@integrity-labs/agt-cli 0.28.1128 → 0.28.1130

package/dist/mcp/index.js

@@ -25856,243 +25856,6 @@ OAUTH_PROVIDERS["xero-control-plane"] = {
   ...OAUTH_PROVIDERS["xero"]
 };
 
-// ../core/dist/integrations/composio-account-probe.js
-var BODY_MAX_BYTES = 1024 * 1024;
-
-// ../core/dist/integrations/composio-approved-egress.json
-var composio_approved_egress_default = {
-  $comment: [
-    "ADR-0032 Part 3, gate item 2 + gate item 3 (ENG-9684). THE single recorded source",
-    "for the addresses Composio's per-key IP allowlist is expected to hold. Read by BOTH",
-    "scripts/fleet-egress-enum.sh (the operator's pre-arming instrument) and the",
-    "ComposioEgressAddressDrift cron (the between-armings watch). They must agree, which",
-    "is why neither carries its own copy.",
-    "",
-    "WHY A REPO FILE AND NOT SSM. Composio's allowlist has no read API, so its contents",
-    "can never be queried - only inferred from a refusal. This file is therefore not a",
-    "cache of vendor state; it is a DECLARATION of what a human pasted into a dashboard.",
-    "A PR is the right ceremony for changing a security boundary nobody can read back.",
-    "SSM would also hit registerCron's five-parameter grant scope (ENG-9940), where a",
-    "sixth parameter fails silently.",
-    "",
-    "THE COMPARISON IS ON `ip` AND NOTHING ELSE. `seenAsGateway` is informational. A NAT",
-    "rebuild that re-adopts the same EIP keeps egress correct while changing the gateway",
-    "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
-    "EIP adoption exists to create.",
-    "",
-    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
-    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
-    "same change that created it. Do the same for the next one, or the detector correctly",
-    "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
-    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
-    "account at all - which is why the bridge note below is written out by hand instead.",
-    "",
-    "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
-    "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
-    "be reassigned to another AWS customer at any time. An allowlist entry naming it would",
-    "then permit a stranger's host rather than simply failing closed. Nothing was armed when",
-    "this happened, so no key ever held it - but this file IS what an operator pastes from,",
-    "which is why it is removed here the same day.",
-    "",
-    "WHY retainOnDelete DID NOT SAVE IT, because the next person will assume it would.",
-    "The option was added in the SAME change that set dev's natMode to `none`. Pulumi reads",
-    "delete-time options from the STATE recorded at the resource's last registration, and by",
-    "the time this ran the resource was no longer in the program at all - so the state still",
-    "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
-    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
-    "this apply registered them with the option set.",
-    "",
-    "THE BRIDGE ADDRESSES ARE RECORDED HERE AND LIVE SOMEWHERE ELSE (ENG-10687).",
-    "The two control-plane bridge addresses were allocated by ENG-10515's deploy on",
-    "2026-09-18 and are listed below with stage `prod-bridge`. They sit in the CONTROL",
-    "PLANE account (109039361030), region us-east-2 - NOT the hosts account, and not",
-    "ap-southeast-2. Read back live after that deploy, not predicted.",
-    "",
-    "SO `account` AND `homeRegion` ABOVE ARE NOT THE SCOPE OF THIS FILE. They are the",
-    "single account and region the DETECTOR enumerates, which is why they stayed",
-    "hosts-account values when addresses from a second account landed here. Each address",
-    "carries its own `account` and `region`; read those, never the top-level pair, when",
-    "asking where an address lives.",
-    "",
-    "THE DETECTOR CANNOT VERIFY THE BRIDGE PAIR, AND THAT IS CORRECT, NOT A BUG.",
-    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
-    "only the addresses instances there actually route through. The bridge addresses sit in",
-    "this set unmatched and unflagged, which costs nothing: the detector reports an OBSERVED",
-    "address that is not approved, so a superset can never make it red. Do NOT 'fix' the",
-    "asymmetry by trimming this file to what the detector checks - the file records what the",
-    "ALLOWLIST must hold, which is a superset of what any one account scan can see.",
-    "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
-    "a tidy file.",
-    "",
-    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
-    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
