@integrity-labs/agt-cli 0.28.677 → 0.28.678

package/dist/mcp/direct-chat-channel.js

@@ -35895,6 +35895,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/index.js

@@ -42822,6 +42822,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/origami.js

@@ -41633,6 +41633,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/slack-channel.js

@@ -36116,6 +36116,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/telegram-channel.js

@@ -36260,6 +36260,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/{persistent-session-TMOTEVV6.js → persistent-session-EZEYH3PM.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-F6CUSDJ6.js";
-import "./chunk-GYYEUNTD.js";
+} from "./chunk-LTOGVWUR.js";
+import "./chunk-5DHJE2G7.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-TMOTEVV6.js.map
+//# sourceMappingURL=persistent-session-EZEYH3PM.js.map

package/dist/{responsiveness-probe-ZHE7S6G4.js → responsiveness-probe-VS6GODYP.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-F6CUSDJ6.js";
-import "./chunk-GYYEUNTD.js";
+} from "./chunk-LTOGVWUR.js";
+import "./chunk-5DHJE2G7.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -727,4 +727,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-ZHE7S6G4.js.map
+//# sourceMappingURL=responsiveness-probe-VS6GODYP.js.map

package/dist/{session-auth-dead-JCKENEY5.js → session-auth-dead-7U24PZZS.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-GYYEUNTD.js";
+} from "./chunk-5DHJE2G7.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-JCKENEY5.js.map
+//# sourceMappingURL=session-auth-dead-7U24PZZS.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.677",
+  "version": "0.28.678",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {