@integrity-labs/agt-cli 0.28.616 → 0.28.618

package/dist/{chunk-TYVQNCBU.js → chunk-P6KFZVKA.js}

@@ -4200,6 +4200,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",
@@ -12007,4 +12042,4 @@ export {
   minutesSinceLocalMidnight,
   peekCurrentSession
 };
-//# sourceMappingURL=chunk-TYVQNCBU.js.map
+//# sourceMappingURL=chunk-P6KFZVKA.js.map