@integrity-labs/agt-cli 0.28.990 → 0.28.992

package/dist/{chunk-6KYXH6ZZ.js → chunk-NF7LESJA.js}

@@ -2,11 +2,13 @@ import {
   INTEGRATION_REGISTRY,
   OAUTH_PROVIDERS,
   PLATFORM_STORAGE_RULE,
+  REMOTE_MCP_PROXY_ENV,
   SECRET_PATTERNS,
   claudeModelAlias,
   containerMemoryForAgentClass,
   encodeClaudeProjectPath,
   getOrCreateDailySession,
+  isAutoTier,
   isClaudeFastMode,
   isDefaultRemoteMcpConnection,
   isDeprecatedFramework,
@@ -20,7 +22,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-TGCA3LTI.js";
+} from "./chunk-C72SNMP6.js";
 import {
   classifyUnanswerablePane,
   findUsageLimitResetHint,
@@ -1017,7 +1019,19 @@ function extractHeaderVarName(value) {
   const m = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(value.trim());
   return m ? m[1] : null;
 }
-function buildLiveHeaderRemoteMcpProxyEntry(definitionId, dbSpec, paths, connectionKey) {
+function hasGatedTool(tiers) {
+  if (!tiers)
+    return false;
+  if (Object.keys(tiers).length === 0)
+    return true;
+  return Object.values(tiers).some((tier) => !isAutoTier(tier));
+}
+function toolTiersEnv(tiers) {
+  if (!tiers)
+    return {};
+  return { [REMOTE_MCP_PROXY_ENV.toolTiers]: JSON.stringify(tiers) };
+}
+function buildLiveHeaderRemoteMcpProxyEntry(definitionId, dbSpec, paths, connectionKey, toolTiers) {
   const spec = dbSpec ?? INTEGRATION_REGISTRY.find((d) => d.id === definitionId)?.remoteMcp;
   if (!spec?.liveHeaderRefresh)
     return null;
@@ -1041,11 +1055,15 @@ function buildLiveHeaderRemoteMcpProxyEntry(definitionId, dbSpec, paths, connect
       AGT_REMOTE_MCP_TOKEN_VAR: credentialEnvVar(definitionId, spec.auth.credential_ref, connectionKey),
       AGT_REMOTE_MCP_AUTH_HEADER: spec.auth.header_name,
       AGT_REMOTE_MCP_LABEL: remoteMcpConnectionLabel(definitionId, connectionKey),
-      ...extraPairs.length > 0 ? { AGT_REMOTE_MCP_EXTRA_HEADERS: extraPairs.join(",") } : {}
+      ...extraPairs.length > 0 ? { AGT_REMOTE_MCP_EXTRA_HEADERS: extraPairs.join(",") } : {},
+      // ENG-10614: the catalogued HITL floors. anchor-browser reaches the proxy
+      // via this branch, so this is where its one gated tool
+      // (`anchor_network_requests`, write_high_risk) starts being enforced.
+      ...toolTiersEnv(toolTiers)
     }
   };
 }
-function buildOAuthRemoteMcpProxyEntry(definitionId, paths, connectionKey) {
+function buildOAuthRemoteMcpProxyEntry(definitionId, paths, connectionKey, toolTiers) {
   const def = INTEGRATION_REGISTRY.find((d) => d.id === definitionId);
   if (def?.remoteMcp)
     return null;
@@ -1073,7 +1091,50 @@ function buildOAuthRemoteMcpProxyEntry(definitionId, paths, connectionKey) {
       // might have picked. Omitted when the provider declares none, leaving the
       // proxy's argument checking entirely off.
       ...provider.argRejects && provider.argRejects.length > 0 ? { AGT_REMOTE_MCP_ARG_REJECTS: JSON.stringify(provider.argRejects) } : {},
-      ...provider.preEnableToolsets && provider.preEnableToolsets.length > 0 ? { AGT_REMOTE_MCP_PREENABLE_TOOLSETS: provider.preEnableToolsets.join(",") } : {}
+      ...provider.preEnableToolsets && provider.preEnableToolsets.length > 0 ? { AGT_REMOTE_MCP_PREENABLE_TOOLSETS: provider.preEnableToolsets.join(",") } : {},
+      // ENG-10614: catalogued HITL floors, orthogonal to the allowlist above.
+      // The allowlist answers "may this agent see the tool at all"; this answers
+      // "may it run without a human". A tool can be allowlisted and still gated.
+      ...toolTiersEnv(toolTiers)
+    }
+  };
+}
+function buildApiKeyRemoteMcpProxyEntry(definitionId, dbSpec, paths, connectionKey, toolTiers) {
+  if (!hasGatedTool(toolTiers))
+    return null;
+  const spec = dbSpec ?? INTEGRATION_REGISTRY.find((d) => d.id === definitionId)?.remoteMcp;
+  if (!spec)
+    return null;
+  if (spec.liveHeaderRefresh)
+    return null;
+  if (!spec.auth?.credential_ref)
+    return null;
+  assertSafeRemoteMcpUrl(spec.url, definitionId);
+  const tokenVar = credentialEnvVar(definitionId, spec.auth.credential_ref, connectionKey);
+  const scheme = spec.auth.scheme ?? "bearer";
+  if (scheme !== "bearer" && scheme !== "header")
+    return null;
+  if (scheme === "header" && !spec.auth.header_name)
+    return null;
+  const extraPairs = [];
+  for (const [header, value] of Object.entries(spec.headers ?? {})) {
+    const varName = extractHeaderVarName(value);
+    if (!varName) {
+      throw new Error(`remoteMcp for '${definitionId}' declares a literal header '${header}' and also has a gated tool, which the tier-gating proxy cannot render (extra headers must be '\${VAR}' references). Give the header a '\${VAR}' value, or the integration would have to run un-gated.`);
+    }
+    extraPairs.push(`${header}:${remoteMcpConnectionScopedEnvVar(definitionId, varName, connectionKey)}`);
+  }
+  return {
+    command: "node",
+    args: [paths.proxyPath],
+    env: {
+      AGT_REMOTE_MCP_URL: spec.url,
+      AGT_REMOTE_MCP_TOKEN_FILE: paths.tokenFile,
+      AGT_REMOTE_MCP_TOKEN_VAR: tokenVar,
+      AGT_REMOTE_MCP_LABEL: remoteMcpConnectionLabel(definitionId, connectionKey),
+      ...scheme === "header" && spec.auth.header_name ? { AGT_REMOTE_MCP_AUTH_HEADER: spec.auth.header_name } : {},
+      ...extraPairs.length > 0 ? { AGT_REMOTE_MCP_EXTRA_HEADERS: extraPairs.join(",") } : {},
+      ...toolTiersEnv(toolTiers)
     }
   };
 }
@@ -3781,6 +3842,7 @@ var CLAUDE_PER_AGENT_DIRS = [
   // per-session profiling reports
   "bridge-spawn"
 ];
+var CLAUDE_MANAGED_SETTINGS_DIR = process.platform === "darwin" ? "/Library/Application Support/ClaudeCode" : "/etc/claude-code";
 var CLAUDE_NULLED_FILES = ["history.jsonl"];
 var CLAUDE_HOST_WIDE = [
   // Account and auth: one login per host, refreshed in place.
@@ -3861,10 +3923,13 @@ function buildDockerRunCommand(args) {
   const claudeProjects = join7(claudeHome, "projects");
   const transcriptMask = join7(claudeProjects, `${TRANSCRIPT_MASK_DIR_PREFIX}${agentId}`);
   const ownTranscripts = join7(claudeProjects, encodeClaudeProjectPath(projectDir));
+  const managedSettingsDir = CLAUDE_MANAGED_SETTINGS_DIR;
   const mounts = [
     `-v ${q(`${agentDir2}:${agentDir2}`)}`,
     `-v ${q(`${agentIdDir}:${agentIdDir}`)}`,
     `-v ${q(`${mcpDir}:${mcpDir}:ro`)}`,
+    // ENG-10806: see the block above - without this, inbound is silently dead.
+    `-v ${q(`${managedSettingsDir}:${managedSettingsDir}:ro`)}`,
     `-v ${q(`${claudeHome}:${claudeHome}`)}`,
     `-v ${q(`${transcriptMask}:${claudeProjects}`)}`,
     `-v ${q(`${ownTranscripts}:${ownTranscripts}`)}`,
@@ -5461,6 +5526,7 @@ export {
   buildRemoteMcpEntry,
   buildLiveHeaderRemoteMcpProxyEntry,
   buildOAuthRemoteMcpProxyEntry,
+  buildApiKeyRemoteMcpProxyEntry,
   buildNativeMcpEntry,
   shellQuote,
   CHANNEL_SECRET_ENV_KEYS,
@@ -5526,6 +5592,7 @@ export {
   restartEgressSidecar,
   TRANSCRIPT_MASK_DIR_PREFIX,
   CLAUDE_PER_AGENT_DIRS,
+  CLAUDE_MANAGED_SETTINGS_DIR,
   CLAUDE_NULLED_FILES,
   CLAUDE_HOST_WIDE,
   claudeStateDirFor,
@@ -5575,4 +5642,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-6KYXH6ZZ.js.map
+//# sourceMappingURL=chunk-NF7LESJA.js.map