-    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
-    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
-    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
-    "operator following the old sentence would arm a key that refuses that org's own agents.",
-    "",
-    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
-    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
-    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
-    "address no shared entry above carries. These are recorded per org rather than",
-    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
-    "into another org's key widens that key for no reason. The drift detector and",
-    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
-    "compared against a hosts-account scan - which is correct, since these addresses live in",
-    "accounts neither ever enumerates.",
-    "",
-    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
-    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
-    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
-    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
-    "seeing an address is not deciding it may hold a key. A row appears here when a human",
-    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
-    "decides it, in a PR, which is the same ceremony every other entry gets. So an org CAN",
-    "legitimately have a known egress address and no entry here, and the posture page must",
-    "withhold its paste value rather than offer the shared set. As of 2026-09-28 no org is in",
-    "that state - Zanda was, and the block below records what it cost, which is the reason",
-    "the withholding behaviour must not be softened just because nothing exercises it today.",
-    "",
-    "ZANDA IS THE LIVE EXAMPLE, AND ITS ADDRESS IS NOW APPROVED (2026-09-28). READ WHY.",
-    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
-    "585819234046, created 2026-09-16 - whose egress address was known from 2026-09-20:",
-    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
-    "to find it (it is a THIRD account, which no census had thought to scan). For eight days it",
-    "was NOT recorded here, deliberately, because nobody had approved it.",
-    "",
-    "THE ARGUMENT FOR LEAVING IT WAS CORRECT AND ITS PREMISE EXPIRED WITHOUT A SIGNAL.",
-    "This block used to read: 'That host carries ZERO assigned agents, so it makes no Composio",
-    "calls and the omission costs nothing today.' True when written, and it stopped being true",
-    "the moment an operator migrated an agent onto that host - which is a routine action, taken",
-    "by someone who had no reason to read this file, and which nothing connects back to here.",
-    "On 2026-09-28 that agent could not reach Jira: the org's key was armed, the host egressed",
-    "from an address no allowlist carried, and Composio refused it. The address was approved and",
-    "the full five-address set pasted into project pr_MY372XzWOmX_ the same day.",
-    "",
-    "SO THE LESSON IS NOT 'APPROVE FASTER'. It is that a cost bounded by 'no agents on that",
-    "host' is bounded by a condition nothing enforces and nothing watches. The queue that would",
-    "have surfaced this decision is ENG-10668, still unbuilt; until it exists, an address landing",
-    "in `host_attested_egress` for a fully_managed org is a decision waiting on someone noticing.",
-    "The customer-visible failure also outlived the fix: the refusals drove the integration into",
-    "an ENG-7916 bind quarantine, which does not self-clear when the allowlist is corrected.",
-    "",
-    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
-    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
-    "NATs, both BYO, and as of 2026-09-28 BOTH have a recorded address, so no org's row withholds.",
-    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
-    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
-    "NOT to narrow the rule back."
-  ],
-  account: "711726113003",
-  homeRegion: "ap-southeast-2",
-  addresses: [
-    {
-      ip: "32.236.6.24",
-      stage: "prod",
-      account: "711726113003",
-      region: "ap-southeast-2",
-      seenAsGateway: "nat-00a3dac969c0641a6",
-      note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
-    },
-    {
-      ip: "54.253.255.215",
-      stage: "prod",
-      account: "711726113003",
-      region: "ap-southeast-2",
-      seenAsGateway: "nat-04384e27ab04973b5",
-      note: "Prod hosts NAT in ap-southeast-2b, created 2026-09-15 by ENG-9426. The 12 prod hosts in the 2b private subnet egress here instead of crossing to 2a. Verified live after the Pulumi apply, not predicted."
-    },
-    {
-      ip: "77.112.237.198",
-      stage: "prod-bridge",
-      account: "109039361030",
-      region: "us-east-2",
-      seenAsGateway: "nat-07f1db970d2714b95",
-      note: "Control-plane egress bridge NAT in us-east-2a, created 2026-09-18 by ENG-10515. Carries server-side Composio traffic from the API and the webapp SSR Lambda once COMPOSIO_EGRESS_TRANSPORT reads `bridge`; until then the bridge function is never invoked and this address sends nothing. Verified live after the deploy: attached to the gateway, state available, and matching /augmented/prod/secrets/COMPOSIO_EGRESS_IPS."
-    },
-    {
-      ip: "18.224.120.114",
-      stage: "prod-bridge",
-      account: "109039361030",
-      region: "us-east-2",
-      seenAsGateway: "nat-02a4721d4ce678cf7",
-      note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
-    }
-  ],
-  orgAddresses: {
-    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
-      orgSlug: "integritylabs",
-      addresses: [
-        {
-          ip: "54.153.194.237",
-          stage: "prod-byo",
-          account: "436812233703",
-          region: null,
-          seenAsGateway: "nat-0c3cc231a8701a0e9",
-          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
-        }
-      ]
-    },
-    "c6a844b7-45d6-44f3-8390-616de3924c03": {
-      orgSlug: "zanda",
-      addresses: [
-        {
-          ip: "3.107.131.133",
-          stage: "prod-byo",
-          account: "585819234046",
-          region: null,
-          seenAsGateway: null,
-          note: "Zanda's BYO host d0a78e4f-7a21-4d8d-85db-66a167fdd8cb, created 2026-09-16 in a THIRD account no egress census had scanned. OBSERVED from `host_attested_egress` (ENG-10666) on 2026-09-20 and APPROVED 2026-09-28, after an agent was migrated onto that host and could not reach Jira - the org's key was already armed and no allowlist carried this address. `region` and `seenAsGateway` are null because they are NOT RECORDED and cannot be enumerated from here: the `augmented-byo-provisioner` role grants neither DescribeRouteTables nor DescribeNatGateways. The comparison is on `ip` alone, so a null costs nothing whereas a guessed value would be a fact this file states without evidence. The eight-day gap between observing and approving is the cost of ENG-10668 being unbuilt, not an oversight - see the ZANDA block in $comment."
-        }
-      ]
-    }
-  }
-};
-
-// ../core/dist/integrations/composio-approved-egress.js
-var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
-var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
-var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
-var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
-
-// ../core/dist/integrations/remote-mcp-proxy-env.js
-var REMOTE_MCP_PROXY_ENV = {
-  url: "AGT_REMOTE_MCP_URL",
-  tokenFile: "AGT_REMOTE_MCP_TOKEN_FILE",
-  tokenVar: "AGT_REMOTE_MCP_TOKEN_VAR",
-  label: "AGT_REMOTE_MCP_LABEL",
-  authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
-  extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
-  toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
-  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
-  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
-  // KNOW the remote accepts and silently ignores is refused before it is
-  // forwarded, rather than returning a 200 that every layer above records as
-  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
-  // we forward, not what an outbound request looks like, so the probe (which
-  // never issues a tools/call) has nothing to reconstruct from it.
-  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
-  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
-  //
-  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
-  // straight at the vendor, so none of the three brokered HITL gates
-  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
-  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
-  // — measured: zero hits for that column under `packages/core/src/provisioning`,
-  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
-  // approval and the call went straight out.
-  //
-  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
-  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
-  // looks like, so the connectivity probe has nothing to reconstruct from it.
-  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
-};
-var REMOTE_MCP_AUTH_ENV_KEYS = [
-  REMOTE_MCP_PROXY_ENV.tokenVar,
-  REMOTE_MCP_PROXY_ENV.authHeader,
-  REMOTE_MCP_PROXY_ENV.extraHeaders
-];
-
 // ../core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
   {
@@ -27053,6 +26816,78 @@ var INTEGRATION_REGISTRY = [
     },
     docs_url: "https://www.framer.com/developers/server-api-quick-start"
   },
+  {
+    // ENG-11540: FlutterFlow, through FlutterFlow's own CLI (`flutterflow ai`).
+    //
+    // WHAT "FLUTTERFLOW MCP" ACTUALLY IS. Not a hosted MCP endpoint. `flutterflow
+    // ai init <dir>` creates a local workspace holding a vendored Dart SDK and an
+    // MCP server registered in a workspace-root `.mcp.json`. The agent's own
+    // `.mcp.json` is platform-rendered, so a workspace-local server is never seen
+    // by the agent's session. The agent drives the same commands over Bash
+    // instead, which is what FlutterFlow's own Claude Code plugin does
+    // (github.com/FlutterFlow/flutterflow-claude) and is the same project state.
+    //
+    // HEADLESS, VERIFIED by running flutterflow_cli 0.0.41 on 2026-10-15: `init`
+    // reads FF_API_KEY from the environment, takes the workspace positionally and
+    // the project as `--project`, and never prompts when stdin is not a TTY. With
+    // no key it fails fast ("API key is required") rather than hanging. A key
+    // from the environment is never written to the CLI's credential store.
+    // Neither `flutterflow --version` nor `flutterflow ai --version` works outside
+    // a workspace, which is why the probe is central HTTP (connectivity-probe.ts).
+    id: "flutterflow",
+    name: "FlutterFlow",
+    category: "code",
+    description: "Build and edit FlutterFlow apps with the FlutterFlow CLI. Start with `flutterflow ai init <dir> --project <project-id>` (the key is already in FF_API_KEY), work inside that folder, inspect and validate before you run, and never read the folder's .flutterflow/.env (it holds the key). Never pass --yes to native-file unlock or lock, and ask a person before publish-library.",
+    supported_auth_types: ["api_key"],
+    // flutterflow_cli is 0.0.x and the AI SDK it downloads is versioned server-side.
+    beta: true,
+    installable: { category: "Code", authTypes: ["api_key"] },
+    capabilities: [
+      {
+        id: "flutterflow:read-project",
+        name: "Read Project",
+        description: "Inspect, search and validate a FlutterFlow project: pages, components, resources, status and run history",
+        access: "read"
+      },
+      {
+        id: "flutterflow:edit-project",
+        name: "Edit Project",
+        description: "Push changes to a FlutterFlow project: pages, widgets, state, actions and theme",
+        access: "write"
+      },
+      {
+        id: "flutterflow:publish-library",
+        name: "Publish Library",
+        description: "Publish a new version of a FlutterFlow library that other projects depend on",
+        access: "write"
+      }
+    ],
+    cli_tool: {
+      package: "flutterflow_cli",
+      binary: "flutterflow",
+      // `flutterflow ai` and the SDK it downloads both authenticate from this
+      // (the legacy FLUTTERFLOW_API_TOKEN feeds only export-code/deploy-firebase).
+      env_key: "FF_API_KEY",
+      installer: "script",
+      // The catalog is the trust boundary for this string (same contract as the
+      // `gh` entry above). The CLI is a Dart pub package, and AL2023 has no Dart
+      // rpm, so this installs Google's official SDK zip into a private prefix
+      // (about 650 MB, which is why it is per-integration and not in the base
+      // image) and puts a wrapper, not pub's shim, at /usr/local/bin/flutterflow.
+      // pub's shim runs a bare `dart`, so a different Dart earlier on PATH would
+      // reject the 3.13.5 snapshot; the wrapper pins our Dart for the CLI AND for
+      // the `dart run` the downloaded SDK does. Re-runnable: a timed-out run
+      // (180s) resumes from whatever finished. The SDK is unzipped into a
+      // staging dir INSIDE the prefix and renamed into place last (CodeRabbit on
+      // #7007): a run killed mid-unzip must never leave a partial dart-sdk that
+      // passes the version check and then fails every retry. Staging on the same
+      // filesystem is what makes the final `mv` a rename rather than a copy.
+      // Versions pinned on purpose: bump
+      // them together, after re-running the headless check above.
+      script: `set -e; d=/usr/local/flutterflow; v=3.13.5; case "$(uname -m)" in x86_64) a=x64;; aarch64|arm64) a=arm64;; *) echo "flutterflow: unsupported architecture $(uname -m)" >&2; exit 1;; esac; if ! "$d/dart-sdk/bin/dart" --version 2>&1 | grep -q "version: $v "; then if ! command -v unzip >/dev/null 2>&1; then if command -v dnf >/dev/null 2>&1; then dnf install -y unzip; elif command -v apt-get >/dev/null 2>&1; then apt-get update && apt-get install -y unzip; else echo "flutterflow: unzip missing and no supported installer (need dnf or apt-get)" >&2; exit 1; fi; fi; mkdir -p "$d"; t=$(mktemp -d "$d/.stage.XXXXXX"); trap 'rm -rf "$t"' EXIT; curl -fsSL "https://storage.googleapis.com/dart-archive/channels/stable/release/$v/sdk/dartsdk-linux-$a-release.zip" -o "$t/dart.zip"; unzip -q "$t/dart.zip" -d "$t/x"; rm -rf "$d/dart-sdk"; mv "$t/x/dart-sdk" "$d/dart-sdk"; fi; PATH="$d/dart-sdk/bin:$PATH" PUB_CACHE="$d/pub-cache" "$d/dart-sdk/bin/dart" pub global activate flutterflow_cli 0.0.41; printf '#!/bin/sh\\nPATH="%s/dart-sdk/bin:$PATH" PUB_CACHE="%s/pub-cache" exec "%s/pub-cache/bin/flutterflow" "$@"\\n' "$d" "$d" "$d" > /usr/local/bin/flutterflow; chmod 755 /usr/local/bin/flutterflow`
+    },
+    docs_url: "https://docs.flutterflow.io/flutterflow-cli/build/"
+  },
   {
     id: "v0",
     name: "v0 by Vercel",
@@ -28000,6 +27835,243 @@ var INSTALLABLE_NATIVE_INTEGRATIONS = INTEGRATION_REGISTRY.filter((d) => d.insta
 }));
 var INSTALLABLE_NATIVE_INTEGRATION_IDS = INSTALLABLE_NATIVE_INTEGRATIONS.map((i) => i.id);
 
+// ../core/dist/integrations/composio-account-probe.js
+var BODY_MAX_BYTES = 1024 * 1024;
+
+// ../core/dist/integrations/composio-approved-egress.json
+var composio_approved_egress_default = {
+  $comment: [
+    "ADR-0032 Part 3, gate item 2 + gate item 3 (ENG-9684). THE single recorded source",
+    "for the addresses Composio's per-key IP allowlist is expected to hold. Read by BOTH",
+    "scripts/fleet-egress-enum.sh (the operator's pre-arming instrument) and the",
+    "ComposioEgressAddressDrift cron (the between-armings watch). They must agree, which",
+    "is why neither carries its own copy.",
+    "",
+    "WHY A REPO FILE AND NOT SSM. Composio's allowlist has no read API, so its contents",
+    "can never be queried - only inferred from a refusal. This file is therefore not a",
+    "cache of vendor state; it is a DECLARATION of what a human pasted into a dashboard.",
+    "A PR is the right ceremony for changing a security boundary nobody can read back.",
+    "SSM would also hit registerCron's five-parameter grant scope (ENG-9940), where a",
+    "sixth parameter fails silently.",
+    "",
+    "THE COMPARISON IS ON `ip` AND NOTHING ELSE. `seenAsGateway` is informational. A NAT",
+    "rebuild that re-adopts the same EIP keeps egress correct while changing the gateway",
+    "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
+    "EIP adoption exists to create.",
+    "",
+    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
+    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
+    "same change that created it. Do the same for the next one, or the detector correctly",
+    "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
+    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
+    "account at all - which is why the bridge note below is written out by hand instead.",
+    "",
+    "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
+    "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
+    "be reassigned to another AWS customer at any time. An allowlist entry naming it would",
+    "then permit a stranger's host rather than simply failing closed. Nothing was armed when",
+    "this happened, so no key ever held it - but this file IS what an operator pastes from,",
+    "which is why it is removed here the same day.",
+    "",
+    "WHY retainOnDelete DID NOT SAVE IT, because the next person will assume it would.",
+    "The option was added in the SAME change that set dev's natMode to `none`. Pulumi reads",
+    "delete-time options from the STATE recorded at the resource's last registration, and by",
+    "the time this ran the resource was no longer in the program at all - so the state still",
+    "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
+    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
+    "this apply registered them with the option set.",
+    "",
+    "THE BRIDGE ADDRESSES ARE RECORDED HERE AND LIVE SOMEWHERE ELSE (ENG-10687).",
+    "The two control-plane bridge addresses were allocated by ENG-10515's deploy on",
+    "2026-09-18 and are listed below with stage `prod-bridge`. They sit in the CONTROL",
+    "PLANE account (109039361030), region us-east-2 - NOT the hosts account, and not",
+    "ap-southeast-2. Read back live after that deploy, not predicted.",
+    "",
+    "SO `account` AND `homeRegion` ABOVE ARE NOT THE SCOPE OF THIS FILE. They are the",
+    "single account and region the DETECTOR enumerates, which is why they stayed",
+    "hosts-account values when addresses from a second account landed here. Each address",
+    "carries its own `account` and `region`; read those, never the top-level pair, when",
+    "asking where an address lives.",
+    "",
+    "THE DETECTOR CANNOT VERIFY THE BRIDGE PAIR, AND THAT IS CORRECT, NOT A BUG.",
+    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
+    "only the addresses instances there actually route through. The bridge addresses sit in",
+    "this set unmatched and unflagged, which costs nothing: the detector reports an OBSERVED",
+    "address that is not approved, so a superset can never make it red. Do NOT 'fix' the",
+    "asymmetry by trimming this file to what the detector checks - the file records what the",
+    "ALLOWLIST must hold, which is a superset of what any one account scan can see.",
+    "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
+    "a tidy file.",
+    "",
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org CAN",
+    "legitimately have a known egress address and no entry here, and the posture page must",
+    "withhold its paste value rather than offer the shared set. As of 2026-09-28 no org is in",
+    "that state - Zanda was, and the block below records what it cost, which is the reason",
+    "the withholding behaviour must not be softened just because nothing exercises it today.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ADDRESS IS NOW APPROVED (2026-09-28). READ WHY.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - whose egress address was known from 2026-09-20:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). For eight days it",
+    "was NOT recorded here, deliberately, because nobody had approved it.",
+    "",
+    "THE ARGUMENT FOR LEAVING IT WAS CORRECT AND ITS PREMISE EXPIRED WITHOUT A SIGNAL.",
+    "This block used to read: 'That host carries ZERO assigned agents, so it makes no Composio",
+    "calls and the omission costs nothing today.' True when written, and it stopped being true",
+    "the moment an operator migrated an agent onto that host - which is a routine action, taken",
+    "by someone who had no reason to read this file, and which nothing connects back to here.",
+    "On 2026-09-28 that agent could not reach Jira: the org's key was armed, the host egressed",
+    "from an address no allowlist carried, and Composio refused it. The address was approved and",
+    "the full five-address set pasted into project pr_MY372XzWOmX_ the same day.",
+    "",
+    "SO THE LESSON IS NOT 'APPROVE FASTER'. It is that a cost bounded by 'no agents on that",
+    "host' is bounded by a condition nothing enforces and nothing watches. The queue that would",
+    "have surfaced this decision is ENG-10668, still unbuilt; until it exists, an address landing",
+    "in `host_attested_egress` for a fully_managed org is a decision waiting on someone noticing.",
+    "The customer-visible failure also outlived the fix: the refusals drove the integration into",
+    "an ENG-7916 bind quarantine, which does not self-clear when the allowlist is corrected.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and as of 2026-09-28 BOTH have a recorded address, so no org's row withholds.",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
+  ],
+  account: "711726113003",
+  homeRegion: "ap-southeast-2",
+  addresses: [
+    {
+      ip: "32.236.6.24",
+      stage: "prod",
+      account: "711726113003",
+      region: "ap-southeast-2",
+      seenAsGateway: "nat-00a3dac969c0641a6",
+      note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
+    },
+    {
+      ip: "54.253.255.215",
+      stage: "prod",
+      account: "711726113003",
+      region: "ap-southeast-2",
+      seenAsGateway: "nat-04384e27ab04973b5",
+      note: "Prod hosts NAT in ap-southeast-2b, created 2026-09-15 by ENG-9426. The 12 prod hosts in the 2b private subnet egress here instead of crossing to 2a. Verified live after the Pulumi apply, not predicted."
+    },
+    {
+      ip: "77.112.237.198",
+      stage: "prod-bridge",
+      account: "109039361030",
+      region: "us-east-2",
+      seenAsGateway: "nat-07f1db970d2714b95",
+      note: "Control-plane egress bridge NAT in us-east-2a, created 2026-09-18 by ENG-10515. Carries server-side Composio traffic from the API and the webapp SSR Lambda once COMPOSIO_EGRESS_TRANSPORT reads `bridge`; until then the bridge function is never invoked and this address sends nothing. Verified live after the deploy: attached to the gateway, state available, and matching /augmented/prod/secrets/COMPOSIO_EGRESS_IPS."
+    },
+    {
+      ip: "18.224.120.114",
+      stage: "prod-bridge",
+      account: "109039361030",
+      region: "us-east-2",
+      seenAsGateway: "nat-02a4721d4ce678cf7",
+      note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
+    }
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    },
+    "c6a844b7-45d6-44f3-8390-616de3924c03": {
+      orgSlug: "zanda",
+      addresses: [
+        {
+          ip: "3.107.131.133",
+          stage: "prod-byo",
+          account: "585819234046",
+          region: null,
+          seenAsGateway: null,
+          note: "Zanda's BYO host d0a78e4f-7a21-4d8d-85db-66a167fdd8cb, created 2026-09-16 in a THIRD account no egress census had scanned. OBSERVED from `host_attested_egress` (ENG-10666) on 2026-09-20 and APPROVED 2026-09-28, after an agent was migrated onto that host and could not reach Jira - the org's key was already armed and no allowlist carried this address. `region` and `seenAsGateway` are null because they are NOT RECORDED and cannot be enumerated from here: the `augmented-byo-provisioner` role grants neither DescribeRouteTables nor DescribeNatGateways. The comparison is on `ip` alone, so a null costs nothing whereas a guessed value would be a fact this file states without evidence. The eight-day gap between observing and approving is the cost of ENG-10668 being unbuilt, not an oversight - see the ZANDA block in $comment."
+        }
+      ]
+    }
+  }
+};
+
+// ../core/dist/integrations/composio-approved-egress.js
+var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
+var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
+var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
+
+// ../core/dist/integrations/remote-mcp-proxy-env.js
+var REMOTE_MCP_PROXY_ENV = {
+  url: "AGT_REMOTE_MCP_URL",
+  tokenFile: "AGT_REMOTE_MCP_TOKEN_FILE",
+  tokenVar: "AGT_REMOTE_MCP_TOKEN_VAR",
+  label: "AGT_REMOTE_MCP_LABEL",
+  authHeader: "AGT_REMOTE_MCP_AUTH_HEADER",
+  extraHeaders: "AGT_REMOTE_MCP_EXTRA_HEADERS",
+  toolAllowlist: "AGT_REMOTE_MCP_TOOL_ALLOWLIST",
+  preEnableToolsets: "AGT_REMOTE_MCP_PREENABLE_TOOLSETS",
+  // ENG-8512: per-provider argument rules. A `tools/call` carrying a value we
+  // KNOW the remote accepts and silently ignores is refused before it is
+  // forwarded, rather than returning a 200 that every layer above records as
+  // success. Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS: it shapes which calls
+  // we forward, not what an outbound request looks like, so the probe (which
+  // never issues a tools/call) has nothing to reconstruct from it.
+  argRejects: "AGT_REMOTE_MCP_ARG_REJECTS",
+  // ENG-10614: the per-tool HITL floor table, as JSON `{ "<tool>": "<tier>" }`.
+  //
+  // WHY THIS EXISTS AT ALL. A hosted API-key remote MCP is called by Claude Code
+  // straight at the vendor, so none of the three brokered HITL gates
+  // (`enforceComposioHitlGate`, `hitlGateForBrokerCall`, the CLI lane) is in the
+  // path, and `tool_definitions.min_hitl_tier` was read by nothing on this lane
+  // — measured: zero hits for that column under `packages/core/src/provisioning`,
+  // `packages/mcp/src` or `apps/cli/src`. The catalog said `delete_item` needed
+  // approval and the call went straight out.
+  //
+  // Deliberately NOT in REMOTE_MCP_AUTH_ENV_KEYS, for the same reason as
+  // `argRejects`: it shapes WHICH calls we forward, not what an outbound request
+  // looks like, so the connectivity probe has nothing to reconstruct from it.
+  toolTiers: "AGT_REMOTE_MCP_TOOL_TIERS"
+};
+var REMOTE_MCP_AUTH_ENV_KEYS = [
+  REMOTE_MCP_PROXY_ENV.tokenVar,
+  REMOTE_MCP_PROXY_ENV.authHeader,
+  REMOTE_MCP_PROXY_ENV.extraHeaders
+];
+
 // ../core/dist/direct-chat/upload.js
 var MB2 = 1024 * 1024;
 var DIRECT_CHAT_UPLOAD_MAX_BYTES = 100 * MB2;
@@ -30840,6 +30912,20 @@ var FLAG_REGISTRY = [
     // on for their own org. Only a platform admin can (PR #6522 review).
     platformAdminOnly: true
   },
+  {
+    key: "direct-chat-voice",
+    description: "Show the microphone (voice) button in the web Direct Chat composer - the Direct Chat drawer and the agent-screen chat dock (ENG-11542). Off by default: voice set expectations it does not yet meet for customers, but the team still needs it for testing, so it is enabled per org rather than removed. Does not gate the mobile PWA voice switch or the server voice-session routes.",
+    flagType: "boolean",
+    // PUBLIC (ADR-0022 §2): read in the browser via usePublicBooleanFlag, so it
+    // must be in the GET /flags map. No env override (UI rollout, not an
+    // operator gate). Ships dark (default false).
+    public: true,
+    defaultValue: false,
+    // Platform admin only: the point of the flag is keeping a not-ready feature
+    // away from customers, so a customer org admin must not be able to switch
+    // it back on for their own org.
+    platformAdminOnly: true
+  },
   {
     key: "platform-maintenance-mode",
     description: 'Platform-wide maintenance mode (ENG-6506; widened to modes by ENG-11436). off = normal operation (ships dark; channels behave exactly as today). tools-offline = every agent KEEPS conversing but every Augmented tool that WRITES to the control plane refuses with a reason, so nothing is created during a window whose database restore would discard it; reads are untouched. fleet-offline = the previous boolean-true behaviour AND the write gate: admitted human inbound gets a "we are offline for maintenance" notice instead of being dispatched, for whole-platform downtime such as DB upgrades. The modes are CUMULATIVE \u2014 fleet-offline gates writes too, because silencing channel inbound does not stop a /loop or a scheduled task filing work. Read host-side per inbound and per tool call from the flags cache (no MCP restart). (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',