@integrity-labs/agt-cli 0.28.962 → 0.28.964

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-37AUMVY3.js";
+} from "../chunk-JCAQEJYK.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-MNARTDPO.js";
+} from "../chunk-WVOB2TIP.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-D3FGOGI2.js";
+} from "../chunk-SMZQHDO7.js";
 import "../chunk-DHWNVVX4.js";
 import "../chunk-XWVM4KPK.js";
 
@@ -5471,7 +5471,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.962" : "dev";
+var cliVersion = true ? "0.28.964" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6731,7 +6731,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.962" : "dev";
+var cliVersion2 = true ? "0.28.964" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-37AUMVY3.js → chunk-JCAQEJYK.js}

@@ -14,7 +14,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-MNARTDPO.js";
+} from "./chunk-WVOB2TIP.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -74,7 +74,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-D3FGOGI2.js";
+} from "./chunk-SMZQHDO7.js";
 import {
   classifyUnanswerablePane,
   summarizeUnanswerablePane
@@ -6967,7 +6967,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.962" : "dev";
+var agtCliVersion = true ? "0.28.964" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11666,4 +11666,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-37AUMVY3.js.map
+//# sourceMappingURL=chunk-JCAQEJYK.js.map

package/dist/{chunk-D3FGOGI2.js → chunk-SMZQHDO7.js}

@@ -11851,12 +11851,12 @@ var composio_approved_egress_default = {
     "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
     "EIP adoption exists to create.",
     "",
-    "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
-    "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
-    "address: add it here in the same change that lands it, or the detector correctly",
+    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
+    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
+    "same change that created it. Do the same for the next one, or the detector correctly",
     "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
-    "",
-    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
+    "account at all - which is why the bridge note below is written out by hand instead.",
     "",
     "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
     "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
@@ -11870,8 +11870,24 @@ var composio_approved_egress_default = {
     "delete-time options from the STATE recorded at the resource's last registration, and by",
     "the time this ran the resource was no longer in the program at all - so the state still",
     "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
-    "resource before it protects anything. The two prod EIPs above are protected, because",
-    "this apply registered them with the option set."
+    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
+    "this apply registered them with the option set.",
+    "",
+    "TWO BRIDGE ADDRESSES ARE STILL MISSING FROM THIS FILE (ENG-9684, 2026-09-15).",
+    "The control-plane egress bridge is being deployed to prod with a managed multi-AZ NAT,",
+    "which allocates two more Elastic IPs - in the CONTROL PLANE account (109039361030), not",
+    "the hosts account. They are not listed here yet because they do not exist until that",
+    "deploy runs; read them from SSM at",
+    "/augmented/prod/secrets/COMPOSIO_EGRESS_IPS (comma-separated, ready to paste) and add",
+    "them here in the same change that arms anything.",
+    "",
+    "THE DETECTOR CANNOT VERIFY THOSE TWO, AND THAT IS CORRECT, NOT A BUG.",
+    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
+    "only the addresses instances there actually route through. Bridge addresses will sit in",
+    "this set unmatched and unflagged. Do NOT 'fix' that by trimming this file to what the",
+    "detector checks: the file records what the ALLOWLIST must hold, which is a superset of",
+    "what any one account scan can see. Trimming it would make the allowlist incomplete,",
+    "which is a fleet-wide 401 rather than a tidy file."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -14928,4 +14944,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-D3FGOGI2.js.map
+//# sourceMappingURL=chunk-SMZQHDO7.js.map