@integrity-labs/agt-cli 0.28.926 → 0.28.928

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-XISR7YWZ.js";
+} from "../chunk-OXWLTPU2.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-6SKPDXGU.js";
+} from "../chunk-NIUBYSLW.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-UBXUNYTR.js";
+} from "../chunk-Y7ERASS6.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.926" : "dev";
+var cliVersion = true ? "0.28.928" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6682,7 +6682,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.926" : "dev";
+var cliVersion2 = true ? "0.28.928" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-6SKPDXGU.js → chunk-NIUBYSLW.js}

@@ -19,7 +19,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-UBXUNYTR.js";
+} from "./chunk-Y7ERASS6.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5730,4 +5730,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-6SKPDXGU.js.map
+//# sourceMappingURL=chunk-NIUBYSLW.js.map

package/dist/{chunk-XISR7YWZ.js → chunk-OXWLTPU2.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-6SKPDXGU.js";
+} from "./chunk-NIUBYSLW.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -76,7 +76,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-UBXUNYTR.js";
+} from "./chunk-Y7ERASS6.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6942,7 +6942,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.926" : "dev";
+var agtCliVersion = true ? "0.28.928" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11552,4 +11552,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-XISR7YWZ.js.map
+//# sourceMappingURL=chunk-OXWLTPU2.js.map

package/dist/{chunk-UBXUNYTR.js → chunk-Y7ERASS6.js}

@@ -11298,6 +11298,55 @@ async function fetchServerAuthConfigIds(fetchImpl, base, serverId, apiKey) {
   }
 }
 
+// ../../packages/core/dist/integrations/composio-approved-egress.json
+var composio_approved_egress_default = {
+  $comment: [
+    "ADR-0032 Part 3, gate item 2 + gate item 3 (ENG-9684). THE single recorded source",
+    "for the addresses Composio's per-key IP allowlist is expected to hold. Read by BOTH",
+    "scripts/fleet-egress-enum.sh (the operator's pre-arming instrument) and the",
+    "ComposioEgressAddressDrift cron (the between-armings watch). They must agree, which",
+    "is why neither carries its own copy.",
+    "",
+    "WHY A REPO FILE AND NOT SSM. Composio's allowlist has no read API, so its contents",
+    "can never be queried - only inferred from a refusal. This file is therefore not a",
+    "cache of vendor state; it is a DECLARATION of what a human pasted into a dashboard.",
+    "A PR is the right ceremony for changing a security boundary nobody can read back.",
+    "SSM would also hit registerCron's five-parameter grant scope (ENG-9940), where a",
+    "sixth parameter fails silently.",
+    "",
+    "THE COMPARISON IS ON `ip` AND NOTHING ELSE. `seenAsGateway` is informational. A NAT",
+    "rebuild that re-adopts the same EIP keeps egress correct while changing the gateway",
+    "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
+    "EIP adoption exists to create.",
+    "",
+    "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
+    "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
+    "address: add it here in the same change that lands it, or the detector correctly",
+    "reports that hosts are leaving from an address no key allows. Do not loosen the check."
+  ],
+  account: "711726113003",
+  homeRegion: "ap-southeast-2",
+  addresses: [
+    {
+      ip: "32.236.6.24",
+      stage: "prod",
+      seenAsGateway: "nat-00a3dac969c0641a6",
+      note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
+    },
+    {
+      ip: "15.135.204.192",
+      stage: "dev",
+      seenAsGateway: "nat-01122e6efaf4c4eaa",
+      note: "Dev-stage hosts NAT, same account. 2 instances measured 2026-09-12; their host rows live in the dev Supabase project."
+    }
+  ]
+};
+
+// ../../packages/core/dist/integrations/composio-approved-egress.js
+var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
+var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
+var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+
 // ../../packages/core/dist/integrations/composio-tool-call-probe.js
 var MCP_ACCEPT2 = "application/json, text/event-stream";
 var DEFAULT_TIMEOUT_MS2 = 1e4;
@@ -14569,4 +14618,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-UBXUNYTR.js.map
+//# sourceMappingURL=chunk-Y7ERASS6.js.map