@integrity-labs/agt-cli 0.28.483 → 0.28.485

package/dist/{claude-pair-runtime-2XPTEGQR.js → claude-pair-runtime-STSHUESG.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-IBMUPQZ2.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-CEGPLUHO.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-2XPTEGQR.js.map
+//# sourceMappingURL=claude-pair-runtime-STSHUESG.js.map

package/dist/lib/manager-worker.js

@@ -44,7 +44,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-EGVOVL5P.js";
+} from "../chunk-QFQTGSXQ.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -162,7 +162,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-DNC5JGOV.js";
+} from "../chunk-SRR5XVWJ.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -10064,7 +10064,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.483" : "dev";
+var agtCliVersion = true ? "0.28.485" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11227,7 +11227,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-IBMUPQZ2.js");
+      const { collectDiagnostics } = await import("../persistent-session-CEGPLUHO.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11334,7 +11334,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-IBMUPQZ2.js");
+      const { collectDiagnostics } = await import("../persistent-session-CEGPLUHO.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11448,7 +11448,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-QBLQIMZR.js");
+      } = await import("../responsiveness-probe-RBLOTOHD.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11512,7 +11512,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-QBLQIMZR.js");
+        } = await import("../responsiveness-probe-RBLOTOHD.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14988,7 +14988,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-IBMUPQZ2.js");
+        const { collectDiagnostics } = await import("../persistent-session-CEGPLUHO.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15038,7 +15038,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-IBMUPQZ2.js");
+      const { collectDiagnostics } = await import("../persistent-session-CEGPLUHO.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15496,7 +15496,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-2XPTEGQR.js");
+  } = await import("../claude-pair-runtime-STSHUESG.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -30218,7 +30218,7 @@ function recordChannelDeflection(agentDir, channel, cause) {
 }
 
 // src/turn-failure-watch.ts
-import { readFileSync as readFileSync9, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
+import { readdirSync as readdirSync5, statSync as statSync2 } from "fs";
 import { join as join9 } from "path";
 
 // ../core/dist/types/integration.js
@@ -33208,18 +33208,27 @@ var INTEGRATION_REGISTRY = [
     id: "firecrawl",
     name: "Firecrawl",
     category: "knowledge",
-    description: "Web data for agents: scrape, map, crawl and search any website for clean structured data, plus scheduled change-detection monitors whose updates arrive in the agent's direct-chat. Augmented Team manages Firecrawl access for you - there is no key to enter.",
+    description: "Web data for agents: scrape, map, crawl and search any website for clean structured data, plus scheduled change-detection monitors whose updates arrive in the agent's direct-chat. Connect via the platform-managed account, or bring your own Firecrawl API key.",
     // ENG-7217: Firecrawl migrates from a customer-API-key stdio MCP
     // (`npx firecrawl-mcp`, FIRECRAWL_API_KEY) to a PREMIUM, platform-managed
     // integration on the Deck / ElevenLabs model (ADR-0031, epic ENG-6920):
     // Augmented holds ONE Firecrawl account key (`FIRECRAWL_ACCOUNT_KEY`) that
-    // every customer agent's web-data calls bill back to, so the key is a single
-    // platform-held secret, NOT a per-agent credential. Auth type is therefore
-    // `none` - customers never enter a key. The agent-facing tools are brokered
-    // server-side (firecrawl-broker.ts, reusing the official @mendable/firecrawl-js
-    // SDK) rather than via the stdio MCP, so usage can be metered at the one
-    // control-plane chokepoint and gated on a per-org opt-in + monthly USD cap.
-    supported_auth_types: ["none"],
+    // every customer agent's web-data calls bill back to. The agent-facing tools
+    // are brokered server-side (firecrawl-broker.ts, reusing the official
+    // @mendable/firecrawl-js SDK) rather than via the stdio MCP, so managed usage
+    // is metered at the one control-plane chokepoint and gated on a per-org opt-in
+    // + monthly USD cap.
+    //
+    // ENG-8304 / ADR-0055 (Phase 1b — Firecrawl is the BYO exemplar): `api_key` is
+    // now also offered so a customer can bring their OWN Firecrawl key. A BYO
+    // install (`credential_source='byo'`) authenticates with the customer's key
+    // (stored encrypted on the install) and is NOT metered — its upstream cost is
+    // on the customer's own Firecrawl bill. BYO is gated on the plan-tier
+    // `byo_credentials` entitlement; managed stays the platform-key, billed path.
+    // `api_key` is the BYO option; the connect UI offers it via the toolkit's
+    // `auth_types` seed (Firecrawl surfaces through the premium list, not the
+    // native `installable` picker — that descriptor is for non-premium natives).
+    supported_auth_types: ["none", "api_key"],
     capabilities: [
       { id: "firecrawl:scrape", name: "Scrape Pages", description: "Fetch a single URL as clean markdown / structured data (firecrawl_scrape).", access: "write" },
       { id: "firecrawl:search", name: "Web Search", description: "Search the web and return ranked results, optionally scraped (firecrawl_search).", access: "write" },
@@ -35352,11 +35361,77 @@ function deriveBindFailureQuarantineThreshold(provisioningMax) {
 var MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING = BIND_FAILURE_QUARANTINE_THRESHOLD + 1;
 
 // src/rate-limit-watch.ts
-import { readFileSync as readFileSync8, readdirSync as readdirSync4, statSync } from "fs";
+import { closeSync, fstatSync, openSync, readSync, readdirSync as readdirSync4, statSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join8 } from "path";
 var DEFAULT_WATCH_MS = 5e3;
 var DEFAULT_POLL_MS = 400;
+var INITIAL_TAIL_BYTES = 256 * 1024;
+var TAIL_WIDEN_FACTOR = 8;
+var TAIL_SKEW_TOLERANCE_MS = 5 * 6e4;
+function readClassifiableTail(path, sinceMs, opts) {
+  let want = Math.max(1, opts?.initialBytes ?? INITIAL_TAIL_BYTES);
+  for (; ; ) {
+    const slice = readTailSlice(path, want);
+    if (slice === null) return "";
+    if (slice.fromStart) return slice.text;
+    const oldest = oldestTimestampMs(slice.text);
+    if (oldest !== null && oldest < sinceMs - TAIL_SKEW_TOLERANCE_MS) return slice.text;
+    want *= TAIL_WIDEN_FACTOR;
+  }
+}
+function readTailSlice(path, bytes) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const size = fstatSync(fd).size;
+    const start = size > bytes ? size - bytes : 0;
+    const len = size - start;
+    if (len <= 0) return { text: "", fromStart: true };
+    const buf = Buffer.allocUnsafe(len);
+    let read = 0;
+    while (read < len) {
+      const n = readSync(fd, buf, read, len - read, start + read);
+      if (n <= 0) break;
+      read += n;
+    }
+    if (read < len) return null;
+    let text = buf.subarray(0, read).toString("utf-8");
+    if (start > 0) {
+      const nl = text.indexOf("\n");
+      text = nl === -1 ? "" : text.slice(nl + 1);
+    }
+    return { text, fromStart: start === 0 };
+  } catch {
+    return null;
+  } finally {
+    closeSync(fd);
+  }
+}
+function oldestTimestampMs(text) {
+  let idx = 0;
+  while (idx < text.length) {
+    const nl = text.indexOf("\n", idx);
+    const line = (nl === -1 ? text.slice(idx) : text.slice(idx, nl)).trim();
+    if (line) {
+      try {
+        const ts = JSON.parse(line).timestamp;
+        if (typeof ts === "string") {
+          const ms = new Date(ts).getTime();
+          if (Number.isFinite(ms)) return ms;
+        }
+      } catch {
+      }
+    }
+    if (nl === -1) break;
+    idx = nl + 1;
+  }
+  return null;
+}
 function agentTranscriptDir(opts) {
   const cwd = opts?.cwd ?? process.cwd();
   const home = opts?.home ?? homedir2();
@@ -35380,12 +35455,10 @@ function classifyTranscriptSince(opts) {
     } catch {
       continue;
     }
-    let content;
-    try {
-      content = readFileSync8(path, "utf-8");
-    } catch {
-      continue;
-    }
+    const content = readClassifiableTail(path, opts.sinceMs, {
+      ...opts.initialTailBytes != null ? { initialBytes: opts.initialTailBytes } : {}
+    });
+    if (!content) continue;
     newest = pickNewerClassification(
       newest,
       classifyTranscriptRateLimit(content, opts.sinceMs, opts.nowMs, new Date(opts.nowMs))
@@ -35463,12 +35536,8 @@ function classifyTurnFailureSince(opts) {
     if (cached2 && cached2.fingerprint === fingerprint) {
       scan = cached2.scan;
     } else {
-      let content;
-      try {
-        content = readFileSync9(path, "utf-8");
-      } catch {
-        continue;
-      }
+      const content = readClassifiableTail(path, opts.sinceMs);
+      if (!content) continue;
       const analysis = analyzeTranscriptTurnFailure(content, opts.sinceMs, opts.nowMs);
       scan = {
         result: analysis.result,
@@ -35637,7 +35706,7 @@ async function fetchWithTimeout(input, init, timeoutMs, fetchImpl = fetch) {
 import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync8,
   renameSync as renameSync4,
   statSync as statSync3,
   unlinkSync as unlinkSync3,
@@ -35734,7 +35803,7 @@ function defaultLockMtimeMs(path) {
 function readLockHolder(path) {
   if (!existsSync5(path)) return null;
   try {
-    const raw = readFileSync10(path, "utf8");
+    const raw = readFileSync8(path, "utf8");
     const parsed = JSON.parse(raw);
     const pid = typeof parsed.pid === "number" ? parsed.pid : Number(parsed.pid);
     if (!Number.isFinite(pid) || pid <= 0) return null;
@@ -35753,7 +35822,7 @@ import {
   watch,
   mkdirSync as mkdirSync5,
   writeFileSync as writeFileSync6,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync10,
   readdirSync as readdirSync6,
   existsSync as existsSync6,
   renameSync as renameSync5,
@@ -36186,7 +36255,7 @@ function isMaintenanceModeActive(opts) {
 }
 
 // src/account-enforcement-notice.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join12 } from "path";
 
@@ -36213,7 +36282,7 @@ function readAccountEnforcementLevel(opts) {
   if (!path) return null;
   let raw;
   try {
-    raw = readFileSync11(path, "utf-8");
+    raw = readFileSync9(path, "utf-8");
   } catch {
     return null;
   }
@@ -36352,7 +36421,7 @@ var directChatKanbanCardClient = createKanbanCardActiveClient({
 function readProgressHeartbeat() {
   if (!PROGRESS_HEARTBEAT_PATH || !existsSync6(PROGRESS_HEARTBEAT_PATH)) return null;
   try {
-    return parseProgressHeartbeat(readFileSync12(PROGRESS_HEARTBEAT_PATH, "utf-8"));
+    return parseProgressHeartbeat(readFileSync10(PROGRESS_HEARTBEAT_PATH, "utf-8"));
   } catch {
     return null;
   }
@@ -37319,7 +37388,7 @@ function sweepAgedDirectChatMarkersNow(thresholdMs) {
   const now = Date.now();
   const res = sweepAgedDirectChatMarkers(DIRECT_CHAT_PENDING_INBOUND_DIR, {
     readdir: (dir) => readdirSync6(dir),
-    readFile: (p2) => readFileSync12(p2, "utf8"),
+    readFile: (p2) => readFileSync10(p2, "utf8"),
     unlink: (p2) => {
       if (existsSync6(p2)) unlinkSync4(p2);
     },
@@ -37355,7 +37424,7 @@ function sanitizeRecoveryText(text) {
 }
 function directChatRecoveryDeps() {
   return {
-    readFile: (p2) => readFileSync12(p2, "utf-8"),
+    readFile: (p2) => readFileSync10(p2, "utf-8"),
     renameFile: (from, to) => renameSync5(from, to),
     unlinkFile: (p2) => {
       if (existsSync6(p2)) unlinkSync4(p2);

package/dist/mcp/origami.js

@@ -39535,18 +39535,27 @@ var INTEGRATION_REGISTRY = [
     id: "firecrawl",
     name: "Firecrawl",
     category: "knowledge",
-    description: "Web data for agents: scrape, map, crawl and search any website for clean structured data, plus scheduled change-detection monitors whose updates arrive in the agent's direct-chat. Augmented Team manages Firecrawl access for you - there is no key to enter.",
+    description: "Web data for agents: scrape, map, crawl and search any website for clean structured data, plus scheduled change-detection monitors whose updates arrive in the agent's direct-chat. Connect via the platform-managed account, or bring your own Firecrawl API key.",
     // ENG-7217: Firecrawl migrates from a customer-API-key stdio MCP
     // (`npx firecrawl-mcp`, FIRECRAWL_API_KEY) to a PREMIUM, platform-managed
     // integration on the Deck / ElevenLabs model (ADR-0031, epic ENG-6920):
     // Augmented holds ONE Firecrawl account key (`FIRECRAWL_ACCOUNT_KEY`) that
-    // every customer agent's web-data calls bill back to, so the key is a single
-    // platform-held secret, NOT a per-agent credential. Auth type is therefore
-    // `none` - customers never enter a key. The agent-facing tools are brokered
-    // server-side (firecrawl-broker.ts, reusing the official @mendable/firecrawl-js
-    // SDK) rather than via the stdio MCP, so usage can be metered at the one
-    // control-plane chokepoint and gated on a per-org opt-in + monthly USD cap.
-    supported_auth_types: ["none"],
+    // every customer agent's web-data calls bill back to. The agent-facing tools
+    // are brokered server-side (firecrawl-broker.ts, reusing the official
+    // @mendable/firecrawl-js SDK) rather than via the stdio MCP, so managed usage
+    // is metered at the one control-plane chokepoint and gated on a per-org opt-in
+    // + monthly USD cap.
+    //
+    // ENG-8304 / ADR-0055 (Phase 1b — Firecrawl is the BYO exemplar): `api_key` is
+    // now also offered so a customer can bring their OWN Firecrawl key. A BYO
+    // install (`credential_source='byo'`) authenticates with the customer's key
+    // (stored encrypted on the install) and is NOT metered — its upstream cost is
+    // on the customer's own Firecrawl bill. BYO is gated on the plan-tier
+    // `byo_credentials` entitlement; managed stays the platform-key, billed path.
+    // `api_key` is the BYO option; the connect UI offers it via the toolkit's
+    // `auth_types` seed (Firecrawl surfaces through the premium list, not the
+    // native `installable` picker — that descriptor is for non-premium natives).
+    supported_auth_types: ["none", "api_key"],
     capabilities: [
       { id: "firecrawl:scrape", name: "Scrape Pages", description: "Fetch a single URL as clean markdown / structured data (firecrawl_scrape).", access: "write" },
       { id: "firecrawl:search", name: "Web Search", description: "Search the web and return ranked results, optionally scraped (firecrawl_search).", access: "write" },