@integrity-labs/agt-cli 0.28.1110 → 0.28.1112

package/dist/{chunk-RTYZQMSK.js → chunk-TJUDOE53.js}

@@ -16,7 +16,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-4PTXGOVO.js";
+} from "./chunk-5EYINOIW.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -79,7 +79,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-TZM6YVE7.js";
+} from "./chunk-NO57I56V.js";
 import {
   classifyUnanswerablePane,
   isConsumerTermsDialogVisible,
@@ -7518,7 +7518,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1110" : "dev";
+var agtCliVersion = true ? "0.28.1112" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -12492,4 +12492,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-RTYZQMSK.js.map
+//# sourceMappingURL=chunk-TJUDOE53.js.map

package/dist/{claude-pair-runtime-L7KXG3DD.js → claude-pair-runtime-CKWLQMAC.js}

@@ -266,7 +266,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-HSYN3SQ2.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-SDYY75X7.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -734,4 +734,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-L7KXG3DD.js.map
+//# sourceMappingURL=claude-pair-runtime-CKWLQMAC.js.map

package/dist/lib/manager-worker.js

@@ -68,7 +68,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-RTYZQMSK.js";
+} from "../chunk-TJUDOE53.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -155,7 +155,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-4PTXGOVO.js";
+} from "../chunk-5EYINOIW.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -265,7 +265,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-TZM6YVE7.js";
+} from "../chunk-NO57I56V.js";
 import {
   classifyUnanswerablePane,
   paneRemedy
@@ -14143,7 +14143,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-MO4L5O6F.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-NEBHDSMI.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14901,7 +14901,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1110" : "dev";
+var agtCliVersion = true ? "0.28.1112" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16518,7 +16518,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-HSYN3SQ2.js");
+      const { collectDiagnostics } = await import("../persistent-session-SDYY75X7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -16660,7 +16660,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-HSYN3SQ2.js");
+      const { collectDiagnostics } = await import("../persistent-session-SDYY75X7.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -16868,7 +16868,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-MO4L5O6F.js");
+      } = await import("../responsiveness-probe-NEBHDSMI.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16985,7 +16985,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-MO4L5O6F.js");
+        } = await import("../responsiveness-probe-NEBHDSMI.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -17271,7 +17271,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-MO4L5O6F.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-NEBHDSMI.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -17302,7 +17302,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-HSYN3SQ2.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-SDYY75X7.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -17467,7 +17467,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-ZKI4XCSI.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-CNV4O7RF.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -22054,7 +22054,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-MO4L5O6F.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-NEBHDSMI.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -22097,7 +22097,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-HSYN3SQ2.js");
+        const { collectDiagnostics } = await import("../persistent-session-SDYY75X7.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22148,7 +22148,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-HSYN3SQ2.js");
+      const { collectDiagnostics } = await import("../persistent-session-SDYY75X7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22821,7 +22821,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-L7KXG3DD.js");
+  } = await import("../claude-pair-runtime-CKWLQMAC.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -38455,14 +38455,37 @@ var FLAG_REGISTRY = [
   },
   {
     key: "platform-maintenance-mode",
-    description: 'Platform-wide maintenance mode (ENG-6506): when on, every agent across every team/org auto-replies to admitted human inbound with a "we are offline for maintenance" notice instead of dispatching to the agent \u2014 for whole-platform downtime such as DB upgrades. Read host-side per inbound from the flags cache (no MCP restart). Boolean gate; ships dark \u2014 when off, channels behave exactly as today. (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',
-    flagType: "boolean",
-    // Declared safe value is `false` (normal operation). Fail-safe direction: a
-    // flag-DB read error or absent flag map must never silence the fleet on its
-    // own — agents stay responsive unless an operator deliberately flips this on
-    // from the admin Feature Flags page. No envVar: net-new control, no
-    // pre-flags env gate to migrate.
-    defaultValue: false,
+    description: 'Platform-wide maintenance mode (ENG-6506; widened to modes by ENG-11436). off = normal operation (ships dark; channels behave exactly as today). tools-offline = every agent KEEPS conversing but every Augmented tool that WRITES to the control plane refuses with a reason, so nothing is created during a window whose database restore would discard it; reads are untouched. fleet-offline = the previous boolean-true behaviour AND the write gate: admitted human inbound gets a "we are offline for maintenance" notice instead of being dispatched, for whole-platform downtime such as DB upgrades. The modes are CUMULATIVE \u2014 fleet-offline gates writes too, because silencing channel inbound does not stop a /loop or a scheduled task filing work. Read host-side per inbound and per tool call from the flags cache (no MCP restart). (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',
+    flagType: "enum",
+    allowedValues: ["off", "tools-offline", "fleet-offline"],
+    // Declared safe value is `off` (normal operation). Fail-safe direction: a
+    // flag-DB read error or absent flag map must never silence the fleet OR take
+    // its write tools away on its own — agents stay fully functional unless an
+    // operator deliberately sets a mode from the admin Feature Flags page. No
+    // envVar: net-new control, no pre-flags env gate to migrate.
+    //
+    // ENG-11436 widened this from a boolean rather than adding a second flag, so
+    // there is ONE operator control whose modes are mutually exclusive by type
+    // instead of two similar booleans with four combinations.
+    //
+    // The host resolver GRANDFATHERS a boolean-shaped cache value
+    // (true -> fleet-offline, false -> off), and the DIRECTION it protects is
+    // narrower than an earlier version of this comment claimed (Obi Wan
+    // `e3f0d2c154b9` on #6903). It said "an older manager still writing a boolean
+    // must not make a central flip a silent no-op". That situation cannot arise:
+    // once this registry change deploys, normalizeFlagValue only ever yields one
+    // of the three strings, feature-flags-host.ts writes the heartbeat map
+    // verbatim, so no manager writes a boolean again. What grandfathering
+    // actually covers is a NEW MCP reading a STALE PRE-DEPLOY cache that still
+    // holds one.
+    //
+    // The direction that DOES happen is not handled and cannot be: an OLD MCP
+    // reads the new string with resolveHostBooleanFlag, gets undefined, and keeps
+    // dispatching. That is a real regression against ENG-6506 until the fleet
+    // converges, and it is why the runbook makes convergence a deploy-order
+    // PRECONDITION rather than offering a boolean fallback — there is none, since
+    // an enum flag rejects `{value: true}` with a 400.
+    defaultValue: "off",
     // Flipping this takes the ENTIRE fleet offline to end users; a mis-flip is a
     // platform-wide availability incident, so mutations require explicit
     // confirmation (the admin flip-reach modal).
@@ -39786,6 +39809,37 @@ function resolveHostBooleanFlag(opts) {
   if (cached2 !== void 0) return cached2;
   return opts.defaultValue;
 }
+var MAINTENANCE_FLAG_KEY = "platform-maintenance-mode";
+function parseMaintenanceMode(raw) {
+  if (raw === void 0) return void 0;
+  const v = raw.trim().toLowerCase();
+  if (v === "") return void 0;
+  if (v === "off" || v === "tools-offline" || v === "fleet-offline") return v;
+  const b = envBoolean(raw);
+  if (b === true) return "fleet-offline";
+  if (b === false) return "off";
+  return void 0;
+}
+function cachedMaintenanceMode(path) {
+  try {
+    if (!existsSync4(path)) return void 0;
+    const parsed = JSON.parse(readFileSync8(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const flags = parsed.flags;
+    if (!flags || typeof flags !== "object") return void 0;
+    const value = flags[MAINTENANCE_FLAG_KEY];
+    if (typeof value === "string") return parseMaintenanceMode(value);
+    if (typeof value === "boolean") return value ? "fleet-offline" : "off";
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveMaintenanceMode(opts) {
+  const cached2 = cachedMaintenanceMode(opts?.cachePath ?? defaultFlagsCachePath());
+  if (cached2 !== void 0) return cached2;
+  return "off";
+}
 
 // ../core/dist/channels/deflection-causes.js
 var DEFLECTION_CAUSES = [
@@ -41033,17 +41087,157 @@ function createKanbanCardActiveClient(args) {
 }
 
 // src/maintenance-mode.ts
-var FLAG_KEY = "platform-maintenance-mode";
 var MAINTENANCE_OFFLINE_MESSAGE = "The Ninjafy platform is offline for scheduled maintenance right now, so I can't pick this up \u2014 please try again shortly.";
 function isMaintenanceModeActive(opts) {
-  return resolveHostBooleanFlag({
-    key: FLAG_KEY,
-    envVar: "",
-    defaultValue: false,
+  return resolveMaintenanceMode({
     cachePath: opts?.cachePath,
     env: opts?.env
-  });
+  }) === "fleet-offline";
+}
+
+// src/maintenance-tools-offline.ts
+function isToolsOfflineActive(opts) {
+  const mode = resolveMaintenanceMode({ cachePath: opts?.cachePath, env: opts?.env });
+  return mode === "tools-offline" || mode === "fleet-offline";
+}
+var MAINTENANCE_GATED_TOOLS = /* @__PURE__ */ new Set([
+  // Tasks.
+  "kanban_add",
+  "kanban_update",
+  "kanban_move",
+  "kanban_done",
+  "kanban_reopen",
+  "kanban_assign",
+  "kanban_reassign",
+  "kanban_recall",
+  "kanban_respond",
+  "kanban_progress",
+  "kanban_log",
+  "kanban_assign_project",
+  "assign_kanban_to_human",
+  // Canvases. `dashboards_request_refresh` is gated because it enqueues
+  // server-side work, not because it renders anything itself.
+  "dashboards_upsert",
+  "dashboards_persist_widget",
+  "dashboards_request_refresh",
+  // ───────────────────────────────────────────────────────────────────────
+  // FORWARDED writes (ENG-11436 / CodeRabbit on #6903). These reach the agent
+  // through `registerForwardedApiTools()` -> `server.registerTool`, from
+  // `packages/api/src/routes/mcp-tools.ts`, with names resolved at RUNTIME. They
+  // are gated only because index.ts now wraps that method too; before that, this
+  // whole block would have been a list the gate could not see.
+  //
+  // CodeRabbit named five (workflow_update, workflow_run_{start,phase,end},
+  // memory_delete). Enumerating the surface to check them found 37 of the 50
+  // forwarded tools unclassified, so the five were a subset — these are all of
+  // the writes among them. The test now classifies that surface exhaustively, so
+  // the next addition fails CI rather than slipping through.
+  "composio_upload_file",
+  "memory_delete",
+  "memory_save",
+  "onboarding_advance",
+  "onboarding_provision_skills",
+  "onboarding_provision_tasks",
+  "onboarding_record_manager_contact",
+  "request_batch_approval",
+  "request_integration_access",
+  "skill_contribute_fragment",
+  "skill_create",
+  "skill_delete",
+  "skill_improve",
+  "skill_propose_revision",
+  "skill_publish_to_marketplace",
+  "skill_update",
+  "submit_performance_review",
+  "workflow_run_end",
+  "workflow_run_phase",
+  "workflow_run_start",
+  "workflow_update",
+  // CHANNEL-SERVER write (Obi Wan `b3537c1e8495` on #6903). Dispatched by NAME in
+  // slack-channel.ts / telegram-channel.ts / direct-chat-channel.ts, which are
+  // separate processes that never call server.tool — so this one is enforced by
+  // `refuseIfToolsOffline` at each dispatch point, not by the registration
+  // wrapper. It inserts a `pending_interaction` row, the same durable
+  // human-actionable record that gates request_buttons / request_form.
+  "channel_request_input",
+  // `slack.ask_user` is the SAME write under a dotted name, and it was missed
+  // because the test's enumerator could not see dotted names at all (Obi Wan
+  // `122ac55ff278` / `d7245eddd77f` on #6903). handleAskUser calls
+  // runtime.createPendingInteraction -> POST /host/pending-interactions ->
+  // inserts `pending_interaction`. Ungated, an agent on a /loop files the row,
+  // the restore discards it, and the agent blocks forever on a resolution that
+  // no longer exists — the exact failure the entry above is gated for.
+  //
+  // Verified it is the ONLY dotted channel tool that writes: createPendingInteraction
+  // is CALLED once in the three channel servers (slack-channel.ts:8053);
+  // slack-block-kit-runtime.ts only re-exports it.
+  "slack.ask_user",
+  // Workflows. FORWARDED, not local — it reaches the agent through
+  // `server.registerTool` in registerForwardedApiTools, so it is gated only
+  // because that method is now wrapped too (CodeRabbit on #6903).
+  "workflow_create",
+  // Knowledge.
+  "knowledge_add",
+  "knowledge_update",
+  "knowledge_delete",
+  // Projects and project tagging.
+  "projects_create",
+  "projects_update",
+  "artefacts_assign_project",
+  // Routines.
+  "routine_propose",
+  "routine_revise",
+  "routine_retire",
+  "submit_routine_output",
+  // Standing rules.
+  "rule_add",
+  "rule_remove",
+  // Scheduled work.
+  "schedule_create",
+  "schedule_update",
+  "schedule_delete",
+  // Requests that file a durable record a human is expected to act on. Filing
+  // one mid-window is worse than refusing it: the record is discarded by the
+  // restore, so the agent would have promised a human a follow-up that no
+  // longer exists anywhere.
+  "request_approval",
+  "request_buttons",
+  "request_channel_access",
+  "request_form",
+  "request_reconnect",
+  "request_feature",
+  "request_feature_withdraw",
+  // ADR-0025 approval tools, registered by `approval-tools.ts` against the same
+  // server object, so the wrapper in index.ts covers them too.
+  "cancel_approval",
+  // Status / identity.
+  "status_standup",
+  "status_update",
+  "update_identity",
+  "update_timezone",
+  // Fleet changes.
+  "recruit_agent",
+  "integration_improve"
+]);
+function toolsOfflineRefusalText(toolName) {
+  return `Ninjafy is in a control-plane maintenance window, so \`${toolName}\` is unavailable right now. Nothing was created, changed or saved. Do NOT retry this call, and do not try a different Ninjafy tool to work around it \u2014 every tool that writes to the control plane is refusing for the same reason, and the window is short. Tell the person plainly that you cannot save this at the moment and ask them to bring it back afterwards; carry on with anything that does not need saving.`;
+}
+function refuseIfToolsOffline(name, opts) {
+  if (!MAINTENANCE_GATED_TOOLS.has(name)) return null;
+  const isActive = opts?.isActive ?? (() => isToolsOfflineActive());
+  if (!isActive()) return null;
+  return { content: [{ type: "text", text: toolsOfflineRefusalText(name) }] };
+}
+function shouldSendToolsOfflineNotice(opts) {
+  const active = opts.isActive ?? (() => isToolsOfflineActive());
+  if (!active()) return false;
+  const now = opts.now ?? Date.now();
+  const last = opts.cache.get(opts.key);
+  if (last !== void 0 && now - last < opts.cooldownMs) return false;
+  opts.cache.set(opts.key, now);
+  return true;
 }
+var TOOLS_OFFLINE_USER_NOTICE = "Heads up \u2014 Ninjafy is in a maintenance window right now, so I can't save anything: no tasks, canvases, notes or scheduled items. I can still talk things through, and you can ask me to set it up once maintenance is done.";
 
 // src/account-enforcement-notice.ts
 import { readFileSync as readFileSync11 } from "fs";
@@ -41460,6 +41654,49 @@ async function apiPost(path, body) {
   }
   return res;
 }
+var DIRECT_CHAT_TOOLS_OFFLINE_CACHE = /* @__PURE__ */ new Map();
+var DIRECT_CHAT_TOOLS_OFFLINE_COOLDOWN_MS = (() => {
+  const raw = process.env["DIRECT_CHAT_TOOLS_OFFLINE_COOLDOWN_SEC"];
+  const n = raw ? Number(raw) : NaN;
+  return Number.isFinite(n) && n >= 0 ? n * 1e3 : 60 * 60 * 1e3;
+})();
+async function maybeSendDirectChatToolsOfflineNotice(sessionId) {
+  const key = `${sessionId}|tools_offline`;
+  try {
+    if (!shouldSendToolsOfflineNotice({
+      cache: DIRECT_CHAT_TOOLS_OFFLINE_CACHE,
+      key,
+      cooldownMs: DIRECT_CHAT_TOOLS_OFFLINE_COOLDOWN_MS
+    })) {
+      return;
+    }
+    const res = await apiPost("/host/direct-chat/reply", {
+      agent_id: AGT_AGENT_ID,
+      session_id: sessionId,
+      content: TOOLS_OFFLINE_USER_NOTICE,
+      // An extra message alongside the agent's real reply, which has already
+      // advanced the cursor.
+      // cursor-advance-allow: deliberately EMPTY — nothing to advance, no count to read.
+      message_ids: [],
+      // kind:'notice' — the system speaking, not the agent, and owes no reply.
+      kind: "notice"
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok || data.error) {
+      DIRECT_CHAT_TOOLS_OFFLINE_CACHE.delete(key);
+      process.stderr.write(
+        `direct-chat-channel: tools-offline notice failed: ${data.error ?? res.status}
+`
+      );
+    }
+  } catch (err) {
+    DIRECT_CHAT_TOOLS_OFFLINE_CACHE.delete(key);
+    process.stderr.write(
+      `direct-chat-channel: tools-offline notice error: ${err.message}
+`
+    );
+  }
+}
 async function maybeSendDirectChatAccountWarn(sessionId) {
   try {
     if (!shouldSendAccountWarn({
@@ -41657,6 +41894,10 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
   ]
 }));
 mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
+  {
+    const offline = refuseIfToolsOffline(req.params.name);
+    if (offline) return offline;
+  }
   const { name, arguments: args } = req.params;
   const impersonationRefusal = shouldRefuseImpersonatedEgress(
     name,
@@ -41758,6 +41999,8 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
           }
         }
         await maybeSendDirectChatAccountWarn(session_id);
+        void maybeSendDirectChatToolsOfflineNotice(session_id).catch(() => {
+        });
         return { content: [{ type: "text", text: "sent" }] };
       } catch (err) {
         return {
@@ -41799,6 +42042,8 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       clearDirectChatPendingMarkersForSession(DIRECT_CHAT_PENDING_INBOUND_DIR, session_id);
       recordDirectChatDelivery(session_id, message_ids);
       await maybeSendDirectChatAccountWarn(session_id);
+      void maybeSendDirectChatToolsOfflineNotice(session_id).catch(() => {
+      });
       return { content: [{ type: "text", text: "sent" }] };
     } catch (err) {
       return {