@integrity-labs/agt-cli 0.28.990 → 0.28.992

package/dist/mcp/direct-chat-channel.js

@@ -33253,7 +33253,21 @@ var REMOTE_MCP_PROXY_ENV = {
   // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
   // we forward, not what an outbound request looks like, so the probe (which
   // never issues a tools/call) has nothing to reconstruct from it.
-  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
+  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
+  //
+  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
+  // straight at the vendor, so none of the three brokered HITL gates
+  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
+  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
+  // — measured: zero hits for that column under `packages/core/src/provisioning`,
+  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
+  // approval and the call went straight out.
+  //
+  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
+  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
+  // looks like, so the connectivity probe has nothing to reconstruct from it.
+  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,

package/dist/mcp/index.js

@@ -25835,7 +25835,21 @@ var REMOTE_MCP_PROXY_ENV = {
   // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
   // we forward, not what an outbound request looks like, so the probe (which
   // never issues a tools/call) has nothing to reconstruct from it.
-  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
+  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
+  //
+  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
+  // straight at the vendor, so none of the three brokered HITL gates
+  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
+  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
+  // — measured: zero hits for that column under `packages/core/src/provisioning`,
+  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
+  // approval and the call went straight out.
+  //
+  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
+  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
+  // looks like, so the connectivity probe has nothing to reconstruct from it.
+  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,

package/dist/mcp/origami.js

@@ -39986,7 +39986,21 @@ var REMOTE_MCP_PROXY_ENV = {
   // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
   // we forward, not what an outbound request looks like, so the probe (which
   // never issues a tools/call) has nothing to reconstruct from it.
-  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
+  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
+  //
+  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
+  // straight at the vendor, so none of the three brokered HITL gates
+  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
+  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
+  // — measured: zero hits for that column under `packages/core/src/provisioning`,
+  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
+  // approval and the call went straight out.
+  //
+  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
+  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
+  // looks like, so the connectivity probe has nothing to reconstruct from it.
+  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,

package/dist/mcp/remote-oauth-proxy.js

@@ -24,7 +24,21 @@ var REMOTE_MCP_PROXY_ENV = {
   // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
   // we forward, not what an outbound request looks like, so the probe (which
   // never issues a tools/call) has nothing to reconstruct from it.
-  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
+  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
+  //
+  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
+  // straight at the vendor, so none of the three brokered HITL gates
+  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
+  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
+  // — measured: zero hits for that column under `packages/core/src/provisioning`,
+  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
+  // approval and the call went straight out.
+  //
+  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
+  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
+  // looks like, so the connectivity probe has nothing to reconstruct from it.
+  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,
@@ -75,6 +89,7 @@ var TOKEN_VAR_ENV = REMOTE_MCP_PROXY_ENV.tokenVar;
 var ALLOWLIST_ENV = REMOTE_MCP_PROXY_ENV.toolAllowlist;
 var PREENABLE_ENV = REMOTE_MCP_PROXY_ENV.preEnableToolsets;
 var ARG_REJECTS_ENV = REMOTE_MCP_PROXY_ENV.argRejects;
+var TOOL_TIERS_ENV = REMOTE_MCP_PROXY_ENV.toolTiers;
 var REMOTE_FETCH_TIMEOUT_MS = 3e4;
 var remoteUrl = process.env[URL_ENV] ?? "";
 var tokenFile = process.env[TOKEN_FILE_ENV] ?? "";
@@ -83,6 +98,7 @@ var label = process.env[REMOTE_MCP_PROXY_ENV.label] || tokenVar || "remote-oauth
 var toolAllowlist = parseToolAllowlist(process.env[ALLOWLIST_ENV] ?? "");
 var preEnableToolsets = parsePreEnableToolsets(process.env[PREENABLE_ENV] ?? "");
 var argRejects = parseArgRejects(process.env[ARG_REJECTS_ENV] ?? "");
+var toolTiers = parseToolTiers(process.env[TOOL_TIERS_ENV]);
 var { authHeader: authHeaderName, extras: extraHeaderSpecs } = readRemoteMcpAuthConfig(process.env);
 function logErr(msg) {
   process.stderr.write(`[remote-oauth-proxy:${label}] ${msg}
@@ -300,7 +316,40 @@ function isToolArgRejected(method, params, rules) {
   }
   return none;
 }
-function callRefusal(method, params, allow, rules, label2) {
+var AUTO_EXECUTE_TIERS = /* @__PURE__ */ new Set(["read", "write"]);
+function parseToolTiers(raw) {
+  if (raw === void 0 || raw.trim() === "") return { kind: "absent" };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    return { kind: "unusable", detail: `not valid JSON (${err.message})` };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { kind: "unusable", detail: "not a JSON object of tool -> tier" };
+  }
+  const tiers = /* @__PURE__ */ new Map();
+  for (const [tool, tier] of Object.entries(parsed)) {
+    if (typeof tier !== "string" || tier === "") {
+      return { kind: "unusable", detail: `tool "${tool}" has a non-string tier` };
+    }
+    tiers.set(tool, tier);
+  }
+  return { kind: "table", tiers };
+}
+function isToolCallTierGated(method, params, table) {
+  const none = { gated: false, name: "", tier: null, reason: null };
+  if (method !== "tools/call") return none;
+  if (table.kind === "absent") return none;
+  const name = params && typeof params === "object" && typeof params.name === "string" ? params.name : "";
+  if (table.kind === "unusable") return { gated: true, name, tier: null, reason: "unusable" };
+  if (!name) return { gated: true, name: "", tier: null, reason: "unknown" };
+  const tier = table.tiers.get(name);
+  if (tier === void 0) return { gated: true, name, tier: null, reason: "unknown" };
+  if (AUTO_EXECUTE_TIERS.has(tier)) return { gated: false, name, tier, reason: null };
+  return { gated: true, name, tier, reason: "gated" };
+}
+function callRefusal(method, params, allow, rules, label2, tiers) {
   const block = isToolCallBlocked(method, params, allow);
   if (block.blocked) {
     return {
@@ -309,6 +358,30 @@ function callRefusal(method, params, allow, rules, label2) {
       message: `${label2}: tool "${block.name}" is not enabled for this integration`
     };
   }
+  const tierCheck = isToolCallTierGated(method, params, tiers);
+  if (tierCheck.gated) {
+    const named = tierCheck.name || "(unnamed)";
+    const code = -32001;
+    if (tierCheck.reason === "unusable") {
+      return {
+        log: `refused tools/call "${named}": ${TOOL_TIERS_ENV} is set but unusable (${tiers.kind === "unusable" ? tiers.detail : "unknown"}), refusing every call`,
+        code,
+        message: `${label2}: this integration's approval-tier table could not be read, so every tool call is refused rather than forwarded un-gated. Nothing was sent to the remote. Ask your operator to re-provision this agent.`
+      };
+    }
+    if (tierCheck.reason === "unknown") {
+      return {
+        log: `refused tools/call "${named}": no catalogued HITL tier`,
+        code,
+        message: `${label2}: "${named}" has no approval tier in the catalog, so it is refused rather than run un-gated. Nothing was sent to the remote. The catalog covers the tools in this integration's curated scopes, so a name outside them is unclassified rather than necessarily new - ask your operator to seed a tool_definitions row for it.`
+      };
+    }
+    return {
+      log: `refused tools/call "${named}": tier ${tierCheck.tier} requires human approval, which this lane cannot yet file`,
+      code,
+      message: `${label2}: "${named}" is catalogued ${tierCheck.tier}, which requires human approval. Nothing was sent to the remote. This lane cannot file an approval yet, so the call is refused rather than executed un-approved - if you need it, ask a human to run it or to lower the tool's tier.`
+    };
+  }
   const argReject = isToolArgRejected(method, params, rules);
   if (argReject.rejected) {
     return {
@@ -555,43 +628,57 @@ function isMissingConfig() {
   if (!tokenVar) return TOKEN_VAR_ENV;
   return null;
 }
+function handleInboundLine(line, deps) {
+  const { writeReplies, inflight } = deps;
+  const text = line.trim();
+  if (!text) return;
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    logErr("dropping non-JSON stdin line");
+    return;
+  }
+  const isNotification = !("id" in parsed);
+  const id = parsed.id;
+  const refusal = callRefusal(parsed.method, parsed.params, toolAllowlist, argRejects, label, toolTiers);
+  if (refusal) {
+    logErr(isNotification ? `${refusal.log} (notification, no reply sent)` : refusal.log);
+    if (isNotification) return;
+    const task2 = writeReplies([jsonRpcError(id, refusal.code, refusal.message)]).catch(
+      (err) => logErr(`handler error: ${err.message}`)
+    );
+    inflight.add(task2);
+    void task2.finally(() => inflight.delete(task2));
+    return;
+  }
+  const task = forward(text, id, isNotification, parsed.method, parsed.params).then(writeReplies).catch((err) => {
+    logErr(`handler error: ${err.message}`);
+  });
+  inflight.add(task);
+  void task.finally(() => inflight.delete(task));
+}
 async function main() {
   const missing = isMissingConfig();
   if (missing) {
     logErr(`missing required env ${missing}; exiting`);
     process.exit(1);
   }
+  if (toolTiers.kind === "absent") {
+    logErr(`no ${TOOL_TIERS_ENV} set: tool calls are NOT gated by catalogued HITL tier`);
+  } else if (toolTiers.kind === "unusable") {
+    logErr(`${TOOL_TIERS_ENV} is set but unusable (${toolTiers.detail}); refusing every tools/call`);
+  } else {
+    const gated = [...toolTiers.tiers.entries()].filter(([, t]) => !AUTO_EXECUTE_TIERS.has(t));
+    logErr(
+      `tier gate active: ${toolTiers.tiers.size} catalogued tools, ${gated.length} require approval` + (gated.length > 0 ? ` (${gated.map(([n, t]) => `${n}=${t}`).join(", ")})` : "")
+    );
+  }
   const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
   const writeReplies = createStdoutReplyWriter();
   const inflight = /* @__PURE__ */ new Set();
   rl.on("line", (line) => {
-    const text = line.trim();
-    if (!text) return;
-    let parsed;
-    try {
-      parsed = JSON.parse(text);
-    } catch {
-      logErr("dropping non-JSON stdin line");
-      return;
-    }
-    const isNotification = !("id" in parsed);
-    const id = parsed.id;
-    const refusal = callRefusal(parsed.method, parsed.params, toolAllowlist, argRejects, label);
-    if (refusal) {
-      logErr(isNotification ? `${refusal.log} (notification, no reply sent)` : refusal.log);
-      if (isNotification) return;
-      const task2 = writeReplies([jsonRpcError(id, refusal.code, refusal.message)]).catch(
-        (err) => logErr(`handler error: ${err.message}`)
-      );
-      inflight.add(task2);
-      void task2.finally(() => inflight.delete(task2));
-      return;
-    }
-    const task = forward(text, id, isNotification, parsed.method, parsed.params).then(writeReplies).catch((err) => {
-      logErr(`handler error: ${err.message}`);
-    });
-    inflight.add(task);
-    void task.finally(() => inflight.delete(task));
+    handleInboundLine(line, { writeReplies, inflight });
   });
   await new Promise((resolve) => rl.on("close", () => resolve()));
   await Promise.all([...inflight]);
@@ -611,6 +698,7 @@ if (invokedDirectly) {
 }
 export {
   ACTIVATION_TOOL,
+  AUTO_EXECUTE_TIERS,
   activationRefusalMessage,
   awaitDrain,
   buildEnableToolsetRequest,
@@ -625,16 +713,19 @@ export {
   extractToolsArray,
   filterToolsListMessage,
   forward,
+  handleInboundLine,
   handleStdoutWriteFailure,
   isManagedActivationCall,
   isToolArgRejected,
   isToolCallBlocked,
+  isToolCallTierGated,
   main,
   parseArgRejects,
   parseEnableToolsetResponse,
   parseExtraHeaders,
   parsePreEnableToolsets,
   parseToolAllowlist,
+  parseToolTiers,
   readCurrentToken,
   stripActivationTool,
   toolName,

package/dist/mcp/slack-channel.js

@@ -34203,7 +34203,21 @@ var REMOTE_MCP_PROXY_ENV = {
   // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
   // we forward, not what an outbound request looks like, so the probe (which
   // never issues a tools/call) has nothing to reconstruct from it.
-  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
+  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
+  //
+  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
+  // straight at the vendor, so none of the three brokered HITL gates
+  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
+  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
+  // — measured: zero hits for that column under `packages/core/src/provisioning`,
+  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
+  // approval and the call went straight out.
+  //
+  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
+  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
+  // looks like, so the connectivity probe has nothing to reconstruct from it.
+  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,

package/dist/mcp/telegram-channel.js

@@ -34223,7 +34223,21 @@ var REMOTE_MCP_PROXY_ENV = {
   // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
   // we forward, not what an outbound request looks like, so the probe (which
   // never issues a tools/call) has nothing to reconstruct from it.
-  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS"
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
+  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
+  //
+  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
+  // straight at the vendor, so none of the three brokered HITL gates
+  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
+  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
+  // — measured: zero hits for that column under `packages/core/src/provisioning`,
+  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
+  // approval and the call went straight out.
+  //
+  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
+  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
+  // looks like, so the connectivity probe has nothing to reconstruct from it.
+  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
 };
 var REMOTE_MCP_AUTH_ENV_KEYS = [
   REMOTE_MCP_PROXY_ENV.tokenVar,

package/dist/{persistent-session-PYYD53GZ.js → persistent-session-HBUVJYYR.js}

@@ -1,5 +1,6 @@
 import {
   CLAUDE_HOST_WIDE,
+  CLAUDE_MANAGED_SETTINGS_DIR,
   CLAUDE_NULLED_FILES,
   CLAUDE_PER_AGENT_DIRS,
   EGRESS_BASELINE_DOMAINS,
@@ -62,12 +63,13 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-6KYXH6ZZ.js";
-import "./chunk-TGCA3LTI.js";
+} from "./chunk-NF7LESJA.js";
+import "./chunk-C72SNMP6.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 export {
   CLAUDE_HOST_WIDE,
+  CLAUDE_MANAGED_SETTINGS_DIR,
   CLAUDE_NULLED_FILES,
   CLAUDE_PER_AGENT_DIRS,
   EGRESS_BASELINE_DOMAINS,
@@ -131,4 +133,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-PYYD53GZ.js.map
+//# sourceMappingURL=persistent-session-HBUVJYYR.js.map

package/dist/{responsiveness-probe-JENZOOKG.js → responsiveness-probe-AIBA25OP.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-6KYXH6ZZ.js";
-import "./chunk-TGCA3LTI.js";
+} from "./chunk-NF7LESJA.js";
+import "./chunk-C72SNMP6.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 
@@ -800,4 +800,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-JENZOOKG.js.map
+//# sourceMappingURL=responsiveness-probe-AIBA25OP.js.map

package/dist/{session-auth-dead-BGXRQB27.js → session-auth-dead-XTMVOHUX.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-TGCA3LTI.js";
+} from "./chunk-C72SNMP6.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-BGXRQB27.js.map
+//# sourceMappingURL=session-auth-dead-XTMVOHUX.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.990",
+  "version": "0.28.992",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {