@integrity-labs/agt-cli 0.27.158 → 0.27.160

package/dist/bin/agt.js

@@ -4,8 +4,10 @@ import {
   LITERAL_SECRET_PATTERNS,
   PROD_AGT_HOST,
   api,
+  defaultFlagsCachePath,
   error,
   exchangeApiKey,
+  flagsCacheAgeSeconds,
   getActiveTeam,
   getApiKey,
   getHost,
@@ -22,13 +24,16 @@ import {
   managerUninstallCommand,
   managerUninstallSystemUnitCommand,
   provision,
+  readFlagsCache,
+  resolveAllFlags,
+  resolveFlagFromLayers,
   setActiveTeam,
   setJsonMode,
   startWatchdog,
   success,
   table,
   warn
-} from "../chunk-ELEMDMTQ.js";
+} from "../chunk-O24XVAYZ.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -45,6 +50,7 @@ import {
   getAllChannelIds,
   getChannel,
   getDefaultSlackScopes,
+  getFlagDefinition,
   getFramework,
   getScopesByCategory,
   getTemplate,
@@ -54,11 +60,11 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-5E5B4T7K.js";
+} from "../chunk-BC26YO7P.js";
 
 // src/bin/agt.ts
-import { join as join20 } from "path";
-import { homedir as homedir9 } from "os";
+import { join as join21 } from "path";
+import { homedir as homedir10 } from "os";
 import { Command } from "commander";
 
 // src/commands/whoami.ts
@@ -119,6 +125,78 @@ async function whoamiCommand() {
   }
 }
 
+// src/commands/flags.ts
+import { join } from "path";
+import { homedir } from "os";
+function flagsResolveCommand(opts) {
+  const json = isJsonMode();
+  const configDir = opts.configDir ?? join(homedir(), ".augmented");
+  const cachePath = defaultFlagsCachePath(configDir);
+  const cache = readFlagsCache(cachePath);
+  const heartbeatFlags = cache?.flags;
+  let resolved;
+  if (opts.flag) {
+    const definition = getFlagDefinition(opts.flag);
+    if (!definition) {
+      if (json) {
+        jsonOutput({ ok: false, error: `Unknown flag '${opts.flag}'` });
+      } else {
+        error(`Unknown flag '${opts.flag}'. Run \`agt flags resolve\` to list registered flags.`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+    resolved = [resolveFlagFromLayers(definition, heartbeatFlags, process.env)];
+  } else {
+    resolved = resolveAllFlags(heartbeatFlags, process.env);
+  }
+  const ageSeconds = cache ? flagsCacheAgeSeconds(cache, cachePath) : null;
+  if (json) {
+    jsonOutput({
+      ok: true,
+      cache: {
+        path: cachePath,
+        present: cache !== null,
+        schema_version: cache?.schema_version ?? null,
+        age_seconds: ageSeconds === null ? null : Math.round(ageSeconds)
+      },
+      flags: resolved.map((r) => ({
+        key: r.key,
+        value: r.value,
+        source: r.source,
+        env_var: r.envVar ?? null,
+        env_masks_heartbeat: r.envMasksHeartbeat ?? false
+      }))
+    });
+    return;
+  }
+  info("Feature flags \u2014 resolved env -> heartbeat-cache -> compiled default");
+  if (cache === null) {
+    info(`Cache: ${cachePath} (absent \u2014 manager hasn't cached a heartbeat yet; showing env + compiled defaults)`);
+  } else {
+    const age = ageSeconds === null ? "unknown" : `${Math.round(ageSeconds)}s`;
+    info(`Cache: ${cachePath} (age: ${age}, schema: ${cache.schema_version || "unknown"})`);
+  }
+  table(
+    ["KEY", "VALUE", "SOURCE", "NOTE"],
+    resolved.map((r) => {
+      let note = "";
+      if (r.envMasksHeartbeat) {
+        note = `env ${r.envVar} masks heartbeat value`;
+      } else if (r.source === "env") {
+        note = `via ${r.envVar}`;
+      }
+      return [r.key, String(r.value), r.source, note];
+    })
+  );
+  if (opts.host && cache) {
+    const unknown = Object.keys(cache.flags).filter((key) => !getFlagDefinition(key));
+    if (unknown.length > 0) {
+      info(`Unrecognised cached keys (inert; upgrade agt-cli to consume): ${unknown.join(", ")}`);
+    }
+  }
+}
+
 // src/commands/team.ts
 import chalk2 from "chalk";
 import ora2 from "ora";
@@ -245,7 +323,7 @@ import ora3 from "ora";
 import { input, select, checkbox } from "@inquirer/prompts";
 import { randomUUID } from "crypto";
 import { mkdirSync, writeFileSync } from "fs";
-import { join } from "path";
+import { join as join2 } from "path";
 function toSlug(name) {
   return name.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
@@ -447,10 +525,10 @@ async function initCommand(opts) {
     process.exitCode = 1;
     return;
   }
-  const agentDir = join(process.cwd(), ".augmented", codeName);
+  const agentDir = join2(process.cwd(), ".augmented", codeName);
   mkdirSync(agentDir, { recursive: true });
-  writeFileSync(join(agentDir, "CHARTER.md"), charterMd);
-  writeFileSync(join(agentDir, "TOOLS.md"), toolsMd);
+  writeFileSync(join2(agentDir, "CHARTER.md"), charterMd);
+  writeFileSync(join2(agentDir, "TOOLS.md"), toolsMd);
   spinner.succeed(`Agent "${chalk3.bold(displayName)}" created.`);
   if (json) {
     jsonOutput({
@@ -503,7 +581,7 @@ async function initCommand(opts) {
 import chalk4 from "chalk";
 import ora4 from "ora";
 import { readFileSync, existsSync } from "fs";
-import { join as join2, resolve } from "path";
+import { join as join3, resolve } from "path";
 function printDiagnostics2(diagnostics) {
   for (const d of diagnostics) {
     const prefix = d.severity === "error" ? chalk4.red("ERR") : chalk4.yellow("WARN");
@@ -542,7 +620,7 @@ async function lintCommand(path) {
     }
     dirs.push({ name: path, dir: resolved });
   } else {
-    const augmentedDir = join2(process.cwd(), ".augmented");
+    const augmentedDir = join3(process.cwd(), ".augmented");
     if (!existsSync(augmentedDir)) {
       if (json) {
         jsonOutput({ ok: false, error: "No .augmented/ directory found" });
@@ -555,7 +633,7 @@ async function lintCommand(path) {
     const { readdirSync: readdirSync7, statSync: statSync5 } = await import("fs");
     const entries = readdirSync7(augmentedDir);
     for (const entry of entries) {
-      const entryPath = join2(augmentedDir, entry);
+      const entryPath = join3(augmentedDir, entry);
       if (statSync5(entryPath).isDirectory()) {
         dirs.push({ name: entry, dir: entryPath });
       }
@@ -596,8 +674,8 @@ async function lintCommand(path) {
   for (const { name, dir } of dirs) {
     if (!json) console.log(chalk4.bold(`
 Linting ${name}:`));
-    const charterPath = join2(dir, "CHARTER.md");
-    const toolsPath = join2(dir, "TOOLS.md");
+    const charterPath = join3(dir, "CHARTER.md");
+    const toolsPath = join3(dir, "TOOLS.md");
     const hasCharter = existsSync(charterPath);
     const hasTools = existsSync(toolsPath);
     if (!hasCharter && !hasTools) {
@@ -765,7 +843,7 @@ import chalk6 from "chalk";
 import ora6 from "ora";
 import { checkbox as checkbox2, confirm as confirm2, input as input2 } from "@inquirer/prompts";
 import { writeFile } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { tmpdir } from "os";
 async function channelSlackSetupCommand(agentCodeName, options) {
   const teamSlug = requireTeam();
@@ -837,7 +915,7 @@ async function channelSlackSetupCommand(agentCodeName, options) {
     });
     const manifestObj = serializeManifestForSlackCli(manifest);
     const manifestJson = JSON.stringify(manifestObj, null, 2);
-    const manifestPath = join3(tmpdir(), `augmented-slack-manifest-${agentCodeName}.json`);
+    const manifestPath = join4(tmpdir(), `augmented-slack-manifest-${agentCodeName}.json`);
     await writeFile(manifestPath, manifestJson, "utf-8");
     success(`Manifest written to ${manifestPath}`);
     console.log(chalk6.dim(manifestJson));
@@ -1190,7 +1268,7 @@ import chalk8 from "chalk";
 import ora8 from "ora";
 import { select as select2, input as input3 } from "@inquirer/prompts";
 import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 async function deployCommand(opts) {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
@@ -1300,9 +1378,9 @@ async function deployCommand(opts) {
     spinner.stop();
     if (!json) info(`Warning: could not record deployment in database: ${deployErr.message}`);
   }
-  const outDir = join4(process.cwd(), ".augmented", "deploy");
+  const outDir = join5(process.cwd(), ".augmented", "deploy");
   mkdirSync2(outDir, { recursive: true });
-  const outPath = join4(outDir, "docker-compose.yaml");
+  const outPath = join5(outDir, "docker-compose.yaml");
   writeFileSync2(outPath, rendered);
   spinner.succeed("Deployment config generated.");
   if (json) {
@@ -1327,7 +1405,7 @@ async function deployCommand(opts) {
 import chalk9 from "chalk";
 import ora9 from "ora";
 import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 function printDiagnostics3(diagnostics) {
   for (const d of diagnostics) {
     const prefix = d.severity === "error" ? chalk9.red("ERR") : chalk9.yellow("WARN");
@@ -1340,7 +1418,7 @@ async function provisionCommand(codeName, options) {
   if (!teamSlug) return;
   const json = isJsonMode();
   const target = options.target ?? "local_docker";
-  const outputDir = options.output ?? join5(process.cwd(), ".augmented", codeName, "provision");
+  const outputDir = options.output ?? join6(process.cwd(), ".augmented", codeName, "provision");
   const dryRun = options.dryRun ?? false;
   if (!json) console.log(chalk9.bold("\nAugmented \u2014 Provision\n"));
   const spinner = ora9({ text: "Fetching agent data\u2026", isSilent: json });
@@ -1530,10 +1608,10 @@ async function provisionCommand(codeName, options) {
   spinner.text = "Writing files\u2026";
   mkdirSync3(outputDir, { recursive: true });
   for (const artifact of provisionOutput.artifacts) {
-    writeFileSync3(join5(outputDir, artifact.relativePath), artifact.content);
+    writeFileSync3(join6(outputDir, artifact.relativePath), artifact.content);
   }
   if (deploymentYaml) {
-    writeFileSync3(join5(outputDir, "docker-compose.yaml"), deploymentYaml);
+    writeFileSync3(join6(outputDir, "docker-compose.yaml"), deploymentYaml);
   }
   spinner.text = "Storing provision snapshot\u2026";
   try {
@@ -1586,7 +1664,7 @@ import chalk10 from "chalk";
 import ora10 from "ora";
 import { spawn } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync7 } from "fs";
-import { delimiter, dirname as dirname3, join as join10 } from "path";
+import { delimiter, dirname as dirname3, join as join11 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/impersonate-flag.ts
@@ -1630,16 +1708,16 @@ import {
   rmSync,
   writeFileSync as writeFileSync4
 } from "fs";
-import { homedir } from "os";
-import { join as join6 } from "path";
-var IMPERSONATE_ROOT = join6(homedir(), ".augmented-impersonate");
-var ACTIVE_DIR = join6(IMPERSONATE_ROOT, "active");
-var ACTIVE_MANIFEST_PATH = join6(ACTIVE_DIR, "manifest.json");
+import { homedir as homedir2 } from "os";
+import { join as join7 } from "path";
+var IMPERSONATE_ROOT = join7(homedir2(), ".augmented-impersonate");
+var ACTIVE_DIR = join7(IMPERSONATE_ROOT, "active");
+var ACTIVE_MANIFEST_PATH = join7(ACTIVE_DIR, "manifest.json");
 var SESSION_FILE_PREFIX = "session-";
 var SESSION_FILE_SUFFIX = ".json";
 function sessionManifestPath(projectCwd) {
   const hash = createHash("sha256").update(projectCwd).digest("hex").slice(0, 16);
-  return join6(ACTIVE_DIR, `${SESSION_FILE_PREFIX}${hash}${SESSION_FILE_SUFFIX}`);
+  return join7(ACTIVE_DIR, `${SESSION_FILE_PREFIX}${hash}${SESSION_FILE_SUFFIX}`);
 }
 var CODE_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function assertValidCodeName(codeName) {
@@ -1651,7 +1729,7 @@ function assertValidCodeName(codeName) {
 }
 function getImpersonateCodeNameDir(codeName) {
   assertValidCodeName(codeName);
-  return join6(IMPERSONATE_ROOT, codeName);
+  return join7(IMPERSONATE_ROOT, codeName);
 }
 function ensureCodeNameDir(codeName) {
   assertValidCodeName(codeName);
@@ -1660,7 +1738,7 @@ function ensureCodeNameDir(codeName) {
   return dir;
 }
 function ensureImpersonateWorkdir(codeName) {
-  const dir = join6(ensureCodeNameDir(codeName), "workdir");
+  const dir = join7(ensureCodeNameDir(codeName), "workdir");
   mkdirSync4(dir, { recursive: true });
   return dir;
 }
@@ -1723,7 +1801,7 @@ function listActiveManifests() {
     if (!entry.startsWith(SESSION_FILE_PREFIX) || !entry.endsWith(SESSION_FILE_SUFFIX)) {
       continue;
     }
-    const manifest = readManifestFile(join6(ACTIVE_DIR, entry));
+    const manifest = readManifestFile(join7(ACTIVE_DIR, entry));
     if (manifest) out.push(manifest);
   }
   return out;
@@ -1758,14 +1836,14 @@ import {
   symlinkSync,
   unlinkSync
 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname, join as join7, parse, sep } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname, join as join8, parse, sep } from "path";
 var BACKUP_SUFFIX = ".pre-impersonate-backup";
 function findGitWorkTreeRoot(startDir) {
   const { root } = parse(startDir);
   let dir = startDir;
   for (; ; ) {
-    if (existsSync3(join7(dir, ".git"))) return dir;
+    if (existsSync3(join8(dir, ".git"))) return dir;
     if (dir === root) return null;
     const parent = dirname(dir);
     if (parent === dir) return null;
@@ -1780,7 +1858,7 @@ function swapInPersonaFile(projectPath, personaPath) {
     const stat = lstatSync(projectPath);
     if (stat.isSymbolicLink()) {
       const target = readlinkSync(projectPath);
-      const ourRoot = realpathSync(homedir2()) + sep + ".augmented-impersonate" + sep;
+      const ourRoot = realpathSync(homedir3()) + sep + ".augmented-impersonate" + sep;
       let resolvedTarget;
       try {
         resolvedTarget = realpathSync(projectPath);
@@ -1848,14 +1926,14 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync5
 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var INTRODUCE_HOOK_COMMAND = "agt impersonate introduce";
 var SESSION_START_MATCHER = "startup";
 function registerIntroduceHook(projectCwd, command = INTRODUCE_HOOK_COMMAND) {
-  const claudeDir = join8(projectCwd, ".claude");
+  const claudeDir = join9(projectCwd, ".claude");
   const createdClaudeDir = !existsSync4(claudeDir);
   mkdirSync5(claudeDir, { recursive: true });
-  const settingsPath = join8(claudeDir, "settings.local.json");
+  const settingsPath = join9(claudeDir, "settings.local.json");
   const settingsExisted = existsSync4(settingsPath);
   const backupPath = settingsPath + BACKUP_SUFFIX;
   let settings = {};
@@ -1942,11 +2020,11 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync6
 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join9 } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, join as join10 } from "path";
 import { fileURLToPath } from "url";
-var INSTALLED_STATUSLINE_PATH = join9(
-  homedir3(),
+var INSTALLED_STATUSLINE_PATH = join10(
+  homedir4(),
   ".augmented-impersonate",
   "statusline.sh"
 );
@@ -1965,10 +2043,10 @@ function registerStatusLine(projectCwd, options = {}) {
   if (options.installAsset !== false) {
     installStatusLineAsset();
   }
-  const claudeDir = join9(projectCwd, ".claude");
+  const claudeDir = join10(projectCwd, ".claude");
   const createdClaudeDir = !existsSync5(claudeDir);
   mkdirSync6(claudeDir, { recursive: true });
-  const settingsPath = join9(claudeDir, "settings.local.json");
+  const settingsPath = join10(claudeDir, "settings.local.json");
   const settingsExisted = existsSync5(settingsPath);
   const backupPath = settingsPath + BACKUP_SUFFIX;
   let settings = {};
@@ -2016,11 +2094,11 @@ function resolveBundledAssetPath() {
   const moduleDir = dirname2(fileURLToPath(import.meta.url));
   const candidates = [
     // Built output: dist/<chunk>.js → dist/assets/...
-    join9(moduleDir, "assets", "impersonate-statusline.sh"),
+    join10(moduleDir, "assets", "impersonate-statusline.sh"),
     // Built output sibling case: dist/<sub>/<chunk>.js → dist/assets/...
-    join9(moduleDir, "..", "assets", "impersonate-statusline.sh"),
+    join10(moduleDir, "..", "assets", "impersonate-statusline.sh"),
     // Dev source: src/lib/impersonate-statusline.ts → ../../assets/...
-    join9(moduleDir, "..", "..", "assets", "impersonate-statusline.sh")
+    join10(moduleDir, "..", "..", "assets", "impersonate-statusline.sh")
   ];
   for (const candidate of candidates) {
     if (existsSync5(candidate)) return candidate;
@@ -2228,11 +2306,11 @@ async function impersonateConnectCommand(token, options = {}) {
   spinner.text = "Writing persona files\u2026";
   const personaDir = ensureCodeNameDir(bundle.agent.code_name);
   writeFileSync7(
-    join10(personaDir, "CLAUDE.md"),
+    join11(personaDir, "CLAUDE.md"),
     bundle.artifacts["CLAUDE.md"]
   );
   writeFileSync7(
-    join10(personaDir, ".mcp.json"),
+    join11(personaDir, ".mcp.json"),
     rewriteMcpJsonForImpersonation(bundle.artifacts[".mcp.json"], {
       operatorHome: process.env.HOME ?? "",
       operatorPath: resolveOperatorPath(),
@@ -2261,8 +2339,8 @@ async function impersonateConnectCommand(token, options = {}) {
   let statusLineBackup;
   try {
     for (const file of SWAP_FILES) {
-      const projectPath = join10(projectCwd, file);
-      const kind = swapInPersonaFile(projectPath, join10(personaDir, file));
+      const projectPath = join11(projectCwd, file);
+      const kind = swapInPersonaFile(projectPath, join11(personaDir, file));
       backups[file] = kind;
       swapped.push({ file, kind });
     }
@@ -2298,7 +2376,7 @@ async function impersonateConnectCommand(token, options = {}) {
     }
     for (const { file, kind } of [...swapped].reverse()) {
       try {
-        restoreSwapped(join10(projectCwd, file), kind);
+        restoreSwapped(join11(projectCwd, file), kind);
       } catch {
       }
     }
@@ -2506,7 +2584,7 @@ async function performImpersonateExit(manifest, opts) {
   }
   const restored = [];
   for (const [file, kind] of Object.entries(manifest.backups)) {
-    const projectPath = join10(manifest.project_cwd, file);
+    const projectPath = join11(manifest.project_cwd, file);
     try {
       restoreSwapped(projectPath, kind);
       restored.push(file);
@@ -2584,8 +2662,8 @@ async function impersonateIntroduceCommand() {
     const manifest = readActiveManifest(process.cwd());
     if (!manifest || isExpired(manifest)) return;
     const cwd = manifest.project_cwd;
-    const identity = readClaudeMdIdentity(join10(cwd, "CLAUDE.md"));
-    const integrations = readMcpIntegrations(join10(cwd, ".mcp.json"));
+    const identity = readClaudeMdIdentity(join11(cwd, "CLAUDE.md"));
+    const integrations = readMcpIntegrations(join11(cwd, ".mcp.json"));
     const intro = buildIntroduction({
       displayName: identity.displayName,
       codeName: manifest.code_name,
@@ -2613,12 +2691,12 @@ function readMcpIntegrations(path) {
 function resolveCliMcpBundleDir() {
   const moduleDir = dirname3(fileURLToPath2(import.meta.url));
   const candidates = [
-    join10(moduleDir, "mcp"),
-    join10(moduleDir, "..", "mcp"),
-    join10(moduleDir, "..", "..", "mcp")
+    join11(moduleDir, "mcp"),
+    join11(moduleDir, "..", "mcp"),
+    join11(moduleDir, "..", "..", "mcp")
   ];
   for (const candidate of candidates) {
-    if (existsSync6(join10(candidate, "index.js"))) return candidate;
+    if (existsSync6(join11(candidate, "index.js"))) return candidate;
   }
   return candidates[candidates.length - 1];
 }
@@ -2647,7 +2725,7 @@ function buildImpersonateClaudeLaunch(projectCwd, inheritEnv = process.env, agen
     args: [
       "--strict-mcp-config",
       "--mcp-config",
-      join10(projectCwd, ".mcp.json")
+      join11(projectCwd, ".mcp.json")
     ],
     env
   };
@@ -2660,7 +2738,7 @@ import ora11 from "ora";
 // ../../packages/core/dist/drift/live-state-reader.js
 import { readFile } from "fs/promises";
 import { createHash as createHash2 } from "crypto";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import JSON5 from "json5";
 async function hashFile(filePath) {
   try {
@@ -2684,8 +2762,8 @@ async function readLiveState(options) {
   const toolsFile = trackedFiles.find((f) => f.includes("TOOLS")) ?? "TOOLS.md";
   const [frameworkConfig, charterHash, toolsHash] = await Promise.all([
     readJsonFile(options.configPath),
-    hashFile(join11(options.teamDir, charterFile)),
-    hashFile(join11(options.teamDir, toolsFile))
+    hashFile(join12(options.teamDir, charterFile)),
+    hashFile(join12(options.teamDir, toolsFile))
   ]);
   return {
     frameworkConfig,
@@ -3386,14 +3464,14 @@ function terminate(child) {
 import { useEffect, useState, useMemo } from "react";
 import { render, Box, Text, useApp, useInput } from "ink";
 import { existsSync as existsSync7, readFileSync as readFileSync6, statSync, openSync, readSync, closeSync } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join12 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join13 } from "path";
 import { jsx, jsxs } from "react/jsx-runtime";
 var REFRESH_MS = 1e3;
 var LOG_TAIL_LINES = 200;
 var DETAIL_RECENT_LINES = 50;
 function managerWatchCommand(opts = {}) {
-  const configDir = opts.configDir ?? join12(homedir4(), ".augmented");
+  const configDir = opts.configDir ?? join13(homedir5(), ".augmented");
   const paths = getManagerPaths(configDir);
   const isTty = process.stdout.isTTY === true && process.stdin.isTTY === true;
   if (opts.noTui || !isTty) {
@@ -3713,11 +3791,11 @@ Start the manager first: agt manager start
 import chalk14 from "chalk";
 import JSON52 from "json5";
 import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 async function agentShowCommand(codeName, opts) {
   const json = isJsonMode();
-  const unifiedDir = join13(opts.configDir, codeName, "provision");
-  const legacyDir = join13(opts.configDir, codeName, "claudecode", "provision");
+  const unifiedDir = join14(opts.configDir, codeName, "provision");
+  const legacyDir = join14(opts.configDir, codeName, "claudecode", "provision");
   const agentDir = existsSync8(unifiedDir) ? unifiedDir : legacyDir;
   const hasLocalConfig = existsSync8(agentDir);
   let apiChannels = null;
@@ -3752,7 +3830,7 @@ async function agentShowCommand(codeName, opts) {
   let openclawConfig = null;
   let agentState = null;
   if (hasLocalConfig) {
-    const charterPath = join13(agentDir, "CHARTER.md");
+    const charterPath = join14(agentDir, "CHARTER.md");
     if (existsSync8(charterPath)) {
       const raw = readFileSync7(charterPath, "utf-8");
       const parsed = extractFrontmatter(raw);
@@ -3760,7 +3838,7 @@ async function agentShowCommand(codeName, opts) {
         charter = parsed.frontmatter;
       }
     }
-    const toolsPath = join13(agentDir, "TOOLS.md");
+    const toolsPath = join14(agentDir, "TOOLS.md");
     if (existsSync8(toolsPath)) {
       const raw = readFileSync7(toolsPath, "utf-8");
       const parsed = extractFrontmatter(raw);
@@ -3768,7 +3846,7 @@ async function agentShowCommand(codeName, opts) {
         tools = parsed.frontmatter;
       }
     }
-    const openclawPath = join13(agentDir, "openclaw.json5");
+    const openclawPath = join14(agentDir, "openclaw.json5");
     if (existsSync8(openclawPath)) {
       try {
         const raw = readFileSync7(openclawPath, "utf-8");
@@ -3776,7 +3854,7 @@ async function agentShowCommand(codeName, opts) {
       } catch {
       }
     }
-    const statePath = join13(opts.configDir, "manager-state.json");
+    const statePath = join14(opts.configDir, "manager-state.json");
     if (existsSync8(statePath)) {
       try {
         const raw = readFileSync7(statePath, "utf-8");
@@ -4117,23 +4195,23 @@ async function kanbanRecurringDisableCommand(titleOrId, opts) {
 
 // src/commands/setup.ts
 import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync8, mkdirSync as mkdirSync7, accessSync, constants as fsConstants } from "fs";
-import { join as join14, dirname as dirname4 } from "path";
-import { homedir as homedir5 } from "os";
+import { join as join15, dirname as dirname4 } from "path";
+import { homedir as homedir6 } from "os";
 import chalk16 from "chalk";
 import ora14 from "ora";
 function detectShellProfile() {
   const shell = process.env["SHELL"] ?? "";
-  const home = homedir5();
+  const home = homedir6();
   if (shell.includes("zsh")) {
-    return join14(home, ".zshrc");
+    return join15(home, ".zshrc");
   }
   if (shell.includes("fish")) {
-    const fishConfig = join14(home, ".config", "fish", "config.fish");
+    const fishConfig = join15(home, ".config", "fish", "config.fish");
     return fishConfig;
   }
-  const bashrc = join14(home, ".bashrc");
+  const bashrc = join15(home, ".bashrc");
   if (existsSync9(bashrc)) return bashrc;
-  return join14(home, ".bash_profile");
+  return join15(home, ".bash_profile");
 }
 function maybeWriteSystemWideEnv(apiUrl, apiKey, consoleUrl) {
   const empty = { etcEnvironment: false, profileD: false, bashrc: false };
@@ -4390,7 +4468,7 @@ async function setupCommand(token, options = {}) {
   const managerSpinner = ora14({ text: "Starting manager daemon\u2026", isSilent: json });
   managerSpinner.start();
   try {
-    const configDir = join14(homedir5(), ".augmented");
+    const configDir = join15(homedir6(), ".augmented");
     const { pid } = startWatchdog({ intervalMs: 1e4, configDir, detached: true });
     managerSpinner.succeed(`Manager started (PID ${pid})`);
   } catch (err) {
@@ -4941,7 +5019,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.158" : "dev";
+var cliVersion = true ? "0.27.160" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5173,12 +5251,12 @@ async function checkForUpdateOnStartup() {
 }
 
 // src/commands/audit-subagents.ts
-import { homedir as homedir6 } from "os";
-import { join as join16 } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join17 } from "path";
 
 // src/lib/subagent-mcp-audit.ts
 import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync2 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 function parseFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match) return null;
@@ -5228,7 +5306,7 @@ function findSubagentFiles(dir, depth = 0) {
   const out = [];
   const isAgentsDir = dir.endsWith("/agents") || dir.endsWith("\\agents");
   for (const entry of entries) {
-    const full = join15(dir, entry);
+    const full = join16(dir, entry);
     let s;
     try {
       s = statSync2(full);
@@ -5275,11 +5353,11 @@ function formatFinding(f) {
 
 // src/commands/audit-subagents.ts
 function defaultRoots() {
-  const home = homedir6();
+  const home = homedir7();
   return [
-    join16(home, ".claude", "agents"),
-    join16(home, ".claude", "plugins"),
-    join16(process.cwd(), ".claude", "agents")
+    join17(home, ".claude", "agents"),
+    join17(home, ".claude", "plugins"),
+    join17(process.cwd(), ".claude", "agents")
   ];
 }
 async function auditSubagentsCommand(options = {}) {
@@ -5315,8 +5393,8 @@ async function auditSubagentsCommand(options = {}) {
 
 // src/lib/mcp-render-allowlist-audit.ts
 import { readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join17 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join18 } from "path";
 function expectedWildcard(serverKey) {
   return `mcp__${serverKey.replace(/-/g, "_")}__*`;
 }
@@ -5335,7 +5413,7 @@ function readMcpServerKeys(mcpJsonPath) {
     return null;
   }
 }
-function auditMcpRenderAllowlist(rootDir = join17(homedir7(), ".augmented")) {
+function auditMcpRenderAllowlist(rootDir = join18(homedir8(), ".augmented")) {
   const findings = [];
   let entries;
   try {
@@ -5344,7 +5422,7 @@ function auditMcpRenderAllowlist(rootDir = join17(homedir7(), ".augmented")) {
     return findings;
   }
   for (const entry of entries) {
-    const agentDir = join17(rootDir, entry);
+    const agentDir = join18(rootDir, entry);
     let s;
     try {
       s = statSync3(agentDir);
@@ -5353,12 +5431,12 @@ function auditMcpRenderAllowlist(rootDir = join17(homedir7(), ".augmented")) {
     }
     if (!s.isDirectory() || entry.startsWith("_") || entry.startsWith(".")) continue;
     for (const scope of ["provision", "project"]) {
-      const mcpJsonPath = scope === "provision" ? join17(agentDir, "provision", ".mcp.json") : join17(agentDir, "project", ".mcp.json");
+      const mcpJsonPath = scope === "provision" ? join18(agentDir, "provision", ".mcp.json") : join18(agentDir, "project", ".mcp.json");
       const keys = readMcpServerKeys(mcpJsonPath);
       if (keys === null || keys.length === 0) continue;
       const expected = new Set(keys.map(expectedWildcard));
       for (const subagent of ["channel-message-handler", "augmented-worker"]) {
-        const mdPath = scope === "provision" ? join17(agentDir, ".claude", "agents", `${subagent}.md`) : join17(agentDir, "project", ".claude", "agents", `${subagent}.md`);
+        const mdPath = scope === "provision" ? join18(agentDir, ".claude", "agents", `${subagent}.md`) : join18(agentDir, "project", ".claude", "agents", `${subagent}.md`);
         let content;
         try {
           content = readFileSync10(mdPath, "utf-8");
@@ -5419,12 +5497,12 @@ async function auditMcpRenderCommand(options = {}) {
 }
 
 // src/commands/audit-secrets.ts
-import { homedir as homedir8 } from "os";
-import { join as join19 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join20 } from "path";
 
 // src/lib/secret-leak-audit.ts
 import { readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync4 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 var SECRET_KEY_NAME_RE = /TOKEN|KEY|SECRET|BEARER|PASSWORD/i;
 function isTemplated(value) {
   return value.includes("${");
@@ -5494,15 +5572,15 @@ function auditSecretLeaks(augmentedRoot) {
     return findings;
   }
   for (const agent2 of agents) {
-    const agentDir = join18(augmentedRoot, agent2);
+    const agentDir = join19(augmentedRoot, agent2);
     try {
       if (!statSync4(agentDir).isDirectory()) continue;
     } catch {
       continue;
     }
-    scanMcpFile(join18(agentDir, "provision", ".mcp.json"), agent2, findings);
-    scanMcpFile(join18(agentDir, "project", ".mcp.json"), agent2, findings);
-    scanEnvIntegrations(join18(agentDir, ".env.integrations"), agent2, findings);
+    scanMcpFile(join19(agentDir, "provision", ".mcp.json"), agent2, findings);
+    scanMcpFile(join19(agentDir, "project", ".mcp.json"), agent2, findings);
+    scanEnvIntegrations(join19(agentDir, ".env.integrations"), agent2, findings);
   }
   return findings;
 }
@@ -5528,7 +5606,7 @@ function describe(f) {
   return `secret file is mode ${f.mode} (expected 0600)`;
 }
 async function auditSecretsCommand(options = {}) {
-  const root = options.root ?? join19(homedir8(), ".augmented");
+  const root = options.root ?? join20(homedir9(), ".augmented");
   const findings = auditSecretLeaks(root);
   if (options.json) {
     process.stdout.write(`${JSON.stringify({ findings, root }, null, 2)}
@@ -5864,7 +5942,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.158" : "dev";
+var cliVersion2 = true ? "0.27.160" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {
@@ -5880,6 +5958,10 @@ program.hook("preAction", async (thisCommand, actionCommand) => {
   }
 });
 program.command("whoami").description("Show the authenticated host, team, and user from AGT_API_KEY").action(whoamiCommand);
+var flags = program.command("flags").description("Inspect feature flags resolved on this host (ADR-0022)");
+flags.command("resolve").description("Print each flag\u2019s effective value and source layer (env / heartbeat-cache / compiled default)").option("--flag <key>", "Resolve a single flag by key instead of all registered flags").option("--host", "Show host-cache diagnostics (unrecognised cached keys from a newer API)").option("--config-dir <path>", "Manager config dir holding flags-cache.json (default ~/.augmented)").action((opts) => {
+  flagsResolveCommand(opts);
+});
 program.command("setup <token>").description("One-command host setup: exchange provisioning token, configure env vars, verify, and start manager").option(
   "--api-host <url>",
   // ENG-5831: required when AGT_HOST is not set in the shell — the setup
@@ -5957,16 +6039,16 @@ host.command("pair <host-name>").description("Start an SSM port-forward + shell
   })
 );
 var manager = program.command("manager").description("Host config sync daemon \u2014 keeps local agent files in sync with API");
-manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
-manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).action(managerStopCommand);
-manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).action(managerStatusCommand);
-manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
-manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join20(homedir9(), ".augmented")).action(managerInstallCommand);
+manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join21(homedir10(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
+manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join21(homedir10(), ".augmented")).action(managerStopCommand);
+manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join21(homedir10(), ".augmented")).action(managerStatusCommand);
+manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join21(homedir10(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
+manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join21(homedir10(), ".augmented")).action(managerInstallCommand);
 manager.command("uninstall").description("Remove the OS-level supervisor (launchctl unload + delete plist on macOS). Idempotent.").action(managerUninstallCommand);
 manager.command("install-system-unit").description("Install a system-level systemd unit (Linux, root) so the manager auto-starts on every boot. For headless EC2 hosts \u2014 survives reboot without `loginctl enable-linger`. (ENG-4706)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files (defaults to /root/.augmented or /home/<user>/.augmented)").option("--user <name>", "Unix user the manager runs as", "root").action(managerInstallSystemUnitCommand);
 manager.command("uninstall-system-unit").description("Remove the system-level systemd unit (Linux, root). Idempotent. (ENG-4706)").action(managerUninstallSystemUnitCommand);
 var agent = program.command("agent").description("Inspect and manage agents");
-agent.command("show <code-name>").description("Display an agent's provisioned OpenClaw configuration").option("--config-dir <dir>", "Config directory", join20(homedir9(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
+agent.command("show <code-name>").description("Display an agent's provisioned OpenClaw configuration").option("--config-dir <dir>", "Config directory", join21(homedir10(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
 var kanban = program.command("kanban").description("Manage agent kanban boards");
 kanban.command("list").description("List kanban board items for an agent").requiredOption("--agent <code-name>", "Agent code name").action(kanbanListCommand);
 kanban.command("add <title>").description("Add a new item to an agent kanban board").requiredOption("--agent <code-name>", "Agent code name").option("--priority <1|2|3>", "Priority: 1=high, 2=medium, 3=low", "2").option("--status <status>", "Initial status: backlog | todo | in_progress", "todo").option("--description <text>", "Item description").option("--estimate <minutes>", "Estimated time in minutes").option("--deliverable <text>", "Expected output/deliverable").action(kanbanAddCommand);