@integrity-labs/agt-cli 0.28.1127 → 0.28.1129

package/dist/mcp/direct-chat-channel.js

@@ -33354,243 +33354,6 @@ OAUTH_PROVIDERS["xero-control-plane"] = {
   ...OAUTH_PROVIDERS["xero"]
 };
 
-// ../core/dist/integrations/composio-account-probe.js
-var BODY_MAX_BYTES = 1024 * 1024;
-
-// ../core/dist/integrations/composio-approved-egress.json
-var composio_approved_egress_default = {
-  $comment: [
-    "ADR-0032 Part 3, gate item 2 + gate item 3 (ENG-9684). THE single recorded source",
-    "for the addresses Composio's per-key IP allowlist is expected to hold. Read by BOTH",
-    "scripts/fleet-egress-enum.sh (the operator's pre-arming instrument) and the",
-    "ComposioEgressAddressDrift cron (the between-armings watch). They must agree, which",
-    "is why neither carries its own copy.",
-    "",
-    "WHY A REPO FILE AND NOT SSM. Composio's allowlist has no read API, so its contents",
-    "can never be queried - only inferred from a refusal. This file is therefore not a",
-    "cache of vendor state; it is a DECLARATION of what a human pasted into a dashboard.",
-    "A PR is the right ceremony for changing a security boundary nobody can read back.",
-    "SSM would also hit registerCron's five-parameter grant scope (ENG-9940), where a",
-    "sixth parameter fails silently.",
-    "",
-    "THE COMPARISON IS ON `ip` AND NOTHING ELSE. `seenAsGateway` is informational. A NAT",
-    "rebuild that re-adopts the same EIP keeps egress correct while changing the gateway",
-    "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
-    "EIP adoption exists to create.",
-    "",
-    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
-    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
-    "same change that created it. Do the same for the next one, or the detector correctly",
-    "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
-    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
-    "account at all - which is why the bridge note below is written out by hand instead.",
-    "",
-    "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
-    "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
-    "be reassigned to another AWS customer at any time. An allowlist entry naming it would",
-    "then permit a stranger's host rather than simply failing closed. Nothing was armed when",
-    "this happened, so no key ever held it - but this file IS what an operator pastes from,",
-    "which is why it is removed here the same day.",
-    "",
-    "WHY retainOnDelete DID NOT SAVE IT, because the next person will assume it would.",
-    "The option was added in the SAME change that set dev's natMode to `none`. Pulumi reads",
-    "delete-time options from the STATE recorded at the resource's last registration, and by",
-    "the time this ran the resource was no longer in the program at all - so the state still",
-    "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
-    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
-    "this apply registered them with the option set.",
-    "",
-    "THE BRIDGE ADDRESSES ARE RECORDED HERE AND LIVE SOMEWHERE ELSE (ENG-10687).",
-    "The two control-plane bridge addresses were allocated by ENG-10515's deploy on",
-    "2026-09-18 and are listed below with stage `prod-bridge`. They sit in the CONTROL",
-    "PLANE account (109039361030), region us-east-2 - NOT the hosts account, and not",
-    "ap-southeast-2. Read back live after that deploy, not predicted.",
-    "",
-    "SO `account` AND `homeRegion` ABOVE ARE NOT THE SCOPE OF THIS FILE. They are the",
-    "single account and region the DETECTOR enumerates, which is why they stayed",
-    "hosts-account values when addresses from a second account landed here. Each address",
-    "carries its own `account` and `region`; read those, never the top-level pair, when",
-    "asking where an address lives.",
-    "",
-    "THE DETECTOR CANNOT VERIFY THE BRIDGE PAIR, AND THAT IS CORRECT, NOT A BUG.",
-    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
-    "only the addresses instances there actually route through. The bridge addresses sit in",
-    "this set unmatched and unflagged, which costs nothing: the detector reports an OBSERVED",
-    "address that is not approved, so a superset can never make it red. Do NOT 'fix' the",
-    "asymmetry by trimming this file to what the detector checks - the file records what the",
-    "ALLOWLIST must hold, which is a superset of what any one account scan can see.",
-    "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
-    "a tidy file.",
-    "",
-    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
-    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
-    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
-    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
-    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
-    "operator following the old sentence would arm a key that refuses that org's own agents.",
-    "",
-    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
-    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
-    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
-    "address no shared entry above carries. These are recorded per org rather than",
-    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
-    "into another org's key widens that key for no reason. The drift detector and",
-    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
-    "compared against a hosts-account scan - which is correct, since these addresses live in",
-    "accounts neither ever enumerates.",
-    "",
-    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
-    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
-    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
-    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
-    "seeing an address is not deciding it may hold a key. A row appears here when a human",
-    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
-    "decides it, in a PR, which is the same ceremony every other entry gets. So an org CAN",
-    "legitimately have a known egress address and no entry here, and the posture page must",
-    "withhold its paste value rather than offer the shared set. As of 2026-09-28 no org is in",
-    "that state - Zanda was, and the block below records what it cost, which is the reason",
-    "the withholding behaviour must not be softened just because nothing exercises it today.",
-    "",
-    "ZANDA IS THE LIVE EXAMPLE, AND ITS ADDRESS IS NOW APPROVED (2026-09-28). READ WHY.",
-    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
-    "585819234046, created 2026-09-16 - whose egress address was known from 2026-09-20:",
-    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
-    "to find it (it is a THIRD account, which no census had thought to scan). For eight days it",
-    "was NOT recorded here, deliberately, because nobody had approved it.",
-    "",
-    "THE ARGUMENT FOR LEAVING IT WAS CORRECT AND ITS PREMISE EXPIRED WITHOUT A SIGNAL.",
-    "This block used to read: 'That host carries ZERO assigned agents, so it makes no Composio",
-    "calls and the omission costs nothing today.' True when written, and it stopped being true",
-    "the moment an operator migrated an agent onto that host - which is a routine action, taken",
-    "by someone who had no reason to read this file, and which nothing connects back to here.",
-    "On 2026-09-28 that agent could not reach Jira: the org's key was armed, the host egressed",
-    "from an address no allowlist carried, and Composio refused it. The address was approved and",
-    "the full five-address set pasted into project pr_MY372XzWOmX_ the same day.",
-    "",
-    "SO THE LESSON IS NOT 'APPROVE FASTER'. It is that a cost bounded by 'no agents on that",
-    "host' is bounded by a condition nothing enforces and nothing watches. The queue that would",
-    "have surfaced this decision is ENG-10668, still unbuilt; until it exists, an address landing",
-    "in `host_attested_egress` for a fully_managed org is a decision waiting on someone noticing.",
-    "The customer-visible failure also outlived the fix: the refusals drove the integration into",
-    "an ENG-7916 bind quarantine, which does not self-clear when the allowlist is corrected.",
-    "",
-    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
-    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
-    "NATs, both BYO, and as of 2026-09-28 BOTH have a recorded address, so no org's row withholds.",
-    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
-    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
-    "NOT to narrow the rule back."
-  ],
-  account: "711726113003",
-  homeRegion: "ap-southeast-2",
-  addresses: [
-    {
-      ip: "32.236.6.24",
-      stage: "prod",
-      account: "711726113003",
-      region: "ap-southeast-2",
-      seenAsGateway: "nat-00a3dac969c0641a6",
-      note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
-    },
-    {
-      ip: "54.253.255.215",
-      stage: "prod",
-      account: "711726113003",
-      region: "ap-southeast-2",
-      seenAsGateway: "nat-04384e27ab04973b5",
-      note: "Prod hosts NAT in ap-southeast-2b, created 2026-09-15 by ENG-9426. The 12 prod hosts in the 2b private subnet egress here instead of crossing to 2a. Verified live after the Pulumi apply, not predicted."
-    },
-    {
-      ip: "77.112.237.198",
-      stage: "prod-bridge",
-      account: "109039361030",
-      region: "us-east-2",
-      seenAsGateway: "nat-07f1db970d2714b95",
-      note: "Control-plane egress bridge NAT in us-east-2a, created 2026-09-18 by ENG-10515. Carries server-side Composio traffic from the API and the webapp SSR Lambda once COMPOSIO_EGRESS_TRANSPORT reads `bridge`; until then the bridge function is never invoked and this address sends nothing. Verified live after the deploy: attached to the gateway, state available, and matching /augmented/prod/secrets/COMPOSIO_EGRESS_IPS."
-    },
-    {
-      ip: "18.224.120.114",
-      stage: "prod-bridge",
-      account: "109039361030",
-      region: "us-east-2",
-      seenAsGateway: "nat-02a4721d4ce678cf7",
-      note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
-    }
-  ],
-  orgAddresses: {
-    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
-      orgSlug: "integritylabs",
-      addresses: [
-        {
-          ip: "54.153.194.237",
-          stage: "prod-byo",
-          account: "436812233703",
-          region: null,
-          seenAsGateway: "nat-0c3cc231a8701a0e9",
-          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
-        }
-      ]
-    },
-    "c6a844b7-45d6-44f3-8390-616de3924c03": {
-      orgSlug: "zanda",
-      addresses: [
-        {
-          ip: "3.107.131.133",
-          stage: "prod-byo",
-          account: "585819234046",
-          region: null,
-          seenAsGateway: null,
-          note: "Zanda's BYO host d0a78e4f-7a21-4d8d-85db-66a167fdd8cb, created 2026-09-16 in a THIRD account no egress census had scanned. OBSERVED from `host_attested_egress` (ENG-10666) on 2026-09-20 and APPROVED 2026-09-28, after an agent was migrated onto that host and could not reach Jira - the org's key was already armed and no allowlist carried this address. `region` and `seenAsGateway` are null because they are NOT RECORDED and cannot be enumerated from here: the `augmented-byo-provisioner` role grants neither DescribeRouteTables nor DescribeNatGateways. The comparison is on `ip` alone, so a null costs nothing whereas a guessed value would be a fact this file states without evidence. The eight-day gap between observing and approving is the cost of ENG-10668 being unbuilt, not an oversight - see the ZANDA block in $comment."
-        }
-      ]
-    }
-  }
-};
-
-// ../core/dist/integrations/composio-approved-egress.js
-var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
-var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
-var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
-var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
-
-// ../core/dist/integrations/remote-mcp-proxy-env.js
-var REMOTE_MCP_PROXY_ENV = {
-  url: "AGT_REMOTE_MCP_URL",
-  tokenFile: "AGT_REMOTE_MCP_TOKEN_FILE",
-  tokenVar: "AGT_REMOTE_MCP_TOKEN_VAR",
-  label: "AGT_REMOTE_MCP_LABEL",
-  authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
-  extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
-  toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
-  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
-  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
-  // KNOW the remote accepts and silently ignores is refused before it is
-  // forwarded, rather than returning a 200 that every layer above records as
-  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
-  // we forward, not what an outbound request looks like, so the probe (which
-  // never issues a tools/call) has nothing to reconstruct from it.
-  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
-  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
-  //
-  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
-  // straight at the vendor, so none of the three brokered HITL gates
-  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
-  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
-  // — measured: zero hits for that column under `packages/core/src/provisioning`,
-  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
-  // approval and the call went straight out.
-  //
-  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
-  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
-  // looks like, so the connectivity probe has nothing to reconstruct from it.
-  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
-};
-var REMOTE_MCP_AUTH_ENV_KEYS = [
-  REMOTE_MCP_PROXY_ENV.tokenVar,
-  REMOTE_MCP_PROXY_ENV.authHeader,
-  REMOTE_MCP_PROXY_ENV.extraHeaders
-];
-
 // ../core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
   {
@@ -35498,6 +35261,243 @@ var INSTALLABLE_NATIVE_INTEGRATIONS = INTEGRATION_REGISTRY.filter((d) => d.insta
 }));
 var INSTALLABLE_NATIVE_INTEGRATION_IDS = INSTALLABLE_NATIVE_INTEGRATIONS.map((i) => i.id);
 
+// ../core/dist/integrations/composio-account-probe.js
+var BODY_MAX_BYTES = 1024 * 1024;
+
+// ../core/dist/integrations/composio-approved-egress.json
+var composio_approved_egress_default = {
+  $comment: [
+    "ADR-0032 Part 3, gate item 2 + gate item 3 (ENG-9684). THE single recorded source",
+    "for the addresses Composio's per-key IP allowlist is expected to hold. Read by BOTH",
+    "scripts/fleet-egress-enum.sh (the operator's pre-arming instrument) and the",
+    "ComposioEgressAddressDrift cron (the between-armings watch). They must agree, which",
+    "is why neither carries its own copy.",
+    "",
+    "WHY A REPO FILE AND NOT SSM. Composio's allowlist has no read API, so its contents",
+    "can never be queried - only inferred from a refusal. This file is therefore not a",
+    "cache of vendor state; it is a DECLARATION of what a human pasted into a dashboard.",
+    "A PR is the right ceremony for changing a security boundary nobody can read back.",
+    "SSM would also hit registerCron's five-parameter grant scope (ENG-9940), where a",
+    "sixth parameter fails silently.",
+    "",
+    "THE COMPARISON IS ON `ip` AND NOTHING ELSE. `seenAsGateway` is informational. A NAT",
+    "rebuild that re-adopts the same EIP keeps egress correct while changing the gateway",
+    "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
+    "EIP adoption exists to create.",
+    "",
+    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
+    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
+    "same change that created it. Do the same for the next one, or the detector correctly",
+    "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
+    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
+    "account at all - which is why the bridge note below is written out by hand instead.",
+    "",
+    "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
+    "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
+    "be reassigned to another AWS customer at any time. An allowlist entry naming it would",
+    "then permit a stranger's host rather than simply failing closed. Nothing was armed when",
+    "this happened, so no key ever held it - but this file IS what an operator pastes from,",
+    "which is why it is removed here the same day.",
+    "",
+    "WHY retainOnDelete DID NOT SAVE IT, because the next person will assume it would.",
+    "The option was added in the SAME change that set dev's natMode to `none`. Pulumi reads",
+    "delete-time options from the STATE recorded at the resource's last registration, and by",
+    "the time this ran the resource was no longer in the program at all - so the state still",
+    "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
+    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
+    "this apply registered them with the option set.",
+    "",
+    "THE BRIDGE ADDRESSES ARE RECORDED HERE AND LIVE SOMEWHERE ELSE (ENG-10687).",
+    "The two control-plane bridge addresses were allocated by ENG-10515's deploy on",
+    "2026-09-18 and are listed below with stage `prod-bridge`. They sit in the CONTROL",
+    "PLANE account (109039361030), region us-east-2 - NOT the hosts account, and not",
+    "ap-southeast-2. Read back live after that deploy, not predicted.",
+    "",
+    "SO `account` AND `homeRegion` ABOVE ARE NOT THE SCOPE OF THIS FILE. They are the",
+    "single account and region the DETECTOR enumerates, which is why they stayed",
+    "hosts-account values when addresses from a second account landed here. Each address",
+    "carries its own `account` and `region`; read those, never the top-level pair, when",
+    "asking where an address lives.",
+    "",
+    "THE DETECTOR CANNOT VERIFY THE BRIDGE PAIR, AND THAT IS CORRECT, NOT A BUG.",
+    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
+    "only the addresses instances there actually route through. The bridge addresses sit in",
+    "this set unmatched and unflagged, which costs nothing: the detector reports an OBSERVED",
+    "address that is not approved, so a superset can never make it red. Do NOT 'fix' the",
+    "asymmetry by trimming this file to what the detector checks - the file records what the",
+    "ALLOWLIST must hold, which is a superset of what any one account scan can see.",
+    "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
+    "a tidy file.",
+    "",
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org CAN",
+    "legitimately have a known egress address and no entry here, and the posture page must",
+    "withhold its paste value rather than offer the shared set. As of 2026-09-28 no org is in",
+    "that state - Zanda was, and the block below records what it cost, which is the reason",
+    "the withholding behaviour must not be softened just because nothing exercises it today.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ADDRESS IS NOW APPROVED (2026-09-28). READ WHY.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - whose egress address was known from 2026-09-20:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). For eight days it",
+    "was NOT recorded here, deliberately, because nobody had approved it.",
+    "",
+    "THE ARGUMENT FOR LEAVING IT WAS CORRECT AND ITS PREMISE EXPIRED WITHOUT A SIGNAL.",
+    "This block used to read: 'That host carries ZERO assigned agents, so it makes no Composio",
+    "calls and the omission costs nothing today.' True when written, and it stopped being true",
+    "the moment an operator migrated an agent onto that host - which is a routine action, taken",
+    "by someone who had no reason to read this file, and which nothing connects back to here.",
+    "On 2026-09-28 that agent could not reach Jira: the org's key was armed, the host egressed",
+    "from an address no allowlist carried, and Composio refused it. The address was approved and",
+    "the full five-address set pasted into project pr_MY372XzWOmX_ the same day.",
+    "",
+    "SO THE LESSON IS NOT 'APPROVE FASTER'. It is that a cost bounded by 'no agents on that",
+    "host' is bounded by a condition nothing enforces and nothing watches. The queue that would",
+    "have surfaced this decision is ENG-10668, still unbuilt; until it exists, an address landing",
+    "in `host_attested_egress` for a fully_managed org is a decision waiting on someone noticing.",
+    "The customer-visible failure also outlived the fix: the refusals drove the integration into",
+    "an ENG-7916 bind quarantine, which does not self-clear when the allowlist is corrected.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and as of 2026-09-28 BOTH have a recorded address, so no org's row withholds.",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
+  ],
+  account: "711726113003",
+  homeRegion: "ap-southeast-2",
+  addresses: [
+    {
+      ip: "32.236.6.24",
+      stage: "prod",
+      account: "711726113003",
+      region: "ap-southeast-2",
+      seenAsGateway: "nat-00a3dac969c0641a6",
+      note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
+    },
+    {
+      ip: "54.253.255.215",
+      stage: "prod",
+      account: "711726113003",
+      region: "ap-southeast-2",
+      seenAsGateway: "nat-04384e27ab04973b5",
+      note: "Prod hosts NAT in ap-southeast-2b, created 2026-09-15 by ENG-9426. The 12 prod hosts in the 2b private subnet egress here instead of crossing to 2a. Verified live after the Pulumi apply, not predicted."
+    },
+    {
+      ip: "77.112.237.198",
+      stage: "prod-bridge",
+      account: "109039361030",
+      region: "us-east-2",
+      seenAsGateway: "nat-07f1db970d2714b95",
+      note: "Control-plane egress bridge NAT in us-east-2a, created 2026-09-18 by ENG-10515. Carries server-side Composio traffic from the API and the webapp SSR Lambda once COMPOSIO_EGRESS_TRANSPORT reads `bridge`; until then the bridge function is never invoked and this address sends nothing. Verified live after the deploy: attached to the gateway, state available, and matching /augmented/prod/secrets/COMPOSIO_EGRESS_IPS."
+    },
+    {
+      ip: "18.224.120.114",
+      stage: "prod-bridge",
+      account: "109039361030",
+      region: "us-east-2",
+      seenAsGateway: "nat-02a4721d4ce678cf7",
+      note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
+    }
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    },
+    "c6a844b7-45d6-44f3-8390-616de3924c03": {
+      orgSlug: "zanda",
+      addresses: [
+        {
+          ip: "3.107.131.133",
+          stage: "prod-byo",
+          account: "585819234046",
+          region: null,
+          seenAsGateway: null,
+          note: "Zanda's BYO host d0a78e4f-7a21-4d8d-85db-66a167fdd8cb, created 2026-09-16 in a THIRD account no egress census had scanned. OBSERVED from `host_attested_egress` (ENG-10666) on 2026-09-20 and APPROVED 2026-09-28, after an agent was migrated onto that host and could not reach Jira - the org's key was already armed and no allowlist carried this address. `region` and `seenAsGateway` are null because they are NOT RECORDED and cannot be enumerated from here: the `augmented-byo-provisioner` role grants neither DescribeRouteTables nor DescribeNatGateways. The comparison is on `ip` alone, so a null costs nothing whereas a guessed value would be a fact this file states without evidence. The eight-day gap between observing and approving is the cost of ENG-10668 being unbuilt, not an oversight - see the ZANDA block in $comment."
+        }
+      ]
+    }
+  }
+};
+
+// ../core/dist/integrations/composio-approved-egress.js
+var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
+var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
+var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
+
+// ../core/dist/integrations/remote-mcp-proxy-env.js
+var REMOTE_MCP_PROXY_ENV = {
+  url: "AGT_REMOTE_MCP_URL",
+  tokenFile: "AGT_REMOTE_MCP_TOKEN_FILE",
+  tokenVar: "AGT_REMOTE_MCP_TOKEN_VAR",
+  label: "AGT_REMOTE_MCP_LABEL",
+  authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
+  extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
+  toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
+  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
+  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
+  // KNOW the remote accepts and silently ignores is refused before it is
+  // forwarded, rather than returning a 200 that every layer above records as
+  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
+  // we forward, not what an outbound request looks like, so the probe (which
+  // never issues a tools/call) has nothing to reconstruct from it.
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
+  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
+  //
+  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
+  // straight at the vendor, so none of the three brokered HITL gates
+  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
+  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
+  // — measured: zero hits for that column under `packages/core/src/provisioning`,
+  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
+  // approval and the call went straight out.
+  //
+  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
+  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
+  // looks like, so the connectivity probe has nothing to reconstruct from it.
+  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
+};
+var REMOTE_MCP_AUTH_ENV_KEYS = [
+  REMOTE_MCP_PROXY_ENV.tokenVar,
+  REMOTE_MCP_PROXY_ENV.authHeader,
+  REMOTE_MCP_PROXY_ENV.extraHeaders
+];
+
 // ../core/dist/direct-chat/upload.js
 var MB2 = 1024 * 1024;
 var DIRECT_CHAT_UPLOAD_MAX_BYTES = 100 * MB2;