@integrity-labs/agt-cli 0.28.512 → 0.28.514

package/dist/{claude-pair-runtime-MNO6DCMX.js → claude-pair-runtime-YGKYLV4M.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-HUKX54KL.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-RM5ZY2SB.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-MNO6DCMX.js.map
+//# sourceMappingURL=claude-pair-runtime-YGKYLV4M.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-Z7DMKSCU.js";
+} from "../chunk-GJ6U2XU6.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -173,7 +173,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-M3ICTPSG.js";
+} from "../chunk-S5RR4UHQ.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -10071,7 +10071,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.512" : "dev";
+var agtCliVersion = true ? "0.28.514" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11278,7 +11278,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-HUKX54KL.js");
+      const { collectDiagnostics } = await import("../persistent-session-RM5ZY2SB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11385,7 +11385,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-HUKX54KL.js");
+      const { collectDiagnostics } = await import("../persistent-session-RM5ZY2SB.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11500,7 +11500,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-HN7KBLJP.js");
+      } = await import("../responsiveness-probe-C4KMTKWR.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11564,7 +11564,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-HN7KBLJP.js");
+        } = await import("../responsiveness-probe-C4KMTKWR.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15072,7 +15072,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-HUKX54KL.js");
+        const { collectDiagnostics } = await import("../persistent-session-RM5ZY2SB.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15122,7 +15122,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-HUKX54KL.js");
+      const { collectDiagnostics } = await import("../persistent-session-RM5ZY2SB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15640,7 +15640,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-MNO6DCMX.js");
+  } = await import("../claude-pair-runtime-YGKYLV4M.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -30945,6 +30945,11 @@ var integration_metadata_v1_default = {
       pattern: "^https://",
       description: "Absolute HTTPS URL the broker uses as the vendor API root. Required when any tool descriptor relies on http_templater (i.e. whenever `tools[]` is non-empty)."
     },
+    auth_scheme: {
+      type: "string",
+      pattern: "^[A-Za-z0-9!#$%&'*+.^_`|~-]+$",
+      description: "Authorization scheme word placed before the credential, e.g. `Key` for Higgsfield's `Authorization: Key KEY_ID:KEY_SECRET` (ENG-8440). Omit for the `Bearer` default. Constrained to a single RFC 7230 token because it is concatenated straight into a header value."
+    },
     runtime_scopes: {
       type: "object",
       description: "Per-runtime-scope support map. Each slot is either null (the integration does not support installs at this scope) or an object describing how token resolution and auth work for that scope.",
@@ -32939,16 +32944,43 @@ var INTEGRATION_REGISTRY = [
     id: "higgsfield",
     name: "Higgsfield",
     category: "media",
-    description: "Generative media \u2014 image (Soul, Nano Banana) and video (Kling, Veo, Seedance) generation, character training (Soul ID), and generation history. Remote streamable-HTTP MCP at https://mcp.higgsfield.ai/mcp.",
-    // Same OAuth pattern as Granola: Claude Code brokers the browser
-    // sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Generative media \u2014 Soul text-to-image with style presets and trained-character consistency, DoP image-to-video with motion presets, and lip-synced talking video. Uses Higgsfield's REST API with your own API key.",
+    // ENG-8440: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Higgsfield MCP (`https://mcp.higgsfield.ai/mcp`) cannot be completed from
+    // the console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Its `oauth-protected-resource` metadata offers two flows and
+    // names the clients each is for: the redirect flow lists
+    // ["anthropic","claude","claude-ai","claude-code"] and the device-code flow
+    // lists ["openclaw","hermes","memoclaw"]. Our console appears in neither,
+    // and the device authorization server
+    // (`fnf-device-auth.higgsfield.ai/.well-known/oauth-authorization-server`)
+    // still returns 404, so there is no discovery document to probe either.
+    // The only client Higgsfield permits is Claude Code on the agent's own
+    // host, driven by an operator in tmux — no console work removes that step.
+    //
+    // The REST API (`platform.higgsfield.ai`) has none of those constraints: a
+    // static key pair the customer creates in their own Higgsfield account,
+    // sent as `Authorization: Key KEY_ID:KEY_SECRET`. That makes this an
+    // ordinary paste-a-key integration, and it means WE hold the credential —
+    // storable, rotatable, revocable and auditable, none of which was true
+    // under the MCP.
+    //
+    // Bring-your-own-key: generations bill to the customer's own Higgsfield
+    // account, so an install is never metered by Augmented Team.
+    //
+    // NOTE: this entry carries no `remoteMcp`, so it contributes nothing to
+    // `registryRemoteMcpKeys` and cannot prune the `higgsfield` key an older
+    // host already wrote to `.mcp.json`. That pruning is why `'higgsfield'` is
+    // a literal in `integrationDerivedKeys` in the claudecode adapter — do not
+    // drop it while any host may still be carrying the retired MCP entry.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create images via Soul, Nano Banana, and other image models \u2014 up to 4K. Includes Soul ID character consistency.", access: "write" },
-      { id: "higgsfield:generate-video", name: "Generate Video", description: "Create videos via Kling, Veo, Seedance \u2014 up to 15s. Includes UGC, product review, TV spot presets.", access: "write" },
-      { id: "higgsfield:read-history", name: "Read History", description: "Browse generation history for iterative workflows; reuse prior outputs as references.", access: "read" }
+      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create stills with Soul \u2014 style presets, plus trained-character consistency for a repeated face or product.", access: "write" },
+      { id: "higgsfield:generate-video", name: "Generate Video", description: "Animate a still into a short clip with DoP motion presets, or lip-sync a talking video from an image plus audio.", access: "write" },
+      { id: "higgsfield:read-jobs", name: "Poll Jobs & Presets", description: "Poll asynchronous generations to completion, and list the style and motion presets the generate tools accept.", access: "read" }
     ],
-    docs_url: "https://higgsfield.ai/mcp",
+    docs_url: "https://docs.higgsfield.ai/",
     beta: true
   },
   {
@@ -33547,7 +33579,19 @@ var MB2 = 1024 * 1024;
 var DIRECT_CHAT_UPLOAD_MAX_BYTES = 10 * MB2;
 
 // ../core/dist/direct-chat/notice-display.js
-var AGENT_DIRECTED_NOTICE_KINDS = ["scheduled_task_nudge", "kanban_check"];
+var AGENT_DIRECTED_NOTICE_KINDS = [
+  "scheduled_task_nudge",
+  "kanban_check",
+  // ENG-8394. These two were originally cited BELOW as examples of user-facing
+  // notices; reading their content builders shows the opposite. The manager
+  // feedback notice opens "Your manager just completed a performance review of
+  // your work" and closes "Please reflect on this feedback and act on it now";
+  // the form-timeout notice ends "do NOT keep waiting for this form" and quotes
+  // a raw request id and Slack channel id. Both are second-person instructions
+  // to the agent and were being rendered verbatim to the customer.
+  "manager_feedback",
+  "form_timeout"
+];
 var AGENT_DIRECTED_KIND_SET = new Set(AGENT_DIRECTED_NOTICE_KINDS);
 
 // ../core/dist/direct-chat/cursor-advance.js

package/dist/mcp/index.js

@@ -21756,33 +21756,62 @@ function describeAssignHumanResult(resp, email2) {
 }
 
 // src/directory.ts
+function scopedCount(n, scope) {
+  const org = orgLabel(scope);
+  if (!org) return `${n}`;
+  return `${n} in ${org} \u2014 this directory cannot see other organizations`;
+}
+function orgLabel(scope) {
+  if (scope?.cross_org !== false) return null;
+  const named = scope.organization_name?.trim();
+  if (named) return named;
+  return scope.organization_id ? "your organization" : null;
+}
+function scopeFooter(scope) {
+  const org = orgLabel(scope);
+  if (!org) return null;
+  const visible = scope?.teams_visible;
+  const total = scope?.teams_in_org;
+  const teams = typeof visible === "number" && typeof total === "number" ? ` (${visible} of ${total} team${total === 1 ? "" : "s"} visible to you)` : "";
+  return `Scope: ${org} only${teams}. Other organizations are not searchable from here, so one match is not proof it is the only one, and no match is not proof there is none.`;
+}
 function formatDirectoryResult(data, query, slackUserId) {
   const agents = data.agents ?? [];
   const people = data.people ?? [];
+  const footer = scopeFooter(data.scope);
   if (agents.length === 0 && people.length === 0) {
     if (slackUserId) {
       return {
-        text: `No agent or person in your directory matches Slack id ${slackUserId}. Either they are not someone you're authorised to see, or they haven't linked their Slack account. Do not guess who it is.`
+        text: `No agent or person in your directory matches Slack id ${slackUserId}. Either they are not someone you're authorised to see, or they haven't linked their Slack account. Do not guess who it is.` + (footer ? `
+
+${footer}` : "")
       };
     }
     return {
-      text: query ? `No agents or people match "${query}" in your directory.` : "No agents or people are visible in your directory."
+      text: (query ? `No agents or people match "${query}" in your directory.` : "No agents or people are visible in your directory.") + (footer ? `
+
+${footer}` : "")
     };
   }
   const slackTag = (id) => id ? ` \u2014 Slack <@${id}>` : "";
   const agentLines = agents.map((a) => {
     const scope = a.same_team ? "your team" : `team ${a.team_slug}`;
     const assignHint = a.same_team ? `kanban_assign target_agent="${a.code_name}"` : `kanban_assign target_agent="${a.code_name}" target_team="${a.team_slug}"`;
-    return `  \u2022 ${a.code_name} (${a.display_name}) - ${scope} [${a.team_name}]${slackTag(a.slack_user_id)} \u2192 ${assignHint}`;
+    return `  \u2022 ${a.code_name} (${a.display_name}) - ${scope} [team: ${a.team_name}]${slackTag(a.slack_user_id)} \u2192 ${assignHint}`;
   });
   const peopleLines = people.map(
     (p) => `  \u2022 ${p.name ?? p.email} <${p.email}>${slackTag(p.slack_user_id)} \u2192 assign_kanban_to_human assignee_email="${p.email}"`
   );
   const sections = [];
-  if (agents.length > 0) sections.push(`Agents (${agents.length}):
+  if (agents.length > 0) {
+    sections.push(`Agents (${scopedCount(agents.length, data.scope)}):
 ${agentLines.join("\n")}`);
-  if (people.length > 0) sections.push(`People (${people.length}):
+  }
+  if (people.length > 0) {
+    sections.push(`People (${scopedCount(people.length, data.scope)}):
 ${peopleLines.join("\n")}`);
+  }
+  if (footer) sections.push(footer);
   return { text: sections.join("\n\n") };
 }
 

package/dist/mcp/origami.js

@@ -37100,6 +37100,11 @@ var integration_metadata_v1_default = {
       pattern: "^https://",
       description: "Absolute HTTPS URL the broker uses as the vendor API root. Required when any tool descriptor relies on http_templater (i.e. whenever `tools[]` is non-empty)."
     },
+    auth_scheme: {
+      type: "string",
+      pattern: "^[A-Za-z0-9!#$%&'*+.^_`|~-]+$",
+      description: "Authorization scheme word placed before the credential, e.g. `Key` for Higgsfield's `Authorization: Key KEY_ID:KEY_SECRET` (ENG-8440). Omit for the `Bearer` default. Constrained to a single RFC 7230 token because it is concatenated straight into a header value."
+    },
     runtime_scopes: {
       type: "object",
       description: "Per-runtime-scope support map. Each slot is either null (the integration does not support installs at this scope) or an object describing how token resolution and auth work for that scope.",
@@ -37254,7 +37259,7 @@ var FIXED_SECONDS = {
 // ../core/dist/integrations/integration-broker/http-templater.js
 var PLACEHOLDER_RE = /\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g;
 function buildHttpRequest(input) {
-  const { tool, args, baseUrl, bearerToken, requestId, extraHeaders } = input;
+  const { tool, args, baseUrl, bearerToken, authScheme, requestId, extraHeaders } = input;
   const { method, path_template, query_template, headers_template, body_template, idempotency_key_header } = tool.http;
   const path = templatePath(path_template, args);
   const query = query_template ? buildQueryString(query_template, args) : "";
@@ -37263,7 +37268,7 @@ function buildHttpRequest(input) {
     Accept: "application/json"
   };
   if (bearerToken) {
-    headers["Authorization"] = `Bearer ${bearerToken}`;
+    headers["Authorization"] = `${resolveAuthScheme(authScheme)} ${bearerToken}`;
   }
   if (method !== "GET") {
     const headerName = idempotency_key_header ?? "Idempotency-Key";
@@ -37341,6 +37346,17 @@ function omitKeys(args, keys) {
   }
   return out;
 }
+function resolveAuthScheme(scheme) {
+  if (scheme === void 0)
+    return "Bearer";
+  const trimmed = scheme.trim();
+  if (trimmed === "")
+    return "Bearer";
+  if (!isValidHeaderName(trimmed)) {
+    throw new TemplateError(`invalid auth_scheme: ${trimmed}`);
+  }
+  return trimmed;
+}
 function isValidHeaderName(name) {
   return /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(name);
 }
@@ -39266,16 +39282,43 @@ var INTEGRATION_REGISTRY = [
     id: "higgsfield",
     name: "Higgsfield",
     category: "media",
-    description: "Generative media \u2014 image (Soul, Nano Banana) and video (Kling, Veo, Seedance) generation, character training (Soul ID), and generation history. Remote streamable-HTTP MCP at https://mcp.higgsfield.ai/mcp.",
-    // Same OAuth pattern as Granola: Claude Code brokers the browser
-    // sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Generative media \u2014 Soul text-to-image with style presets and trained-character consistency, DoP image-to-video with motion presets, and lip-synced talking video. Uses Higgsfield's REST API with your own API key.",
+    // ENG-8440: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Higgsfield MCP (`https://mcp.higgsfield.ai/mcp`) cannot be completed from
+    // the console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Its `oauth-protected-resource` metadata offers two flows and
+    // names the clients each is for: the redirect flow lists
+    // ["anthropic","claude","claude-ai","claude-code"] and the device-code flow
+    // lists ["openclaw","hermes","memoclaw"]. Our console appears in neither,
+    // and the device authorization server
+    // (`fnf-device-auth.higgsfield.ai/.well-known/oauth-authorization-server`)
+    // still returns 404, so there is no discovery document to probe either.
+    // The only client Higgsfield permits is Claude Code on the agent's own
+    // host, driven by an operator in tmux — no console work removes that step.
+    //
+    // The REST API (`platform.higgsfield.ai`) has none of those constraints: a
+    // static key pair the customer creates in their own Higgsfield account,
+    // sent as `Authorization: Key KEY_ID:KEY_SECRET`. That makes this an
+    // ordinary paste-a-key integration, and it means WE hold the credential —
+    // storable, rotatable, revocable and auditable, none of which was true
+    // under the MCP.
+    //
+    // Bring-your-own-key: generations bill to the customer's own Higgsfield
+    // account, so an install is never metered by Augmented Team.
+    //
+    // NOTE: this entry carries no `remoteMcp`, so it contributes nothing to
+    // `registryRemoteMcpKeys` and cannot prune the `higgsfield` key an older
+    // host already wrote to `.mcp.json`. That pruning is why `'higgsfield'` is
+    // a literal in `integrationDerivedKeys` in the claudecode adapter — do not
+    // drop it while any host may still be carrying the retired MCP entry.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create images via Soul, Nano Banana, and other image models \u2014 up to 4K. Includes Soul ID character consistency.", access: "write" },
-      { id: "higgsfield:generate-video", name: "Generate Video", description: "Create videos via Kling, Veo, Seedance \u2014 up to 15s. Includes UGC, product review, TV spot presets.", access: "write" },
-      { id: "higgsfield:read-history", name: "Read History", description: "Browse generation history for iterative workflows; reuse prior outputs as references.", access: "read" }
+      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create stills with Soul \u2014 style presets, plus trained-character consistency for a repeated face or product.", access: "write" },
+      { id: "higgsfield:generate-video", name: "Generate Video", description: "Animate a still into a short clip with DoP motion presets, or lip-sync a talking video from an image plus audio.", access: "write" },
+      { id: "higgsfield:read-jobs", name: "Poll Jobs & Presets", description: "Poll asynchronous generations to completion, and list the style and motion presets the generate tools accept.", access: "read" }
     ],
-    docs_url: "https://higgsfield.ai/mcp",
+    docs_url: "https://docs.higgsfield.ai/",
     beta: true
   },
   {
@@ -39874,7 +39917,19 @@ var MB2 = 1024 * 1024;
 var DIRECT_CHAT_UPLOAD_MAX_BYTES = 10 * MB2;
 
 // ../core/dist/direct-chat/notice-display.js
-var AGENT_DIRECTED_NOTICE_KINDS = ["scheduled_task_nudge", "kanban_check"];
+var AGENT_DIRECTED_NOTICE_KINDS = [
+  "scheduled_task_nudge",
+  "kanban_check",
+  // ENG-8394. These two were originally cited BELOW as examples of user-facing
+  // notices; reading their content builders shows the opposite. The manager
+  // feedback notice opens "Your manager just completed a performance review of
+  // your work" and closes "Please reflect on this feedback and act on it now";
+  // the form-timeout notice ends "do NOT keep waiting for this form" and quotes
+  // a raw request id and Slack channel id. Both are second-person instructions
+  // to the agent and were being rendered verbatim to the customer.
+  "manager_feedback",
+  "form_timeout"
+];
 var AGENT_DIRECTED_KIND_SET = new Set(AGENT_DIRECTED_NOTICE_KINDS);
 
 // ../core/dist/direct-chat/cursor-advance.js

package/dist/mcp/slack-channel.js

@@ -31170,6 +31170,11 @@ var integration_metadata_v1_default = {
       pattern: "^https://",
       description: "Absolute HTTPS URL the broker uses as the vendor API root. Required when any tool descriptor relies on http_templater (i.e. whenever `tools[]` is non-empty)."
     },
+    auth_scheme: {
+      type: "string",
+      pattern: "^[A-Za-z0-9!#$%&'*+.^_`|~-]+$",
+      description: "Authorization scheme word placed before the credential, e.g. `Key` for Higgsfield's `Authorization: Key KEY_ID:KEY_SECRET` (ENG-8440). Omit for the `Bearer` default. Constrained to a single RFC 7230 token because it is concatenated straight into a header value."
+    },
     runtime_scopes: {
       type: "object",
       description: "Per-runtime-scope support map. Each slot is either null (the integration does not support installs at this scope) or an object describing how token resolution and auth work for that scope.",
@@ -33161,16 +33166,43 @@ var INTEGRATION_REGISTRY = [
     id: "higgsfield",
     name: "Higgsfield",
     category: "media",
-    description: "Generative media \u2014 image (Soul, Nano Banana) and video (Kling, Veo, Seedance) generation, character training (Soul ID), and generation history. Remote streamable-HTTP MCP at https://mcp.higgsfield.ai/mcp.",
-    // Same OAuth pattern as Granola: Claude Code brokers the browser
-    // sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Generative media \u2014 Soul text-to-image with style presets and trained-character consistency, DoP image-to-video with motion presets, and lip-synced talking video. Uses Higgsfield's REST API with your own API key.",
+    // ENG-8440: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Higgsfield MCP (`https://mcp.higgsfield.ai/mcp`) cannot be completed from
+    // the console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Its `oauth-protected-resource` metadata offers two flows and
+    // names the clients each is for: the redirect flow lists
+    // ["anthropic","claude","claude-ai","claude-code"] and the device-code flow
+    // lists ["openclaw","hermes","memoclaw"]. Our console appears in neither,
+    // and the device authorization server
+    // (`fnf-device-auth.higgsfield.ai/.well-known/oauth-authorization-server`)
+    // still returns 404, so there is no discovery document to probe either.
+    // The only client Higgsfield permits is Claude Code on the agent's own
+    // host, driven by an operator in tmux — no console work removes that step.
+    //
+    // The REST API (`platform.higgsfield.ai`) has none of those constraints: a
+    // static key pair the customer creates in their own Higgsfield account,
+    // sent as `Authorization: Key KEY_ID:KEY_SECRET`. That makes this an
+    // ordinary paste-a-key integration, and it means WE hold the credential —
+    // storable, rotatable, revocable and auditable, none of which was true
+    // under the MCP.
+    //
+    // Bring-your-own-key: generations bill to the customer's own Higgsfield
+    // account, so an install is never metered by Augmented Team.
+    //
+    // NOTE: this entry carries no `remoteMcp`, so it contributes nothing to
+    // `registryRemoteMcpKeys` and cannot prune the `higgsfield` key an older
+    // host already wrote to `.mcp.json`. That pruning is why `'higgsfield'` is
+    // a literal in `integrationDerivedKeys` in the claudecode adapter — do not
+    // drop it while any host may still be carrying the retired MCP entry.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create images via Soul, Nano Banana, and other image models \u2014 up to 4K. Includes Soul ID character consistency.", access: "write" },
-      { id: "higgsfield:generate-video", name: "Generate Video", description: "Create videos via Kling, Veo, Seedance \u2014 up to 15s. Includes UGC, product review, TV spot presets.", access: "write" },
-      { id: "higgsfield:read-history", name: "Read History", description: "Browse generation history for iterative workflows; reuse prior outputs as references.", access: "read" }
+      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create stills with Soul \u2014 style presets, plus trained-character consistency for a repeated face or product.", access: "write" },
+      { id: "higgsfield:generate-video", name: "Generate Video", description: "Animate a still into a short clip with DoP motion presets, or lip-sync a talking video from an image plus audio.", access: "write" },
+      { id: "higgsfield:read-jobs", name: "Poll Jobs & Presets", description: "Poll asynchronous generations to completion, and list the style and motion presets the generate tools accept.", access: "read" }
     ],
-    docs_url: "https://higgsfield.ai/mcp",
+    docs_url: "https://docs.higgsfield.ai/",
     beta: true
   },
   {
@@ -33769,7 +33801,19 @@ var MB2 = 1024 * 1024;
 var DIRECT_CHAT_UPLOAD_MAX_BYTES = 10 * MB2;
 
 // ../core/dist/direct-chat/notice-display.js
-var AGENT_DIRECTED_NOTICE_KINDS = ["scheduled_task_nudge", "kanban_check"];
+var AGENT_DIRECTED_NOTICE_KINDS = [
+  "scheduled_task_nudge",
+  "kanban_check",
+  // ENG-8394. These two were originally cited BELOW as examples of user-facing
+  // notices; reading their content builders shows the opposite. The manager
+  // feedback notice opens "Your manager just completed a performance review of
+  // your work" and closes "Please reflect on this feedback and act on it now";
+  // the form-timeout notice ends "do NOT keep waiting for this form" and quotes
+  // a raw request id and Slack channel id. Both are second-person instructions
+  // to the agent and were being rendered verbatim to the customer.
+  "manager_feedback",
+  "form_timeout"
+];
 var AGENT_DIRECTED_KIND_SET = new Set(AGENT_DIRECTED_NOTICE_KINDS);
 
 // ../core/dist/direct-chat/cursor-advance.js

package/dist/mcp/telegram-channel.js

@@ -31496,6 +31496,11 @@ var integration_metadata_v1_default = {
       pattern: "^https://",
       description: "Absolute HTTPS URL the broker uses as the vendor API root. Required when any tool descriptor relies on http_templater (i.e. whenever `tools[]` is non-empty)."
     },
+    auth_scheme: {
+      type: "string",
+      pattern: "^[A-Za-z0-9!#$%&'*+.^_`|~-]+$",
+      description: "Authorization scheme word placed before the credential, e.g. `Key` for Higgsfield's `Authorization: Key KEY_ID:KEY_SECRET` (ENG-8440). Omit for the `Bearer` default. Constrained to a single RFC 7230 token because it is concatenated straight into a header value."
+    },
     runtime_scopes: {
       type: "object",
       description: "Per-runtime-scope support map. Each slot is either null (the integration does not support installs at this scope) or an object describing how token resolution and auth work for that scope.",
@@ -33487,16 +33492,43 @@ var INTEGRATION_REGISTRY = [
     id: "higgsfield",
     name: "Higgsfield",
     category: "media",
-    description: "Generative media \u2014 image (Soul, Nano Banana) and video (Kling, Veo, Seedance) generation, character training (Soul ID), and generation history. Remote streamable-HTTP MCP at https://mcp.higgsfield.ai/mcp.",
-    // Same OAuth pattern as Granola: Claude Code brokers the browser
-    // sign-in at runtime; nothing for the manager API to provision.
-    supported_auth_types: ["none"],
+    description: "Generative media \u2014 Soul text-to-image with style presets and trained-character consistency, DoP image-to-video with motion presets, and lip-synced talking video. Uses Higgsfield's REST API with your own API key.",
+    // ENG-8440: api_key, NOT the host-brokered MCP this used to be.
+    //
+    // Higgsfield MCP (`https://mcp.higgsfield.ai/mcp`) cannot be completed from
+    // the console, and that is a vendor constraint rather than a gap in our
+    // plumbing. Its `oauth-protected-resource` metadata offers two flows and
+    // names the clients each is for: the redirect flow lists
+    // ["anthropic","claude","claude-ai","claude-code"] and the device-code flow
+    // lists ["openclaw","hermes","memoclaw"]. Our console appears in neither,
+    // and the device authorization server
+    // (`fnf-device-auth.higgsfield.ai/.well-known/oauth-authorization-server`)
+    // still returns 404, so there is no discovery document to probe either.
+    // The only client Higgsfield permits is Claude Code on the agent's own
+    // host, driven by an operator in tmux — no console work removes that step.
+    //
+    // The REST API (`platform.higgsfield.ai`) has none of those constraints: a
+    // static key pair the customer creates in their own Higgsfield account,
+    // sent as `Authorization: Key KEY_ID:KEY_SECRET`. That makes this an
+    // ordinary paste-a-key integration, and it means WE hold the credential —
+    // storable, rotatable, revocable and auditable, none of which was true
+    // under the MCP.
+    //
+    // Bring-your-own-key: generations bill to the customer's own Higgsfield
+    // account, so an install is never metered by Augmented Team.
+    //
+    // NOTE: this entry carries no `remoteMcp`, so it contributes nothing to
+    // `registryRemoteMcpKeys` and cannot prune the `higgsfield` key an older
+    // host already wrote to `.mcp.json`. That pruning is why `'higgsfield'` is
+    // a literal in `integrationDerivedKeys` in the claudecode adapter — do not
+    // drop it while any host may still be carrying the retired MCP entry.
+    supported_auth_types: ["api_key"],
     capabilities: [
-      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create images via Soul, Nano Banana, and other image models \u2014 up to 4K. Includes Soul ID character consistency.", access: "write" },
-      { id: "higgsfield:generate-video", name: "Generate Video", description: "Create videos via Kling, Veo, Seedance \u2014 up to 15s. Includes UGC, product review, TV spot presets.", access: "write" },
-      { id: "higgsfield:read-history", name: "Read History", description: "Browse generation history for iterative workflows; reuse prior outputs as references.", access: "read" }
+      { id: "higgsfield:generate-image", name: "Generate Image", description: "Create stills with Soul \u2014 style presets, plus trained-character consistency for a repeated face or product.", access: "write" },
+      { id: "higgsfield:generate-video", name: "Generate Video", description: "Animate a still into a short clip with DoP motion presets, or lip-sync a talking video from an image plus audio.", access: "write" },
+      { id: "higgsfield:read-jobs", name: "Poll Jobs & Presets", description: "Poll asynchronous generations to completion, and list the style and motion presets the generate tools accept.", access: "read" }
     ],
-    docs_url: "https://higgsfield.ai/mcp",
+    docs_url: "https://docs.higgsfield.ai/",
     beta: true
   },
   {
@@ -34095,7 +34127,19 @@ var MB2 = 1024 * 1024;
 var DIRECT_CHAT_UPLOAD_MAX_BYTES = 10 * MB2;
 
 // ../core/dist/direct-chat/notice-display.js
-var AGENT_DIRECTED_NOTICE_KINDS = ["scheduled_task_nudge", "kanban_check"];
+var AGENT_DIRECTED_NOTICE_KINDS = [
+  "scheduled_task_nudge",
+  "kanban_check",
+  // ENG-8394. These two were originally cited BELOW as examples of user-facing
+  // notices; reading their content builders shows the opposite. The manager
+  // feedback notice opens "Your manager just completed a performance review of
+  // your work" and closes "Please reflect on this feedback and act on it now";
+  // the form-timeout notice ends "do NOT keep waiting for this form" and quotes
+  // a raw request id and Slack channel id. Both are second-person instructions
+  // to the agent and were being rendered verbatim to the customer.
+  "manager_feedback",
+  "form_timeout"
+];
 var AGENT_DIRECTED_KIND_SET = new Set(AGENT_DIRECTED_NOTICE_KINDS);
 
 // ../core/dist/direct-chat/cursor-advance.js

package/dist/{persistent-session-HUKX54KL.js → persistent-session-RM5ZY2SB.js}

@@ -37,7 +37,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-M3ICTPSG.js";
+} from "./chunk-S5RR4UHQ.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -79,4 +79,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-HUKX54KL.js.map
+//# sourceMappingURL=persistent-session-RM5ZY2SB.js.map

package/dist/{responsiveness-probe-HN7KBLJP.js → responsiveness-probe-C4KMTKWR.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-M3ICTPSG.js";
+} from "./chunk-S5RR4UHQ.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -662,4 +662,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-HN7KBLJP.js.map
+//# sourceMappingURL=responsiveness-probe-C4KMTKWR.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.512",
+  "version": "0.28.514",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {