@integrity-labs/agt-cli 0.28.1111 → 0.28.1113

package/dist/mcp/origami.js

@@ -39711,6 +39711,51 @@ var OAUTH_PROVIDERS = {
       }
     ]
   },
+  "otter": {
+    // CS-2029: Otter.ai's official MCP — remote streamable-HTTP at
+    // https://mcp.otter.ai/mcp. Same Granola/Kajabi shape: OAuth 2.0
+    // authorization-code with PKCE (S256) and a public client
+    // (token_endpoint_auth_method 'none') issued via Dynamic Client
+    // Registration (RFC 7591). Values below are taken verbatim from the
+    // metadata, not inferred:
+    //   - https://mcp.otter.ai/.well-known/oauth-protected-resource names the
+    //     AS as https://otter.ai/ and advertises scopes profile:read,
+    //     conversations:read;
+    //   - https://otter.ai/.well-known/oauth-authorization-server gives
+    //     authorize /oauth2/authorize, token /oauth/token, revoke
+    //     /oauth/revoke_token, register /oauth/register, PKCE S256, `none`,
+    //     and the refresh_token grant.
+    // NOTE the authorize path is /oauth2/authorize while token/revoke live
+    // under /oauth/ — that is Otter's own split, do not "normalise" it.
+    // The prod client was registered 2026-10-10 against /oauth/register with
+    // scope 'profile:read conversations:read' and BOTH API callbacks,
+    // https://api.augmented.team/... and https://api.ninjafy.com/integrations/oauth/callback,
+    // because redirect_uri follows API_PUBLIC_URL and the ENG-11060 flip makes
+    // the ninjafy name canonical; Otter returns no RFC 7592 handle, so a redirect
+    // cannot be added later without a new client and a re-consent per connection.
+    // OAUTH_OTTER_CLIENT_ID is set from its output (docs/runbooks/otter-dogfood.md). Otter advertises ONLY
+    // read scopes, so this integration is read-only by construction: there is
+    // no write scope to request even by mistake.
+    definitionId: "otter",
+    authorizeUrl: "https://otter.ai/oauth2/authorize",
+    tokenUrl: "https://otter.ai/oauth/token",
+    revokeUrl: "https://otter.ai/oauth/revoke_token",
+    defaultScopes: ["profile:read", "conversations:read"],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "body",
+    pkce: "S256",
+    publicClient: true,
+    mcpUrl: "https://mcp.otter.ai/mcp",
+    // Curated surface (matches the catalog seed's defined_scopes[].tools).
+    // These are the server's three tools, all read-only. The names are
+    // Otter's own, quoted from the tools' descriptions ("use `otter_search`
+    // first", "call otter_get_user_info() first"), not Composio's wrapped
+    // OTTER_AI_MCP_* slugs. An allowlisted name the server does not advertise
+    // is logged and SKIPPED by the proxy, so confirm against the first live
+    // tools/list after a real consent (runbook Step 3).
+    toolAllowlist: ["otter_get_user_info", "otter_search", "otter_fetch"]
+  },
   "notion-cli": {
     // Notion's public OAuth app. Tokens are workspace-scoped and long-lived —
     // Notion does not issue refresh_tokens, so `supportsRefresh: false` and
@@ -40344,6 +40389,34 @@ var INTEGRATION_REGISTRY = [
     docs_url: "https://help.kajabi.com/articles/api-integrations/connect-kajabi-to-claude-or-chatgpt",
     beta: true
   },
+  {
+    id: "otter",
+    name: "Otter.ai",
+    category: "knowledge",
+    description: "Read Otter.ai meetings: search recordings by date, attendee or topic, and read summaries, action items and full speaker-attributed transcripts.",
+    // CS-2029: same remote streamable-HTTP MCP + OAuth pattern as Granola/Kajabi.
+    // Otter's server implements the MCP discovery chain (RFC 9728 protected-
+    // resource metadata at mcp.otter.ai → RFC 8414 AS metadata at otter.ai →
+    // RFC 7591 registration); auth is OAuth 2.0 authorization-code with PKCE
+    // (S256) and a public client registered via one-time Dynamic Client
+    // Registration (scripts/dcr-register.ts against https://otter.ai/oauth/register
+    // → OAUTH_OTTER_CLIENT_ID, --scope 'profile:read conversations:read').
+    // Consent is brokered by the webapp through the shared
+    // /integrations/oauth/authorize → /callback path, and the access_token
+    // reaches the host via the generic remote-oauth-proxy
+    // (OAUTH_PROVIDERS.otter.mcpUrl). Read-only by construction: Otter
+    // advertises no write scope.
+    supported_auth_types: ["oauth2"],
+    capabilities: [
+      { id: "otter:read", name: "Read Meetings & Transcripts", description: "Find recorded meetings by date, attendee, topic or title, and read their summaries, action items, outlines and full transcripts (otter_get_user_info, otter_search, otter_fetch)", access: "read" }
+    ],
+    // Otter's own Help Center article for the MCP server (CodeRabbit, #6906). It
+    // exists even though help.otter.ai answers 403 to non-browser clients; the
+    // help-centre API confirmed it (title "Otter MCP Server"). The MCP endpoint
+    // itself is a JSON-RPC URL, not a page (Obi Wan 8305072d5414).
+    docs_url: "https://help.otter.ai/hc/en-us/articles/35287607569687-Otter-MCP-Server",
+    beta: true
+  },
   {
     id: "anchor-browser",
     name: "Anchor Browser",
@@ -44619,14 +44692,37 @@ var FLAG_REGISTRY = [
   },
   {
     key: "platform-maintenance-mode",
-    description: 'Platform-wide maintenance mode (ENG-6506): when on, every agent across every team/org auto-replies to admitted human inbound with a "we are offline for maintenance" notice instead of dispatching to the agent \u2014 for whole-platform downtime such as DB upgrades. Read host-side per inbound from the flags cache (no MCP restart). Boolean gate; ships dark \u2014 when off, channels behave exactly as today. (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',
-    flagType: "boolean",
-    // Declared safe value is `false` (normal operation). Fail-safe direction: a
-    // flag-DB read error or absent flag map must never silence the fleet on its
-    // own — agents stay responsive unless an operator deliberately flips this on
-    // from the admin Feature Flags page. No envVar: net-new control, no
-    // pre-flags env gate to migrate.
-    defaultValue: false,
+    description: 'Platform-wide maintenance mode (ENG-6506; widened to modes by ENG-11436). off = normal operation (ships dark; channels behave exactly as today). tools-offline = every agent KEEPS conversing but every Augmented tool that WRITES to the control plane refuses with a reason, so nothing is created during a window whose database restore would discard it; reads are untouched. fleet-offline = the previous boolean-true behaviour AND the write gate: admitted human inbound gets a "we are offline for maintenance" notice instead of being dispatched, for whole-platform downtime such as DB upgrades. The modes are CUMULATIVE \u2014 fleet-offline gates writes too, because silencing channel inbound does not stop a /loop or a scheduled task filing work. Read host-side per inbound and per tool call from the flags cache (no MCP restart). (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',
+    flagType: "enum",
+    allowedValues: ["off", "tools-offline", "fleet-offline"],
+    // Declared safe value is `off` (normal operation). Fail-safe direction: a
+    // flag-DB read error or absent flag map must never silence the fleet OR take
+    // its write tools away on its own — agents stay fully functional unless an
+    // operator deliberately sets a mode from the admin Feature Flags page. No
+    // envVar: net-new control, no pre-flags env gate to migrate.
+    //
+    // ENG-11436 widened this from a boolean rather than adding a second flag, so
+    // there is ONE operator control whose modes are mutually exclusive by type
+    // instead of two similar booleans with four combinations.
+    //
+    // The host resolver GRANDFATHERS a boolean-shaped cache value
+    // (true -> fleet-offline, false -> off), and the DIRECTION it protects is
+    // narrower than an earlier version of this comment claimed (Obi Wan
+    // `e3f0d2c154b9` on #6903). It said "an older manager still writing a boolean
+    // must not make a central flip a silent no-op". That situation cannot arise:
+    // once this registry change deploys, normalizeFlagValue only ever yields one
+    // of the three strings, feature-flags-host.ts writes the heartbeat map
+    // verbatim, so no manager writes a boolean again. What grandfathering
+    // actually covers is a NEW MCP reading a STALE PRE-DEPLOY cache that still
+    // holds one.
+    //
+    // The direction that DOES happen is not handled and cannot be: an OLD MCP
+    // reads the new string with resolveHostBooleanFlag, gets undefined, and keeps
+    // dispatching. That is a real regression against ENG-6506 until the fleet
+    // converges, and it is why the runbook makes convergence a deploy-order
+    // PRECONDITION rather than offering a boolean fallback — there is none, since
+    // an enum flag rejects `{value: true}` with a 400.
+    defaultValue: "off",
     // Flipping this takes the ENTIRE fleet offline to end users; a mis-flip is a
     // platform-wide availability incident, so mutations require explicit
     // confirmation (the admin flip-reach modal).

package/dist/mcp/slack-channel.js

@@ -30741,6 +30741,37 @@ function resolveGhostReplyMode(opts) {
   if (cached2 !== void 0) return cached2;
   return "off";
 }
+var MAINTENANCE_FLAG_KEY = "platform-maintenance-mode";
+function parseMaintenanceMode(raw) {
+  if (raw === void 0) return void 0;
+  const v = raw.trim().toLowerCase();
+  if (v === "") return void 0;
+  if (v === "off" || v === "tools-offline" || v === "fleet-offline") return v;
+  const b = envBoolean(raw);
+  if (b === true) return "fleet-offline";
+  if (b === false) return "off";
+  return void 0;
+}
+function cachedMaintenanceMode(path) {
+  try {
+    if (!existsSync(path)) return void 0;
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const flags = parsed.flags;
+    if (!flags || typeof flags !== "object") return void 0;
+    const value = flags[MAINTENANCE_FLAG_KEY];
+    if (typeof value === "string") return parseMaintenanceMode(value);
+    if (typeof value === "boolean") return value ? "fleet-offline" : "off";
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveMaintenanceMode(opts) {
+  const cached2 = cachedMaintenanceMode(opts?.cachePath ?? defaultFlagsCachePath());
+  if (cached2 !== void 0) return cached2;
+  return "off";
+}
 var SLACK_HOT_THREAD_FLAG_KEY = "slack-hot-thread-guard";
 function parseSlackHotThreadMode(raw) {
   if (raw === void 0) return void 0;
@@ -30813,17 +30844,157 @@ function resolveSlackScheduledChannelGuardMode(opts) {
 }
 
 // src/maintenance-mode.ts
-var FLAG_KEY = "platform-maintenance-mode";
 var MAINTENANCE_OFFLINE_MESSAGE = "The Ninjafy platform is offline for scheduled maintenance right now, so I can't pick this up \u2014 please try again shortly.";
 function isMaintenanceModeActive(opts) {
-  return resolveHostBooleanFlag({
-    key: FLAG_KEY,
-    envVar: "",
-    defaultValue: false,
+  return resolveMaintenanceMode({
     cachePath: opts?.cachePath,
     env: opts?.env
-  });
+  }) === "fleet-offline";
+}
+
+// src/maintenance-tools-offline.ts
+function isToolsOfflineActive(opts) {
+  const mode = resolveMaintenanceMode({ cachePath: opts?.cachePath, env: opts?.env });
+  return mode === "tools-offline" || mode === "fleet-offline";
+}
+var MAINTENANCE_GATED_TOOLS = /* @__PURE__ */ new Set([
+  // Tasks.
+  "kanban_add",
+  "kanban_update",
+  "kanban_move",
+  "kanban_done",
+  "kanban_reopen",
+  "kanban_assign",
+  "kanban_reassign",
+  "kanban_recall",
+  "kanban_respond",
+  "kanban_progress",
+  "kanban_log",
+  "kanban_assign_project",
+  "assign_kanban_to_human",
+  // Canvases. `dashboards_request_refresh` is gated because it enqueues
+  // server-side work, not because it renders anything itself.
+  "dashboards_upsert",
+  "dashboards_persist_widget",
+  "dashboards_request_refresh",
+  // ───────────────────────────────────────────────────────────────────────
+  // FORWARDED writes (ENG-11436 / CodeRabbit on #6903). These reach the agent
+  // through `registerForwardedApiTools()` -> `server.registerTool`, from
+  // `packages/api/src/routes/mcp-tools.ts`, with names resolved at RUNTIME. They
+  // are gated only because index.ts now wraps that method too; before that, this
+  // whole block would have been a list the gate could not see.
+  //
+  // CodeRabbit named five (workflow_update, workflow_run_{start,phase,end},
+  // memory_delete). Enumerating the surface to check them found 37 of the 50
+  // forwarded tools unclassified, so the five were a subset — these are all of
+  // the writes among them. The test now classifies that surface exhaustively, so
+  // the next addition fails CI rather than slipping through.
+  "composio_upload_file",
+  "memory_delete",
+  "memory_save",
+  "onboarding_advance",
+  "onboarding_provision_skills",
+  "onboarding_provision_tasks",
+  "onboarding_record_manager_contact",
+  "request_batch_approval",
+  "request_integration_access",
+  "skill_contribute_fragment",
+  "skill_create",
+  "skill_delete",
+  "skill_improve",
+  "skill_propose_revision",
+  "skill_publish_to_marketplace",
+  "skill_update",
+  "submit_performance_review",
+  "workflow_run_end",
+  "workflow_run_phase",
+  "workflow_run_start",
+  "workflow_update",
+  // CHANNEL-SERVER write (Obi Wan `b3537c1e8495` on #6903). Dispatched by NAME in
+  // slack-channel.ts / telegram-channel.ts / direct-chat-channel.ts, which are
+  // separate processes that never call server.tool — so this one is enforced by
+  // `refuseIfToolsOffline` at each dispatch point, not by the registration
+  // wrapper. It inserts a `pending_interaction` row, the same durable
+  // human-actionable record that gates request_buttons / request_form.
+  "channel_request_input",
+  // `slack.ask_user` is the SAME write under a dotted name, and it was missed
+  // because the test's enumerator could not see dotted names at all (Obi Wan
+  // `122ac55ff278` / `d7245eddd77f` on #6903). handleAskUser calls
+  // runtime.createPendingInteraction -> POST /host/pending-interactions ->
+  // inserts `pending_interaction`. Ungated, an agent on a /loop files the row,
+  // the restore discards it, and the agent blocks forever on a resolution that
+  // no longer exists — the exact failure the entry above is gated for.
+  //
+  // Verified it is the ONLY dotted channel tool that writes: createPendingInteraction
+  // is CALLED once in the three channel servers (slack-channel.ts:8053);
+  // slack-block-kit-runtime.ts only re-exports it.
+  "slack.ask_user",
+  // Workflows. FORWARDED, not local — it reaches the agent through
+  // `server.registerTool` in registerForwardedApiTools, so it is gated only
+  // because that method is now wrapped too (CodeRabbit on #6903).
+  "workflow_create",
+  // Knowledge.
+  "knowledge_add",
+  "knowledge_update",
+  "knowledge_delete",
+  // Projects and project tagging.
+  "projects_create",
+  "projects_update",
+  "artefacts_assign_project",
+  // Routines.
+  "routine_propose",
+  "routine_revise",
+  "routine_retire",
+  "submit_routine_output",
+  // Standing rules.
+  "rule_add",
+  "rule_remove",
+  // Scheduled work.
+  "schedule_create",
+  "schedule_update",
+  "schedule_delete",
+  // Requests that file a durable record a human is expected to act on. Filing
+  // one mid-window is worse than refusing it: the record is discarded by the
+  // restore, so the agent would have promised a human a follow-up that no
+  // longer exists anywhere.
+  "request_approval",
+  "request_buttons",
+  "request_channel_access",
+  "request_form",
+  "request_reconnect",
+  "request_feature",
+  "request_feature_withdraw",
+  // ADR-0025 approval tools, registered by `approval-tools.ts` against the same
+  // server object, so the wrapper in index.ts covers them too.
+  "cancel_approval",
+  // Status / identity.
+  "status_standup",
+  "status_update",
+  "update_identity",
+  "update_timezone",
+  // Fleet changes.
+  "recruit_agent",
+  "integration_improve"
+]);
+function toolsOfflineRefusalText(toolName) {
+  return `Ninjafy is in a control-plane maintenance window, so \`${toolName}\` is unavailable right now. Nothing was created, changed or saved. Do NOT retry this call, and do not try a different Ninjafy tool to work around it \u2014 every tool that writes to the control plane is refusing for the same reason, and the window is short. Tell the person plainly that you cannot save this at the moment and ask them to bring it back afterwards; carry on with anything that does not need saving.`;
+}
+function refuseIfToolsOffline(name, opts) {
+  if (!MAINTENANCE_GATED_TOOLS.has(name)) return null;
+  const isActive = opts?.isActive ?? (() => isToolsOfflineActive());
+  if (!isActive()) return null;
+  return { content: [{ type: "text", text: toolsOfflineRefusalText(name) }] };
+}
+function shouldSendToolsOfflineNotice(opts) {
+  const active = opts.isActive ?? (() => isToolsOfflineActive());
+  if (!active()) return false;
+  const now = opts.now ?? Date.now();
+  const last = opts.cache.get(opts.key);
+  if (last !== void 0 && now - last < opts.cooldownMs) return false;
+  opts.cache.set(opts.key, now);
+  return true;
 }
+var TOOLS_OFFLINE_USER_NOTICE = "Heads up \u2014 Ninjafy is in a maintenance window right now, so I can't save anything: no tasks, canvases, notes or scheduled items. I can still talk things through, and you can ask me to set it up once maintenance is done.";
 
 // ../core/dist/types/agent.js
 var FRAMEWORK_MODEL_SLOTS = {
@@ -33897,6 +34068,51 @@ var OAUTH_PROVIDERS = {
       }
     ]
   },
+  "otter": {
+    // CS-2029: Otter.ai's official MCP — remote streamable-HTTP at
+    // https://mcp.otter.ai/mcp. Same Granola/Kajabi shape: OAuth 2.0
+    // authorization-code with PKCE (S256) and a public client
+    // (token_endpoint_auth_method 'none') issued via Dynamic Client
+    // Registration (RFC 7591). Values below are taken verbatim from the
+    // metadata, not inferred:
+    //   - https://mcp.otter.ai/.well-known/oauth-protected-resource names the
+    //     AS as https://otter.ai/ and advertises scopes profile:read,
+    //     conversations:read;
+    //   - https://otter.ai/.well-known/oauth-authorization-server gives
+    //     authorize /oauth2/authorize, token /oauth/token, revoke
+    //     /oauth/revoke_token, register /oauth/register, PKCE S256, `none`,
+    //     and the refresh_token grant.
+    // NOTE the authorize path is /oauth2/authorize while token/revoke live
+    // under /oauth/ — that is Otter's own split, do not "normalise" it.
+    // The prod client was registered 2026-10-10 against /oauth/register with
+    // scope 'profile:read conversations:read' and BOTH API callbacks,
+    // https://api.augmented.team/... and https://api.ninjafy.com/integrations/oauth/callback,
+    // because redirect_uri follows API_PUBLIC_URL and the ENG-11060 flip makes
+    // the ninjafy name canonical; Otter returns no RFC 7592 handle, so a redirect
+    // cannot be added later without a new client and a re-consent per connection.
+    // OAUTH_OTTER_CLIENT_ID is set from its output (docs/runbooks/otter-dogfood.md). Otter advertises ONLY
+    // read scopes, so this integration is read-only by construction: there is
+    // no write scope to request even by mistake.
+    definitionId: "otter",
+    authorizeUrl: "https://otter.ai/oauth2/authorize",
+    tokenUrl: "https://otter.ai/oauth/token",
+    revokeUrl: "https://otter.ai/oauth/revoke_token",
+    defaultScopes: ["profile:read", "conversations:read"],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "body",
+    pkce: "S256",
+    publicClient: true,
+    mcpUrl: "https://mcp.otter.ai/mcp",
+    // Curated surface (matches the catalog seed's defined_scopes[].tools).
+    // These are the server's three tools, all read-only. The names are
+    // Otter's own, quoted from the tools' descriptions ("use `otter_search`
+    // first", "call otter_get_user_info() first"), not Composio's wrapped
+    // OTTER_AI_MCP_* slugs. An allowlisted name the server does not advertise
+    // is logged and SKIPPED by the proxy, so confirm against the first live
+    // tools/list after a real consent (runbook Step 3).
+    toolAllowlist: ["otter_get_user_info", "otter_search", "otter_fetch"]
+  },
   "notion-cli": {
     // Notion's public OAuth app. Tokens are workspace-scoped and long-lived —
     // Notion does not issue refresh_tokens, so `supportsRefresh: false` and
@@ -34536,6 +34752,34 @@ var INTEGRATION_REGISTRY = [
     docs_url: "https://help.kajabi.com/articles/api-integrations/connect-kajabi-to-claude-or-chatgpt",
     beta: true
   },
+  {
+    id: "otter",
+    name: "Otter.ai",
+    category: "knowledge",
+    description: "Read Otter.ai meetings: search recordings by date, attendee or topic, and read summaries, action items and full speaker-attributed transcripts.",
+    // CS-2029: same remote streamable-HTTP MCP + OAuth pattern as Granola/Kajabi.
+    // Otter's server implements the MCP discovery chain (RFC 9728 protected-
+    // resource metadata at mcp.otter.ai → RFC 8414 AS metadata at otter.ai →
+    // RFC 7591 registration); auth is OAuth 2.0 authorization-code with PKCE
+    // (S256) and a public client registered via one-time Dynamic Client
+    // Registration (scripts/dcr-register.ts against https://otter.ai/oauth/register
+    // → OAUTH_OTTER_CLIENT_ID, --scope 'profile:read conversations:read').
+    // Consent is brokered by the webapp through the shared
+    // /integrations/oauth/authorize → /callback path, and the access_token
+    // reaches the host via the generic remote-oauth-proxy
+    // (OAUTH_PROVIDERS.otter.mcpUrl). Read-only by construction: Otter
+    // advertises no write scope.
+    supported_auth_types: ["oauth2"],
+    capabilities: [
+      { id: "otter:read", name: "Read Meetings & Transcripts", description: "Find recorded meetings by date, attendee, topic or title, and read their summaries, action items, outlines and full transcripts (otter_get_user_info, otter_search, otter_fetch)", access: "read" }
+    ],
+    // Otter's own Help Center article for the MCP server (CodeRabbit, #6906). It
+    // exists even though help.otter.ai answers 403 to non-browser clients; the
+    // help-centre API confirmed it (title "Otter MCP Server"). The MCP endpoint
+    // itself is a JSON-RPC URL, not a page (Obi Wan 8305072d5414).
+    docs_url: "https://help.otter.ai/hc/en-us/articles/35287607569687-Otter-MCP-Server",
+    beta: true
+  },
   {
     id: "anchor-browser",
     name: "Anchor Browser",
@@ -39227,14 +39471,37 @@ var FLAG_REGISTRY = [
   },
   {
     key: "platform-maintenance-mode",
-    description: 'Platform-wide maintenance mode (ENG-6506): when on, every agent across every team/org auto-replies to admitted human inbound with a "we are offline for maintenance" notice instead of dispatching to the agent \u2014 for whole-platform downtime such as DB upgrades. Read host-side per inbound from the flags cache (no MCP restart). Boolean gate; ships dark \u2014 when off, channels behave exactly as today. (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',
-    flagType: "boolean",
-    // Declared safe value is `false` (normal operation). Fail-safe direction: a
-    // flag-DB read error or absent flag map must never silence the fleet on its
-    // own — agents stay responsive unless an operator deliberately flips this on
-    // from the admin Feature Flags page. No envVar: net-new control, no
-    // pre-flags env gate to migrate.
-    defaultValue: false,
+    description: 'Platform-wide maintenance mode (ENG-6506; widened to modes by ENG-11436). off = normal operation (ships dark; channels behave exactly as today). tools-offline = every agent KEEPS conversing but every Augmented tool that WRITES to the control plane refuses with a reason, so nothing is created during a window whose database restore would discard it; reads are untouched. fleet-offline = the previous boolean-true behaviour AND the write gate: admitted human inbound gets a "we are offline for maintenance" notice instead of being dispatched, for whole-platform downtime such as DB upgrades. The modes are CUMULATIVE \u2014 fleet-offline gates writes too, because silencing channel inbound does not stop a /loop or a scheduled task filing work. Read host-side per inbound and per tool call from the flags cache (no MCP restart). (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',
+    flagType: "enum",
+    allowedValues: ["off", "tools-offline", "fleet-offline"],
+    // Declared safe value is `off` (normal operation). Fail-safe direction: a
+    // flag-DB read error or absent flag map must never silence the fleet OR take
+    // its write tools away on its own — agents stay fully functional unless an
+    // operator deliberately sets a mode from the admin Feature Flags page. No
+    // envVar: net-new control, no pre-flags env gate to migrate.
+    //
+    // ENG-11436 widened this from a boolean rather than adding a second flag, so
+    // there is ONE operator control whose modes are mutually exclusive by type
+    // instead of two similar booleans with four combinations.
+    //
+    // The host resolver GRANDFATHERS a boolean-shaped cache value
+    // (true -> fleet-offline, false -> off), and the DIRECTION it protects is
+    // narrower than an earlier version of this comment claimed (Obi Wan
+    // `e3f0d2c154b9` on #6903). It said "an older manager still writing a boolean
+    // must not make a central flip a silent no-op". That situation cannot arise:
+    // once this registry change deploys, normalizeFlagValue only ever yields one
+    // of the three strings, feature-flags-host.ts writes the heartbeat map
+    // verbatim, so no manager writes a boolean again. What grandfathering
+    // actually covers is a NEW MCP reading a STALE PRE-DEPLOY cache that still
+    // holds one.
+    //
+    // The direction that DOES happen is not handled and cannot be: an OLD MCP
+    // reads the new string with resolveHostBooleanFlag, gets undefined, and keeps
+    // dispatching. That is a real regression against ENG-6506 until the fleet
+    // converges, and it is why the runbook makes convergence a deploy-order
+    // PRECONDITION rather than offering a boolean fallback — there is none, since
+    // an enum flag rejects `{value: true}` with a 400.
+    defaultValue: "off",
     // Flipping this takes the ENTIRE fleet offline to end users; a mis-flip is a
     // platform-wide availability incident, so mutations require explicit
     // confirmation (the admin flip-reach modal).
@@ -45614,6 +45881,56 @@ var SLACK_ACCOUNT_WARN_COOLDOWN_MS = (() => {
   const n = raw ? Number(raw) : NaN;
   return Number.isFinite(n) && n >= 0 ? n * 1e3 : 24 * 60 * 60 * 1e3;
 })();
+var SLACK_TOOLS_OFFLINE_NOTICE_CACHE = /* @__PURE__ */ new Map();
+var SLACK_TOOLS_OFFLINE_COOLDOWN_MS = (() => {
+  const raw = process.env["SLACK_TOOLS_OFFLINE_COOLDOWN_SEC"];
+  const n = raw ? Number(raw) : NaN;
+  return Number.isFinite(n) && n >= 0 ? n * 1e3 : 60 * 60 * 1e3;
+})();
+async function maybeSendSlackToolsOfflineNotice(args) {
+  if (!BOT_TOKEN || !args.channel) return;
+  const key2 = `${args.channel}|${args.threadTs ?? "root"}|tools_offline`;
+  if (!shouldSendToolsOfflineNotice({
+    cache: SLACK_TOOLS_OFFLINE_NOTICE_CACHE,
+    key: key2,
+    cooldownMs: SLACK_TOOLS_OFFLINE_COOLDOWN_MS
+  })) {
+    return;
+  }
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const res = await fetch("https://slack.com/api/chat.postMessage", {
+      method: "POST",
+      signal: controller.signal,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${BOT_TOKEN}`
+      },
+      body: JSON.stringify({
+        channel: args.channel,
+        text: TOOLS_OFFLINE_USER_NOTICE,
+        ...args.threadTs ? { thread_ts: args.threadTs } : {}
+      })
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      SLACK_TOOLS_OFFLINE_NOTICE_CACHE.delete(key2);
+      process.stderr.write(
+        `slack-channel(${AGENT_CODE_NAME}): tools-offline notice post failed: ${data.error ?? "unknown"}
+`
+      );
+    }
+  } catch (err) {
+    SLACK_TOOLS_OFFLINE_NOTICE_CACHE.delete(key2);
+    process.stderr.write(
+      `slack-channel(${AGENT_CODE_NAME}): tools-offline notice error: ${err.message}
+`
+    );
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
 async function maybeSendSlackAccountWarn(args) {
   if (!BOT_TOKEN || !args.channel) return;
   const key2 = `${args.channel}|${args.threadTs ?? "root"}|account_warn`;
@@ -48679,6 +48996,10 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
   ]
 }));
 mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
+  {
+    const offline = refuseIfToolsOffline(req.params.name);
+    if (offline) return offline;
+  }
   const { name, arguments: args } = req.params;
   const impersonationRefusal = shouldRefuseImpersonatedEgress(
     name,
@@ -49052,6 +49373,11 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       }
       const sentTs = typeof data.ts === "string" ? data.ts : void 0;
       await maybeSendSlackAccountWarn({ channel: effectiveChannel, threadTs: effectiveThreadTs });
+      void maybeSendSlackToolsOfflineNotice({
+        channel: effectiveChannel,
+        threadTs: effectiveThreadTs
+      }).catch(() => {
+      });
       return {
         content: [{ type: "text", text: sentTs ? `${base} (ts=${sentTs})` : base }]
       };