@integrity-labs/agt-cli 0.28.441 → 0.28.443

package/dist/mcp/origami.js

@@ -37627,8 +37627,31 @@ var DEFAULT_SCOPES = [
   // links an inbound Slack sender to their organization_people record (inbound
   // identity reconcile). Existing installs without it degrade gracefully - the
   // reconcile no-ops until the bot is re-authorised with the wider scope set.
-  "users:read.email",
-  "users.profile:write"
+  "users:read.email"
+  // ENG-8203: 'users.profile:write' is deliberately NOT here.
+  //
+  // It is registered with `token_type: 'user'` (ENG-4812 — Slack rejects it
+  // under oauth_config.scopes.bot with `illegal_bot_scopes`). The MANIFEST
+  // generator partitions on that flag; the OAuth install-URL builder does not —
+  // `buildSlackAuthorizeUrl` puts every stored scope into `scope=` — so a
+  // default-scoped OAuth install sent a user-only scope as a bot scope and
+  // Slack rejected the whole authorization with "Invalid permissions
+  // requested". That blocked EVERY new install on the default set.
+  //
+  // Removing it rather than routing it to `user_scope=` is deliberate: the
+  // callback destructures `authed_user?: { id?: string }` and persists only the
+  // BOT token (oauth-callback/route.ts:217,246). `authed_user.access_token` is
+  // never read, so asking for the scope would put an extra consent screen in
+  // front of the installing admin and then discard the token it returned.
+  //
+  // Nothing is lost. `users.profile.set` needs an `xoxp-` user token, which no
+  // OAuth-installed agent has ever had — the bot-status/live-presence indicator
+  // only ever worked where an operator pasted a user token into the wizard by
+  // hand, and that path is untouched. The registry definition stays so existing
+  // configs still render and the `token_type: 'user'` knowledge is preserved.
+  //
+  // Wiring the indicator for OAuth installs means persisting
+  // `authed_user.access_token` first, THEN adding `user_scope=`. Separate work.
 ];
 var SLACK_SCOPE_PRESETS = {
   minimal: [
@@ -39782,6 +39805,14 @@ var BANNER_PATTERNS = [
 ];
 var MS_PER_DAY = 24 * 60 * 60 * 1e3;
 
+// ../core/dist/claude-code-usage/rate-limit-classifier.js
+var UNKNOWN_RATE_LIMIT = Object.freeze({
+  verdict: "unknown",
+  atMs: null,
+  resetsAt: null,
+  text: null
+});
+
 // ../core/dist/kanban/state-machine.js
 var KANBAN_STATUSES = [
   "backlog",
@@ -40404,6 +40435,33 @@ var FLAG_REGISTRY = [
     // projectDefinition, so setting it does not roll FLAGS_SCHEMA_VERSION.
     since: "0.28.421"
   },
+  {
+    key: "usage-limit-reactive-notice",
+    description: "Report a Claude Code usage cap REACTIVELY instead of predicting it (ENG-8201). Today the manager guesses from the agent transcript that the next turn will be refused, writes a marker, and every channel MCP refuses to dispatch on the strength of that guess - so a wrong guess is a swallowed message, and because the notice is throttled per (channel, sender) while the DROP is not, the usual symptom is total silence rather than a wrong reply. A refused turn actually costs nothing (rejected in under a second, zero tokens) and Claude Code records it with the reset time in it, so there is no need to guess: dispatch, and report the refusal if one comes back. off = today behaviour (pre-dispatch marker gate, no watcher). shadow = still gate on the marker, but ALSO watch dispatched messages and log the refusal that would have been reported - measures the true-positive rate with no user-visible change. enforce = stop reading the marker before dispatch; every admitted human message reaches the agent and a refusal is answered in-thread with the reset time from the error itself. Read live from the heartbeat flags-cache (or the env override).",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships dark: off preserves today's gate byte-for-byte. shadow is a free
+    // local log line (the watch is a transcript read, no model spend), so it is a
+    // cheap soak; enforce changes what reaches the agent, so it is the audited
+    // per-org flip.
+    defaultValue: "off",
+    // Enum override AGT_USAGE_LIMIT_REACTIVE_MODE (off|shadow|enforce), resolved
+    // by resolveUsageLimitReactiveMode in the channel-server bundle.
+    envVar: "AGT_USAGE_LIMIT_REACTIVE_MODE",
+    // enforce sends a message to an agent the host currently believes is capped -
+    // a deliberate availability trade (the refusal is free, but it is still a
+    // dispatch the operator previously suppressed), so flipping toward it is an
+    // audited change (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+    // ENG-8149: `since` is the agt-cli version that first carries
+    // resolveUsageLimitReactiveMode + the MCP watcher. It cannot be known before
+    // this lands (the auto-publish patch-bumps on merge), and an undefined
+    // `since` makes the flip-reach modal claim FULL reach - true for flags that
+    // predate the reach work, wrong for a NEW host-read flag whose reader older
+    // hosts simply do not have. Backfilled by a follow-up commit once the
+    // publishing run reports the version. Excluded from projectDefinition, so
+    // setting it does not roll FLAGS_SCHEMA_VERSION.
+  },
   {
     key: "slack-hot-thread-guard",
     description: "Server-side hot-thread guard on the slack.reply surface (ENG-7462). Prevents an agent posting a NEW top-level Slack message when it meant to reply inside the thread it is already working in - a prompt/memory rule proved insufficient (the agent had the rule and still slipped). When a reply would otherwise post to channel ROOT (no thread_ts / message_ts / inbound_id, no active kanban card) and the agent has a recent active thread in that channel (its last bot-posted thread, from the persisted trackedThreads cache, within a freshness window), the reply is redirected into that thread. proactive:true no longer implies channel root; posting at root becomes a deliberate action (the to_channel_root flag, or the thread_ts:null sentinel). off = guard never runs, replies with no coords root exactly as today (ships dark). shadow = compute + log the would-redirect but STILL post to root (measure the fire rate before acting). enforce = apply the redirect (a soft-block: redirect + inform, never a hard rejection). Read live from the heartbeat flags-cache (or the env override); enforce is a deliberate per-org flip after a shadow soak.",

package/dist/mcp/slack-channel.js

@@ -31558,8 +31558,31 @@ var DEFAULT_SCOPES = [
   // links an inbound Slack sender to their organization_people record (inbound
   // identity reconcile). Existing installs without it degrade gracefully - the
   // reconcile no-ops until the bot is re-authorised with the wider scope set.
-  "users:read.email",
-  "users.profile:write"
+  "users:read.email"
+  // ENG-8203: 'users.profile:write' is deliberately NOT here.
+  //
+  // It is registered with `token_type: 'user'` (ENG-4812 — Slack rejects it
+  // under oauth_config.scopes.bot with `illegal_bot_scopes`). The MANIFEST
+  // generator partitions on that flag; the OAuth install-URL builder does not —
+  // `buildSlackAuthorizeUrl` puts every stored scope into `scope=` — so a
+  // default-scoped OAuth install sent a user-only scope as a bot scope and
+  // Slack rejected the whole authorization with "Invalid permissions
+  // requested". That blocked EVERY new install on the default set.
+  //
+  // Removing it rather than routing it to `user_scope=` is deliberate: the
+  // callback destructures `authed_user?: { id?: string }` and persists only the
+  // BOT token (oauth-callback/route.ts:217,246). `authed_user.access_token` is
+  // never read, so asking for the scope would put an extra consent screen in
+  // front of the installing admin and then discard the token it returned.
+  //
+  // Nothing is lost. `users.profile.set` needs an `xoxp-` user token, which no
+  // OAuth-installed agent has ever had — the bot-status/live-presence indicator
+  // only ever worked where an operator pasted a user token into the wizard by
+  // hand, and that path is untouched. The registry definition stays so existing
+  // configs still render and the `token_type: 'user'` knowledge is preserved.
+  //
+  // Wiring the indicator for OAuth installs means persisting
+  // `authed_user.access_token` first, THEN adding `user_scope=`. Separate work.
 ];
 var SLACK_SCOPE_PRESETS = {
   minimal: [
@@ -33749,6 +33772,14 @@ function buildUsageLimitReplyText(limitedUntil) {
   return `Your agent has hit its Claude Code usage limit until ${formatUtcClock(limitedUntil)}. It'll pick back up once the limit resets \u2014 please try again after then.`;
 }
 
+// ../core/dist/claude-code-usage/rate-limit-classifier.js
+var UNKNOWN_RATE_LIMIT = Object.freeze({
+  verdict: "unknown",
+  atMs: null,
+  resetsAt: null,
+  text: null
+});
+
 // ../core/dist/account-enforcement/marker.js
 var ACCOUNT_ENFORCEMENT_MARKER_FILENAME = "account-enforcement.json";
 var ACCOUNT_ENFORCEMENT_MARKER_VERSION = 1;
@@ -34393,6 +34424,33 @@ var FLAG_REGISTRY = [
     // projectDefinition, so setting it does not roll FLAGS_SCHEMA_VERSION.
     since: "0.28.421"
   },
+  {
+    key: "usage-limit-reactive-notice",
+    description: "Report a Claude Code usage cap REACTIVELY instead of predicting it (ENG-8201). Today the manager guesses from the agent transcript that the next turn will be refused, writes a marker, and every channel MCP refuses to dispatch on the strength of that guess - so a wrong guess is a swallowed message, and because the notice is throttled per (channel, sender) while the DROP is not, the usual symptom is total silence rather than a wrong reply. A refused turn actually costs nothing (rejected in under a second, zero tokens) and Claude Code records it with the reset time in it, so there is no need to guess: dispatch, and report the refusal if one comes back. off = today behaviour (pre-dispatch marker gate, no watcher). shadow = still gate on the marker, but ALSO watch dispatched messages and log the refusal that would have been reported - measures the true-positive rate with no user-visible change. enforce = stop reading the marker before dispatch; every admitted human message reaches the agent and a refusal is answered in-thread with the reset time from the error itself. Read live from the heartbeat flags-cache (or the env override).",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships dark: off preserves today's gate byte-for-byte. shadow is a free
+    // local log line (the watch is a transcript read, no model spend), so it is a
+    // cheap soak; enforce changes what reaches the agent, so it is the audited
+    // per-org flip.
+    defaultValue: "off",
+    // Enum override AGT_USAGE_LIMIT_REACTIVE_MODE (off|shadow|enforce), resolved
+    // by resolveUsageLimitReactiveMode in the channel-server bundle.
+    envVar: "AGT_USAGE_LIMIT_REACTIVE_MODE",
+    // enforce sends a message to an agent the host currently believes is capped -
+    // a deliberate availability trade (the refusal is free, but it is still a
+    // dispatch the operator previously suppressed), so flipping toward it is an
+    // audited change (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+    // ENG-8149: `since` is the agt-cli version that first carries
+    // resolveUsageLimitReactiveMode + the MCP watcher. It cannot be known before
+    // this lands (the auto-publish patch-bumps on merge), and an undefined
+    // `since` makes the flip-reach modal claim FULL reach - true for flags that
+    // predate the reach work, wrong for a NEW host-read flag whose reader older
+    // hosts simply do not have. Backfilled by a follow-up commit once the
+    // publishing run reports the version. Excluded from projectDefinition, so
+    // setting it does not roll FLAGS_SCHEMA_VERSION.
+  },
   {
     key: "slack-hot-thread-guard",
     description: "Server-side hot-thread guard on the slack.reply surface (ENG-7462). Prevents an agent posting a NEW top-level Slack message when it meant to reply inside the thread it is already working in - a prompt/memory rule proved insufficient (the agent had the rule and still slipped). When a reply would otherwise post to channel ROOT (no thread_ts / message_ts / inbound_id, no active kanban card) and the agent has a recent active thread in that channel (its last bot-posted thread, from the persisted trackedThreads cache, within a freshness window), the reply is redirected into that thread. proactive:true no longer implies channel root; posting at root becomes a deliberate action (the to_channel_root flag, or the thread_ts:null sentinel). off = guard never runs, replies with no coords root exactly as today (ships dark). shadow = compute + log the would-redirect but STILL post to root (measure the fire rate before acting). enforce = apply the redirect (a soft-block: redirect + inform, never a hard rejection). Read live from the heartbeat flags-cache (or the env override); enforce is a deliberate per-org flip after a shadow soak.",

package/dist/mcp/telegram-channel.js

@@ -31860,8 +31860,31 @@ var DEFAULT_SCOPES = [
   // links an inbound Slack sender to their organization_people record (inbound
   // identity reconcile). Existing installs without it degrade gracefully - the
   // reconcile no-ops until the bot is re-authorised with the wider scope set.
-  "users:read.email",
-  "users.profile:write"
+  "users:read.email"
+  // ENG-8203: 'users.profile:write' is deliberately NOT here.
+  //
+  // It is registered with `token_type: 'user'` (ENG-4812 — Slack rejects it
+  // under oauth_config.scopes.bot with `illegal_bot_scopes`). The MANIFEST
+  // generator partitions on that flag; the OAuth install-URL builder does not —
+  // `buildSlackAuthorizeUrl` puts every stored scope into `scope=` — so a
+  // default-scoped OAuth install sent a user-only scope as a bot scope and
+  // Slack rejected the whole authorization with "Invalid permissions
+  // requested". That blocked EVERY new install on the default set.
+  //
+  // Removing it rather than routing it to `user_scope=` is deliberate: the
+  // callback destructures `authed_user?: { id?: string }` and persists only the
+  // BOT token (oauth-callback/route.ts:217,246). `authed_user.access_token` is
+  // never read, so asking for the scope would put an extra consent screen in
+  // front of the installing admin and then discard the token it returned.
+  //
+  // Nothing is lost. `users.profile.set` needs an `xoxp-` user token, which no
+  // OAuth-installed agent has ever had — the bot-status/live-presence indicator
+  // only ever worked where an operator pasted a user token into the wizard by
+  // hand, and that path is untouched. The registry definition stays so existing
+  // configs still render and the `token_type: 'user'` knowledge is preserved.
+  //
+  // Wiring the indicator for OAuth installs means persisting
+  // `authed_user.access_token` first, THEN adding `user_scope=`. Separate work.
 ];
 var SLACK_SCOPE_PRESETS = {
   minimal: [
@@ -34051,6 +34074,14 @@ function buildUsageLimitReplyText(limitedUntil) {
   return `Your agent has hit its Claude Code usage limit until ${formatUtcClock(limitedUntil)}. It'll pick back up once the limit resets \u2014 please try again after then.`;
 }
 
+// ../core/dist/claude-code-usage/rate-limit-classifier.js
+var UNKNOWN_RATE_LIMIT = Object.freeze({
+  verdict: "unknown",
+  atMs: null,
+  resetsAt: null,
+  text: null
+});
+
 // ../core/dist/account-enforcement/marker.js
 var ACCOUNT_ENFORCEMENT_MARKER_FILENAME = "account-enforcement.json";
 var ACCOUNT_ENFORCEMENT_MARKER_VERSION = 1;
@@ -34695,6 +34726,33 @@ var FLAG_REGISTRY = [
     // projectDefinition, so setting it does not roll FLAGS_SCHEMA_VERSION.
     since: "0.28.421"
   },
+  {
+    key: "usage-limit-reactive-notice",
+    description: "Report a Claude Code usage cap REACTIVELY instead of predicting it (ENG-8201). Today the manager guesses from the agent transcript that the next turn will be refused, writes a marker, and every channel MCP refuses to dispatch on the strength of that guess - so a wrong guess is a swallowed message, and because the notice is throttled per (channel, sender) while the DROP is not, the usual symptom is total silence rather than a wrong reply. A refused turn actually costs nothing (rejected in under a second, zero tokens) and Claude Code records it with the reset time in it, so there is no need to guess: dispatch, and report the refusal if one comes back. off = today behaviour (pre-dispatch marker gate, no watcher). shadow = still gate on the marker, but ALSO watch dispatched messages and log the refusal that would have been reported - measures the true-positive rate with no user-visible change. enforce = stop reading the marker before dispatch; every admitted human message reaches the agent and a refusal is answered in-thread with the reset time from the error itself. Read live from the heartbeat flags-cache (or the env override).",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships dark: off preserves today's gate byte-for-byte. shadow is a free
+    // local log line (the watch is a transcript read, no model spend), so it is a
+    // cheap soak; enforce changes what reaches the agent, so it is the audited
+    // per-org flip.
+    defaultValue: "off",
+    // Enum override AGT_USAGE_LIMIT_REACTIVE_MODE (off|shadow|enforce), resolved
+    // by resolveUsageLimitReactiveMode in the channel-server bundle.
+    envVar: "AGT_USAGE_LIMIT_REACTIVE_MODE",
+    // enforce sends a message to an agent the host currently believes is capped -
+    // a deliberate availability trade (the refusal is free, but it is still a
+    // dispatch the operator previously suppressed), so flipping toward it is an
+    // audited change (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+    // ENG-8149: `since` is the agt-cli version that first carries
+    // resolveUsageLimitReactiveMode + the MCP watcher. It cannot be known before
+    // this lands (the auto-publish patch-bumps on merge), and an undefined
+    // `since` makes the flip-reach modal claim FULL reach - true for flags that
+    // predate the reach work, wrong for a NEW host-read flag whose reader older
+    // hosts simply do not have. Backfilled by a follow-up commit once the
+    // publishing run reports the version. Excluded from projectDefinition, so
+    // setting it does not roll FLAGS_SCHEMA_VERSION.
+  },
   {
     key: "slack-hot-thread-guard",
     description: "Server-side hot-thread guard on the slack.reply surface (ENG-7462). Prevents an agent posting a NEW top-level Slack message when it meant to reply inside the thread it is already working in - a prompt/memory rule proved insufficient (the agent had the rule and still slipped). When a reply would otherwise post to channel ROOT (no thread_ts / message_ts / inbound_id, no active kanban card) and the agent has a recent active thread in that channel (its last bot-posted thread, from the persisted trackedThreads cache, within a freshness window), the reply is redirected into that thread. proactive:true no longer implies channel root; posting at root becomes a deliberate action (the to_channel_root flag, or the thread_ts:null sentinel). off = guard never runs, replies with no coords root exactly as today (ships dark). shadow = compute + log the would-redirect but STILL post to root (measure the fire rate before acting). enforce = apply the redirect (a soft-block: redirect + inform, never a hard rejection). Read live from the heartbeat flags-cache (or the env override); enforce is a deliberate per-org flip after a shadow soak.",

package/dist/{persistent-session-PWLMLDVX.js → persistent-session-6SCIPYQI.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-NQP2W2RD.js";
+} from "./chunk-IQX7TMYZ.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-PWLMLDVX.js.map
+//# sourceMappingURL=persistent-session-6SCIPYQI.js.map

package/dist/{responsiveness-probe-ZKUDFRIU.js → responsiveness-probe-WHDWK62P.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-NQP2W2RD.js";
+} from "./chunk-IQX7TMYZ.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -471,4 +471,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-ZKUDFRIU.js.map
+//# sourceMappingURL=responsiveness-probe-WHDWK62P.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.441",
+  "version": "0.28.443",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {