@integrity-labs/agt-cli 0.28.617 → 0.28.619

package/dist/bin/agt.js

@@ -40,10 +40,10 @@ import {
   success,
   table,
   warn
-} from "../chunk-NJHZL7CZ.js";
+} from "../chunk-WY7QPFBK.js";
 import {
   readDirectChatSessionState
-} from "../chunk-6SJJM4FT.js";
+} from "../chunk-RXC3MTSN.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -73,7 +73,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-TYVQNCBU.js";
+} from "../chunk-P6KFZVKA.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.617" : "dev";
+var cliVersion = true ? "0.28.619" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.617" : "dev";
+var cliVersion2 = true ? "0.28.619" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-TYVQNCBU.js → chunk-P6KFZVKA.js}

@@ -4200,6 +4200,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",
@@ -12007,4 +12042,4 @@ export {
   minutesSinceLocalMidnight,
   peekCurrentSession
 };
-//# sourceMappingURL=chunk-TYVQNCBU.js.map
+//# sourceMappingURL=chunk-P6KFZVKA.js.map