@integrity-labs/agt-cli 0.28.454 → 0.28.456

package/dist/{claude-pair-runtime-NRKOKQYR.js → claude-pair-runtime-PHAR4IF4.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-X5N7UFEF.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-Z2UQ4VVF.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-NRKOKQYR.js.map
+//# sourceMappingURL=claude-pair-runtime-PHAR4IF4.js.map

package/dist/lib/manager-worker.js

@@ -42,7 +42,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-23E2T5UT.js";
+} from "../chunk-FNEUIWJJ.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -164,7 +164,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-3NJHNIO3.js";
+} from "../chunk-UIUYOGPK.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -9949,7 +9949,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.454" : "dev";
+var agtCliVersion = true ? "0.28.456" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11110,7 +11110,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-X5N7UFEF.js");
+      const { collectDiagnostics } = await import("../persistent-session-Z2UQ4VVF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11217,7 +11217,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-X5N7UFEF.js");
+      const { collectDiagnostics } = await import("../persistent-session-Z2UQ4VVF.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11331,7 +11331,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-OAZ55KPC.js");
+      } = await import("../responsiveness-probe-WCF2QEVT.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11395,7 +11395,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-OAZ55KPC.js");
+        } = await import("../responsiveness-probe-WCF2QEVT.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14767,7 +14767,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-X5N7UFEF.js");
+        const { collectDiagnostics } = await import("../persistent-session-Z2UQ4VVF.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -14817,7 +14817,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-X5N7UFEF.js");
+      const { collectDiagnostics } = await import("../persistent-session-Z2UQ4VVF.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15270,7 +15270,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-NRKOKQYR.js");
+  } = await import("../claude-pair-runtime-PHAR4IF4.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/augmented-admin.js

@@ -21331,7 +21331,7 @@ var tailLogsSchema = external_exports.object({
   agent_id: external_exports.string().min(1).max(64).describe(
     "UUID of the agent whose host log to tail. Fails closed (uniform not-found) if you are not authorized for its org."
   ),
-  log: external_exports.enum(["manager", "pane", "slack-stderr", "telegram-stderr", "direct-chat-stderr", "manager-state"]).optional().describe(
+  log: external_exports.enum(["manager", "pane", "slack-stderr", "telegram-stderr", "direct-chat-stderr", "manager-state", "channel-quarantine"]).optional().describe(
     `Which host log to read (default manager). manager = manager.log (lifecycle / respawn / wedge lines); pane = pane.log (the tmux pane \u2014 the agent's visible I/O, what it was "actually doing"); slack-stderr / telegram-stderr / direct-chat-stderr = that channel MCP's stderr (crash diagnosis, e.g. attachment-download 400s); manager-state = manager-state.json (current per-agent state snapshot).`
   ),
   lines: external_exports.number().int().min(1).max(2e3).optional().describe(
@@ -21342,7 +21342,7 @@ var queryLogsSchema = external_exports.object({
   agent_id: external_exports.string().min(1).max(64).describe(
     "UUID of the agent whose host log to query. Fails closed (uniform not-found) if you are not authorized for its org."
   ),
-  log: external_exports.enum(["manager", "pane", "slack-stderr", "telegram-stderr", "direct-chat-stderr", "manager-state"]).optional().describe(
+  log: external_exports.enum(["manager", "pane", "slack-stderr", "telegram-stderr", "direct-chat-stderr", "manager-state", "channel-quarantine"]).optional().describe(
     "Which host log to read (default manager). Same allowlist as debug_tail_logs. Time filtering only applies to `manager` (its lines carry an ISO8601 prefix); the others return their byte-capped tail unfiltered (`time_filtered:false`)."
   ),
   since: external_exports.string().min(1).max(40).optional().describe(
@@ -21680,7 +21680,7 @@ server.tool(
 );
 server.tool(
   "debug_query_logs",
-  'Read an agent\'s HOST logs OVER A TIME WINDOW, spanning rotated files \u2014 the historical counterpart to debug_tail_logs. Where tail only shows the live tail of the current file (minutes, and gone once it rotates), this reads the active log AND its logrotate siblings (manager.log.1, manager.log.2.gz, \u2026 14 kept) and filters lines to [since, until]. This is the read path for "did it restart at 4pm YESTERDAY?" \u2014 use it when the answer is older than the live tail or spans a rotation. Returns { agent_id, code_name, host, log, since, until, time_filtered, content, log_present, lines_requested, truncated, ssm_status }. Time filtering applies to `manager` (its lines carry an ISO8601 prefix); `pane`/`slack-stderr`/`telegram-stderr`/`direct-chat-stderr`/`manager-state` return their byte-capped tail unfiltered (time_filtered:false). Only operational logs are reachable \u2014 secret files (.mcp.json, .env.integrations) are NOT. Pass { agent_id, log?, since?, until?, lines? } (since/until ISO8601 UTC e.g. 2026-06-14T16:00:00Z, default unbounded; lines default 1000, max 5000; output ~20 KB-capped, newest kept \u2014 narrow the window if truncated). Fails closed for an unauthorized org; every call is audited as a cross-org host access.',
+  'Read an agent\'s HOST logs OVER A TIME WINDOW, spanning rotated files \u2014 the historical counterpart to debug_tail_logs. Where tail only shows the live tail of the current file (minutes, and gone once it rotates), this reads the active log AND its logrotate siblings (manager.log.1, manager.log.2.gz, \u2026 14 kept) and filters lines to [since, until]. This is the read path for "did it restart at 4pm YESTERDAY?" \u2014 use it when the answer is older than the live tail or spans a rotation. Returns { agent_id, code_name, host, log, since, until, time_filtered, content, log_present, lines_requested, truncated, ssm_status }. Time filtering applies to `manager` (its lines carry an ISO8601 prefix); `pane`/`slack-stderr`/`telegram-stderr`/`direct-chat-stderr`/`manager-state`/`channel-quarantine` return their byte-capped tail unfiltered (time_filtered:false \u2014 the last two are JSON, not line-oriented). Only operational logs are reachable \u2014 secret files (.mcp.json, .env.integrations) are NOT. Pass { agent_id, log?, since?, until?, lines? } (since/until ISO8601 UTC e.g. 2026-06-14T16:00:00Z, default unbounded; lines default 1000, max 5000; output ~20 KB-capped, newest kept \u2014 narrow the window if truncated). Fails closed for an unauthorized org; every call is audited as a cross-org host access.',
   queryLogsSchema.shape,
   async (args) => {
     try {

package/dist/mcp/direct-chat-channel.js

@@ -35154,7 +35154,22 @@ var FLAG_REGISTRY = [
     // enforce reroutes a message the agent asked to send to channel root into a
     // thread - a visible destination change, so flipping toward it is deliberate
     // (ADR-0022 sensitive-flag confirm).
-    sensitive: true
+    sensitive: true,
+    // ENG-8235: the agt-cli whose bundle first carries resolveSlackHotThreadMode.
+    // Without this the flip-reach modal reports FULL reach (an undefined `since`
+    // means "every host can honour it"), which is wrong for a host-read flag that
+    // older hosts have no reader for - and this flag's pending action IS a flip,
+    // once the ENG-7855 soak has data.
+    //
+    // BISECTED from the published npm artifacts rather than inferred from the
+    // merge commit: 0.28.338 lacks the reader; 0.28.339 (2026-07-18T02:48Z) carries
+    // both AGT_SLACK_HOT_THREAD_GUARD_MODE and to_channel_root in
+    // dist/mcp/slack-channel.js. ENG-7462 is usually cited as 0.28.340, but two
+    // publishes fired 8 minutes apart and .339 is the one that shipped the reader;
+    // `since` is a reach THRESHOLD, so .340 would wrongly mark hosts on exactly
+    // .339 as un-reached. Excluded from projectDefinition, so setting it does not
+    // roll FLAGS_SCHEMA_VERSION.
+    since: "0.28.339"
   },
   {
     key: "compaction-notice",

package/dist/mcp/origami.js

@@ -40499,7 +40499,22 @@ var FLAG_REGISTRY = [
     // enforce reroutes a message the agent asked to send to channel root into a
     // thread - a visible destination change, so flipping toward it is deliberate
     // (ADR-0022 sensitive-flag confirm).
-    sensitive: true
+    sensitive: true,
+    // ENG-8235: the agt-cli whose bundle first carries resolveSlackHotThreadMode.
+    // Without this the flip-reach modal reports FULL reach (an undefined `since`
+    // means "every host can honour it"), which is wrong for a host-read flag that
+    // older hosts have no reader for - and this flag's pending action IS a flip,
+    // once the ENG-7855 soak has data.
+    //
+    // BISECTED from the published npm artifacts rather than inferred from the
+    // merge commit: 0.28.338 lacks the reader; 0.28.339 (2026-07-18T02:48Z) carries
+    // both AGT_SLACK_HOT_THREAD_GUARD_MODE and to_channel_root in
+    // dist/mcp/slack-channel.js. ENG-7462 is usually cited as 0.28.340, but two
+    // publishes fired 8 minutes apart and .339 is the one that shipped the reader;
+    // `since` is a reach THRESHOLD, so .340 would wrongly mark hosts on exactly
+    // .339 as un-reached. Excluded from projectDefinition, so setting it does not
+    // roll FLAGS_SCHEMA_VERSION.
+    since: "0.28.339"
   },
   {
     key: "compaction-notice",
@@ -41231,7 +41246,8 @@ var IdentityResolver = class {
         );
       }
       if (res.status >= 400) {
-        throw new IdentityError(res.status, `Credential fetch failed: ${res.status} ${data.error ?? ""}`.trim());
+        const explanation = data.detail?.trim() || data.error?.trim() || "";
+        throw new IdentityError(res.status, `Credential fetch failed: ${res.status} ${explanation}`.trim());
       }
       if (!data.access_token) {
         throw new IdentityError(502, "Broker returned 200 but no access_token - API contract mismatch");

package/dist/mcp/slack-channel.js

@@ -34762,7 +34762,22 @@ var FLAG_REGISTRY = [
     // enforce reroutes a message the agent asked to send to channel root into a
     // thread - a visible destination change, so flipping toward it is deliberate
     // (ADR-0022 sensitive-flag confirm).
-    sensitive: true
+    sensitive: true,
+    // ENG-8235: the agt-cli whose bundle first carries resolveSlackHotThreadMode.
+    // Without this the flip-reach modal reports FULL reach (an undefined `since`
+    // means "every host can honour it"), which is wrong for a host-read flag that
+    // older hosts have no reader for - and this flag's pending action IS a flip,
+    // once the ENG-7855 soak has data.
+    //
+    // BISECTED from the published npm artifacts rather than inferred from the
+    // merge commit: 0.28.338 lacks the reader; 0.28.339 (2026-07-18T02:48Z) carries
+    // both AGT_SLACK_HOT_THREAD_GUARD_MODE and to_channel_root in
+    // dist/mcp/slack-channel.js. ENG-7462 is usually cited as 0.28.340, but two
+    // publishes fired 8 minutes apart and .339 is the one that shipped the reader;
+    // `since` is a reach THRESHOLD, so .340 would wrongly mark hosts on exactly
+    // .339 as un-reached. Excluded from projectDefinition, so setting it does not
+    // roll FLAGS_SCHEMA_VERSION.
+    since: "0.28.339"
   },
   {
     key: "compaction-notice",

package/dist/mcp/telegram-channel.js

@@ -35064,7 +35064,22 @@ var FLAG_REGISTRY = [
     // enforce reroutes a message the agent asked to send to channel root into a
     // thread - a visible destination change, so flipping toward it is deliberate
     // (ADR-0022 sensitive-flag confirm).
-    sensitive: true
+    sensitive: true,
+    // ENG-8235: the agt-cli whose bundle first carries resolveSlackHotThreadMode.
+    // Without this the flip-reach modal reports FULL reach (an undefined `since`
+    // means "every host can honour it"), which is wrong for a host-read flag that
+    // older hosts have no reader for - and this flag's pending action IS a flip,
+    // once the ENG-7855 soak has data.
+    //
+    // BISECTED from the published npm artifacts rather than inferred from the
+    // merge commit: 0.28.338 lacks the reader; 0.28.339 (2026-07-18T02:48Z) carries
+    // both AGT_SLACK_HOT_THREAD_GUARD_MODE and to_channel_root in
+    // dist/mcp/slack-channel.js. ENG-7462 is usually cited as 0.28.340, but two
+    // publishes fired 8 minutes apart and .339 is the one that shipped the reader;
+    // `since` is a reach THRESHOLD, so .340 would wrongly mark hosts on exactly
+    // .339 as un-reached. Excluded from projectDefinition, so setting it does not
+    // roll FLAGS_SCHEMA_VERSION.
+    since: "0.28.339"
   },
   {
     key: "compaction-notice",

package/dist/{persistent-session-X5N7UFEF.js → persistent-session-Z2UQ4VVF.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-3NJHNIO3.js";
+} from "./chunk-UIUYOGPK.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-X5N7UFEF.js.map
+//# sourceMappingURL=persistent-session-Z2UQ4VVF.js.map

package/dist/{responsiveness-probe-OAZ55KPC.js → responsiveness-probe-WCF2QEVT.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-3NJHNIO3.js";
+} from "./chunk-UIUYOGPK.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -528,4 +528,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-OAZ55KPC.js.map
+//# sourceMappingURL=responsiveness-probe-WCF2QEVT.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.454",
+  "version": "0.28.456",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {