@integrity-labs/agt-cli 0.28.292 → 0.28.293

package/dist/{claude-pair-runtime-DVAUH47F.js → claude-pair-runtime-EWJQ5QXS.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-WVLFEQPW.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-7Z33SV2X.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-DVAUH47F.js.map
+//# sourceMappingURL=claude-pair-runtime-EWJQ5QXS.js.map

package/dist/lib/manager-worker.js

@@ -39,7 +39,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-PTJHDSJU.js";
+} from "../chunk-D6SMNBPT.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -126,7 +126,7 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-BNQPLUUB.js";
+} from "../chunk-IGADZDYT.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -6922,7 +6922,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.292" : "dev";
+var agtCliVersion = true ? "0.28.293" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7775,7 +7775,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-WVLFEQPW.js");
+      const { collectDiagnostics } = await import("../persistent-session-7Z33SV2X.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -7873,7 +7873,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-WVLFEQPW.js");
+      const { collectDiagnostics } = await import("../persistent-session-7Z33SV2X.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -8021,7 +8021,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-VCOYMMIT.js");
+      } = await import("../responsiveness-probe-RPX63Y5S.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8053,7 +8053,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-VCOYMMIT.js");
+        } = await import("../responsiveness-probe-RPX63Y5S.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -10981,7 +10981,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-WVLFEQPW.js");
+        const { collectDiagnostics } = await import("../persistent-session-7Z33SV2X.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -11031,7 +11031,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-WVLFEQPW.js");
+      const { collectDiagnostics } = await import("../persistent-session-7Z33SV2X.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -11435,7 +11435,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-DVAUH47F.js");
+  } = await import("../claude-pair-runtime-EWJQ5QXS.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -13907,7 +13907,8 @@ function createInboundContextClient(args) {
       agent_id: agentId,
       source_integration: args2.sourceIntegration,
       source_external_id: args2.sourceExternalId,
-      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {}
+      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {},
+      ...args2.senderId ? { sender_id: args2.senderId } : {}
     };
     try {
       let resp = await postOnce(body);
@@ -15351,7 +15352,9 @@ async function pollForMessages(sinceMs) {
       }
       inboundContextClient?.recordInbound({
         sourceIntegration: "direct-chat",
-        sourceExternalId: msg.session_id
+        sourceExternalId: msg.session_id,
+        // ENG-7643 (P4a): the D16 verified sender uuid (requester identity).
+        ...msg.sender_id ? { senderId: msg.sender_id } : {}
       });
       process.stderr.write(
         `direct-chat-channel: Injected message ${msg.id} (session=${msg.session_id})

package/dist/mcp/origami.js

@@ -39644,6 +39644,20 @@ var FLAG_REGISTRY = [
     // sensitive.
     public: true
   },
+  {
+    key: "integration-cap-enforcement",
+    description: "Enforce the per-agent integration cap (ENG-7180 / ENG-7639). When ON for an org, adding an integration to an agent already at its plan cap (plans.max_integrations_per_agent, default 10) is refused with a 409 across all three attach paths (POST /integrations, the OAuth callback, and the GitHub App manifest-init), and GET /integrations/agent-cap reports at_limit so the webapp Add control blocks. When OFF (default) the cap is not enforced - an agent can add integrations without limit and agent-cap reports at_limit=false. Evaluated per-org API-side via getEvaluatedFlags; the authoritative BEFORE INSERT DB trigger was removed in ENG-7639, so the flag-gated app-level pre-flights are the sole enforcement point. Boolean gate; ships OFF (enforcement disabled) - flip ON per org from the admin Feature Flags page to re-arm the cap.",
+    flagType: "boolean",
+    // Declared safe value is `false` = NOT enforced. This is both the ENG-7639
+    // intent (disable the cap for now) and the fail-safe direction for the route
+    // read: a flag-DB error degrades to "don't enforce", so a flags outage never
+    // blocks a customer's integration add. Flip on per org to re-arm enforcement.
+    defaultValue: false,
+    // Enforcement gate: leaving it OFF relaxes a plan-capacity control and turning
+    // it ON blocks customer adds - either way it is a deliberate, audited decision,
+    // so mutations require explicit confirmation (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "augmented-live-stream-producer",
     description: "Augmented Live live-preview streaming producer (ENG-7210). The receiver (codec, artifact-draft channel, stream route, console Live Preview tab) shipped under ENG-6234 but never engages because nothing writes the working file the manager scanner watches. When ON for an org, a host-side PostToolUse hook mirrors agt-live.publish/editing content to ~/.augmented/{codeName}/artifacts/<slug>/index.html, so the scanner mints a draft and streams a keyframe to the console Live Preview tab. Additive, best-effort. Boolean gate; ships dark. Materialized to the host flags-cache; the bash hook reads it (operator/canary override AGT_LIVE_STREAM_PRODUCER_ENABLED).",

package/dist/mcp/slack-channel.js

@@ -17766,7 +17766,8 @@ function createInboundContextClient(args) {
       agent_id: agentId,
       source_integration: args2.sourceIntegration,
       source_external_id: args2.sourceExternalId,
-      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {}
+      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {},
+      ...args2.senderId ? { sender_id: args2.senderId } : {}
     };
     try {
       let resp = await postOnce(body);
@@ -22402,7 +22403,9 @@ ${forwarded.text}` : forwarded.text;
         if (!isFromBot && threadTs) {
           inboundContextClient?.recordInbound({
             sourceIntegration: "slack",
-            sourceExternalId: `${channel}:${threadTs}`
+            sourceExternalId: `${channel}:${threadTs}`,
+            // ENG-7643 (P4a): the platform-verified Slack sender (requester id).
+            ...evt.user ? { senderId: evt.user } : {}
           });
         }
       }

package/dist/mcp/teams-channel.js

@@ -14672,7 +14672,8 @@ function createInboundContextClient(args) {
       agent_id: agentId,
       source_integration: args2.sourceIntegration,
       source_external_id: args2.sourceExternalId,
-      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {}
+      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {},
+      ...args2.senderId ? { sender_id: args2.senderId } : {}
     };
     try {
       let resp = await postOnce(body);
@@ -15485,7 +15486,9 @@ async function processPendingFile(filename) {
       inboundContextClient?.recordInbound({
         sourceIntegration: "msteams",
         sourceExternalId: `${activity.conversation.id}#${rootActivityId}`,
-        sourceUrl: activity.serviceUrl
+        sourceUrl: activity.serviceUrl,
+        // ENG-7643 (P4a): the Teams AAD object id of the sender (requester id).
+        ...activity.from?.aadObjectId ? { senderId: activity.from.aadObjectId } : {}
       });
     }
   }

package/dist/mcp/telegram-channel.js

@@ -16471,7 +16471,8 @@ function createInboundContextClient(args) {
       agent_id: agentId,
       source_integration: args2.sourceIntegration,
       source_external_id: args2.sourceExternalId,
-      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {}
+      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {},
+      ...args2.senderId ? { sender_id: args2.senderId } : {}
     };
     try {
       let resp = await postOnce(body);
@@ -20960,7 +20961,10 @@ async function pollLoop() {
         if (!isFromBot && !peerAgentMeta) {
           inboundContextClient?.recordInbound({
             sourceIntegration: "telegram",
-            sourceExternalId: String(chatId)
+            sourceExternalId: String(chatId),
+            // ENG-7643 (P4a): the verified Telegram from-id (requester id);
+            // 'unknown' means from.id was absent, so don't record it.
+            ...userId && userId !== "unknown" ? { senderId: String(userId) } : {}
           });
         }
       }

package/dist/{persistent-session-WVLFEQPW.js → persistent-session-7Z33SV2X.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-BNQPLUUB.js";
+} from "./chunk-IGADZDYT.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-WVLFEQPW.js.map
+//# sourceMappingURL=persistent-session-7Z33SV2X.js.map

package/dist/{responsiveness-probe-VCOYMMIT.js → responsiveness-probe-RPX63Y5S.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-BNQPLUUB.js";
+} from "./chunk-IGADZDYT.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -418,4 +418,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-VCOYMMIT.js.map
+//# sourceMappingURL=responsiveness-probe-RPX63Y5S.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.292",
+  "version": "0.28.293",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {