@integrity-labs/agt-cli 0.28.1029 → 0.28.1031

package/dist/{chunk-7LBSHOJ7.js → chunk-XD5GMJGJ.js}

@@ -23,7 +23,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-3V43FBP4.js";
+} from "./chunk-TFFXAGBJ.js";
 import {
   classifyUnanswerablePane,
   findUsageLimitResetHint,
@@ -5930,4 +5930,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-7LBSHOJ7.js.map
+//# sourceMappingURL=chunk-XD5GMJGJ.js.map

package/dist/{claude-pair-runtime-A4JF2ZGD.js → claude-pair-runtime-NBF54YQD.js}

@@ -266,7 +266,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-U2DXYFIU.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-AMUXFQKY.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -734,4 +734,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-A4JF2ZGD.js.map
+//# sourceMappingURL=claude-pair-runtime-NBF54YQD.js.map

package/dist/lib/manager-worker.js

@@ -66,7 +66,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-4KX6ZCA2.js";
+} from "../chunk-HQSQLPHD.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -149,7 +149,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-7LBSHOJ7.js";
+} from "../chunk-XD5GMJGJ.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -254,7 +254,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-3V43FBP4.js";
+} from "../chunk-TFFXAGBJ.js";
 import {
   classifyUnanswerablePane,
   paneRemedy
@@ -13927,7 +13927,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-7KPMAX2A.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-73AXZT6D.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14673,7 +14673,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1029" : "dev";
+var agtCliVersion = true ? "0.28.1031" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16308,7 +16308,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-U2DXYFIU.js");
+      const { collectDiagnostics } = await import("../persistent-session-AMUXFQKY.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -16450,7 +16450,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-U2DXYFIU.js");
+      const { collectDiagnostics } = await import("../persistent-session-AMUXFQKY.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -16626,7 +16626,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-7KPMAX2A.js");
+      } = await import("../responsiveness-probe-73AXZT6D.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16743,7 +16743,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-7KPMAX2A.js");
+        } = await import("../responsiveness-probe-73AXZT6D.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16899,7 +16899,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-PZGGUZWK.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-VINCM3ZI.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -21442,7 +21442,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-7KPMAX2A.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-73AXZT6D.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -21485,7 +21485,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-U2DXYFIU.js");
+        const { collectDiagnostics } = await import("../persistent-session-AMUXFQKY.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -21536,7 +21536,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-U2DXYFIU.js");
+      const { collectDiagnostics } = await import("../persistent-session-AMUXFQKY.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22208,7 +22208,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-A4JF2ZGD.js");
+  } = await import("../claude-pair-runtime-NBF54YQD.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -36419,7 +36419,10 @@ var FLAG_REGISTRY = [
     // Disabling this RESTORES the shared host-wide key to every container, and
     // with it the cross-agent credential read ENG-8992 closes. A credential-scope
     // reduction should not be one click away without confirmation — same posture
-    // as `github-broker-credentials`, the other credential-delivery flag.
+    // as the credential-delivery flags `github-broker-credentials` and
+    // `xero-broker-credentials`. (This said "the OTHER credential-delivery flag"
+    // while there was one; ENG-10939 added the second, so the singular had to go
+    // rather than silently become a claim that github is the only sibling.)
     sensitive: true,
     // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
     // so a host on an older agt-cli has no consumer code: it keeps forwarding the
@@ -37566,6 +37569,12 @@ var FLAG_REGISTRY = [
     // are the precedent: pinned ABOVE every published release ON PURPOSE,
     // labelled as a placeholder, and gated on a post-publish bisect.
     //
+    // ENG-10939: `xero-broker-credentials` is the worked example of the other
+    // half of that convention - the bisect that DISCHARGES a placeholder. Its
+    // `since` is a real published version read off `npm pack` tarballs, with the
+    // markers it was bisected on written down, so the two entries together show
+    // both states this field is allowed to be in.
+    //
     // (This cited `claudecode-agt-bin-credential-helpers` until obi-wan
     // `8f9d3c43076c` pointed out no such key exists anywhere in the repo - the
     // only occurrence in the tree was this citation. The precedent was real and
@@ -38332,6 +38341,56 @@ var FLAG_REGISTRY = [
     // flips); shipping a guessed number is not.
     since: "0.29.0"
   },
+  {
+    key: "xero-broker-credentials",
+    description: 'Deliver the Xero OAuth access token to the vendor Xero MCP server through the broker credential endpoint at USE time, instead of materializing it onto the agent host at spawn (ENG-10939, step 1 of the Xero lockdown ENG-10927). Mechanically the sibling of `github-broker-credentials`; the REASON and the cost of a bad flip are both different. ON: POST /host/agent-integrations strips `access_token`, `refresh_token` and `token_expires_at` from the xero row and marks it credential_delivery=broker, so XERO_ACCESS_TOKEN stops being written to .env.integrations. Nothing replaces it host-side and nothing needs to: the vendor MCP server has fetched a fresh token per call from POST /host/agent-integrations/:id/credential since ENG-4920, and `brokerMode` is true for every install carrying an id - so XERO_CLIENT_BEARER_TOKEN: ${XERO_ACCESS_TOKEN} is already not emitted and no dangling reference is left behind. `granted_scopes` and `read_only` are deliberately KEPT: they are consent metadata the host reports scope drift from, not credentials. OFF (default): byte-for-byte today\'s behaviour. WHY THIS IS NOT THE GITHUB FLAG. For github, an under-`since` host on a flipped flag LOSES `git`/`gh` - an outage. For xero the equivalent host LEAKS: before ENG-10939 the ENG-8344 broker guard was a loop-level `continue` that also skipped the config-derived env vars, so a broker-marked xero row dropped XERO_TENANT_ID, and per ENG-4898 the vendor MCP server then falls back to `tenants[0]` - a CROSS-TENANT DATA LEAK with no error anywhere. The dangerous fleet is therefore an INTERVAL, not "old hosts", and BOTH edges are bisected from published tarballs rather than named by issue: below agt-cli 0.28.508 a host carries no `credentialDelivery` handling at all, so it ignores the marker and is SAFE; from 0.28.508 up to (not including) 0.28.1015 it honours the marker with the WIDE skip and LEAKS; at 0.28.1015 and above the skip is narrowed and the behaviour is correct. `since` is a lower bound, so it classifies BOTH ends of that interval as `stale` and cannot tell a safe pre-0.28.508 host from a leaking-middle one. THE FLIP GATE IS THEREFORE NOT "the modal shows reach": it is zero xero-bearing hosts below 0.28.1015 per hosts.agt_version, counting NULL and stale as UNCONVERGED (the heartbeat writes that column conditionally on presence, so a host that stopped reporting keeps its last value - the async-export-rollout pattern). AND A SECOND GATE THE MODAL CANNOT SEE AT ALL: the rewritten Xero skills (ENG-10961) must be live in the catalog AND have reached hosts BEFORE this is flipped. Reversed, a host has no token while its own skills still tell it to read one - a silent read outage with no error at the write site. The catalog reaches prod through `pnpm db:catalog:seed` on deploy, not through the code deploy itself, so "merged" is not "live". EXPECTED ON FLIP DAY, so it is not a surprise: the payload shrinks, so computeIntegrationsHash moves once and XERO_ACCESS_TOKEN reads present->absent in the env diff. That does NOT respawn the session. `liveProxyTokenVars` collects AGT_REMOTE_MCP_TOKEN_VAR from .mcp.json (= XERO_ACCESS_TOKEN in broker mode) and the manager filters it out of `respawnVars` BY NAME, kind-blind - so a removal is exempt on exactly the same line a rotation is (ENG-8264). The ENG-5318 child-kill path is likewise unreachable, because broker mode never emits the ${XERO_ACCESS_TOKEN} reference the stale-mcp-reaper keys on. Both restart paths that touch this var are already quiet. Evaluated API-side only, per agent, in POST /host/agent-integrations. The host does not read this flag - it keys off the resulting credential_delivery marker - so there is deliberately NO host-side envVar that could put the token back on its own. Roll back from the flag.',
+    flagType: "boolean",
+    // Declared safe value is `false` = today's env delivery. Fail-safe here is
+    // not symmetrical with github's: OFF leaves a credential on the host (bad,
+    // but the status quo this epic is closing), while a wrongly-ON flip on an
+    // under-`since` host LEAKS ANOTHER TENANT'S DATA. `false` is still the right
+    // default, because the ON path is the one with a reach precondition — but
+    // the reason is "do not arm this until the fleet is measured", not "a flag
+    // blip must not break the agent".
+    defaultValue: false,
+    // Flipping ON changes how every Xero agent on the scope authenticates, and
+    // on an unconverged host it is a cross-tenant leak rather than an outage. A
+    // deliberate, confirmed action (ADR-0022 §4).
+    sensitive: true,
+    // A REAL bisected threshold, not the placeholder `github-broker-credentials`
+    // and `per-agent-host-credentials` had to ship with: the host-side code this
+    // flag depends on (ENG-10939 item 0, narrowing the ENG-8344 broker guard so
+    // it skips the CREDENTIAL and not the whole row's config) landed in PR #6443
+    // and has already published.
+    //
+    // Read off the published tarballs rather than inferred from the merge
+    // timestamp. #6443 merged at 2026-09-24T01:54:41Z; 0.28.1015 published at
+    // 01:59:23Z. `npm pack` of 0.28.1013/1014/1015/1016 + grep of the extracted
+    // bundle agrees in both directions on four independent markers:
+    //   0.28.1014 — `writeTokenFile` present (4 files), `isRespawnExemptEnvVar`
+    //               and `RESPAWN_EXEMPT_CONFIG_TAILS` absent, and the only
+    //               broker-guard spelling is `credentialDelivery === "broker"`
+    //               (the wide skip).
+    //   0.28.1015 — `writeTokenFile` gone, both new exports present, and
+    //               `credentialDelivery !== "broker"` (the narrowed block form)
+    //               appears for the first time.
+    // The `!==` form is the one that matters: it is the guard that keeps
+    // XERO_TENANT_ID on a broker-marked row, i.e. the thing whose absence is the
+    // ENG-4898 leak.
+    //
+    // The interval's OTHER edge was bisected the same way, so the description
+    // above can name a version instead of an issue: `credentialDelivery` appears
+    // in no file of 0.28.507 and in five files of 0.28.508, so ENG-8344's marker
+    // handling first shipped in 0.28.508. A host below that is genuinely safe
+    // rather than merely old — it has no code to honour the marker with.
+    //
+    // Same caveat as every other `since` in this registry: it is ADVISORY. It is
+    // read only by `computeFlagReach` behind GET /flags/admin/reach, so it
+    // changes what an operator is TOLD and does not stop a flip on an
+    // under-`since` host. What holds the line is `defaultValue: false`, plus
+    // `sensitive: true`, plus the two gates spelled out in the description.
+    since: "0.28.1015"
+  },
   {
     key: "help-kb-auto-grant",
     description: "Auto-grant the `augmented-help-kb` integration at ORG scope when an organization is provisioned (ENG-8542), so every agent in that org gets product-doc search without a per-agent operator action. One organization_integrations row reaches every agent in the org: POST /host/agent-integrations merges org -> team -> agent and buildMcpJson's predicate reads that merged set with no scope filter. ON: the two org-provisioning call sites write the row (status=active, created_by=the org owner). OFF (default): they write nothing - byte-for-byte today's behaviour. STAGED ROLLOUT IS THE POINT. ENG-8332 argues against widening distribution of the help KB until two things close, because distributing a corpus with wrong articles \"converts one agent's wrong answer into everyone's\": (1) a live 200 from GET /host/kb/search as the anon role has still never been observed - ENG-7260 was closed on remediation evidence, not on a live call, and the deploy seed log is SERVICE-ROLE evidence that says nothing about the anon grant; (2) the `site-structure` article is unverified against the current IA. Turning this on for ONE org and watching that org's help-kb connectivity-probe verdicts (ENG-8332 added a real mcp_stdio probe that calls search_knowledge_base) is the cheap positive control for (1) - an ENG-7260-class 500 then reports as `down` per agent instead of as silence. Widen only after it comes back healthy. REVOKING IS DELETING THE ROW, not flipping this off: the flag gates GRANTING, so an already-granted org keeps its row when the flag goes off. Evaluated API-side only, per org, inside grantHelpKbToOrg; no host-side envVar and deliberately no sst.config.ts entry (a literal default there would pin it - ENG-8303).",

package/dist/mcp/index.js

@@ -28716,7 +28716,10 @@ var FLAG_REGISTRY = [
     // Disabling this RESTORES the shared host-wide key to every container, and
     // with it the cross-agent credential read ENG-8992 closes. A credential-scope
     // reduction should not be one click away without confirmation — same posture
-    // as `github-broker-credentials`, the other credential-delivery flag.
+    // as the credential-delivery flags `github-broker-credentials` and
+    // `xero-broker-credentials`. (This said "the OTHER credential-delivery flag"
+    // while there was one; ENG-10939 added the second, so the singular had to go
+    // rather than silently become a claim that github is the only sibling.)
     sensitive: true,
     // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
     // so a host on an older agt-cli has no consumer code: it keeps forwarding the
@@ -29863,6 +29866,12 @@ var FLAG_REGISTRY = [
     // are the precedent: pinned ABOVE every published release ON PURPOSE,
     // labelled as a placeholder, and gated on a post-publish bisect.
     //
+    // ENG-10939: `xero-broker-credentials` is the worked example of the other
+    // half of that convention - the bisect that DISCHARGES a placeholder. Its
+    // `since` is a real published version read off `npm pack` tarballs, with the
+    // markers it was bisected on written down, so the two entries together show
+    // both states this field is allowed to be in.
+    //
     // (This cited `claudecode-agt-bin-credential-helpers` until obi-wan
     // `8f9d3c43076c` pointed out no such key exists anywhere in the repo - the
     // only occurrence in the tree was this citation. The precedent was real and
@@ -30629,6 +30638,56 @@ var FLAG_REGISTRY = [
     // flips); shipping a guessed number is not.
     since: "0.29.0"
   },
+  {
+    key: "xero-broker-credentials",
+    description: 'Deliver the Xero OAuth access token to the vendor Xero MCP server through the broker credential endpoint at USE time, instead of materializing it onto the agent host at spawn (ENG-10939, step 1 of the Xero lockdown ENG-10927). Mechanically the sibling of `github-broker-credentials`; the REASON and the cost of a bad flip are both different. ON: POST /host/agent-integrations strips `access_token`, `refresh_token` and `token_expires_at` from the xero row and marks it credential_delivery=broker, so XERO_ACCESS_TOKEN stops being written to .env.integrations. Nothing replaces it host-side and nothing needs to: the vendor MCP server has fetched a fresh token per call from POST /host/agent-integrations/:id/credential since ENG-4920, and `brokerMode` is true for every install carrying an id - so XERO_CLIENT_BEARER_TOKEN: ${XERO_ACCESS_TOKEN} is already not emitted and no dangling reference is left behind. `granted_scopes` and `read_only` are deliberately KEPT: they are consent metadata the host reports scope drift from, not credentials. OFF (default): byte-for-byte today\'s behaviour. WHY THIS IS NOT THE GITHUB FLAG. For github, an under-`since` host on a flipped flag LOSES `git`/`gh` - an outage. For xero the equivalent host LEAKS: before ENG-10939 the ENG-8344 broker guard was a loop-level `continue` that also skipped the config-derived env vars, so a broker-marked xero row dropped XERO_TENANT_ID, and per ENG-4898 the vendor MCP server then falls back to `tenants[0]` - a CROSS-TENANT DATA LEAK with no error anywhere. The dangerous fleet is therefore an INTERVAL, not "old hosts", and BOTH edges are bisected from published tarballs rather than named by issue: below agt-cli 0.28.508 a host carries no `credentialDelivery` handling at all, so it ignores the marker and is SAFE; from 0.28.508 up to (not including) 0.28.1015 it honours the marker with the WIDE skip and LEAKS; at 0.28.1015 and above the skip is narrowed and the behaviour is correct. `since` is a lower bound, so it classifies BOTH ends of that interval as `stale` and cannot tell a safe pre-0.28.508 host from a leaking-middle one. THE FLIP GATE IS THEREFORE NOT "the modal shows reach": it is zero xero-bearing hosts below 0.28.1015 per hosts.agt_version, counting NULL and stale as UNCONVERGED (the heartbeat writes that column conditionally on presence, so a host that stopped reporting keeps its last value - the async-export-rollout pattern). AND A SECOND GATE THE MODAL CANNOT SEE AT ALL: the rewritten Xero skills (ENG-10961) must be live in the catalog AND have reached hosts BEFORE this is flipped. Reversed, a host has no token while its own skills still tell it to read one - a silent read outage with no error at the write site. The catalog reaches prod through `pnpm db:catalog:seed` on deploy, not through the code deploy itself, so "merged" is not "live". EXPECTED ON FLIP DAY, so it is not a surprise: the payload shrinks, so computeIntegrationsHash moves once and XERO_ACCESS_TOKEN reads present->absent in the env diff. That does NOT respawn the session. `liveProxyTokenVars` collects AGT_REMOTE_MCP_TOKEN_VAR from .mcp.json (= XERO_ACCESS_TOKEN in broker mode) and the manager filters it out of `respawnVars` BY NAME, kind-blind - so a removal is exempt on exactly the same line a rotation is (ENG-8264). The ENG-5318 child-kill path is likewise unreachable, because broker mode never emits the ${XERO_ACCESS_TOKEN} reference the stale-mcp-reaper keys on. Both restart paths that touch this var are already quiet. Evaluated API-side only, per agent, in POST /host/agent-integrations. The host does not read this flag - it keys off the resulting credential_delivery marker - so there is deliberately NO host-side envVar that could put the token back on its own. Roll back from the flag.',
+    flagType: "boolean",
+    // Declared safe value is `false` = today's env delivery. Fail-safe here is
+    // not symmetrical with github's: OFF leaves a credential on the host (bad,
+    // but the status quo this epic is closing), while a wrongly-ON flip on an
+    // under-`since` host LEAKS ANOTHER TENANT'S DATA. `false` is still the right
+    // default, because the ON path is the one with a reach precondition — but
+    // the reason is "do not arm this until the fleet is measured", not "a flag
+    // blip must not break the agent".
+    defaultValue: false,
+    // Flipping ON changes how every Xero agent on the scope authenticates, and
+    // on an unconverged host it is a cross-tenant leak rather than an outage. A
+    // deliberate, confirmed action (ADR-0022 §4).
+    sensitive: true,
+    // A REAL bisected threshold, not the placeholder `github-broker-credentials`
+    // and `per-agent-host-credentials` had to ship with: the host-side code this
+    // flag depends on (ENG-10939 item 0, narrowing the ENG-8344 broker guard so
+    // it skips the CREDENTIAL and not the whole row's config) landed in PR #6443
+    // and has already published.
+    //
+    // Read off the published tarballs rather than inferred from the merge
+    // timestamp. #6443 merged at 2026-09-24T01:54:41Z; 0.28.1015 published at
+    // 01:59:23Z. `npm pack` of 0.28.1013/1014/1015/1016 + grep of the extracted
+    // bundle agrees in both directions on four independent markers:
+    //   0.28.1014 — `writeTokenFile` present (4 files), `isRespawnExemptEnvVar`
+    //               and `RESPAWN_EXEMPT_CONFIG_TAILS` absent, and the only
+    //               broker-guard spelling is `credentialDelivery === "broker"`
+    //               (the wide skip).
+    //   0.28.1015 — `writeTokenFile` gone, both new exports present, and
+    //               `credentialDelivery !== "broker"` (the narrowed block form)
+    //               appears for the first time.
+    // The `!==` form is the one that matters: it is the guard that keeps
+    // XERO_TENANT_ID on a broker-marked row, i.e. the thing whose absence is the
+    // ENG-4898 leak.
+    //
+    // The interval's OTHER edge was bisected the same way, so the description
+    // above can name a version instead of an issue: `credentialDelivery` appears
+    // in no file of 0.28.507 and in five files of 0.28.508, so ENG-8344's marker
+    // handling first shipped in 0.28.508. A host below that is genuinely safe
+    // rather than merely old — it has no code to honour the marker with.
+    //
+    // Same caveat as every other `since` in this registry: it is ADVISORY. It is
+    // read only by `computeFlagReach` behind GET /flags/admin/reach, so it
+    // changes what an operator is TOLD and does not stop a flip on an
+    // under-`since` host. What holds the line is `defaultValue: false`, plus
+    // `sensitive: true`, plus the two gates spelled out in the description.
+    since: "0.28.1015"
+  },
   {
     key: "help-kb-auto-grant",
     description: "Auto-grant the `augmented-help-kb` integration at ORG scope when an organization is provisioned (ENG-8542), so every agent in that org gets product-doc search without a per-agent operator action. One organization_integrations row reaches every agent in the org: POST /host/agent-integrations merges org -> team -> agent and buildMcpJson's predicate reads that merged set with no scope filter. ON: the two org-provisioning call sites write the row (status=active, created_by=the org owner). OFF (default): they write nothing - byte-for-byte today's behaviour. STAGED ROLLOUT IS THE POINT. ENG-8332 argues against widening distribution of the help KB until two things close, because distributing a corpus with wrong articles \"converts one agent's wrong answer into everyone's\": (1) a live 200 from GET /host/kb/search as the anon role has still never been observed - ENG-7260 was closed on remediation evidence, not on a live call, and the deploy seed log is SERVICE-ROLE evidence that says nothing about the anon grant; (2) the `site-structure` article is unverified against the current IA. Turning this on for ONE org and watching that org's help-kb connectivity-probe verdicts (ENG-8332 added a real mcp_stdio probe that calls search_knowledge_base) is the cheap positive control for (1) - an ENG-7260-class 500 then reports as `down` per agent instead of as silence. Widen only after it comes back healthy. REVOKING IS DELETING THE ROW, not flipping this off: the flag gates GRANTING, so an already-granted org keeps its row when the flag goes off. Evaluated API-side only, per org, inside grantHelpKbToOrg; no host-side envVar and deliberately no sst.config.ts entry (a literal default there would pin it - ENG-8303).",

package/dist/mcp/origami.js

@@ -42664,7 +42664,10 @@ var FLAG_REGISTRY = [
     // Disabling this RESTORES the shared host-wide key to every container, and
     // with it the cross-agent credential read ENG-8992 closes. A credential-scope
     // reduction should not be one click away without confirmation — same posture
-    // as `github-broker-credentials`, the other credential-delivery flag.
+    // as the credential-delivery flags `github-broker-credentials` and
+    // `xero-broker-credentials`. (This said "the OTHER credential-delivery flag"
+    // while there was one; ENG-10939 added the second, so the singular had to go
+    // rather than silently become a claim that github is the only sibling.)
     sensitive: true,
     // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
     // so a host on an older agt-cli has no consumer code: it keeps forwarding the
@@ -43811,6 +43814,12 @@ var FLAG_REGISTRY = [
     // are the precedent: pinned ABOVE every published release ON PURPOSE,
     // labelled as a placeholder, and gated on a post-publish bisect.
     //
+    // ENG-10939: `xero-broker-credentials` is the worked example of the other
+    // half of that convention - the bisect that DISCHARGES a placeholder. Its
+    // `since` is a real published version read off `npm pack` tarballs, with the
+    // markers it was bisected on written down, so the two entries together show
+    // both states this field is allowed to be in.
+    //
     // (This cited `claudecode-agt-bin-credential-helpers` until obi-wan
     // `8f9d3c43076c` pointed out no such key exists anywhere in the repo - the
     // only occurrence in the tree was this citation. The precedent was real and
@@ -44577,6 +44586,56 @@ var FLAG_REGISTRY = [
     // flips); shipping a guessed number is not.
     since: "0.29.0"
   },
+  {
+    key: "xero-broker-credentials",
+    description: 'Deliver the Xero OAuth access token to the vendor Xero MCP server through the broker credential endpoint at USE time, instead of materializing it onto the agent host at spawn (ENG-10939, step 1 of the Xero lockdown ENG-10927). Mechanically the sibling of `github-broker-credentials`; the REASON and the cost of a bad flip are both different. ON: POST /host/agent-integrations strips `access_token`, `refresh_token` and `token_expires_at` from the xero row and marks it credential_delivery=broker, so XERO_ACCESS_TOKEN stops being written to .env.integrations. Nothing replaces it host-side and nothing needs to: the vendor MCP server has fetched a fresh token per call from POST /host/agent-integrations/:id/credential since ENG-4920, and `brokerMode` is true for every install carrying an id - so XERO_CLIENT_BEARER_TOKEN: ${XERO_ACCESS_TOKEN} is already not emitted and no dangling reference is left behind. `granted_scopes` and `read_only` are deliberately KEPT: they are consent metadata the host reports scope drift from, not credentials. OFF (default): byte-for-byte today\'s behaviour. WHY THIS IS NOT THE GITHUB FLAG. For github, an under-`since` host on a flipped flag LOSES `git`/`gh` - an outage. For xero the equivalent host LEAKS: before ENG-10939 the ENG-8344 broker guard was a loop-level `continue` that also skipped the config-derived env vars, so a broker-marked xero row dropped XERO_TENANT_ID, and per ENG-4898 the vendor MCP server then falls back to `tenants[0]` - a CROSS-TENANT DATA LEAK with no error anywhere. The dangerous fleet is therefore an INTERVAL, not "old hosts", and BOTH edges are bisected from published tarballs rather than named by issue: below agt-cli 0.28.508 a host carries no `credentialDelivery` handling at all, so it ignores the marker and is SAFE; from 0.28.508 up to (not including) 0.28.1015 it honours the marker with the WIDE skip and LEAKS; at 0.28.1015 and above the skip is narrowed and the behaviour is correct. `since` is a lower bound, so it classifies BOTH ends of that interval as `stale` and cannot tell a safe pre-0.28.508 host from a leaking-middle one. THE FLIP GATE IS THEREFORE NOT "the modal shows reach": it is zero xero-bearing hosts below 0.28.1015 per hosts.agt_version, counting NULL and stale as UNCONVERGED (the heartbeat writes that column conditionally on presence, so a host that stopped reporting keeps its last value - the async-export-rollout pattern). AND A SECOND GATE THE MODAL CANNOT SEE AT ALL: the rewritten Xero skills (ENG-10961) must be live in the catalog AND have reached hosts BEFORE this is flipped. Reversed, a host has no token while its own skills still tell it to read one - a silent read outage with no error at the write site. The catalog reaches prod through `pnpm db:catalog:seed` on deploy, not through the code deploy itself, so "merged" is not "live". EXPECTED ON FLIP DAY, so it is not a surprise: the payload shrinks, so computeIntegrationsHash moves once and XERO_ACCESS_TOKEN reads present->absent in the env diff. That does NOT respawn the session. `liveProxyTokenVars` collects AGT_REMOTE_MCP_TOKEN_VAR from .mcp.json (= XERO_ACCESS_TOKEN in broker mode) and the manager filters it out of `respawnVars` BY NAME, kind-blind - so a removal is exempt on exactly the same line a rotation is (ENG-8264). The ENG-5318 child-kill path is likewise unreachable, because broker mode never emits the ${XERO_ACCESS_TOKEN} reference the stale-mcp-reaper keys on. Both restart paths that touch this var are already quiet. Evaluated API-side only, per agent, in POST /host/agent-integrations. The host does not read this flag - it keys off the resulting credential_delivery marker - so there is deliberately NO host-side envVar that could put the token back on its own. Roll back from the flag.',
+    flagType: "boolean",
+    // Declared safe value is `false` = today's env delivery. Fail-safe here is
+    // not symmetrical with github's: OFF leaves a credential on the host (bad,
+    // but the status quo this epic is closing), while a wrongly-ON flip on an
+    // under-`since` host LEAKS ANOTHER TENANT'S DATA. `false` is still the right
+    // default, because the ON path is the one with a reach precondition — but
+    // the reason is "do not arm this until the fleet is measured", not "a flag
+    // blip must not break the agent".
+    defaultValue: false,
+    // Flipping ON changes how every Xero agent on the scope authenticates, and
+    // on an unconverged host it is a cross-tenant leak rather than an outage. A
+    // deliberate, confirmed action (ADR-0022 §4).
+    sensitive: true,
+    // A REAL bisected threshold, not the placeholder `github-broker-credentials`
+    // and `per-agent-host-credentials` had to ship with: the host-side code this
+    // flag depends on (ENG-10939 item 0, narrowing the ENG-8344 broker guard so
+    // it skips the CREDENTIAL and not the whole row's config) landed in PR #6443
+    // and has already published.
+    //
+    // Read off the published tarballs rather than inferred from the merge
+    // timestamp. #6443 merged at 2026-09-24T01:54:41Z; 0.28.1015 published at
+    // 01:59:23Z. `npm pack` of 0.28.1013/1014/1015/1016 + grep of the extracted
+    // bundle agrees in both directions on four independent markers:
+    //   0.28.1014 — `writeTokenFile` present (4 files), `isRespawnExemptEnvVar`
+    //               and `RESPAWN_EXEMPT_CONFIG_TAILS` absent, and the only
+    //               broker-guard spelling is `credentialDelivery === "broker"`
+    //               (the wide skip).
+    //   0.28.1015 — `writeTokenFile` gone, both new exports present, and
+    //               `credentialDelivery !== "broker"` (the narrowed block form)
+    //               appears for the first time.
+    // The `!==` form is the one that matters: it is the guard that keeps
+    // XERO_TENANT_ID on a broker-marked row, i.e. the thing whose absence is the
+    // ENG-4898 leak.
+    //
+    // The interval's OTHER edge was bisected the same way, so the description
+    // above can name a version instead of an issue: `credentialDelivery` appears
+    // in no file of 0.28.507 and in five files of 0.28.508, so ENG-8344's marker
+    // handling first shipped in 0.28.508. A host below that is genuinely safe
+    // rather than merely old — it has no code to honour the marker with.
+    //
+    // Same caveat as every other `since` in this registry: it is ADVISORY. It is
+    // read only by `computeFlagReach` behind GET /flags/admin/reach, so it
+    // changes what an operator is TOLD and does not stop a flip on an
+    // under-`since` host. What holds the line is `defaultValue: false`, plus
+    // `sensitive: true`, plus the two gates spelled out in the description.
+    since: "0.28.1015"
+  },
   {
     key: "help-kb-auto-grant",
     description: "Auto-grant the `augmented-help-kb` integration at ORG scope when an organization is provisioned (ENG-8542), so every agent in that org gets product-doc search without a per-agent operator action. One organization_integrations row reaches every agent in the org: POST /host/agent-integrations merges org -> team -> agent and buildMcpJson's predicate reads that merged set with no scope filter. ON: the two org-provisioning call sites write the row (status=active, created_by=the org owner). OFF (default): they write nothing - byte-for-byte today's behaviour. STAGED ROLLOUT IS THE POINT. ENG-8332 argues against widening distribution of the help KB until two things close, because distributing a corpus with wrong articles \"converts one agent's wrong answer into everyone's\": (1) a live 200 from GET /host/kb/search as the anon role has still never been observed - ENG-7260 was closed on remediation evidence, not on a live call, and the deploy seed log is SERVICE-ROLE evidence that says nothing about the anon grant; (2) the `site-structure` article is unverified against the current IA. Turning this on for ONE org and watching that org's help-kb connectivity-probe verdicts (ENG-8332 added a real mcp_stdio probe that calls search_knowledge_base) is the cheap positive control for (1) - an ENG-7260-class 500 then reports as `down` per agent instead of as silence. Widen only after it comes back healthy. REVOKING IS DELETING THE ROW, not flipping this off: the flag gates GRANTING, so an already-granted org keeps its row when the flag goes off. Evaluated API-side only, per org, inside grantHelpKbToOrg; no host-side envVar and deliberately no sst.config.ts entry (a literal default there would pin it - ENG-8303).",

package/dist/mcp/slack-channel.js

@@ -37303,7 +37303,10 @@ var FLAG_REGISTRY = [
     // Disabling this RESTORES the shared host-wide key to every container, and
     // with it the cross-agent credential read ENG-8992 closes. A credential-scope
     // reduction should not be one click away without confirmation — same posture
-    // as `github-broker-credentials`, the other credential-delivery flag.
+    // as the credential-delivery flags `github-broker-credentials` and
+    // `xero-broker-credentials`. (This said "the OTHER credential-delivery flag"
+    // while there was one; ENG-10939 added the second, so the singular had to go
+    // rather than silently become a claim that github is the only sibling.)
     sensitive: true,
     // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
     // so a host on an older agt-cli has no consumer code: it keeps forwarding the
@@ -38450,6 +38453,12 @@ var FLAG_REGISTRY = [
     // are the precedent: pinned ABOVE every published release ON PURPOSE,
     // labelled as a placeholder, and gated on a post-publish bisect.
     //
+    // ENG-10939: `xero-broker-credentials` is the worked example of the other
+    // half of that convention - the bisect that DISCHARGES a placeholder. Its
+    // `since` is a real published version read off `npm pack` tarballs, with the
+    // markers it was bisected on written down, so the two entries together show
+    // both states this field is allowed to be in.
+    //
     // (This cited `claudecode-agt-bin-credential-helpers` until obi-wan
     // `8f9d3c43076c` pointed out no such key exists anywhere in the repo - the
     // only occurrence in the tree was this citation. The precedent was real and
@@ -39216,6 +39225,56 @@ var FLAG_REGISTRY = [
     // flips); shipping a guessed number is not.
     since: "0.29.0"
   },
+  {
+    key: "xero-broker-credentials",
+    description: 'Deliver the Xero OAuth access token to the vendor Xero MCP server through the broker credential endpoint at USE time, instead of materializing it onto the agent host at spawn (ENG-10939, step 1 of the Xero lockdown ENG-10927). Mechanically the sibling of `github-broker-credentials`; the REASON and the cost of a bad flip are both different. ON: POST /host/agent-integrations strips `access_token`, `refresh_token` and `token_expires_at` from the xero row and marks it credential_delivery=broker, so XERO_ACCESS_TOKEN stops being written to .env.integrations. Nothing replaces it host-side and nothing needs to: the vendor MCP server has fetched a fresh token per call from POST /host/agent-integrations/:id/credential since ENG-4920, and `brokerMode` is true for every install carrying an id - so XERO_CLIENT_BEARER_TOKEN: ${XERO_ACCESS_TOKEN} is already not emitted and no dangling reference is left behind. `granted_scopes` and `read_only` are deliberately KEPT: they are consent metadata the host reports scope drift from, not credentials. OFF (default): byte-for-byte today\'s behaviour. WHY THIS IS NOT THE GITHUB FLAG. For github, an under-`since` host on a flipped flag LOSES `git`/`gh` - an outage. For xero the equivalent host LEAKS: before ENG-10939 the ENG-8344 broker guard was a loop-level `continue` that also skipped the config-derived env vars, so a broker-marked xero row dropped XERO_TENANT_ID, and per ENG-4898 the vendor MCP server then falls back to `tenants[0]` - a CROSS-TENANT DATA LEAK with no error anywhere. The dangerous fleet is therefore an INTERVAL, not "old hosts", and BOTH edges are bisected from published tarballs rather than named by issue: below agt-cli 0.28.508 a host carries no `credentialDelivery` handling at all, so it ignores the marker and is SAFE; from 0.28.508 up to (not including) 0.28.1015 it honours the marker with the WIDE skip and LEAKS; at 0.28.1015 and above the skip is narrowed and the behaviour is correct. `since` is a lower bound, so it classifies BOTH ends of that interval as `stale` and cannot tell a safe pre-0.28.508 host from a leaking-middle one. THE FLIP GATE IS THEREFORE NOT "the modal shows reach": it is zero xero-bearing hosts below 0.28.1015 per hosts.agt_version, counting NULL and stale as UNCONVERGED (the heartbeat writes that column conditionally on presence, so a host that stopped reporting keeps its last value - the async-export-rollout pattern). AND A SECOND GATE THE MODAL CANNOT SEE AT ALL: the rewritten Xero skills (ENG-10961) must be live in the catalog AND have reached hosts BEFORE this is flipped. Reversed, a host has no token while its own skills still tell it to read one - a silent read outage with no error at the write site. The catalog reaches prod through `pnpm db:catalog:seed` on deploy, not through the code deploy itself, so "merged" is not "live". EXPECTED ON FLIP DAY, so it is not a surprise: the payload shrinks, so computeIntegrationsHash moves once and XERO_ACCESS_TOKEN reads present->absent in the env diff. That does NOT respawn the session. `liveProxyTokenVars` collects AGT_REMOTE_MCP_TOKEN_VAR from .mcp.json (= XERO_ACCESS_TOKEN in broker mode) and the manager filters it out of `respawnVars` BY NAME, kind-blind - so a removal is exempt on exactly the same line a rotation is (ENG-8264). The ENG-5318 child-kill path is likewise unreachable, because broker mode never emits the ${XERO_ACCESS_TOKEN} reference the stale-mcp-reaper keys on. Both restart paths that touch this var are already quiet. Evaluated API-side only, per agent, in POST /host/agent-integrations. The host does not read this flag - it keys off the resulting credential_delivery marker - so there is deliberately NO host-side envVar that could put the token back on its own. Roll back from the flag.',
+    flagType: "boolean",
+    // Declared safe value is `false` = today's env delivery. Fail-safe here is
+    // not symmetrical with github's: OFF leaves a credential on the host (bad,
+    // but the status quo this epic is closing), while a wrongly-ON flip on an
+    // under-`since` host LEAKS ANOTHER TENANT'S DATA. `false` is still the right
+    // default, because the ON path is the one with a reach precondition — but
+    // the reason is "do not arm this until the fleet is measured", not "a flag
+    // blip must not break the agent".
+    defaultValue: false,
+    // Flipping ON changes how every Xero agent on the scope authenticates, and
+    // on an unconverged host it is a cross-tenant leak rather than an outage. A
+    // deliberate, confirmed action (ADR-0022 §4).
+    sensitive: true,
+    // A REAL bisected threshold, not the placeholder `github-broker-credentials`
+    // and `per-agent-host-credentials` had to ship with: the host-side code this
+    // flag depends on (ENG-10939 item 0, narrowing the ENG-8344 broker guard so
+    // it skips the CREDENTIAL and not the whole row's config) landed in PR #6443
+    // and has already published.
+    //
+    // Read off the published tarballs rather than inferred from the merge
+    // timestamp. #6443 merged at 2026-09-24T01:54:41Z; 0.28.1015 published at
+    // 01:59:23Z. `npm pack` of 0.28.1013/1014/1015/1016 + grep of the extracted
+    // bundle agrees in both directions on four independent markers:
+    //   0.28.1014 — `writeTokenFile` present (4 files), `isRespawnExemptEnvVar`
+    //               and `RESPAWN_EXEMPT_CONFIG_TAILS` absent, and the only
+    //               broker-guard spelling is `credentialDelivery === "broker"`
+    //               (the wide skip).
+    //   0.28.1015 — `writeTokenFile` gone, both new exports present, and
+    //               `credentialDelivery !== "broker"` (the narrowed block form)
+    //               appears for the first time.
+    // The `!==` form is the one that matters: it is the guard that keeps
+    // XERO_TENANT_ID on a broker-marked row, i.e. the thing whose absence is the
+    // ENG-4898 leak.
+    //
+    // The interval's OTHER edge was bisected the same way, so the description
+    // above can name a version instead of an issue: `credentialDelivery` appears
+    // in no file of 0.28.507 and in five files of 0.28.508, so ENG-8344's marker
+    // handling first shipped in 0.28.508. A host below that is genuinely safe
+    // rather than merely old — it has no code to honour the marker with.
+    //
+    // Same caveat as every other `since` in this registry: it is ADVISORY. It is
+    // read only by `computeFlagReach` behind GET /flags/admin/reach, so it
+    // changes what an operator is TOLD and does not stop a flip on an
+    // under-`since` host. What holds the line is `defaultValue: false`, plus
+    // `sensitive: true`, plus the two gates spelled out in the description.
+    since: "0.28.1015"
+  },
   {
     key: "help-kb-auto-grant",
     description: "Auto-grant the `augmented-help-kb` integration at ORG scope when an organization is provisioned (ENG-8542), so every agent in that org gets product-doc search without a per-agent operator action. One organization_integrations row reaches every agent in the org: POST /host/agent-integrations merges org -> team -> agent and buildMcpJson's predicate reads that merged set with no scope filter. ON: the two org-provisioning call sites write the row (status=active, created_by=the org owner). OFF (default): they write nothing - byte-for-byte today's behaviour. STAGED ROLLOUT IS THE POINT. ENG-8332 argues against widening distribution of the help KB until two things close, because distributing a corpus with wrong articles \"converts one agent's wrong answer into everyone's\": (1) a live 200 from GET /host/kb/search as the anon role has still never been observed - ENG-7260 was closed on remediation evidence, not on a live call, and the deploy seed log is SERVICE-ROLE evidence that says nothing about the anon grant; (2) the `site-structure` article is unverified against the current IA. Turning this on for ONE org and watching that org's help-kb connectivity-probe verdicts (ENG-8332 added a real mcp_stdio probe that calls search_knowledge_base) is the cheap positive control for (1) - an ENG-7260-class 500 then reports as `down` per agent instead of as silence. Widen only after it comes back healthy. REVOKING IS DELETING THE ROW, not flipping this off: the flag gates GRANTING, so an already-granted org keeps its row when the flag goes off. Evaluated API-side only, per org, inside grantHelpKbToOrg; no host-side envVar and deliberately no sst.config.ts entry (a literal default there would pin it - ENG-8303).",