@integrity-labs/agt-cli 0.28.616 → 0.28.618

package/dist/mcp/direct-chat-channel.js

@@ -35000,6 +35000,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",

package/dist/mcp/index.js

@@ -22476,7 +22476,7 @@ server.tool(
   }
 );
 var kanbanMoveStatuses = AGT_KANBAN_WAITING_ENABLED ? ["backlog", "todo", "in_progress", "waiting", "done", "failed"] : ["backlog", "todo", "in_progress", "done", "failed"];
-var kanbanMoveDescription = AGT_KANBAN_WAITING_ENABLED ? `Move a kanban item to a different status column. Use status="failed" for a task attempted but not completable. Use status="waiting" when you have COMPLETED your part and cannot proceed until one specific external action happens (a person approves/answers/decides, or a dependency like a PR merge or deploy completes). status="waiting" REQUIRES waiting_kind - classify the wait as "pr-review", "pr-merged", "human", "external", or "other" (the catch-all when none fit). For a PR wait ("pr-review"/"pr-merged") set waiting_repo ("owner/repo") and waiting_pr (the number) INSTEAD of waiting_on - the card then links straight to the PR and can auto-resume when it lands. For "human"/"external"/"other" set waiting_on to a one-line ask ("Answer my 5 scoping questions") AND put the full context the person needs to decide - the actual questions, options, links - in waiting_details, so they can answer from the card without opening a ticket. For "human" ALSO set waiting_on_person to that person's Slack user id, so the card lands in their "Awaiting you" queue and they are notified instead of your ask sitting unseen. Do NOT use waiting to offload hard work, and do NOT confuse it with a failure. (matches the hosted kanban_move enum).` : 'Move a kanban item to a different status column. Use status="failed" to mark a task that was attempted but could not complete (matches the hosted kanban_move enum).';
+var kanbanMoveDescription = AGT_KANBAN_WAITING_ENABLED ? `Move a kanban item to a different status column. Use status="failed" for a task attempted but not completable. Use status="waiting" when you have COMPLETED your part and cannot proceed until one specific external action happens (a person approves/answers/decides, or a dependency like a PR merge or deploy completes). status="waiting" REQUIRES waiting_kind - classify the wait as "pr-review", "pr-merged", "human", "external", or "other" (the catch-all when none fit). For a PR wait ("pr-review"/"pr-merged") set waiting_repo ("owner/repo") and waiting_pr (the number) INSTEAD of waiting_on - the card then links straight to the PR and can auto-resume when it lands. For "human"/"external"/"other" set waiting_on to a one-line ask ("Answer my 5 scoping questions") AND put the full context the person needs to decide - the actual questions, options, links - in waiting_details, so they can answer from the card without opening a ticket. For "human" ALSO set waiting_on_person to that person's person_id (uuid, from directory_lookup \u2014 preferred) or their Slack user id, so the card lands in their "Awaiting you" queue and they are notified instead of your ask sitting unseen. Do NOT use waiting to offload hard work, and do NOT confuse it with a failure. (matches the hosted kanban_move enum).` : 'Move a kanban item to a different status column. Use status="failed" to mark a task that was attempted but could not complete (matches the hosted kanban_move enum).';
 var kanbanMoveStatusDescribe = AGT_KANBAN_WAITING_ENABLED ? 'Target status. "waiting" parks the card until one external action happens; it REQUIRES waiting_kind - use "pr-review"/"pr-merged" with waiting_repo + waiting_pr, or "human"/"external"/"other" with a concrete waiting_on. "failed" closes the row as a failed attempt; there is no "cancelled" status, close no-longer-needed work via kanban_done with an explanatory result.' : 'Target status. "failed" closes the row as a failed attempt; there is no "cancelled" status, close no-longer-needed work via kanban_done with an explanatory result.';
 server.tool(
   "kanban_move",
@@ -22504,7 +22504,7 @@ server.tool(
         'Optional, best with waiting_kind="human": 2-5 short answer options to offer the person as one-click buttons (e.g. ["Ship it", "Hold", "Needs changes"]). Keep them short. They can still add a free-text comment alongside a choice. Omit for an open-ended human wait (they just get a comment box).'
       ),
       waiting_on_person: external_exports.string().optional().describe(
-        `The Slack user id of the ONE person who has to act before you can continue (e.g. "U0123ABCD" - the same id you would pass to deliver_to). This puts the card in that person's "Awaiting you" queue and notifies them, so your ask does not sit unseen. It does NOT reassign the card - you still own driving it to done and you resume as soon as they answer. Valid on "human", "approval", "pr-review" and "pr-merged" waits (ENG-8291: a PR waiting on a review or a merge tap IS waiting on a person, and naming them is the whole point). NOT valid on "external" or "other", which are parked on a system or unclassified - there is nobody to notify. Set it whenever you know who has to act; omit only if genuinely nobody specific does.`
+        `Who has to act before you can continue - the ONE person. Two accepted forms: a person_id (uuid) as emitted by directory_lookup, which is PREFERRED because it is the id the directory actually gives you and it resolves for people with no linked Slack account; or a Slack user id (e.g. "U0123ABCD" - the same id you would pass to deliver_to). This puts the card in that person's "Awaiting you" queue and notifies them, so your ask does not sit unseen. It does NOT reassign the card - you still own driving it to done and you resume as soon as they answer. Valid on "human", "approval", "pr-review" and "pr-merged" waits (ENG-8291: a PR waiting on a review or a merge tap IS waiting on a person, and naming them is the whole point). Note "approval" is absent from the waiting_kind enum above deliberately and that is NOT an inconsistency: the approval broker sets that kind server-side, so you never pass it - but a card the server already parked that way still accepts this field, and rejecting the pair the server itself produces was the ENG-8291 bug. NOT valid on "external" or "other", which are parked on a system or unclassified - there is nobody to notify. Set it whenever you know who has to act; omit only if genuinely nobody specific does.`
       )
     } : {}
   },

package/dist/mcp/origami.js

@@ -40864,6 +40864,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",

package/dist/mcp/slack-channel.js

@@ -35332,6 +35332,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",

package/dist/mcp/telegram-channel.js

@@ -35491,6 +35491,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",

package/dist/{persistent-session-GM3EH2ZU.js → persistent-session-AGPLISL3.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-6SJJM4FT.js";
-import "./chunk-TYVQNCBU.js";
+} from "./chunk-RXC3MTSN.js";
+import "./chunk-P6KFZVKA.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-GM3EH2ZU.js.map
+//# sourceMappingURL=persistent-session-AGPLISL3.js.map

package/dist/{responsiveness-probe-VSSJC3MN.js → responsiveness-probe-ITYPPSHM.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-6SJJM4FT.js";
-import "./chunk-TYVQNCBU.js";
+} from "./chunk-RXC3MTSN.js";
+import "./chunk-P6KFZVKA.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -710,4 +710,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-VSSJC3MN.js.map
+//# sourceMappingURL=responsiveness-probe-ITYPPSHM.js.map

package/dist/{session-auth-dead-KOKVXPPQ.js → session-auth-dead-Y6ABNWNM.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-TYVQNCBU.js";
+} from "./chunk-P6KFZVKA.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-KOKVXPPQ.js.map
+//# sourceMappingURL=session-auth-dead-Y6ABNWNM.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.616",
+  "version": "0.28.618",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {