@integrity-labs/agt-cli 0.28.610 → 0.28.612

package/dist/{claude-pair-runtime-3Y6ZICI3.js → claude-pair-runtime-4MKFMNYN.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-HOFUHGKI.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-KO24RZN7.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-3Y6ZICI3.js.map
+//# sourceMappingURL=claude-pair-runtime-4MKFMNYN.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-RTZ2VC7V.js";
+} from "../chunk-F2WTBHMD.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -109,7 +109,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-DESCRVVM.js";
+} from "../chunk-DJP4JZGE.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -186,7 +186,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-FF7H4K7I.js";
+} from "../chunk-RQAAW5LL.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -11287,7 +11287,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-Z7IFPQCU.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-V4O7DXYV.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname9(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -11926,7 +11926,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.610" : "dev";
+var agtCliVersion = true ? "0.28.612" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13233,7 +13233,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-HOFUHGKI.js");
+      const { collectDiagnostics } = await import("../persistent-session-KO24RZN7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -13341,7 +13341,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-HOFUHGKI.js");
+      const { collectDiagnostics } = await import("../persistent-session-KO24RZN7.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor) : void 0;
       let tailscaleHostname;
@@ -13464,7 +13464,7 @@ async function pollCycle() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-Z7IFPQCU.js");
+      } = await import("../responsiveness-probe-V4O7DXYV.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -13570,7 +13570,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-Z7IFPQCU.js");
+        } = await import("../responsiveness-probe-V4O7DXYV.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -13726,7 +13726,7 @@ async function pollCycle() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-Q6AY5HC7.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-S7WK33WO.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -17215,7 +17215,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-HOFUHGKI.js");
+        const { collectDiagnostics } = await import("../persistent-session-KO24RZN7.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17266,7 +17266,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-HOFUHGKI.js");
+      const { collectDiagnostics } = await import("../persistent-session-KO24RZN7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17862,7 +17862,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-3Y6ZICI3.js");
+  } = await import("../claude-pair-runtime-4MKFMNYN.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -30142,8 +30142,12 @@ function busyAckNoticeText() {
   return "\u{1F6E0}\uFE0F I'm in the middle of something right now \u2014 I'll follow up on this as soon as I'm free.";
 }
 var GIVE_UP_SIGNAL_MAX_AGE_MS = 30 * 60 * 1e3;
-function turnFailedNoticeText() {
-  return "\u26A0\uFE0F Something went wrong on my side and I couldn\u2019t finish that. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.";
+function turnFailedNoticeText(failureClass) {
+  const cause = failureClass === "overloaded" ? "the service I run on is overloaded right now \u2014 nothing to do with you or what you asked for" : failureClass === "server_error" ? "something upstream of me is failing right now \u2014 nothing to do with you or what you asked for" : null;
+  if (cause === null) {
+    return "\u26A0\uFE0F Something went wrong on my side and I couldn\u2019t finish that. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.";
+  }
+  return `\u26A0\uFE0F I couldn\u2019t finish that \u2014 ${cause}. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.`;
 }
 function oldestPendingMarkerAgeMs(dir, now = Date.now(), opts) {
   if (!dir) return null;
@@ -32565,6 +32569,12 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
 var AL_PANEL_WIDTH_PX = 420;
 var AL_MIN_CANVAS_PX = 320;
 var AL_SPLIT_MIN_VIEWPORT_PX = AL_PANEL_WIDTH_PX + AL_MIN_CANVAS_PX;
+var DECK_HUD_BOTTOM_PX = 20;
+var DECK_HUD_HEIGHT_PX = 48;
+var DECK_HUD_TOP_PX = DECK_HUD_BOTTOM_PX + DECK_HUD_HEIGHT_PX;
+var DECK_CHROME_GAP_PX = 8;
+var DECK_ATTRIBUTION_BOTTOM_PX = DECK_HUD_TOP_PX + DECK_CHROME_GAP_PX;
+var DECK_ATTRIBUTION_NARROW_BOTTOM_PX = 104 + DECK_CHROME_GAP_PX;
 
