@integrity-labs/agt-cli 0.28.914 → 0.28.916

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-3WTA477Y.js";
+} from "../chunk-OJK2OMY7.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.914" : "dev";
+var cliVersion = true ? "0.28.916" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6682,7 +6682,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.914" : "dev";
+var cliVersion2 = true ? "0.28.916" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-3WTA477Y.js → chunk-OJK2OMY7.js}

@@ -3339,9 +3339,13 @@ function provisionIsolationHook(codeName, agentId) {
   if (hasAgentId)
     assertValidAgentId(agentId);
   const augmentedBaseRe = augmentedBase.replace(/[.[\]()*+?{}|^$]/g, "\\$&");
+  const claudeProjectsBase = join4(homeDir, ".claude", "projects");
+  const claudeProjectsBaseRe = claudeProjectsBase.replace(/[.[\]()*+?{}|^$]/g, "\\$&");
+  const mangledBase = augmentedBase.replace(/[^a-zA-Z0-9]/g, "-");
   const ownAgentDir = getAgentDir(codeName);
   const logFile = join4(ownAgentDir, "isolation.log");
   const idAllowClause = hasAgentId ? ` && [ "$AGENT_DIR" != "${agentId}" ]` : "";
+  const idAllowClause2 = hasAgentId ? ` || [ "$OWNER" = "${agentId}" ]` : "";
   const hookScriptPath = join4(claudeDir, "agt-isolation-hook.sh");
   const hookScript = [
     "#!/bin/bash",
@@ -3408,6 +3412,25 @@ function provisionIsolationHook(codeName, agentId) {
     `AUGMENTED_BASE="${augmentedBase}"`,
     `AUGMENTED_BASE_RE='${augmentedBaseRe}'`,
     `LOG_FILE="${logFile}"`,
+    // ENG-10378: the hook guarded ~/.augmented and nothing else, while Claude
+    // Code writes every transcript and tool result to ~/.claude/projects. Ada
+    // measured it on 2026-09-12 by piping synthetic payloads and reading exit
+    // codes: reads under ~/.augmented/<other> blocked (exit 2), reads under
+    // ~/.claude/projects/<other> allowed (exit 0). So on a bare host this was
+    // not a partial mitigation for transcripts - it was none at all.
+    //
+    // Claude Code names a project directory by replacing every non-alphanumeric
+    // character of the project path with '-', so /root/.augmented/<name>/project
+    // becomes -root--augmented-<name>-project. Verified against a live host.
+    // Matching on the '-augmented-<name>-' TOKEN rather than an exact directory
+    // name keeps this correct for scratch and any other subpath.
+    //
+    // SCOPE, deliberately narrow: a directory is only judged when it carries an
+    // agent token at all. A project dir for anything else (a bare repo checkout,
+    // '-root') is untouched, so this cannot lock an agent out of its own work.
+    `CLAUDE_PROJECTS_BASE="${claudeProjectsBase}"`,
+    `CLAUDE_PROJECTS_BASE_RE='${claudeProjectsBaseRe}'`,
+    `MANGLED_BASE="${mangledBase}"`,
     "# The directory this agent's codename actually resolves to. Under the",
     "# id-keyed layout the codename is a symlink to the agent_id, and a legacy-",
     "# provisioned hook has no agent_id baked in to recognise it by. Unlike the",
@@ -3422,6 +3445,51 @@ function provisionIsolationHook(codeName, agentId) {
     "  exit 2",
     "}",
     "",
+    "# ENG-10378: is this Claude Code project directory another agent's?",
+    "#",
+    "# CodeRabbit (#5994): a raw token SUBSTRING test is a prefix-collision",
+    "# bypass. Agent `ada` owns the token `-augmented-ada-`, which is a prefix of",
+    "# `-root--augmented-ada-two-project` - so ada could read ada-two's",
+    "# transcripts. Matching the shape of a name instead of its path segments is",
+    "# the same defect this hook exists to prevent.",
+    "#",
+    '# The mangling is lossy (every non-alphanumeric becomes "-"), so the name',
+    "# cannot be inverted: `-augmented-ada-two-project` is ambiguous between",
+    '# agent "ada-two" and an agent "ada" with a subdir "two-project". Ground',
+    "# truth resolves it - the REAL entries under AUGMENTED_BASE say which agents",
+    "# exist, and the LONGEST matching prefix is the owner. That makes ada-two win",
+    "# over ada for its own directory, which is the whole point.",
+    "own_mangled() {",
+    `  printf '%s' "$1" | tr -c '[:alnum:]' '-'`,
+    "}",
+    "project_owner() {",
+    "  local D=$1 BEST= BESTLEN=0 E EN PFX",
+    '  for E in "$AUGMENTED_BASE"/*; do',
+    '    [ -e "$E" ] || continue',
+    '    E=$(basename -- "$E")',
+    '    EN=$(own_mangled "$E")',
+    '    PFX="${MANGLED_BASE}-${EN}-"',
+    '    case "$D" in',
+    '      "$PFX"*) if [ ${#PFX} -gt $BESTLEN ]; then BEST=$E; BESTLEN=${#PFX}; fi ;;',
+    "    esac",
+    "  done",
+    `  printf '%s' "$BEST"`,
+    "}",
+    "other_agent_project() {",
+    "  local D=$1",
+    "  local OWNER",
+    '  OWNER=$(project_owner "$D")',
+    "  # No real agent directory claims it: not an agent project, not judged.",
+    "  # LIMITATION, stated: a DEPROVISIONED agent whose transcripts remain has no",
+    "  # directory to claim them, so they are not judged. This is an accident-guard",
+    "  # for live agents, not a retention control (ENG-10378).",
+    '  [ -z "$OWNER" ] && return 1',
+    `  if [ "$OWNER" = "${codeName}" ]${idAllowClause2} || [ "$OWNER" = "$OWN_REAL" ]; then`,
+    "    return 1",
+    "  fi",
+    "  return 0",
+    "}",
+    "",
     "# An agent segment that will be expanded later: nothing here can know where",
     "# it points, so it is treated as another agent.",
     "has_expansion() {",
@@ -3469,11 +3537,25 @@ function provisionIsolationHook(codeName, agentId) {
     "      fi",
     "    fi",
     '  done <<< "$OCCURRENCES"',
+    "  # ENG-10378: the same pass over ~/.claude/projects. A bash command naming",
+    "  # another agent's transcript directory is the case that was wide open.",
+    '  POCC_RE="${CLAUDE_PROJECTS_BASE_RE}/[^/[:space:];&|<>()]+/?"',
+    `  POCCURRENCES=$(printf '%s\\n' "$NORM" | grep -oE "$POCC_RE" || true)`,
+    "  while IFS= read -r POCC; do",
+    '    [ -z "$POCC" ] && continue',
+    '    PREST=${POCC#"$CLAUDE_PROJECTS_BASE"/}',
+    "    PROJ_DIR=${PREST%/}",
+    '    case "$PROJ_DIR" in .|..) continue ;; esac',
+    '    if other_agent_project "$PROJ_DIR" || has_expansion "$PROJ_DIR"; then',
+    '      deny "bash targeting $CLAUDE_PROJECTS_BASE/$PROJ_DIR"',
+    "    fi",
+    '  done <<< "$POCCURRENCES"',
     "  exit 0",
     "fi",
     "",
     `CWD=$(echo "$INPUT" | jq -r '.cwd // empty')`,
     `CANON_BASE=$(realpath -m -- "$AUGMENTED_BASE" 2>/dev/null || printf '%s' "$AUGMENTED_BASE")`,
+    `CANON_PROJECTS=$(realpath -m -- "$CLAUDE_PROJECTS_BASE" 2>/dev/null || printf '%s' "$CLAUDE_PROJECTS_BASE")`,
     "",
     "# check_path PATH [RELATIVE_TO]: canonicalise one tool path, then judge it.",
     "check_path() {",
@@ -3495,6 +3577,12 @@ function provisionIsolationHook(codeName, agentId) {
     '          deny "$TOOL on $P"',
     "        fi",
     "      fi ;;",
+    `    "$CANON_PROJECTS"/?*)`,
+    '      local PREST=${P#"$CANON_PROJECTS"/}',
+    "      local PROJ_DIR=${PREST%%/*}",
+    '      if other_agent_project "$PROJ_DIR" || has_expansion "$PROJ_DIR"; then',
+    '        deny "$TOOL on $P"',
+    "      fi ;;",
     "  esac",
     "  return 0",
     "}",
@@ -6841,7 +6929,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.914" : "dev";
+var agtCliVersion = true ? "0.28.916" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11451,4 +11539,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-3WTA477Y.js.map
+//# sourceMappingURL=chunk-OJK2OMY7.js.map