@integrity-labs/agt-cli 0.28.762 → 0.28.764

package/dist/mcp/direct-chat-channel.js

@@ -37122,6 +37122,20 @@ var FLAG_REGISTRY = [
     // audited decision ADR-0022 §4 reserves confirmation for — same treatment as
     // agent-hours-billing-enabled.
     sensitive: true
+  },
+  {
+    key: "first-party-token-refusal",
+    description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // See the description: `shadow` is what prod compiles today, so it is the
+    // only default that ships this flag as a no-op.
+    defaultValue: "shadow",
+    // enforce changes the admission rule on the platform's front door, and the
+    // families it starts refusing include mcp-proxy — one of the fleet's
+    // dominant callers. This is precisely the deliberate, audited flip ADR-0022
+    // §4 reserves confirmation for.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/index.js

@@ -44117,6 +44117,20 @@ var FLAG_REGISTRY = [
     // audited decision ADR-0022 §4 reserves confirmation for — same treatment as
     // agent-hours-billing-enabled.
     sensitive: true
+  },
+  {
+    key: "first-party-token-refusal",
+    description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // See the description: `shadow` is what prod compiles today, so it is the
+    // only default that ships this flag as a no-op.
+    defaultValue: "shadow",
+    // enforce changes the admission rule on the platform's front door, and the
+    // families it starts refusing include mcp-proxy — one of the fleet's
+    // dominant callers. This is precisely the deliberate, audited flip ADR-0022
+    // §4 reserves confirmation for.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/origami.js

@@ -42846,6 +42846,20 @@ var FLAG_REGISTRY = [
     // audited decision ADR-0022 §4 reserves confirmation for — same treatment as
     // agent-hours-billing-enabled.
     sensitive: true
+  },
+  {
+    key: "first-party-token-refusal",
+    description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // See the description: `shadow` is what prod compiles today, so it is the
+    // only default that ships this flag as a no-op.
+    defaultValue: "shadow",
+    // enforce changes the admission rule on the platform's front door, and the
+    // families it starts refusing include mcp-proxy — one of the fleet's
+    // dominant callers. This is precisely the deliberate, audited flip ADR-0022
+    // §4 reserves confirmation for.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/slack-channel.js

@@ -37369,6 +37369,20 @@ var FLAG_REGISTRY = [
     // audited decision ADR-0022 §4 reserves confirmation for — same treatment as
     // agent-hours-billing-enabled.
     sensitive: true
+  },
+  {
+    key: "first-party-token-refusal",
+    description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // See the description: `shadow` is what prod compiles today, so it is the
+    // only default that ships this flag as a no-op.
+    defaultValue: "shadow",
+    // enforce changes the admission rule on the platform's front door, and the
+    // families it starts refusing include mcp-proxy — one of the fleet's
+    // dominant callers. This is precisely the deliberate, audited flip ADR-0022
+    // §4 reserves confirmation for.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/telegram-channel.js

@@ -37527,6 +37527,20 @@ var FLAG_REGISTRY = [
     // audited decision ADR-0022 §4 reserves confirmation for — same treatment as
     // agent-hours-billing-enabled.
     sensitive: true
+  },
+  {
+    key: "first-party-token-refusal",
+    description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // See the description: `shadow` is what prod compiles today, so it is the
+    // only default that ships this flag as a no-op.
+    defaultValue: "shadow",
+    // enforce changes the admission rule on the platform's front door, and the
+    // families it starts refusing include mcp-proxy — one of the fleet's
+    // dominant callers. This is precisely the deliberate, audited flip ADR-0022
+    // §4 reserves confirmation for.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/{persistent-session-VS44QKVB.js → persistent-session-3OBDKYWF.js}

@@ -49,8 +49,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-EU6RSU5V.js";
-import "./chunk-L4KDOGHB.js";
+} from "./chunk-LVBINNTQ.js";
+import "./chunk-23KTLVYX.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -104,4 +104,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-VS44QKVB.js.map
+//# sourceMappingURL=persistent-session-3OBDKYWF.js.map

package/dist/{responsiveness-probe-CNSUJALX.js → responsiveness-probe-ULIAXSCT.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-EU6RSU5V.js";
-import "./chunk-L4KDOGHB.js";
+} from "./chunk-LVBINNTQ.js";
+import "./chunk-23KTLVYX.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -745,4 +745,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-CNSUJALX.js.map
+//# sourceMappingURL=responsiveness-probe-ULIAXSCT.js.map

package/dist/{session-auth-dead-3AK3MDNT.js → session-auth-dead-67XFJWMA.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-L4KDOGHB.js";
+} from "./chunk-23KTLVYX.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-3AK3MDNT.js.map
+//# sourceMappingURL=session-auth-dead-67XFJWMA.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.762",
+  "version": "0.28.764",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {