@integrity-labs/agt-cli 0.28.508 → 0.28.510

package/dist/mcp/direct-chat-channel.js

@@ -32955,29 +32955,44 @@ var INTEGRATION_REGISTRY = [
     id: "vercel",
     name: "Vercel",
     category: "infrastructure",
-    description: "Check on Vercel app deployments \u2014 status, build/runtime logs \u2014 and search Vercel documentation. Remote streamable-HTTP MCP at https://mcp.vercel.com.",
-    // Same OAuth pattern as Granola/Higgsfield: Claude Code brokers the
-    // browser sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Check on Vercel app deployments \u2014 what's live, deployment status, and build logs \u2014 through Vercel's REST API with your own API token.",
+    // ENG-8421: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Vercel MCP (`https://mcp.vercel.com`) is not completable from the
+    // console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Established empirically 2026-08-03: Dynamic Client
+    // Registration REJECTS an https redirect (`invalid_redirect_uri` — "not
+    // approved for use by this authorization server") and ACCEPTS only
+    // localhost; the device-code grant, the one flow needing no redirect, is
+    // refused to DCR clients (`unauthorized_client`). So the only client
+    // Vercel permits is a local one redirecting to its own ephemeral port —
+    // i.e. Claude Code on the agent's host, driven by an operator running
+    // `/mcp` in tmux. No console work can remove that step.
+    //
+    // The REST API has none of those constraints: plain bearer auth
+    // (unauthenticated → `{"code":"forbidden","missingToken":true}`, bogus
+    // bearer → `{"invalidToken":true}`), so a token the customer creates in
+    // their own Vercel dashboard works directly. That makes this an ordinary
+    // paste-a-key integration, and it means WE hold the credential — so it can
+    // be stored, rotated, revoked and audited, none of which was true when the
+    // grant lived in Claude Code's `~/.claude.json` on the host.
+    //
+    // Tools are declared as data on `integration_definitions.metadata.tools`
+    // and dispatch through the existing Direct HTTP broker (the v0 pattern) —
+    // there is deliberately no bespoke Vercel client and no bespoke broker.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build/runtime logs.", access: "read" },
-      { id: "vercel:search-docs", name: "Search Documentation", description: "Search Vercel platform documentation.", access: "read" }
+      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build logs.", access: "read" }
     ],
-    docs_url: "https://vercel.com/docs/agent-resources/vercel-mcp",
-    // Beta until the headless OAuth flow (and Vercel's OAuth-client allowlist,
-    // which is vendor-side and outside our control) is verified end-to-end.
-    beta: true,
-    // No `auth`/`headers` — host-brokered OAuth (Claude Code authenticates
-    // directly with Vercel; nothing for us to inject). Declaring this here
-    // (rather than a hardcoded buildMcpJson/writeIntegrations branch, the
-    // pre-ENG-8035 Higgsfield-era pattern) lets the generic remote-MCP loop
-    // render the `.mcp.json` entry AND enrolls 'vercel' in the
-    // `registryRemoteMcpKeys` prune universe automatically, so an uninstall
-    // actually removes the entry instead of leaving it stale.
-    remoteMcp: {
-      type: "http",
-      url: "https://mcp.vercel.com"
-    }
+    docs_url: "https://vercel.com/docs/rest-api",
+    // Beta until the REST tool surface has been exercised against a real
+    // customer token. (The previous reason — "until the headless OAuth flow is
+    // verified end-to-end" — is void: there is no OAuth flow any more.)
+    beta: true
+    // NO `remoteMcp`. See the tombstone in the claudecode adapter's prune
+    // universe: dropping this field also drops `vercel` from
+    // `registryRemoteMcpKeys`, which would strand the `.mcp.json` entry on
+    // every host that installed the MCP variant.
   },
   {
     id: "qmd",
@@ -34980,6 +34995,22 @@ var FLAG_REGISTRY = [
     // safe: `since` is excluded from projectDefinition, so it does not roll
     // FLAGS_SCHEMA_VERSION.
   },
+  {
+    key: "agt-version-drift-alarm",
+    description: "Arms the ENG-8341 agt CLI version-drift alert. When a host has fallen behind its EFFECTIVE target (env pin > DB pin > release channel) across two or more of its OWN maintenance windows, the monitor opens a host_agt_version_drift alert. OBSERVE-FIRST rollout gate: the cron computes and LOGS the drift for every host on every run regardless of this flag, so the real fleet spread is measurable before anyone is paged - the ticket asks for the threshold to be set from observed data rather than a guess. Off = compute and log, open nothing. Boolean gate; ships dark. Evaluated API-side, in the cron.",
+    flagType: "boolean",
+    // Declared safe value is `false`. Fail-safe direction for a NEW alerting
+    // cron is silence: ~21 hosts with no prior drift signal means the first
+    // armed pass could open an alert for every host that is behind at once.
+    // The cron also carries a bootstrap floor (agent-stall-monitor.ts's
+    // precedent) so arming it does not retroactively page for drift that
+    // started before the monitor existed.
+    defaultValue: false,
+    // Arming this makes a previously-invisible backlog visible all at once, in
+    // the same shape ENG-8204's never-spawned-session-metric warned about - so
+    // the flip is a deliberate, confirmed one (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",

package/dist/mcp/index.js

@@ -21500,6 +21500,16 @@ function describeReconnectRequestResult(resp) {
         text: "A reconnect request for this integration was already sent recently, so no new notification went out. Stop retrying the failing tool and wait for the reconnect.",
         isError: false
       };
+    case "notified_disputed":
+      return {
+        text: "Reconnect request sent. Note that the platform still shows this integration as connected, so your report and the stored status disagree \u2014 your manager has been notified with both, and with the error you reported. Stop retrying the failing tool; a human has to resolve the disagreement.",
+        isError: false
+      };
+    // CS-1542: retained for older API stages that still return it. The route no
+    // longer emits `healthy` - a stored status is not a probe, so it is not
+    // allowed to end the request - but a host can run a newer CLI than the API
+    // it talks to, and the previous copy ("no reconnect request was sent") is
+    // the honest thing to say if this ever does come back.
     case "healthy":
       return {
         text: "The platform shows this integration as connected, so no reconnect request was sent. If the tool is still failing, tell your operator exactly what error you saw instead of retrying.",

package/dist/mcp/origami.js

@@ -39282,29 +39282,44 @@ var INTEGRATION_REGISTRY = [
     id: "vercel",
     name: "Vercel",
     category: "infrastructure",
-    description: "Check on Vercel app deployments \u2014 status, build/runtime logs \u2014 and search Vercel documentation. Remote streamable-HTTP MCP at https://mcp.vercel.com.",
-    // Same OAuth pattern as Granola/Higgsfield: Claude Code brokers the
-    // browser sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Check on Vercel app deployments \u2014 what's live, deployment status, and build logs \u2014 through Vercel's REST API with your own API token.",
+    // ENG-8421: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Vercel MCP (`https://mcp.vercel.com`) is not completable from the
+    // console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Established empirically 2026-08-03: Dynamic Client
+    // Registration REJECTS an https redirect (`invalid_redirect_uri` — "not
+    // approved for use by this authorization server") and ACCEPTS only
+    // localhost; the device-code grant, the one flow needing no redirect, is
+    // refused to DCR clients (`unauthorized_client`). So the only client
+    // Vercel permits is a local one redirecting to its own ephemeral port —
+    // i.e. Claude Code on the agent's host, driven by an operator running
+    // `/mcp` in tmux. No console work can remove that step.
+    //
+    // The REST API has none of those constraints: plain bearer auth
+    // (unauthenticated → `{"code":"forbidden","missingToken":true}`, bogus
+    // bearer → `{"invalidToken":true}`), so a token the customer creates in
+    // their own Vercel dashboard works directly. That makes this an ordinary
+    // paste-a-key integration, and it means WE hold the credential — so it can
+    // be stored, rotated, revoked and audited, none of which was true when the
+    // grant lived in Claude Code's `~/.claude.json` on the host.
+    //
+    // Tools are declared as data on `integration_definitions.metadata.tools`
+    // and dispatch through the existing Direct HTTP broker (the v0 pattern) —
+    // there is deliberately no bespoke Vercel client and no bespoke broker.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build/runtime logs.", access: "read" },
-      { id: "vercel:search-docs", name: "Search Documentation", description: "Search Vercel platform documentation.", access: "read" }
+      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build logs.", access: "read" }
     ],
-    docs_url: "https://vercel.com/docs/agent-resources/vercel-mcp",
-    // Beta until the headless OAuth flow (and Vercel's OAuth-client allowlist,
-    // which is vendor-side and outside our control) is verified end-to-end.
-    beta: true,
-    // No `auth`/`headers` — host-brokered OAuth (Claude Code authenticates
-    // directly with Vercel; nothing for us to inject). Declaring this here
-    // (rather than a hardcoded buildMcpJson/writeIntegrations branch, the
-    // pre-ENG-8035 Higgsfield-era pattern) lets the generic remote-MCP loop
-    // render the `.mcp.json` entry AND enrolls 'vercel' in the
-    // `registryRemoteMcpKeys` prune universe automatically, so an uninstall
-    // actually removes the entry instead of leaving it stale.
-    remoteMcp: {
-      type: "http",
-      url: "https://mcp.vercel.com"
-    }
+    docs_url: "https://vercel.com/docs/rest-api",
+    // Beta until the REST tool surface has been exercised against a real
+    // customer token. (The previous reason — "until the headless OAuth flow is
+    // verified end-to-end" — is void: there is no OAuth flow any more.)
+    beta: true
+    // NO `remoteMcp`. See the tombstone in the claudecode adapter's prune
+    // universe: dropping this field also drops `vercel` from
+    // `registryRemoteMcpKeys`, which would strand the `.mcp.json` entry on
+    // every host that installed the MCP variant.
   },
   {
     id: "qmd",
@@ -40871,6 +40886,22 @@ var FLAG_REGISTRY = [
     // safe: `since` is excluded from projectDefinition, so it does not roll
     // FLAGS_SCHEMA_VERSION.
   },
+  {
+    key: "agt-version-drift-alarm",
+    description: "Arms the ENG-8341 agt CLI version-drift alert. When a host has fallen behind its EFFECTIVE target (env pin > DB pin > release channel) across two or more of its OWN maintenance windows, the monitor opens a host_agt_version_drift alert. OBSERVE-FIRST rollout gate: the cron computes and LOGS the drift for every host on every run regardless of this flag, so the real fleet spread is measurable before anyone is paged - the ticket asks for the threshold to be set from observed data rather than a guess. Off = compute and log, open nothing. Boolean gate; ships dark. Evaluated API-side, in the cron.",
+    flagType: "boolean",
+    // Declared safe value is `false`. Fail-safe direction for a NEW alerting
+    // cron is silence: ~21 hosts with no prior drift signal means the first
+    // armed pass could open an alert for every host that is behind at once.
+    // The cron also carries a bootstrap floor (agent-stall-monitor.ts's
+    // precedent) so arming it does not retroactively page for drift that
+    // started before the monitor existed.
+    defaultValue: false,
+    // Arming this makes a previously-invisible backlog visible all at once, in
+    // the same shape ENG-8204's never-spawned-session-metric warned about - so
+    // the flip is a deliberate, confirmed one (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",

package/dist/mcp/slack-channel.js

@@ -33177,29 +33177,44 @@ var INTEGRATION_REGISTRY = [
     id: "vercel",
     name: "Vercel",
     category: "infrastructure",
-    description: "Check on Vercel app deployments \u2014 status, build/runtime logs \u2014 and search Vercel documentation. Remote streamable-HTTP MCP at https://mcp.vercel.com.",
-    // Same OAuth pattern as Granola/Higgsfield: Claude Code brokers the
-    // browser sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Check on Vercel app deployments \u2014 what's live, deployment status, and build logs \u2014 through Vercel's REST API with your own API token.",
+    // ENG-8421: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Vercel MCP (`https://mcp.vercel.com`) is not completable from the
+    // console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Established empirically 2026-08-03: Dynamic Client
+    // Registration REJECTS an https redirect (`invalid_redirect_uri` — "not
+    // approved for use by this authorization server") and ACCEPTS only
+    // localhost; the device-code grant, the one flow needing no redirect, is
+    // refused to DCR clients (`unauthorized_client`). So the only client
+    // Vercel permits is a local one redirecting to its own ephemeral port —
+    // i.e. Claude Code on the agent's host, driven by an operator running
+    // `/mcp` in tmux. No console work can remove that step.
+    //
+    // The REST API has none of those constraints: plain bearer auth
+    // (unauthenticated → `{"code":"forbidden","missingToken":true}`, bogus
+    // bearer → `{"invalidToken":true}`), so a token the customer creates in
+    // their own Vercel dashboard works directly. That makes this an ordinary
+    // paste-a-key integration, and it means WE hold the credential — so it can
+    // be stored, rotated, revoked and audited, none of which was true when the
+    // grant lived in Claude Code's `~/.claude.json` on the host.
+    //
+    // Tools are declared as data on `integration_definitions.metadata.tools`
+    // and dispatch through the existing Direct HTTP broker (the v0 pattern) —
+    // there is deliberately no bespoke Vercel client and no bespoke broker.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build/runtime logs.", access: "read" },
-      { id: "vercel:search-docs", name: "Search Documentation", description: "Search Vercel platform documentation.", access: "read" }
+      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build logs.", access: "read" }
     ],
-    docs_url: "https://vercel.com/docs/agent-resources/vercel-mcp",
-    // Beta until the headless OAuth flow (and Vercel's OAuth-client allowlist,
-    // which is vendor-side and outside our control) is verified end-to-end.
-    beta: true,
-    // No `auth`/`headers` — host-brokered OAuth (Claude Code authenticates
-    // directly with Vercel; nothing for us to inject). Declaring this here
-    // (rather than a hardcoded buildMcpJson/writeIntegrations branch, the
-    // pre-ENG-8035 Higgsfield-era pattern) lets the generic remote-MCP loop
-    // render the `.mcp.json` entry AND enrolls 'vercel' in the
-    // `registryRemoteMcpKeys` prune universe automatically, so an uninstall
-    // actually removes the entry instead of leaving it stale.
-    remoteMcp: {
-      type: "http",
-      url: "https://mcp.vercel.com"
-    }
+    docs_url: "https://vercel.com/docs/rest-api",
+    // Beta until the REST tool surface has been exercised against a real
+    // customer token. (The previous reason — "until the headless OAuth flow is
+    // verified end-to-end" — is void: there is no OAuth flow any more.)
+    beta: true
+    // NO `remoteMcp`. See the tombstone in the claudecode adapter's prune
+    // universe: dropping this field also drops `vercel` from
+    // `registryRemoteMcpKeys`, which would strand the `.mcp.json` entry on
+    // every host that installed the MCP variant.
   },
   {
     id: "qmd",
@@ -35149,6 +35164,22 @@ var FLAG_REGISTRY = [
     // safe: `since` is excluded from projectDefinition, so it does not roll
     // FLAGS_SCHEMA_VERSION.
   },
+  {
+    key: "agt-version-drift-alarm",
+    description: "Arms the ENG-8341 agt CLI version-drift alert. When a host has fallen behind its EFFECTIVE target (env pin > DB pin > release channel) across two or more of its OWN maintenance windows, the monitor opens a host_agt_version_drift alert. OBSERVE-FIRST rollout gate: the cron computes and LOGS the drift for every host on every run regardless of this flag, so the real fleet spread is measurable before anyone is paged - the ticket asks for the threshold to be set from observed data rather than a guess. Off = compute and log, open nothing. Boolean gate; ships dark. Evaluated API-side, in the cron.",
+    flagType: "boolean",
+    // Declared safe value is `false`. Fail-safe direction for a NEW alerting
+    // cron is silence: ~21 hosts with no prior drift signal means the first
+    // armed pass could open an alert for every host that is behind at once.
+    // The cron also carries a bootstrap floor (agent-stall-monitor.ts's
+    // precedent) so arming it does not retroactively page for drift that
+    // started before the monitor existed.
+    defaultValue: false,
+    // Arming this makes a previously-invisible backlog visible all at once, in
+    // the same shape ENG-8204's never-spawned-session-metric warned about - so
+    // the flip is a deliberate, confirmed one (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",

package/dist/mcp/telegram-channel.js

@@ -33503,29 +33503,44 @@ var INTEGRATION_REGISTRY = [
     id: "vercel",
     name: "Vercel",
     category: "infrastructure",
-    description: "Check on Vercel app deployments \u2014 status, build/runtime logs \u2014 and search Vercel documentation. Remote streamable-HTTP MCP at https://mcp.vercel.com.",
-    // Same OAuth pattern as Granola/Higgsfield: Claude Code brokers the
-    // browser sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Check on Vercel app deployments \u2014 what's live, deployment status, and build logs \u2014 through Vercel's REST API with your own API token.",
+    // ENG-8421: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Vercel MCP (`https://mcp.vercel.com`) is not completable from the
+    // console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Established empirically 2026-08-03: Dynamic Client
+    // Registration REJECTS an https redirect (`invalid_redirect_uri` — "not
+    // approved for use by this authorization server") and ACCEPTS only
+    // localhost; the device-code grant, the one flow needing no redirect, is
+    // refused to DCR clients (`unauthorized_client`). So the only client
+    // Vercel permits is a local one redirecting to its own ephemeral port —
+    // i.e. Claude Code on the agent's host, driven by an operator running
+    // `/mcp` in tmux. No console work can remove that step.
+    //
+    // The REST API has none of those constraints: plain bearer auth
+    // (unauthenticated → `{"code":"forbidden","missingToken":true}`, bogus
+    // bearer → `{"invalidToken":true}`), so a token the customer creates in
+    // their own Vercel dashboard works directly. That makes this an ordinary
+    // paste-a-key integration, and it means WE hold the credential — so it can
+    // be stored, rotated, revoked and audited, none of which was true when the
+    // grant lived in Claude Code's `~/.claude.json` on the host.
+    //
+    // Tools are declared as data on `integration_definitions.metadata.tools`
+    // and dispatch through the existing Direct HTTP broker (the v0 pattern) —
+    // there is deliberately no bespoke Vercel client and no bespoke broker.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build/runtime logs.", access: "read" },
-      { id: "vercel:search-docs", name: "Search Documentation", description: "Search Vercel platform documentation.", access: "read" }
+      { id: "vercel:read-deployments", name: "Read Deployments", description: "List teams/projects, check deployment status, and read build logs.", access: "read" }
     ],
-    docs_url: "https://vercel.com/docs/agent-resources/vercel-mcp",
-    // Beta until the headless OAuth flow (and Vercel's OAuth-client allowlist,
-    // which is vendor-side and outside our control) is verified end-to-end.
-    beta: true,
-    // No `auth`/`headers` — host-brokered OAuth (Claude Code authenticates
-    // directly with Vercel; nothing for us to inject). Declaring this here
-    // (rather than a hardcoded buildMcpJson/writeIntegrations branch, the
-    // pre-ENG-8035 Higgsfield-era pattern) lets the generic remote-MCP loop
-    // render the `.mcp.json` entry AND enrolls 'vercel' in the
-    // `registryRemoteMcpKeys` prune universe automatically, so an uninstall
-    // actually removes the entry instead of leaving it stale.
-    remoteMcp: {
-      type: "http",
-      url: "https://mcp.vercel.com"
-    }
+    docs_url: "https://vercel.com/docs/rest-api",
+    // Beta until the REST tool surface has been exercised against a real
+    // customer token. (The previous reason — "until the headless OAuth flow is
+    // verified end-to-end" — is void: there is no OAuth flow any more.)
+    beta: true
+    // NO `remoteMcp`. See the tombstone in the claudecode adapter's prune
+    // universe: dropping this field also drops `vercel` from
+    // `registryRemoteMcpKeys`, which would strand the `.mcp.json` entry on
+    // every host that installed the MCP variant.
   },
   {
     id: "qmd",
@@ -35475,6 +35490,22 @@ var FLAG_REGISTRY = [
     // safe: `since` is excluded from projectDefinition, so it does not roll
     // FLAGS_SCHEMA_VERSION.
   },
+  {
+    key: "agt-version-drift-alarm",
+    description: "Arms the ENG-8341 agt CLI version-drift alert. When a host has fallen behind its EFFECTIVE target (env pin > DB pin > release channel) across two or more of its OWN maintenance windows, the monitor opens a host_agt_version_drift alert. OBSERVE-FIRST rollout gate: the cron computes and LOGS the drift for every host on every run regardless of this flag, so the real fleet spread is measurable before anyone is paged - the ticket asks for the threshold to be set from observed data rather than a guess. Off = compute and log, open nothing. Boolean gate; ships dark. Evaluated API-side, in the cron.",
+    flagType: "boolean",
+    // Declared safe value is `false`. Fail-safe direction for a NEW alerting
+    // cron is silence: ~21 hosts with no prior drift signal means the first
+    // armed pass could open an alert for every host that is behind at once.
+    // The cron also carries a bootstrap floor (agent-stall-monitor.ts's
+    // precedent) so arming it does not retroactively page for drift that
+    // started before the monitor existed.
+    defaultValue: false,
+    // Arming this makes a previously-invisible backlog visible all at once, in
+    // the same shape ENG-8204's never-spawned-session-metric warned about - so
+    // the flip is a deliberate, confirmed one (ADR-0022 sensitive-flag confirm).
+    sensitive: true
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",

package/dist/{persistent-session-VX37ESOS.js → persistent-session-4VF7V4HB.js}

@@ -37,7 +37,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-LNPJI2AE.js";
+} from "./chunk-7DZNVMMX.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -79,4 +79,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-VX37ESOS.js.map
+//# sourceMappingURL=persistent-session-4VF7V4HB.js.map

package/dist/{responsiveness-probe-5MEW5XNI.js → responsiveness-probe-PWS3FIRF.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-LNPJI2AE.js";
+} from "./chunk-7DZNVMMX.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -662,4 +662,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-5MEW5XNI.js.map
+//# sourceMappingURL=responsiveness-probe-PWS3FIRF.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.508",
+  "version": "0.28.510",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {