@integrity-labs/agt-cli 0.28.671 → 0.28.672

package/dist/mcp/direct-chat-channel.js

@@ -36456,6 +36456,27 @@ var FLAG_REGISTRY = [
     // consumed by the manager's own logic, not an in-container MCP, so no env materialization.
     defaultValue: false
   },
+  {
+    key: "spawn-inject-channel-secrets",
+    description: "ENG-9350 (host key-management hardening, epic ENG-9347): deliver a managed agent's channel bot tokens (SLACK_BOT_TOKEN, SLACK_APP_TOKEN, TELEGRAM_BOT_TOKEN, MSTEAMS_CLIENT_SECRET) into the Claude Code spawn env via `tmux new-session -e KEY=VALUE` (the same posture as ANTHROPIC_API_KEY / AGT_API_KEY) instead of writing them as plaintext to the on-disk `.env.integrations` file. ON = the manager injects the four channel secrets at spawn and evicts them from `.env.integrations`; the `.mcp.json` `${VAR}` templates are unchanged and now resolve from the spawn env, so the value never touches persistent EBS (and, under Docker isolation, is name-only forwarded into the container the same way AGT_API_KEY is). OFF (default) = today's behaviour, byte-for-byte: the tokens are written to `.env.integrations` (0600) and the wrapper sources them. Resolved host-side by the manager via hostFlagStore().getBooleanForAgent \u2014 the manager owns the spawn path, so no in-container MCP reads this; it materializes the VALUES, not the flag. A channel- token rotation already forces a session respawn (ENG-6062), so the injected value is bound at the same moment the file value used to be \u2014 the two paths are behaviourally equivalent, this one just keeps the plaintext off disk. Ships dark; flip per-agent/ host to soak before fleet convergence, flip OFF to fall back to the file path instantly without a code rollback. Integration credentials + the OAuth remote-MCP live-read proxy deliberately stay on the file (later slices / a permanent bounded carve-out, ADR-0062 Part 5).",
+    flagType: "boolean",
+    // Declared safe value is `false`: the current on-disk `.env.integrations` delivery,
+    // byte-for-byte. `false` is also the fail-safe direction — a flag-store read error must
+    // never silently move a fleet onto the spawn-env path (a bug there = a channel with no
+    // token = a silently dead channel). Net-new gate consumed by the manager's own spawn
+    // logic, not an in-container MCP, so registry-only with NO envVar materialization
+    // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
+    defaultValue: false,
+    // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
+    // dist carries this host-side reader. That build is the one THIS PR's merge
+    // auto-publishes — unknown until then, and every already-published version
+    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
+    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
+    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
+    // while they still write tokens to disk). MUST be updated to the actual
+    // published version once the release lands (tracked on ENG-9350).
+    since: "99.0.0"
+  },
   {
     key: "scheduled-task-confirmation-card",
     description: `Post the \u{1F44D}/\u{1F44E} "Task complete?" kanban confirmation card for completed scheduled_task runs (ENG-4576 / ENG-6048). OFF (default) kills these cards fleet-wide: ENG-8072 found they mis-thread onto the run's captured slack_delivery, which in the persistent-session model is frequently a conversational reply rather than the task's own output - so a routine cron's confirmation card lands in an unrelated human thread (e.g. a half-hourly reconciliation card posted into a "you're back online" DM), and a clean cron emits a human \u{1F44D}/\u{1F44E} prompt on every tick regardless. The card was net-negative, so it is disabled by default. Turn it ON per org to restore scheduled-task ratings for a customer who wants them (e.g. a daily digest delivered to a channel). Evaluated per-org in the API (POST /host/runs/finish + the manager rating-prompt route) via getEvaluatedFlags(); the decision is passed into postScheduledTaskKanbanConfirmation. API-only gate - no host env materialization. Ships dark (cards off).`,

package/dist/mcp/index.js

@@ -43395,6 +43395,27 @@ var FLAG_REGISTRY = [
     // consumed by the manager's own logic, not an in-container MCP, so no env materialization.
     defaultValue: false
   },
+  {
+    key: "spawn-inject-channel-secrets",
+    description: "ENG-9350 (host key-management hardening, epic ENG-9347): deliver a managed agent's channel bot tokens (SLACK_BOT_TOKEN, SLACK_APP_TOKEN, TELEGRAM_BOT_TOKEN, MSTEAMS_CLIENT_SECRET) into the Claude Code spawn env via `tmux new-session -e KEY=VALUE` (the same posture as ANTHROPIC_API_KEY / AGT_API_KEY) instead of writing them as plaintext to the on-disk `.env.integrations` file. ON = the manager injects the four channel secrets at spawn and evicts them from `.env.integrations`; the `.mcp.json` `${VAR}` templates are unchanged and now resolve from the spawn env, so the value never touches persistent EBS (and, under Docker isolation, is name-only forwarded into the container the same way AGT_API_KEY is). OFF (default) = today's behaviour, byte-for-byte: the tokens are written to `.env.integrations` (0600) and the wrapper sources them. Resolved host-side by the manager via hostFlagStore().getBooleanForAgent \u2014 the manager owns the spawn path, so no in-container MCP reads this; it materializes the VALUES, not the flag. A channel- token rotation already forces a session respawn (ENG-6062), so the injected value is bound at the same moment the file value used to be \u2014 the two paths are behaviourally equivalent, this one just keeps the plaintext off disk. Ships dark; flip per-agent/ host to soak before fleet convergence, flip OFF to fall back to the file path instantly without a code rollback. Integration credentials + the OAuth remote-MCP live-read proxy deliberately stay on the file (later slices / a permanent bounded carve-out, ADR-0062 Part 5).",
+    flagType: "boolean",
+    // Declared safe value is `false`: the current on-disk `.env.integrations` delivery,
+    // byte-for-byte. `false` is also the fail-safe direction — a flag-store read error must
+    // never silently move a fleet onto the spawn-env path (a bug there = a channel with no
+    // token = a silently dead channel). Net-new gate consumed by the manager's own spawn
+    // logic, not an in-container MCP, so registry-only with NO envVar materialization
+    // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
+    defaultValue: false,
+    // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
+    // dist carries this host-side reader. That build is the one THIS PR's merge
+    // auto-publishes — unknown until then, and every already-published version
+    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
+    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
+    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
+    // while they still write tokens to disk). MUST be updated to the actual
+    // published version once the release lands (tracked on ENG-9350).
+    since: "99.0.0"
+  },
   {
     key: "scheduled-task-confirmation-card",
     description: `Post the \u{1F44D}/\u{1F44E} "Task complete?" kanban confirmation card for completed scheduled_task runs (ENG-4576 / ENG-6048). OFF (default) kills these cards fleet-wide: ENG-8072 found they mis-thread onto the run's captured slack_delivery, which in the persistent-session model is frequently a conversational reply rather than the task's own output - so a routine cron's confirmation card lands in an unrelated human thread (e.g. a half-hourly reconciliation card posted into a "you're back online" DM), and a clean cron emits a human \u{1F44D}/\u{1F44E} prompt on every tick regardless. The card was net-negative, so it is disabled by default. Turn it ON per org to restore scheduled-task ratings for a customer who wants them (e.g. a daily digest delivered to a channel). Evaluated per-org in the API (POST /host/runs/finish + the manager rating-prompt route) via getEvaluatedFlags(); the decision is passed into postScheduledTaskKanbanConfirmation. API-only gate - no host env materialization. Ships dark (cards off).`,

package/dist/mcp/origami.js

@@ -42206,6 +42206,27 @@ var FLAG_REGISTRY = [
     // consumed by the manager's own logic, not an in-container MCP, so no env materialization.
     defaultValue: false
   },
+  {
+    key: "spawn-inject-channel-secrets",
+    description: "ENG-9350 (host key-management hardening, epic ENG-9347): deliver a managed agent's channel bot tokens (SLACK_BOT_TOKEN, SLACK_APP_TOKEN, TELEGRAM_BOT_TOKEN, MSTEAMS_CLIENT_SECRET) into the Claude Code spawn env via `tmux new-session -e KEY=VALUE` (the same posture as ANTHROPIC_API_KEY / AGT_API_KEY) instead of writing them as plaintext to the on-disk `.env.integrations` file. ON = the manager injects the four channel secrets at spawn and evicts them from `.env.integrations`; the `.mcp.json` `${VAR}` templates are unchanged and now resolve from the spawn env, so the value never touches persistent EBS (and, under Docker isolation, is name-only forwarded into the container the same way AGT_API_KEY is). OFF (default) = today's behaviour, byte-for-byte: the tokens are written to `.env.integrations` (0600) and the wrapper sources them. Resolved host-side by the manager via hostFlagStore().getBooleanForAgent \u2014 the manager owns the spawn path, so no in-container MCP reads this; it materializes the VALUES, not the flag. A channel- token rotation already forces a session respawn (ENG-6062), so the injected value is bound at the same moment the file value used to be \u2014 the two paths are behaviourally equivalent, this one just keeps the plaintext off disk. Ships dark; flip per-agent/ host to soak before fleet convergence, flip OFF to fall back to the file path instantly without a code rollback. Integration credentials + the OAuth remote-MCP live-read proxy deliberately stay on the file (later slices / a permanent bounded carve-out, ADR-0062 Part 5).",
+    flagType: "boolean",
+    // Declared safe value is `false`: the current on-disk `.env.integrations` delivery,
+    // byte-for-byte. `false` is also the fail-safe direction — a flag-store read error must
+    // never silently move a fleet onto the spawn-env path (a bug there = a channel with no
+    // token = a silently dead channel). Net-new gate consumed by the manager's own spawn
+    // logic, not an in-container MCP, so registry-only with NO envVar materialization
+    // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
+    defaultValue: false,
+    // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
+    // dist carries this host-side reader. That build is the one THIS PR's merge
+    // auto-publishes — unknown until then, and every already-published version
+    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
+    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
+    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
+    // while they still write tokens to disk). MUST be updated to the actual
+    // published version once the release lands (tracked on ENG-9350).
+    since: "99.0.0"
+  },
   {
     key: "scheduled-task-confirmation-card",
     description: `Post the \u{1F44D}/\u{1F44E} "Task complete?" kanban confirmation card for completed scheduled_task runs (ENG-4576 / ENG-6048). OFF (default) kills these cards fleet-wide: ENG-8072 found they mis-thread onto the run's captured slack_delivery, which in the persistent-session model is frequently a conversational reply rather than the task's own output - so a routine cron's confirmation card lands in an unrelated human thread (e.g. a half-hourly reconciliation card posted into a "you're back online" DM), and a clean cron emits a human \u{1F44D}/\u{1F44E} prompt on every tick regardless. The card was net-negative, so it is disabled by default. Turn it ON per org to restore scheduled-task ratings for a customer who wants them (e.g. a daily digest delivered to a channel). Evaluated per-org in the API (POST /host/runs/finish + the manager rating-prompt route) via getEvaluatedFlags(); the decision is passed into postScheduledTaskKanbanConfirmation. API-only gate - no host env materialization. Ships dark (cards off).`,

package/dist/mcp/slack-channel.js

@@ -36689,6 +36689,27 @@ var FLAG_REGISTRY = [
     // consumed by the manager's own logic, not an in-container MCP, so no env materialization.
     defaultValue: false
   },
+  {
+    key: "spawn-inject-channel-secrets",
+    description: "ENG-9350 (host key-management hardening, epic ENG-9347): deliver a managed agent's channel bot tokens (SLACK_BOT_TOKEN, SLACK_APP_TOKEN, TELEGRAM_BOT_TOKEN, MSTEAMS_CLIENT_SECRET) into the Claude Code spawn env via `tmux new-session -e KEY=VALUE` (the same posture as ANTHROPIC_API_KEY / AGT_API_KEY) instead of writing them as plaintext to the on-disk `.env.integrations` file. ON = the manager injects the four channel secrets at spawn and evicts them from `.env.integrations`; the `.mcp.json` `${VAR}` templates are unchanged and now resolve from the spawn env, so the value never touches persistent EBS (and, under Docker isolation, is name-only forwarded into the container the same way AGT_API_KEY is). OFF (default) = today's behaviour, byte-for-byte: the tokens are written to `.env.integrations` (0600) and the wrapper sources them. Resolved host-side by the manager via hostFlagStore().getBooleanForAgent \u2014 the manager owns the spawn path, so no in-container MCP reads this; it materializes the VALUES, not the flag. A channel- token rotation already forces a session respawn (ENG-6062), so the injected value is bound at the same moment the file value used to be \u2014 the two paths are behaviourally equivalent, this one just keeps the plaintext off disk. Ships dark; flip per-agent/ host to soak before fleet convergence, flip OFF to fall back to the file path instantly without a code rollback. Integration credentials + the OAuth remote-MCP live-read proxy deliberately stay on the file (later slices / a permanent bounded carve-out, ADR-0062 Part 5).",
+    flagType: "boolean",
+    // Declared safe value is `false`: the current on-disk `.env.integrations` delivery,
+    // byte-for-byte. `false` is also the fail-safe direction — a flag-store read error must
+    // never silently move a fleet onto the spawn-env path (a bug there = a channel with no
+    // token = a silently dead channel). Net-new gate consumed by the manager's own spawn
+    // logic, not an in-container MCP, so registry-only with NO envVar materialization
+    // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
+    defaultValue: false,
+    // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
+    // dist carries this host-side reader. That build is the one THIS PR's merge
+    // auto-publishes — unknown until then, and every already-published version
+    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
+    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
+    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
+    // while they still write tokens to disk). MUST be updated to the actual
+    // published version once the release lands (tracked on ENG-9350).
+    since: "99.0.0"
+  },
   {
     key: "scheduled-task-confirmation-card",
     description: `Post the \u{1F44D}/\u{1F44E} "Task complete?" kanban confirmation card for completed scheduled_task runs (ENG-4576 / ENG-6048). OFF (default) kills these cards fleet-wide: ENG-8072 found they mis-thread onto the run's captured slack_delivery, which in the persistent-session model is frequently a conversational reply rather than the task's own output - so a routine cron's confirmation card lands in an unrelated human thread (e.g. a half-hourly reconciliation card posted into a "you're back online" DM), and a clean cron emits a human \u{1F44D}/\u{1F44E} prompt on every tick regardless. The card was net-negative, so it is disabled by default. Turn it ON per org to restore scheduled-task ratings for a customer who wants them (e.g. a daily digest delivered to a channel). Evaluated per-org in the API (POST /host/runs/finish + the manager rating-prompt route) via getEvaluatedFlags(); the decision is passed into postScheduledTaskKanbanConfirmation. API-only gate - no host env materialization. Ships dark (cards off).`,

package/dist/mcp/telegram-channel.js

@@ -36833,6 +36833,27 @@ var FLAG_REGISTRY = [
     // consumed by the manager's own logic, not an in-container MCP, so no env materialization.
     defaultValue: false
   },
+  {
+    key: "spawn-inject-channel-secrets",
+    description: "ENG-9350 (host key-management hardening, epic ENG-9347): deliver a managed agent's channel bot tokens (SLACK_BOT_TOKEN, SLACK_APP_TOKEN, TELEGRAM_BOT_TOKEN, MSTEAMS_CLIENT_SECRET) into the Claude Code spawn env via `tmux new-session -e KEY=VALUE` (the same posture as ANTHROPIC_API_KEY / AGT_API_KEY) instead of writing them as plaintext to the on-disk `.env.integrations` file. ON = the manager injects the four channel secrets at spawn and evicts them from `.env.integrations`; the `.mcp.json` `${VAR}` templates are unchanged and now resolve from the spawn env, so the value never touches persistent EBS (and, under Docker isolation, is name-only forwarded into the container the same way AGT_API_KEY is). OFF (default) = today's behaviour, byte-for-byte: the tokens are written to `.env.integrations` (0600) and the wrapper sources them. Resolved host-side by the manager via hostFlagStore().getBooleanForAgent \u2014 the manager owns the spawn path, so no in-container MCP reads this; it materializes the VALUES, not the flag. A channel- token rotation already forces a session respawn (ENG-6062), so the injected value is bound at the same moment the file value used to be \u2014 the two paths are behaviourally equivalent, this one just keeps the plaintext off disk. Ships dark; flip per-agent/ host to soak before fleet convergence, flip OFF to fall back to the file path instantly without a code rollback. Integration credentials + the OAuth remote-MCP live-read proxy deliberately stay on the file (later slices / a permanent bounded carve-out, ADR-0062 Part 5).",
+    flagType: "boolean",
+    // Declared safe value is `false`: the current on-disk `.env.integrations` delivery,
+    // byte-for-byte. `false` is also the fail-safe direction — a flag-store read error must
+    // never silently move a fleet onto the spawn-env path (a bug there = a channel with no
+    // token = a silently dead channel). Net-new gate consumed by the manager's own spawn
+    // logic, not an in-container MCP, so registry-only with NO envVar materialization
+    // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
+    defaultValue: false,
+    // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
+    // dist carries this host-side reader. That build is the one THIS PR's merge
+    // auto-publishes — unknown until then, and every already-published version
+    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
+    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
+    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
+    // while they still write tokens to disk). MUST be updated to the actual
+    // published version once the release lands (tracked on ENG-9350).
+    since: "99.0.0"
+  },
   {
     key: "scheduled-task-confirmation-card",
     description: `Post the \u{1F44D}/\u{1F44E} "Task complete?" kanban confirmation card for completed scheduled_task runs (ENG-4576 / ENG-6048). OFF (default) kills these cards fleet-wide: ENG-8072 found they mis-thread onto the run's captured slack_delivery, which in the persistent-session model is frequently a conversational reply rather than the task's own output - so a routine cron's confirmation card lands in an unrelated human thread (e.g. a half-hourly reconciliation card posted into a "you're back online" DM), and a clean cron emits a human \u{1F44D}/\u{1F44E} prompt on every tick regardless. The card was net-negative, so it is disabled by default. Turn it ON per org to restore scheduled-task ratings for a customer who wants them (e.g. a daily digest delivered to a channel). Evaluated per-org in the API (POST /host/runs/finish + the manager rating-prompt route) via getEvaluatedFlags(); the decision is passed into postScheduledTaskKanbanConfirmation. API-only gate - no host env materialization. Ships dark (cards off).`,

package/dist/{persistent-session-LTFB4M53.js → persistent-session-PYAJ4VJW.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-57XP5OG6.js";
-import "./chunk-DWFN5PMF.js";
+} from "./chunk-YAVWYI5S.js";
+import "./chunk-YOID6KOQ.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-LTFB4M53.js.map
+//# sourceMappingURL=persistent-session-PYAJ4VJW.js.map

package/dist/{responsiveness-probe-P2S3UMRE.js → responsiveness-probe-5I2LIVCA.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-57XP5OG6.js";
-import "./chunk-DWFN5PMF.js";
+} from "./chunk-YAVWYI5S.js";
+import "./chunk-YOID6KOQ.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -727,4 +727,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-P2S3UMRE.js.map
+//# sourceMappingURL=responsiveness-probe-5I2LIVCA.js.map

package/dist/{session-auth-dead-YHSQBOB4.js → session-auth-dead-NUX643UJ.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-DWFN5PMF.js";
+} from "./chunk-YOID6KOQ.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-YHSQBOB4.js.map
+//# sourceMappingURL=session-auth-dead-NUX643UJ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.671",
+  "version": "0.28.672",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {