@integrity-labs/agt-cli 0.28.617 → 0.28.619

package/dist/mcp/direct-chat-channel.js

@@ -35000,6 +35000,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",

package/dist/mcp/origami.js

@@ -40864,6 +40864,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",

package/dist/mcp/slack-channel.js

@@ -30250,14 +30250,23 @@ var ALLOWED_MESSAGE_SUBTYPES = /* @__PURE__ */ new Set([
   "file_share",
   "thread_broadcast"
 ]);
-function decideSlackMessageForward(evt) {
+function matchesThirdPartyGrant(evt, thirdPartyBots) {
+  const botId = evt.bot_id;
+  if (!botId || !thirdPartyBots?.length)
+    return false;
+  return thirdPartyBots.some((b) => b.bot_id === botId || b.bot_user_id === botId);
+}
+function decideSlackMessageForward(evt, thirdPartyBots) {
   if (evt.type !== "message") {
     return { forward: true };
   }
+  const granted = matchesThirdPartyGrant(evt, thirdPartyBots);
   if (!ALLOWED_MESSAGE_SUBTYPES.has(evt.subtype)) {
-    return { forward: false, reason: "subtype" };
+    if (!granted || evt.subtype !== "bot_message") {
+      return { forward: false, reason: "subtype" };
+    }
   }
-  if (!evt.user) {
+  if (!evt.user && !granted) {
     return { forward: false, reason: "no_user" };
   }
   const hasText = typeof evt.text === "string" && evt.text.trim().length > 0;
@@ -35332,6 +35341,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",
@@ -40559,7 +40603,13 @@ function classifyPeerMessage(msg, cfg, self) {
   }
   const peer = cfg.peers.find((p2) => p2.bot_user_id === msg.user);
   if (!peer) {
-    const thirdParty = cfg.third_party_bots?.find((b) => b.bot_user_id === msg.user);
+    const thirdParty = cfg.third_party_bots?.find((b) => {
+      if (msg.user && b.bot_user_id === msg.user)
+        return true;
+      if (!msg.bot_id)
+        return false;
+      return b.bot_id === msg.bot_id || b.bot_user_id === msg.bot_id;
+    });
     if (thirdParty) {
       if (cfg.peer_disabled_mode === "cross_team_only") {
         return { kind: "drop", reason: "peer_disabled_cross_team" };
@@ -40699,7 +40749,13 @@ function parseThirdPartyBotsEnv(raw) {
       continue;
     const channels = rec["channel_ids"].filter((c) => typeof c === "string" && c.trim() !== "").map((c) => c.trim());
     const label = typeof rec["label"] === "string" && rec["label"].trim() ? rec["label"].trim() : void 0;
-    out.push({ bot_user_id: botUserId2, channel_ids: channels, ...label ? { label } : {} });
+    const botId = typeof rec["bot_id"] === "string" && rec["bot_id"].trim() ? rec["bot_id"].trim() : void 0;
+    out.push({
+      bot_user_id: botUserId2,
+      channel_ids: channels,
+      ...botId ? { bot_id: botId } : {},
+      ...label ? { label } : {}
+    });
   }
   return out;
 }
@@ -46209,7 +46265,10 @@ async function connectSocketMode() {
         return;
       }
       const isBot = Boolean(evt.bot_id);
-      const filterDecision = decideSlackMessageForward(evt);
+      const filterDecision = decideSlackMessageForward(
+        evt,
+        SLACK_PEER_CLASSIFIER_CONFIG.third_party_bots
+      );
       const senderPolicyDecision = decideSenderPolicyForward(evt, SLACK_SENDER_POLICY);
       const policyBlockReason = senderPolicyDecision.forward ? void 0 : classifySlackPolicyBlock(evt, SLACK_SENDER_POLICY);
       const peerClassification = isBot ? classifyPeerMessage(

package/dist/mcp/telegram-channel.js

@@ -35491,6 +35491,41 @@ var FLAG_REGISTRY = [
     // it MOVES data, so mutations require explicit confirmation (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "per-agent-host-credentials",
+    description: "Per-agent host credentials on DEDICATED hosts (ENG-8992, extending ADR-0042 pt3b). When ON, the manager mints a per-agent org-scoped `tlk_` key at spawn and injects it as that container's AGT_API_KEY, instead of forwarding the one HOST-WIDE key into every agent. Today every container on a dedicated host holds the same credential, so an agent can exchange a claim-less token and read a SIBLING agent's decrypted integration credentials via POST /host/agent-integrations. The request-time guard that stops this (verifyHostAgentAccess reading the token's agent_id claim, ENG-7449) is ALREADY live in production - it no-ops only because no container ever carries a scoped key, so this flag gives the existing gate something to check rather than adding a new one. POOL hosts are NOT governed by this flag: per-agent scope is mandatory there (ENG-7489) and stays unconditional. Read by the MANAGER at spawn (hostFlagStore), so a central flip applies to subsequent spawns - already-running agents keep their current credential until they respawn, which is what makes the rollout staged rather than a fleet-wide cutover. Ships dark (default off). AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED is the per-host escape hatch and kill switch; precedence is env override > flag value > this default.",
+    flagType: "boolean",
+    // Declared safe value is `false` = keep forwarding the shared host key. A
+    // flag-read error must not change which credential a container is spawned
+    // with; the fail-safe direction here is "no behaviour change", and a mint
+    // FAILURE (once armed) separately fails the spawn CLOSED rather than
+    // falling back to the shared key.
+    defaultValue: false,
+    envVar: "AGT_PER_AGENT_HOST_CREDENTIALS_ENABLED",
+    // Disabling this RESTORES the shared host-wide key to every container, and
+    // with it the cross-agent credential read ENG-8992 closes. A credential-scope
+    // reduction should not be one click away without confirmation — same posture
+    // as `github-broker-credentials`, the other credential-delivery flag.
+    sensitive: true,
+    // The reader is host-side (`hostFlagStore().getBoolean(...)` in the manager),
+    // so a host on an older agt-cli has no consumer code: it keeps forwarding the
+    // shared key no matter what the flag says. Without `since`, the flip-reach
+    // modal would report every recently-seen host as honoring the flip — the
+    // dangerous direction, because it reads as "armed" when it is not.
+    //
+    // PLACEHOLDER, deliberately above every published version (npm latest was
+    // 0.28.612 when this landed). The reader ships in whatever the auto-publish
+    // patch-bump produces AFTER this merges, which is not knowable here. Per the
+    // same reasoning recorded on the `agt-bin` flag: `since` is ADVISORY, read
+    // only by `computeFlagReach`; it changes what an operator is TOLD, it does
+    // not gate a flip. So an over-high placeholder is safe (reach under-reports,
+    // nobody flips), and a GUESSED number is not.
+    //
+    // BEFORE FLIPPING THIS ANYWHERE: replace with the exact first published
+    // agt-cli version whose `spawnSession` carries the `-e AGT_API_KEY=` push.
+    // The rollout runbook gates on it.
+    since: "0.29.0"
+  },
   {
     key: "agent-hours-billing-enabled",
     description: "Agent-hours (utilisation) billing (ENG-7910). Per-org gate; ships dark. When on for an org, its closed billing periods are settled into org_agent_hours_settlements from the plan/override agent-hours terms, and the customer billing surface shows used-vs-included hours + projected overage. Off = no settlement written, no charge, surface hidden. Launch prices are seeded in plan_billing_terms; flip on per-org for a controlled rollout.",

package/dist/{persistent-session-GM3EH2ZU.js → persistent-session-AGPLISL3.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-6SJJM4FT.js";
-import "./chunk-TYVQNCBU.js";
+} from "./chunk-RXC3MTSN.js";
+import "./chunk-P6KFZVKA.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-GM3EH2ZU.js.map
+//# sourceMappingURL=persistent-session-AGPLISL3.js.map

package/dist/{responsiveness-probe-VSSJC3MN.js → responsiveness-probe-ITYPPSHM.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-6SJJM4FT.js";
-import "./chunk-TYVQNCBU.js";
+} from "./chunk-RXC3MTSN.js";
+import "./chunk-P6KFZVKA.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -710,4 +710,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-VSSJC3MN.js.map
+//# sourceMappingURL=responsiveness-probe-ITYPPSHM.js.map

package/dist/{session-auth-dead-KOKVXPPQ.js → session-auth-dead-Y6ABNWNM.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-TYVQNCBU.js";
+} from "./chunk-P6KFZVKA.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-KOKVXPPQ.js.map
+//# sourceMappingURL=session-auth-dead-Y6ABNWNM.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.617",
+  "version": "0.28.619",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {