@integrity-labs/agt-cli 0.28.691 → 0.28.693

package/dist/{chunk-2GNXBVWJ.js → chunk-BV2ZQRFB.js}

@@ -79,15 +79,24 @@ var PLATFORM_STORAGE_RULE = "Store durable, reusable work you build (repeatable
 
 // ../../packages/core/dist/provisioning/frameworks/claudecode/identity.js
 var SCRATCH_RETENTION_DAYS = 7;
-var CLAUDE_MD_MAX_CHARS = 4e4;
+var CLAUDE_MD_CHARS_PER_TOKEN = 3.57;
+var CLAUDE_MD_CONTEXT_WINDOW_TOKENS = 2e5;
+var CLAUDE_MD_ALARM_SHARE = 0.1;
 var CLAUDE_MD_BUDGET_CHARS = 38e3;
+var CLAUDE_MD_CONTEXT_ALARM_CHARS = Math.round(CLAUDE_MD_CONTEXT_WINDOW_TOKENS * CLAUDE_MD_ALARM_SHARE * CLAUDE_MD_CHARS_PER_TOKEN);
+function estimateClaudeMdTokens(chars) {
+  return Math.round(chars / CLAUDE_MD_CHARS_PER_TOKEN);
+}
 function checkClaudeMdSize(md) {
   const chars = md.length;
+  const tokens = estimateClaudeMdTokens(chars);
   return {
     chars,
-    ok: chars <= CLAUDE_MD_MAX_CHARS,
+    tokens,
+    contextShare: tokens / CLAUDE_MD_CONTEXT_WINDOW_TOKENS,
+    ok: chars <= CLAUDE_MD_CONTEXT_ALARM_CHARS,
     withinBudget: chars <= CLAUDE_MD_BUDGET_CHARS,
-    overBy: Math.max(0, chars - CLAUDE_MD_MAX_CHARS)
+    overBy: Math.max(0, chars - CLAUDE_MD_CONTEXT_ALARM_CHARS)
   };
 }
 function buildMemorySection(hasQmd) {
@@ -1187,8 +1196,9 @@ The marginal cost of completeness is near zero \u2014 do the whole thing.
 - Before concluding that an agent or person doesn't exist, call \`directory_lookup\` first. Only report "not found" after the directory confirms no match. (ENG-7955)
 ${frontmatter.environment === "prod" ? "- Production environment: exercise extra caution with all operations.\n" : ""}`;
   const size = checkClaudeMdSize(body);
-  if (!size.ok) {
-    console.warn(`[generateClaudeMd] CLAUDE.md for ${frontmatter.code_name} is ${size.chars} chars, over Claude Code's ${CLAUDE_MD_MAX_CHARS}-char limit by ${size.overBy}. The CLI will truncate it \u2014 trim the generated sections (ENG-8105).`);
+  if (!size.withinBudget) {
+    const share = (size.contextShare * 100).toFixed(1);
+    console.warn(`[generateClaudeMd] CLAUDE.md for ${frontmatter.code_name} is ${size.chars} chars (~${size.tokens} tokens, ~${share}% of a ${CLAUDE_MD_CONTEXT_WINDOW_TOKENS}-token context window), over the ${CLAUDE_MD_BUDGET_CHARS}-char generator budget by ${size.chars - CLAUDE_MD_BUDGET_CHARS}${size.ok ? "" : ` \u2014 and past the ${CLAUDE_MD_CONTEXT_ALARM_CHARS}-char operational threshold`}. Nothing is truncated; this is context the agent pays for on every request. Trim the generated sections (ENG-8105 / ENG-9459).`);
   }
   return body;
 }
@@ -4969,30 +4979,17 @@ var FLAG_REGISTRY = [
     // first the real cut is higher than this and the pin under-reports.
     since: "0.28.570"
   },
-  {
-    key: "secret-files-tmpfs",
-    description: "Host-side RAM-backing of the per-agent .env.integrations secret files (ENG-9348, epic ENG-9347). When on, the manager turns both copies (the agent-dir file and the project/ mirror) into symlinks pointing at a 0700 per-agent directory under tmpfs (/dev/shm, else /run), so plaintext channel/integration tokens live only in RAM: the persistent EBS volume holds a symlink (no token bytes), an EBS snapshot captures nothing, and a host shutdown is a genuine wipe. Every consumer path is unchanged (same file paths). Boolean gate; ships dark. Fail-safe in every direction \u2014 off is byte-for-byte today; a host with no genuine tmpfs root (e.g. macOS dev) silently keeps the persistent files; a symlink-setup error logs and falls back to the persistent path. Reboot clears tmpfs, and the manager re-backs on its next refresh (surviving reboot is not required \u2014 secrets are re-fetched on refresh).",
-    flagType: "boolean",
-    // Declared safe value is `false` (persistent files, today's behaviour).
-    // Fail-safe direction: a flag-DB read error must never, on its own, start
-    // relocating where prod secret files physically live. Flip on per-host for a
-    // canary, verify no plaintext lands on the persistent volume, then fleet-wide
-    // from the admin Feature Flags page.
-    defaultValue: false,
-    // ADR-0022 operator override, read by the host flag store's env layer (not a
-    // hand-written process.env gate) — same posture as memory-extraction /
-    // tool-call-audit above. Gives a per-host canary before the DB flag exists.
-    envVar: "AGT_SECRET_FILES_TMPFS_ENABLED",
-    // The real published build that carries the manager reader + core writer,
-    // replacing the deliberately-unreachable `99.0.0` this flag shipped with.
-    // Verified against the tarball (`npm pack @integrity-labs/agt-cli@0.28.678`):
-    // `setSecretFileTmpfsBacking` is present in package/dist/lib/manager-worker.js
-    // and the `secret-files-tmpfs` key ships in the bundle. Auto-publish patch-
-    // bumps from main, so if a CLI-touching PR landed between the ENG-9348 merge
-    // and this one the real cut is higher than 0.28.678 and reach under-reports;
-    // re-verify before flipping the flag on for a canary (ENG-8575/ENG-9350).
-    since: "0.28.678"
-  },
+  // ENG-9348 RETIRED (2026-08-24): the `secret-files-tmpfs` flag and its whole
+  // tmpfs-backing implementation are removed after TWO prod outages. Symlinking
+  // `.env.integrations` into /dev/shm raced the agent wrapper's `set -e; source
+  // .env.integrations` (a symlink observed before its target existed → crashloop);
+  // the seed-before-symlink fix (PR #4960) proved insufficient (a flag-read flap
+  // let the destructive disable-revert re-open the window). Approach abandoned in
+  // favour of the spawn-env path (ENG-9350, which never writes the file at all)
+  // plus disk shred (ENG-9349). Removing the flag makes a third outage impossible.
+  // Any lingering feature_flag_overrides rows for this key are inert (no reader);
+  // clear them out-of-band if desired.
+  // flag-archive-allow: secret-files-tmpfs retired after two prod outages — feature removed, no manager reader remains
   {
     key: "memory-file-tombstones",
     description: "Host-side removal of RETIRED agent memory files (ENG-9257). The control plane sends an explicit tombstone list on /host/memories and the manager moves the matching .md out of the agent's memory directory \u2014 but only when its write-time manifest says the manager itself wrote that exact file and the sha256 still matches, so an agent-edited or hand-authored file is retained and reported instead. Boolean gate; ships dark. Scope is retirement only, never expiry: /host/memories has always withheld expired rows, so an expiry-driven list would make months of accumulated backlog deletable on the first armed tick. This is the ONLY thing that makes retirement visible to the agent, which reads its memory directory straight off disk \u2014 every server-side reader already excludes retired rows, so with this off a retired memory is gone everywhere except the one surface that changes the agent's behaviour.",
@@ -12487,7 +12484,7 @@ export {
   resolveAvatarEnvUrl,
   PLATFORM_STORAGE_RULE,
   SCRATCH_RETENTION_DAYS,
-  CLAUDE_MD_MAX_CHARS,
+  CLAUDE_MD_CONTEXT_ALARM_CHARS,
   INTEGRATIONS_SECTION_START,
   INTEGRATIONS_SECTION_END,
   buildIntegrationsSection,
@@ -12625,4 +12622,4 @@ export {
   minutesSinceLocalMidnight,
   peekCurrentSession
 };
-//# sourceMappingURL=chunk-2GNXBVWJ.js.map
+//# sourceMappingURL=chunk-BV2ZQRFB.js.map