@integrity-labs/agt-cli 0.28.666 → 0.28.668

package/dist/bin/agt.js

@@ -40,10 +40,10 @@ import {
   success,
   table,
   warn
-} from "../chunk-P7UIFZQO.js";
+} from "../chunk-EQK5Q7ZL.js";
 import {
   readDirectChatSessionState
-} from "../chunk-EX5XJEGF.js";
+} from "../chunk-52V5BMBC.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -73,7 +73,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-FYZOD3SS.js";
+} from "../chunk-4GA4K2BF.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.666" : "dev";
+var cliVersion = true ? "0.28.668" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.666" : "dev";
+var cliVersion2 = true ? "0.28.668" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-FYZOD3SS.js → chunk-4GA4K2BF.js}

@@ -4950,6 +4950,62 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "memory-file-tombstones",
+    description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",
+    flagType: "boolean",
+    // Declared safe value is `false` (remove nothing). Fail-safe direction: a
+    // flag-DB read error must never start deleting files on customer-owned
+    // hosts on its own. Note the asymmetry with a read-only gate — the blast
+    // radius here is data on a machine we frequently cannot re-enter, which is
+    // also why the first release MOVES files rather than unlinking them.
+    defaultValue: false,
+    // ADR-0022 §4: mutating this requires an explicit caller confirmation.
+    //
+    // Arming it DELETES FILES on customer-owned hosts. The registry already
+    // marks `id-keyed-layout-migration` sensitive on the narrower basis that it
+    // moves data, and `admin-send-keys` because it writes to a customer host;
+    // this is the stronger case of both at once. Without it the flip is a single
+    // unguarded write, which is the wrong ceremony for an irreversible action on
+    // a machine we frequently cannot re-enter — the same fact the defaultValue
+    // comment above already leans on.
+    sensitive: true,
+    // ADR-0022 operator override, read by the host flag store's env layer.
+    //
+    // ROLLOUT WARNING: an env override needs a manager RESTART to set or clear,
+    // and masks the central flag while set (ENG-7409). So a per-host canary
+    // pinned via env becomes a host the central kill switch cannot reach during
+    // an incident. Canary centrally (per-agent overrides are delivered on the
+    // heartbeat for every boolean flag) rather than with this.
+    //
+    // Note `sensitive` does NOT gate this env var — it guards the control-plane
+    // write path, not a host's local environment file. One more reason not to
+    // canary with it.
+    envVar: "AGT_MEMORY_TOMBSTONES_ENABLED",
+    // Deliberately unreachable placeholder: the reader is not published yet.
+    //
+    // It must be PARSEABLE and unreachable, not omitted and not garbage.
+    // classifyHostReach (packages/core/src/feature-flags/reach.ts) maps an
+    // empty `since` to `honors` for EVERY host including ones with no reader at
+    // all, and maps an unparseable one to `unknown` — which collides with the
+    // "host reports no agt_version" class, so an operator cannot tell "not
+    // shipped yet" from "these hosts are unreadable". '99.99.99' classifies
+    // every host `stale`, which is the honest pre-publication answer.
+    //
+    // Note '0.29.0' is used elsewhere for the same purpose but is weaker: it is
+    // unreachable only by accident of auto-publish patch-bumping 0.28.x, so one
+    // deliberate minor bump would silently reclassify the whole fleet `honors`.
+    //
+    // REPLACE IT AT THE **CLI** MERGE, not the API merge — `since` describes
+    // what the HOST can act on — with the published tarball's version (verify
+    // via `npm pack`; apps/cli/package.json is not the published number). And
+    // it must name the first build where flipping the flag does what this flag
+    // SAYS, not merely the first build with a reader: that means the manifest
+    // gate, the tombstone pass sitting above the download short-circuit, and
+    // the response hash covering the tombstone list. Ship a build missing any
+    // of those and reach reports `honors` for hosts that silently never act.
+    since: "99.99.99"
+  },
   {
     key: "conversation-eval-backend",
     description: "Backend for host-side conversation-success scoring AND memory extraction (ENG-6581), which share one scorer: anthropic-api = Haiku via a direct Anthropic Messages API fetch (no subprocess); claude-p = Haiku via the `claude -p` subprocess (reuses the agent auth, effectively free under Max but a heavy spawn); local = an OpenAI-compatible loopback endpoint (transcript never leaves the host). Auth for the anthropic-api path comes from AGT_CONV_EVAL_ANTHROPIC_API_KEY (falls back to ANTHROPIC_API_KEY); with no key that path fails closed (eval disabled) rather than reverting to claude-p. Enum.",
@@ -12365,4 +12421,4 @@ export {
   minutesSinceLocalMidnight,
   peekCurrentSession
 };
-//# sourceMappingURL=chunk-FYZOD3SS.js.map
+//# sourceMappingURL=chunk-4GA4K2BF.js.map