@integrity-labs/agt-cli 0.28.421 → 0.28.422

package/dist/{claude-pair-runtime-ZTZR3VCN.js → claude-pair-runtime-3JHCWZZD.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-2OYYXMM7.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-HWCKGPYF.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-ZTZR3VCN.js.map
+//# sourceMappingURL=claude-pair-runtime-3JHCWZZD.js.map

package/dist/lib/manager-worker.js

@@ -45,7 +45,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-HVVEMQWZ.js";
+} from "../chunk-6JC5YLU5.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -150,7 +150,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-B4NX2T2H.js";
+} from "../chunk-XFC7YVGS.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -9458,7 +9458,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.421" : "dev";
+var agtCliVersion = true ? "0.28.422" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -10606,7 +10606,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-2OYYXMM7.js");
+      const { collectDiagnostics } = await import("../persistent-session-HWCKGPYF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor)
@@ -10713,7 +10713,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-2OYYXMM7.js");
+      const { collectDiagnostics } = await import("../persistent-session-HWCKGPYF.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor) : void 0;
       let tailscaleHostname;
@@ -10827,7 +10827,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-7OOA57BP.js");
+      } = await import("../responsiveness-probe-4CGMUXOH.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -10866,7 +10866,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-7OOA57BP.js");
+        } = await import("../responsiveness-probe-4CGMUXOH.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-HYOOQV4A.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14177,7 +14177,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-2OYYXMM7.js");
+        const { collectDiagnostics } = await import("../persistent-session-HWCKGPYF.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor)
@@ -14227,7 +14227,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-2OYYXMM7.js");
+      const { collectDiagnostics } = await import("../persistent-session-HWCKGPYF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor)
@@ -14680,7 +14680,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-ZTZR3VCN.js");
+  } = await import("../claude-pair-runtime-3JHCWZZD.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -34681,7 +34681,14 @@ var FLAG_REGISTRY = [
     envVar: "AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE",
     // enforce REFUSES a send the agent asked to make - a visible availability
     // change, so flipping toward it is deliberate (ADR-0022 sensitive-flag confirm).
-    sensitive: true
+    sensitive: true,
+    // ENG-8149: the agt-cli that first carries resolveSlackScheduledChannelGuardMode
+    // (published from the ENG-8137 merge c6ff71cd). Without this the flip-reach modal
+    // reports FULL reach, because an undefined `since` means "every host can honour
+    // it" - true for flags that predate the reach work, wrong for a NEW host-read
+    // flag whose reader older hosts simply do not have. Excluded from
+    // projectDefinition, so setting it does not roll FLAGS_SCHEMA_VERSION.
+    since: "0.28.421"
   },
   {
     key: "slack-hot-thread-guard",
@@ -35293,6 +35300,17 @@ var FLAG_REGISTRY = [
     // direction - a flag-DB read error must not resurrect the mis-threading/noise the kill
     // fixes. Net-new gate, registry-only (ADR-0022); API-evaluated, no env materialization.
     defaultValue: false
+  },
+  {
+    key: "onboarding-msteams-channel",
+    description: `Offer Microsoft Teams as a selectable channel on onboarding step 3 ("which channels should your org use?", ENG-8146). OFF (default) hides the Teams option entirely: it is not rendered, not selectable, and not named in the plan-upgrade note. Turn it ON per org to restore the option for a customer who genuinely runs on Teams. Resolved SERVER-SIDE in the step-3 server component for the URL's orgId (webapp lib/feature-flags-org-server.ts), NOT via the browser public map \u2014 the client flag path evaluates at the active-org cookie, which onboarding deliberately does not pin to the org being onboarded, so a client read would resolve the wrong org for a multi-org user. Hiding the option never revokes a channel: an org that already saved msteams keeps it (step 3 carries hidden-but-saved channels through the write). Ships dark.`,
+    flagType: "boolean",
+    // Declared safe value is `false`: Teams hidden. `false` is also the fail-closed
+    // direction - a flag-DB read error must show the narrower channel set, never
+    // surface an option the operator has not deliberately turned on. Net-new gate,
+    // registry-only (ADR-0022). NOT `public`: it is resolved server-side only, so it
+    // must never be serialized into the browser map.
+    defaultValue: false
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/origami.js

@@ -40297,7 +40297,14 @@ var FLAG_REGISTRY = [
     envVar: "AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE",
     // enforce REFUSES a send the agent asked to make - a visible availability
     // change, so flipping toward it is deliberate (ADR-0022 sensitive-flag confirm).
-    sensitive: true
+    sensitive: true,
+    // ENG-8149: the agt-cli that first carries resolveSlackScheduledChannelGuardMode
+    // (published from the ENG-8137 merge c6ff71cd). Without this the flip-reach modal
+    // reports FULL reach, because an undefined `since` means "every host can honour
+    // it" - true for flags that predate the reach work, wrong for a NEW host-read
+    // flag whose reader older hosts simply do not have. Excluded from
+    // projectDefinition, so setting it does not roll FLAGS_SCHEMA_VERSION.
+    since: "0.28.421"
   },
   {
     key: "slack-hot-thread-guard",
@@ -40909,6 +40916,17 @@ var FLAG_REGISTRY = [
     // direction - a flag-DB read error must not resurrect the mis-threading/noise the kill
     // fixes. Net-new gate, registry-only (ADR-0022); API-evaluated, no env materialization.
     defaultValue: false
+  },
+  {
+    key: "onboarding-msteams-channel",
+    description: `Offer Microsoft Teams as a selectable channel on onboarding step 3 ("which channels should your org use?", ENG-8146). OFF (default) hides the Teams option entirely: it is not rendered, not selectable, and not named in the plan-upgrade note. Turn it ON per org to restore the option for a customer who genuinely runs on Teams. Resolved SERVER-SIDE in the step-3 server component for the URL's orgId (webapp lib/feature-flags-org-server.ts), NOT via the browser public map \u2014 the client flag path evaluates at the active-org cookie, which onboarding deliberately does not pin to the org being onboarded, so a client read would resolve the wrong org for a multi-org user. Hiding the option never revokes a channel: an org that already saved msteams keeps it (step 3 carries hidden-but-saved channels through the write). Ships dark.`,
+    flagType: "boolean",
+    // Declared safe value is `false`: Teams hidden. `false` is also the fail-closed
+    // direction - a flag-DB read error must show the narrower channel set, never
+    // surface an option the operator has not deliberately turned on. Net-new gate,
+    // registry-only (ADR-0022). NOT `public`: it is resolved server-side only, so it
+    // must never be serialized into the browser map.
+    defaultValue: false
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/slack-channel.js

@@ -34264,7 +34264,14 @@ var FLAG_REGISTRY = [
     envVar: "AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE",
     // enforce REFUSES a send the agent asked to make - a visible availability
     // change, so flipping toward it is deliberate (ADR-0022 sensitive-flag confirm).
-    sensitive: true
+    sensitive: true,
+    // ENG-8149: the agt-cli that first carries resolveSlackScheduledChannelGuardMode
+    // (published from the ENG-8137 merge c6ff71cd). Without this the flip-reach modal
+    // reports FULL reach, because an undefined `since` means "every host can honour
+    // it" - true for flags that predate the reach work, wrong for a NEW host-read
+    // flag whose reader older hosts simply do not have. Excluded from
+    // projectDefinition, so setting it does not roll FLAGS_SCHEMA_VERSION.
+    since: "0.28.421"
   },
   {
     key: "slack-hot-thread-guard",
@@ -34876,6 +34883,17 @@ var FLAG_REGISTRY = [
     // direction - a flag-DB read error must not resurrect the mis-threading/noise the kill
     // fixes. Net-new gate, registry-only (ADR-0022); API-evaluated, no env materialization.
     defaultValue: false
+  },
+  {
+    key: "onboarding-msteams-channel",
+    description: `Offer Microsoft Teams as a selectable channel on onboarding step 3 ("which channels should your org use?", ENG-8146). OFF (default) hides the Teams option entirely: it is not rendered, not selectable, and not named in the plan-upgrade note. Turn it ON per org to restore the option for a customer who genuinely runs on Teams. Resolved SERVER-SIDE in the step-3 server component for the URL's orgId (webapp lib/feature-flags-org-server.ts), NOT via the browser public map \u2014 the client flag path evaluates at the active-org cookie, which onboarding deliberately does not pin to the org being onboarded, so a client read would resolve the wrong org for a multi-org user. Hiding the option never revokes a channel: an org that already saved msteams keeps it (step 3 carries hidden-but-saved channels through the write). Ships dark.`,
+    flagType: "boolean",
+    // Declared safe value is `false`: Teams hidden. `false` is also the fail-closed
+    // direction - a flag-DB read error must show the narrower channel set, never
+    // surface an option the operator has not deliberately turned on. Net-new gate,
+    // registry-only (ADR-0022). NOT `public`: it is resolved server-side only, so it
+    // must never be serialized into the browser map.
+    defaultValue: false
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/telegram-channel.js

@@ -34566,7 +34566,14 @@ var FLAG_REGISTRY = [
     envVar: "AGT_SLACK_SCHEDULED_CHANNEL_GUARD_MODE",
     // enforce REFUSES a send the agent asked to make - a visible availability
     // change, so flipping toward it is deliberate (ADR-0022 sensitive-flag confirm).
-    sensitive: true
+    sensitive: true,
+    // ENG-8149: the agt-cli that first carries resolveSlackScheduledChannelGuardMode
+    // (published from the ENG-8137 merge c6ff71cd). Without this the flip-reach modal
+    // reports FULL reach, because an undefined `since` means "every host can honour
+    // it" - true for flags that predate the reach work, wrong for a NEW host-read
+    // flag whose reader older hosts simply do not have. Excluded from
+    // projectDefinition, so setting it does not roll FLAGS_SCHEMA_VERSION.
+    since: "0.28.421"
   },
   {
     key: "slack-hot-thread-guard",
@@ -35178,6 +35185,17 @@ var FLAG_REGISTRY = [
     // direction - a flag-DB read error must not resurrect the mis-threading/noise the kill
     // fixes. Net-new gate, registry-only (ADR-0022); API-evaluated, no env materialization.
     defaultValue: false
+  },
+  {
+    key: "onboarding-msteams-channel",
+    description: `Offer Microsoft Teams as a selectable channel on onboarding step 3 ("which channels should your org use?", ENG-8146). OFF (default) hides the Teams option entirely: it is not rendered, not selectable, and not named in the plan-upgrade note. Turn it ON per org to restore the option for a customer who genuinely runs on Teams. Resolved SERVER-SIDE in the step-3 server component for the URL's orgId (webapp lib/feature-flags-org-server.ts), NOT via the browser public map \u2014 the client flag path evaluates at the active-org cookie, which onboarding deliberately does not pin to the org being onboarded, so a client read would resolve the wrong org for a multi-org user. Hiding the option never revokes a channel: an org that already saved msteams keeps it (step 3 carries hidden-but-saved channels through the write). Ships dark.`,
+    flagType: "boolean",
+    // Declared safe value is `false`: Teams hidden. `false` is also the fail-closed
+    // direction - a flag-DB read error must show the narrower channel set, never
+    // surface an option the operator has not deliberately turned on. Net-new gate,
+    // registry-only (ADR-0022). NOT `public`: it is resolved server-side only, so it
+    // must never be serialized into the browser map.
+    defaultValue: false
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/{persistent-session-2OYYXMM7.js → persistent-session-HWCKGPYF.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-B4NX2T2H.js";
+} from "./chunk-XFC7YVGS.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-2OYYXMM7.js.map
+//# sourceMappingURL=persistent-session-HWCKGPYF.js.map

package/dist/{responsiveness-probe-7OOA57BP.js → responsiveness-probe-4CGMUXOH.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-B4NX2T2H.js";
+} from "./chunk-XFC7YVGS.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -471,4 +471,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-7OOA57BP.js.map
+//# sourceMappingURL=responsiveness-probe-4CGMUXOH.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.421",
+  "version": "0.28.422",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {