@integrity-labs/agt-cli 0.28.268 → 0.28.270

package/dist/{claude-pair-runtime-CXIVEO6R.js → claude-pair-runtime-WZLKWP74.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-FGGXFAJH.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-FMFTNDJO.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-CXIVEO6R.js.map
+//# sourceMappingURL=claude-pair-runtime-WZLKWP74.js.map

package/dist/lib/manager-worker.js

@@ -38,7 +38,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-PA3PWATY.js";
+} from "../chunk-ND4BBPV5.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -123,7 +123,7 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-GBVZDTCB.js";
+} from "../chunk-RH4FTCZK.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -6700,7 +6700,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.268" : "dev";
+var agtCliVersion = true ? "0.28.270" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7550,7 +7550,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-FGGXFAJH.js");
+      const { collectDiagnostics } = await import("../persistent-session-FMFTNDJO.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -7648,7 +7648,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-FGGXFAJH.js");
+      const { collectDiagnostics } = await import("../persistent-session-FMFTNDJO.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -7796,7 +7796,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-2734PYS6.js");
+      } = await import("../responsiveness-probe-FPTBS6RZ.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -7828,7 +7828,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-2734PYS6.js");
+        } = await import("../responsiveness-probe-FPTBS6RZ.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -10686,7 +10686,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-FGGXFAJH.js");
+        const { collectDiagnostics } = await import("../persistent-session-FMFTNDJO.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -10736,7 +10736,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-FGGXFAJH.js");
+      const { collectDiagnostics } = await import("../persistent-session-FMFTNDJO.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -11127,7 +11127,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-CXIVEO6R.js");
+  } = await import("../claude-pair-runtime-WZLKWP74.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/origami.js

@@ -38739,13 +38739,13 @@ var INTEGRATION_REGISTRY = [
     id: "image-gen",
     name: "Image Generation",
     category: "media",
-    description: "AI image generation for Augmented Live pages. An agent authoring a page passes a text prompt (agt_live.generate_image) and gets back a generated raster image, stored on the page asset CDN so there is no image to source or host. Augmented Team manages the model access for you - there is no key to enter. Generation runs through the Vercel AI Gateway (OpenAI gpt-image-2 today). It is a PREMIUM, usage-billed capability, separate from Augmented Live text and audio: gated on a per-org opt-in and a monthly USD budget, and metered per generated image.",
+    description: "AI image generation from a text prompt. An agent passes a prompt to generate_image and gets back a generated raster image, which it can deliver to a chat channel or embed on an Augmented Live page (ENG-7535). Augmented Team manages the model access for you - there is no key to enter. Generation runs through the Vercel AI Gateway (OpenAI gpt-image-2 today). It is a PREMIUM, usage-billed capability: gated on a per-org opt-in and a monthly USD budget, and metered per generated image.",
     // No vendor key to enter: Augmented owns the shared Vercel AI Gateway virtual
     // key (AI_GATEWAY_API_KEY) that fronts the image providers, so auth is `none`
     // (customers never enter a key), same as ElevenLabs.
     supported_auth_types: ["none"],
     capabilities: [
-      { id: "image-gen:generate", name: "Generate Image", description: "Generate a raster image from a text prompt for an Augmented Live page (agt_live.generate_image)", access: "write" }
+      { id: "image-gen:generate", name: "Generate Image", description: "Generate a raster image from a text prompt (generate_image), deliverable to a chat channel or an Augmented Live page", access: "write" }
     ],
     docs_url: "https://platform.openai.com/docs/guides/images",
     beta: true,
@@ -38762,7 +38762,7 @@ var INTEGRATION_REGISTRY = [
     // declared here; the handler fails CLOSED when the deployed model maps to an
     // undeclared meter, so a version bump without a rate card refuses rather than
     // silently disabling the budget. Adding a model = declare its meter here + seed
-    // its rate card + add a normalizer entry in augmented-live-image-gen.ts.
+    // its rate card + add a normalizer entry in image-generation.ts.
     premium: {
       pricing: "usage",
       note: "Billed per generated image; the rate depends on the model/version used.",
@@ -40033,6 +40033,19 @@ var FLAG_REGISTRY = [
     // env var is retired.
     envVar: "AUGMENTED_CONNECTIVITY_ESCALATION_ENABLED"
   },
+  {
+    key: "managed-health-connectivity-flip",
+    description: "Arm the managed-connection-health status flip on data-plane hard-down (ENG-7539). When on, the managed-connection-health cron flips a managed integration to needs_reauth when the host-side connectivity probe reports a sustained hard-down (consecutive_connectivity_failures at/over the hysteresis threshold with a down observation), even if Composio account-status still reads ACTIVE. When off it keeps the pre-ENG-7539 behaviour: status is driven only by the account-status probe, so a live 401 behind an ACTIVE account never flips status. Boolean gate; ships dark. Sibling of integration-connectivity-escalation: that flag arms the alert; this flag arms the status flip plus the reconnect notification.",
+    flagType: "boolean",
+    // Declared safe value is `false` (no auto status flip). It preserves the
+    // pre-ENG-7539 fleet behaviour where managed status derives solely from the
+    // account-status probe, so merging this dark changes nothing until an
+    // operator arms it per-stage from the admin Feature Flags page. `false` is
+    // also the fail-safe direction: a flag-DB read error must never start
+    // flipping statuses (and firing reconnect notifications) on its own. No env
+    // override - this is a net-new gate, so it is registry-only (ADR-0022).
+    defaultValue: false
+  },
   {
     key: "projects-menu",
     description: "Show the Projects nav item in the webapp (ADR-0017 Projects soft launch, ENG-6342). Replaces the isAdmin/adminOnly gate with a per-org rollout flag.",

package/dist/mcp/remote-oauth-proxy.js

@@ -11,16 +11,38 @@ var URL_ENV = "AGT_REMOTE_MCP_URL";
 var TOKEN_FILE_ENV = "AGT_REMOTE_MCP_TOKEN_FILE";
 var TOKEN_VAR_ENV = "AGT_REMOTE_MCP_TOKEN_VAR";
 var ALLOWLIST_ENV = "AGT_REMOTE_MCP_TOOL_ALLOWLIST";
+var PREENABLE_ENV = "AGT_REMOTE_MCP_PREENABLE_TOOLSETS";
 var REMOTE_FETCH_TIMEOUT_MS = 3e4;
 var remoteUrl = process.env[URL_ENV] ?? "";
 var tokenFile = process.env[TOKEN_FILE_ENV] ?? "";
 var tokenVar = process.env[TOKEN_VAR_ENV] ?? "";
 var label = process.env["AGT_REMOTE_MCP_LABEL"] || tokenVar || "remote-oauth";
 var toolAllowlist = parseToolAllowlist(process.env[ALLOWLIST_ENV] ?? "");
+var preEnableToolsets = parsePreEnableToolsets(process.env[PREENABLE_ENV] ?? "");
 function logErr(msg) {
   process.stderr.write(`[remote-oauth-proxy:${label}] ${msg}
 `);
 }
+function parsePreEnableToolsets(raw) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const part of (raw || "").split(",")) {
+    const name = part.trim();
+    if (name && !seen.has(name)) {
+      seen.add(name);
+      out.push(name);
+    }
+  }
+  return out;
+}
+function buildEnableToolsetRequest(toolset) {
+  return JSON.stringify({
+    jsonrpc: "2.0",
+    id: `agt-preenable-${toolset}`,
+    method: "tools/call",
+    params: { name: "enable_toolset", arguments: { name: toolset } }
+  });
+}
 function parseToolAllowlist(raw) {
   const out = /* @__PURE__ */ new Set();
   for (const part of (raw || "").split(",")) {
@@ -104,12 +126,54 @@ function extractJsonRpcMessages(contentType, body) {
   }
   return out;
 }
+var preEnabledOnce = null;
+function ensurePreEnabled(token) {
+  if (preEnabledOnce) return preEnabledOnce;
+  preEnabledOnce = Promise.allSettled(
+    preEnableToolsets.map(async (name) => {
+      const res = await fetch(remoteUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json, text/event-stream",
+          Authorization: `Bearer ${token}`
+        },
+        body: buildEnableToolsetRequest(name),
+        signal: AbortSignal.timeout(REMOTE_FETCH_TIMEOUT_MS)
+      });
+      const body = await res.text().catch(() => "");
+      if (!res.ok) {
+        throw new Error(`HTTP ${res.status}${body ? ` (${body.slice(0, 200).replace(/\s+/g, " ").trim()})` : ""}`);
+      }
+      let rpcError;
+      try {
+        rpcError = JSON.parse(body)?.error?.message;
+      } catch {
+      }
+      if (rpcError) throw new Error(rpcError);
+      return name;
+    })
+  ).then((results) => {
+    results.forEach((r, i) => {
+      const name = preEnableToolsets[i];
+      if (r.status === "fulfilled") {
+        logErr(`pre-enabled toolset "${name}"`);
+      } else {
+        logErr(`pre-enable toolset "${name}" failed: ${r.reason.message}`);
+      }
+    });
+  });
+  return preEnabledOnce;
+}
 async function forward(line, id, isNotification, method) {
   const token = readCurrentToken(tokenFile, tokenVar);
   if (!token) {
     logErr(`no token in ${tokenFile} (var ${tokenVar})`);
     return isNotification ? [] : [jsonRpcError(id, -32e3, `${label}: no current access token available (reconnect the integration)`)];
   }
+  if (method === "tools/list" && preEnableToolsets.length > 0) {
+    await ensurePreEnabled(token);
+  }
   let res;
   try {
     res = await fetch(remoteUrl, {
@@ -224,10 +288,12 @@ if (invokedDirectly) {
   void main();
 }
 export {
+  buildEnableToolsetRequest,
   extractJsonRpcMessages,
   filterToolsListMessage,
   isToolCallBlocked,
   main,
+  parsePreEnableToolsets,
   parseToolAllowlist,
   readCurrentToken
 };