@integrity-labs/agt-cli 0.28.672 → 0.28.674

package/dist/mcp/direct-chat-channel.js

@@ -36468,14 +36468,13 @@ var FLAG_REGISTRY = [
     // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
     defaultValue: false,
     // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
-    // dist carries this host-side reader. That build is the one THIS PR's merge
-    // auto-publishes — unknown until then, and every already-published version
-    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
-    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
-    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
-    // while they still write tokens to disk). MUST be updated to the actual
-    // published version once the release lands (tracked on ENG-9350).
-    since: "99.0.0"
+    // dist carries this host-side reader. The ENG-9350 merge auto-published
+    // 0.28.672, and `npm pack @integrity-labs/agt-cli@0.28.672` confirms its
+    // bundled dist contains `spawn-inject-channel-secrets` (the reader) — every
+    // earlier 0.28.x lacks it. So hosts on ≥ 0.28.672 honor a flip; older ones
+    // no-op until they self-update. (Replaced the 99.0.0 fail-safe placeholder
+    // the flag shipped with before this build was known.)
+    since: "0.28.672"
   },
   {
     key: "scheduled-task-confirmation-card",

package/dist/mcp/index.js

@@ -43407,14 +43407,13 @@ var FLAG_REGISTRY = [
     // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
     defaultValue: false,
     // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
-    // dist carries this host-side reader. That build is the one THIS PR's merge
-    // auto-publishes — unknown until then, and every already-published version
-    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
-    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
-    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
-    // while they still write tokens to disk). MUST be updated to the actual
-    // published version once the release lands (tracked on ENG-9350).
-    since: "99.0.0"
+    // dist carries this host-side reader. The ENG-9350 merge auto-published
+    // 0.28.672, and `npm pack @integrity-labs/agt-cli@0.28.672` confirms its
+    // bundled dist contains `spawn-inject-channel-secrets` (the reader) — every
+    // earlier 0.28.x lacks it. So hosts on ≥ 0.28.672 honor a flip; older ones
+    // no-op until they self-update. (Replaced the 99.0.0 fail-safe placeholder
+    // the flag shipped with before this build was known.)
+    since: "0.28.672"
   },
   {
     key: "scheduled-task-confirmation-card",

package/dist/mcp/origami.js

@@ -42218,14 +42218,13 @@ var FLAG_REGISTRY = [
     // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
     defaultValue: false,
     // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
-    // dist carries this host-side reader. That build is the one THIS PR's merge
-    // auto-publishes — unknown until then, and every already-published version
-    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
-    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
-    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
-    // while they still write tokens to disk). MUST be updated to the actual
-    // published version once the release lands (tracked on ENG-9350).
-    since: "99.0.0"
+    // dist carries this host-side reader. The ENG-9350 merge auto-published
+    // 0.28.672, and `npm pack @integrity-labs/agt-cli@0.28.672` confirms its
+    // bundled dist contains `spawn-inject-channel-secrets` (the reader) — every
+    // earlier 0.28.x lacks it. So hosts on ≥ 0.28.672 honor a flip; older ones
+    // no-op until they self-update. (Replaced the 99.0.0 fail-safe placeholder
+    // the flag shipped with before this build was known.)
+    since: "0.28.672"
   },
   {
     key: "scheduled-task-confirmation-card",

package/dist/mcp/slack-channel.js

@@ -36701,14 +36701,13 @@ var FLAG_REGISTRY = [
     // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
     defaultValue: false,
     // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
-    // dist carries this host-side reader. That build is the one THIS PR's merge
-    // auto-publishes — unknown until then, and every already-published version
-    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
-    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
-    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
-    // while they still write tokens to disk). MUST be updated to the actual
-    // published version once the release lands (tracked on ENG-9350).
-    since: "99.0.0"
+    // dist carries this host-side reader. The ENG-9350 merge auto-published
+    // 0.28.672, and `npm pack @integrity-labs/agt-cli@0.28.672` confirms its
+    // bundled dist contains `spawn-inject-channel-secrets` (the reader) — every
+    // earlier 0.28.x lacks it. So hosts on ≥ 0.28.672 honor a flip; older ones
+    // no-op until they self-update. (Replaced the 99.0.0 fail-safe placeholder
+    // the flag shipped with before this build was known.)
+    since: "0.28.672"
   },
   {
     key: "scheduled-task-confirmation-card",
@@ -37871,7 +37870,13 @@ var SECRET_PATTERNS = [
   // AWS access key IDs
   { re: /(?:AKIA|ASIA)[0-9A-Z]{16}/g, label: "aws-key" },
   // GitHub tokens
-  { re: /gh[pousr]_[A-Za-z0-9]{20,}/g, label: "github-token" }
+  { re: /gh[pousr]_[A-Za-z0-9]{20,}/g, label: "github-token" },
+  // Telegram bot tokens: <8-10 digit bot id>:<35-char secret> (ENG-9353).
+  { re: /[0-9]{8,10}:[A-Za-z0-9_-]{35}/g, label: "telegram-bot-token" },
+  // Bearer authorization tokens (opaque or JWT); 16+ chars so ordinary
+  // "Bearer authentication" prose is left intact. `[ \t]+` (not `\s+`) so the
+  // match cannot span a newline and swallow the line break (ENG-9353).
+  { re: /[Bb]earer[ \t]+[A-Za-z0-9._-]{16,}/g, label: "bearer-token" }
 ];
 function redactPaneText(text) {
   let out = redactAugmentedPaths(text);

package/dist/mcp/telegram-channel.js

@@ -36845,14 +36845,13 @@ var FLAG_REGISTRY = [
     // (mirrors scheduled-task-nudge-durable). Turning it ON removes plaintext at rest.
     defaultValue: false,
     // ENG-7997 flip-reach estimate: `since` is the first agt-cli build whose
-    // dist carries this host-side reader. That build is the one THIS PR's merge
-    // auto-publishes — unknown until then, and every already-published version
-    // (0.28.x) demonstrably lacks the reader (CodeRabbit npm-pack check). An
-    // UNREACHABLE placeholder is the fail-safe: the reach estimate counts zero
-    // hosts as honoring the flip (rather than over-claiming that 0.28.x hosts do,
-    // while they still write tokens to disk). MUST be updated to the actual
-    // published version once the release lands (tracked on ENG-9350).
-    since: "99.0.0"
+    // dist carries this host-side reader. The ENG-9350 merge auto-published
+    // 0.28.672, and `npm pack @integrity-labs/agt-cli@0.28.672` confirms its
+    // bundled dist contains `spawn-inject-channel-secrets` (the reader) — every
+    // earlier 0.28.x lacks it. So hosts on ≥ 0.28.672 honor a flip; older ones
+    // no-op until they self-update. (Replaced the 99.0.0 fail-safe placeholder
+    // the flag shipped with before this build was known.)
+    since: "0.28.672"
   },
   {
     key: "scheduled-task-confirmation-card",
@@ -38238,7 +38237,13 @@ var SECRET_PATTERNS = [
   // AWS access key IDs
   { re: /(?:AKIA|ASIA)[0-9A-Z]{16}/g, label: "aws-key" },
   // GitHub tokens
-  { re: /gh[pousr]_[A-Za-z0-9]{20,}/g, label: "github-token" }
+  { re: /gh[pousr]_[A-Za-z0-9]{20,}/g, label: "github-token" },
+  // Telegram bot tokens: <8-10 digit bot id>:<35-char secret> (ENG-9353).
+  { re: /[0-9]{8,10}:[A-Za-z0-9_-]{35}/g, label: "telegram-bot-token" },
+  // Bearer authorization tokens (opaque or JWT); 16+ chars so ordinary
+  // "Bearer authentication" prose is left intact. `[ \t]+` (not `\s+`) so the
+  // match cannot span a newline and swallow the line break (ENG-9353).
+  { re: /[Bb]earer[ \t]+[A-Za-z0-9._-]{16,}/g, label: "bearer-token" }
 ];
 function redactPaneText(text) {
   let out = redactAugmentedPaths(text);

package/dist/{persistent-session-PYAJ4VJW.js → persistent-session-F7JEOWHQ.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-YAVWYI5S.js";
-import "./chunk-YOID6KOQ.js";
+} from "./chunk-7Y54PSMR.js";
+import "./chunk-AJNES24H.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-PYAJ4VJW.js.map
+//# sourceMappingURL=persistent-session-F7JEOWHQ.js.map

package/dist/{responsiveness-probe-5I2LIVCA.js → responsiveness-probe-7465YNMN.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-YAVWYI5S.js";
-import "./chunk-YOID6KOQ.js";
+} from "./chunk-7Y54PSMR.js";
+import "./chunk-AJNES24H.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -727,4 +727,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-5I2LIVCA.js.map
+//# sourceMappingURL=responsiveness-probe-7465YNMN.js.map

package/dist/{session-auth-dead-NUX643UJ.js → session-auth-dead-GBC5QPH3.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-YOID6KOQ.js";
+} from "./chunk-AJNES24H.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-NUX643UJ.js.map
+//# sourceMappingURL=session-auth-dead-GBC5QPH3.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.672",
+  "version": "0.28.674",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {