@integrity-labs/agt-cli 0.28.677 → 0.28.679

package/dist/mcp/direct-chat-channel.js

@@ -35895,6 +35895,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/index.js

@@ -37038,6 +37038,30 @@ var BLOCKED_ON_ME_SECTION_NOTE = "_Another agent has PARKED its own work until y
 var HUMAN_ASSIGNED_SECTION_HEADING = "Assigned to a person (not yours to action)";
 var HUMAN_ASSIGNED_SECTION_NOTE = "_These belong to a person, not to you. You cannot move, note or complete them \u2014 every kanban write is refused. If the work is finished (or was never really theirs), use `kanban_recall` to pull the card back onto your board, then close it as normal._";
 
+// src/kanban-peek-render.ts
+var PEEK_RENDER_COLUMNS = [
+  ["in_progress", "in progress"],
+  ["todo", "todo"],
+  ["backlog", "backlog"],
+  ["waiting", "waiting"],
+  ["needs_attention", "needs attention"]
+];
+function formatPeekAge(ageHours) {
+  if (!Number.isFinite(ageHours) || ageHours <= 0) return "<1h";
+  if (ageHours < 48) return `${Math.floor(ageHours)}h`;
+  return `${Math.floor(ageHours / 24)}d`;
+}
+function renderKanbanPeek(data, fallbackTeam) {
+  const parts = PEEK_RENDER_COLUMNS.map(([key, label]) => {
+    const count = data[key];
+    const oldest = data.oldest?.[key];
+    const age = oldest === void 0 ? "" : ` (oldest ${formatPeekAge(oldest.age_hours)}, id ${oldest.card_id})`;
+    return `${label}: ${count}${age}`;
+  });
+  const where = data.cross_team ? ` on team ${data.target_team ?? fallbackTeam ?? "?"}` : "";
+  return `${data.target_agent}${where} \u2014 ${parts.join(" \xB7 ")}`;
+}
+
 // src/kanban-person-waiting-kind.ts
 function isPersonWaitingKindMcp(kind) {
   if (kind === void 0 || kind === null || kind === "") return true;
@@ -42822,6 +42846,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",
@@ -44547,6 +44594,64 @@ server.tool(
     }
   }
 );
+server.tool(
+  "kanban_peek",
+  "Look at ANOTHER agent's board WITHOUT seeing what is on it: how many cards sit in each column, and how long the oldest card in each column has been sitting there. Use it before routing work with kanban_assign, to tell an agent that is genuinely free from one that is buried, and to spot a board where something has been rotting for days. You get NUMBERS ONLY \u2014 no titles, descriptions, results or notes ever cross between agents, so this tells you the SHAPE of their queue, never its content. A deep board is not automatically a problem and an empty one is not automatically fine: the age of the oldest card is usually the more useful of the two. By default the target must be an agent on your OWN team; pass `target_team` to peek across teams in your organization, which works only where your org has enabled cross-team assignment and a peer grant links the teams \u2014 otherwise it reads as not-found, exactly like kanban_assign. Don't know the agent's code_name? Call directory_lookup first.",
+  {
+    target_agent: external_exports.string().describe(
+      "The agent whose board you want to size up: their agent code_name (kebab-case) or agent UUID. On your own team unless target_team is also set."
+    ),
+    target_team: external_exports.string().trim().min(1).optional().describe(
+      "Optional: the slug (or UUID) of ANOTHER team in your organization, to peek across teams. Omit for a teammate on your own team. Requires the org to have cross-team assignment enabled and a peer grant; otherwise the target reads as not-found."
+    )
+  },
+  async (params) => {
+    try {
+      const data = await apiPost(
+        "/host/kanban/peek",
+        {
+          agent_id: AGT_AGENT_ID,
+          target_agent: params.target_agent,
+          // Only sent when peeking across teams — the route branches on its
+          // presence, so omit it for the same-team path (identical contract to
+          // kanban_assign). The schema rejects empty strings, so a present value
+          // is always meaningful; check presence, not truthiness.
+          ...params.target_team !== void 0 ? { target_team: params.target_team } : {}
+        },
+        false,
+        15e3,
+        "kanban_peek",
+        // Genuinely read-only: a timeout or transport error here can never have
+        // committed anything, and saying so keeps the retry decision obvious.
+        true
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            // Rendering lives in a sibling module so it is reachable by a test —
+            // importing this file boots the stdio server, so anything inline
+            // here is checked exactly once, on the day it is written.
+            text: renderKanbanPeek(data, params.target_team)
+          }
+        ]
+      };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const notFound = /returned 404/.test(msg);
+      const notFoundText = params.target_team ? `Could not peek: no agent "${params.target_agent}" reachable on team "${params.target_team}". Check the team slug and agent code_name, and note cross-team access only works when your org has enabled it and a peer grant links the teams.` : `Could not peek: no agent "${params.target_agent}" found on your team. Check the code_name and make sure they're a teammate on the same team.`;
+      return {
+        content: [
+          {
+            type: "text",
+            text: notFound ? notFoundText : `Could not peek at ${params.target_agent}: ${msg}`
+          }
+        ],
+        isError: true
+      };
+    }
+  }
+);
 server.tool(
   "kanban_reassign",
   "Move an EXISTING kanban card to ANOTHER agent\u2019s board, preserving its id, history, comments, priority and status. Use this to re-home a task you already have (e.g. you picked up a card but it\u2019s really another specialist\u2019s job) - it removes the card from the current board and places the same card on the target agent\u2019s board. This is different from kanban_assign, which CREATES a new card. The card must currently live on your team. To move across teams in your organization, also pass `target_team` (same cross-team rules as kanban_assign). Don\u2019t know the agent code_name or team slug? Call directory_lookup first.",
@@ -46334,6 +46439,8 @@ var LOCAL_TOOL_NAMES = /* @__PURE__ */ new Set([
   "kanban_recall",
   // ENG-9050: the return path for delegated work.
   "kanban_reopen",
+  // ENG-9375: the READ path over a teammate's board (counts only).
+  "kanban_peek",
   // ENG-6953: agent + people directory lookup (always registered locally).
   "directory_lookup",
   "status_standup",

package/dist/mcp/origami.js

@@ -41633,6 +41633,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/slack-channel.js

@@ -36116,6 +36116,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/telegram-channel.js

@@ -36260,6 +36260,29 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
+  {
+    key: "secret-files-tmpfs",
+    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
+    flagType: "boolean",
+    // Declared safe value is `false` (persistent files, today's behaviour).
+    // Fail-safe direction: a flag-DB read error must never, on its own, start
+    // relocating where prod secret files physically live. Flip on per-host for a
+    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
+    // from the admin Feature Flags page.
+    defaultValue: false,
+    // ADR-0022 operator override, read by the host flag store's env layer (not a
+    // hand-written process.env gate) — same posture as memory-extraction /
+    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
+    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
+    // Deliberately-unreachable placeholder until this ships: no published CLI
+    // carries the manager reader + core writer yet, so reach must report "no
+    // host honors" rather than the `honors`-for-everyone that omitting `since`
+    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
+    // merge (auto-publish patch-bumps from main; verify against the tarball, the
+    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
+    // package/dist/lib/manager-worker.js.
+    since: "99.0.0"
+  },
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/{persistent-session-TMOTEVV6.js → persistent-session-GQZQWMJU.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-F6CUSDJ6.js";
-import "./chunk-GYYEUNTD.js";
+} from "./chunk-HLJKOJVJ.js";
+import "./chunk-GDT7JHV6.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-TMOTEVV6.js.map
+//# sourceMappingURL=persistent-session-GQZQWMJU.js.map

package/dist/{responsiveness-probe-ZHE7S6G4.js → responsiveness-probe-QKKOHDHF.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-F6CUSDJ6.js";
-import "./chunk-GYYEUNTD.js";
+} from "./chunk-HLJKOJVJ.js";
+import "./chunk-GDT7JHV6.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -727,4 +727,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-ZHE7S6G4.js.map
+//# sourceMappingURL=responsiveness-probe-QKKOHDHF.js.map

package/dist/{session-auth-dead-JCKENEY5.js → session-auth-dead-CUEBDRZU.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-GYYEUNTD.js";
+} from "./chunk-GDT7JHV6.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-JCKENEY5.js.map
+//# sourceMappingURL=session-auth-dead-CUEBDRZU.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.677",
+  "version": "0.28.679",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {