@integrity-labs/agt-cli 0.28.679 → 0.28.681

package/dist/{chunk-HLJKOJVJ.js → chunk-ZKNKHAHX.js}

@@ -17,7 +17,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-GDT7JHV6.js";
+} from "./chunk-OOFJUWMT.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -4531,4 +4531,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-HLJKOJVJ.js.map
+//# sourceMappingURL=chunk-ZKNKHAHX.js.map

package/dist/{claude-pair-runtime-5UDCBIB7.js → claude-pair-runtime-HPCXQDVY.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-GQZQWMJU.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-OQ7MFVEH.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-5UDCBIB7.js.map
+//# sourceMappingURL=claude-pair-runtime-HPCXQDVY.js.map

package/dist/lib/manager-worker.js

@@ -55,7 +55,7 @@ import {
   setConfigHash,
   setSecretFileTmpfsBacking,
   tripClass
-} from "../chunk-CLNFPTVG.js";
+} from "../chunk-Q44TIWZN.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -113,7 +113,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-HLJKOJVJ.js";
+} from "../chunk-ZKNKHAHX.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -194,7 +194,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-GDT7JHV6.js";
+} from "../chunk-OOFJUWMT.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -11712,7 +11712,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-QKKOHDHF.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-MDL53OT2.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname10(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -12360,7 +12360,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.679" : "dev";
+var agtCliVersion = true ? "0.28.681" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13821,7 +13821,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-GQZQWMJU.js");
+      const { collectDiagnostics } = await import("../persistent-session-OQ7MFVEH.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -13938,7 +13938,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-GQZQWMJU.js");
+      const { collectDiagnostics } = await import("../persistent-session-OQ7MFVEH.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor) : void 0;
       let tailscaleHostname;
@@ -14090,7 +14090,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-QKKOHDHF.js");
+      } = await import("../responsiveness-probe-MDL53OT2.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -14200,7 +14200,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-QKKOHDHF.js");
+        } = await import("../responsiveness-probe-MDL53OT2.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14356,7 +14356,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-CUEBDRZU.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-4OJ2XLH4.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -18117,7 +18117,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-GQZQWMJU.js");
+        const { collectDiagnostics } = await import("../persistent-session-OQ7MFVEH.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -18168,7 +18168,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-GQZQWMJU.js");
+      const { collectDiagnostics } = await import("../persistent-session-OQ7MFVEH.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -18800,7 +18800,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-5UDCBIB7.js");
+  } = await import("../claude-pair-runtime-HPCXQDVY.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -32291,6 +32291,15 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // long note on the window-capture click handler for why this is a mode and
   // not just always-on.
   var editMode = false;
+  // ENG-9383: the ONE gate every edit-entry path asks. It exists because the
+  // last time a path was added, the old ones did not come with it: ENG-8477
+  // introduced editMode for the deep-probe handlers and left the ENG-6821
+  // direct click/hover on an arming-only check, so text stayed editable with
+  // the toggle off and the button gated one of two paths. A funnel is the fix
+  // for that class of bug; adding the term twice is only the fix for this
+  // instance of it. A fifth handler cannot forget the mode.
+  function canEdit(){ return editEnabled && editMode && !editing; }
+  var hoverCued = []; // ENG-9383: elements currently wearing the mouseover cue
 
   // Element-child indices from <body> down to el. Counts ELEMENT children only
   // (children, not childNodes), matching how the server walks source_html; our
@@ -32484,14 +32493,48 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // Hover affordance (only when armed and not mid-edit). Highlight leaves AND
   // inline-only containers (their bare text is per-node editable, ENG-6856).
   document.addEventListener('mouseover', function(e){
-    if(!editEnabled||editing) return; var el=e.target;
-    if(editable(el)||inlineOnlyEditable(el)){ el.style.cursor='text'; el.style.outline=el.style.outline||'1px dashed rgba(110,231,183,.6)'; el.__alHover=1; }
+    if(!canEdit()) return; var el=e.target;
+    if(editable(el)||inlineOnlyEditable(el)){
+      // ENG-9383: remember what the author's cursor was before we overwrite it.
+      // Blanking it on the way out would delete an inline cursor the artefact
+      // set itself; '' is a legitimate saved value meaning "there was none".
+      if(el.__alCur===undefined) el.__alCur = el.style.cursor || '';
+      el.style.cursor='text'; el.style.outline=el.style.outline||'1px dashed rgba(110,231,183,.6)'; el.__alHover=1; hoverCued.push(el);
+    }
   });
   document.addEventListener('mouseout', function(e){
-    var el=e.target; if(el&&el.__alHover&&el!==editing){ el.style.outline=''; el.__alHover=0; }
+    var el=e.target; if(el&&el.__alHover&&el!==editing){ el.style.outline=''; restoreCursor(el); el.__alHover=0; dropHoverCue(el); }
   });
+  // ENG-9383 (CodeRabbit on #4956): the cue is an outline AND an I-beam cursor.
+  // Clearing only the outline leaves the text still saying "you can type here"
+  // on a page that will now refuse the click - the same misdirection this ticket
+  // is about, one property over.
+  function restoreCursor(el){
+    if(el.__alCur!==undefined){ try{ el.style.cursor=el.__alCur; }catch(e){} el.__alCur=undefined; }
+  }
+  // Keep hoverCued bounded. Without this it grows once per hovered element for
+  // the life of the page and pins every one of them against GC - a list that
+  // only ever empties when the viewer toggles the mode off is a leak on any page
+  // nobody toggles.
+  function dropHoverCue(el){
+    var i=hoverCued.indexOf(el); if(i!==-1) hoverCued.splice(i,1);
+  }
+  // ENG-9383: drop every outline the mouseover cue left behind, without waiting
+  // for a mouseout that may never come - the mode can go off while the pointer is
+  // parked on the text, and then the artefact wears a dashed "editable" outline
+  // on a page where you no longer can. Tracked in a list rather than queried back
+  // out of the DOM: more than one element can carry the cue if the pointer moved
+  // between mouseover and mouseout, and the bridge should not depend on a
+  // selector matching an inline style it wrote.
+  function clearHoverCues(){
+    for(var i=0;i<hoverCued.length;i++){
+      var el=hoverCued[i];
+      if(el && el.__alHover && el!==editing){ try{ el.style.outline=''; }catch(e){} restoreCursor(el); el.__alHover=0; }
+    }
+    hoverCued.length=0;
+  }
   document.addEventListener('click', function(e){
-    if(!editEnabled||editing) return;
+    if(!canEdit()) return;
     var sel=document.getSelection(); if(sel && String(sel).trim()) return; // a selection => comment flow
     var el=e.target;
     if(editable(el)){ e.preventDefault(); e.stopPropagation(); startEdit(el); return; }
@@ -32535,7 +32578,7 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // Deliberately general: nothing here knows about .clickzone or any class name.
   // It fixes any artefact that covers its own content.
   window.addEventListener('click', function(e){
-    if(!editEnabled || !editMode || editing) return;
+    if(!canEdit()) return;
     var sel=document.getSelection(); if(sel && String(sel).trim()) return; // selection => comment flow
     var t=e.target;
     // Our own toolbar (Save/Cancel) must keep its clicks.
@@ -32593,7 +32636,7 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     hoverEl=null;
   }
   document.addEventListener('mousemove', function(e){
-    if(!editEnabled || !editMode || editing){ clearDeepHover(); return; }
+    if(!canEdit()){ clearDeepHover(); return; }
     var t=e.target;
     if(editable(t)||inlineOnlyEditable(t)){ clearDeepHover(); return; }
     var now=Date.now(); if(now-hoverProbeAt<80) return; hoverProbeAt=now;
@@ -32693,12 +32736,17 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     var d=e.data; if(!d || d['${MARKUP_CONTROL_MARKER}']!==true) return;
     if(d.type==='enable-edit'){ editEnabled=true; }
     else if(d.type==='enable-comment'){ commentEnabled=true; }
-    // ENG-8477: the viewer toggled Edit text in the shell. Turning it OFF must
+    // ENG-8477: the viewer toggled Edit mode in the shell. Turning it OFF must
     // also close anything open and drop the hover cue, or the artefact is left
     // wearing our outlines with no way to clear them.
+    // ENG-9383: clearDeepHover() only knows the deep-probe path's outline. The
+    // ENG-6821 mouseover path marks its own element with __alHover and relies on
+    // mouseout to undo it - which never fires if the pointer is still sitting on
+    // the text when the mode goes off, leaving a dashed "you can edit this"
+    // outline on a page where you now cannot. Clear both.
     else if(d.type==='set-edit-mode'){
       editMode = !!d.on;
-      if(!editMode){ if(editing) endEdit(false); clearDeepHover(); }
+      if(!editMode){ if(editing) endEdit(false); clearDeepHover(); clearHoverCues(); }
     }
     else if(d.type==='edit-result'){
       if(d.ok){ /* republish hot-swaps the iframe; nothing to do */ }
@@ -35909,14 +35957,15 @@ var FLAG_REGISTRY = [
     // hand-written process.env gate) — same posture as memory-extraction /
     // tool-call-audit above. Gives a per-host canary before the DB flag exists.
     envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
-    // Deliberately-unreachable placeholder until this ships: no published CLI
-    // carries the manager reader + core writer yet, so reach must report "no
-    // host honors" rather than the `honors`-for-everyone that omitting `since`
-    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
-    // merge (auto-publish patch-bumps from main; verify against the tarball, the
-    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
-    // package/dist/lib/manager-worker.js.
-    since: "99.0.0"
+    // The real published build that carries the manager reader + core writer,
+    // replacing the deliberately-unreachable `99.0.0` this flag shipped with.
+    // Verified against the tarball (`npm pack @integrity-labs/agt-cli@0.28.678`):
+    // `setSecretFileTmpfsBacking` is present in package/dist/lib/manager-worker.js
+    // and the `secret-files-tmpfs` key ships in the bundle. Auto-publish patch-
+    // bumps from main, so if a CLI-touching PR landed between the ENG-9348 merge
+    // and this one the real cut is higher than 0.28.678 and reach under-reports;
+    // re-verify before flipping the flag on for a canary (ENG-8575/ENG-9350).
+    since: "0.28.678"
   },
   {
     key: "memory-file-tombstones",
@@ -36700,6 +36749,17 @@ var FLAG_REGISTRY = [
     // control that does nothing, which is the ENG-8303 class exactly.
     // enforce arms automated downtime on a customer's production host.
     sensitive: true
+  },
+  {
+    key: "live-meeting-advisor",
+    description: "Live meeting advising in Ninja Notes (ENG-9381). When ON for an org, a person recording a meeting on the Mac may arm an agent to watch it in flight: audio chunks stream to POST /notes/live/:id/chunks, a server-side Haiku vet decides moment by moment whether to escalate, and escalations reach the agent in a server-minted chat thread. Gates the CAPABILITY, not a surface: the refusal is in startLiveAdvisorSession, so a client that ignores the flag still cannot open a session, and GET /notes/destinations reports the same answer as advisor_enabled so the app can skip the arming modal entirely. Boolean gate; ships dark. OFF NEVER COSTS THE RECORDING. An unentitled org \u2014 or a flag read that fails \u2014 costs the advisor only; the microphone still starts and the note is still transcribed and delivered. That direction is deliberate: the user pressed Record and a recording is what they are owed, while arming on a failed read would spend money per minute on a session nobody confirmed. Deliberately NO envVar. This is an org-scoped gate, and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing, the ENG-8303 class exactly.",
+    flagType: "boolean",
+    defaultValue: false,
+    // Turning it ON arms a per-minute-metered capability AND starts streaming
+    // meeting content to a server-side vet. Both halves are the deliberate,
+    // audited decision ADR-0022 §4 reserves confirmation for — same treatment as
+    // agent-hours-billing-enabled.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/index.js

@@ -39691,6 +39691,15 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // long note on the window-capture click handler for why this is a mode and
   // not just always-on.
   var editMode = false;
+  // ENG-9383: the ONE gate every edit-entry path asks. It exists because the
+  // last time a path was added, the old ones did not come with it: ENG-8477
+  // introduced editMode for the deep-probe handlers and left the ENG-6821
+  // direct click/hover on an arming-only check, so text stayed editable with
+  // the toggle off and the button gated one of two paths. A funnel is the fix
+  // for that class of bug; adding the term twice is only the fix for this
+  // instance of it. A fifth handler cannot forget the mode.
+  function canEdit(){ return editEnabled && editMode && !editing; }
+  var hoverCued = []; // ENG-9383: elements currently wearing the mouseover cue
 
   // Element-child indices from <body> down to el. Counts ELEMENT children only
   // (children, not childNodes), matching how the server walks source_html; our
@@ -39884,14 +39893,48 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // Hover affordance (only when armed and not mid-edit). Highlight leaves AND
   // inline-only containers (their bare text is per-node editable, ENG-6856).
   document.addEventListener('mouseover', function(e){
-    if(!editEnabled||editing) return; var el=e.target;
-    if(editable(el)||inlineOnlyEditable(el)){ el.style.cursor='text'; el.style.outline=el.style.outline||'1px dashed rgba(110,231,183,.6)'; el.__alHover=1; }
+    if(!canEdit()) return; var el=e.target;
+    if(editable(el)||inlineOnlyEditable(el)){
+      // ENG-9383: remember what the author's cursor was before we overwrite it.
+      // Blanking it on the way out would delete an inline cursor the artefact
+      // set itself; '' is a legitimate saved value meaning "there was none".
+      if(el.__alCur===undefined) el.__alCur = el.style.cursor || '';
+      el.style.cursor='text'; el.style.outline=el.style.outline||'1px dashed rgba(110,231,183,.6)'; el.__alHover=1; hoverCued.push(el);
+    }
   });
   document.addEventListener('mouseout', function(e){
-    var el=e.target; if(el&&el.__alHover&&el!==editing){ el.style.outline=''; el.__alHover=0; }
+    var el=e.target; if(el&&el.__alHover&&el!==editing){ el.style.outline=''; restoreCursor(el); el.__alHover=0; dropHoverCue(el); }
   });
+  // ENG-9383 (CodeRabbit on #4956): the cue is an outline AND an I-beam cursor.
+  // Clearing only the outline leaves the text still saying "you can type here"
+  // on a page that will now refuse the click - the same misdirection this ticket
+  // is about, one property over.
+  function restoreCursor(el){
+    if(el.__alCur!==undefined){ try{ el.style.cursor=el.__alCur; }catch(e){} el.__alCur=undefined; }
+  }
+  // Keep hoverCued bounded. Without this it grows once per hovered element for
+  // the life of the page and pins every one of them against GC - a list that
+  // only ever empties when the viewer toggles the mode off is a leak on any page
+  // nobody toggles.
+  function dropHoverCue(el){
+    var i=hoverCued.indexOf(el); if(i!==-1) hoverCued.splice(i,1);
+  }
+  // ENG-9383: drop every outline the mouseover cue left behind, without waiting
+  // for a mouseout that may never come - the mode can go off while the pointer is
+  // parked on the text, and then the artefact wears a dashed "editable" outline
+  // on a page where you no longer can. Tracked in a list rather than queried back
+  // out of the DOM: more than one element can carry the cue if the pointer moved
+  // between mouseover and mouseout, and the bridge should not depend on a
+  // selector matching an inline style it wrote.
+  function clearHoverCues(){
+    for(var i=0;i<hoverCued.length;i++){
+      var el=hoverCued[i];
+      if(el && el.__alHover && el!==editing){ try{ el.style.outline=''; }catch(e){} restoreCursor(el); el.__alHover=0; }
+    }
+    hoverCued.length=0;
+  }
   document.addEventListener('click', function(e){
-    if(!editEnabled||editing) return;
+    if(!canEdit()) return;
     var sel=document.getSelection(); if(sel && String(sel).trim()) return; // a selection => comment flow
     var el=e.target;
     if(editable(el)){ e.preventDefault(); e.stopPropagation(); startEdit(el); return; }
@@ -39935,7 +39978,7 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // Deliberately general: nothing here knows about .clickzone or any class name.
   // It fixes any artefact that covers its own content.
   window.addEventListener('click', function(e){
-    if(!editEnabled || !editMode || editing) return;
+    if(!canEdit()) return;
     var sel=document.getSelection(); if(sel && String(sel).trim()) return; // selection => comment flow
     var t=e.target;
     // Our own toolbar (Save/Cancel) must keep its clicks.
@@ -39993,7 +40036,7 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     hoverEl=null;
   }
   document.addEventListener('mousemove', function(e){
-    if(!editEnabled || !editMode || editing){ clearDeepHover(); return; }
+    if(!canEdit()){ clearDeepHover(); return; }
     var t=e.target;
     if(editable(t)||inlineOnlyEditable(t)){ clearDeepHover(); return; }
     var now=Date.now(); if(now-hoverProbeAt<80) return; hoverProbeAt=now;
@@ -40093,12 +40136,17 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     var d=e.data; if(!d || d['${MARKUP_CONTROL_MARKER}']!==true) return;
     if(d.type==='enable-edit'){ editEnabled=true; }
     else if(d.type==='enable-comment'){ commentEnabled=true; }
-    // ENG-8477: the viewer toggled Edit text in the shell. Turning it OFF must
+    // ENG-8477: the viewer toggled Edit mode in the shell. Turning it OFF must
     // also close anything open and drop the hover cue, or the artefact is left
     // wearing our outlines with no way to clear them.
+    // ENG-9383: clearDeepHover() only knows the deep-probe path's outline. The
+    // ENG-6821 mouseover path marks its own element with __alHover and relies on
+    // mouseout to undo it - which never fires if the pointer is still sitting on
+    // the text when the mode goes off, leaving a dashed "you can edit this"
+    // outline on a page where you now cannot. Clear both.
     else if(d.type==='set-edit-mode'){
       editMode = !!d.on;
-      if(!editMode){ if(editing) endEdit(false); clearDeepHover(); }
+      if(!editMode){ if(editing) endEdit(false); clearDeepHover(); clearHoverCues(); }
     }
     else if(d.type==='edit-result'){
       if(d.ok){ /* republish hot-swaps the iframe; nothing to do */ }
@@ -42860,14 +42908,15 @@ var FLAG_REGISTRY = [
     // hand-written process.env gate) — same posture as memory-extraction /
     // tool-call-audit above. Gives a per-host canary before the DB flag exists.
     envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
-    // Deliberately-unreachable placeholder until this ships: no published CLI
-    // carries the manager reader + core writer yet, so reach must report "no
-    // host honors" rather than the `honors`-for-everyone that omitting `since`
-    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
-    // merge (auto-publish patch-bumps from main; verify against the tarball, the
-    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
-    // package/dist/lib/manager-worker.js.
-    since: "99.0.0"
+    // The real published build that carries the manager reader + core writer,
+    // replacing the deliberately-unreachable `99.0.0` this flag shipped with.
+    // Verified against the tarball (`npm pack @integrity-labs/agt-cli@0.28.678`):
+    // `setSecretFileTmpfsBacking` is present in package/dist/lib/manager-worker.js
+    // and the `secret-files-tmpfs` key ships in the bundle. Auto-publish patch-
+    // bumps from main, so if a CLI-touching PR landed between the ENG-9348 merge
+    // and this one the real cut is higher than 0.28.678 and reach under-reports;
+    // re-verify before flipping the flag on for a canary (ENG-8575/ENG-9350).
+    since: "0.28.678"
   },
   {
     key: "memory-file-tombstones",
@@ -43651,6 +43700,17 @@ var FLAG_REGISTRY = [
     // control that does nothing, which is the ENG-8303 class exactly.
     // enforce arms automated downtime on a customer's production host.
     sensitive: true
+  },
+  {
+    key: "live-meeting-advisor",
+    description: "Live meeting advising in Ninja Notes (ENG-9381). When ON for an org, a person recording a meeting on the Mac may arm an agent to watch it in flight: audio chunks stream to POST /notes/live/:id/chunks, a server-side Haiku vet decides moment by moment whether to escalate, and escalations reach the agent in a server-minted chat thread. Gates the CAPABILITY, not a surface: the refusal is in startLiveAdvisorSession, so a client that ignores the flag still cannot open a session, and GET /notes/destinations reports the same answer as advisor_enabled so the app can skip the arming modal entirely. Boolean gate; ships dark. OFF NEVER COSTS THE RECORDING. An unentitled org \u2014 or a flag read that fails \u2014 costs the advisor only; the microphone still starts and the note is still transcribed and delivered. That direction is deliberate: the user pressed Record and a recording is what they are owed, while arming on a failed read would spend money per minute on a session nobody confirmed. Deliberately NO envVar. This is an org-scoped gate, and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing, the ENG-8303 class exactly.",
+    flagType: "boolean",
+    defaultValue: false,
+    // Turning it ON arms a per-minute-metered capability AND starts streaming
+    // meeting content to a server-side vet. Both halves are the deliberate,
+    // audited decision ADR-0022 §4 reserves confirmation for — same treatment as
+    // agent-hours-billing-enabled.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/origami.js

@@ -38499,6 +38499,15 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // long note on the window-capture click handler for why this is a mode and
   // not just always-on.
   var editMode = false;
+  // ENG-9383: the ONE gate every edit-entry path asks. It exists because the
+  // last time a path was added, the old ones did not come with it: ENG-8477
+  // introduced editMode for the deep-probe handlers and left the ENG-6821
+  // direct click/hover on an arming-only check, so text stayed editable with
+  // the toggle off and the button gated one of two paths. A funnel is the fix
+  // for that class of bug; adding the term twice is only the fix for this
+  // instance of it. A fifth handler cannot forget the mode.
+  function canEdit(){ return editEnabled && editMode && !editing; }
+  var hoverCued = []; // ENG-9383: elements currently wearing the mouseover cue
 
   // Element-child indices from <body> down to el. Counts ELEMENT children only
   // (children, not childNodes), matching how the server walks source_html; our
@@ -38692,14 +38701,48 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // Hover affordance (only when armed and not mid-edit). Highlight leaves AND
   // inline-only containers (their bare text is per-node editable, ENG-6856).
   document.addEventListener('mouseover', function(e){
-    if(!editEnabled||editing) return; var el=e.target;
-    if(editable(el)||inlineOnlyEditable(el)){ el.style.cursor='text'; el.style.outline=el.style.outline||'1px dashed rgba(110,231,183,.6)'; el.__alHover=1; }
+    if(!canEdit()) return; var el=e.target;
+    if(editable(el)||inlineOnlyEditable(el)){
+      // ENG-9383: remember what the author's cursor was before we overwrite it.
+      // Blanking it on the way out would delete an inline cursor the artefact
+      // set itself; '' is a legitimate saved value meaning "there was none".
+      if(el.__alCur===undefined) el.__alCur = el.style.cursor || '';
+      el.style.cursor='text'; el.style.outline=el.style.outline||'1px dashed rgba(110,231,183,.6)'; el.__alHover=1; hoverCued.push(el);
+    }
   });
   document.addEventListener('mouseout', function(e){
-    var el=e.target; if(el&&el.__alHover&&el!==editing){ el.style.outline=''; el.__alHover=0; }
+    var el=e.target; if(el&&el.__alHover&&el!==editing){ el.style.outline=''; restoreCursor(el); el.__alHover=0; dropHoverCue(el); }
   });
+  // ENG-9383 (CodeRabbit on #4956): the cue is an outline AND an I-beam cursor.
+  // Clearing only the outline leaves the text still saying "you can type here"
+  // on a page that will now refuse the click - the same misdirection this ticket
+  // is about, one property over.
+  function restoreCursor(el){
+    if(el.__alCur!==undefined){ try{ el.style.cursor=el.__alCur; }catch(e){} el.__alCur=undefined; }
+  }
+  // Keep hoverCued bounded. Without this it grows once per hovered element for
+  // the life of the page and pins every one of them against GC - a list that
+  // only ever empties when the viewer toggles the mode off is a leak on any page
+  // nobody toggles.
+  function dropHoverCue(el){
+    var i=hoverCued.indexOf(el); if(i!==-1) hoverCued.splice(i,1);
+  }
+  // ENG-9383: drop every outline the mouseover cue left behind, without waiting
+  // for a mouseout that may never come - the mode can go off while the pointer is
+  // parked on the text, and then the artefact wears a dashed "editable" outline
+  // on a page where you no longer can. Tracked in a list rather than queried back
+  // out of the DOM: more than one element can carry the cue if the pointer moved
+  // between mouseover and mouseout, and the bridge should not depend on a
+  // selector matching an inline style it wrote.
+  function clearHoverCues(){
+    for(var i=0;i<hoverCued.length;i++){
+      var el=hoverCued[i];
+      if(el && el.__alHover && el!==editing){ try{ el.style.outline=''; }catch(e){} restoreCursor(el); el.__alHover=0; }
+    }
+    hoverCued.length=0;
+  }
   document.addEventListener('click', function(e){
-    if(!editEnabled||editing) return;
+    if(!canEdit()) return;
     var sel=document.getSelection(); if(sel && String(sel).trim()) return; // a selection => comment flow
     var el=e.target;
     if(editable(el)){ e.preventDefault(); e.stopPropagation(); startEdit(el); return; }
@@ -38743,7 +38786,7 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // Deliberately general: nothing here knows about .clickzone or any class name.
   // It fixes any artefact that covers its own content.
   window.addEventListener('click', function(e){
-    if(!editEnabled || !editMode || editing) return;
+    if(!canEdit()) return;
     var sel=document.getSelection(); if(sel && String(sel).trim()) return; // selection => comment flow
     var t=e.target;
     // Our own toolbar (Save/Cancel) must keep its clicks.
@@ -38801,7 +38844,7 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     hoverEl=null;
   }
   document.addEventListener('mousemove', function(e){
-    if(!editEnabled || !editMode || editing){ clearDeepHover(); return; }
+    if(!canEdit()){ clearDeepHover(); return; }
     var t=e.target;
     if(editable(t)||inlineOnlyEditable(t)){ clearDeepHover(); return; }
     var now=Date.now(); if(now-hoverProbeAt<80) return; hoverProbeAt=now;
@@ -38901,12 +38944,17 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     var d=e.data; if(!d || d['${MARKUP_CONTROL_MARKER}']!==true) return;
     if(d.type==='enable-edit'){ editEnabled=true; }
     else if(d.type==='enable-comment'){ commentEnabled=true; }
-    // ENG-8477: the viewer toggled Edit text in the shell. Turning it OFF must
+    // ENG-8477: the viewer toggled Edit mode in the shell. Turning it OFF must
     // also close anything open and drop the hover cue, or the artefact is left
     // wearing our outlines with no way to clear them.
+    // ENG-9383: clearDeepHover() only knows the deep-probe path's outline. The
+    // ENG-6821 mouseover path marks its own element with __alHover and relies on
+    // mouseout to undo it - which never fires if the pointer is still sitting on
+    // the text when the mode goes off, leaving a dashed "you can edit this"
+    // outline on a page where you now cannot. Clear both.
     else if(d.type==='set-edit-mode'){
       editMode = !!d.on;
-      if(!editMode){ if(editing) endEdit(false); clearDeepHover(); }
+      if(!editMode){ if(editing) endEdit(false); clearDeepHover(); clearHoverCues(); }
     }
     else if(d.type==='edit-result'){
       if(d.ok){ /* republish hot-swaps the iframe; nothing to do */ }
@@ -41647,14 +41695,15 @@ var FLAG_REGISTRY = [
     // hand-written process.env gate) — same posture as memory-extraction /
     // tool-call-audit above. Gives a per-host canary before the DB flag exists.
     envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
-    // Deliberately-unreachable placeholder until this ships: no published CLI
-    // carries the manager reader + core writer yet, so reach must report "no
-    // host honors" rather than the `honors`-for-everyone that omitting `since`
-    // produces. MOVE THIS PIN to the actual auto-published agt-cli version at
-    // merge (auto-publish patch-bumps from main; verify against the tarball, the
-    // ENG-8575/ENG-9350 lesson) — the marker is `setSecretFileTmpfsBacking` in
-    // package/dist/lib/manager-worker.js.
-    since: "99.0.0"
+    // The real published build that carries the manager reader + core writer,
+    // replacing the deliberately-unreachable `99.0.0` this flag shipped with.
+    // Verified against the tarball (`npm pack @integrity-labs/agt-cli@0.28.678`):
+    // `setSecretFileTmpfsBacking` is present in package/dist/lib/manager-worker.js
+    // and the `secret-files-tmpfs` key ships in the bundle. Auto-publish patch-
+    // bumps from main, so if a CLI-touching PR landed between the ENG-9348 merge
+    // and this one the real cut is higher than 0.28.678 and reach under-reports;
+    // re-verify before flipping the flag on for a canary (ENG-8575/ENG-9350).
+    since: "0.28.678"
   },
   {
     key: "memory-file-tombstones",
@@ -42438,6 +42487,17 @@ var FLAG_REGISTRY = [
     // control that does nothing, which is the ENG-8303 class exactly.
     // enforce arms automated downtime on a customer's production host.
     sensitive: true
+  },
+  {
+    key: "live-meeting-advisor",
+    description: "Live meeting advising in Ninja Notes (ENG-9381). When ON for an org, a person recording a meeting on the Mac may arm an agent to watch it in flight: audio chunks stream to POST /notes/live/:id/chunks, a server-side Haiku vet decides moment by moment whether to escalate, and escalations reach the agent in a server-minted chat thread. Gates the CAPABILITY, not a surface: the refusal is in startLiveAdvisorSession, so a client that ignores the flag still cannot open a session, and GET /notes/destinations reports the same answer as advisor_enabled so the app can skip the arming modal entirely. Boolean gate; ships dark. OFF NEVER COSTS THE RECORDING. An unentitled org \u2014 or a flag read that fails \u2014 costs the advisor only; the microphone still starts and the note is still transcribed and delivered. That direction is deliberate: the user pressed Record and a recording is what they are owed, while arming on a failed read would spend money per minute on a session nobody confirmed. Deliberately NO envVar. This is an org-scoped gate, and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing, the ENG-8303 class exactly.",
+    flagType: "boolean",
+    defaultValue: false,
+    // Turning it ON arms a per-minute-metered capability AND starts streaming
+    // meeting content to a server-side vet. Both halves are the deliberate,
+    // audited decision ADR-0022 §4 reserves confirmation for — same treatment as
+    // agent-hours-billing-enabled.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));