@integrity-labs/agt-cli 0.28.564 → 0.28.566

package/dist/mcp/direct-chat-channel.js

@@ -35358,6 +35358,35 @@ var FLAG_REGISTRY = [
     // AGT_MEMORY_EXTRACTION_ENABLED set keeps that value until the env is retired.
     envVar: "AGT_MEMORY_EXTRACTION_ENABLED"
   },
+  {
+    key: "tool-call-audit",
+    description: "Host-side tool-call audit extraction (ENG-8575, slice 3 of ENG-8427): the manager scans agent transcripts for tool calls, redacts each to identity-without-content, and POSTs them to /host/tool-calls. Boolean gate; ships dark \u2014 when off the manager reads no transcripts and sends nothing, so 0 agent_tool_calls rows fleet-wide is the expected steady state until it is armed. NOT the commercial gate: /host/tool-calls independently re-checks the advanced_governance entitlement and refuses regardless of this flag, because the host is customer-owned infrastructure. This flag is rollout control only.",
+    flagType: "boolean",
+    // Declared safe value is `false` (no extraction). Fail-safe direction: a
+    // flag-DB read error must never start shipping tool-call metadata across the
+    // host→control-plane boundary on its own. Same posture as memory-extraction
+    // above, and for the same reason — both read agent transcripts.
+    defaultValue: false,
+    // ADR-0022 operator override. Read by the host flag store's env layer, not
+    // by a hand-written process.env gate — so check-new-env-gates.sh stays quiet
+    // and the escape hatch still exists for a per-host canary.
+    envVar: "AGT_TOOL_CALL_AUDIT_ENABLED",
+    // PLACEHOLDER, deliberately unreachable — see the identical treatment on
+    // `github-broker-credentials` below for the full reasoning. `since` is
+    // advisory: it is read only by computeFlagReach behind GET /admin/reach, so
+    // it changes what an operator is TOLD and does not itself stop a flip.
+    //
+    // The host-side reader ships in whichever agt-cli patch the auto-publish
+    // cuts after this merges, and that number cannot be known while writing
+    // this line. Omitting `since` is NOT the safe default here: it resolves to
+    // `honors`, reporting every host as honouring the flip — including hosts
+    // whose agt-cli has no reader at all. An unreachable value reports `stale`
+    // instead: conservative, and visibly wrong rather than invisibly wrong.
+    //
+    // BEFORE THIS FLAG IS FLIPPED ANYWHERE: replace this with the first
+    // published agt-cli version containing `maybeScanToolCalls`.
+    since: "0.29.0"
+  },
   {
     key: "conversation-eval-backend",
     description: "Backend for host-side conversation-success scoring AND memory extraction (ENG-6581), which share one scorer: anthropic-api = Haiku via a direct Anthropic Messages API fetch (no subprocess); claude-p = Haiku via the `claude -p` subprocess (reuses the agent auth, effectively free under Max but a heavy spawn); local = an OpenAI-compatible loopback endpoint (transcript never leaves the host). Auth for the anthropic-api path comes from AGT_CONV_EVAL_ANTHROPIC_API_KEY (falls back to ANTHROPIC_API_KEY); with no key that path fails closed (eval disabled) rather than reverting to claude-p. Enum.",

package/dist/mcp/origami.js

@@ -41249,6 +41249,35 @@ var FLAG_REGISTRY = [
     // AGT_MEMORY_EXTRACTION_ENABLED set keeps that value until the env is retired.
     envVar: "AGT_MEMORY_EXTRACTION_ENABLED"
   },
+  {
+    key: "tool-call-audit",
+    description: "Host-side tool-call audit extraction (ENG-8575, slice 3 of ENG-8427): the manager scans agent transcripts for tool calls, redacts each to identity-without-content, and POSTs them to /host/tool-calls. Boolean gate; ships dark \u2014 when off the manager reads no transcripts and sends nothing, so 0 agent_tool_calls rows fleet-wide is the expected steady state until it is armed. NOT the commercial gate: /host/tool-calls independently re-checks the advanced_governance entitlement and refuses regardless of this flag, because the host is customer-owned infrastructure. This flag is rollout control only.",
+    flagType: "boolean",
+    // Declared safe value is `false` (no extraction). Fail-safe direction: a
+    // flag-DB read error must never start shipping tool-call metadata across the
+    // host→control-plane boundary on its own. Same posture as memory-extraction
+    // above, and for the same reason — both read agent transcripts.
+    defaultValue: false,
+    // ADR-0022 operator override. Read by the host flag store's env layer, not
+    // by a hand-written process.env gate — so check-new-env-gates.sh stays quiet
+    // and the escape hatch still exists for a per-host canary.
+    envVar: "AGT_TOOL_CALL_AUDIT_ENABLED",
+    // PLACEHOLDER, deliberately unreachable — see the identical treatment on
+    // `github-broker-credentials` below for the full reasoning. `since` is
+    // advisory: it is read only by computeFlagReach behind GET /admin/reach, so
+    // it changes what an operator is TOLD and does not itself stop a flip.
+    //
+    // The host-side reader ships in whichever agt-cli patch the auto-publish
+    // cuts after this merges, and that number cannot be known while writing
+    // this line. Omitting `since` is NOT the safe default here: it resolves to
+    // `honors`, reporting every host as honouring the flip — including hosts
+    // whose agt-cli has no reader at all. An unreachable value reports `stale`
+    // instead: conservative, and visibly wrong rather than invisibly wrong.
+    //
+    // BEFORE THIS FLAG IS FLIPPED ANYWHERE: replace this with the first
+    // published agt-cli version containing `maybeScanToolCalls`.
+    since: "0.29.0"
+  },
   {
     key: "conversation-eval-backend",
     description: "Backend for host-side conversation-success scoring AND memory extraction (ENG-6581), which share one scorer: anthropic-api = Haiku via a direct Anthropic Messages API fetch (no subprocess); claude-p = Haiku via the `claude -p` subprocess (reuses the agent auth, effectively free under Max but a heavy spawn); local = an OpenAI-compatible loopback endpoint (transcript never leaves the host). Auth for the anthropic-api path comes from AGT_CONV_EVAL_ANTHROPIC_API_KEY (falls back to ANTHROPIC_API_KEY); with no key that path fails closed (eval disabled) rather than reverting to claude-p. Enum.",

package/dist/mcp/slack-channel.js

@@ -35694,6 +35694,35 @@ var FLAG_REGISTRY = [
     // AGT_MEMORY_EXTRACTION_ENABLED set keeps that value until the env is retired.
     envVar: "AGT_MEMORY_EXTRACTION_ENABLED"
   },
+  {
+    key: "tool-call-audit",
+    description: "Host-side tool-call audit extraction (ENG-8575, slice 3 of ENG-8427): the manager scans agent transcripts for tool calls, redacts each to identity-without-content, and POSTs them to /host/tool-calls. Boolean gate; ships dark \u2014 when off the manager reads no transcripts and sends nothing, so 0 agent_tool_calls rows fleet-wide is the expected steady state until it is armed. NOT the commercial gate: /host/tool-calls independently re-checks the advanced_governance entitlement and refuses regardless of this flag, because the host is customer-owned infrastructure. This flag is rollout control only.",
+    flagType: "boolean",
+    // Declared safe value is `false` (no extraction). Fail-safe direction: a
+    // flag-DB read error must never start shipping tool-call metadata across the
+    // host→control-plane boundary on its own. Same posture as memory-extraction
+    // above, and for the same reason — both read agent transcripts.
+    defaultValue: false,
+    // ADR-0022 operator override. Read by the host flag store's env layer, not
+    // by a hand-written process.env gate — so check-new-env-gates.sh stays quiet
+    // and the escape hatch still exists for a per-host canary.
+    envVar: "AGT_TOOL_CALL_AUDIT_ENABLED",
+    // PLACEHOLDER, deliberately unreachable — see the identical treatment on
+    // `github-broker-credentials` below for the full reasoning. `since` is
+    // advisory: it is read only by computeFlagReach behind GET /admin/reach, so
+    // it changes what an operator is TOLD and does not itself stop a flip.
+    //
+    // The host-side reader ships in whichever agt-cli patch the auto-publish
+    // cuts after this merges, and that number cannot be known while writing
+    // this line. Omitting `since` is NOT the safe default here: it resolves to
+    // `honors`, reporting every host as honouring the flip — including hosts
+    // whose agt-cli has no reader at all. An unreachable value reports `stale`
+    // instead: conservative, and visibly wrong rather than invisibly wrong.
+    //
+    // BEFORE THIS FLAG IS FLIPPED ANYWHERE: replace this with the first
+    // published agt-cli version containing `maybeScanToolCalls`.
+    since: "0.29.0"
+  },
   {
     key: "conversation-eval-backend",
     description: "Backend for host-side conversation-success scoring AND memory extraction (ENG-6581), which share one scorer: anthropic-api = Haiku via a direct Anthropic Messages API fetch (no subprocess); claude-p = Haiku via the `claude -p` subprocess (reuses the agent auth, effectively free under Max but a heavy spawn); local = an OpenAI-compatible loopback endpoint (transcript never leaves the host). Auth for the anthropic-api path comes from AGT_CONV_EVAL_ANTHROPIC_API_KEY (falls back to ANTHROPIC_API_KEY); with no key that path fails closed (eval disabled) rather than reverting to claude-p. Enum.",

package/dist/mcp/telegram-channel.js

@@ -35853,6 +35853,35 @@ var FLAG_REGISTRY = [
     // AGT_MEMORY_EXTRACTION_ENABLED set keeps that value until the env is retired.
     envVar: "AGT_MEMORY_EXTRACTION_ENABLED"
   },
+  {
+    key: "tool-call-audit",
+    description: "Host-side tool-call audit extraction (ENG-8575, slice 3 of ENG-8427): the manager scans agent transcripts for tool calls, redacts each to identity-without-content, and POSTs them to /host/tool-calls. Boolean gate; ships dark \u2014 when off the manager reads no transcripts and sends nothing, so 0 agent_tool_calls rows fleet-wide is the expected steady state until it is armed. NOT the commercial gate: /host/tool-calls independently re-checks the advanced_governance entitlement and refuses regardless of this flag, because the host is customer-owned infrastructure. This flag is rollout control only.",
+    flagType: "boolean",
+    // Declared safe value is `false` (no extraction). Fail-safe direction: a
+    // flag-DB read error must never start shipping tool-call metadata across the
+    // host→control-plane boundary on its own. Same posture as memory-extraction
+    // above, and for the same reason — both read agent transcripts.
+    defaultValue: false,
+    // ADR-0022 operator override. Read by the host flag store's env layer, not
+    // by a hand-written process.env gate — so check-new-env-gates.sh stays quiet
+    // and the escape hatch still exists for a per-host canary.
+    envVar: "AGT_TOOL_CALL_AUDIT_ENABLED",
+    // PLACEHOLDER, deliberately unreachable — see the identical treatment on
+    // `github-broker-credentials` below for the full reasoning. `since` is
+    // advisory: it is read only by computeFlagReach behind GET /admin/reach, so
+    // it changes what an operator is TOLD and does not itself stop a flip.
+    //
+    // The host-side reader ships in whichever agt-cli patch the auto-publish
+    // cuts after this merges, and that number cannot be known while writing
+    // this line. Omitting `since` is NOT the safe default here: it resolves to
+    // `honors`, reporting every host as honouring the flip — including hosts
+    // whose agt-cli has no reader at all. An unreachable value reports `stale`
+    // instead: conservative, and visibly wrong rather than invisibly wrong.
+    //
+    // BEFORE THIS FLAG IS FLIPPED ANYWHERE: replace this with the first
+    // published agt-cli version containing `maybeScanToolCalls`.
+    since: "0.29.0"
+  },
   {
     key: "conversation-eval-backend",
     description: "Backend for host-side conversation-success scoring AND memory extraction (ENG-6581), which share one scorer: anthropic-api = Haiku via a direct Anthropic Messages API fetch (no subprocess); claude-p = Haiku via the `claude -p` subprocess (reuses the agent auth, effectively free under Max but a heavy spawn); local = an OpenAI-compatible loopback endpoint (transcript never leaves the host). Auth for the anthropic-api path comes from AGT_CONV_EVAL_ANTHROPIC_API_KEY (falls back to ANTHROPIC_API_KEY); with no key that path fails closed (eval disabled) rather than reverting to claude-p. Enum.",

package/dist/{persistent-session-MLLLDI5U.js → persistent-session-CI37H442.js}

@@ -41,7 +41,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-TOGADVFR.js";
+} from "./chunk-2DEE3OVI.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -87,4 +87,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-MLLLDI5U.js.map
+//# sourceMappingURL=persistent-session-CI37H442.js.map

package/dist/{responsiveness-probe-QMAIFW4P.js → responsiveness-probe-O33QL25H.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-TOGADVFR.js";
+} from "./chunk-2DEE3OVI.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -689,4 +689,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-QMAIFW4P.js.map
+//# sourceMappingURL=responsiveness-probe-O33QL25H.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.564",
+  "version": "0.28.566",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {