@integrity-labs/agt-cli 0.28.1112 → 0.28.1114

package/dist/mcp/direct-chat-channel.js

@@ -33059,6 +33059,51 @@ var OAUTH_PROVIDERS = {
       }
     ]
   },
+  "otter": {
+    // CS-2029: Otter.ai's official MCP — remote streamable-HTTP at
+    // https://mcp.otter.ai/mcp. Same Granola/Kajabi shape: OAuth 2.0
+    // authorization-code with PKCE (S256) and a public client
+    // (token_endpoint_auth_method 'none') issued via Dynamic Client
+    // Registration (RFC 7591). Values below are taken verbatim from the
+    // metadata, not inferred:
+    //   - https://mcp.otter.ai/.well-known/oauth-protected-resource names the
+    //     AS as https://otter.ai/ and advertises scopes profile:read,
+    //     conversations:read;
+    //   - https://otter.ai/.well-known/oauth-authorization-server gives
+    //     authorize /oauth2/authorize, token /oauth/token, revoke
+    //     /oauth/revoke_token, register /oauth/register, PKCE S256, `none`,
+    //     and the refresh_token grant.
+    // NOTE the authorize path is /oauth2/authorize while token/revoke live
+    // under /oauth/ — that is Otter's own split, do not "normalise" it.
+    // The prod client was registered 2026-10-10 against /oauth/register with
+    // scope 'profile:read conversations:read' and BOTH API callbacks,
+    // https://api.augmented.team/... and https://api.ninjafy.com/integrations/oauth/callback,
+    // because redirect_uri follows API_PUBLIC_URL and the ENG-11060 flip makes
+    // the ninjafy name canonical; Otter returns no RFC 7592 handle, so a redirect
+    // cannot be added later without a new client and a re-consent per connection.
+    // OAUTH_OTTER_CLIENT_ID is set from its output (docs/runbooks/otter-dogfood.md). Otter advertises ONLY
+    // read scopes, so this integration is read-only by construction: there is
+    // no write scope to request even by mistake.
+    definitionId: "otter",
+    authorizeUrl: "https://otter.ai/oauth2/authorize",
+    tokenUrl: "https://otter.ai/oauth/token",
+    revokeUrl: "https://otter.ai/oauth/revoke_token",
+    defaultScopes: ["profile:read", "conversations:read"],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "body",
+    pkce: "S256",
+    publicClient: true,
+    mcpUrl: "https://mcp.otter.ai/mcp",
+    // Curated surface (matches the catalog seed's defined_scopes[].tools).
+    // These are the server's three tools, all read-only. The names are
+    // Otter's own, quoted from the tools' descriptions ("use `otter_search`
+    // first", "call otter_get_user_info() first"), not Composio's wrapped
+    // OTTER_AI_MCP_* slugs. An allowlisted name the server does not advertise
+    // is logged and SKIPPED by the proxy, so confirm against the first live
+    // tools/list after a real consent (runbook Step 3).
+    toolAllowlist: ["otter_get_user_info", "otter_search", "otter_fetch"]
+  },
   "notion-cli": {
     // Notion's public OAuth app. Tokens are workspace-scoped and long-lived —
     // Notion does not issue refresh_tokens, so `supportsRefresh: false` and
@@ -33692,6 +33737,34 @@ var INTEGRATION_REGISTRY = [
     docs_url: "https://help.kajabi.com/articles/api-integrations/connect-kajabi-to-claude-or-chatgpt",
     beta: true
   },
+  {
+    id: "otter",
+    name: "Otter.ai",
+    category: "knowledge",
+    description: "Read Otter.ai meetings: search recordings by date, attendee or topic, and read summaries, action items and full speaker-attributed transcripts.",
+    // CS-2029: same remote streamable-HTTP MCP + OAuth pattern as Granola/Kajabi.
+    // Otter's server implements the MCP discovery chain (RFC 9728 protected-
+    // resource metadata at mcp.otter.ai → RFC 8414 AS metadata at otter.ai →
+    // RFC 7591 registration); auth is OAuth 2.0 authorization-code with PKCE
+    // (S256) and a public client registered via one-time Dynamic Client
+    // Registration (scripts/dcr-register.ts against https://otter.ai/oauth/register
+    // → OAUTH_OTTER_CLIENT_ID, --scope 'profile:read conversations:read').
+    // Consent is brokered by the webapp through the shared
+    // /integrations/oauth/authorize → /callback path, and the access_token
+    // reaches the host via the generic remote-oauth-proxy
+    // (OAUTH_PROVIDERS.otter.mcpUrl). Read-only by construction: Otter
+    // advertises no write scope.
+    supported_auth_types: ["oauth2"],
+    capabilities: [
+      { id: "otter:read", name: "Read Meetings & Transcripts", description: "Find recorded meetings by date, attendee, topic or title, and read their summaries, action items, outlines and full transcripts (otter_get_user_info, otter_search, otter_fetch)", access: "read" }
+    ],
+    // Otter's own Help Center article for the MCP server (CodeRabbit, #6906). It
+    // exists even though help.otter.ai answers 403 to non-browser clients; the
+    // help-centre API confirmed it (title "Otter MCP Server"). The MCP endpoint
+    // itself is a JSON-RPC URL, not a page (Obi Wan 8305072d5414).
+    docs_url: "https://help.otter.ai/hc/en-us/articles/35287607569687-Otter-MCP-Server",
+    beta: true
+  },
   {
     id: "anchor-browser",
     name: "Anchor Browser",
@@ -39777,8 +39850,38 @@ import { join as join10 } from "path";
 import { existsSync as existsSync4, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join9 } from "path";
-function defaultFlagsCachePath() {
-  return join9(homedir2(), ".augmented", "flags-cache.json");
+function hasUsableFlags(path) {
+  try {
+    if (!existsSync4(path)) return false;
+    const parsed = JSON.parse(readFileSync8(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return false;
+    const flags = parsed.flags;
+    return !!flags && typeof flags === "object" && !Array.isArray(flags);
+  } catch {
+    return false;
+  }
+}
+function cacheUpdatedAt(path) {
+  try {
+    if (!existsSync4(path)) return void 0;
+    const parsed = JSON.parse(readFileSync8(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const u = parsed.updated_at;
+    return typeof u === "string" && u.length > 0 ? u : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function defaultFlagsCachePath(env2 = process.env) {
+  const hostWide = join9(homedir2(), ".augmented", "flags-cache.json");
+  const agentId = env2["AGT_AGENT_ID"]?.trim();
+  if (!agentId) return hostWide;
+  const perAgent = join9(homedir2(), ".augmented", agentId, "flags-cache.json");
+  if (!hasUsableFlags(perAgent)) return hostWide;
+  const hostWideAt = cacheUpdatedAt(hostWide);
+  const perAgentAt = cacheUpdatedAt(perAgent);
+  if (hostWideAt && (!perAgentAt || perAgentAt < hostWideAt)) return hostWide;
+  return perAgent;
 }
 function envBoolean(raw) {
   if (raw === void 0) return void 0;
@@ -39805,7 +39908,7 @@ function resolveHostBooleanFlag(opts) {
   const env2 = opts.env ?? process.env;
   const envValue = envBoolean(env2[opts.envVar]);
   if (envValue !== void 0) return envValue;
-  const cached2 = cachedBoolean(opts.key, opts.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedBoolean(opts.key, opts.cachePath ?? defaultFlagsCachePath(env2));
   if (cached2 !== void 0) return cached2;
   return opts.defaultValue;
 }
@@ -39836,7 +39939,7 @@ function cachedMaintenanceMode(path) {
   }
 }
 function resolveMaintenanceMode(opts) {
-  const cached2 = cachedMaintenanceMode(opts?.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedMaintenanceMode(opts?.cachePath ?? defaultFlagsCachePath(opts?.env));
   if (cached2 !== void 0) return cached2;
   return "off";
 }

package/dist/mcp/index.js

@@ -25562,6 +25562,51 @@ var OAUTH_PROVIDERS = {
       }
     ]
   },
+  "otter": {
+    // CS-2029: Otter.ai's official MCP — remote streamable-HTTP at
+    // https://mcp.otter.ai/mcp. Same Granola/Kajabi shape: OAuth 2.0
+    // authorization-code with PKCE (S256) and a public client
+    // (token_endpoint_auth_method 'none') issued via Dynamic Client
+    // Registration (RFC 7591). Values below are taken verbatim from the
+    // metadata, not inferred:
+    //   - https://mcp.otter.ai/.well-known/oauth-protected-resource names the
+    //     AS as https://otter.ai/ and advertises scopes profile:read,
+    //     conversations:read;
+    //   - https://otter.ai/.well-known/oauth-authorization-server gives
+    //     authorize /oauth2/authorize, token /oauth/token, revoke
+    //     /oauth/revoke_token, register /oauth/register, PKCE S256, `none`,
+    //     and the refresh_token grant.
+    // NOTE the authorize path is /oauth2/authorize while token/revoke live
+    // under /oauth/ — that is Otter's own split, do not "normalise" it.
+    // The prod client was registered 2026-10-10 against /oauth/register with
+    // scope 'profile:read conversations:read' and BOTH API callbacks,
+    // https://api.augmented.team/... and https://api.ninjafy.com/integrations/oauth/callback,
+    // because redirect_uri follows API_PUBLIC_URL and the ENG-11060 flip makes
+    // the ninjafy name canonical; Otter returns no RFC 7592 handle, so a redirect
+    // cannot be added later without a new client and a re-consent per connection.
+    // OAUTH_OTTER_CLIENT_ID is set from its output (docs/runbooks/otter-dogfood.md). Otter advertises ONLY
+    // read scopes, so this integration is read-only by construction: there is
+    // no write scope to request even by mistake.
+    definitionId: "otter",
+    authorizeUrl: "https://otter.ai/oauth2/authorize",
+    tokenUrl: "https://otter.ai/oauth/token",
+    revokeUrl: "https://otter.ai/oauth/revoke_token",
+    defaultScopes: ["profile:read", "conversations:read"],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "body",
+    pkce: "S256",
+    publicClient: true,
+    mcpUrl: "https://mcp.otter.ai/mcp",
+    // Curated surface (matches the catalog seed's defined_scopes[].tools).
+    // These are the server's three tools, all read-only. The names are
+    // Otter's own, quoted from the tools' descriptions ("use `otter_search`
+    // first", "call otter_get_user_info() first"), not Composio's wrapped
+    // OTTER_AI_MCP_* slugs. An allowlisted name the server does not advertise
+    // is logged and SKIPPED by the proxy, so confirm against the first live
+    // tools/list after a real consent (runbook Step 3).
+    toolAllowlist: ["otter_get_user_info", "otter_search", "otter_fetch"]
+  },
   "notion-cli": {
     // Notion's public OAuth app. Tokens are workspace-scoped and long-lived —
     // Notion does not issue refresh_tokens, so `supportsRefresh: false` and
@@ -26195,6 +26240,34 @@ var INTEGRATION_REGISTRY = [
     docs_url: "https://help.kajabi.com/articles/api-integrations/connect-kajabi-to-claude-or-chatgpt",
     beta: true
   },
+  {
+    id: "otter",
+    name: "Otter.ai",
+    category: "knowledge",
+    description: "Read Otter.ai meetings: search recordings by date, attendee or topic, and read summaries, action items and full speaker-attributed transcripts.",
+    // CS-2029: same remote streamable-HTTP MCP + OAuth pattern as Granola/Kajabi.
+    // Otter's server implements the MCP discovery chain (RFC 9728 protected-
+    // resource metadata at mcp.otter.ai → RFC 8414 AS metadata at otter.ai →
+    // RFC 7591 registration); auth is OAuth 2.0 authorization-code with PKCE
+    // (S256) and a public client registered via one-time Dynamic Client
+    // Registration (scripts/dcr-register.ts against https://otter.ai/oauth/register
+    // → OAUTH_OTTER_CLIENT_ID, --scope 'profile:read conversations:read').
+    // Consent is brokered by the webapp through the shared
+    // /integrations/oauth/authorize → /callback path, and the access_token
+    // reaches the host via the generic remote-oauth-proxy
+    // (OAUTH_PROVIDERS.otter.mcpUrl). Read-only by construction: Otter
+    // advertises no write scope.
+    supported_auth_types: ["oauth2"],
+    capabilities: [
+      { id: "otter:read", name: "Read Meetings & Transcripts", description: "Find recorded meetings by date, attendee, topic or title, and read their summaries, action items, outlines and full transcripts (otter_get_user_info, otter_search, otter_fetch)", access: "read" }
+    ],
+    // Otter's own Help Center article for the MCP server (CodeRabbit, #6906). It
+    // exists even though help.otter.ai answers 403 to non-browser clients; the
+    // help-centre API confirmed it (title "Otter MCP Server"). The MCP endpoint
+    // itself is a JSON-RPC URL, not a page (Obi Wan 8305072d5414).
+    docs_url: "https://help.otter.ai/hc/en-us/articles/35287607569687-Otter-MCP-Server",
+    beta: true
+  },
   {
     id: "anchor-browser",
     name: "Anchor Browser",
@@ -46116,8 +46189,38 @@ var StdioServerTransport = class {
 import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join6 } from "path";
-function defaultFlagsCachePath() {
-  return join6(homedir2(), ".augmented", "flags-cache.json");
+function hasUsableFlags(path) {
+  try {
+    if (!existsSync2(path)) return false;
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return false;
+    const flags = parsed.flags;
+    return !!flags && typeof flags === "object" && !Array.isArray(flags);
+  } catch {
+    return false;
+  }
+}
+function cacheUpdatedAt(path) {
+  try {
+    if (!existsSync2(path)) return void 0;
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const u = parsed.updated_at;
+    return typeof u === "string" && u.length > 0 ? u : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function defaultFlagsCachePath(env2 = process.env) {
+  const hostWide = join6(homedir2(), ".augmented", "flags-cache.json");
+  const agentId = env2["AGT_AGENT_ID"]?.trim();
+  if (!agentId) return hostWide;
+  const perAgent = join6(homedir2(), ".augmented", agentId, "flags-cache.json");
+  if (!hasUsableFlags(perAgent)) return hostWide;
+  const hostWideAt = cacheUpdatedAt(hostWide);
+  const perAgentAt = cacheUpdatedAt(perAgent);
+  if (hostWideAt && (!perAgentAt || perAgentAt < hostWideAt)) return hostWide;
+  return perAgent;
 }
 function envBoolean(raw) {
   if (raw === void 0) return void 0;
@@ -46154,7 +46257,7 @@ function cachedMaintenanceMode(path) {
   }
 }
 function resolveMaintenanceMode(opts) {
-  const cached2 = cachedMaintenanceMode(opts?.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedMaintenanceMode(opts?.cachePath ?? defaultFlagsCachePath(opts?.env));
   if (cached2 !== void 0) return cached2;
   return "off";
 }

package/dist/mcp/origami.js

@@ -39711,6 +39711,51 @@ var OAUTH_PROVIDERS = {
       }
     ]
   },
+  "otter": {
+    // CS-2029: Otter.ai's official MCP — remote streamable-HTTP at
+    // https://mcp.otter.ai/mcp. Same Granola/Kajabi shape: OAuth 2.0
+    // authorization-code with PKCE (S256) and a public client
+    // (token_endpoint_auth_method 'none') issued via Dynamic Client
+    // Registration (RFC 7591). Values below are taken verbatim from the
+    // metadata, not inferred:
+    //   - https://mcp.otter.ai/.well-known/oauth-protected-resource names the
+    //     AS as https://otter.ai/ and advertises scopes profile:read,
+    //     conversations:read;
+    //   - https://otter.ai/.well-known/oauth-authorization-server gives
+    //     authorize /oauth2/authorize, token /oauth/token, revoke
+    //     /oauth/revoke_token, register /oauth/register, PKCE S256, `none`,
+    //     and the refresh_token grant.
+    // NOTE the authorize path is /oauth2/authorize while token/revoke live
+    // under /oauth/ — that is Otter's own split, do not "normalise" it.
+    // The prod client was registered 2026-10-10 against /oauth/register with
+    // scope 'profile:read conversations:read' and BOTH API callbacks,
+    // https://api.augmented.team/... and https://api.ninjafy.com/integrations/oauth/callback,
+    // because redirect_uri follows API_PUBLIC_URL and the ENG-11060 flip makes
+    // the ninjafy name canonical; Otter returns no RFC 7592 handle, so a redirect
+    // cannot be added later without a new client and a re-consent per connection.
+    // OAUTH_OTTER_CLIENT_ID is set from its output (docs/runbooks/otter-dogfood.md). Otter advertises ONLY
+    // read scopes, so this integration is read-only by construction: there is
+    // no write scope to request even by mistake.
+    definitionId: "otter",
+    authorizeUrl: "https://otter.ai/oauth2/authorize",
+    tokenUrl: "https://otter.ai/oauth/token",
+    revokeUrl: "https://otter.ai/oauth/revoke_token",
+    defaultScopes: ["profile:read", "conversations:read"],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "body",
+    pkce: "S256",
+    publicClient: true,
+    mcpUrl: "https://mcp.otter.ai/mcp",
+    // Curated surface (matches the catalog seed's defined_scopes[].tools).
+    // These are the server's three tools, all read-only. The names are
+    // Otter's own, quoted from the tools' descriptions ("use `otter_search`
+    // first", "call otter_get_user_info() first"), not Composio's wrapped
+    // OTTER_AI_MCP_* slugs. An allowlisted name the server does not advertise
+    // is logged and SKIPPED by the proxy, so confirm against the first live
+    // tools/list after a real consent (runbook Step 3).
+    toolAllowlist: ["otter_get_user_info", "otter_search", "otter_fetch"]
+  },
   "notion-cli": {
     // Notion's public OAuth app. Tokens are workspace-scoped and long-lived —
     // Notion does not issue refresh_tokens, so `supportsRefresh: false` and
@@ -40344,6 +40389,34 @@ var INTEGRATION_REGISTRY = [
     docs_url: "https://help.kajabi.com/articles/api-integrations/connect-kajabi-to-claude-or-chatgpt",
     beta: true
   },
+  {
+    id: "otter",
+    name: "Otter.ai",
+    category: "knowledge",
+    description: "Read Otter.ai meetings: search recordings by date, attendee or topic, and read summaries, action items and full speaker-attributed transcripts.",
+    // CS-2029: same remote streamable-HTTP MCP + OAuth pattern as Granola/Kajabi.
+    // Otter's server implements the MCP discovery chain (RFC 9728 protected-
+    // resource metadata at mcp.otter.ai → RFC 8414 AS metadata at otter.ai →
+    // RFC 7591 registration); auth is OAuth 2.0 authorization-code with PKCE
+    // (S256) and a public client registered via one-time Dynamic Client
+    // Registration (scripts/dcr-register.ts against https://otter.ai/oauth/register
+    // → OAUTH_OTTER_CLIENT_ID, --scope 'profile:read conversations:read').
+    // Consent is brokered by the webapp through the shared
+    // /integrations/oauth/authorize → /callback path, and the access_token
+    // reaches the host via the generic remote-oauth-proxy
+    // (OAUTH_PROVIDERS.otter.mcpUrl). Read-only by construction: Otter
+    // advertises no write scope.
+    supported_auth_types: ["oauth2"],
+    capabilities: [
+      { id: "otter:read", name: "Read Meetings & Transcripts", description: "Find recorded meetings by date, attendee, topic or title, and read their summaries, action items, outlines and full transcripts (otter_get_user_info, otter_search, otter_fetch)", access: "read" }
+    ],
+    // Otter's own Help Center article for the MCP server (CodeRabbit, #6906). It
+    // exists even though help.otter.ai answers 403 to non-browser clients; the
+    // help-centre API confirmed it (title "Otter MCP Server"). The MCP endpoint
+    // itself is a JSON-RPC URL, not a page (Obi Wan 8305072d5414).
+    docs_url: "https://help.otter.ai/hc/en-us/articles/35287607569687-Otter-MCP-Server",
+    beta: true
+  },
   {
     id: "anchor-browser",
     name: "Anchor Browser",

package/dist/mcp/slack-channel.js

@@ -30673,8 +30673,38 @@ function isSlackDirectMessage(channelId) {
 import { existsSync, readFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
-function defaultFlagsCachePath() {
-  return join(homedir(), ".augmented", "flags-cache.json");
+function hasUsableFlags(path) {
+  try {
+    if (!existsSync(path)) return false;
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return false;
+    const flags = parsed.flags;
+    return !!flags && typeof flags === "object" && !Array.isArray(flags);
+  } catch {
+    return false;
+  }
+}
+function cacheUpdatedAt(path) {
+  try {
+    if (!existsSync(path)) return void 0;
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const u = parsed.updated_at;
+    return typeof u === "string" && u.length > 0 ? u : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function defaultFlagsCachePath(env2 = process.env) {
+  const hostWide = join(homedir(), ".augmented", "flags-cache.json");
+  const agentId = env2["AGT_AGENT_ID"]?.trim();
+  if (!agentId) return hostWide;
+  const perAgent = join(homedir(), ".augmented", agentId, "flags-cache.json");
+  if (!hasUsableFlags(perAgent)) return hostWide;
+  const hostWideAt = cacheUpdatedAt(hostWide);
+  const perAgentAt = cacheUpdatedAt(perAgent);
+  if (hostWideAt && (!perAgentAt || perAgentAt < hostWideAt)) return hostWide;
+  return perAgent;
 }
 function envBoolean(raw) {
   if (raw === void 0) return void 0;
@@ -30701,7 +30731,7 @@ function resolveHostBooleanFlag(opts) {
   const env2 = opts.env ?? process.env;
   const envValue = envBoolean(env2[opts.envVar]);
   if (envValue !== void 0) return envValue;
-  const cached2 = cachedBoolean(opts.key, opts.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedBoolean(opts.key, opts.cachePath ?? defaultFlagsCachePath(env2));
   if (cached2 !== void 0) return cached2;
   return opts.defaultValue;
 }
@@ -30737,7 +30767,7 @@ function resolveGhostReplyMode(opts) {
   if (modeOverride !== void 0) return modeOverride;
   const legacyOverride = parseGhostReplyMode(env2["AGT_GHOST_REPLY_INTENT_CLASSIFIER_ENABLED"]);
   if (legacyOverride !== void 0) return legacyOverride;
-  const cached2 = cachedGhostReplyMode(opts?.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedGhostReplyMode(opts?.cachePath ?? defaultFlagsCachePath(env2));
   if (cached2 !== void 0) return cached2;
   return "off";
 }
@@ -30768,7 +30798,7 @@ function cachedMaintenanceMode(path) {
   }
 }
 function resolveMaintenanceMode(opts) {
-  const cached2 = cachedMaintenanceMode(opts?.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedMaintenanceMode(opts?.cachePath ?? defaultFlagsCachePath(opts?.env));
   if (cached2 !== void 0) return cached2;
   return "off";
 }
@@ -30802,7 +30832,7 @@ function resolveSlackHotThreadMode(opts) {
   const env2 = opts?.env ?? process.env;
   const modeOverride = parseSlackHotThreadMode(env2["AGT_SLACK_HOT_THREAD_GUARD_MODE"]);
   if (modeOverride !== void 0) return modeOverride;
-  const cached2 = cachedSlackHotThreadMode(opts?.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedSlackHotThreadMode(opts?.cachePath ?? defaultFlagsCachePath(env2));
   if (cached2 !== void 0) return cached2;
   return "off";
 }
@@ -30838,7 +30868,7 @@ function resolveSlackScheduledChannelGuardMode(opts) {
     env2["AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE"]
   );
   if (modeOverride !== void 0) return modeOverride;
-  const cached2 = cachedSlackScheduledChannelGuardMode(opts?.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedSlackScheduledChannelGuardMode(opts?.cachePath ?? defaultFlagsCachePath(env2));
   if (cached2 !== void 0) return cached2;
   return "shadow";
 }
@@ -34068,6 +34098,51 @@ var OAUTH_PROVIDERS = {
       }
     ]
   },
+  "otter": {
+    // CS-2029: Otter.ai's official MCP — remote streamable-HTTP at
+    // https://mcp.otter.ai/mcp. Same Granola/Kajabi shape: OAuth 2.0
+    // authorization-code with PKCE (S256) and a public client
+    // (token_endpoint_auth_method 'none') issued via Dynamic Client
+    // Registration (RFC 7591). Values below are taken verbatim from the
+    // metadata, not inferred:
+    //   - https://mcp.otter.ai/.well-known/oauth-protected-resource names the
+    //     AS as https://otter.ai/ and advertises scopes profile:read,
+    //     conversations:read;
+    //   - https://otter.ai/.well-known/oauth-authorization-server gives
+    //     authorize /oauth2/authorize, token /oauth/token, revoke
+    //     /oauth/revoke_token, register /oauth/register, PKCE S256, `none`,
+    //     and the refresh_token grant.
+    // NOTE the authorize path is /oauth2/authorize while token/revoke live
+    // under /oauth/ — that is Otter's own split, do not "normalise" it.
+    // The prod client was registered 2026-10-10 against /oauth/register with
+    // scope 'profile:read conversations:read' and BOTH API callbacks,
+    // https://api.augmented.team/... and https://api.ninjafy.com/integrations/oauth/callback,
+    // because redirect_uri follows API_PUBLIC_URL and the ENG-11060 flip makes
+    // the ninjafy name canonical; Otter returns no RFC 7592 handle, so a redirect
+    // cannot be added later without a new client and a re-consent per connection.
+    // OAUTH_OTTER_CLIENT_ID is set from its output (docs/runbooks/otter-dogfood.md). Otter advertises ONLY
+    // read scopes, so this integration is read-only by construction: there is
+    // no write scope to request even by mistake.
+    definitionId: "otter",
+    authorizeUrl: "https://otter.ai/oauth2/authorize",
+    tokenUrl: "https://otter.ai/oauth/token",
+    revokeUrl: "https://otter.ai/oauth/revoke_token",
+    defaultScopes: ["profile:read", "conversations:read"],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "body",
+    pkce: "S256",
+    publicClient: true,
+    mcpUrl: "https://mcp.otter.ai/mcp",
+    // Curated surface (matches the catalog seed's defined_scopes[].tools).
+    // These are the server's three tools, all read-only. The names are
+    // Otter's own, quoted from the tools' descriptions ("use `otter_search`
+    // first", "call otter_get_user_info() first"), not Composio's wrapped
+    // OTTER_AI_MCP_* slugs. An allowlisted name the server does not advertise
+    // is logged and SKIPPED by the proxy, so confirm against the first live
+    // tools/list after a real consent (runbook Step 3).
+    toolAllowlist: ["otter_get_user_info", "otter_search", "otter_fetch"]
+  },
   "notion-cli": {
     // Notion's public OAuth app. Tokens are workspace-scoped and long-lived —
     // Notion does not issue refresh_tokens, so `supportsRefresh: false` and
@@ -34707,6 +34782,34 @@ var INTEGRATION_REGISTRY = [
     docs_url: "https://help.kajabi.com/articles/api-integrations/connect-kajabi-to-claude-or-chatgpt",
     beta: true
   },
+  {
+    id: "otter",
+    name: "Otter.ai",
+    category: "knowledge",
+    description: "Read Otter.ai meetings: search recordings by date, attendee or topic, and read summaries, action items and full speaker-attributed transcripts.",
+    // CS-2029: same remote streamable-HTTP MCP + OAuth pattern as Granola/Kajabi.
+    // Otter's server implements the MCP discovery chain (RFC 9728 protected-
+    // resource metadata at mcp.otter.ai → RFC 8414 AS metadata at otter.ai →
+    // RFC 7591 registration); auth is OAuth 2.0 authorization-code with PKCE
+    // (S256) and a public client registered via one-time Dynamic Client
+    // Registration (scripts/dcr-register.ts against https://otter.ai/oauth/register
+    // → OAUTH_OTTER_CLIENT_ID, --scope 'profile:read conversations:read').
+    // Consent is brokered by the webapp through the shared
+    // /integrations/oauth/authorize → /callback path, and the access_token
+    // reaches the host via the generic remote-oauth-proxy
+    // (OAUTH_PROVIDERS.otter.mcpUrl). Read-only by construction: Otter
+    // advertises no write scope.
+    supported_auth_types: ["oauth2"],
+    capabilities: [
+      { id: "otter:read", name: "Read Meetings & Transcripts", description: "Find recorded meetings by date, attendee, topic or title, and read their summaries, action items, outlines and full transcripts (otter_get_user_info, otter_search, otter_fetch)", access: "read" }
+    ],
+    // Otter's own Help Center article for the MCP server (CodeRabbit, #6906). It
+    // exists even though help.otter.ai answers 403 to non-browser clients; the
+    // help-centre API confirmed it (title "Otter MCP Server"). The MCP endpoint
+    // itself is a JSON-RPC URL, not a page (Obi Wan 8305072d5414).
+    docs_url: "https://help.otter.ai/hc/en-us/articles/35287607569687-Otter-MCP-Server",
+    beta: true
+  },
   {
     id: "anchor-browser",
     name: "Anchor Browser",

package/dist/mcp/teams-channel.js

@@ -14169,8 +14169,38 @@ function emitToolCallMarkupRedactionTelemetry(channel) {
 import { existsSync, readFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
-function defaultFlagsCachePath() {
-  return join(homedir(), ".augmented", "flags-cache.json");
+function hasUsableFlags(path) {
+  try {
+    if (!existsSync(path)) return false;
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return false;
+    const flags = parsed.flags;
+    return !!flags && typeof flags === "object" && !Array.isArray(flags);
+  } catch {
+    return false;
+  }
+}
+function cacheUpdatedAt(path) {
+  try {
+    if (!existsSync(path)) return void 0;
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const u = parsed.updated_at;
+    return typeof u === "string" && u.length > 0 ? u : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function defaultFlagsCachePath(env = process.env) {
+  const hostWide = join(homedir(), ".augmented", "flags-cache.json");
+  const agentId = env["AGT_AGENT_ID"]?.trim();
+  if (!agentId) return hostWide;
+  const perAgent = join(homedir(), ".augmented", agentId, "flags-cache.json");
+  if (!hasUsableFlags(perAgent)) return hostWide;
+  const hostWideAt = cacheUpdatedAt(hostWide);
+  const perAgentAt = cacheUpdatedAt(perAgent);
+  if (hostWideAt && (!perAgentAt || perAgentAt < hostWideAt)) return hostWide;
+  return perAgent;
 }
 function envBoolean(raw) {
   if (raw === void 0) return void 0;
@@ -14197,7 +14227,7 @@ function resolveHostBooleanFlag(opts) {
   const env = opts.env ?? process.env;
   const envValue = envBoolean(env[opts.envVar]);
   if (envValue !== void 0) return envValue;
-  const cached2 = cachedBoolean(opts.key, opts.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedBoolean(opts.key, opts.cachePath ?? defaultFlagsCachePath(env));
   if (cached2 !== void 0) return cached2;
   return opts.defaultValue;
 }
@@ -14233,7 +14263,7 @@ function resolveGhostReplyMode(opts) {
   if (modeOverride !== void 0) return modeOverride;
   const legacyOverride = parseGhostReplyMode(env["AGT_GHOST_REPLY_INTENT_CLASSIFIER_ENABLED"]);
   if (legacyOverride !== void 0) return legacyOverride;
-  const cached2 = cachedGhostReplyMode(opts?.cachePath ?? defaultFlagsCachePath());
+  const cached2 = cachedGhostReplyMode(opts?.cachePath ?? defaultFlagsCachePath(env));
   if (cached2 !== void 0) return cached2;
   return "off";
 }