@integrity-labs/agt-cli 0.28.569 → 0.28.571

package/dist/mcp/direct-chat-channel.js

@@ -35393,13 +35393,30 @@ var FLAG_REGISTRY = [
     // safe default — it resolves to `honors`, reporting every host as honouring
     // the flip, including hosts whose agt-cli has no reader at all.
     //
-    // 0.28.566 is the auto-publish cut from the ENG-8575 merge (583cef8d9,
-    // published 2026-08-12T08:32Z). Verified against the published tarball
-    // rather than inferred from the merge: `maybeScanToolCalls`,
-    // `tool-call-audit` and `tool-call-path-salt` are all present in
-    // package/dist/lib/manager-worker.js — the manager, which is the actual
-    // reader. The dist/mcp/* occurrences are bundling artifacts, not readers.
-    since: "0.28.566"
+    // WHAT THIS VERSION HAS TO MEAN. Not "the first build with a reader" — the
+    // first build where flipping the flag does what the flag is documented to
+    // do. Those diverged twice already, in the same direction:
+    //
+    //   0.28.566 (ENG-8575) — the first build with a reader. Pinned here and
+    //     correct on the day. It has the unbounded scan window and the coverage
+    //     rows that overstate (both ENG-8740), and no `logging_mode` enforcement
+    //     at all (ENG-8726) — so a hash-only agent on it emits plaintext
+    //     `argv0` / `url_host` / `mcp_tool`, which is precisely the governance
+    //     breach this epic exists to prevent.
+    //   0.28.569 (ENG-8740) — bounded window, honest coverage intervals. Still
+    //     no hash-only enforcement. The pin was NOT moved at that merge and went
+    //     stale for a day; reach reported those hosts `honors`.
+    //   0.28.570 (ENG-8726) — hash-only honoured at runtime. Current pin.
+    //
+    // MOVE THIS PIN whenever a change alters what arming the flag DOES on a
+    // host, and verify it against the published tarball rather than inferring it
+    // from the merge — `npm pack @integrity-labs/agt-cli@<v>` and grep
+    // package/dist/lib/manager-worker.js (the manager is the actual reader; the
+    // dist/mcp/* occurrences are bundling artifacts). For 0.28.570 the markers
+    // are `readAgentLoggingMode` and `loggingModeWithholdsTargets`. Auto-publish
+    // patch-bumps from whatever is on main, so if another CLI-touching PR lands
+    // first the real cut is higher than this and the pin under-reports.
+    since: "0.28.570"
   },
   {
     key: "conversation-eval-backend",
@@ -35704,9 +35721,9 @@ var FLAG_REGISTRY = [
   },
   {
     key: "notify-dispatch",
-    description: "Membership-based channel-notify dispatch (ENG-7682 / notify Slice 1). off = today's behaviour: a non-@mention top-level channel message is dropped by the mention_only engagement gate (SLACK_CHANNEL_RESPONSE_MODE). membership = the agent's Slack MCP ADMITS non-@mention channel messages in channels its bot is a member of (the Socket Mode websocket already receives them), waking the agent in-thread via the SAME existing wake path used for @mentions/DMs. Only the mention_only engagement gate is relaxed - the echo/dedup, bot_id/self, and peer-classifier safety leaves still apply, so this never opens a bot-to-bot wake loop. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_NOTIFY_DISPATCH spawn env (operator/canary override, ADR-0022). filter = like membership (opt-out) but honours a per-channel mute list: a member-channel message wakes the agent UNLESS the user muted that channel via the /notify slash command. The manager materializes the muted set into AGT_NOTIFY_MUTED_CHANNELS from agent_notify_channel_prefs (ENG-7682 Slice 2). Ships dark (default off).",
+    description: `Membership-based channel-notify dispatch (ENG-7682 / notify Slice 1). off = today's behaviour: a non-@mention top-level channel message is dropped by the mention_only engagement gate (SLACK_CHANNEL_RESPONSE_MODE). membership = the agent's Slack MCP ADMITS non-@mention channel messages in channels its bot is a member of (the Socket Mode websocket already receives them), waking the agent in-thread via the SAME existing wake path used for @mentions/DMs. Only the mention_only engagement gate is relaxed - the echo/dedup, bot_id/self, and peer-classifier safety leaves still apply, so this never opens a bot-to-bot wake loop. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_NOTIFY_DISPATCH spawn env (operator/canary override, ADR-0022). filter = like membership (opt-out) but honours a per-channel mute list: a member-channel message wakes the agent UNLESS the user muted that channel via the /notify slash command. The manager materializes the muted set into AGT_NOTIFY_MUTED_CHANNELS from agent_notify_channel_prefs (ENG-7682 Slice 2). addressed = like filter (same per-channel mute, checked FIRST so a mute outranks being named), but a member-channel message additionally has to address THIS agent to wake it: a real Slack mention of its bot user id, \`@<code_name>\` typed verbatim, or the code name used as a vocative at the start of the message ("koda:", "hey koda"). @team / @everyone still wake everyone. This is the fix for one named agent waking every agent in a shared channel (ENG-8657); matching is deliberately conservative, so a name mentioned mid-sentence does NOT wake, and an agent whose identity is unknown to the channel server stays asleep rather than waking on everything. Ships dark (default off).`,
     flagType: "enum",
-    allowedValues: ["off", "membership", "filter"],
+    allowedValues: ["off", "membership", "filter", "addressed"],
     // Declared safe value is `off`: the mention_only gate stays in force, byte-
     // identical to today. membership is the deliberate, per-agent flip that
     // widens what wakes the agent.

package/dist/mcp/origami.js

@@ -41284,13 +41284,30 @@ var FLAG_REGISTRY = [
     // safe default — it resolves to `honors`, reporting every host as honouring
     // the flip, including hosts whose agt-cli has no reader at all.
     //
-    // 0.28.566 is the auto-publish cut from the ENG-8575 merge (583cef8d9,
-    // published 2026-08-12T08:32Z). Verified against the published tarball
-    // rather than inferred from the merge: `maybeScanToolCalls`,
-    // `tool-call-audit` and `tool-call-path-salt` are all present in
-    // package/dist/lib/manager-worker.js — the manager, which is the actual
-    // reader. The dist/mcp/* occurrences are bundling artifacts, not readers.
-    since: "0.28.566"
+    // WHAT THIS VERSION HAS TO MEAN. Not "the first build with a reader" — the
+    // first build where flipping the flag does what the flag is documented to
+    // do. Those diverged twice already, in the same direction:
+    //
+    //   0.28.566 (ENG-8575) — the first build with a reader. Pinned here and
+    //     correct on the day. It has the unbounded scan window and the coverage
+    //     rows that overstate (both ENG-8740), and no `logging_mode` enforcement
+    //     at all (ENG-8726) — so a hash-only agent on it emits plaintext
+    //     `argv0` / `url_host` / `mcp_tool`, which is precisely the governance
+    //     breach this epic exists to prevent.
+    //   0.28.569 (ENG-8740) — bounded window, honest coverage intervals. Still
+    //     no hash-only enforcement. The pin was NOT moved at that merge and went
+    //     stale for a day; reach reported those hosts `honors`.
+    //   0.28.570 (ENG-8726) — hash-only honoured at runtime. Current pin.
+    //
+    // MOVE THIS PIN whenever a change alters what arming the flag DOES on a
+    // host, and verify it against the published tarball rather than inferring it
+    // from the merge — `npm pack @integrity-labs/agt-cli@<v>` and grep
+    // package/dist/lib/manager-worker.js (the manager is the actual reader; the
+    // dist/mcp/* occurrences are bundling artifacts). For 0.28.570 the markers
+    // are `readAgentLoggingMode` and `loggingModeWithholdsTargets`. Auto-publish
+    // patch-bumps from whatever is on main, so if another CLI-touching PR lands
+    // first the real cut is higher than this and the pin under-reports.
+    since: "0.28.570"
   },
   {
     key: "conversation-eval-backend",
@@ -41595,9 +41612,9 @@ var FLAG_REGISTRY = [
   },
   {
     key: "notify-dispatch",
-    description: "Membership-based channel-notify dispatch (ENG-7682 / notify Slice 1). off = today's behaviour: a non-@mention top-level channel message is dropped by the mention_only engagement gate (SLACK_CHANNEL_RESPONSE_MODE). membership = the agent's Slack MCP ADMITS non-@mention channel messages in channels its bot is a member of (the Socket Mode websocket already receives them), waking the agent in-thread via the SAME existing wake path used for @mentions/DMs. Only the mention_only engagement gate is relaxed - the echo/dedup, bot_id/self, and peer-classifier safety leaves still apply, so this never opens a bot-to-bot wake loop. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_NOTIFY_DISPATCH spawn env (operator/canary override, ADR-0022). filter = like membership (opt-out) but honours a per-channel mute list: a member-channel message wakes the agent UNLESS the user muted that channel via the /notify slash command. The manager materializes the muted set into AGT_NOTIFY_MUTED_CHANNELS from agent_notify_channel_prefs (ENG-7682 Slice 2). Ships dark (default off).",
+    description: `Membership-based channel-notify dispatch (ENG-7682 / notify Slice 1). off = today's behaviour: a non-@mention top-level channel message is dropped by the mention_only engagement gate (SLACK_CHANNEL_RESPONSE_MODE). membership = the agent's Slack MCP ADMITS non-@mention channel messages in channels its bot is a member of (the Socket Mode websocket already receives them), waking the agent in-thread via the SAME existing wake path used for @mentions/DMs. Only the mention_only engagement gate is relaxed - the echo/dedup, bot_id/self, and peer-classifier safety leaves still apply, so this never opens a bot-to-bot wake loop. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_NOTIFY_DISPATCH spawn env (operator/canary override, ADR-0022). filter = like membership (opt-out) but honours a per-channel mute list: a member-channel message wakes the agent UNLESS the user muted that channel via the /notify slash command. The manager materializes the muted set into AGT_NOTIFY_MUTED_CHANNELS from agent_notify_channel_prefs (ENG-7682 Slice 2). addressed = like filter (same per-channel mute, checked FIRST so a mute outranks being named), but a member-channel message additionally has to address THIS agent to wake it: a real Slack mention of its bot user id, \`@<code_name>\` typed verbatim, or the code name used as a vocative at the start of the message ("koda:", "hey koda"). @team / @everyone still wake everyone. This is the fix for one named agent waking every agent in a shared channel (ENG-8657); matching is deliberately conservative, so a name mentioned mid-sentence does NOT wake, and an agent whose identity is unknown to the channel server stays asleep rather than waking on everything. Ships dark (default off).`,
     flagType: "enum",
-    allowedValues: ["off", "membership", "filter"],
+    allowedValues: ["off", "membership", "filter", "addressed"],
     // Declared safe value is `off`: the mention_only gate stays in force, byte-
     // identical to today. membership is the deliberate, per-agent flip that
     // widens what wakes the agent.

package/dist/mcp/slack-channel.js

@@ -14991,7 +14991,7 @@ var require_lib = __commonJS({
       ">": ">",
       "\\": "\"
     };
-    var escapeRegex2 = /[&"'<>\\]/g;
+    var escapeRegex3 = /[&"'<>\\]/g;
     var _exports = module.exports = {};
     function hasOwnProp(obj, k) {
       return ObjProto.hasOwnProperty.call(obj, k);
@@ -15095,7 +15095,7 @@ var require_lib = __commonJS({
     }
     _exports.TemplateError = TemplateError2;
     function escape2(val) {
-      return val.replace(escapeRegex2, lookupEscape);
+      return val.replace(escapeRegex3, lookupEscape);
     }
     _exports.escape = escape2;
     function isFunction(obj) {
@@ -35729,13 +35729,30 @@ var FLAG_REGISTRY = [
     // safe default — it resolves to `honors`, reporting every host as honouring
     // the flip, including hosts whose agt-cli has no reader at all.
     //
-    // 0.28.566 is the auto-publish cut from the ENG-8575 merge (583cef8d9,
-    // published 2026-08-12T08:32Z). Verified against the published tarball
-    // rather than inferred from the merge: `maybeScanToolCalls`,
-    // `tool-call-audit` and `tool-call-path-salt` are all present in
-    // package/dist/lib/manager-worker.js — the manager, which is the actual
-    // reader. The dist/mcp/* occurrences are bundling artifacts, not readers.
-    since: "0.28.566"
+    // WHAT THIS VERSION HAS TO MEAN. Not "the first build with a reader" — the
+    // first build where flipping the flag does what the flag is documented to
+    // do. Those diverged twice already, in the same direction:
+    //
+    //   0.28.566 (ENG-8575) — the first build with a reader. Pinned here and
+    //     correct on the day. It has the unbounded scan window and the coverage
+    //     rows that overstate (both ENG-8740), and no `logging_mode` enforcement
+    //     at all (ENG-8726) — so a hash-only agent on it emits plaintext
+    //     `argv0` / `url_host` / `mcp_tool`, which is precisely the governance
+    //     breach this epic exists to prevent.
+    //   0.28.569 (ENG-8740) — bounded window, honest coverage intervals. Still
+    //     no hash-only enforcement. The pin was NOT moved at that merge and went
+    //     stale for a day; reach reported those hosts `honors`.
+    //   0.28.570 (ENG-8726) — hash-only honoured at runtime. Current pin.
+    //
+    // MOVE THIS PIN whenever a change alters what arming the flag DOES on a
+    // host, and verify it against the published tarball rather than inferring it
+    // from the merge — `npm pack @integrity-labs/agt-cli@<v>` and grep
+    // package/dist/lib/manager-worker.js (the manager is the actual reader; the
+    // dist/mcp/* occurrences are bundling artifacts). For 0.28.570 the markers
+    // are `readAgentLoggingMode` and `loggingModeWithholdsTargets`. Auto-publish
+    // patch-bumps from whatever is on main, so if another CLI-touching PR lands
+    // first the real cut is higher than this and the pin under-reports.
+    since: "0.28.570"
   },
   {
     key: "conversation-eval-backend",
@@ -36040,9 +36057,9 @@ var FLAG_REGISTRY = [
   },
   {
     key: "notify-dispatch",
-    description: "Membership-based channel-notify dispatch (ENG-7682 / notify Slice 1). off = today's behaviour: a non-@mention top-level channel message is dropped by the mention_only engagement gate (SLACK_CHANNEL_RESPONSE_MODE). membership = the agent's Slack MCP ADMITS non-@mention channel messages in channels its bot is a member of (the Socket Mode websocket already receives them), waking the agent in-thread via the SAME existing wake path used for @mentions/DMs. Only the mention_only engagement gate is relaxed - the echo/dedup, bot_id/self, and peer-classifier safety leaves still apply, so this never opens a bot-to-bot wake loop. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_NOTIFY_DISPATCH spawn env (operator/canary override, ADR-0022). filter = like membership (opt-out) but honours a per-channel mute list: a member-channel message wakes the agent UNLESS the user muted that channel via the /notify slash command. The manager materializes the muted set into AGT_NOTIFY_MUTED_CHANNELS from agent_notify_channel_prefs (ENG-7682 Slice 2). Ships dark (default off).",
+    description: `Membership-based channel-notify dispatch (ENG-7682 / notify Slice 1). off = today's behaviour: a non-@mention top-level channel message is dropped by the mention_only engagement gate (SLACK_CHANNEL_RESPONSE_MODE). membership = the agent's Slack MCP ADMITS non-@mention channel messages in channels its bot is a member of (the Socket Mode websocket already receives them), waking the agent in-thread via the SAME existing wake path used for @mentions/DMs. Only the mention_only engagement gate is relaxed - the echo/dedup, bot_id/self, and peer-classifier safety leaves still apply, so this never opens a bot-to-bot wake loop. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_NOTIFY_DISPATCH spawn env (operator/canary override, ADR-0022). filter = like membership (opt-out) but honours a per-channel mute list: a member-channel message wakes the agent UNLESS the user muted that channel via the /notify slash command. The manager materializes the muted set into AGT_NOTIFY_MUTED_CHANNELS from agent_notify_channel_prefs (ENG-7682 Slice 2). addressed = like filter (same per-channel mute, checked FIRST so a mute outranks being named), but a member-channel message additionally has to address THIS agent to wake it: a real Slack mention of its bot user id, \`@<code_name>\` typed verbatim, or the code name used as a vocative at the start of the message ("koda:", "hey koda"). @team / @everyone still wake everyone. This is the fix for one named agent waking every agent in a shared channel (ENG-8657); matching is deliberately conservative, so a name mentioned mid-sentence does NOT wake, and an agent whose identity is unknown to the channel server stays asleep rather than waking on everything. Ships dark (default off).`,
     flagType: "enum",
-    allowedValues: ["off", "membership", "filter"],
+    allowedValues: ["off", "membership", "filter", "addressed"],
     // Declared safe value is `off`: the mention_only gate stays in force, byte-
     // identical to today. membership is the deliberate, per-agent flip that
     // widens what wakes the agent.
@@ -39891,6 +39908,26 @@ function matchesAddressedTeam(text) {
   if (/^(everyone|all)\s*[:,—-]/i.test(t)) return true;
   return false;
 }
+function matchesAddressedAgent(text, agent) {
+  const t = text.trim();
+  if (t.length === 0) return false;
+  const botUserId2 = agent.botUserId?.trim();
+  if (botUserId2 && new RegExp(`<@${escapeRegex2(botUserId2)}(?:\\|[^>]*)?>`).test(t)) return true;
+  const codeName = agent.codeName?.trim();
+  if (!codeName) return false;
+  const name = escapeRegex2(codeName);
+  if (new RegExp(`(?:^|\\s)@${name}(?=$|[\\s.,!?;:])`, "i").test(t)) return true;
+  if (new RegExp(`^${name}\\s*[:,\u2014-]`, "i").test(t)) return true;
+  if (new RegExp(
+    `^(hey|hi|hello|howdy|good (morning|afternoon|evening)|morning|afternoon)\\s+${name}(?=$|[\\s,.!?:])`,
+    "i"
+  ).test(t))
+    return true;
+  return false;
+}
+function escapeRegex2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function channelMessageShouldRespond(text, mode) {
   if (mode === "all") return true;
   if (mode === "mention_only") return false;
@@ -39903,6 +39940,7 @@ function parseNotifyDispatchMode(raw) {
   const v = raw.trim().toLowerCase();
   if (v === "membership") return "membership";
   if (v === "filter") return "filter";
+  if (v === "addressed") return "addressed";
   return "off";
 }
 function parseMutedChannels(raw) {
@@ -39911,12 +39949,17 @@ function parseMutedChannels(raw) {
     raw.split(",").map((s) => s.trim()).filter(Boolean)
   );
 }
-function channelMessageShouldWake(text, responseMode, notifyMode, channelId, mutedChannels) {
+function channelMessageShouldWake(text, responseMode, notifyMode, channelId, mutedChannels, agent) {
   if (notifyMode === "membership") return true;
   if (notifyMode === "filter") {
     if (channelId && mutedChannels && mutedChannels.has(channelId)) return false;
     return true;
   }
+  if (notifyMode === "addressed") {
+    if (channelId && mutedChannels && mutedChannels.has(channelId)) return false;
+    if (!agent) return false;
+    return matchesAddressedAgent(text, agent);
+  }
   return channelMessageShouldRespond(text, responseMode);
 }
 function parseNotifyCommand(text, currentChannelId) {
@@ -39926,6 +39969,15 @@ function parseNotifyCommand(text, currentChannelId) {
   if (arg === "" || arg === "status") return { action: "status", channelId: currentChannelId };
   return { action: "help", channelId: currentChannelId };
 }
+function notifyStatusMessage(muted, mode) {
+  if (mode === "filter") {
+    return muted ? ":mute: This channel is *muted* \u2014 I won\u2019t wake on its messages (an @-mention still reaches me). `/notify on` to resume." : ":bell: This channel is *active* \u2014 I wake on its messages. `/notify off` to mute.";
+  }
+  if (mode === "addressed") {
+    return muted ? ":mute: This channel is *muted* \u2014 I won\u2019t wake on its messages, including ones that name me (a direct @-mention still reaches me). `/notify on` to resume." : ":bell: This channel is *active* \u2014 I wake on messages that address me by name, not on every message here (an @-mention always reaches me). `/notify off` to mute.";
+  }
+  return muted ? ":grey_question: Your *mute* for this channel is *saved but not in effect* \u2014 I\u2019m not in a per-channel dispatch mode right now, so it isn\u2019t changing what wakes me. It applies as soon as an operator enables one." : ":grey_question: *No mute saved* for this channel \u2014 though it wouldn\u2019t apply yet either way: I\u2019m not in a per-channel dispatch mode right now. `/notify off` saves one for when an operator enables it.";
+}
 
 // src/slack-list-channels.ts
 function normaliseForMatch(s) {
@@ -42870,7 +42922,8 @@ async function handleNotifyCommand(payload, codeName) {
     );
     return;
   }
-  const inactiveNote = NOTIFY_DISPATCH_MODE === "filter" ? "" : " _(note: I\u2019m not in per-channel filter mode right now, so this is saved but won\u2019t take effect until an operator enables it.)_";
+  const muteIsLive = NOTIFY_DISPATCH_MODE === "filter" || NOTIFY_DISPATCH_MODE === "addressed";
+  const inactiveNote = muteIsLive ? "" : " _(note: I\u2019m not in a per-channel dispatch mode right now, so this is saved but won\u2019t take effect until an operator enables it.)_";
   const { action } = parseNotifyCommand(payload.text, channelId);
   if (action === "help") {
     await postEphemeralViaResponseUrl(
@@ -42884,7 +42937,9 @@ async function handleNotifyCommand(payload, codeName) {
     const muted = MUTED_CHANNELS.has(channelId);
     await postEphemeralViaResponseUrl(
       responseUrl,
-      (muted ? ":mute: This channel is *muted* \u2014 I won\u2019t wake on its messages (an @-mention still reaches me). `/notify on` to resume." : ":bell: This channel is *active* \u2014 I wake on its messages. `/notify off` to mute.") + inactiveNote,
+      // Pass the MODE, not muteIsLive: `filter` and `addressed` both honour the
+      // mute but do not wake alike, and the status line has to say which.
+      notifyStatusMessage(muted, NOTIFY_DISPATCH_MODE),
       codeName
     );
     return;
@@ -45405,7 +45460,20 @@ async function seedMutedChannelsFromApi() {
   }
 }
 function connectSocketModeSafely() {
-  if (NOTIFY_DISPATCH_MODE === "filter") void seedMutedChannelsFromApi();
+  void startSocketModeAfterSeedingMutes();
+}
+async function startSocketModeAfterSeedingMutes() {
+  if (NOTIFY_DISPATCH_MODE === "filter" || NOTIFY_DISPATCH_MODE === "addressed") {
+    try {
+      await seedMutedChannelsFromApi();
+    } catch (err) {
+      process.stderr.write(
+        `slack-channel: notify-prefs seed threw, connecting anyway: ${err.message}
+`
+      );
+    }
+  }
+  if (isShuttingDown) return;
   void runOrRetry(connectSocketMode, {
     retryDelayMs: 1e4,
     onError: (err) => process.stderr.write(
@@ -45831,7 +45899,10 @@ async function connectSocketMode() {
             CHANNEL_RESPONSE_MODE,
             NOTIFY_DISPATCH_MODE,
             evt.channel,
-            MUTED_CHANNELS
+            MUTED_CHANNELS,
+            // ENG-8657: who this agent is, so `addressed` can tell a message
+            // naming IT from one naming a different agent in the same channel.
+            { botUserId, codeName: AGENT_CODE_NAME }
           ))
             return;
         }

package/dist/mcp/telegram-channel.js

@@ -35888,13 +35888,30 @@ var FLAG_REGISTRY = [
     // safe default — it resolves to `honors`, reporting every host as honouring
     // the flip, including hosts whose agt-cli has no reader at all.
     //
-    // 0.28.566 is the auto-publish cut from the ENG-8575 merge (583cef8d9,
-    // published 2026-08-12T08:32Z). Verified against the published tarball
-    // rather than inferred from the merge: `maybeScanToolCalls`,
-    // `tool-call-audit` and `tool-call-path-salt` are all present in
-    // package/dist/lib/manager-worker.js — the manager, which is the actual
-    // reader. The dist/mcp/* occurrences are bundling artifacts, not readers.
-    since: "0.28.566"
+    // WHAT THIS VERSION HAS TO MEAN. Not "the first build with a reader" — the
+    // first build where flipping the flag does what the flag is documented to
+    // do. Those diverged twice already, in the same direction:
+    //
+    //   0.28.566 (ENG-8575) — the first build with a reader. Pinned here and
+    //     correct on the day. It has the unbounded scan window and the coverage
+    //     rows that overstate (both ENG-8740), and no `logging_mode` enforcement
+    //     at all (ENG-8726) — so a hash-only agent on it emits plaintext
+    //     `argv0` / `url_host` / `mcp_tool`, which is precisely the governance
+    //     breach this epic exists to prevent.
+    //   0.28.569 (ENG-8740) — bounded window, honest coverage intervals. Still
+    //     no hash-only enforcement. The pin was NOT moved at that merge and went
+    //     stale for a day; reach reported those hosts `honors`.
+    //   0.28.570 (ENG-8726) — hash-only honoured at runtime. Current pin.
+    //
+    // MOVE THIS PIN whenever a change alters what arming the flag DOES on a
+    // host, and verify it against the published tarball rather than inferring it
+    // from the merge — `npm pack @integrity-labs/agt-cli@<v>` and grep
+    // package/dist/lib/manager-worker.js (the manager is the actual reader; the
+    // dist/mcp/* occurrences are bundling artifacts). For 0.28.570 the markers
+    // are `readAgentLoggingMode` and `loggingModeWithholdsTargets`. Auto-publish
+    // patch-bumps from whatever is on main, so if another CLI-touching PR lands
+    // first the real cut is higher than this and the pin under-reports.
+    since: "0.28.570"
   },
   {
     key: "conversation-eval-backend",
@@ -36199,9 +36216,9 @@ var FLAG_REGISTRY = [
   },
   {
     key: "notify-dispatch",
-    description: "Membership-based channel-notify dispatch (ENG-7682 / notify Slice 1). off = today's behaviour: a non-@mention top-level channel message is dropped by the mention_only engagement gate (SLACK_CHANNEL_RESPONSE_MODE). membership = the agent's Slack MCP ADMITS non-@mention channel messages in channels its bot is a member of (the Socket Mode websocket already receives them), waking the agent in-thread via the SAME existing wake path used for @mentions/DMs. Only the mention_only engagement gate is relaxed - the echo/dedup, bot_id/self, and peer-classifier safety leaves still apply, so this never opens a bot-to-bot wake loop. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_NOTIFY_DISPATCH spawn env (operator/canary override, ADR-0022). filter = like membership (opt-out) but honours a per-channel mute list: a member-channel message wakes the agent UNLESS the user muted that channel via the /notify slash command. The manager materializes the muted set into AGT_NOTIFY_MUTED_CHANNELS from agent_notify_channel_prefs (ENG-7682 Slice 2). Ships dark (default off).",
+    description: `Membership-based channel-notify dispatch (ENG-7682 / notify Slice 1). off = today's behaviour: a non-@mention top-level channel message is dropped by the mention_only engagement gate (SLACK_CHANNEL_RESPONSE_MODE). membership = the agent's Slack MCP ADMITS non-@mention channel messages in channels its bot is a member of (the Socket Mode websocket already receives them), waking the agent in-thread via the SAME existing wake path used for @mentions/DMs. Only the mention_only engagement gate is relaxed - the echo/dedup, bot_id/self, and peer-classifier safety leaves still apply, so this never opens a bot-to-bot wake loop. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_NOTIFY_DISPATCH spawn env (operator/canary override, ADR-0022). filter = like membership (opt-out) but honours a per-channel mute list: a member-channel message wakes the agent UNLESS the user muted that channel via the /notify slash command. The manager materializes the muted set into AGT_NOTIFY_MUTED_CHANNELS from agent_notify_channel_prefs (ENG-7682 Slice 2). addressed = like filter (same per-channel mute, checked FIRST so a mute outranks being named), but a member-channel message additionally has to address THIS agent to wake it: a real Slack mention of its bot user id, \`@<code_name>\` typed verbatim, or the code name used as a vocative at the start of the message ("koda:", "hey koda"). @team / @everyone still wake everyone. This is the fix for one named agent waking every agent in a shared channel (ENG-8657); matching is deliberately conservative, so a name mentioned mid-sentence does NOT wake, and an agent whose identity is unknown to the channel server stays asleep rather than waking on everything. Ships dark (default off).`,
     flagType: "enum",
-    allowedValues: ["off", "membership", "filter"],
+    allowedValues: ["off", "membership", "filter", "addressed"],
     // Declared safe value is `off`: the mention_only gate stays in force, byte-
     // identical to today. membership is the deliberate, per-agent flip that
     // widens what wakes the agent.

package/dist/{persistent-session-WUNZJXCI.js → persistent-session-74MH2XTM.js}

@@ -41,7 +41,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-7O2TXBWR.js";
+} from "./chunk-72K46XUZ.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -87,4 +87,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-WUNZJXCI.js.map
+//# sourceMappingURL=persistent-session-74MH2XTM.js.map

package/dist/{responsiveness-probe-V3P5TGBH.js → responsiveness-probe-5VNQQZNJ.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-7O2TXBWR.js";
+} from "./chunk-72K46XUZ.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -689,4 +689,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-V3P5TGBH.js.map
+//# sourceMappingURL=responsiveness-probe-5VNQQZNJ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.569",
+  "version": "0.28.571",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {