@integrity-labs/agt-cli 0.28.611 → 0.28.613

package/dist/mcp/telegram-channel.js

@@ -34476,7 +34476,14 @@ var AGENT_DIRECTED_NOTICE_KINDS = [
   // written for the machine. The user learns the same fact from the connect card
   // in that conversation flipping to its connected state, so showing this row as
   // well would say it twice, the second time in prose aimed at an agent.
-  "integration_connected"
+  "integration_connected",
+  // ENG-8745. The offer RESULT receipt (not the offer card — that one is
+  // written for the human and is how they decided). Its content opens "Your
+  // offer was ACCEPTED", carries an `[offer_result]` machine tag, and closes by
+  // instructing the agent what not to do ("do not re-raise it yourself"). The
+  // human needs none of it: they are the person who tapped the button, and the
+  // card swapped under their finger to say so.
+  "offer_result"
 ];
 var AGENT_DIRECTED_KIND_SET = new Set(AGENT_DIRECTED_NOTICE_KINDS);
 
@@ -35367,6 +35374,29 @@ registerTriggerSource(videoRenderTriggerAdapter);
 
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
+  {
+    key: "impersonation-enabled",
+    description: "Kill switch for admin impersonation (ENG-9080), filed during the 18 Aug cross-tenant identity incident. ON (default) = impersonation works as today. OFF = both halves of the flow refuse: the mint route stops issuing redeem URLs, and \u2014 the half that actually matters \u2014 the REDEEM route refuses before it inserts the nonce or calls generateLink, so a URL that was already issued cannot still mint a session. Redeem tokens live REDEEM_TTL_SECONDS = 300, so gating only the mint route would leave five minutes in which new sessions keep appearing after an operator believes they have stopped it. Evaluated as a GLOBAL stage value, read UNCACHED on the redeem path (see readImpersonationEnabled): a kill switch that takes a cache TTL to bite is not a kill switch. Containment only \u2014 it does not fix the underlying defect that redeem writes the target's cookies into whatever browser context opens the URL (ENG-8923 / ENG-9020).",
+    flagType: "boolean",
+    // Declared safe value is `true` = impersonation available, i.e. today's
+    // behaviour, so merging this changes nothing until an operator flips it.
+    //
+    // NOTE the asymmetry with the other gates in this file, and it is
+    // deliberate: their safe direction is "off / don't do the new thing"
+    // because they gate NEW behaviour. This one gates EXISTING behaviour, so
+    // the no-op default is `true`. The READ direction is where the safety lives
+    // instead — an unreachable flag store resolves to DISABLED, not to this
+    // default. See readImpersonationEnabled for that argument.
+    defaultValue: true,
+    // Enforcement gate (ADR-0022 section 4): re-enabling impersonation is
+    // "relaxing a security control", exactly the mutation that must not happen
+    // on a single unguarded write. The emergency direction (turning it OFF)
+    // costs one confirmation, which is the right price.
+    sensitive: true
+    // Deliberately NOT public. A browser has no business evaluating whether
+    // impersonation is available; both consumers are server-side route
+    // handlers.
+  },
   {
     key: "at-rest-v2-writes",
     description: "ADR-0061 A2\u2192arm cutover (ENG-8944, parent ENG-8764). Gates whether the at-rest writer (encryptSecret/encryptAtRest) emits the v2 AAD-bound envelope when a DecryptContext is supplied; OFF (default) = the legacy v1 envelope (pre-ADR-0061 behaviour). Resolved FLEET-WIDE and process-global via setV2WritesArmed at the API + webapp + cron bootstrap seams, so ONLY the stage value applies \u2014 per-org overrides do not (the crypto writer carries no request/org context). Ships dark. Flip on only once every reader parses v2 (fleet-wide since release A1) AND the re-seal engine can re-seal v2 blobs before any AUTH_ENCRYPTION_KEY rotation (slice 5b). Reversible without redeploy: clearing it returns the writer to v1 within the flag cache TTL; already-written v2 blobs stay readable.",
@@ -39578,8 +39608,12 @@ function giveUpNoticeText(reason = null) {
   }
   return "\u26A0\uFE0F I couldn't read your last message \u2014 please resend it.";
 }
-function turnFailedNoticeText() {
-  return "\u26A0\uFE0F Something went wrong on my side and I couldn\u2019t finish that. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.";
+function turnFailedNoticeText(failureClass) {
+  const cause = failureClass === "overloaded" ? "the service I run on is overloaded right now \u2014 nothing to do with you or what you asked for" : failureClass === "server_error" ? "something upstream of me is failing right now \u2014 nothing to do with you or what you asked for" : null;
+  if (cause === null) {
+    return "\u26A0\uFE0F Something went wrong on my side and I couldn\u2019t finish that. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.";
+  }
+  return `\u26A0\uFE0F I couldn\u2019t finish that \u2014 ${cause}. Sorry \u2014 send it again when you get a chance and I\u2019ll pick it straight up.`;
 }
 function turnRetryingNoticeText() {
   return "\u23F3 Still working on this \u2014 things are running slower than usual on my side. I\u2019ll reply as soon as I have it.";
@@ -41993,7 +42027,7 @@ function armTelegramTurnFailureWatch(args) {
       const posted = await postTelegramTurnNotice({
         chatId: args.chatId,
         ...args.messageThreadId != null ? { messageThreadId: args.messageThreadId } : {},
-        text: turnFailedNoticeText()
+        text: turnFailedNoticeText(failure.failureClass)
       });
       if (!posted) {
         lastTurnFailedNoticeAt.delete(conversationKey);

package/dist/{persistent-session-JWBUD6RZ.js → persistent-session-U7PE7ZDB.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-DD6NRRYC.js";
-import "./chunk-2ASO4HVN.js";
+} from "./chunk-JRL7754L.js";
+import "./chunk-ZQXXK7JC.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-JWBUD6RZ.js.map
+//# sourceMappingURL=persistent-session-U7PE7ZDB.js.map

package/dist/{responsiveness-probe-GJEX44DE.js → responsiveness-probe-K6DGNTXA.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-DD6NRRYC.js";
-import "./chunk-2ASO4HVN.js";
+} from "./chunk-JRL7754L.js";
+import "./chunk-ZQXXK7JC.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -710,4 +710,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-GJEX44DE.js.map
+//# sourceMappingURL=responsiveness-probe-K6DGNTXA.js.map

package/dist/{session-auth-dead-LBRWZQPW.js → session-auth-dead-RPMWBVBH.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-2ASO4HVN.js";
+} from "./chunk-ZQXXK7JC.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-LBRWZQPW.js.map
+//# sourceMappingURL=session-auth-dead-RPMWBVBH.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.611",
+  "version": "0.28.613",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {