@integrity-labs/agt-cli 0.28.327 → 0.28.328

package/dist/{claude-pair-runtime-BOFTEAQC.js → claude-pair-runtime-LTZRJHKO.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-BICDYHOC.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-5IV24YKT.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-BOFTEAQC.js.map
+//# sourceMappingURL=claude-pair-runtime-LTZRJHKO.js.map

package/dist/lib/manager-worker.js

@@ -43,7 +43,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-EQMRT6OT.js";
+} from "../chunk-XRO2EOEM.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -132,7 +132,7 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-BSTFCC62.js";
+} from "../chunk-GAWNDPGM.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -8386,7 +8386,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.327" : "dev";
+var agtCliVersion = true ? "0.28.328" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -9282,7 +9282,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-BICDYHOC.js");
+      const { collectDiagnostics } = await import("../persistent-session-5IV24YKT.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -9381,7 +9381,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-BICDYHOC.js");
+      const { collectDiagnostics } = await import("../persistent-session-5IV24YKT.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -9530,7 +9530,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-FEAFPNUF.js");
+      } = await import("../responsiveness-probe-TTGD44MW.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -9562,7 +9562,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-FEAFPNUF.js");
+        } = await import("../responsiveness-probe-TTGD44MW.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -12660,7 +12660,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-BICDYHOC.js");
+        const { collectDiagnostics } = await import("../persistent-session-5IV24YKT.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -12710,7 +12710,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-BICDYHOC.js");
+      const { collectDiagnostics } = await import("../persistent-session-5IV24YKT.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -13208,7 +13208,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-BOFTEAQC.js");
+  } = await import("../claude-pair-runtime-LTZRJHKO.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -14255,6 +14255,67 @@ function writeTurnInitiatorMarker(input) {
   }
 }
 
+// src/direct-chat-pending-inbound.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readdirSync,
+  renameSync as renameSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { join as join3 } from "path";
+function hexEncodeSegment(value) {
+  return Buffer.from(value, "utf8").toString("hex");
+}
+function directChatMarkerName(sessionId, messageId) {
+  return `${hexEncodeSegment(sessionId)}__${hexEncodeSegment(messageId)}.json`;
+}
+var defaultClearMarkerFile = (fullPath) => {
+  try {
+    if (existsSync2(fullPath)) unlinkSync(fullPath);
+  } catch {
+  }
+};
+function directChatInboundId(sessionId, messageId) {
+  return `direct-chat|${sessionId.length}|${sessionId}|${messageId}`;
+}
+function writeDirectChatPendingInboundMarker(dir, sessionId, messageId) {
+  if (!dir || !sessionId || !messageId) return;
+  try {
+    mkdirSync2(dir, { recursive: true });
+    const marker = {
+      channel: "direct-chat",
+      session_id: sessionId,
+      message_id: messageId,
+      received_at: (/* @__PURE__ */ new Date()).toISOString(),
+      inbound_id: directChatInboundId(sessionId, messageId)
+    };
+    const final = join3(dir, directChatMarkerName(sessionId, messageId));
+    const tmp = `${final}.tmp`;
+    writeFileSync2(tmp, JSON.stringify(marker), "utf8");
+    renameSync2(tmp, final);
+  } catch {
+  }
+}
+function clearDirectChatPendingMarkersForSession(dir, sessionId, op = defaultClearMarkerFile) {
+  if (!dir || !sessionId) return 0;
+  const prefix = `${hexEncodeSegment(sessionId)}__`;
+  let cleared = 0;
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return 0;
+  }
+  for (const name of names) {
+    if (!name.startsWith(prefix) || !name.endsWith(".json")) continue;
+    op(join3(dir, name));
+    cleared += 1;
+  }
+  return cleared;
+}
+
 // src/direct-chat-poll-guard.ts
 function evaluatePollGuard(state, nowMs, stuckMs) {
   if (!state.inFlight) return { run: true, stuck: false };
@@ -14277,14 +14338,14 @@ async function fetchWithTimeout(input, init, timeoutMs, fetchImpl = fetch) {
 
 // src/mcp-spawn-lock.ts
 import {
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
-  renameSync as renameSync2,
-  unlinkSync,
-  writeFileSync as writeFileSync2
+  renameSync as renameSync3,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function defaultIsPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   try {
@@ -14302,7 +14363,7 @@ function acquireMcpSpawnLock(args) {
   const isPidAlive = options.isPidAlive ?? defaultIsPidAlive;
   const selfPid = options.selfPid ?? process.pid;
   const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const path = join3(agentDir, basename);
+  const path = join4(agentDir, basename);
   const existing = readLockHolder(path);
   if (existing) {
     if (existing.pid === selfPid) {
@@ -14312,11 +14373,11 @@ function acquireMcpSpawnLock(args) {
       return { kind: "blocked", path, holder: existing };
     }
   }
-  mkdirSync2(agentDir, { recursive: true, mode: 448 });
+  mkdirSync3(agentDir, { recursive: true, mode: 448 });
   const tmpPath = `${path}.${selfPid}.tmp`;
   const payload = { pid: selfPid, started_at: now() };
-  writeFileSync2(tmpPath, JSON.stringify(payload), { mode: 384 });
-  renameSync2(tmpPath, path);
+  writeFileSync3(tmpPath, JSON.stringify(payload), { mode: 384 });
+  renameSync3(tmpPath, path);
   return { kind: "acquired", path };
 }
 function releaseMcpSpawnLock(lockPath, opts = {}) {
@@ -14326,12 +14387,12 @@ function releaseMcpSpawnLock(lockPath, opts = {}) {
   if (!existing) return;
   if (existing.pid !== selfPid) return;
   try {
-    unlinkSync(lockPath);
+    unlinkSync2(lockPath);
   } catch {
   }
 }
 function readLockHolder(path) {
-  if (!existsSync2(path)) return null;
+  if (!existsSync3(path)) return null;
   try {
     const raw = readFileSync3(path, "utf8");
     const parsed = JSON.parse(raw);
@@ -14346,35 +14407,35 @@ function readLockHolder(path) {
 
 // src/direct-chat-channel.ts
 import { homedir as homedir2 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { randomUUID } from "crypto";
 import {
   watch,
-  mkdirSync as mkdirSync3,
-  writeFileSync as writeFileSync3,
+  mkdirSync as mkdirSync4,
+  writeFileSync as writeFileSync4,
   readFileSync as readFileSync5,
-  existsSync as existsSync4,
-  renameSync as renameSync3,
-  unlinkSync as unlinkSync2
+  existsSync as existsSync5,
+  renameSync as renameSync4,
+  unlinkSync as unlinkSync3
 } from "fs";
 
 // src/direct-chat-inbound-attachments.ts
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 var MAX_INBOUND_ATTACHMENT_BYTES = 10 * 1024 * 1024;
 var INBOUND_ATTACHMENTS_SUBDIR = "direct-chat-inbound";
 function resolveInboundAttachmentsDir(input) {
   const { codeName, turnInitiatorFile, agentId, homeDir } = input;
   const codeNameTrimmed = typeof codeName === "string" ? codeName.trim() : "";
   if (codeNameTrimmed) {
-    return join4(homeDir, ".augmented", codeNameTrimmed, INBOUND_ATTACHMENTS_SUBDIR);
+    return join5(homeDir, ".augmented", codeNameTrimmed, INBOUND_ATTACHMENTS_SUBDIR);
   }
   const initiator = typeof turnInitiatorFile === "string" ? turnInitiatorFile.trim() : "";
   if (initiator) {
-    return join4(dirname2(initiator), INBOUND_ATTACHMENTS_SUBDIR);
+    return join5(dirname2(initiator), INBOUND_ATTACHMENTS_SUBDIR);
   }
   const agentIdTrimmed = typeof agentId === "string" ? agentId.trim() : "";
   if (agentIdTrimmed) {
-    return join4(homeDir, ".augmented", agentIdTrimmed, INBOUND_ATTACHMENTS_SUBDIR);
+    return join5(homeDir, ".augmented", agentIdTrimmed, INBOUND_ATTACHMENTS_SUBDIR);
   }
   return null;
 }
@@ -14472,11 +14533,11 @@ async function downloadInboundAttachments(attachments, dir, deps) {
 }
 
 // src/flags-cache-read.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 import { homedir } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 function defaultFlagsCachePath() {
-  return join5(homedir(), ".augmented", "flags-cache.json");
+  return join6(homedir(), ".augmented", "flags-cache.json");
 }
 function envBoolean(raw) {
   if (raw === void 0) return void 0;
@@ -14488,7 +14549,7 @@ function envBoolean(raw) {
 }
 function cachedBoolean(key, path) {
   try {
-    if (!existsSync3(path)) return void 0;
+    if (!existsSync4(path)) return void 0;
     const parsed = JSON.parse(readFileSync4(path, "utf8"));
     if (!parsed || typeof parsed !== "object") return void 0;
     const flags = parsed.flags;
@@ -14826,7 +14887,7 @@ var DIRECT_CHAT_MAINTENANCE_COOLDOWN_MS = (() => {
 var AGT_HOST = process.env.AGT_HOST;
 var AGT_API_KEY = process.env.AGT_API_KEY;
 var AGT_AGENT_ID = process.env.AGT_AGENT_ID;
-var DIRECT_CHAT_AGENT_DIR = AGT_AGENT_ID ? join6(homedir2(), ".augmented", AGT_AGENT_ID) : null;
+var DIRECT_CHAT_AGENT_DIR = AGT_AGENT_ID ? join7(homedir2(), ".augmented", AGT_AGENT_ID) : null;
 var INBOUND_ATTACHMENTS_DIR = resolveInboundAttachmentsDir({
   codeName: process.env.AGT_AGENT_CODE_NAME,
   turnInitiatorFile: process.env.AGT_TURN_INITIATOR_FILE,
@@ -14834,7 +14895,8 @@ var INBOUND_ATTACHMENTS_DIR = resolveInboundAttachmentsDir({
   homeDir: homedir2()
 });
 var AGT_AGENT_CODE_NAME = process.env.AGT_AGENT_CODE_NAME;
-var PROGRESS_HEARTBEAT_PATH = AGT_AGENT_CODE_NAME ? join6(homedir2(), ".augmented", AGT_AGENT_CODE_NAME, "channel-progress-heartbeat.json") : null;
+var PROGRESS_HEARTBEAT_PATH = AGT_AGENT_CODE_NAME ? join7(homedir2(), ".augmented", AGT_AGENT_CODE_NAME, "channel-progress-heartbeat.json") : null;
+var DIRECT_CHAT_PENDING_INBOUND_DIR = AGT_AGENT_CODE_NAME ? join7(homedir2(), ".augmented", AGT_AGENT_CODE_NAME, "direct-chat-pending-inbound") : null;
 var progressReceivedAt = /* @__PURE__ */ new Map();
 var directChatProgressState = { tracked: null };
 var directChatProgressTickRunning = false;
@@ -14851,7 +14913,7 @@ var directChatKanbanCardClient = createKanbanCardActiveClient({
 `)
 });
 function readProgressHeartbeat() {
-  if (!PROGRESS_HEARTBEAT_PATH || !existsSync4(PROGRESS_HEARTBEAT_PATH)) return null;
+  if (!PROGRESS_HEARTBEAT_PATH || !existsSync5(PROGRESS_HEARTBEAT_PATH)) return null;
   try {
     return parseProgressHeartbeat(readFileSync5(PROGRESS_HEARTBEAT_PATH, "utf-8"));
   } catch {
@@ -14862,12 +14924,12 @@ function seedProgressHeartbeat() {
   if (!PROGRESS_HEARTBEAT_PATH) return;
   const tmp = `${PROGRESS_HEARTBEAT_PATH}.${process.pid}.tmp`;
   try {
-    mkdirSync3(join6(homedir2(), ".augmented", AGT_AGENT_CODE_NAME), { recursive: true });
-    writeFileSync3(tmp, serializeProgressHeartbeat(SEED_PROGRESS_STEP, Date.now()), { mode: 384 });
-    renameSync3(tmp, PROGRESS_HEARTBEAT_PATH);
+    mkdirSync4(join7(homedir2(), ".augmented", AGT_AGENT_CODE_NAME), { recursive: true });
+    writeFileSync4(tmp, serializeProgressHeartbeat(SEED_PROGRESS_STEP, Date.now()), { mode: 384 });
+    renameSync4(tmp, PROGRESS_HEARTBEAT_PATH);
   } catch {
     try {
-      unlinkSync2(tmp);
+      unlinkSync3(tmp);
     } catch {
     }
   }
@@ -15020,9 +15082,9 @@ var inboundAttachmentDeps = {
       bytes: async () => new Uint8Array(await res.arrayBuffer())
     };
   },
-  ensureDir: (dir) => mkdirSync3(dir, { recursive: true }),
-  writeFile: (path, bytes) => writeFileSync3(path, bytes, { mode: 384 }),
-  joinPath: (...parts) => join6(...parts),
+  ensureDir: (dir) => mkdirSync4(dir, { recursive: true }),
+  writeFile: (path, bytes) => writeFileSync4(path, bytes, { mode: 384 }),
+  joinPath: (...parts) => join7(...parts),
   warn: (msg) => process.stderr.write(`${msg}
 `)
 };
@@ -15190,6 +15252,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
           };
         }
         claimTracker.clear(session_id, message_ids);
+        clearDirectChatPendingMarkersForSession(DIRECT_CHAT_PENDING_INBOUND_DIR, session_id);
         const messageId = data.message_id;
         for (let i = 1; i < slices.length; i++) {
           await sleep(STREAM_REPLY_FLUSH_MS);
@@ -15234,6 +15297,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
         };
       }
       claimTracker.clear(session_id, message_ids);
+      clearDirectChatPendingMarkersForSession(DIRECT_CHAT_PENDING_INBOUND_DIR, session_id);
       return { content: [{ type: "text", text: "sent" }] };
     } catch (err) {
       return {
@@ -15262,6 +15326,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
         };
       }
       claimTracker.clear(session_id, message_ids);
+      clearDirectChatPendingMarkersForSession(DIRECT_CHAT_PENDING_INBOUND_DIR, session_id);
       return { content: [{ type: "text", text: "consumed" }] };
     } catch (err) {
       return {
@@ -15361,6 +15426,13 @@ async function pollForMessages(sinceMs) {
           }
         }
       });
+      if (!isNotice) {
+        writeDirectChatPendingInboundMarker(
+          DIRECT_CHAT_PENDING_INBOUND_DIR,
+          msg.session_id,
+          msg.id
+        );
+      }
       if (!isNotice && msg.sender_id) {
         writeTurnInitiatorMarker({
           channel: "direct-chat",
@@ -15450,7 +15522,7 @@ var doorbellWatcher = null;
 var safetyNetTimer = null;
 if (DOORBELL_ENABLED && DIRECT_CHAT_AGENT_DIR) {
   try {
-    mkdirSync3(DIRECT_CHAT_AGENT_DIR, { recursive: true });
+    mkdirSync4(DIRECT_CHAT_AGENT_DIR, { recursive: true });
   } catch {
   }
   const sessionState = readDirectChatSessionState(DIRECT_CHAT_AGENT_DIR, Date.now());

package/dist/mcp/origami.js

@@ -39592,7 +39592,8 @@ var WAITING_KINDS = [
   "pr-merged",
   "human",
   "external",
-  "other"
+  "other",
+  "approval"
 ];
 var WAITING_KIND_SET = new Set(WAITING_KINDS);
 
@@ -39985,6 +39986,16 @@ var FLAG_REGISTRY = [
     defaultValue: false,
     envVar: "AGT_LIVE_STREAM_PRODUCER_ENABLED"
   },
+  {
+    key: "auto-provision-agt-live",
+    description: "Auto-provision the Augmented Live integration (free tier, watermarked) into every NEW organization as an org-scoped install (ENG-7819). Consumed in TWO places: the seed_default_live_integration AFTER INSERT trigger on organizations reads the EXPLICIT feature_flags row (a plpgsql trigger cannot see this compiled default, so dark = no row = trigger no-ops; flipping the flag on this page writes the row the trigger reads - GLOBAL value only, per-org overrides are not consulted by the trigger), and the POST /organizations route evaluates it normally to send the owner provisioning notice. Restricted-posture orgs are skipped; opt-out (remove/block) is permanent - no reconciler. Boolean gate; ships dark. Pre-flip gates: docs/operator/default-integrations-admission.md.",
+    flagType: "boolean",
+    defaultValue: false,
+    // Grants every new open org a public-publishing capability by default;
+    // flipping it on is fleet-shaping and worth an explicit confirm (ADR-0022
+    // §4, same treatment as augmented-support-auto-provision).
+    sensitive: true
+  },
   {
     key: "admin-live-pane",
     description: "Live agent pane streaming on the platform-admin surfaces (ENG-6588): the agent Diagnostics tab and the /admin embed poll GET /admin/agents/:id/pane (tmux capture-pane over SSM) ~every 3s for a bounded window. Boolean gate; ships dark; when OFF the route returns feature_disabled and the UI falls back to the 30s static diagnostics snapshot. It is the no-deploy kill switch bounding the shared-SSM blast radius (SSM SendCommand throttles account-wide, shared with incident-response runbooks).",

package/dist/{persistent-session-BICDYHOC.js → persistent-session-5IV24YKT.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-BSTFCC62.js";
+} from "./chunk-GAWNDPGM.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-BICDYHOC.js.map
+//# sourceMappingURL=persistent-session-5IV24YKT.js.map

package/dist/{responsiveness-probe-FEAFPNUF.js → responsiveness-probe-TTGD44MW.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-BSTFCC62.js";
+} from "./chunk-GAWNDPGM.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -427,4 +427,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-FEAFPNUF.js.map
+//# sourceMappingURL=responsiveness-probe-TTGD44MW.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.327",
+  "version": "0.28.328",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {