@integrity-labs/agt-cli 0.28.456 → 0.28.457

package/dist/{chunk-FNEUIWJJ.js → chunk-WMGMLOPB.js}

@@ -29,7 +29,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-UIUYOGPK.js";
+} from "./chunk-QFBCK4ZH.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -4910,7 +4910,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.456" : "dev";
+var agtCliVersion = true ? "0.28.457" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7411,4 +7411,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-FNEUIWJJ.js.map
+//# sourceMappingURL=chunk-WMGMLOPB.js.map

package/dist/{claude-pair-runtime-PHAR4IF4.js → claude-pair-runtime-QNOUSTW3.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-Z2UQ4VVF.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-LEWM6BKO.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-PHAR4IF4.js.map
+//# sourceMappingURL=claude-pair-runtime-QNOUSTW3.js.map

package/dist/lib/manager-worker.js

@@ -42,7 +42,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-FNEUIWJJ.js";
+} from "../chunk-WMGMLOPB.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -164,7 +164,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-UIUYOGPK.js";
+} from "../chunk-QFBCK4ZH.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -9949,7 +9949,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.456" : "dev";
+var agtCliVersion = true ? "0.28.457" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11110,7 +11110,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-Z2UQ4VVF.js");
+      const { collectDiagnostics } = await import("../persistent-session-LEWM6BKO.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11217,7 +11217,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-Z2UQ4VVF.js");
+      const { collectDiagnostics } = await import("../persistent-session-LEWM6BKO.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11331,7 +11331,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-WCF2QEVT.js");
+      } = await import("../responsiveness-probe-U6DPVIDD.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11395,7 +11395,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-WCF2QEVT.js");
+        } = await import("../responsiveness-probe-U6DPVIDD.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14767,7 +14767,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-Z2UQ4VVF.js");
+        const { collectDiagnostics } = await import("../persistent-session-LEWM6BKO.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -14817,7 +14817,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-Z2UQ4VVF.js");
+      const { collectDiagnostics } = await import("../persistent-session-LEWM6BKO.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15270,7 +15270,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-PHAR4IF4.js");
+  } = await import("../claude-pair-runtime-QNOUSTW3.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -31704,6 +31704,12 @@ var integration_metadata_v1_default = {
               description: "Optional query-string shape with `{arg}` placeholders.",
               additionalProperties: { type: "string" }
             },
+            headers_template: {
+              type: "object",
+              description: 'Optional request-header shape with `{arg}` placeholders (e.g. `{ "x-origami-project": "{project_id}" }`). A header whose template resolves to empty is dropped rather than sent blank, and args consumed only by a header template are excluded from a `{$body}` expansion.',
+              propertyNames: { pattern: "^[A-Za-z0-9!#$%&'*+.^_`|~-]+$" },
+              additionalProperties: { type: "string" }
+            },
             idempotency_key_header: {
               type: "string",
               minLength: 1,

package/dist/mcp/origami.js

@@ -37203,6 +37203,12 @@ var integration_metadata_v1_default = {
               description: "Optional query-string shape with `{arg}` placeholders.",
               additionalProperties: { type: "string" }
             },
+            headers_template: {
+              type: "object",
+              description: 'Optional request-header shape with `{arg}` placeholders (e.g. `{ "x-origami-project": "{project_id}" }`). A header whose template resolves to empty is dropped rather than sent blank, and args consumed only by a header template are excluded from a `{$body}` expansion.',
+              propertyNames: { pattern: "^[A-Za-z0-9!#$%&'*+.^_`|~-]+$" },
+              additionalProperties: { type: "string" }
+            },
             idempotency_key_header: {
               type: "string",
               minLength: 1,
@@ -37249,7 +37255,7 @@ var FIXED_SECONDS = {
 var PLACEHOLDER_RE = /\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g;
 function buildHttpRequest(input) {
   const { tool, args, baseUrl, bearerToken, requestId, extraHeaders } = input;
-  const { method, path_template, query_template, body_template, idempotency_key_header } = tool.http;
+  const { method, path_template, query_template, headers_template, body_template, idempotency_key_header } = tool.http;
   const path = templatePath(path_template, args);
   const query = query_template ? buildQueryString(query_template, args) : "";
   const url2 = joinUrl(baseUrl, path) + query;
@@ -37263,9 +37269,17 @@ function buildHttpRequest(input) {
     const headerName = idempotency_key_header ?? "Idempotency-Key";
     headers[headerName] = requestId;
   }
+  if (headers_template) {
+    const reserved = /* @__PURE__ */ new Set([
+      ...RESERVED_HEADER_NAMES,
+      (idempotency_key_header ?? "Idempotency-Key").toLowerCase()
+    ]);
+    Object.assign(headers, buildTemplatedHeaders(headers_template, args, reserved));
+  }
   let body;
   if (method !== "GET" && body_template !== void 0) {
-    const expanded = expandBodyTemplate(body_template, args);
+    const bodyArgs = body_template === "{$body}" && headers_template ? omitKeys(args, headerOnlyPlaceholders(headers_template, tool.http)) : args;
+    const expanded = expandBodyTemplate(body_template, bodyArgs);
     body = JSON.stringify(expanded);
     headers["Content-Type"] = "application/json";
   }
@@ -37274,6 +37288,65 @@ function buildHttpRequest(input) {
   }
   return { url: url2, method, headers, body };
 }
+var RESERVED_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization", "accept", "content-type"]);
+function buildTemplatedHeaders(template, args, reservedNames) {
+  const out = {};
+  for (const [headerName, valueTemplate] of Object.entries(template)) {
+    if (!isValidHeaderName(headerName)) {
+      throw new TemplateError(`invalid header name in headers_template: ${headerName}`);
+    }
+    if (reservedNames.has(headerName.toLowerCase())) {
+      throw new TemplateError(`headers_template cannot target reserved header: ${headerName}`);
+    }
+    const expanded = valueTemplate.replace(PLACEHOLDER_RE, (_full, key) => {
+      const v = args[key];
+      if (v === void 0 || v === null)
+        return "";
+      if (!isScalar(v)) {
+        throw new TemplateError(`header placeholder {${key}} cannot be substituted with non-scalar value`);
+      }
+      return String(v);
+    });
+    if (expanded === "")
+      continue;
+    if (!isValidHeaderValue(expanded)) {
+      throw new TemplateError(`header ${headerName} resolved to an invalid value`);
+    }
+    out[headerName] = expanded;
+  }
+  return out;
+}
+function headerOnlyPlaceholders(headersTemplate, http) {
+  const elsewhere = /* @__PURE__ */ new Set([
+    ...placeholderKeys(http.path_template),
+    ...Object.values(http.query_template ?? {}).flatMap(placeholderKeys)
+  ]);
+  const out = /* @__PURE__ */ new Set();
+  for (const key of Object.values(headersTemplate).flatMap(placeholderKeys)) {
+    if (!elsewhere.has(key))
+      out.add(key);
+  }
+  return out;
+}
+function placeholderKeys(template) {
+  return [...template.matchAll(PLACEHOLDER_RE)].map((m) => m[1]);
+}
+function omitKeys(args, keys) {
+  if (keys.size === 0)
+    return args;
+  const out = {};
+  for (const [k, v] of Object.entries(args)) {
+    if (!keys.has(k))
+      out[k] = v;
+  }
+  return out;
+}
+function isValidHeaderName(name) {
+  return /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(name);
+}
+function isValidHeaderValue(value) {
+  return !/[\x00-\x1f\x7f]/.test(value);
+}
 function templatePath(template, args) {
   return template.replace(PLACEHOLDER_RE, (_full, key) => {
     const value = args[key];
@@ -41182,6 +41255,10 @@ var IdentityError = class extends Error {
     this.status = status;
   }
 };
+function nonEmpty(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  return trimmed === "" ? null : trimmed;
+}
 var IdentityResolver = class {
   env;
   fetchImpl;
@@ -41209,7 +41286,10 @@ var IdentityResolver = class {
     return {
       apiKey,
       organizationId: this.env.ORIGAMI_ORG_ID ?? null,
-      teamSlug: this.env.ORIGAMI_TEAM_SLUG ?? null
+      teamSlug: this.env.ORIGAMI_TEAM_SLUG ?? null,
+      // Blank is absent: an empty ORIGAMI_PROJECT_ID must mean "parent org",
+      // not "scope to the empty string" (which the vendor 400s on).
+      projectId: nonEmpty(this.env.ORIGAMI_PROJECT_ID)
     };
   }
   async resolveViaBroker() {
@@ -41255,7 +41335,8 @@ var IdentityResolver = class {
       return {
         apiKey: data.access_token,
         organizationId: data.organization_id ?? null,
-        teamSlug: data.team_slug ?? null
+        teamSlug: data.team_slug ?? null,
+        projectId: nonEmpty(data.project_id)
       };
     }
     throw new IdentityError(401, "Credential fetch failed after JWT re-exchange retry");
@@ -41297,80 +41378,36 @@ var IdentityResolver = class {
   }
 };
 
-// src/server.ts
-var DEFAULT_BASE_URL = "https://origami.chat";
-var VENDOR_TIMEOUT_MS = 3e4;
-function errorResult(text) {
-  return { isError: true, content: [{ type: "text", text: `Error: ${text}` }] };
-}
-function buildOrigamiMcpServer(opts) {
-  const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const newRequestId = opts.newRequestId ?? (() => crypto.randomUUID());
-  const byName = new Map(opts.descriptors.map((d) => [d.name, d]));
-  const server = new Server(
-    { name: "origami", version: "0.1.0" },
-    { capabilities: { tools: {} } }
-  );
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: opts.descriptors.map((d) => ({
-      name: d.name,
-      description: d.description,
-      inputSchema: d.input_schema
-    }))
-  }));
-  server.setRequestHandler(CallToolRequestSchema, async (req) => {
-    const descriptor = byName.get(req.params.name);
-    if (!descriptor) {
-      return errorResult(`unknown tool ${req.params.name}`);
-    }
-    const args = req.params.arguments ?? {};
-    let identity;
-    try {
-      identity = await opts.resolveIdentity();
-    } catch (err) {
-      const msg = err instanceof IdentityError ? err.message : err.message;
-      return errorResult(`credential resolution failed: ${msg}`);
-    }
-    const extraHeaders = {};
-    if (identity.organizationId) extraHeaders["X-Organization-Id"] = identity.organizationId;
-    if (identity.teamSlug) extraHeaders["X-Team-Slug"] = identity.teamSlug;
-    let prepared;
-    try {
-      prepared = buildHttpRequest({
-        tool: descriptor,
-        args,
-        baseUrl,
-        bearerToken: identity.apiKey,
-        requestId: newRequestId(),
-        extraHeaders
-      });
-    } catch (err) {
-      const msg = err instanceof TemplateError ? err.message : err.message;
-      return errorResult(msg);
-    }
-    let resp;
-    try {
-      resp = await fetchImpl(prepared.url, {
-        method: prepared.method,
-        headers: prepared.headers,
-        body: prepared.body,
-        signal: AbortSignal.timeout(VENDOR_TIMEOUT_MS)
-      });
-    } catch (err) {
-      return errorResult(`origami.chat fetch failed: ${err.message}`);
-    }
-    const text = await resp.text();
-    if (!resp.ok) {
-      return errorResult(`origami.chat ${resp.status}: ${text.slice(0, 400)}`);
+// src/descriptors.ts
+var PROJECT_SCOPE_HEADER = "x-origami-project";
+var PROJECT_ID_ARG = "project_id";
+var PROJECT_ID_PROPERTY = {
+  type: ["string", "null"],
+  description: "Optional origami project (child org) id to scope this call to - discover ids with list_projects. Omit to act on the parent org that owns the API key. If the integration has a default project configured it is applied automatically when this is omitted; pass null to override that default and act on the parent org."
+};
+function withProjectScoping(tool) {
+  return {
+    ...tool,
+    input_schema: {
+      ...tool.input_schema,
+      properties: {
+        ...tool.input_schema.properties,
+        [PROJECT_ID_ARG]: PROJECT_ID_PROPERTY
+      }
+    },
+    http: {
+      ...tool.http,
+      headers_template: {
+        ...tool.http.headers_template ?? {},
+        [PROJECT_SCOPE_HEADER]: `{${PROJECT_ID_ARG}}`
+      }
     }
-    return { content: [{ type: "text", text: text || "{}" }] };
-  });
-  return server;
+  };
 }
-
-// src/descriptors.ts
-var ORIGAMI_TOOLS = [
+function supportsProjectScoping(tool) {
+  return tool.http.headers_template?.[PROJECT_SCOPE_HEADER] === `{${PROJECT_ID_ARG}}`;
+}
+var ORG_SCOPED_TOOLS = [
   // ==========================================================================
   // v1 DATA PLANE
   // ==========================================================================
@@ -41650,6 +41687,122 @@ var ORIGAMI_TOOLS = [
     }
   }
 ];
+var PROJECT_TOOLS = [
+  {
+    name: "list_projects",
+    description: "List the projects (child orgs) under the API key's parent org, newest first. Use this to discover the project id to pass as `project_id` on any other tool - without it every call resolves against the parent org, so a project's agents and tables are invisible. Cursor-paginated: pass the previous response's `nextCursor` as `cursor`; `nextCursor: null` means the last page. Optional `search` is a case-insensitive substring match on project name. Returns { object, items[{ id, name, monthlyCredits, usage{spent,reserved}, createdAt }], nextCursor }. Always acts on the parent org - `project_id` is not accepted here.",
+    risk_tier: "Low",
+    input_schema: {
+      type: "object",
+      properties: {
+        cursor: { type: "string", description: "Opaque pagination cursor - the `nextCursor` from a previous page. Omit for the first page." },
+        limit: { type: "integer", minimum: 1, maximum: 100, description: "Projects per page. Default 50, max 100." },
+        search: { type: "string", description: "Optional case-insensitive substring match on project name." }
+      }
+    },
+    http: {
+      method: "GET",
+      path_template: "/api/v2/projects",
+      query_template: { cursor: "{cursor}", limit: "{limit}", search: "{search}" }
+    }
+  },
+  {
+    name: "get_project",
+    description: "Fetch a single project (child org) by id: name, optional monthlyCredits budget cap, current-period usage { spent, reserved } and createdAt. Use it to confirm a project id before scoping calls to it, or to check its remaining budget. Always acts on the parent org - `project_id` is not accepted here.",
+    risk_tier: "Low",
+    input_schema: {
+      type: "object",
+      properties: {
+        projectId: { type: "string", minLength: 1, description: "The project (child org) id (uuid), from list_projects." }
+      },
+      required: ["projectId"]
+    },
+    http: { method: "GET", path_template: "/api/v2/projects/{projectId}" }
+  }
+];
+var ORIGAMI_TOOLS = [
+  ...ORG_SCOPED_TOOLS.map(withProjectScoping),
+  ...PROJECT_TOOLS
+];
+
+// src/server.ts
+var DEFAULT_BASE_URL = "https://origami.chat";
+var VENDOR_TIMEOUT_MS = 3e4;
+function errorResult(text) {
+  return { isError: true, content: [{ type: "text", text: `Error: ${text}` }] };
+}
+function resolveProjectScope(descriptor, args, defaultProjectId) {
+  if (!defaultProjectId) return args;
+  if (!supportsProjectScoping(descriptor)) return args;
+  if (PROJECT_ID_ARG in args) return args;
+  return { ...args, [PROJECT_ID_ARG]: defaultProjectId };
+}
+function buildOrigamiMcpServer(opts) {
+  const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const newRequestId = opts.newRequestId ?? (() => crypto.randomUUID());
+  const byName = new Map(opts.descriptors.map((d) => [d.name, d]));
+  const server = new Server(
+    { name: "origami", version: "0.1.0" },
+    { capabilities: { tools: {} } }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: opts.descriptors.map((d) => ({
+      name: d.name,
+      description: d.description,
+      inputSchema: d.input_schema
+    }))
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const descriptor = byName.get(req.params.name);
+    if (!descriptor) {
+      return errorResult(`unknown tool ${req.params.name}`);
+    }
+    const args = req.params.arguments ?? {};
+    let identity;
+    try {
+      identity = await opts.resolveIdentity();
+    } catch (err) {
+      const msg = err instanceof IdentityError ? err.message : err.message;
+      return errorResult(`credential resolution failed: ${msg}`);
+    }
+    const extraHeaders = {};
+    if (identity.organizationId) extraHeaders["X-Organization-Id"] = identity.organizationId;
+    if (identity.teamSlug) extraHeaders["X-Team-Slug"] = identity.teamSlug;
+    const scopedArgs = resolveProjectScope(descriptor, args, identity.projectId);
+    let prepared;
+    try {
+      prepared = buildHttpRequest({
+        tool: descriptor,
+        args: scopedArgs,
+        baseUrl,
+        bearerToken: identity.apiKey,
+        requestId: newRequestId(),
+        extraHeaders
+      });
+    } catch (err) {
+      const msg = err instanceof TemplateError ? err.message : err.message;
+      return errorResult(msg);
+    }
+    let resp;
+    try {
+      resp = await fetchImpl(prepared.url, {
+        method: prepared.method,
+        headers: prepared.headers,
+        body: prepared.body,
+        signal: AbortSignal.timeout(VENDOR_TIMEOUT_MS)
+      });
+    } catch (err) {
+      return errorResult(`origami.chat fetch failed: ${err.message}`);
+    }
+    const text = await resp.text();
+    if (!resp.ok) {
+      return errorResult(`origami.chat ${resp.status}: ${text.slice(0, 400)}`);
+    }
+    return { content: [{ type: "text", text: text || "{}" }] };
+  });
+  return server;
+}
 
 // src/index.ts
 async function main() {

package/dist/mcp/slack-channel.js

@@ -31312,6 +31312,12 @@ var integration_metadata_v1_default = {
               description: "Optional query-string shape with `{arg}` placeholders.",
               additionalProperties: { type: "string" }
             },
+            headers_template: {
+              type: "object",
+              description: 'Optional request-header shape with `{arg}` placeholders (e.g. `{ "x-origami-project": "{project_id}" }`). A header whose template resolves to empty is dropped rather than sent blank, and args consumed only by a header template are excluded from a `{$body}` expansion.',
+              propertyNames: { pattern: "^[A-Za-z0-9!#$%&'*+.^_`|~-]+$" },
+              additionalProperties: { type: "string" }
+            },
             idempotency_key_header: {
               type: "string",
               minLength: 1,

package/dist/mcp/telegram-channel.js

@@ -31614,6 +31614,12 @@ var integration_metadata_v1_default = {
               description: "Optional query-string shape with `{arg}` placeholders.",
               additionalProperties: { type: "string" }
             },
+            headers_template: {
+              type: "object",
+              description: 'Optional request-header shape with `{arg}` placeholders (e.g. `{ "x-origami-project": "{project_id}" }`). A header whose template resolves to empty is dropped rather than sent blank, and args consumed only by a header template are excluded from a `{$body}` expansion.',
+              propertyNames: { pattern: "^[A-Za-z0-9!#$%&'*+.^_`|~-]+$" },
+              additionalProperties: { type: "string" }
+            },
             idempotency_key_header: {
               type: "string",
               minLength: 1,

package/dist/{persistent-session-Z2UQ4VVF.js → persistent-session-LEWM6BKO.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-UIUYOGPK.js";
+} from "./chunk-QFBCK4ZH.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-Z2UQ4VVF.js.map
+//# sourceMappingURL=persistent-session-LEWM6BKO.js.map

package/dist/{responsiveness-probe-WCF2QEVT.js → responsiveness-probe-U6DPVIDD.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-UIUYOGPK.js";
+} from "./chunk-QFBCK4ZH.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -528,4 +528,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-WCF2QEVT.js.map
+//# sourceMappingURL=responsiveness-probe-U6DPVIDD.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.456",
+  "version": "0.28.457",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {