@integrity-labs/agt-cli 0.28.506 → 0.28.507

package/dist/mcp/direct-chat-channel.js

@@ -34950,6 +34950,36 @@ var FLAG_REGISTRY = [
     // AGT_RESUME_RECONCILER_ENABLED set keeps that value until the env is retired.
     envVar: "AGT_RESUME_RECONCILER_ENABLED"
   },
+  {
+    key: "auto-resume-enabled",
+    description: "DO NOT ARM YET (ENG-8395): this flag has no `since` set until a follow-up bisects it from the published agt-cli dist, and an unset `since` makes the flip-reach estimate report FULL reach for a reader that is host-side \u2014 it will tell you a flip reached hosts that have no code to honour it. Arm only once that follow-up has landed. Bounded BLIND auto-resume for circuit-breaker pauses (ENG-6088): at most one unattended resume per trip cycle, fired once the trip driver has been quiet for the configured window and only for provisioning-reload trips (the ENG-7577 class gate \u2014 a crash-class trip still needs an operator). Superseded wherever `resume-reconciler` is on: that path proves the dependency recovered instead of assuming it, and the blind timer is its flag-off fallback. Boolean gate; ships dark. ENG-8395 promoted this from a raw host env var because AGT_AUTO_RESUME_ENABLED lives in the host env file, so its grain is per-HOST \u2014 one flip arms every agent that host runs (agt-aws-1 carries 14), which made the canary-then-fleet rollout its own documentation prescribes impossible. As a registry flag it resolves per org/team/host/AGENT, so one agent can genuinely be cut over first. Read host-side by the manager (agt-cli), not centrally.",
+    flagType: "boolean",
+    // Declared safe value is `false` — identical to today's behaviour on a host
+    // that has never set the env var. Fail-safe direction on a flag-DB read
+    // error is "no unattended resume of a paused agent".
+    defaultValue: false,
+    // Migration override (ADR-0022) — KEPT, not swapped (ENG-8395 is an addition).
+    // The pre-flags env gate stays the highest-precedence operator override so a
+    // host already running with AGT_AUTO_RESUME_ENABLED set keeps that value, and
+    // so an operator retains a host-local escape hatch that needs no control-plane
+    // round-trip. Note the host reader accepts a slightly WIDER truthy vocabulary
+    // than coerceEnvValue (it also honours the legacy yes/on/no/off spellings);
+    // both agree on true/1/false/0, and the reader is the authority for this gate.
+    envVar: "AGT_AUTO_RESUME_ENABLED",
+    // An unattended resume is a real availability change — the agent starts
+    // spawning sessions again with no human in the loop — so arming it is a
+    // deliberate, confirmed write (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+    // ENG-8395 AC5: `since` is deliberately UNSET at merge. It must be bisected
+    // from the PUBLISHED agt-cli dist once the artifact carrying the host-side
+    // reader exists, never guessed — auto-resume.ts is host-side, so an
+    // under-`since` host has no consumer for this flag and a guessed value makes
+    // the flip-reach modal promise reach it does not have (the defect caught on
+    // ENG-8344 / PR #4014). Precedent for the bisect method: slack-hot-thread-guard
+    // = 0.28.339, slack-scheduled-channel-guard = 0.28.421. Setting it later is
+    // safe: `since` is excluded from projectDefinition, so it does not roll
+    // FLAGS_SCHEMA_VERSION.
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",

package/dist/mcp/origami.js

@@ -40841,6 +40841,36 @@ var FLAG_REGISTRY = [
     // AGT_RESUME_RECONCILER_ENABLED set keeps that value until the env is retired.
     envVar: "AGT_RESUME_RECONCILER_ENABLED"
   },
+  {
+    key: "auto-resume-enabled",
+    description: "DO NOT ARM YET (ENG-8395): this flag has no `since` set until a follow-up bisects it from the published agt-cli dist, and an unset `since` makes the flip-reach estimate report FULL reach for a reader that is host-side \u2014 it will tell you a flip reached hosts that have no code to honour it. Arm only once that follow-up has landed. Bounded BLIND auto-resume for circuit-breaker pauses (ENG-6088): at most one unattended resume per trip cycle, fired once the trip driver has been quiet for the configured window and only for provisioning-reload trips (the ENG-7577 class gate \u2014 a crash-class trip still needs an operator). Superseded wherever `resume-reconciler` is on: that path proves the dependency recovered instead of assuming it, and the blind timer is its flag-off fallback. Boolean gate; ships dark. ENG-8395 promoted this from a raw host env var because AGT_AUTO_RESUME_ENABLED lives in the host env file, so its grain is per-HOST \u2014 one flip arms every agent that host runs (agt-aws-1 carries 14), which made the canary-then-fleet rollout its own documentation prescribes impossible. As a registry flag it resolves per org/team/host/AGENT, so one agent can genuinely be cut over first. Read host-side by the manager (agt-cli), not centrally.",
+    flagType: "boolean",
+    // Declared safe value is `false` — identical to today's behaviour on a host
+    // that has never set the env var. Fail-safe direction on a flag-DB read
+    // error is "no unattended resume of a paused agent".
+    defaultValue: false,
+    // Migration override (ADR-0022) — KEPT, not swapped (ENG-8395 is an addition).
+    // The pre-flags env gate stays the highest-precedence operator override so a
+    // host already running with AGT_AUTO_RESUME_ENABLED set keeps that value, and
+    // so an operator retains a host-local escape hatch that needs no control-plane
+    // round-trip. Note the host reader accepts a slightly WIDER truthy vocabulary
+    // than coerceEnvValue (it also honours the legacy yes/on/no/off spellings);
+    // both agree on true/1/false/0, and the reader is the authority for this gate.
+    envVar: "AGT_AUTO_RESUME_ENABLED",
+    // An unattended resume is a real availability change — the agent starts
+    // spawning sessions again with no human in the loop — so arming it is a
+    // deliberate, confirmed write (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+    // ENG-8395 AC5: `since` is deliberately UNSET at merge. It must be bisected
+    // from the PUBLISHED agt-cli dist once the artifact carrying the host-side
+    // reader exists, never guessed — auto-resume.ts is host-side, so an
+    // under-`since` host has no consumer for this flag and a guessed value makes
+    // the flip-reach modal promise reach it does not have (the defect caught on
+    // ENG-8344 / PR #4014). Precedent for the bisect method: slack-hot-thread-guard
+    // = 0.28.339, slack-scheduled-channel-guard = 0.28.421. Setting it later is
+    // safe: `since` is excluded from projectDefinition, so it does not roll
+    // FLAGS_SCHEMA_VERSION.
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",

package/dist/mcp/slack-channel.js

@@ -35119,6 +35119,36 @@ var FLAG_REGISTRY = [
     // AGT_RESUME_RECONCILER_ENABLED set keeps that value until the env is retired.
     envVar: "AGT_RESUME_RECONCILER_ENABLED"
   },
+  {
+    key: "auto-resume-enabled",
+    description: "DO NOT ARM YET (ENG-8395): this flag has no `since` set until a follow-up bisects it from the published agt-cli dist, and an unset `since` makes the flip-reach estimate report FULL reach for a reader that is host-side \u2014 it will tell you a flip reached hosts that have no code to honour it. Arm only once that follow-up has landed. Bounded BLIND auto-resume for circuit-breaker pauses (ENG-6088): at most one unattended resume per trip cycle, fired once the trip driver has been quiet for the configured window and only for provisioning-reload trips (the ENG-7577 class gate \u2014 a crash-class trip still needs an operator). Superseded wherever `resume-reconciler` is on: that path proves the dependency recovered instead of assuming it, and the blind timer is its flag-off fallback. Boolean gate; ships dark. ENG-8395 promoted this from a raw host env var because AGT_AUTO_RESUME_ENABLED lives in the host env file, so its grain is per-HOST \u2014 one flip arms every agent that host runs (agt-aws-1 carries 14), which made the canary-then-fleet rollout its own documentation prescribes impossible. As a registry flag it resolves per org/team/host/AGENT, so one agent can genuinely be cut over first. Read host-side by the manager (agt-cli), not centrally.",
+    flagType: "boolean",
+    // Declared safe value is `false` — identical to today's behaviour on a host
+    // that has never set the env var. Fail-safe direction on a flag-DB read
+    // error is "no unattended resume of a paused agent".
+    defaultValue: false,
+    // Migration override (ADR-0022) — KEPT, not swapped (ENG-8395 is an addition).
+    // The pre-flags env gate stays the highest-precedence operator override so a
+    // host already running with AGT_AUTO_RESUME_ENABLED set keeps that value, and
+    // so an operator retains a host-local escape hatch that needs no control-plane
+    // round-trip. Note the host reader accepts a slightly WIDER truthy vocabulary
+    // than coerceEnvValue (it also honours the legacy yes/on/no/off spellings);
+    // both agree on true/1/false/0, and the reader is the authority for this gate.
+    envVar: "AGT_AUTO_RESUME_ENABLED",
+    // An unattended resume is a real availability change — the agent starts
+    // spawning sessions again with no human in the loop — so arming it is a
+    // deliberate, confirmed write (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+    // ENG-8395 AC5: `since` is deliberately UNSET at merge. It must be bisected
+    // from the PUBLISHED agt-cli dist once the artifact carrying the host-side
+    // reader exists, never guessed — auto-resume.ts is host-side, so an
+    // under-`since` host has no consumer for this flag and a guessed value makes
+    // the flip-reach modal promise reach it does not have (the defect caught on
+    // ENG-8344 / PR #4014). Precedent for the bisect method: slack-hot-thread-guard
+    // = 0.28.339, slack-scheduled-channel-guard = 0.28.421. Setting it later is
+    // safe: `since` is excluded from projectDefinition, so it does not roll
+    // FLAGS_SCHEMA_VERSION.
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",

package/dist/mcp/telegram-channel.js

@@ -35445,6 +35445,36 @@ var FLAG_REGISTRY = [
     // AGT_RESUME_RECONCILER_ENABLED set keeps that value until the env is retired.
     envVar: "AGT_RESUME_RECONCILER_ENABLED"
   },
+  {
+    key: "auto-resume-enabled",
+    description: "DO NOT ARM YET (ENG-8395): this flag has no `since` set until a follow-up bisects it from the published agt-cli dist, and an unset `since` makes the flip-reach estimate report FULL reach for a reader that is host-side \u2014 it will tell you a flip reached hosts that have no code to honour it. Arm only once that follow-up has landed. Bounded BLIND auto-resume for circuit-breaker pauses (ENG-6088): at most one unattended resume per trip cycle, fired once the trip driver has been quiet for the configured window and only for provisioning-reload trips (the ENG-7577 class gate \u2014 a crash-class trip still needs an operator). Superseded wherever `resume-reconciler` is on: that path proves the dependency recovered instead of assuming it, and the blind timer is its flag-off fallback. Boolean gate; ships dark. ENG-8395 promoted this from a raw host env var because AGT_AUTO_RESUME_ENABLED lives in the host env file, so its grain is per-HOST \u2014 one flip arms every agent that host runs (agt-aws-1 carries 14), which made the canary-then-fleet rollout its own documentation prescribes impossible. As a registry flag it resolves per org/team/host/AGENT, so one agent can genuinely be cut over first. Read host-side by the manager (agt-cli), not centrally.",
+    flagType: "boolean",
+    // Declared safe value is `false` — identical to today's behaviour on a host
+    // that has never set the env var. Fail-safe direction on a flag-DB read
+    // error is "no unattended resume of a paused agent".
+    defaultValue: false,
+    // Migration override (ADR-0022) — KEPT, not swapped (ENG-8395 is an addition).
+    // The pre-flags env gate stays the highest-precedence operator override so a
+    // host already running with AGT_AUTO_RESUME_ENABLED set keeps that value, and
+    // so an operator retains a host-local escape hatch that needs no control-plane
+    // round-trip. Note the host reader accepts a slightly WIDER truthy vocabulary
+    // than coerceEnvValue (it also honours the legacy yes/on/no/off spellings);
+    // both agree on true/1/false/0, and the reader is the authority for this gate.
+    envVar: "AGT_AUTO_RESUME_ENABLED",
+    // An unattended resume is a real availability change — the agent starts
+    // spawning sessions again with no human in the loop — so arming it is a
+    // deliberate, confirmed write (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+    // ENG-8395 AC5: `since` is deliberately UNSET at merge. It must be bisected
+    // from the PUBLISHED agt-cli dist once the artifact carrying the host-side
+    // reader exists, never guessed — auto-resume.ts is host-side, so an
+    // under-`since` host has no consumer for this flag and a guessed value makes
+    // the flip-reach modal promise reach it does not have (the defect caught on
+    // ENG-8344 / PR #4014). Precedent for the bisect method: slack-hot-thread-guard
+    // = 0.28.339, slack-scheduled-channel-guard = 0.28.421. Setting it later is
+    // safe: `since` is excluded from projectDefinition, so it does not roll
+    // FLAGS_SCHEMA_VERSION.
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",

package/dist/{persistent-session-RAXQFDPB.js → persistent-session-OMAAP4OU.js}

@@ -37,7 +37,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-SMHHGXI5.js";
+} from "./chunk-4PRR22KH.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -79,4 +79,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-RAXQFDPB.js.map
+//# sourceMappingURL=persistent-session-OMAAP4OU.js.map

package/dist/{responsiveness-probe-PBWABVLJ.js → responsiveness-probe-NRH2AQW6.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-SMHHGXI5.js";
+} from "./chunk-4PRR22KH.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -662,4 +662,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-PBWABVLJ.js.map
+//# sourceMappingURL=responsiveness-probe-NRH2AQW6.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.506",
+  "version": "0.28.507",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {