@integrity-labs/agt-cli 0.28.297 → 0.28.298

package/dist/{chunk-VTSO7X7P.js → chunk-EF42DMMK.js}

@@ -18,7 +18,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-QXU5FMXN.js";
+} from "./chunk-5LUVY4P6.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5882,7 +5882,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.297" : "dev";
+var agtCliVersion = true ? "0.28.298" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8181,4 +8181,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-VTSO7X7P.js.map
+//# sourceMappingURL=chunk-EF42DMMK.js.map

package/dist/{claude-pair-runtime-BIBIVB7I.js → claude-pair-runtime-UTQO3G5A.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-A5N7BYS3.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-ZQUFIWLK.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-BIBIVB7I.js.map
+//# sourceMappingURL=claude-pair-runtime-UTQO3G5A.js.map

package/dist/lib/manager-worker.js

@@ -39,7 +39,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-VTSO7X7P.js";
+} from "../chunk-EF42DMMK.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -126,7 +126,7 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-QXU5FMXN.js";
+} from "../chunk-5LUVY4P6.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -6947,7 +6947,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.297" : "dev";
+var agtCliVersion = true ? "0.28.298" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7802,7 +7802,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-A5N7BYS3.js");
+      const { collectDiagnostics } = await import("../persistent-session-ZQUFIWLK.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -7900,7 +7900,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-A5N7BYS3.js");
+      const { collectDiagnostics } = await import("../persistent-session-ZQUFIWLK.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -8048,7 +8048,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-OZP2HO2F.js");
+      } = await import("../responsiveness-probe-BFB2G333.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8080,7 +8080,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-OZP2HO2F.js");
+        } = await import("../responsiveness-probe-BFB2G333.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -11051,7 +11051,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-A5N7BYS3.js");
+        const { collectDiagnostics } = await import("../persistent-session-ZQUFIWLK.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -11101,7 +11101,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-A5N7BYS3.js");
+      const { collectDiagnostics } = await import("../persistent-session-ZQUFIWLK.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -11506,7 +11506,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-BIBIVB7I.js");
+  } = await import("../claude-pair-runtime-UTQO3G5A.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/index.js

@@ -22533,6 +22533,9 @@ server.tool(
       "Short form title (max 24 chars - the Slack modal title limit), shown on the button and as the modal heading. Put longer context in intro."
     ),
     intro: external_exports.string().max(1e3).optional().describe("Optional context shown above the button and inside the modal (what you are asking and why)."),
+    button_label: external_exports.string().min(1).max(75).optional().describe(
+      'Optional label for the button that opens the form (max 75 chars). Defaults to "Fill out form". Use a specific call-to-action so the person knows what they are opening, e.g. "Start intake", "Give feedback", "Book a slot", "Submit your update".'
+    ),
     schema: external_exports.record(external_exports.unknown()).describe(
       'The form definition as a constrained JSON Schema: { "type": "object", "properties": { "<field>": { "type": "string|number|integer|boolean|array", "enum"?: [...], "format"?: "date|time|date-time|email|uri", ... } }, "required": ["..."] }. Flat only - no nested objects or oneOf/anyOf/allOf.'
     ),
@@ -22555,6 +22558,7 @@ server.tool(
         ...params.thread_ts ? { thread_ts: params.thread_ts } : {},
         title: params.title,
         ...params.intro ? { intro: params.intro } : {},
+        ...params.button_label ? { button_label: params.button_label } : {},
         schema: params.schema,
         ...params.request_id ? { request_id: params.request_id } : {}
       });

package/dist/mcp/origami.js

@@ -38842,7 +38842,10 @@ var INTEGRATION_REGISTRY = [
       note: "Billed per second of generated video; the rate depends on the resolution.",
       meters: [
         { event_type: "grok_imagine_video_1_5_480p", unit: "second" },
-        { event_type: "grok_imagine_video_1_5_720p", unit: "second" }
+        { event_type: "grok_imagine_video_1_5_720p", unit: "second" },
+        // 1080p is image-to-video only (xAI restriction); metered when the
+        // agent supplies image_url (ENG-7675).
+        { event_type: "grok_imagine_video_1_5_1080p", unit: "second" }
       ]
     }
   },
@@ -40115,6 +40118,41 @@ var FLAG_REGISTRY = [
     // safety control, so mutations require explicit confirmation.
     sensitive: true
   },
+  {
+    key: "composio-hitl-mode",
+    description: "Composio managed-toolkits HITL gate (ENG-6027): off = kill switch, shadow = resolve + audit the tier decision but never block, enforce = block write_high_risk+ calls (routed to approval when hitl-approval-routing is on). Per-org rollout from the admin Feature Flags page; ENG-7672 migrated this off the fleet-wide COMPOSIO_HITL_MODE env var.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Declared safe value is `shadow` (resolve + audit, never block) — NOT `off`.
+    // shadow keeps the control evaluating + producing enforce-flip evidence while
+    // staying non-blocking, and matches the pre-flag compiled default so migrating
+    // onto the flag (ENG-7672) preserves fleet behaviour. A flag-DB read error
+    // degrades here. `enforce` is the deliberate, audited flip.
+    defaultValue: "shadow",
+    // Migration override (ADR-0022): the pre-flags env gate stays the
+    // highest-precedence operator override. It is only injected onto the Lambdas
+    // when an operator explicitly sets it (sst.config.ts) — otherwise this flag governs.
+    envVar: "COMPOSIO_HITL_MODE",
+    // enforce blocks prod tool calls, so weakening it (enforce → shadow/off) drops a
+    // safety control — mutations require explicit confirmation.
+    sensitive: true
+  },
+  {
+    key: "hitl-approval-routing",
+    description: "Routing for HITL-blocked integration calls (ENG-6028): off = blocked calls return the terminal block, on = route them into the approval-core flow (approval_requests row + Slack approval card). Needs a block first (composio-hitl-mode=enforce, or the always-on Direct-HTTP lane). Per-org rollout; ENG-7672 migrated this off the fleet-wide HITL_APPROVAL_ROUTING env var.",
+    flagType: "enum",
+    allowedValues: ["off", "on"],
+    // Declared safe value is `off` (terminal block, no new side effects) — the
+    // most-restrictive-known state, matching the pre-flag default. A flag-DB read
+    // error degrades here.
+    defaultValue: "off",
+    // Migration override (ADR-0022): only injected onto the Lambdas when an operator
+    // explicitly sets it (sst.config.ts) — otherwise this flag governs.
+    envVar: "HITL_APPROVAL_ROUTING",
+    // Turning routing on starts minting approval cards / approval_requests rows — an
+    // egress + workflow change worth an explicit confirm.
+    sensitive: true
+  },
   {
     key: "slack-reply-binding",
     description: "Slack reply-target binding (ENG-7396 / WS2, cross-thread reply routing): the model names which inbound it answers (inbound_id) and the server resolves the destination from its own verified record. shadow = classify + count only, routing unchanged; warn = same routing plus a tool-result note so the model self-corrects; enforce = route a bound reply to the registry thread and REJECT a reply whose target matches no inbound this process delivered. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_SLACK_REPLY_BINDING spawn env (the operator/canary override, ADR-0022). Ships shadow.",

package/dist/mcp/slack-channel.js

@@ -15629,7 +15629,8 @@ var SLACK_EGRESS_TOOLS = /* @__PURE__ */ new Set([
   "slack.react",
   "slack.send_structured",
   "slack.ask_user",
-  "slack.upload_file"
+  "slack.upload_file",
+  "slack.update"
 ]);
 
 // src/strip-repost-preamble.ts
@@ -20417,6 +20418,25 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
         required: ["channel", "timestamp", "emoji"]
       }
     },
+    {
+      name: "slack.update",
+      description: 'Edit the text of a Slack message YOU already sent (Slack chat.update). Pass the channel and the message\'s ts (slack.reply returns it as `(ts=\u2026)` on a successful send) plus the new text. You can only edit your OWN messages. This REPLACES the message text - any block layout on the original is cleared - so use it to correct a typo or update a message in place instead of posting a new one. NOTE: editing an interim "On it\u2026" into the final answer does NOT clear the pending-reply obligation - your final answer must still be a separate slack.reply (interim omitted). Common Slack errors: message_not_found (wrong ts/channel), cant_update_message (not your message), edit_window_closed.',
+      inputSchema: {
+        type: "object",
+        properties: {
+          channel: {
+            type: "string",
+            description: "Slack channel ID the message is in (the same channel you sent it to)."
+          },
+          ts: {
+            type: "string",
+            description: 'Timestamp of the message to edit - the `ts` value slack.reply returned when you sent it (e.g. "1783902864.258519"). Must be a message the bot itself sent.'
+          },
+          text: { type: "string", description: "The new message text. Replaces the existing text." }
+        },
+        required: ["channel", "ts", "text"]
+      }
+    },
     {
       name: "slack.read_thread",
       description: "Read the full message history of a Slack thread. Inbound thread replies already carry the surrounding thread inline as the <channel> tag's thread_context attribute \u2014 ground your reply in that first, and only call this tool when you need MORE history than thread_context shows (it is capped to recent messages) or to catch up on an auto-followed thread.",
@@ -20820,8 +20840,10 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
           }
         })();
       }
+      const base = bindingFeedback ? `sent. ${bindingFeedback}` : "sent";
+      const sentTs = typeof data.ts === "string" ? data.ts : void 0;
       return {
-        content: [{ type: "text", text: bindingFeedback ? `sent. ${bindingFeedback}` : "sent" }]
+        content: [{ type: "text", text: sentTs ? `${base} (ts=${sentTs})` : base }]
       };
     } catch (err) {
       return {
@@ -20868,6 +20890,40 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       };
     }
   }
+  if (name === "slack.update") {
+    const { channel, ts, text } = args;
+    if (!channel || !ts || typeof text !== "string") {
+      return {
+        content: [{ type: "text", text: "slack.update requires channel, ts and text" }],
+        isError: true
+      };
+    }
+    try {
+      const res = await fetch("https://slack.com/api/chat.update", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json; charset=utf-8",
+          Authorization: `Bearer ${BOT_TOKEN}`
+        },
+        // text only: chat.update replaces the message, clearing any prior blocks.
+        body: JSON.stringify({ channel, ts, text }),
+        signal: AbortSignal.timeout(8e3)
+      });
+      const data = await res.json();
+      if (!data.ok) {
+        return {
+          content: [{ type: "text", text: `Slack error: ${data.error}` }],
+          isError: true
+        };
+      }
+      return { content: [{ type: "text", text: "updated" }] };
+    } catch (err) {
+      return {
+        content: [{ type: "text", text: `Failed: ${err.message}` }],
+        isError: true
+      };
+    }
+  }
   if (name === "slack.read_thread") {
     const { channel, thread_ts, limit: rawLimit } = args;
     const limit = Math.min(Math.max(rawLimit ?? 50, 1), 200);

package/dist/{persistent-session-A5N7BYS3.js → persistent-session-ZQUFIWLK.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-QXU5FMXN.js";
+} from "./chunk-5LUVY4P6.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-A5N7BYS3.js.map
+//# sourceMappingURL=persistent-session-ZQUFIWLK.js.map

package/dist/{responsiveness-probe-OZP2HO2F.js → responsiveness-probe-BFB2G333.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-QXU5FMXN.js";
+} from "./chunk-5LUVY4P6.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -418,4 +418,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-OZP2HO2F.js.map
+//# sourceMappingURL=responsiveness-probe-BFB2G333.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.297",
+  "version": "0.28.298",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {