@integrity-labs/agt-cli 0.28.1005 → 0.28.1007

package/dist/{chunk-DVSYT4MU.js → chunk-XWMUQR65.js}

@@ -6529,6 +6529,57 @@ var FLAG_REGISTRY = [
     sensitive: true
     // No envVar - net-new API-side control with no pre-flags env gate to migrate (ADR-0022).
   },
+  {
+    key: "channel-quarantine-auto-resume",
+    description: "Time-based auto-resume of an ENG-5932 channel quarantine (ENG-10510): off = disabled, shadow = log the would-resume without acting, enforce = clear the local quarantine marker and re-add the channel for a TRIAL run, letting the reaper re-quarantine it if it is still dead. Backoff 2h doubling to a 24h cap, giving up after 5 attempts and leaving it for an operator; the manual Re-enable is unaffected and clears the strike count. DELIBERATELY NOT health-based: a quarantined channel is dropped from .mcp.json and the launch flags, so its process never spawns and its liveness is unobservable - unlike an ENG-7916 integration, which stays probeable via a reconstructed inline_server_entry, which is why mcp-auto-resume-mode can wait for healthy cycles and this cannot. A SEPARATE FLAG FROM channel-quarantine-mode ON PURPOSE: that one defaults to shadow, so giving it a resume meaning would arm auto-resume fleet-wide on the existing default. Declared safe value is off (fully dark): a flag-DB read error must never re-add a channel on its own, because a trial costs restarts against the breaker budget.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // off = fully dark. See the description's fail-safe reasoning.
+    defaultValue: "off",
+    // Enforcement-mode control like its siblings channel-quarantine-mode and
+    // mcp-auto-resume-mode: masked on public surfaces, mutations confirmed.
+    sensitive: true,
+    // ENG-10036: the reader lives in apps/cli (manager-worker), so an older
+    // host has no code to honour a flip. Without `since`, classifyHostReach
+    // reports 'honors' - full reach - which is the most confident thing the
+    // field can say and would be a lie here.
+    //
+    // DELIBERATE UNREACHABLE PLACEHOLDER - NOT A REAL THRESHOLD YET.
+    // Obi-Wan on #6313: the previous value here was '0.28.990', written before
+    // merge and stated as though it were the reader's shipping version. It is
+    // not knowable pre-merge. `since` is documented (types.ts) as "the agt-cli
+    // version its reader lands in", and the bisected siblings in this registry
+    // were all read off published dists AFTER their merge. The published line
+    // is around 0.28.916-0.28.918, so that guess sat ~70 patch releases above
+    // the build that will actually carry this reader - every host running the
+    // release that DOES honour the flag would have classified `stale` until the
+    // fleet passed a version that does not exist yet.
+    //
+    // So this follows the convention this registry already established for
+    // exactly this situation - see `github-broker-credentials` below, whose
+    // identical DELIBERATE UNREACHABLE PLACEHOLDER block and `since: '0.29.0'`
+    // are the precedent: pinned ABOVE every published release ON PURPOSE,
+    // labelled as a placeholder, and gated on a post-publish bisect.
+    //
+    // (This cited `claudecode-agt-bin-credential-helpers` until obi-wan
+    // `8f9d3c43076c` pointed out no such key exists anywhere in the repo - the
+    // only occurrence in the tree was this citation. The precedent was real and
+    // the reasoning held, but the pointer could not be followed, so a reader
+    // looking it up found nothing and had no way to tell whether the convention
+    // was inherited or invented here. That is the one question a citation
+    // exists to answer, and it is asked at exactly the moment someone is about
+    // to do the post-publish bisect.) It classifies every host
+    // as `stale`, which reports no reach rather than reach there is no basis
+    // for - and unlike a plausible-looking number, it says out loud that it
+    // must be re-bisected.
+    //
+    // BEFORE THIS FLAG IS FLIPPED ANYWHERE: bisect the published dist for the
+    // first agt-cli whose manager-worker carries the auto-resume poll block,
+    // and replace this with that exact version. Leaving the placeholder is safe
+    // (defaultValue 'off', sensitive: true, nothing flips); shipping a guessed
+    // number is not.
+    since: "0.29.0"
+  },
   {
     key: "mcp-auto-resume-mode",
     description: "MCP auto-resume of a bind-failure quarantine (ENG-8036, follow-up to ENG-7916): off = disabled, shadow = log only (would-resume without acting), enforce = flip an ENG-7916-quarantined integration (status=unhealthy) back to status=active after DEFAULT_AUTO_RESUME_OK_CYCLES consecutive healthy connectivity-probe cycles. Recovery is observed via the connectivity-probe path, not the session-tool-bind probe (a quarantined row is excluded from the bind probe by the ENG-5292 writer). Only rows this quarantine system marked are auto-resumed - the reaper/oauth-refresh error/unhealthy states are never stomped. Declared safe value is off (fully dark): a flag-DB read error must never auto-un-quarantine on its own. Flip to shadow to observe, then enforce once the cycle threshold is tuned.",
@@ -15371,4 +15422,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-DVSYT4MU.js.map
+//# sourceMappingURL=chunk-XWMUQR65.js.map