 // ../core/dist/integrations/augmented-live/asset.js
 var MB = 1024 * 1024;
@@ -34866,6 +34876,29 @@ registerTriggerSource(videoRenderTriggerAdapter);
 
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
+  {
+    key: "impersonation-enabled",
+    description: "Kill switch for admin impersonation (ENG-9080), filed during the 18 Aug cross-tenant identity incident. ON (default) = impersonation works as today. OFF = both halves of the flow refuse: the mint route stops issuing redeem URLs, and \u2014 the half that actually matters \u2014 the REDEEM route refuses before it inserts the nonce or calls generateLink, so a URL that was already issued cannot still mint a session. Redeem tokens live REDEEM_TTL_SECONDS = 300, so gating only the mint route would leave five minutes in which new sessions keep appearing after an operator believes they have stopped it. Evaluated as a GLOBAL stage value, read UNCACHED on the redeem path (see readImpersonationEnabled): a kill switch that takes a cache TTL to bite is not a kill switch. Containment only \u2014 it does not fix the underlying defect that redeem writes the target's cookies into whatever browser context opens the URL (ENG-8923 / ENG-9020).",
+    flagType: "boolean",
+    // Declared safe value is `true` = impersonation available, i.e. today's
+    // behaviour, so merging this changes nothing until an operator flips it.
+    //
+    // NOTE the asymmetry with the other gates in this file, and it is
+    // deliberate: their safe direction is "off / don't do the new thing"
+    // because they gate NEW behaviour. This one gates EXISTING behaviour, so
+    // the no-op default is `true`. The READ direction is where the safety lives
+    // instead — an unreachable flag store resolves to DISABLED, not to this
+    // default. See readImpersonationEnabled for that argument.
+    defaultValue: true,
+    // Enforcement gate (ADR-0022 section 4): re-enabling impersonation is
+    // "relaxing a security control", exactly the mutation that must not happen
+    // on a single unguarded write. The emergency direction (turning it OFF)
+    // costs one confirmation, which is the right price.
+    sensitive: true
+    // Deliberately NOT public. A browser has no business evaluating whether
+    // impersonation is available; both consumers are server-side route
+    // handlers.
+  },
   {
     key: "at-rest-v2-writes",
     description: "ADR-0061 A2\u2192arm cutover (ENG-8944, parent ENG-8764). Gates whether the at-rest writer (encryptSecret/encryptAtRest) emits the v2 AAD-bound envelope when a DecryptContext is supplied; OFF (default) = the legacy v1 envelope (pre-ADR-0061 behaviour). Resolved FLEET-WIDE and process-global via setV2WritesArmed at the API + webapp + cron bootstrap seams, so ONLY the stage value applies \u2014 per-org overrides do not (the crypto writer carries no request/org context). Ships dark. Flip on only once every reader parses v2 (fleet-wide since release A1) AND the re-seal engine can re-seal v2 blobs before any AUTH_ENCRYPTION_KEY rotation (slice 5b). Reversible without redeploy: clearing it returns the writer to v1 within the flag cache TTL; already-written v2 blobs stay readable.",
@@ -38099,7 +38132,7 @@ function armTurnFailureWatch(args) {
         return;
       }
       lastTurnFailedNoticeAt.set(args.sessionId, now);
-      const ok = await postDirectChatNoticeMessage(args.sessionId, turnFailedNoticeText());
+      const ok = await postDirectChatNoticeMessage(args.sessionId, turnFailedNoticeText(failure.failureClass));
       if (!ok) {
         lastTurnFailedNoticeAt.delete(args.sessionId);
         process.stderr.write(

package/dist/mcp/origami.js

@@ -38903,6 +38903,12 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
 var AL_PANEL_WIDTH_PX = 420;
 var AL_MIN_CANVAS_PX = 320;
 var AL_SPLIT_MIN_VIEWPORT_PX = AL_PANEL_WIDTH_PX + AL_MIN_CANVAS_PX;
+var DECK_HUD_BOTTOM_PX = 20;
+var DECK_HUD_HEIGHT_PX = 48;
+var DECK_HUD_TOP_PX = DECK_HUD_BOTTOM_PX + DECK_HUD_HEIGHT_PX;
+var DECK_CHROME_GAP_PX = 8;
+var DECK_ATTRIBUTION_BOTTOM_PX = DECK_HUD_TOP_PX + DECK_CHROME_GAP_PX;
+var DECK_ATTRIBUTION_NARROW_BOTTOM_PX = 104 + DECK_CHROME_GAP_PX;
 
 // ../core/dist/integrations/augmented-live/asset.js
 var MB = 1024 * 1024;
@@ -40757,6 +40763,29 @@ registerTriggerSource(videoRenderTriggerAdapter);
 
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
+  {
+    key: "impersonation-enabled",
+    description: "Kill switch for admin impersonation (ENG-9080), filed during the 18 Aug cross-tenant identity incident. ON (default) = impersonation works as today. OFF = both halves of the flow refuse: the mint route stops issuing redeem URLs, and \u2014 the half that actually matters \u2014 the REDEEM route refuses before it inserts the nonce or calls generateLink, so a URL that was already issued cannot still mint a session. Redeem tokens live REDEEM_TTL_SECONDS = 300, so gating only the mint route would leave five minutes in which new sessions keep appearing after an operator believes they have stopped it. Evaluated as a GLOBAL stage value, read UNCACHED on the redeem path (see readImpersonationEnabled): a kill switch that takes a cache TTL to bite is not a kill switch. Containment only \u2014 it does not fix the underlying defect that redeem writes the target's cookies into whatever browser context opens the URL (ENG-8923 / ENG-9020).",
+    flagType: "boolean",
+    // Declared safe value is `true` = impersonation available, i.e. today's
+    // behaviour, so merging this changes nothing until an operator flips it.
+    //
+    // NOTE the asymmetry with the other gates in this file, and it is
+    // deliberate: their safe direction is "off / don't do the new thing"
+    // because they gate NEW behaviour. This one gates EXISTING behaviour, so
+    // the no-op default is `true`. The READ direction is where the safety lives
+    // instead — an unreachable flag store resolves to DISABLED, not to this
+    // default. See readImpersonationEnabled for that argument.
+    defaultValue: true,
+    // Enforcement gate (ADR-0022 section 4): re-enabling impersonation is
+    // "relaxing a security control", exactly the mutation that must not happen
+    // on a single unguarded write. The emergency direction (turning it OFF)
+    // costs one confirmation, which is the right price.
+    sensitive: true
+    // Deliberately NOT public. A browser has no business evaluating whether
+    // impersonation is available; both consumers are server-side route
+    // handlers.
+  },
   {
     key: "at-rest-v2-writes",
     description: "ADR-0061 A2\u2192arm cutover (ENG-8944, parent ENG-8764). Gates whether the at-rest writer (encryptSecret/encryptAtRest) emits the v2 AAD-bound envelope when a DecryptContext is supplied; OFF (default) = the legacy v1 envelope (pre-ADR-0061 behaviour). Resolved FLEET-WIDE and process-global via setV2WritesArmed at the API + webapp + cron bootstrap seams, so ONLY the stage value applies \u2014 per-org overrides do not (the crypto writer carries no request/org context). Ships dark. Flip on only once every reader parses v2 (fleet-wide since release A1) AND the re-seal engine can re-seal v2 blobs before any AUTH_ENCRYPTION_KEY rotation (slice 5b). Reversible without redeploy: clearing it returns the writer to v1 within the flag cache TTL; already-written v2 blobs stay readable.",

package/dist/mcp/slack-channel.js

@@ -32954,6 +32954,12 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
 var AL_PANEL_WIDTH_PX = 420;
 var AL_MIN_CANVAS_PX = 320;
 var AL_SPLIT_MIN_VIEWPORT_PX = AL_PANEL_WIDTH_PX + AL_MIN_CANVAS_PX;
+var DECK_HUD_BOTTOM_PX = 20;
+var DECK_HUD_HEIGHT_PX = 48;
+var DECK_HUD_TOP_PX = DECK_HUD_BOTTOM_PX + DECK_HUD_HEIGHT_PX;
+var DECK_CHROME_GAP_PX = 8;
+var DECK_ATTRIBUTION_BOTTOM_PX = DECK_HUD_TOP_PX + DECK_CHROME_GAP_PX;
+var DECK_ATTRIBUTION_NARROW_BOTTOM_PX = 104 + DECK_CHROME_GAP_PX;
 
 // ../core/dist/integrations/augmented-live/asset.js
 var MB = 1024 * 1024;
@@ -35202,6 +35208,29 @@ registerTriggerSource(videoRenderTriggerAdapter);
 
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
+  {
+    key: "impersonation-enabled",
+    description: "Kill switch for admin impersonation (ENG-9080), filed during the 18 Aug cross-tenant identity incident. ON (default) = impersonation works as today. OFF = both halves of the flow refuse: the mint route stops issuing redeem URLs, and \u2014 the half that actually matters \u2014 the REDEEM route refuses before it inserts the nonce or calls generateLink, so a URL that was already issued cannot still mint a session. Redeem tokens live REDEEM_TTL_SECONDS = 300, so gating only the mint route would leave five minutes in which new sessions keep appearing after an operator believes they have stopped it. Evaluated as a GLOBAL stage value, read UNCACHED on the redeem path (see readImpersonationEnabled): a kill switch that takes a cache TTL to bite is not a kill switch. Containment only \u2014 it does not fix the underlying defect that redeem writes the target's cookies into whatever browser context opens the URL (ENG-8923 / ENG-9020).",
+    flagType: "boolean",
+    // Declared safe value is `true` = impersonation available, i.e. today's
+    // behaviour, so merging this changes nothing until an operator flips it.
+    //
+    // NOTE the asymmetry with the other gates in this file, and it is
+    // deliberate: their safe direction is "off / don't do the new thing"
+    // because they gate NEW behaviour. This one gates EXISTING behaviour, so
+    // the no-op default is `true`. The READ direction is where the safety lives
+    // instead — an unreachable flag store resolves to DISABLED, not to this
+    // default. See readImpersonationEnabled for that argument.
+    defaultValue: true,
+    // Enforcement gate (ADR-0022 section 4): re-enabling impersonation is
+    // "relaxing a security control", exactly the mutation that must not happen
+    // on a single unguarded write. The emergency direction (turning it OFF)
+    // costs one confirmation, which is the right price.
+    sensitive: true
+    // Deliberately NOT public. A browser has no business evaluating whether
+    // impersonation is available; both consumers are server-side route
+    // handlers.
+  },
   {
     key: "at-rest-v2-writes",
     description: "ADR-0061 A2\u2192arm cutover (ENG-8944, parent ENG-8764). Gates whether the at-rest writer (encryptSecret/encryptAtRest) emits the v2 AAD-bound envelope when a DecryptContext is supplied; OFF (default) = the legacy v1 envelope (pre-ADR-0061 behaviour). Resolved FLEET-WIDE and process-global via setV2WritesArmed at the API + webapp + cron bootstrap seams, so ONLY the stage value applies \u2014 per-org overrides do not (the crypto writer carries no request/org context). Ships dark. Flip on only once every reader parses v2 (fleet-wide since release A1) AND the re-seal engine can re-seal v2 blobs before any AUTH_ENCRYPTION_KEY rotation (slice 5b). Reversible without redeploy: clearing it returns the writer to v1 within the flag cache TTL; already-written v2 blobs stay readable.",
@@ -36968,8 +36997,12 @@ function giveUpNoticeText(reason = null) {
   }
   return "\u26A0\uFE0F I couldn't read your last message \u2014 please resend it.";
 }
-function turnFailedNoticeText() {
-  return "\u26A0\uFE0F Something went wrong on my side and I couldn\u2019t finish that. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.";
+function turnFailedNoticeText(failureClass) {
+  const cause = failureClass === "overloaded" ? "the service I run on is overloaded right now \u2014 nothing to do with you or what you asked for" : failureClass === "server_error" ? "something upstream of me is failing right now \u2014 nothing to do with you or what you asked for" : null;
+  if (cause === null) {
+    return "\u26A0\uFE0F Something went wrong on my side and I couldn\u2019t finish that. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.";
+  }
+  return `\u26A0\uFE0F I couldn\u2019t finish that \u2014 ${cause}. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.`;
 }
 function turnRetryingNoticeText() {
   return "\u23F3 Still working on this \u2014 things are running slower than usual on my side. I\u2019ll reply as soon as I have it.";
@@ -42672,7 +42705,7 @@ function armSlackTurnFailureWatch(args) {
       const posted = await postSlackTurnNotice({
         channel,
         threadTs: args.threadTs,
-        text: turnFailedNoticeText()
+        text: turnFailedNoticeText(failure.failureClass)
       });
       if (!posted.ok) {
         lastSlackTurnFailedNoticeAt.delete(conversationKey);

package/dist/mcp/telegram-channel.js

@@ -33113,6 +33113,12 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
 var AL_PANEL_WIDTH_PX = 420;
 var AL_MIN_CANVAS_PX = 320;
 var AL_SPLIT_MIN_VIEWPORT_PX = AL_PANEL_WIDTH_PX + AL_MIN_CANVAS_PX;
+var DECK_HUD_BOTTOM_PX = 20;
+var DECK_HUD_HEIGHT_PX = 48;
+var DECK_HUD_TOP_PX = DECK_HUD_BOTTOM_PX + DECK_HUD_HEIGHT_PX;
+var DECK_CHROME_GAP_PX = 8;
+var DECK_ATTRIBUTION_BOTTOM_PX = DECK_HUD_TOP_PX + DECK_CHROME_GAP_PX;
+var DECK_ATTRIBUTION_NARROW_BOTTOM_PX = 104 + DECK_CHROME_GAP_PX;
 
 // ../core/dist/integrations/augmented-live/asset.js
 var MB = 1024 * 1024;
@@ -35361,6 +35367,29 @@ registerTriggerSource(videoRenderTriggerAdapter);
 
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
+  {
+    key: "impersonation-enabled",
+    description: "Kill switch for admin impersonation (ENG-9080), filed during the 18 Aug cross-tenant identity incident. ON (default) = impersonation works as today. OFF = both halves of the flow refuse: the mint route stops issuing redeem URLs, and \u2014 the half that actually matters \u2014 the REDEEM route refuses before it inserts the nonce or calls generateLink, so a URL that was already issued cannot still mint a session. Redeem tokens live REDEEM_TTL_SECONDS = 300, so gating only the mint route would leave five minutes in which new sessions keep appearing after an operator believes they have stopped it. Evaluated as a GLOBAL stage value, read UNCACHED on the redeem path (see readImpersonationEnabled): a kill switch that takes a cache TTL to bite is not a kill switch. Containment only \u2014 it does not fix the underlying defect that redeem writes the target's cookies into whatever browser context opens the URL (ENG-8923 / ENG-9020).",
+    flagType: "boolean",
+    // Declared safe value is `true` = impersonation available, i.e. today's
+    // behaviour, so merging this changes nothing until an operator flips it.
+    //
+    // NOTE the asymmetry with the other gates in this file, and it is
+    // deliberate: their safe direction is "off / don't do the new thing"
+    // because they gate NEW behaviour. This one gates EXISTING behaviour, so
+    // the no-op default is `true`. The READ direction is where the safety lives
+    // instead — an unreachable flag store resolves to DISABLED, not to this
+    // default. See readImpersonationEnabled for that argument.
+    defaultValue: true,
+    // Enforcement gate (ADR-0022 section 4): re-enabling impersonation is
+    // "relaxing a security control", exactly the mutation that must not happen
+    // on a single unguarded write. The emergency direction (turning it OFF)
+    // costs one confirmation, which is the right price.
+    sensitive: true
+    // Deliberately NOT public. A browser has no business evaluating whether
+    // impersonation is available; both consumers are server-side route
+    // handlers.
+  },
   {
     key: "at-rest-v2-writes",
     description: "ADR-0061 A2\u2192arm cutover (ENG-8944, parent ENG-8764). Gates whether the at-rest writer (encryptSecret/encryptAtRest) emits the v2 AAD-bound envelope when a DecryptContext is supplied; OFF (default) = the legacy v1 envelope (pre-ADR-0061 behaviour). Resolved FLEET-WIDE and process-global via setV2WritesArmed at the API + webapp + cron bootstrap seams, so ONLY the stage value applies \u2014 per-org overrides do not (the crypto writer carries no request/org context). Ships dark. Flip on only once every reader parses v2 (fleet-wide since release A1) AND the re-seal engine can re-seal v2 blobs before any AUTH_ENCRYPTION_KEY rotation (slice 5b). Reversible without redeploy: clearing it returns the writer to v1 within the flag cache TTL; already-written v2 blobs stay readable.",
@@ -39572,8 +39601,12 @@ function giveUpNoticeText(reason = null) {
   }
   return "\u26A0\uFE0F I couldn't read your last message \u2014 please resend it.";
 }
-function turnFailedNoticeText() {
-  return "\u26A0\uFE0F Something went wrong on my side and I couldn\u2019t finish that. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.";
+function turnFailedNoticeText(failureClass) {
+  const cause = failureClass === "overloaded" ? "the service I run on is overloaded right now \u2014 nothing to do with you or what you asked for" : failureClass === "server_error" ? "something upstream of me is failing right now \u2014 nothing to do with you or what you asked for" : null;
+  if (cause === null) {
+    return "\u26A0\uFE0F Something went wrong on my side and I couldn\u2019t finish that. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.";
+  }
+  return `\u26A0\uFE0F I couldn\u2019t finish that \u2014 ${cause}. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.`;
 }
 function turnRetryingNoticeText() {
   return "\u23F3 Still working on this \u2014 things are running slower than usual on my side. I\u2019ll reply as soon as I have it.";
@@ -41987,7 +42020,7 @@ function armTelegramTurnFailureWatch(args) {
       const posted = await postTelegramTurnNotice({
         chatId: args.chatId,
         ...args.messageThreadId != null ? { messageThreadId: args.messageThreadId } : {},
-        text: turnFailedNoticeText()
+        text: turnFailedNoticeText(failure.failureClass)
       });
       if (!posted) {
         lastTurnFailedNoticeAt.delete(conversationKey);

package/dist/{persistent-session-HOFUHGKI.js → persistent-session-KO24RZN7.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-DESCRVVM.js";
-import "./chunk-FF7H4K7I.js";
+} from "./chunk-DJP4JZGE.js";
+import "./chunk-RQAAW5LL.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-HOFUHGKI.js.map
+//# sourceMappingURL=persistent-session-KO24RZN7.js.map

package/dist/{responsiveness-probe-Z7IFPQCU.js → responsiveness-probe-V4O7DXYV.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-DESCRVVM.js";
-import "./chunk-FF7H4K7I.js";
+} from "./chunk-DJP4JZGE.js";
+import "./chunk-RQAAW5LL.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -710,4 +710,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-Z7IFPQCU.js.map
+//# sourceMappingURL=responsiveness-probe-V4O7DXYV.js.map

package/dist/{session-auth-dead-Q6AY5HC7.js → session-auth-dead-S7WK33WO.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-FF7H4K7I.js";
+} from "./chunk-RQAAW5LL.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-Q6AY5HC7.js.map
+//# sourceMappingURL=session-auth-dead-S7WK33WO.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.610",
+  "version": "0.28.612",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {