@integrity-labs/agt-cli 0.28.716 → 0.28.718

package/dist/mcp/telegram-channel.js

@@ -34784,6 +34784,104 @@ var AGENT_DIRECTED_NOTICE_KINDS = [
   "waiting_on_agent"
 ];
 var AGENT_DIRECTED_KIND_SET = new Set(AGENT_DIRECTED_NOTICE_KINDS);
+var NOTICE_KIND_AUDIENCE = {
+  // ---- USER -------------------------------------------------------------
+  // An integration broke and only the customer can reconnect it. Carries the
+  // ENG-7652 deep link and renders as the ENG-9256 card — the one notice kind
+  // that already earned a bespoke renderer.
+  integration_failure: "user",
+  // The other half of that pair: the thing you were asked to reconnect is working
+  // again. Kept visible even though it needs no ACTION, because it closes a loop
+  // the customer was explicitly pulled into — hiding it would leave the reconnect
+  // card as the last word on a problem that is now fixed.
+  //
+  // ENG-9592 left a wart here and recorded it: two of the three recovery arms
+  // were written in the second person to the AGENT ("mention it to your owner",
+  // "your session will pick it up"), which reads as nonsense to the customer now
+  // seeing the same string. ENG-9609 rewrote all three to be true for both
+  // readers and pinned it in `eng-9609-recovery-copy-dual-audience.test.ts`.
+  // The note is deleted rather than updated: a deferral that outlives the thing
+  // it defers is just a false claim about the code.
+  integration_recovered: "user",
+  // The form itself. `direct-chat-form.ts` calls it "the agent→user render
+  // message"; hiding it would remove the control the user is meant to fill in.
+  form_request_render: "user",
+  // ENG-9592: the outcome chip for a button the user just pressed — "already
+  // resolved", "only the manager can approve", the re-prompt. Its producer says
+  // it exists so the click does not "look like it did nothing", which is exactly
+  // an answer owed to a person. See the note on the stamped payload below.
+  approval_outcome: "user",
+  // ---- AGENT ------------------------------------------------------------
+  // The ENG-9592 report's headline kind: parked-card pickup instructions, in the
+  // second person, ending in an order not to reply in direct-chat.
+  waiting_response: "agent",
+  // Already agent-directed before this change; each is summarised above and its
+  // reasoning lives beside its entry in AGENT_DIRECTED_NOTICE_KINDS.
+  scheduled_task_nudge: "agent",
+  kanban_check: "agent",
+  manager_feedback: "agent",
+  form_timeout: "agent",
+  integration_connected: "agent",
+  offer_result: "agent",
+  waiting_on_agent: "agent",
+  // "The user submitted your form … Use payload.values to continue the user's
+  // task" — a delivery mechanism, with a raw request uuid. The user submitted it;
+  // they do not need to be told they did.
+  form_result: "agent",
+  // Same shape for a tapped button: "The user tapped X on your button prompt
+  // (request `<uuid>`)". They tapped it.
+  button_click: "agent",
+  // ENG-9397: tells the agent a question was answered AFTER it stopped listening
+  // so it does not report the person as silent. The person's own answer goes
+  // back on the channel they tapped in, not here.
+  late_button_click: "agent",
+  // Broker grant resolutions. Second person to the agent, and each carries the
+  // grant uuid the tool contracts explicitly forbid showing a user ("NEVER paste
+  // the grant UUID into user-facing prose"). Two of these are in the report.
+  supabase_grant_resolved: "agent",
+  supabase_grant_denied: "agent",
+  aws_grant_resolved: "agent",
+  aws_grant_denied: "agent",
+  gcp_grant_resolved: "agent",
+  gcp_grant_denied: "agent",
+  // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
+  // action happened, and do NOT poll".
+  integration_invoke_resolved: "agent",
+  integration_invoke_denied: "agent",
+  // Support/recruit approvals — same shape, agent resumes the provisioning.
+  recruit_resolved: "agent",
+  recruit_denied: "agent",
+  // "Your `<verb>` approval request (`<uuid>`) EXPIRED at …" — in the report,
+  // uuid and all.
+  approval_expired: "agent",
+  // A routine fired; the agent picks the work up.
+  routine_firing_result: "agent",
+  // Live-advisor wake: "Call `live_read` with escalation_id …" — a literal tool
+  // call addressed to the machine.
+  live_advisor_escalation: "agent",
+  live_advisor_session_open: "agent",
+  // The assigner reopened a card and the agent must work it again.
+  assigner_reopen: "agent",
+  // An inbound trigger event delivered onto the rail for the agent to handle.
+  // Named `trigger_event` by `triggerDeliveryPayload` — NOT `trigger_delivery`,
+  // which is what the producing module is called. Read from the builder.
+  trigger_event: "agent",
+  // Operational degradation routed into the agent's chat by the alert bridge.
+  degradation_alert: "agent",
+  // ENG-9592: probes and synthetic prompts, previously carrying NO payload at
+  // all and therefore unclassifiable. Stamped at their producers so the verdict
+  // is recorded rather than inherited from the default. `agent_probe` covers
+  // both probe kinds (liveness and the board nudge); the specific one is
+  // `payload.probe_kind`, so a new probe kind needs no entry here.
+  agent_probe: "agent",
+  agent_question_probe: "agent",
+  kanban_confirm_prompt: "agent"
+};
+var USER_FACING_KIND_SET = new Set(Object.entries(NOTICE_KIND_AUDIENCE).filter(([, audience]) => audience === "user").map(([kind]) => kind));
+var USER_FACING_NOTICE_KINDS = Object.freeze([
+  ...USER_FACING_KIND_SET
+]);
+var HIDDEN_NOTICE_KINDS = Object.freeze(Object.entries(NOTICE_KIND_AUDIENCE).filter(([, audience]) => audience === "agent").map(([kind]) => kind));
 
 // ../core/dist/direct-chat/cursor-advance.js
 var CURSOR_ADVANCE_NON_SHORTFALL_KEYS = ["advanced", "advanced_unreported", "failed"];
@@ -35415,6 +35513,12 @@ var WAITING_KIND_SET = new Set(WAITING_KINDS);
 // ../core/dist/alerts/index.js
 init_snooze();
 
+// ../core/dist/alerts/age.js
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS = 24 * HOUR_MS;
+var ALERT_AGE_SEVERITY_FLOORS = [{ afterMs: 24 * HOUR_MS, floor: "critical" }];
+
 // ../core/dist/conversations/metrics.js
 var PERIOD_CONFIG = {
   "24h": { windowMs: 24 * 60 * 60 * 1e3, bucket: "hour" },
@@ -36842,6 +36946,25 @@ var FLAG_REGISTRY = [
     // deliberate, audited per-org flip (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "email-require-approval-enforcement",
+    description: 'Enforcement gate for the `email.require_approval` guardrail (ENG-9611). That guardrail has been `default_for_new_orgs` since ~2026-05-03 and its display text promises "Require human approval before sending any email", but nothing ever read it: its only runtime path was toGuardrailForPrompt, i.e. a line in the agent CLAUDE.md. When ON for an org, a DISPATCHING email send (never a draft-create, ENG-7980) is held and routed to Human Approval regardless of recipient domain \u2014 which is what "any email" means, and is what distinguishes it from email-guard-require-approval-enabled, whose require_approval stage only intercepts a would-be DOMAIN block. Deliberately separate from the guardrail row: roughly four months of orgs already carry an inert `enforce`-level row, so reading the row alone would arm a blocking control across all of them on deploy. New orgs are armed by an org-scoped override written at org creation; existing orgs stay off until an operator flips them. Evaluated per-org. Ships dark.',
+    flagType: "boolean",
+    // Declared safe value is `false` (no hold). A flag-DB read error degrades here, so a flags
+    // outage can never silently start holding real customer email — the same fail-OPEN posture
+    // enforceEmailDomainGuard already takes, and the opposite of the enforcement resolver's
+    // fail-CLOSED, deliberately: a control that cannot verify itself must not block mail.
+    // No envVar: net-new control with no pre-flags env gate to migrate (ADR-0022).
+    defaultValue: false,
+    // Turning it on holds real customer email pending a human tap, so it is a deliberate,
+    // audited per-org flip (ADR-0022 §4).
+    sensitive: true,
+    // ENG-9629: NEW orgs are armed on. Declared here rather than hardcoded in the
+    // seeding code, so `listNewOrgFlagOverrides()` is the one answer to "which flags
+    // does a new org get". `defaultValue` stays false so the ~4 months of orgs already
+    // carrying an inert enforce-level email.require_approval row are NOT armed on deploy.
+    newOrgOverride: true
+  },
   {
     key: "email-guard-require-approval-enabled",
     description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",
@@ -37531,20 +37654,20 @@ function watchSuccessTextPlain(fileId, durationMs, reused) {
 
 // src/telegram-peer-rate-limiter.ts
 var SECOND_MS = 1e3;
-var MINUTE_MS = 60 * SECOND_MS;
-var HOUR_MS = 60 * MINUTE_MS;
-var DAY_MS = 24 * HOUR_MS;
+var MINUTE_MS2 = 60 * SECOND_MS;
+var HOUR_MS2 = 60 * MINUTE_MS2;
+var DAY_MS2 = 24 * HOUR_MS2;
 var DEFAULT_RATE_LIMITER_CONFIG = Object.freeze({
   pairBurstLimit: 1,
   pairBurstWindowMs: 10 * SECOND_MS,
   pairWindowLimit: 5,
-  pairWindowMs: 5 * MINUTE_MS,
+  pairWindowMs: 5 * MINUTE_MS2,
   chatLimit: 10,
-  chatWindowMs: 5 * MINUTE_MS,
+  chatWindowMs: 5 * MINUTE_MS2,
   agentDailyLimit: 200,
-  agentDailyWindowMs: DAY_MS,
+  agentDailyWindowMs: DAY_MS2,
   dailyBudgetLimit: 500,
-  dailyBudgetWindowMs: DAY_MS
+  dailyBudgetWindowMs: DAY_MS2
 });
 function readSliding(window2, windowMs, now) {
   if (!window2) return 0;
@@ -37631,7 +37754,7 @@ function createPeerRateLimiter(config2 = DEFAULT_RATE_LIMITER_CONFIG) {
   };
 }
 function createPresenceTracker(opts = {}) {
-  const retainMs = opts.retainMs ?? DAY_MS;
+  const retainMs = opts.retainMs ?? DAY_MS2;
   const lastHumanByChat = /* @__PURE__ */ new Map();
   for (const [chatId, at] of Object.entries(opts.initial ?? {})) {
     if (typeof at === "number" && Number.isFinite(at)) lastHumanByChat.set(chatId, at);
@@ -37656,7 +37779,7 @@ function createPresenceTracker(opts = {}) {
         }
       }
     },
-    shouldDropOutgress(chatId, now, maxAgeMs = 30 * MINUTE_MS) {
+    shouldDropOutgress(chatId, now, maxAgeMs = 30 * MINUTE_MS2) {
       const last = lastHumanByChat.get(chatId);
       if (last === void 0) return "no_human_recent";
       if (now - last >= maxAgeMs) return "no_human_recent";

package/dist/{persistent-session-DJSSEIR6.js → persistent-session-2AWYIUCX.js}

@@ -9,6 +9,7 @@ import {
   buildSpawnEnv,
   collectDiagnostics,
   describePaneAgentIdMismatch,
+  detectFailureSignature,
   directChatSessionStatePath,
   egressAllowlistHostPath,
   egressMode,
@@ -36,6 +37,7 @@ import {
   rotatePaneLogForDayRollover,
   rotateSessionForWedge,
   sendToAgent,
+  spawnBackoffMs,
   startPersistentSession,
   stopAllSessions,
   stopAllSessionsAndWait,
@@ -44,8 +46,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-ILDRNSOB.js";
-import "./chunk-LHYYO4NY.js";
+} from "./chunk-FNALM4HG.js";
+import "./chunk-7LH3SVAD.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -58,6 +60,7 @@ export {
   buildSpawnEnv,
   collectDiagnostics,
   describePaneAgentIdMismatch,
+  detectFailureSignature,
   directChatSessionStatePath,
   egressAllowlistHostPath,
   egressMode,
@@ -85,6 +88,7 @@ export {
   rotatePaneLogForDayRollover,
   rotateSessionForWedge,
   sendToAgent,
+  spawnBackoffMs,
   startPersistentSession,
   stopAllSessions,
   stopAllSessionsAndWait,
@@ -94,4 +98,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-DJSSEIR6.js.map
+//# sourceMappingURL=persistent-session-2AWYIUCX.js.map

package/dist/{responsiveness-probe-A5335ORT.js → responsiveness-probe-JQS4WA2L.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-ILDRNSOB.js";
-import "./chunk-LHYYO4NY.js";
+} from "./chunk-FNALM4HG.js";
+import "./chunk-7LH3SVAD.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -745,4 +745,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-A5335ORT.js.map
+//# sourceMappingURL=responsiveness-probe-JQS4WA2L.js.map

package/dist/{session-auth-dead-KUYVUOK5.js → session-auth-dead-VBMZW4GG.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-LHYYO4NY.js";
+} from "./chunk-7LH3SVAD.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-KUYVUOK5.js.map
+//# sourceMappingURL=session-auth-dead-VBMZW4GG.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.716",
+  "version": "0.28.718",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {