@integrity-labs/agt-cli 0.28.676 → 0.28.678

package/dist/mcp/augmented-admin.js

@@ -21326,6 +21326,18 @@ var AdminDebugClient = class _AdminDebugClient {
       run_id: this.runId
     });
   }
+  /** Request a HITL-gated end to a circuit-breaker pause (ENG-9343). */
+  requestResumeAgent(args) {
+    if (!this.agentId) {
+      throw makeError(400, "AdminDebugClient.requestResumeAgent requires agentId (set AGT_AGENT_ID)");
+    }
+    return this.post("/admin/debug/actions/resume", {
+      target_agent_id: args.target_agent_id,
+      reason: args.reason,
+      agent_id: this.agentId,
+      run_id: this.runId
+    });
+  }
   /** Poll a remedial action's HITL decision. */
   getActionStatus(requestId) {
     return this.get(`/admin/debug/actions/${encodeURIComponent(requestId)}`);
@@ -21457,6 +21469,12 @@ var clearRestartRequestSchema = strictObject({
   target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent whose stuck restart request to clear (from the inspect result)."),
   reason: external_exports.string().min(1).max(2e3).describe("Why this stuck restart request should be cleared \u2014 shown verbatim to the human approver. Be specific.")
 });
+var resumeAgentSchema = strictObject({
+  target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent whose CIRCUIT-BREAKER pause to end (from debug_search_agents status=paused)."),
+  reason: external_exports.string().min(1).max(2e3).describe(
+    'Why this agent should come back now, and what you know about the condition that tripped the breaker - shown verbatim to the human approver alongside the trip reason and count. Be specific: the approver is deciding "resume DESPITE this driver", not "resume".'
+  )
+});
 var listAlertsSchema = strictObject({
   severity: external_exports.string().max(16).optional().describe("Filter by severity (critical | warning | info)."),
   open: external_exports.boolean().optional().describe("When true, only currently-open (unclosed) alerts."),
@@ -21869,7 +21887,7 @@ server.registerTool(
 );
 server.registerTool(
   "debug_restart_agent",
-  { description: `Request a HITL-gated RESTART of a customer agent \u2014 bounce its session so the manager respawns it on the next poll (reversible; the inbound backlog replays). Use this to recover a wedged agent or to make it pick up a newly-bound integration/config change. A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Org-agnostic: keyed on the agent's host assignment, so it works cross-org without an active-org dependency. This is the same path as request_action({ action: "restart" }), exposed as a dedicated tool for discoverability. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { target_agent_id, reason }.`, inputSchema: restartAgentSchema },
+  { description: `Request a HITL-gated RESTART of a customer agent \u2014 bounce its session so the manager respawns it on the next poll (reversible; the inbound backlog replays). Use this to recover a wedged agent or to make it pick up a newly-bound integration/config change. NOT for a PAUSED agent: a paused agent's manager does not respawn it, so a restart against one does nothing at all - use \`debug_resume_agent\`, which is the only tool that ends a pause (ENG-9343). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Org-agnostic: keyed on the agent's host assignment, so it works cross-org without an active-org dependency. This is the same path as request_action({ action: "restart" }), exposed as a dedicated tool for discoverability. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { target_agent_id, reason }.`, inputSchema: restartAgentSchema },
   async (args) => {
     try {
       const result = await client.requestAction("restart", {
@@ -21882,6 +21900,21 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "debug_resume_agent",
+  { description: 'Request a HITL-gated END to a customer agent\'s CIRCUIT-BREAKER pause - flip it back to active so its manager respawns it, close the agent_paused alert, and clear any pending restart request. This is the ONLY tool that ends a pause; debug_restart_agent does NOT, because a paused agent\'s manager never respawns it, so a restart against a paused agent is a no-op. SCOPE: it touches ONLY pauses whose reason is `circuit_breaker`. A "manual" pause (a person clicked Pause) and an "hourly_cost_exceeded" pause (a budget guard) are refused with a 409 - do not retry those, escalate to a human. BEFORE YOU CALL IT: the approval card names the breaker\'s trip reason and count and flags when that condition still appears to hold (e.g. other agents on the same host tripping on the same driver), so write a `reason` that addresses the driver, not just the downtime - the approver is deciding "resume DESPITE day-rollover=3", not "resume". Resuming while the driver is still live just re-trips the breaker and the agent flaps instead of failing cleanly. A HUMAN must approve in Slack, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). Returns { request_id, status, write_mode, trip_driver, trip_count, precondition_verdict, precondition_signals, notification_status }; after approval, poll check_action_status (result_payload carries { resumed, alert_closed, cleared_restart_bindings } or { resumed: false, not_eligible }). Pass { target_agent_id, reason }.', inputSchema: resumeAgentSchema },
+  async (args) => {
+    try {
+      const result = await client.requestResumeAgent({
+        target_agent_id: args.target_agent_id,
+        reason: args.reason
+      });
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.registerTool(
   "request_config_update",
   { description: "Request a HITL-gated change to a customer agent's model config (primary/secondary/tertiary_model). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). The change is reversible and applies at the agent's NEXT session launch after /host/refresh \u2014 it does not restart the agent. The new value is validated against the agent before approval is requested: Claude Code (subscription) agents take a family alias (fable/opus/opus[fast]/sonnet/haiku); routed agents take a full stored model id (e.g. openrouter/anthropic/claude-opus-4-6). Use this to fix a misconfigured model (e.g. an agent wedged on a model its auth can't access). Returns { request_id, status, write_mode, notification_status }. Pass { target_agent_id, field, new_value, reason }.", inputSchema: requestConfigUpdateSchema },

package/dist/mcp/direct-chat-channel.js

@@ -34277,6 +34277,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -35892,6 +35895,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",
@@ -36563,6 +36589,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/mcp/index.js

@@ -41597,6 +41597,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -42819,6 +42822,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",
@@ -43490,6 +43516,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/mcp/origami.js

@@ -40429,6 +40429,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -41630,6 +41633,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",
@@ -42301,6 +42327,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/mcp/slack-channel.js

@@ -34495,6 +34495,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -36113,6 +36116,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",
@@ -36784,6 +36810,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/mcp/telegram-channel.js

@@ -34639,6 +34639,9 @@ var DIRECTIVE_KINDS = [
 ];
 var DIRECTIVE_SET = new Set(DIRECTIVE_KINDS);
 
+// ../core/dist/admin-debug/resume-precondition.js
+var DEFAULT_RESUME_LOOKBACK_MS = 14 * 24 * 60 * 60 * 1e3;
+
 // ../core/dist/admin-debug/index.js
 var STUCK_RESTART_THRESHOLD_SECONDS = 15 * 60;
 
@@ -36257,6 +36260,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",
@@ -36928,6 +36954,28 @@ var FLAG_REGISTRY = [
     // exactly the org whose brand should be shown.
     public: true
   },
+  {
+    key: "ninjafy-logo",
+    description: "Which Ninjafy logo TREATMENT the console chrome renders (ENG-9365). This is a SUB-SELECTION under ninjafy-brand, not a second brand gate: it is consulted only once ninjafy-brand has already resolved ON, so with the brand off the value is inert and the half-branded state that flag's description calls unreachable stays unreachable. ninjafy-brand remains the single kill switch for the rebrand. It exists so candidate logo treatments can be put in front of a human and compared in the running console, rather than judged from a static export. lockup = mark and wordmark together, both in the brand blue \u2014 exactly what ENG-9298 shipped, so an unset flag is a no-op. two-tone = the mark in brand blue with the wordmark in the neutral text colour (the treatment of the blue-icon/black-wordmark artwork). wordmark = the word alone, no mark. Every treatment is composed from the ENG-9298 geometry \u2014 ENG-9312 pins that the lockup's blue path IS the mark subpath followed by the wordmark subpaths, byte for byte \u2014 so a new treatment is a composition, never a fresh trace, and the three drawings cannot drift apart. Surfaces are the dashboard sidebar and the top nav. The top nav shows the WORDMARK portion at every width whatever the treatment, because ENG-9342 decided that deliberately (a full lockup at the header's icon height crowds the team switcher on a phone) \u2014 so a treatment changes the word's colour there, never whether a mark appears. The admin sidebar (ENG-9323) is NOT wired to this key and always renders the mark; widening it is a separate decision. Resolved SERVER-SIDE in (dashboard)/layout.tsx via getPublicEnumFlagServer, beside ninjafy-brand and in the same single GET /flags round trip, then passed down as a required prop. That is not a style preference: the client hook starts at its default and updates after an async fetch, so a client read would paint one logo and swap it after hydration \u2014 the exact flash ENG-9227 removed from the wordmark and ENG-8858 removed from the palette. Org and team are the useful pilot grains, as for ninjafy-brand: the single consumer evaluates in the active-org cookie scope, so a host- or agent-scoped override row is accepted by the table but never reached by the console.",
+    flagType: "enum",
+    allowedValues: ["lockup", "two-tone", "wordmark"],
+    // Declared safe value is `lockup` — what ENG-9298 shipped. This flag has no
+    // "off" direction: it selects among presentations that are all live-safe, so
+    // fail-safe here means "the treatment currently in production", not the
+    // narrowest one. A flag-DB read error, an archived row, or a stored value
+    // outside allowedValues all resolve here (evaluate.ts normalizeFlagValue),
+    // which is what makes an experimental value impossible to strand.
+    defaultValue: "lockup",
+    // Same trap as ninjafy-brand, and it bites harder here because there are no
+    // client readers of this key AT ALL — it is server-resolved by construction.
+    // `public` does NOT mean "read by a browser"; it means "readable through the
+    // public map". getPublicEnumFlagServer resolves against the same GET /flags
+    // endpoint the browser uses, and that route filters to listPublicFlagKeys()
+    // (routes/flags.ts). Drop `public` and the key is simply absent from the map,
+    // so the helper falls through to its default and returns `lockup` FOREVER —
+    // the dropdown appearing to do nothing, with no error raised anywhere.
+    public: true
+  },
   {
     key: "agent-recruit",
     description: "The `recruit_agent` MCP tool (ENG-8159): lets an ordinary managed agent PROPOSE a new teammate in its own org. The proposal is filed under the `agent.recruit` approval verb and routed to an org owner as a server-rendered card, so this gates the ASK \u2014 nothing is created until a human taps Approve. Deliberately distinct from augmented-support-writes, which gates the concierge's own create_agent surface: the two requesters are separately controllable because an org may well want its support concierge to propose agents without giving every agent in the fleet the same power. Ships dark.",

package/dist/{persistent-session-F7JEOWHQ.js → persistent-session-EZEYH3PM.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-7Y54PSMR.js";
-import "./chunk-AJNES24H.js";
+} from "./chunk-LTOGVWUR.js";
+import "./chunk-5DHJE2G7.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-F7JEOWHQ.js.map
+//# sourceMappingURL=persistent-session-EZEYH3PM.js.map

package/dist/{responsiveness-probe-7465YNMN.js → responsiveness-probe-VS6GODYP.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-7Y54PSMR.js";
-import "./chunk-AJNES24H.js";
+} from "./chunk-LTOGVWUR.js";
+import "./chunk-5DHJE2G7.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -727,4 +727,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-7465YNMN.js.map
+//# sourceMappingURL=responsiveness-probe-VS6GODYP.js.map

package/dist/{session-auth-dead-GBC5QPH3.js → session-auth-dead-7U24PZZS.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-AJNES24H.js";
+} from "./chunk-5DHJE2G7.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-GBC5QPH3.js.map
+//# sourceMappingURL=session-auth-dead-7U24PZZS.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.676",
+  "version": "0.28.678",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {