@integrity-labs/agt-cli 0.28.1052 → 0.28.1054

package/dist/mcp/direct-chat-channel.js

@@ -37900,6 +37900,16 @@ var FLAG_REGISTRY = [
     // put a first-of-its-kind classifier in front of real customer traffic with nothing
     // observed. Arm per-org, then revisit once there is evidence.
   },
+  {
+    key: "heartbeat-writes-claude-account-email",
+    description: "ENG-10796 (#6382): when ON, the host heartbeat writes the Claude account address it reads from the host (oauthAccount.emailAddress) into hosts.claude_account_email, so the Tokens label self-heals. OFF (default) the heartbeat never writes the column and the label stays whatever an operator set. Ships DARK because the column must first sit behind column-level grants (ENG-11162, #6596): until then any org member, and every co-tenant org on a pool host, can read it raw through Supabase REST, and on an IL-provisioned box the harvested address is a staff login (Obi Wan ecad15b6eff5). Evaluated at PLATFORM scope only: the heartbeat does not know the host org before its UPDATE, so flip the platform value once ENG-11162 is live.",
+    flagType: "boolean",
+    // Safe value is `false` (write nothing). A flag read error degrades here, so a flags outage
+    // can never start harvesting addresses into a customer-readable row.
+    defaultValue: false,
+    // Turning it on starts publishing an identifier into customer-visible rows (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "email-guard-require-approval-enabled",
     description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",

package/dist/mcp/index.js

@@ -30231,6 +30231,16 @@ var FLAG_REGISTRY = [
     // put a first-of-its-kind classifier in front of real customer traffic with nothing
     // observed. Arm per-org, then revisit once there is evidence.
   },
+  {
+    key: "heartbeat-writes-claude-account-email",
+    description: "ENG-10796 (#6382): when ON, the host heartbeat writes the Claude account address it reads from the host (oauthAccount.emailAddress) into hosts.claude_account_email, so the Tokens label self-heals. OFF (default) the heartbeat never writes the column and the label stays whatever an operator set. Ships DARK because the column must first sit behind column-level grants (ENG-11162, #6596): until then any org member, and every co-tenant org on a pool host, can read it raw through Supabase REST, and on an IL-provisioned box the harvested address is a staff login (Obi Wan ecad15b6eff5). Evaluated at PLATFORM scope only: the heartbeat does not know the host org before its UPDATE, so flip the platform value once ENG-11162 is live.",
+    flagType: "boolean",
+    // Safe value is `false` (write nothing). A flag read error degrades here, so a flags outage
+    // can never start harvesting addresses into a customer-readable row.
+    defaultValue: false,
+    // Turning it on starts publishing an identifier into customer-visible rows (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "email-guard-require-approval-enabled",
     description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",
@@ -50585,6 +50595,8 @@ var LOCAL_TOOL_NAMES = /* @__PURE__ */ new Set([
   "projects_list",
   "projects_get",
   "projects_create",
+  // CS-1900: rename / archive / Linear link on an existing project.
+  "projects_update",
   "artefacts_assign_project",
   "kanban_assign_project",
   // ENG-6229: self-restart. Conditionally registered (dark unless
@@ -51122,6 +51134,33 @@ server.tool(
     content: [{ type: "text", text: await createProjectText(params) }]
   })
 );
+async function updateProjectText(params) {
+  const data = await apiPost(
+    `/host/projects/${encodeURIComponent(params.project_id)}/update`,
+    {
+      agent_id: AGT_AGENT_ID,
+      name: params.name,
+      status: params.status,
+      linear_project_id: params.linear_project_id
+    }
+  );
+  const p2 = data.project;
+  return `Updated project "${p2.name}" [${p2.status}] (id: ${p2.id}).`;
+}
+server.tool(
+  "projects_update",
+  'Rename a project, archive or unarchive it, or set/clear its Linear link. Pass only the fields to change. A project is shared by your whole team, so ask the human to confirm before renaming or archiving one, naming the project and the change (e.g. archive "Theoretical Store Profitability"). Archiving hides it from active lists but keeps its tasks and artefacts; set status "active" to undo. Projects have no cover image, so there is nothing to set for one.',
+  {
+    project_id: external_exports.string().uuid().describe("The project id returned by projects_list"),
+    // Trim BEFORE the length check, as the host does (CodeRabbit on #6642).
+    name: external_exports.string().trim().min(1).max(200).optional().describe("New project name"),
+    status: external_exports.enum(["active", "archived"]).optional().describe('"archived" to archive, "active" to unarchive'),
+    linear_project_id: external_exports.string().nullable().optional().describe("Linear project id to deep-link, or null to clear the link")
+  },
+  async (params) => ({
+    content: [{ type: "text", text: await updateProjectText(params) }]
+  })
+);
 async function assignArtefactProjectText(params) {
   const data = await apiPost(
     `/host/artefact/${encodeURIComponent(params.artefact_id)}/assign-project`,

package/dist/mcp/origami.js

@@ -44145,6 +44145,16 @@ var FLAG_REGISTRY = [
     // put a first-of-its-kind classifier in front of real customer traffic with nothing
     // observed. Arm per-org, then revisit once there is evidence.
   },
+  {
+    key: "heartbeat-writes-claude-account-email",
+    description: "ENG-10796 (#6382): when ON, the host heartbeat writes the Claude account address it reads from the host (oauthAccount.emailAddress) into hosts.claude_account_email, so the Tokens label self-heals. OFF (default) the heartbeat never writes the column and the label stays whatever an operator set. Ships DARK because the column must first sit behind column-level grants (ENG-11162, #6596): until then any org member, and every co-tenant org on a pool host, can read it raw through Supabase REST, and on an IL-provisioned box the harvested address is a staff login (Obi Wan ecad15b6eff5). Evaluated at PLATFORM scope only: the heartbeat does not know the host org before its UPDATE, so flip the platform value once ENG-11162 is live.",
+    flagType: "boolean",
+    // Safe value is `false` (write nothing). A flag read error degrades here, so a flags outage
+    // can never start harvesting addresses into a customer-readable row.
+    defaultValue: false,
+    // Turning it on starts publishing an identifier into customer-visible rows (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "email-guard-require-approval-enabled",
     description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",

package/dist/mcp/slack-channel.js

@@ -38784,6 +38784,16 @@ var FLAG_REGISTRY = [
     // put a first-of-its-kind classifier in front of real customer traffic with nothing
     // observed. Arm per-org, then revisit once there is evidence.
   },
+  {
+    key: "heartbeat-writes-claude-account-email",
+    description: "ENG-10796 (#6382): when ON, the host heartbeat writes the Claude account address it reads from the host (oauthAccount.emailAddress) into hosts.claude_account_email, so the Tokens label self-heals. OFF (default) the heartbeat never writes the column and the label stays whatever an operator set. Ships DARK because the column must first sit behind column-level grants (ENG-11162, #6596): until then any org member, and every co-tenant org on a pool host, can read it raw through Supabase REST, and on an IL-provisioned box the harvested address is a staff login (Obi Wan ecad15b6eff5). Evaluated at PLATFORM scope only: the heartbeat does not know the host org before its UPDATE, so flip the platform value once ENG-11162 is live.",
+    flagType: "boolean",
+    // Safe value is `false` (write nothing). A flag read error degrades here, so a flags outage
+    // can never start harvesting addresses into a customer-readable row.
+    defaultValue: false,
+    // Turning it on starts publishing an identifier into customer-visible rows (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "email-guard-require-approval-enabled",
     description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",
@@ -41181,11 +41191,24 @@ function buildIngressThreadKey(channel, threadTs) {
 }
 function createIngressOnlyThreadRegistry(maxEntries = 500) {
   const marked = /* @__PURE__ */ new Set();
+  const cleared = /* @__PURE__ */ new Set();
+  const remember = (set, key2) => {
+    set.delete(key2);
+    set.add(key2);
+    while (set.size > maxEntries) {
+      const oldest = set.values().next();
+      if (oldest.done)
+        break;
+      set.delete(oldest.value);
+    }
+  };
   return {
     mark(channel, threadTs) {
       const key2 = buildIngressThreadKey(channel, threadTs);
       if (!key2)
         return;
+      if (cleared.has(key2))
+        return;
       marked.delete(key2);
       marked.add(key2);
       while (marked.size > maxEntries) {
@@ -41200,6 +41223,7 @@ function createIngressOnlyThreadRegistry(maxEntries = 500) {
       if (!key2)
         return;
       marked.delete(key2);
+      remember(cleared, key2);
     },
     isIngressOnly(channel, threadTs) {
       const key2 = buildIngressThreadKey(channel, threadTs);
@@ -41212,6 +41236,16 @@ function createIngressOnlyThreadRegistry(maxEntries = 500) {
     }
   };
 }
+function shouldSuppressDirectPost(input) {
+  if (input.persistedHumanOwed === true)
+    return false;
+  if (input.persistedIngressOnly === true)
+    return true;
+  return input.ingressOnly.isIngressOnly(input.channel, input.threadTs);
+}
+function threadMarkersAllIngressOnly(markers) {
+  return markers.length > 0 && markers.every((m) => m.ingress_only === true);
+}
 var INGRESS_ONLY_REFUSAL = "This thread was opened by a third-party bot (an alert or issue card), which can wake you but is not someone you can talk to - replying would start a bot-to-bot exchange in a shared channel. Act on the content instead: work the issue, or raise it with a person in a thread they are in. If a human posts here, this thread becomes repliable.";
 
 // ../core/dist/channels/governance/mention-echo-twin-audit.js
@@ -44020,6 +44054,24 @@ function channelMessageShouldWake(text, responseMode, notifyMode, channelId, mut
   }
   return channelMessageShouldRespond(text, responseMode);
 }
+function decideTopLevelChannelWake(input) {
+  const muted = Boolean(input.channelId && input.mutedChannels?.has(input.channelId));
+  if (input.thirdPartyBotGranted) {
+    return muted ? { wake: false, reason: "muted" } : { wake: true, via: "third_party_bot" };
+  }
+  if (channelMessageShouldWake(
+    input.text,
+    input.responseMode,
+    input.notifyMode,
+    input.channelId,
+    input.mutedChannels,
+    input.agent
+  )) {
+    return { wake: true, via: "engagement" };
+  }
+  const muteApplies = input.notifyMode === "filter" || input.notifyMode === "addressed";
+  return { wake: false, reason: muted && muteApplies ? "muted" : "not_engaged" };
+}
 function parseNotifyCommand(text, currentChannelId) {
   const arg = (text ?? "").trim().toLowerCase().split(/\s+/)[0] ?? "";
   if (arg === "off" || arg === "mute") return { action: "mute", channelId: currentChannelId };
@@ -44035,7 +44087,12 @@ function notifyStatusMessage(muted, mode) {
     return muted ? ":mute: This channel is *muted* \u2014 I won\u2019t wake on its messages, including ones that name me (a direct @-mention still reaches me). `/notify on` to resume." : ":bell: This channel is *active* \u2014 I wake on messages that address me by name, not on every message here (an @-mention always reaches me). `/notify off` to mute.";
   }
   const unblock = "This is the `notify-dispatch` flag: an operator turns it on, and a session already running only picks it up after a restart \u2014 so if it has just been enabled, ask for me to be restarted.";
-  return muted ? `:grey_question: Your *mute* for this channel is *saved but not in effect* \u2014 I\u2019m not in a per-channel dispatch mode right now, so it isn\u2019t changing what wakes me. It applies as soon as one is live. ${unblock}` : `:grey_question: *No mute saved* for this channel \u2014 though it wouldn\u2019t apply yet either way: I\u2019m not in a per-channel dispatch mode right now. \`/notify off\` saves one for when it is live. ${unblock}`;
+  return muted ? `:grey_question: Your *mute* for this channel is saved and *only partly in effect*: ${NOTIFY_BOT_MUTE_CLAUSE} Everything else here is unchanged, because I\u2019m not in a per-channel dispatch mode right now; it applies to those as soon as one is live. ${unblock}` : `:grey_question: *No mute saved* for this channel. I\u2019m not in a per-channel dispatch mode right now, so a mute would not change what other messages do here, but \`/notify off\` would still stop any allowlisted third-party bot (an alert or issue integration such as Linear) waking me here straight away. ${unblock}`;
+}
+var NOTIFY_BOT_MUTE_CLAUSE = "it already stops any allowlisted third-party bot (an alert or issue integration such as Linear) from waking me here.";
+function notifyAckNote(mode) {
+  if (mode === "filter" || mode === "addressed") return "";
+  return ` _(note: I\u2019m not in a per-channel dispatch mode right now. A mute here ${NOTIFY_BOT_MUTE_CLAUSE.replace(/^it /, "")} Other messages are unaffected until an operator enables per-channel dispatch.)_`;
 }
 
 // src/slack-list-channels.ts
@@ -45445,7 +45502,8 @@ function writeSlackPendingInboundMarker(channel, threadTs, messageTs, undelivera
     ...discretionary ? { discretionary: true } : {},
     // ENG-5969/ENG-6327: carry the replay payload only when provided (the
     // durable-replay path). Absent ⇒ the marker can't be replayed.
-    ...payload ? { payload } : {}
+    ...payload ? { payload } : {},
+    ...ingressOnlyThreads.isIngressOnly(channel, threadTs) ? { ingress_only: true } : {}
   };
   try {
     mkdirSync9(SLACK_PENDING_INBOUND_DIR, { recursive: true, mode: 448 });
@@ -45589,6 +45647,18 @@ function slackConversationReplayFacts(channel, threadTs) {
 }
 function sendUndeliverableNotice(channel, threadTs, conversationKey) {
   if (!BOT_TOKEN || !channel) return;
+  if (shouldSuppressDirectPost({
+    channel,
+    threadTs,
+    ingressOnly: ingressOnlyThreads,
+    persistedHumanOwed: readSlackThreadMarkerState(channel, threadTs).humanOwed
+  })) {
+    process.stderr.write(
+      `slack-channel(${AGENT_CODE_NAME}): undeliverable notice suppressed reason=ingress_only thread=${redactSlackId(threadTs)}
+`
+    );
+    return;
+  }
   const text = undeliverableNoticeTextForRepeat({
     replay: slackConversationReplayFacts(channel, threadTs) ?? void 0,
     priorNotices: slackUndeliverableNotices.noticeCount(conversationKey)
@@ -45641,6 +45711,18 @@ function deleteSlackUndeliverableNotice(conversationKey) {
 var lastSlackBusyAckNoticeAt = /* @__PURE__ */ new Map();
 function postBusyAckNotice(channel, threadTs, isThreadReply, state) {
   if (!BOT_TOKEN || !channel) return;
+  if (shouldSuppressDirectPost({
+    channel,
+    threadTs,
+    ingressOnly: ingressOnlyThreads,
+    persistedHumanOwed: readSlackThreadMarkerState(channel, threadTs).humanOwed
+  })) {
+    process.stderr.write(
+      `slack-channel(${AGENT_CODE_NAME}): busy-ack suppressed reason=ingress_only thread=${redactSlackId(threadTs)}
+`
+    );
+    return;
+  }
   const now = Date.now();
   const conversationKey = isThreadReply && threadTs ? `${channel}:${threadTs}` : channel;
   if (!shouldPostUndeliverableNotice(
@@ -45834,6 +45916,32 @@ function slackNextRetryName(filename) {
   }
   return { next: `${base}.retry-${attempt}.json`, attempt };
 }
+function readSlackThreadMarkerState(channel, threadTs) {
+  const none = { allIngressOnly: false, humanOwed: false };
+  if (!threadTs || !SLACK_PENDING_INBOUND_DIR) return none;
+  const markers = [];
+  try {
+    markSeenAllSlackPendingMarkersForThread(
+      SLACK_PENDING_INBOUND_DIR,
+      channel,
+      threadTs,
+      (fullPath) => {
+        try {
+          const m = JSON.parse(readFileSync18(fullPath, "utf-8"));
+          markers.push({ ingress_only: m.ingress_only });
+        } catch {
+          markers.push({});
+        }
+      }
+    );
+  } catch {
+    return none;
+  }
+  return {
+    allIngressOnly: threadMarkersAllIngressOnly(markers),
+    humanOwed: markers.some((m) => m.ingress_only !== true)
+  };
+}
 async function processSlackRecoveryOutboxFile(filename) {
   if (!SLACK_RECOVERY_OUTBOX_DIR) return;
   if (filename.endsWith(".poison.json") || filename.endsWith(".tmp")) return;
@@ -45877,6 +45985,26 @@ async function processSlackRecoveryOutboxFile(filename) {
   const urlFixed = stripUrlWrappingAsterisks(mrkdwn.text);
   if (urlFixed.stripped) emitUrlAsteriskStripTelemetry("slack", urlFixed.count);
   const text = urlFixed.text;
+  const recoveryMarkers = readSlackThreadMarkerState(payload.channel, payload.thread_ts);
+  if (shouldSuppressDirectPost({
+    channel: payload.channel,
+    threadTs: payload.thread_ts,
+    ingressOnly: ingressOnlyThreads,
+    persistedIngressOnly: recoveryMarkers.allIngressOnly,
+    persistedHumanOwed: recoveryMarkers.humanOwed
+  })) {
+    process.stderr.write(
+      `slack-channel(${AGENT_CODE_NAME}): ghost-reply recovery suppressed reason=ingress_only channel=${redactSlackId(payload.channel)} thread=${redactSlackId(payload.thread_ts)}
+`
+    );
+    if (payload.thread_ts) clearPendingMessage(payload.channel, payload.thread_ts);
+    removeRecoveryLedgerEntry(SLACK_RECOVERY_LEDGER_DIR, payload.marker_name);
+    try {
+      unlinkSync7(fullPath);
+    } catch {
+    }
+    return;
+  }
   const ghostReplyMode = resolveGhostReplyMode();
   if (ghostReplyMode !== "off") {
     const decision = await decideRecovery(text, ghostReplyMode);
@@ -47119,8 +47247,7 @@ async function handleNotifyCommand(payload, codeName) {
     );
     return;
   }
-  const muteIsLive = NOTIFY_DISPATCH_MODE === "filter" || NOTIFY_DISPATCH_MODE === "addressed";
-  const inactiveNote = muteIsLive ? "" : " _(note: I\u2019m not in a per-channel dispatch mode right now, so this is saved but won\u2019t take effect until an operator enables it.)_";
+  const inactiveNote = notifyAckNote(NOTIFY_DISPATCH_MODE);
   const { action } = parseNotifyCommand(payload.text, channelId);
   if (action === "help") {
     await postEphemeralViaResponseUrl(
@@ -49801,15 +49928,13 @@ function connectSocketModeSafely() {
   void startSocketModeAfterSeedingMutes();
 }
 async function startSocketModeAfterSeedingMutes() {
-  if (NOTIFY_DISPATCH_MODE === "filter" || NOTIFY_DISPATCH_MODE === "addressed") {
-    try {
-      await seedMutedChannelsFromApi();
-    } catch (err) {
-      process.stderr.write(
-        `slack-channel: notify-prefs seed threw, connecting anyway: ${err.message}
+  try {
+    await seedMutedChannelsFromApi();
+  } catch (err) {
+    process.stderr.write(
+      `slack-channel: notify-prefs seed threw, connecting anyway: ${err.message}
 `
-      );
-    }
+    );
   }
   if (isShuttingDown) return;
   void runOrRetry(connectSocketMode, {
@@ -50074,8 +50199,12 @@ async function connectSocketMode() {
       if (passedIdentity) recordActivity("inbound");
       const ingressThreadTs = evt.thread_ts ?? evt.ts;
       if (peerClassification?.kind === "bot-ingress" && access.kind !== "drop") {
-        ingressOnlyThreads.mark(evt.channel, ingressThreadTs);
-      } else if (!isBot) {
+        if (evt.channel && readSlackThreadMarkerState(evt.channel, ingressThreadTs).humanOwed) {
+          ingressOnlyThreads.clear(evt.channel, ingressThreadTs);
+        } else {
+          ingressOnlyThreads.mark(evt.channel, ingressThreadTs);
+        }
+      } else if (access.kind !== "drop" && (!isBot || peerClassification?.kind === "peer-ingress")) {
         ingressOnlyThreads.clear(evt.channel, ingressThreadTs);
       }
       if (access.kind === "drop") {
@@ -50277,17 +50406,25 @@ async function connectSocketMode() {
             return;
           }
         } else {
-          if (!channelMessageShouldWake(
-            evt.text ?? "",
-            CHANNEL_RESPONSE_MODE,
-            NOTIFY_DISPATCH_MODE,
-            evt.channel,
-            MUTED_CHANNELS,
+          const wake = decideTopLevelChannelWake({
+            text: evt.text ?? "",
+            responseMode: CHANNEL_RESPONSE_MODE,
+            notifyMode: NOTIFY_DISPATCH_MODE,
+            channelId: evt.channel,
+            mutedChannels: MUTED_CHANNELS,
             // ENG-8657: who this agent is, so `addressed` can tell a message
             // naming IT from one naming a different agent in the same channel.
-            { botUserId, codeName: AGENT_CODE_NAME }
-          ))
+            agent: { botUserId, codeName: AGENT_CODE_NAME },
+            thirdPartyBotGranted: peerClassification?.kind === "bot-ingress"
+          });
+          if (!wake.wake) {
+            const channelHash = createHash3("sha256").update(evt.channel ?? "").digest("hex").slice(0, 8);
+            process.stderr.write(
+              `slack-channel: inbound drop reason=engagement:${wake.reason} notify=${NOTIFY_DISPATCH_MODE} response=${CHANNEL_RESPONSE_MODE} bot=${isBot} channel=${channelHash} ts=${redactSlackId(evt.ts)}
+`
+            );
             return;
+          }
         }
       }
       const composed = composeInboundText(evt);

package/dist/mcp/telegram-channel.js

@@ -38890,6 +38890,16 @@ var FLAG_REGISTRY = [
     // put a first-of-its-kind classifier in front of real customer traffic with nothing
     // observed. Arm per-org, then revisit once there is evidence.
   },
+  {
+    key: "heartbeat-writes-claude-account-email",
+    description: "ENG-10796 (#6382): when ON, the host heartbeat writes the Claude account address it reads from the host (oauthAccount.emailAddress) into hosts.claude_account_email, so the Tokens label self-heals. OFF (default) the heartbeat never writes the column and the label stays whatever an operator set. Ships DARK because the column must first sit behind column-level grants (ENG-11162, #6596): until then any org member, and every co-tenant org on a pool host, can read it raw through Supabase REST, and on an IL-provisioned box the harvested address is a staff login (Obi Wan ecad15b6eff5). Evaluated at PLATFORM scope only: the heartbeat does not know the host org before its UPDATE, so flip the platform value once ENG-11162 is live.",
+    flagType: "boolean",
+    // Safe value is `false` (write nothing). A flag read error degrades here, so a flags outage
+    // can never start harvesting addresses into a customer-readable row.
+    defaultValue: false,
+    // Turning it on starts publishing an identifier into customer-visible rows (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "email-guard-require-approval-enabled",
     description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",

package/dist/{persistent-session-5RX4P7GP.js → persistent-session-3WRSJIDM.js}

@@ -65,8 +65,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-4ZH75WMF.js";
-import "./chunk-MQ4COFCI.js";
+} from "./chunk-AT7E625H.js";
+import "./chunk-2SGXGNDW.js";
 import "./chunk-OCMJ5E6J.js";
 import "./chunk-XWVM4KPK.js";
 import "./chunk-EL5MWGGH.js";
@@ -139,4 +139,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-5RX4P7GP.js.map
+//# sourceMappingURL=persistent-session-3WRSJIDM.js.map

package/dist/{responsiveness-probe-C75AUK6I.js → responsiveness-probe-2DF6VH7Q.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-4ZH75WMF.js";
-import "./chunk-MQ4COFCI.js";
+} from "./chunk-AT7E625H.js";
+import "./chunk-2SGXGNDW.js";
 import "./chunk-OCMJ5E6J.js";
 import "./chunk-XWVM4KPK.js";
 import "./chunk-EL5MWGGH.js";
@@ -802,4 +802,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-C75AUK6I.js.map
+//# sourceMappingURL=responsiveness-probe-2DF6VH7Q.js.map

package/dist/{session-auth-dead-VFRUHVTF.js → session-auth-dead-GRTHA2Z5.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-MQ4COFCI.js";
+} from "./chunk-2SGXGNDW.js";
 import "./chunk-DGUM43GV.js";
 
 // src/lib/session-auth-dead.ts
@@ -204,4 +204,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-VFRUHVTF.js.map
+//# sourceMappingURL=session-auth-dead-GRTHA2Z5.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.1052",
+  "version": "0.28.1054",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {