@integrity-labs/agt-cli 0.28.675 → 0.28.677

package/dist/mcp/augmented-admin.js

@@ -21326,6 +21326,18 @@ var AdminDebugClient = class _AdminDebugClient {
       run_id: this.runId
     });
   }
+  /** Request a HITL-gated end to a circuit-breaker pause (ENG-9343). */
+  requestResumeAgent(args) {
+    if (!this.agentId) {
+      throw makeError(400, "AdminDebugClient.requestResumeAgent requires agentId (set AGT_AGENT_ID)");
+    }
+    return this.post("/admin/debug/actions/resume", {
+      target_agent_id: args.target_agent_id,
+      reason: args.reason,
+      agent_id: this.agentId,
+      run_id: this.runId
+    });
+  }
   /** Poll a remedial action's HITL decision. */
   getActionStatus(requestId) {
     return this.get(`/admin/debug/actions/${encodeURIComponent(requestId)}`);
@@ -21457,6 +21469,12 @@ var clearRestartRequestSchema = strictObject({
   target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent whose stuck restart request to clear (from the inspect result)."),
   reason: external_exports.string().min(1).max(2e3).describe("Why this stuck restart request should be cleared \u2014 shown verbatim to the human approver. Be specific.")
 });
+var resumeAgentSchema = strictObject({
+  target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent whose CIRCUIT-BREAKER pause to end (from debug_search_agents status=paused)."),
+  reason: external_exports.string().min(1).max(2e3).describe(
+    'Why this agent should come back now, and what you know about the condition that tripped the breaker - shown verbatim to the human approver alongside the trip reason and count. Be specific: the approver is deciding "resume DESPITE this driver", not "resume".'
+  )
+});
 var listAlertsSchema = strictObject({
   severity: external_exports.string().max(16).optional().describe("Filter by severity (critical | warning | info)."),
   open: external_exports.boolean().optional().describe("When true, only currently-open (unclosed) alerts."),
@@ -21869,7 +21887,7 @@ server.registerTool(
 );
 server.registerTool(
   "debug_restart_agent",
-  { description: `Request a HITL-gated RESTART of a customer agent \u2014 bounce its session so the manager respawns it on the next poll (reversible; the inbound backlog replays). Use this to recover a wedged agent or to make it pick up a newly-bound integration/config change. A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Org-agnostic: keyed on the agent's host assignment, so it works cross-org without an active-org dependency. This is the same path as request_action({ action: "restart" }), exposed as a dedicated tool for discoverability. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { target_agent_id, reason }.`, inputSchema: restartAgentSchema },
+  { description: `Request a HITL-gated RESTART of a customer agent \u2014 bounce its session so the manager respawns it on the next poll (reversible; the inbound backlog replays). Use this to recover a wedged agent or to make it pick up a newly-bound integration/config change. NOT for a PAUSED agent: a paused agent's manager does not respawn it, so a restart against one does nothing at all - use \`debug_resume_agent\`, which is the only tool that ends a pause (ENG-9343). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Org-agnostic: keyed on the agent's host assignment, so it works cross-org without an active-org dependency. This is the same path as request_action({ action: "restart" }), exposed as a dedicated tool for discoverability. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { target_agent_id, reason }.`, inputSchema: restartAgentSchema },
   async (args) => {
     try {
       const result = await client.requestAction("restart", {
@@ -21882,6 +21900,21 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "debug_resume_agent",
+  { description: 'Request a HITL-gated END to a customer agent\'s CIRCUIT-BREAKER pause - flip it back to active so its manager respawns it, close the agent_paused alert, and clear any pending restart request. This is the ONLY tool that ends a pause; debug_restart_agent does NOT, because a paused agent\'s manager never respawns it, so a restart against a paused agent is a no-op. SCOPE: it touches ONLY pauses whose reason is `circuit_breaker`. A "manual" pause (a person clicked Pause) and an "hourly_cost_exceeded" pause (a budget guard) are refused with a 409 - do not retry those, escalate to a human. BEFORE YOU CALL IT: the approval card names the breaker\'s trip reason and count and flags when that condition still appears to hold (e.g. other agents on the same host tripping on the same driver), so write a `reason` that addresses the driver, not just the downtime - the approver is deciding "resume DESPITE day-rollover=3", not "resume". Resuming while the driver is still live just re-trips the breaker and the agent flaps instead of failing cleanly. A HUMAN must approve in Slack, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). Returns { request_id, status, write_mode, trip_driver, trip_count, precondition_verdict, precondition_signals, notification_status }; after approval, poll check_action_status (result_payload carries { resumed, alert_closed, cleared_restart_bindings } or { resumed: false, not_eligible }). Pass { target_agent_id, reason }.', inputSchema: resumeAgentSchema },
+  async (args) => {
+    try {
+      const result = await client.requestResumeAgent({
+        target_agent_id: args.target_agent_id,
+        reason: args.reason
+      });
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.registerTool(
   "request_config_update",
   { description: "Request a HITL-gated change to a customer agent's model config (primary/secondary/tertiary_model). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). The change is reversible and applies at the agent's NEXT session launch after /host/refresh \u2014 it does not restart the agent. The new value is validated against the agent before approval is requested: Claude Code (subscription) agents take a family alias (fable/opus/opus[fast]/sonnet/haiku); routed agents take a full stored model id (e.g. openrouter/anthropic/claude-opus-4-6). Use this to fix a misconfigured model (e.g. an agent wedged on a model its auth can't access). Returns { request_id, status, write_mode, notification_status }. Pass { target_agent_id, field, new_value, reason }.", inputSchema: requestConfigUpdateSchema },

package/dist/mcp/direct-chat-channel.js

@@ -34277,6 +34277,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -36563,6 +36566,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/mcp/index.js

@@ -41597,6 +41597,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -43490,6 +43493,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/mcp/origami.js

@@ -40429,6 +40429,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -42301,6 +42304,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/mcp/slack-channel.js

@@ -34495,6 +34495,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -36784,6 +36787,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/mcp/telegram-channel.js

@@ -34639,6 +34639,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -36928,6 +36931,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/{persistent-session-F7JEOWHQ.js → persistent-session-TMOTEVV6.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-7Y54PSMR.js";
-import "./chunk-AJNES24H.js";
+} from "./chunk-F6CUSDJ6.js";
+import "./chunk-GYYEUNTD.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-F7JEOWHQ.js.map
+//# sourceMappingURL=persistent-session-TMOTEVV6.js.map

package/dist/{responsiveness-probe-7465YNMN.js → responsiveness-probe-ZHE7S6G4.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-7Y54PSMR.js";
-import "./chunk-AJNES24H.js";
+} from "./chunk-F6CUSDJ6.js";
+import "./chunk-GYYEUNTD.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -727,4 +727,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-7465YNMN.js.map
+//# sourceMappingURL=responsiveness-probe-ZHE7S6G4.js.map

package/dist/{session-auth-dead-GBC5QPH3.js → session-auth-dead-JCKENEY5.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-AJNES24H.js";
+} from "./chunk-GYYEUNTD.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-GBC5QPH3.js.map
+//# sourceMappingURL=session-auth-dead-JCKENEY5.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.675",
+  "version": "0.28.677",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {