@integrity-labs/agt-cli 0.28.691 → 0.28.692

package/dist/mcp/direct-chat-channel.js

@@ -35962,30 +35962,17 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
-  {
-    key: "secret-files-tmpfs",
-    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
-    flagType: "boolean",
-    // Declared safe value is `false` (persistent files, today's behaviour).
-    // Fail-safe direction: a flag-DB read error must never, on its own, start
-    // relocating where prod secret files physically live. Flip on per-host for a
-    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
-    // from the admin Feature Flags page.
-    defaultValue: false,
-    // ADR-0022 operator override, read by the host flag store's env layer (not a
-    // hand-written process.env gate) — same posture as memory-extraction /
-    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
-    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
-    // The real published build that carries the manager reader + core writer,
-    // replacing the deliberately-unreachable `99.0.0` this flag shipped with.
-    // Verified against the tarball (`npm pack @integrity-labs/agt-cli@0.28.678`):
-    // `setSecretFileTmpfsBacking` is present in package/dist/lib/manager-worker.js
-    // and the `secret-files-tmpfs` key ships in the bundle. Auto-publish patch-
-    // bumps from main, so if a CLI-touching PR landed between the ENG-9348 merge
-    // and this one the real cut is higher than 0.28.678 and reach under-reports;
-    // re-verify before flipping the flag on for a canary (ENG-8575/ENG-9350).
-    since: "0.28.678"
-  },
+  // ENG-9348 RETIRED (2026-08-24): the `secret-files-tmpfs` flag and its whole
+  // tmpfs-backing implementation are removed after TWO prod outages. Symlinking
+  // `.env.integrations` into /dev/shm raced the agent wrapper's `set -e; source
+  // .env.integrations` (a symlink observed before its target existed → crashloop);
+  // the seed-before-symlink fix (PR #4960) proved insufficient (a flag-read flap
+  // let the destructive disable-revert re-open the window). Approach abandoned in
+  // favour of the spawn-env path (ENG-9350, which never writes the file at all)
+  // plus disk shred (ENG-9349). Removing the flag makes a third outage impossible.
+  // Any lingering feature_flag_overrides rows for this key are inert (no reader);
+  // clear them out-of-band if desired.
+  // flag-archive-allow: secret-files-tmpfs retired after two prod outages — feature removed, no manager reader remains
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/index.js

@@ -42913,30 +42913,17 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
-  {
-    key: "secret-files-tmpfs",
-    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
-    flagType: "boolean",
-    // Declared safe value is `false` (persistent files, today's behaviour).
-    // Fail-safe direction: a flag-DB read error must never, on its own, start
-    // relocating where prod secret files physically live. Flip on per-host for a
-    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
-    // from the admin Feature Flags page.
-    defaultValue: false,
-    // ADR-0022 operator override, read by the host flag store's env layer (not a
-    // hand-written process.env gate) — same posture as memory-extraction /
-    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
-    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
-    // The real published build that carries the manager reader + core writer,
-    // replacing the deliberately-unreachable `99.0.0` this flag shipped with.
-    // Verified against the tarball (`npm pack @integrity-labs/agt-cli@0.28.678`):
-    // `setSecretFileTmpfsBacking` is present in package/dist/lib/manager-worker.js
-    // and the `secret-files-tmpfs` key ships in the bundle. Auto-publish patch-
-    // bumps from main, so if a CLI-touching PR landed between the ENG-9348 merge
-    // and this one the real cut is higher than 0.28.678 and reach under-reports;
-    // re-verify before flipping the flag on for a canary (ENG-8575/ENG-9350).
-    since: "0.28.678"
-  },
+  // ENG-9348 RETIRED (2026-08-24): the `secret-files-tmpfs` flag and its whole
+  // tmpfs-backing implementation are removed after TWO prod outages. Symlinking
+  // `.env.integrations` into /dev/shm raced the agent wrapper's `set -e; source
+  // .env.integrations` (a symlink observed before its target existed → crashloop);
+  // the seed-before-symlink fix (PR #4960) proved insufficient (a flag-read flap
+  // let the destructive disable-revert re-open the window). Approach abandoned in
+  // favour of the spawn-env path (ENG-9350, which never writes the file at all)
+  // plus disk shred (ENG-9349). Removing the flag makes a third outage impossible.
+  // Any lingering feature_flag_overrides rows for this key are inert (no reader);
+  // clear them out-of-band if desired.
+  // flag-archive-allow: secret-files-tmpfs retired after two prod outages — feature removed, no manager reader remains
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/origami.js

@@ -41700,30 +41700,17 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
-  {
-    key: "secret-files-tmpfs",
-    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
-    flagType: "boolean",
-    // Declared safe value is `false` (persistent files, today's behaviour).
-    // Fail-safe direction: a flag-DB read error must never, on its own, start
-    // relocating where prod secret files physically live. Flip on per-host for a
-    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
-    // from the admin Feature Flags page.
-    defaultValue: false,
-    // ADR-0022 operator override, read by the host flag store's env layer (not a
-    // hand-written process.env gate) — same posture as memory-extraction /
-    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
-    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
-    // The real published build that carries the manager reader + core writer,
-    // replacing the deliberately-unreachable `99.0.0` this flag shipped with.
-    // Verified against the tarball (`npm pack @integrity-labs/agt-cli@0.28.678`):
-    // `setSecretFileTmpfsBacking` is present in package/dist/lib/manager-worker.js
-    // and the `secret-files-tmpfs` key ships in the bundle. Auto-publish patch-
-    // bumps from main, so if a CLI-touching PR landed between the ENG-9348 merge
-    // and this one the real cut is higher than 0.28.678 and reach under-reports;
-    // re-verify before flipping the flag on for a canary (ENG-8575/ENG-9350).
-    since: "0.28.678"
-  },
+  // ENG-9348 RETIRED (2026-08-24): the `secret-files-tmpfs` flag and its whole
+  // tmpfs-backing implementation are removed after TWO prod outages. Symlinking
+  // `.env.integrations` into /dev/shm raced the agent wrapper's `set -e; source
+  // .env.integrations` (a symlink observed before its target existed → crashloop);
+  // the seed-before-symlink fix (PR #4960) proved insufficient (a flag-read flap
+  // let the destructive disable-revert re-open the window). Approach abandoned in
+  // favour of the spawn-env path (ENG-9350, which never writes the file at all)
+  // plus disk shred (ENG-9349). Removing the flag makes a third outage impossible.
+  // Any lingering feature_flag_overrides rows for this key are inert (no reader);
+  // clear them out-of-band if desired.
+  // flag-archive-allow: secret-files-tmpfs retired after two prod outages — feature removed, no manager reader remains
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/slack-channel.js

@@ -36171,30 +36171,17 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
-  {
-    key: "secret-files-tmpfs",
-    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
-    flagType: "boolean",
-    // Declared safe value is `false` (persistent files, today's behaviour).
-    // Fail-safe direction: a flag-DB read error must never, on its own, start
-    // relocating where prod secret files physically live. Flip on per-host for a
-    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
-    // from the admin Feature Flags page.
-    defaultValue: false,
-    // ADR-0022 operator override, read by the host flag store's env layer (not a
-    // hand-written process.env gate) — same posture as memory-extraction /
-    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
-    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
-    // The real published build that carries the manager reader + core writer,
-    // replacing the deliberately-unreachable `99.0.0` this flag shipped with.
-    // Verified against the tarball (`npm pack @integrity-labs/agt-cli@0.28.678`):
-    // `setSecretFileTmpfsBacking` is present in package/dist/lib/manager-worker.js
-    // and the `secret-files-tmpfs` key ships in the bundle. Auto-publish patch-
-    // bumps from main, so if a CLI-touching PR landed between the ENG-9348 merge
-    // and this one the real cut is higher than 0.28.678 and reach under-reports;
-    // re-verify before flipping the flag on for a canary (ENG-8575/ENG-9350).
-    since: "0.28.678"
-  },
+  // ENG-9348 RETIRED (2026-08-24): the `secret-files-tmpfs` flag and its whole
+  // tmpfs-backing implementation are removed after TWO prod outages. Symlinking
+  // `.env.integrations` into /dev/shm raced the agent wrapper's `set -e; source
+  // .env.integrations` (a symlink observed before its target existed → crashloop);
+  // the seed-before-symlink fix (PR #4960) proved insufficient (a flag-read flap
+  // let the destructive disable-revert re-open the window). Approach abandoned in
+  // favour of the spawn-env path (ENG-9350, which never writes the file at all)
+  // plus disk shred (ENG-9349). Removing the flag makes a third outage impossible.
+  // Any lingering feature_flag_overrides rows for this key are inert (no reader);
+  // clear them out-of-band if desired.
+  // flag-archive-allow: secret-files-tmpfs retired after two prod outages — feature removed, no manager reader remains
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/mcp/telegram-channel.js

@@ -36327,30 +36327,17 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
-  {
-    key: "secret-files-tmpfs",
-    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
-    flagType: "boolean",
-    // Declared safe value is `false` (persistent files, today's behaviour).
-    // Fail-safe direction: a flag-DB read error must never, on its own, start
-    // relocating where prod secret files physically live. Flip on per-host for a
-    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
-    // from the admin Feature Flags page.
-    defaultValue: false,
-    // ADR-0022 operator override, read by the host flag store's env layer (not a
-    // hand-written process.env gate) — same posture as memory-extraction /
-    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
-    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
-    // The real published build that carries the manager reader + core writer,
-    // replacing the deliberately-unreachable `99.0.0` this flag shipped with.
-    // Verified against the tarball (`npm pack @integrity-labs/agt-cli@0.28.678`):
-    // `setSecretFileTmpfsBacking` is present in package/dist/lib/manager-worker.js
-    // and the `secret-files-tmpfs` key ships in the bundle. Auto-publish patch-
-    // bumps from main, so if a CLI-touching PR landed between the ENG-9348 merge
-    // and this one the real cut is higher than 0.28.678 and reach under-reports;
-    // re-verify before flipping the flag on for a canary (ENG-8575/ENG-9350).
-    since: "0.28.678"
-  },
+  // ENG-9348 RETIRED (2026-08-24): the `secret-files-tmpfs` flag and its whole
+  // tmpfs-backing implementation are removed after TWO prod outages. Symlinking
+  // `.env.integrations` into /dev/shm raced the agent wrapper's `set -e; source
+  // .env.integrations` (a symlink observed before its target existed → crashloop);
+  // the seed-before-symlink fix (PR #4960) proved insufficient (a flag-read flap
+  // let the destructive disable-revert re-open the window). Approach abandoned in
+  // favour of the spawn-env path (ENG-9350, which never writes the file at all)
+  // plus disk shred (ENG-9349). Removing the flag makes a third outage impossible.
+  // Any lingering feature_flag_overrides rows for this key are inert (no reader);
+  // clear them out-of-band if desired.
+  // flag-archive-allow: secret-files-tmpfs retired after two prod outages — feature removed, no manager reader remains
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",

package/dist/{persistent-session-LVBNKFMF.js → persistent-session-42FL5BEW.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-XF2B7JHC.js";
-import "./chunk-2GNXBVWJ.js";
+} from "./chunk-WHW747J3.js";
+import "./chunk-7K2I4LJZ.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-LVBNKFMF.js.map
+//# sourceMappingURL=persistent-session-42FL5BEW.js.map

package/dist/{responsiveness-probe-T52RFYK3.js → responsiveness-probe-RG2SD7HX.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-XF2B7JHC.js";
-import "./chunk-2GNXBVWJ.js";
+} from "./chunk-WHW747J3.js";
+import "./chunk-7K2I4LJZ.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -745,4 +745,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-T52RFYK3.js.map
+//# sourceMappingURL=responsiveness-probe-RG2SD7HX.js.map

package/dist/{session-auth-dead-MV6C7TBH.js → session-auth-dead-SHLP7FRQ.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-2GNXBVWJ.js";
+} from "./chunk-7K2I4LJZ.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-MV6C7TBH.js.map
+//# sourceMappingURL=session-auth-dead-SHLP7FRQ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.691",
+  "version": "0.28.692",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {