints a
+  // perfectly valid token for a DIFFERENT App, whose `[bot]` name then appears
+  // on the review. That is the outcome AC3 forbids, minus the tell: it does not
+  // look like a fallback, it looks like a working bot under the wrong name.
+  //
+  // This hop needs the JWT: an installation token cannot call `GET /app`.
+  const app = await request('https://api.github.com/app', jwt);
+  if (app.status !== 200 || !app.body?.slug) {
+    throw new Error(
+      `app identity lookup failed (${app.status}): ${app.body?.message ?? 'no slug in the response'}` +
+        (app.status === 401
+          ? ' — a 401 here means the JWT did not verify: check OBIWAN_APP_ID matches the key you downloaded'
+          : ''),
+    );
+  }
+
   const inst = await request(`https://api.github.com/repos/${repo}/installation`, jwt);
   if (inst.status === 404) {
     throw new Error(
@@ -158,18 +184,31 @@ export async function mintInstallationToken({ repo, appId, privateKey, request =
   if (tok.status !== 201 || !tok.body?.token) {
     throw new Error(`token exchange failed (${tok.status}): ${tok.body?.message ?? 'no token in response'}`);
   }
-  return { token: tok.body.token, expiresAt: tok.body.expires_at, installationId: inst.body.id };
+  return {
+    token: tok.body.token,
+    expiresAt: tok.body.expires_at,
+    installationId: inst.body.id,
+    appSlug: app.body.slug,
+  };
 }
 
 /**
  * The token to authenticate as, or null to keep whatever `gh` is already using.
  *
- * Falls back deliberately rather than throwing when the App is unconfigured:
- * posting as the operator is a worse outcome than posting as the bot, but it is
- * a far better one than not posting at all, and a half-configured machine
- * should degrade rather than block. The CALLER is told which identity it got,
- * so the fallback is never silent — see `post-review-findings.mjs`, which
- * prints it before it posts anything.
+ * TWO OUTCOMES, AND THEY ARE NOT THE SAME KIND OF THING.
+ *
+ * An UNCONFIGURED App returns `kind: 'fallback'` rather than throwing, because
+ * the read-only modes are still useful without it — `--status` lists this
+ * reviewer's threads with any credentials at all. What the fallback must never
+ * do is write, and enforcing that is the CALLER's job: see `refuseIdentity` in
+ * `post-review-findings.mjs`, which is where the fail-closed decision lives so
+ * that it can distinguish a dry run from a post.
+ *
+ * A MISCONFIGURED App throws. Absence degrades; pointing at the wrong App is a
+ * mistake to be loud about, and a machine that would post under a name nobody
+ * chose should stop rather than narrow its mode. The cost is that `--status`
+ * also fails there, which is the right way round: the operator learns of the
+ * misconfiguration at the first command they run, not at the first post.
  */
 /**
  * The two halves of the fallback diagnostic, named so the test can assert them
@@ -202,8 +241,25 @@ export async function resolveIdentity({ repo, env = process.env, mint = mintInst
     };
   }
   const privateKey = resolvePrivateKey(env.OBIWAN_PRIVATE_KEY);
-  const { token, expiresAt } = await mint({ repo, appId: env.OBIWAN_APP_ID, privateKey });
-  return { kind: 'app', token, expiresAt, why: `obi-wan-shinobi-reviewer[bot] via App ${env.OBIWAN_APP_ID}` };
+  const { token, expiresAt, appSlug } = await mint({ repo, appId: env.OBIWAN_APP_ID, privateKey });
+
+  // A MISSING slug is a failure, not a pass. It means this token was minted by
+  // something that did not perform the `GET /app` hop — an older `mint`, or a
+  // future refactor that drops it — and reading "nothing to compare" as
+  // "nothing wrong" is exactly how a check that still exists stops checking.
+  if (appSlug !== EXPECTED_APP_SLUG) {
+    throw new Error(
+      `OBIWAN_APP_ID ${env.OBIWAN_APP_ID} authenticates as ` +
+        `${appSlug ? `"${appSlug}"` : 'an App whose identity was not verified'}, ` +
+        `not "${EXPECTED_APP_SLUG}" — refusing to post under an identity nobody chose. ` +
+        'Point OBIWAN_APP_ID and OBIWAN_PRIVATE_KEY at the Obi Wan Shinobi App.',
+    );
+  }
+
+  // `why` is derived from what GitHub returned, never from the constant above.
+  // Printing the expected name would report the identity the code hoped for
+  // rather than the one it got, which is the whole failure this guards.
+  return { kind: 'app', token, expiresAt, appSlug, why: `${appSlug}[bot] via App ${env.OBIWAN_APP_ID}` };
 }
 
 /** Never let a token reach a log or an error message intact. */

package/dist/assets/review/post-review-findings.mjs

@@ -14,8 +14,10 @@
  *
  * Origin: the Smithers Claude Code plugin (~/.claude/plugins/smithers/scripts/).
  * That copy is now DOWNSTREAM of this one. Do NOT add an equality sync test:
- * this copy is expected to diverge (fail-closed identity with login
- * verification, and a `--min-severity` floor — ENG-10001 items 2 and 3).
+ * this copy is expected to diverge, and already has — `refuseIdentity()` below
+ * makes a write without the VERIFIED review-bot identity impossible here, while
+ * the plugin copy stays permissive for the human who runs it. A `--min-severity`
+ * floor is the remaining planned divergence (ENG-10001).
  */
 /**
  * post-review-findings — deliver `/s:code-review` and `/s:security-review`
@@ -416,6 +418,45 @@ export function refuseMode({ state, status, resolve, pr }) {
   return null;
 }
 
+/**
+ * Whether this identity may WRITE. Deliberately a second function rather than
+ * another clause in refuseMode(): they gate different axes, and their read-only
+ * sets genuinely differ.
+ *
+ * refuseMode asks "may this MODE touch a PR in this STATE", and there a dry run
+ * counts as a write, because computing findings against a closed PR is pointless
+ * work. Here a dry run is a READ — it posts nothing, so who we are cannot matter
+ * — and refusing it would deny an operator the one command that shows what the
+ * misconfiguration would have done. So `willWrite` is `--post || --resolve`, and
+ * nothing else. Folding the two together would force one of those two readings
+ * onto the other.
+ *
+ * FAIL CLOSED, WITH NO OVERRIDE FLAG. There is deliberately no
+ * `--allow-fallback-identity`. This copy's only caller is an unattended agent,
+ * so any escape hatch is one the AGENT can take, and an agent writing under an
+ * identity nobody chose is the exact thing being guarded. A documented bypass of
+ * a fail-closed check is not a fail-closed check.
+ *
+ * AND THE FALLBACK IS NOT WHAT IT LOOKS LIKE ON A HOST. The obvious reading —
+ * "it would post as the operator" — is a workstation reading. ENG-7506
+ * materialises the Augmented App's installation token into the agent session as
+ * GITHUB_ACCESS_TOKEN and GITHUB_TOKEN, and `gh` reads GITHUB_TOKEN. So a
+ * fallback write from a managed agent posts as the PLATFORM's bot, on a review
+ * the platform did not make. Unattributable rather than misattributed, which is
+ * no better: nobody can mute it, and nobody can tell whose claim it is.
+ *
+ * Returns a refusal message, or null to proceed.
+ */
+export function refuseIdentity({ kind, willWrite }) {
+  if (!willWrite || kind === 'app') return null;
+  return (
+    'refusing to write as anything but the review bot: OBIWAN_APP_ID / OBIWAN_PRIVATE_KEY ' +
+    'are not configured, so --post and --resolve would write under whatever credentials ' +
+    '`gh` happens to hold. Configure the App (see obiwan-auth.mjs), or drop --post to see ' +
+    'what would have been posted.'
+  );
+}
+
 async function main() {
   const a = parseArgs(process.argv.slice(2));
   if (!a.pr) throw new Error('--pr is required');
@@ -431,9 +472,18 @@ async function main() {
   console.log(
     identity.kind === 'app'
       ? `identity: ${identity.why} (token expires ${identity.expiresAt})`
-      : `identity: FALLBACK — posting as your own gh account (${identity.why})`,
+      : `identity: FALLBACK — whatever \`gh\` already holds, which is NOT the review bot ` +
+          `(${identity.why}); reads are fine, --post and --resolve will refuse`,
   );
 
+  // Before the PR is even read, so a misconfigured machine learns it from the
+  // first line of output rather than after a full scan it cannot deliver.
+  const identityRefusal = refuseIdentity({
+    kind: identity.kind,
+    willWrite: Boolean(a.post) || Boolean(a.resolve),
+  });
+  if (identityRefusal) throw new Error(identityRefusal);
+
   // Read PR state BEFORE the --resolve branch, not after it (CodeRabbit, #156).
   // --resolve returned early, and resolveFinding posts a reply before it
   // resolves — so a merged PR could still take a bot comment through this door

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-REBHUZ7N.js";
+} from "../chunk-E6B43IJZ.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.835" : "dev";
+var cliVersion = true ? "0.28.836" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.835" : "dev";
+var cliVersion2 = true ? "0.28.836" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-REBHUZ7N.js → chunk-E6B43IJZ.js}

@@ -6537,7 +6537,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.835" : "dev";
+var agtCliVersion = true ? "0.28.836" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10895,4 +10895,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-REBHUZ7N.js.map
+//# sourceMappingURL=chunk-E6B43IJZ.js.map

package/dist/lib/manager-worker.js

@@ -60,7 +60,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-REBHUZ7N.js";
+} from "../chunk-E6B43IJZ.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -13669,7 +13669,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.835" : "dev";
+var agtCliVersion = true ? "0.28.836" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();