@integrity-labs/agt-cli 0.28.506 → 0.28.508

package/dist/{chunk-SMHHGXI5.js → chunk-LNPJI2AE.js}

@@ -9819,6 +9819,36 @@ var FLAG_REGISTRY = [
     // AGT_RESUME_RECONCILER_ENABLED set keeps that value until the env is retired.
     envVar: "AGT_RESUME_RECONCILER_ENABLED"
   },
+  {
+    key: "auto-resume-enabled",
+    description: "DO NOT ARM YET (ENG-8395): this flag has no `since` set until a follow-up bisects it from the published agt-cli dist, and an unset `since` makes the flip-reach estimate report FULL reach for a reader that is host-side \u2014 it will tell you a flip reached hosts that have no code to honour it. Arm only once that follow-up has landed. Bounded BLIND auto-resume for circuit-breaker pauses (ENG-6088): at most one unattended resume per trip cycle, fired once the trip driver has been quiet for the configured window and only for provisioning-reload trips (the ENG-7577 class gate \u2014 a crash-class trip still needs an operator). Superseded wherever `resume-reconciler` is on: that path proves the dependency recovered instead of assuming it, and the blind timer is its flag-off fallback. Boolean gate; ships dark. ENG-8395 promoted this from a raw host env var because AGT_AUTO_RESUME_ENABLED lives in the host env file, so its grain is per-HOST \u2014 one flip arms every agent that host runs (agt-aws-1 carries 14), which made the canary-then-fleet rollout its own documentation prescribes impossible. As a registry flag it resolves per org/team/host/AGENT, so one agent can genuinely be cut over first. Read host-side by the manager (agt-cli), not centrally.",
+    flagType: "boolean",
+    // Declared safe value is `false` — identical to today's behaviour on a host
+    // that has never set the env var. Fail-safe direction on a flag-DB read
+    // error is "no unattended resume of a paused agent".
+    defaultValue: false,
+    // Migration override (ADR-0022) — KEPT, not swapped (ENG-8395 is an addition).
+    // The pre-flags env gate stays the highest-precedence operator override so a
+    // host already running with AGT_AUTO_RESUME_ENABLED set keeps that value, and
+    // so an operator retains a host-local escape hatch that needs no control-plane
+    // round-trip. Note the host reader accepts a slightly WIDER truthy vocabulary
+    // than coerceEnvValue (it also honours the legacy yes/on/no/off spellings);
+    // both agree on true/1/false/0, and the reader is the authority for this gate.
+    envVar: "AGT_AUTO_RESUME_ENABLED",
+    // An unattended resume is a real availability change — the agent starts
+    // spawning sessions again with no human in the loop — so arming it is a
+    // deliberate, confirmed write (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+    // ENG-8395 AC5: `since` is deliberately UNSET at merge. It must be bisected
+    // from the PUBLISHED agt-cli dist once the artifact carrying the host-side
+    // reader exists, never guessed — auto-resume.ts is host-side, so an
+    // under-`since` host has no consumer for this flag and a guessed value makes
+    // the flip-reach modal promise reach it does not have (the defect caught on
+    // ENG-8344 / PR #4014). Precedent for the bisect method: slack-hot-thread-guard
+    // = 0.28.339, slack-scheduled-channel-guard = 0.28.421. Setting it later is
+    // safe: `since` is excluded from projectDefinition, so it does not roll
+    // FLAGS_SCHEMA_VERSION.
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",
@@ -10341,6 +10371,54 @@ var FLAG_REGISTRY = [
     // Turning this on lets agents originate proposals that create customer
     // infrastructure once approved — same posture as augmented-support-writes.
     sensitive: true
+  },
+  {
+    key: "github-broker-credentials",
+    description: "Deliver GitHub App installation tokens to `git` and the `gh` CLI through the broker credential endpoint at USE time, instead of materializing them into the agent process environment at spawn (ENG-8344). A GitHub App installation token has a ~1h TTL, so the spawn-frozen GITHUB_ACCESS_TOKEN / GITHUB_TOKEN pair rotates hourly; the wrapper sources `.env.integrations` exactly once, so the only way a running agent sees the new value is a full session respawn (measured: 6 agents, ~144 kills/day). ENG-8343 stopped those kills landing mid-turn; this removes them. ON: `POST /host/agent-integrations` stops minting the installation token into the payload for auth_type=github_app rows (so computeIntegrationsHash stops seeing a rotating value) and marks the row credential_delivery=broker; the claudecode adapter then writes a git credential helper + a `gh` shim that fetch a fresh token per use from POST /host/agent-integrations/github/credential (ENG-8264 name addressing). OFF (default): byte-for-byte today's behaviour - the token is minted into the payload and materialized as GITHUB_ACCESS_TOKEN / GITHUB_TOKEN, no helper, no shim. NOTE the scope of the security claim: this removes the token from the agent's ENVIRONMENT, which is what stops the respawns. It does NOT make the token unreachable by a determined agent - the agent can invoke the helper itself. Strictly better than today, not a sandbox. Evaluated API-side only, per agent, in POST /host/agent-integrations; no host-side envVar. The host does not read this flag - it keys off the resulting credential_delivery marker on the row - so there is deliberately no host override that could put the token back on its own. Roll back from the flag.",
+    flagType: "boolean",
+    // Declared safe value is `false` = today's env delivery. Fail-safe direction:
+    // a flag-DB read error must never strip `git`/`gh` credentials off a live
+    // agent, which is what the ON path does when its host has no helper writer.
+    defaultValue: false,
+    // Flipping ON changes how every GitHub App agent on the scope authenticates
+    // `git push` / `gh`. A bad flip takes those away, so it is a deliberate,
+    // confirmed action (ADR-0022 §4).
+    sensitive: true,
+    // Set even though the flag is evaluated centrally, because `since` is a
+    // REACH threshold ("a host this old has no consumer code for the flag") and
+    // that is exactly the hazard here: the host does not read the flag, but it
+    // does need the claudecode adapter's helper/shim writer and the wrapper PATH
+    // prepend. On a host too old for those, the API would stop shipping the
+    // token and NOTHING would replace it. Without `since` the flip-reach modal
+    // reports FULL reach and hides that.
+    //
+    // DELIBERATE UNREACHABLE PLACEHOLDER - NOT A REAL THRESHOLD YET.
+    // The sibling entries in this registry (`slack-hot-thread-guard` 0.28.339,
+    // `slack-scheduled-channel-guard` 0.28.421) are BISECTED from published npm
+    // artifacts, which is only possible AFTER this merges and publishes. A
+    // pre-merge guess cannot be right, and the two directions are not
+    // symmetric:
+    //   - too HIGH  -> hosts classify `stale`, the modal over-warns. Annoying.
+    //   - too LOW   -> hosts classify `honors` while carrying NO helper writer,
+    //                  the modal promises full reach, and a flip strips `git`/
+    //                  `gh` credentials with nothing replacing them. Outage.
+    // So this is pinned ABOVE every published release on purpose: it classifies
+    // EVERY host as `stale`, so the modal reports no reach rather than reach it
+    // has no basis for. That is the intended pre-bisect state.
+    //
+    // BUT `since` IS ADVISORY, NOT A GUARD. It is read in exactly one place -
+    // `computeFlagReach` behind GET /admin/reach, which renders the flip-reach
+    // modal. `evaluate.ts` never reads it and neither does the override write
+    // path. The placeholder therefore changes what an operator is TOLD; it does
+    // not stop a flip on an under-`since` host. What actually holds the line
+    // here is `defaultValue: false` plus `sensitive: true` plus the runbook.
+    //
+    // BEFORE THIS FLAG IS FLIPPED ANYWHERE: bisect the published dist for the
+    // first agt-cli whose claudecode adapter writes agt-bin/ and whose wrapper
+    // prepends it, then replace this with that exact version. The rollout
+    // runbook gates on it. Leaving the placeholder in place is safe (nothing
+    // flips); shipping a guessed number is not.
+    since: "0.29.0"
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
@@ -13675,6 +13753,10 @@ function writePersistentClaudeWrapper(args) {
       "set +a"
     );
   }
+  const brokerBinDir = join6(projectDir, ".claude", "agt-bin");
+  if (existsSync6(brokerBinDir)) {
+    wrapperLines.push(`export PATH=${JSON.stringify(brokerBinDir)}:"$PATH"`);
+  }
   const initPromptArg = initPrompt ? `${JSON.stringify(initPrompt)} ` : "";
   wrapperLines.push(
     `exec ${JSON.stringify(claudeBin)} ${initPromptArg}${claudeArgsJoined}`
@@ -14826,4 +14908,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-SMHHGXI5.js.map
+//# sourceMappingURL=chunk-LNPJI2AE.js.map