@integrity-labs/agt-cli 0.28.419 → 0.28.421

package/dist/{chunk-W63FDJBY.js → chunk-HVVEMQWZ.js}

@@ -25,7 +25,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-IKQHNN7I.js";
+} from "./chunk-B4NX2T2H.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6011,7 +6011,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.419" : "dev";
+var agtCliVersion = true ? "0.28.421" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8515,4 +8515,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-W63FDJBY.js.map
+//# sourceMappingURL=chunk-HVVEMQWZ.js.map

package/dist/{claude-pair-runtime-UOH5MOK4.js → claude-pair-runtime-ZTZR3VCN.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-AYCUX4DJ.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-2OYYXMM7.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-UOH5MOK4.js.map
+//# sourceMappingURL=claude-pair-runtime-ZTZR3VCN.js.map

package/dist/lib/manager-worker.js

@@ -45,7 +45,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-W63FDJBY.js";
+} from "../chunk-HVVEMQWZ.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -150,7 +150,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-IKQHNN7I.js";
+} from "../chunk-B4NX2T2H.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -9458,7 +9458,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.419" : "dev";
+var agtCliVersion = true ? "0.28.421" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -10606,7 +10606,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-AYCUX4DJ.js");
+      const { collectDiagnostics } = await import("../persistent-session-2OYYXMM7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor)
@@ -10713,7 +10713,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-AYCUX4DJ.js");
+      const { collectDiagnostics } = await import("../persistent-session-2OYYXMM7.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor) : void 0;
       let tailscaleHostname;
@@ -10827,7 +10827,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-AQUOYHCE.js");
+      } = await import("../responsiveness-probe-7OOA57BP.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -10866,7 +10866,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-AQUOYHCE.js");
+        } = await import("../responsiveness-probe-7OOA57BP.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-HYOOQV4A.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14177,7 +14177,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-AYCUX4DJ.js");
+        const { collectDiagnostics } = await import("../persistent-session-2OYYXMM7.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor)
@@ -14227,7 +14227,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-AYCUX4DJ.js");
+      const { collectDiagnostics } = await import("../persistent-session-2OYYXMM7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor)
@@ -14680,7 +14680,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-UOH5MOK4.js");
+  } = await import("../claude-pair-runtime-ZTZR3VCN.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -32300,19 +32300,27 @@ var env = new import_nunjucks.default.Environment(null, { autoescape: false });
 
 // ../core/dist/provisioning/ec2-capacity.js
 var CAPACITY_TABLE = {
-  // t3 family — burst-credit instances. Lookup is per-vCPU plus
-  // headroom for the manager process itself.
+  // t3 family — burstable (CPU credits). Fine for these mostly-I/O-bound
+  // agents; the monitor + resize path cover the rare sustained-load case.
   "t3.micro": 1,
-  //   1 vCPU /  1 GB — barely fits one agent
-  "t3.small": 1,
-  //   2 vCPU /  2 GB — still tight
-  "t3.medium": 2,
-  //  2 vCPU /  4 GB — the sweet spot for a 2-agent host
-  "t3.large": 4,
-  //   2 vCPU /  8 GB — bursts cover the headroom
-  "t3.xlarge": 8,
+  //    2 vCPU /  1 GB — floor
+  "t3.small": 2,
+  //    2 vCPU /  2 GB
+  "t3.medium": 4,
+  //   2 vCPU /  4 GB
+  "t3.large": 8,
+  //    2 vCPU /  8 GB
+  "t3.xlarge": 16,
   //  4 vCPU / 16 GB
-  "t3.2xlarge": 16
+  "t3.2xlarge": 32,
+  // 8 vCPU / 32 GB
+  // m6i family — fixed performance (no burst-credit cliff), the preferred
+  // family for dense / sustained multi-agent hosts (e.g. Enterprise default).
+  "m6i.large": 8,
+  //    2 vCPU /  8 GB
+  "m6i.xlarge": 16,
+  //  4 vCPU / 16 GB
+  "m6i.2xlarge": 32
   // 8 vCPU / 32 GB
 };
 var KNOWN_INSTANCE_TYPES = Object.keys(CAPACITY_TABLE);
@@ -34654,6 +34662,27 @@ var FLAG_REGISTRY = [
     // change (ADR-0022 sensitive-flag confirm).
     sensitive: true
   },
+  {
+    key: "slack-scheduled-channel-guard",
+    description: 'Guard on slack.reply that refuses to let an active scheduled-task destination silently move a reply to a DIFFERENT channel than the agent named (ENG-8137). CS-1505 gave an explicit inbound_id priority over the task destination but left the no-inbound_id case treating "no inbound reference" as "no destination specified" - and `channel` is a REQUIRED argument, so every call names one. The symptom: a question asked in one channel answered in another, and a reply meant as a DM landing in a public channel. Fires only when the marker carries an EXPLICIT target, the named channel differs from it, and neither an inbound_id, an enforce binding, nor an ENG-7542 channel correction is available to arbitrate. off = never runs (today behaviour: silent retarget). shadow = count + log the would-block but STILL route as today, so the false-positive rate is measurable before anyone refuses a send. enforce = block the reply and tell the agent to retry. Read live from the heartbeat flags-cache (or the env override). NOTE: enforce is currently CLAMPED to shadow host-side and setting it here will not take effect - it stays blocked until ENG-8142 teaches the Stop hook to tell a refused reply from a delivered one, because until then a blocked send fails silently (no recovery, no re-prompt, nothing in the channel). Lifting the clamp is a code change, not a flag flip.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships in SHADOW, not off: the counter is the whole point - the fleet metric
+    // is currently blind to this misroute, which is why it went unnoticed. shadow
+    // is a free local log line + counter (no model spend, no behaviour change), so
+    // it measures the fire rate immediately. enforce turns a misroute into a
+    // REFUSED send, which trades a confidentiality risk for an availability one -
+    // that is the audited per-org flip, taken after reading the shadow numbers and
+    // after ENG-8143 shrinks the stale-marker window that dominates the false
+    // positives.
+    defaultValue: "shadow",
+    // Enum override AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE (off|shadow|enforce),
+    // resolved by resolveSlackScheduledChannelGuardMode in the channel-server bundle.
+    envVar: "AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE",
+    // enforce REFUSES a send the agent asked to make - a visible availability
+    // change, so flipping toward it is deliberate (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+  },
   {
     key: "slack-hot-thread-guard",
     description: "Server-side hot-thread guard on the slack.reply surface (ENG-7462). Prevents an agent posting a NEW top-level Slack message when it meant to reply inside the thread it is already working in - a prompt/memory rule proved insufficient (the agent had the rule and still slipped). When a reply would otherwise post to channel ROOT (no thread_ts / message_ts / inbound_id, no active kanban card) and the agent has a recent active thread in that channel (its last bot-posted thread, from the persisted trackedThreads cache, within a freshness window), the reply is redirected into that thread. proactive:true no longer implies channel root; posting at root becomes a deliberate action (the to_channel_root flag, or the thread_ts:null sentinel). off = guard never runs, replies with no coords root exactly as today (ships dark). shadow = compute + log the would-redirect but STILL post to root (measure the fire rate before acting). enforce = apply the redirect (a soft-block: redirect + inform, never a hard rejection). Read live from the heartbeat flags-cache (or the env override); enforce is a deliberate per-org flip after a shadow soak.",

package/dist/mcp/origami.js

@@ -37952,19 +37952,27 @@ var env = new import_nunjucks.default.Environment(null, { autoescape: false });
 
 // ../core/dist/provisioning/ec2-capacity.js
 var CAPACITY_TABLE = {
-  // t3 family — burst-credit instances. Lookup is per-vCPU plus
-  // headroom for the manager process itself.
+  // t3 family — burstable (CPU credits). Fine for these mostly-I/O-bound
+  // agents; the monitor + resize path cover the rare sustained-load case.
   "t3.micro": 1,
-  //   1 vCPU /  1 GB — barely fits one agent
-  "t3.small": 1,
-  //   2 vCPU /  2 GB — still tight
-  "t3.medium": 2,
-  //  2 vCPU /  4 GB — the sweet spot for a 2-agent host
-  "t3.large": 4,
-  //   2 vCPU /  8 GB — bursts cover the headroom
-  "t3.xlarge": 8,
+  //    2 vCPU /  1 GB — floor
+  "t3.small": 2,
+  //    2 vCPU /  2 GB
+  "t3.medium": 4,
+  //   2 vCPU /  4 GB
+  "t3.large": 8,
+  //    2 vCPU /  8 GB
+  "t3.xlarge": 16,
   //  4 vCPU / 16 GB
-  "t3.2xlarge": 16
+  "t3.2xlarge": 32,
+  // 8 vCPU / 32 GB
+  // m6i family — fixed performance (no burst-credit cliff), the preferred
+  // family for dense / sustained multi-agent hosts (e.g. Enterprise default).
+  "m6i.large": 8,
+  //    2 vCPU /  8 GB
+  "m6i.xlarge": 16,
+  //  4 vCPU / 16 GB
+  "m6i.2xlarge": 32
   // 8 vCPU / 32 GB
 };
 var KNOWN_INSTANCE_TYPES = Object.keys(CAPACITY_TABLE);
@@ -40270,6 +40278,27 @@ var FLAG_REGISTRY = [
     // change (ADR-0022 sensitive-flag confirm).
     sensitive: true
   },
+  {
+    key: "slack-scheduled-channel-guard",
+    description: 'Guard on slack.reply that refuses to let an active scheduled-task destination silently move a reply to a DIFFERENT channel than the agent named (ENG-8137). CS-1505 gave an explicit inbound_id priority over the task destination but left the no-inbound_id case treating "no inbound reference" as "no destination specified" - and `channel` is a REQUIRED argument, so every call names one. The symptom: a question asked in one channel answered in another, and a reply meant as a DM landing in a public channel. Fires only when the marker carries an EXPLICIT target, the named channel differs from it, and neither an inbound_id, an enforce binding, nor an ENG-7542 channel correction is available to arbitrate. off = never runs (today behaviour: silent retarget). shadow = count + log the would-block but STILL route as today, so the false-positive rate is measurable before anyone refuses a send. enforce = block the reply and tell the agent to retry. Read live from the heartbeat flags-cache (or the env override). NOTE: enforce is currently CLAMPED to shadow host-side and setting it here will not take effect - it stays blocked until ENG-8142 teaches the Stop hook to tell a refused reply from a delivered one, because until then a blocked send fails silently (no recovery, no re-prompt, nothing in the channel). Lifting the clamp is a code change, not a flag flip.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships in SHADOW, not off: the counter is the whole point - the fleet metric
+    // is currently blind to this misroute, which is why it went unnoticed. shadow
+    // is a free local log line + counter (no model spend, no behaviour change), so
+    // it measures the fire rate immediately. enforce turns a misroute into a
+    // REFUSED send, which trades a confidentiality risk for an availability one -
+    // that is the audited per-org flip, taken after reading the shadow numbers and
+    // after ENG-8143 shrinks the stale-marker window that dominates the false
+    // positives.
+    defaultValue: "shadow",
+    // Enum override AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE (off|shadow|enforce),
+    // resolved by resolveSlackScheduledChannelGuardMode in the channel-server bundle.
+    envVar: "AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE",
+    // enforce REFUSES a send the agent asked to make - a visible availability
+    // change, so flipping toward it is deliberate (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+  },
   {
     key: "slack-hot-thread-guard",
     description: "Server-side hot-thread guard on the slack.reply surface (ENG-7462). Prevents an agent posting a NEW top-level Slack message when it meant to reply inside the thread it is already working in - a prompt/memory rule proved insufficient (the agent had the rule and still slipped). When a reply would otherwise post to channel ROOT (no thread_ts / message_ts / inbound_id, no active kanban card) and the agent has a recent active thread in that channel (its last bot-posted thread, from the persisted trackedThreads cache, within a freshness window), the reply is redirected into that thread. proactive:true no longer implies channel root; posting at root becomes a deliberate action (the to_channel_root flag, or the thread_ts:null sentinel). off = guard never runs, replies with no coords root exactly as today (ships dark). shadow = compute + log the would-redirect but STILL post to root (measure the fire rate before acting). enforce = apply the redirect (a soft-block: redirect + inform, never a hard rejection). Read live from the heartbeat flags-cache (or the env override); enforce is a deliberate per-org flip after a shadow soak.",

package/dist/mcp/slack-channel.js

@@ -30345,6 +30345,54 @@ function resolveSlackHotThreadMode(opts) {
   if (cached2 !== void 0) return cached2;
   return "off";
 }
+var SLACK_SCHEDULED_CHANNEL_GUARD_FLAG_KEY = "slack-scheduled-channel-guard";
+function parseSlackScheduledChannelGuardMode(raw) {
+  if (raw === void 0) return void 0;
+  const v = raw.trim().toLowerCase();
+  if (v === "") return void 0;
+  if (v === "off" || v === "shadow" || v === "enforce") return v;
+  const b = envBoolean(raw);
+  if (b === true) return "enforce";
+  if (b === false) return "off";
+  return void 0;
+}
+function cachedSlackScheduledChannelGuardMode(path) {
+  try {
+    if (!existsSync(path)) return void 0;
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const flags = parsed.flags;
+    if (!flags || typeof flags !== "object") return void 0;
+    const value = flags[SLACK_SCHEDULED_CHANNEL_GUARD_FLAG_KEY];
+    if (typeof value === "string") return parseSlackScheduledChannelGuardMode(value);
+    if (typeof value === "boolean") return value ? "enforce" : "off";
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+var SCHEDULED_CHANNEL_GUARD_ENFORCE_READY = false;
+var warnedEnforceClamped = false;
+function clampScheduledChannelGuardMode(mode) {
+  if (mode !== "enforce" || SCHEDULED_CHANNEL_GUARD_ENFORCE_READY) return mode;
+  if (!warnedEnforceClamped) {
+    warnedEnforceClamped = true;
+    process.stderr.write(
+      "slack-channel: slack-scheduled-channel-guard=enforce requested but CLAMPED to shadow - enforce is blocked until ENG-8142 (the Stop hook treats a refused reply as a delivered one, so a blocked send would fail silently). Detection and counters still run.\n"
+    );
+  }
+  return "shadow";
+}
+function resolveSlackScheduledChannelGuardMode(opts) {
+  const env2 = opts?.env ?? process.env;
+  const modeOverride = parseSlackScheduledChannelGuardMode(
+    env2["AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE"]
+  );
+  if (modeOverride !== void 0) return clampScheduledChannelGuardMode(modeOverride);
+  const cached2 = cachedSlackScheduledChannelGuardMode(opts?.cachePath ?? defaultFlagsCachePath());
+  if (cached2 !== void 0) return clampScheduledChannelGuardMode(cached2);
+  return "shadow";
+}
 
 // src/maintenance-mode.ts
 var FLAG_KEY = "platform-maintenance-mode";
@@ -31835,19 +31883,27 @@ var env = new import_nunjucks.default.Environment(null, { autoescape: false });
 
 // ../core/dist/provisioning/ec2-capacity.js
 var CAPACITY_TABLE = {
-  // t3 family — burst-credit instances. Lookup is per-vCPU plus
-  // headroom for the manager process itself.
+  // t3 family — burstable (CPU credits). Fine for these mostly-I/O-bound
+  // agents; the monitor + resize path cover the rare sustained-load case.
   "t3.micro": 1,
-  //   1 vCPU /  1 GB — barely fits one agent
-  "t3.small": 1,
-  //   2 vCPU /  2 GB — still tight
-  "t3.medium": 2,
-  //  2 vCPU /  4 GB — the sweet spot for a 2-agent host
-  "t3.large": 4,
-  //   2 vCPU /  8 GB — bursts cover the headroom
-  "t3.xlarge": 8,
+  //    2 vCPU /  1 GB — floor
+  "t3.small": 2,
+  //    2 vCPU /  2 GB
+  "t3.medium": 4,
+  //   2 vCPU /  4 GB
+  "t3.large": 8,
+  //    2 vCPU /  8 GB
+  "t3.xlarge": 16,
+  //  4 vCPU / 16 GB
+  "t3.2xlarge": 32,
+  // 8 vCPU / 32 GB
+  // m6i family — fixed performance (no burst-credit cliff), the preferred
+  // family for dense / sustained multi-agent hosts (e.g. Enterprise default).
+  "m6i.large": 8,
+  //    2 vCPU /  8 GB
+  "m6i.xlarge": 16,
   //  4 vCPU / 16 GB
-  "t3.2xlarge": 16
+  "m6i.2xlarge": 32
   // 8 vCPU / 32 GB
 };
 var KNOWN_INSTANCE_TYPES = Object.keys(CAPACITY_TABLE);
@@ -34189,6 +34245,27 @@ var FLAG_REGISTRY = [
     // change (ADR-0022 sensitive-flag confirm).
     sensitive: true
   },
+  {
+    key: "slack-scheduled-channel-guard",
+    description: 'Guard on slack.reply that refuses to let an active scheduled-task destination silently move a reply to a DIFFERENT channel than the agent named (ENG-8137). CS-1505 gave an explicit inbound_id priority over the task destination but left the no-inbound_id case treating "no inbound reference" as "no destination specified" - and `channel` is a REQUIRED argument, so every call names one. The symptom: a question asked in one channel answered in another, and a reply meant as a DM landing in a public channel. Fires only when the marker carries an EXPLICIT target, the named channel differs from it, and neither an inbound_id, an enforce binding, nor an ENG-7542 channel correction is available to arbitrate. off = never runs (today behaviour: silent retarget). shadow = count + log the would-block but STILL route as today, so the false-positive rate is measurable before anyone refuses a send. enforce = block the reply and tell the agent to retry. Read live from the heartbeat flags-cache (or the env override). NOTE: enforce is currently CLAMPED to shadow host-side and setting it here will not take effect - it stays blocked until ENG-8142 teaches the Stop hook to tell a refused reply from a delivered one, because until then a blocked send fails silently (no recovery, no re-prompt, nothing in the channel). Lifting the clamp is a code change, not a flag flip.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships in SHADOW, not off: the counter is the whole point - the fleet metric
+    // is currently blind to this misroute, which is why it went unnoticed. shadow
+    // is a free local log line + counter (no model spend, no behaviour change), so
+    // it measures the fire rate immediately. enforce turns a misroute into a
+    // REFUSED send, which trades a confidentiality risk for an availability one -
+    // that is the audited per-org flip, taken after reading the shadow numbers and
+    // after ENG-8143 shrinks the stale-marker window that dominates the false
+    // positives.
+    defaultValue: "shadow",
+    // Enum override AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE (off|shadow|enforce),
+    // resolved by resolveSlackScheduledChannelGuardMode in the channel-server bundle.
+    envVar: "AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE",
+    // enforce REFUSES a send the agent asked to make - a visible availability
+    // change, so flipping toward it is deliberate (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+  },
   {
     key: "slack-hot-thread-guard",
     description: "Server-side hot-thread guard on the slack.reply surface (ENG-7462). Prevents an agent posting a NEW top-level Slack message when it meant to reply inside the thread it is already working in - a prompt/memory rule proved insufficient (the agent had the rule and still slipped). When a reply would otherwise post to channel ROOT (no thread_ts / message_ts / inbound_id, no active kanban card) and the agent has a recent active thread in that channel (its last bot-posted thread, from the persisted trackedThreads cache, within a freshness window), the reply is redirected into that thread. proactive:true no longer implies channel root; posting at root becomes a deliberate action (the to_channel_root flag, or the thread_ts:null sentinel). off = guard never runs, replies with no coords root exactly as today (ships dark). shadow = compute + log the would-redirect but STILL post to root (measure the fire rate before acting). enforce = apply the redirect (a soft-block: redirect + inform, never a hard rejection). Read live from the heartbeat flags-cache (or the env override); enforce is a deliberate per-org flip after a shadow soak.",
@@ -37590,6 +37667,8 @@ var REPLY_BINDING_CLASSIFICATION_COUNTER_SUFFIX = "-reply-binding-classification
 var UNKNOWN_INBOUND_ID_KEY = "unknown_inbound_id";
 var CHANNEL_MISTARGET_CORRECTED_KEY = "channel_mistarget_corrected";
 var DM_CHANNEL_MISTARGET_KEY = "dm_channel_mistarget";
+var SCHEDULED_CHANNEL_OVERRIDE_SHADOW_KEY = "scheduled_channel_override_shadow";
+var SCHEDULED_CHANNEL_OVERRIDE_BLOCKED_KEY = "scheduled_channel_override_blocked";
 var VALID_MODES = /* @__PURE__ */ new Set(["shadow", "warn", "enforce"]);
 function slackReplyBindingMode() {
   const raw = process.env["AGT_SLACK_REPLY_BINDING"];
@@ -37614,6 +37693,22 @@ function recordReplyBindingClassification(agentDir, channel, input) {
   } catch {
   }
 }
+function recordScheduledChannelOverride(agentDir, channel, input) {
+  if (!agentDir) return;
+  const path = join13(agentDir, `${channel}${REPLY_BINDING_CLASSIFICATION_COUNTER_SUFFIX}`);
+  let counts = {};
+  try {
+    const parsed = JSON.parse(readFileSync13(path, "utf-8"));
+    if (parsed && typeof parsed === "object") counts = parsed;
+  } catch {
+  }
+  const key2 = input.enforced ? SCHEDULED_CHANNEL_OVERRIDE_BLOCKED_KEY : SCHEDULED_CHANNEL_OVERRIDE_SHADOW_KEY;
+  counts[key2] = (counts[key2] ?? 0) + 1;
+  try {
+    writeFileSync10(path, JSON.stringify(counts), { mode: 384 });
+  } catch {
+  }
+}
 function recordChannelMistarget(agentDir, channel, input) {
   if (!agentDir) return;
   const path = join13(agentDir, `${channel}${REPLY_BINDING_CLASSIFICATION_COUNTER_SUFFIX}`);
@@ -37742,6 +37837,13 @@ function clearScheduledTurnMarker(agentDir) {
 }
 
 // src/slack-reply-scheduled-priority.ts
+function scheduledDestOverridesNamedChannel(opts) {
+  if (opts.inboundId || opts.enforceBound) return false;
+  if (opts.channelGuardCorrected) return false;
+  if (!opts.scheduledTargetChannel) return false;
+  if (!opts.namedChannel) return false;
+  return opts.scheduledTargetChannel !== opts.namedChannel;
+}
 function resolveSlackScheduledPriority(opts) {
   const inboundWins = !!(opts.inboundId || opts.enforceBound);
   const effectiveChannel = inboundWins ? opts.bindingChannel ?? opts.fallbackChannel : opts.scheduledDest ? opts.scheduledDest.channel : opts.fallbackChannel;
@@ -41559,8 +41661,41 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       );
     }
     const enforceBound = bindingMode === "enforce" && (binding.classification === "bound" || binding.classification === "coords_corrected");
+    const resolvedFallbackChannel = channelGuard.corrected && channelGuard.channel ? channelGuard.channel : channel;
     const scheduledMarker = readScheduledTurnMarker(SLACK_AGENT_DIR);
     const scheduledDest = scheduledMarker ? resolveScheduledTurnDestination(scheduledMarker, { channel, thread_ts }) : null;
+    const scheduledChannelGuardMode = resolveSlackScheduledChannelGuardMode();
+    const scheduledChannelOverride = scheduledChannelGuardMode !== "off" && scheduledDestOverridesNamedChannel({
+      inboundId: inbound_id,
+      enforceBound,
+      // ENG-7542 resolved a registry-VERIFIED destination - it arbitrates like
+      // enforceBound rather than being treated as just another named channel.
+      channelGuardCorrected: channelGuard.corrected,
+      // The marker's OWN target, not the resolved dest: the resolver echoes the
+      // requested channel for a target-less marker, so comparing the resolved
+      // value compared the raw arg against the corrected one.
+      scheduledTargetChannel: scheduledMarker?.target?.channel_id ?? null,
+      namedChannel: resolvedFallbackChannel
+    });
+    if (scheduledChannelOverride) {
+      const enforced = scheduledChannelGuardMode === "enforce";
+      recordScheduledChannelOverride(SLACK_AGENT_DIR, "slack", { enforced });
+      process.stderr.write(
+        `slack-channel(${AGENT_CODE_NAME}): scheduled_dest_channel_override_${enforced ? "blocked" : "shadow"} task=${scheduledMarker?.task_id ?? "?"} named=${redactSlackId(resolvedFallbackChannel)} task_dest=${redactSlackId(scheduledMarker?.target?.channel_id)}
+`
+      );
+      if (enforced) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "This reply was blocked: a scheduled task is active and its destination channel is not the channel you named, so this message would have gone somewhere you did not ask for. If you are answering someone, send again with the inbound_id from their <channel> tag - that always wins over the task destination. If this is the scheduled task's own output, write it on the task card (kanban_update / kanban_done) instead of sending it - the card delivers it for you. If this is deliberate outreach that has nothing to do with the running task, it can be sent once the task finishes."
+            }
+          ],
+          isError: true
+        };
+      }
+    }
     if (scheduledDest?.retargeted) {
       process.stderr.write(
         `slack-channel(${AGENT_CODE_NAME}): scheduled_turn_retargeted task=${scheduledMarker?.task_id ?? "?"} requested=${redactSlackId(channel)}/${redactSlackId(thread_ts)} routed=${redactSlackId(scheduledDest.channel)}/${redactSlackId(scheduledDest.thread_ts)}
@@ -41626,7 +41761,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       scheduledDest: scheduledDest ?? null,
       bindingChannel: binding.channel,
       bindingThreadTs: binding.threadTs,
-      fallbackChannel: channelGuard.corrected && channelGuard.channel ? channelGuard.channel : channel,
+      fallbackChannel: resolvedFallbackChannel,
       fallbackThreadTs: channelGuard.corrected ? channelGuard.threadTs : hotThreadMode === "enforce" && hotGuard ? hotGuard.threadTs : baseThreadTs,
       fallbackSettleThreadTs: channelGuard.corrected ? channelGuard.threadTs : thread_ts
     });

package/dist/mcp/telegram-channel.js

@@ -32185,19 +32185,27 @@ var env = new import_nunjucks.default.Environment(null, { autoescape: false });
 
 // ../core/dist/provisioning/ec2-capacity.js
 var CAPACITY_TABLE = {
-  // t3 family — burst-credit instances. Lookup is per-vCPU plus
-  // headroom for the manager process itself.
+  // t3 family — burstable (CPU credits). Fine for these mostly-I/O-bound
+  // agents; the monitor + resize path cover the rare sustained-load case.
   "t3.micro": 1,
-  //   1 vCPU /  1 GB — barely fits one agent
-  "t3.small": 1,
-  //   2 vCPU /  2 GB — still tight
-  "t3.medium": 2,
-  //  2 vCPU /  4 GB — the sweet spot for a 2-agent host
-  "t3.large": 4,
-  //   2 vCPU /  8 GB — bursts cover the headroom
-  "t3.xlarge": 8,
+  //    2 vCPU /  1 GB — floor
+  "t3.small": 2,
+  //    2 vCPU /  2 GB
+  "t3.medium": 4,
+  //   2 vCPU /  4 GB
+  "t3.large": 8,
+  //    2 vCPU /  8 GB
+  "t3.xlarge": 16,
   //  4 vCPU / 16 GB
-  "t3.2xlarge": 16
+  "t3.2xlarge": 32,
+  // 8 vCPU / 32 GB
+  // m6i family — fixed performance (no burst-credit cliff), the preferred
+  // family for dense / sustained multi-agent hosts (e.g. Enterprise default).
+  "m6i.large": 8,
+  //    2 vCPU /  8 GB
+  "m6i.xlarge": 16,
+  //  4 vCPU / 16 GB
+  "m6i.2xlarge": 32
   // 8 vCPU / 32 GB
 };
 var KNOWN_INSTANCE_TYPES = Object.keys(CAPACITY_TABLE);
@@ -34539,6 +34547,27 @@ var FLAG_REGISTRY = [
     // change (ADR-0022 sensitive-flag confirm).
     sensitive: true
   },
+  {
+    key: "slack-scheduled-channel-guard",
+    description: 'Guard on slack.reply that refuses to let an active scheduled-task destination silently move a reply to a DIFFERENT channel than the agent named (ENG-8137). CS-1505 gave an explicit inbound_id priority over the task destination but left the no-inbound_id case treating "no inbound reference" as "no destination specified" - and `channel` is a REQUIRED argument, so every call names one. The symptom: a question asked in one channel answered in another, and a reply meant as a DM landing in a public channel. Fires only when the marker carries an EXPLICIT target, the named channel differs from it, and neither an inbound_id, an enforce binding, nor an ENG-7542 channel correction is available to arbitrate. off = never runs (today behaviour: silent retarget). shadow = count + log the would-block but STILL route as today, so the false-positive rate is measurable before anyone refuses a send. enforce = block the reply and tell the agent to retry. Read live from the heartbeat flags-cache (or the env override). NOTE: enforce is currently CLAMPED to shadow host-side and setting it here will not take effect - it stays blocked until ENG-8142 teaches the Stop hook to tell a refused reply from a delivered one, because until then a blocked send fails silently (no recovery, no re-prompt, nothing in the channel). Lifting the clamp is a code change, not a flag flip.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships in SHADOW, not off: the counter is the whole point - the fleet metric
+    // is currently blind to this misroute, which is why it went unnoticed. shadow
+    // is a free local log line + counter (no model spend, no behaviour change), so
+    // it measures the fire rate immediately. enforce turns a misroute into a
+    // REFUSED send, which trades a confidentiality risk for an availability one -
+    // that is the audited per-org flip, taken after reading the shadow numbers and
+    // after ENG-8143 shrinks the stale-marker window that dominates the false
+    // positives.
+    defaultValue: "shadow",
+    // Enum override AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE (off|shadow|enforce),
+    // resolved by resolveSlackScheduledChannelGuardMode in the channel-server bundle.
+    envVar: "AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE",
+    // enforce REFUSES a send the agent asked to make - a visible availability
+    // change, so flipping toward it is deliberate (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+  },
   {
     key: "slack-hot-thread-guard",
     description: "Server-side hot-thread guard on the slack.reply surface (ENG-7462). Prevents an agent posting a NEW top-level Slack message when it meant to reply inside the thread it is already working in - a prompt/memory rule proved insufficient (the agent had the rule and still slipped). When a reply would otherwise post to channel ROOT (no thread_ts / message_ts / inbound_id, no active kanban card) and the agent has a recent active thread in that channel (its last bot-posted thread, from the persisted trackedThreads cache, within a freshness window), the reply is redirected into that thread. proactive:true no longer implies channel root; posting at root becomes a deliberate action (the to_channel_root flag, or the thread_ts:null sentinel). off = guard never runs, replies with no coords root exactly as today (ships dark). shadow = compute + log the would-redirect but STILL post to root (measure the fire rate before acting). enforce = apply the redirect (a soft-block: redirect + inform, never a hard rejection). Read live from the heartbeat flags-cache (or the env override); enforce is a deliberate per-org flip after a shadow soak.",

package/dist/{persistent-session-AYCUX4DJ.js → persistent-session-2OYYXMM7.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-IKQHNN7I.js";
+} from "./chunk-B4NX2T2H.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-AYCUX4DJ.js.map
+//# sourceMappingURL=persistent-session-2OYYXMM7.js.map

package/dist/{responsiveness-probe-AQUOYHCE.js → responsiveness-probe-7OOA57BP.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-IKQHNN7I.js";
+} from "./chunk-B4NX2T2H.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -185,7 +185,16 @@ var KNOWN_REPLY_BINDING_KEYS = /* @__PURE__ */ new Set([
   "delivery_ledger_self",
   "delivery_ledger_moved_on",
   "delivery_ledger_clear",
-  "delivery_ledger_fallback"
+  "delivery_ledger_fallback",
+  // ENG-8137: the scheduled-turn channel guard writes these into the same counter
+  // file (recordScheduledChannelOverride). `_shadow` counts detections while the
+  // flag observes without changing routing - the false-positive signal that gates
+  // the enforce flip; `_blocked` counts sends actually refused under enforce.
+  // Allowlisted so both reach CloudWatch: without them this guard would fire
+  // fleet-wide with no observable rate, which is the blindness that let the
+  // original misroute reach customers unnoticed.
+  "scheduled_channel_override_shadow",
+  "scheduled_channel_override_blocked"
 ]);
 function readAndResetSlackReplyBindingClassifications(agentHomeDir) {
   let names;
@@ -462,4 +471,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-AQUOYHCE.js.map
+//# sourceMappingURL=responsiveness-probe-7OOA57BP.js.map