@integrity-labs/agt-cli 0.28.772 → 0.28.774

package/dist/{chunk-R6XGVTQS.js → chunk-SXTHAF3R.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-UPSDSMNC.js";
+} from "./chunk-PMKI7ZTP.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5141,4 +5141,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-R6XGVTQS.js.map
+//# sourceMappingURL=chunk-SXTHAF3R.js.map

package/dist/{claude-pair-runtime-Z7JFVKIY.js → claude-pair-runtime-O7T3PIMT.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-NUVUR3PB.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-C2Y4CSAY.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-Z7JFVKIY.js.map
+//# sourceMappingURL=claude-pair-runtime-O7T3PIMT.js.map

package/dist/lib/manager-worker.js

@@ -58,7 +58,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-SBAX57SN.js";
+} from "../chunk-BUCKLMKD.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -120,7 +120,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-R6XGVTQS.js";
+} from "../chunk-SXTHAF3R.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -209,7 +209,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-UPSDSMNC.js";
+} from "../chunk-PMKI7ZTP.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -12870,7 +12870,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-J3D7MRIU.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-7CVB5NBT.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname10(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13530,7 +13530,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.772" : "dev";
+var agtCliVersion = true ? "0.28.774" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15074,7 +15074,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-NUVUR3PB.js");
+      const { collectDiagnostics } = await import("../persistent-session-C2Y4CSAY.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15215,7 +15215,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-NUVUR3PB.js");
+      const { collectDiagnostics } = await import("../persistent-session-C2Y4CSAY.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15384,7 +15384,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-J3D7MRIU.js");
+      } = await import("../responsiveness-probe-7CVB5NBT.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -15494,7 +15494,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-J3D7MRIU.js");
+        } = await import("../responsiveness-probe-7CVB5NBT.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15650,7 +15650,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-GKZNZKWI.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-E3WEZYEH.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -19690,7 +19690,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-NUVUR3PB.js");
+        const { collectDiagnostics } = await import("../persistent-session-C2Y4CSAY.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -19736,7 +19736,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-NUVUR3PB.js");
+      const { collectDiagnostics } = await import("../persistent-session-C2Y4CSAY.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20372,7 +20372,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-Z7JFVKIY.js");
+  } = await import("../claude-pair-runtime-O7T3PIMT.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -37139,6 +37139,74 @@ var FLAG_REGISTRY = [
     // dominant callers. This is precisely the deliberate, audited flip ADR-0022
     // §4 reserves confirmation for.
     sensitive: true
+  },
+  {
+    key: "artefact-export-jobs-serve",
+    description: 'ADR-0077 / ENG-9729 \u2014 the MASTER switch for the async artefact-export lane. ON (default) = a route may resolve an export request to an artefact_export_jobs row: attach to one that is already rendering, or hand back the bytes of one that has completed. OFF = the job lane is invisible and every export renders synchronously, which is the pre-ADR-0077 behaviour. DEFAULT true DOES NOT MEAN ASYNC IS ON. Nothing CREATES a job unless artefact-export-jobs-start is also on, so with the shipped defaults this flag governs an empty table and no caller can tell it exists. WHY THE LANE IS TWO FLAGS AND NOT ONE. Disarming the start lever while renders are in flight must not strand the callers holding their job ids: those renders keep running (a Lambda invocation nobody awaits still runs to completion), and their bytes land in the private bucket regardless. A single flag would take the only door to them away at the moment it was most needed. So "stop creating new jobs" and "keep serving the ones that exist" are separate, and this is the second one. READ-ONLY BY CONSTRUCTION: with start off, the route looks up a REUSABLE row and nothing more \u2014 it never inserts, never requeues a terminal row, and never dispatches a renderer. A requeue mints an attempt and fires an invoke, so a serve lever that requeued would start new renders under a disarmed start lever, which is the exact thing disarming it was meant to stop. Evaluated server-side per request (org-scoped), so a flip applies within the evaluation cache TTL with no deploy and no host update. Deliberately NO envVar: the consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and a literal in sst.config.ts would pin every stage and make the admin control inert (ENG-8303).',
+    flagType: "boolean",
+    // ON is the no-op default here, which looks like the wrong direction until
+    // you read it with the start lever: serving an empty table is
+    // indistinguishable from not serving at all. Shipping it OFF would instead
+    // mean that arming async later takes TWO flips, and that the second one is
+    // the easy one to forget — leaving a fleet that creates jobs it refuses to
+    // serve, i.e. every slow export failing while the flag page reads "async: on".
+    defaultValue: true
+  },
+  {
+    key: "artefact-export-jobs-start",
+    description: "ADR-0077 / ENG-9729 \u2014 whether a route may CREATE an async artefact-export job: insert or requeue an artefact_export_jobs row, dispatch the worker, and answer a caller with a job id instead of bytes when the ~20s grace window is exceeded. OFF (default) = today's synchronous render on every export. THIS IS THE ROLLOUT GATE, AND IT IS ORDERED AGAINST A CLIENT, NOT A DEPLOY. The agent caller is `artefacts_download`, which ships inside the agt CLI to a permanently mixed-version fleet \u2014 hosts self-update overnight and some never do. Arming this against a CLI that cannot read a job-id body does not degrade an export, it BREAKS one: the pre-ENG-9729 tool does Buffer.from(data.base64) with no branch for any other shape, so a job id arrives as a TypeError deep in file-write logic. That is strictly worse than the 503 + Retry-After it would replace, which the tool already understands. A published CLI version is NOT evidence of convergence \u2014 measure hosts.agt_version across recently-seen hosts first. The procedure is docs/runbooks/async-export-rollout.md; arm this only after running it. Turning it back OFF stops new jobs and leaves artefact-export-jobs-serve delivering the in-flight ones, which is why the two are separate. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark. The client half of this change publishes with the same merge, and
+    // the fleet has not converged on it at merge time by construction — see the
+    // runbook. Arming is an operator action taken against a measurement.
+    defaultValue: false,
+    // Arming this changes the RESPONSE SHAPE of a route whose callers include a
+    // binary we do not control the version of. ADR-0022 section 4 reserves
+    // confirmation for exactly this: a flip that a single unguarded write should
+    // not be able to make.
+    sensitive: true,
+    // `since` USED SLIGHTLY OFF-LABEL, AND THAT IS THE POINT.
+    //
+    // The field's docblock says it records the CLI whose build first shipped
+    // this flag's HOST-SIDE READER, and this flag has none — it is evaluated
+    // server-side in the export route, so every host "honors" a flip the instant
+    // it is made. Read literally, `since` should therefore be undefined.
+    //
+    // Undefined is the dangerous answer. `classifyHostReach` returns `honors`
+    // for every host when `since` is unset, so the flip-reach modal — the screen
+    // an operator is looking at AT THE MOMENT OF THE FLIP — would report full
+    // reach for the one flag whose entire purpose is "do not flip this until you
+    // have measured the fleet". It would be telling the truth about the
+    // mechanism (the flip does reach every host immediately) while giving
+    // exactly the wrong answer to the question being asked (can those hosts
+    // survive it). The dependency is real; it is on the CLI's ability to SURVIVE
+    // the flag, not to READ it, and the modal cannot tell those apart.
+    //
+    // Pinned ABOVE every published release on purpose, the `agt-bin-path`
+    // precedent: it classifies EVERY host as `stale`, so the modal reports no
+    // reach rather than reach it has no basis for. A guessed number would be
+    // worse than a placeholder, and the two directions are not symmetric —
+    // too HIGH over-warns (annoying), too LOW promises reach to a build that
+    // answers a job id with a TypeError inside file-write logic (a broken export
+    // reported to the agent as "download failed").
+    //
+    // The exact version cannot be known here: the CLI auto-publishes ON MERGE of
+    // this change, patch-bumping from whatever is current, so any pre-merge
+    // value is a guess. Do NOT read it off `apps/cli/package.json`, and do NOT
+    // trust a version produced by re-running a failed publish job (ENG-9647: a
+    // re-run rebuilds the ORIGINAL tree under a HIGHER number, so the version
+    // string would claim a capability the bytes do not carry).
+    //
+    // AND `since` IS ADVISORY, NOT A GUARD. It is read in exactly one place —
+    // the flip-reach modal. Nothing in the evaluation or override-write path
+    // consults it, so this changes what an operator is TOLD and does not stop a
+    // flip on an under-`since` host. What holds the line is `defaultValue:
+    // false` + `sensitive: true` + the runbook.
+    //
+    // REPLACING IT IS STEP 1 OF THE ARMING PROCEDURE in
+    // docs/runbooks/async-export-rollout.md, so the placeholder has a named
+    // owner and a named moment rather than being a deferral nobody holds.
+    since: "0.29.0"
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/index.js

@@ -36790,6 +36790,60 @@ function jsonSchemaPropertyToZod(prop) {
   return external_exports.unknown();
 }
 
+// src/artefact-export-response.ts
+var DEFAULT_EXPORT_RETRY_MS = 1e4;
+function classifyExportResponse(body) {
+  if (typeof body !== "object" || body === null) {
+    throw new Error("export response was not an object");
+  }
+  const candidate = body;
+  if (typeof candidate.job_id === "string" && candidate.job_id.length > 0) {
+    const retry = typeof candidate.retry_after_ms === "number" && Number.isFinite(candidate.retry_after_ms) ? Math.max(0, candidate.retry_after_ms) : null;
+    return {
+      kind: "pending",
+      jobId: candidate.job_id,
+      status: typeof candidate.status === "string" ? candidate.status : null,
+      retryAfterMs: retry
+    };
+  }
+  if (typeof candidate.base64 !== "string" || candidate.base64.length === 0) {
+    throw new Error("export response carried neither rendered bytes nor a job id");
+  }
+  return {
+    kind: "bytes",
+    body: {
+      base64: candidate.base64,
+      content_type: typeof candidate.content_type === "string" ? candidate.content_type : "",
+      filename: typeof candidate.filename === "string" ? candidate.filename : "",
+      format: typeof candidate.format === "string" ? candidate.format : "",
+      version: typeof candidate.version === "number" ? candidate.version : 0
+    }
+  };
+}
+function pendingExportText(n) {
+  const wait = Math.max(1, Math.round((n.retryAfterMs ?? DEFAULT_EXPORT_RETRY_MS) / 1e3));
+  const fmt = n.format.toUpperCase();
+  const retryLine = `Call artefacts_download again with the SAME arguments in about ${wait}s. The retry attaches to the render already in progress rather than starting a new one, and items that have already finished come back immediately.`;
+  if (n.totalItems <= 1) {
+    return [
+      `The ${fmt} export is still rendering (job ${n.jobId}); no file was saved yet.`,
+      retryLine,
+      "Nothing has failed \u2014 this document simply takes longer than the export request waits."
+    ].join("\n");
+  }
+  const header = n.saved.length > 0 ? `Rendered ${n.saved.length} of ${n.totalItems} items; item ${n.pendingPosition} is still rendering (job ${n.jobId}), so this is a PARTIAL export.` : `None of the ${n.totalItems} items finished in time; item ${n.pendingPosition} is still rendering (job ${n.jobId}).`;
+  const lines = [header];
+  if (n.saved.length > 0) {
+    lines.push(`Saved so far (items 1-${n.saved.length}):`);
+    lines.push(...n.saved.map((p2) => `- ${p2}`));
+    lines.push(
+      "These files are complete and usable, but they are NOT the whole document \u2014 do not send them as if they were."
+    );
+  }
+  lines.push(retryLine);
+  return lines.join("\n");
+}
+
 // src/mutation-commit-state.ts
 var API_GATEWAY_INTEGRATION_TIMEOUT_MS = 29e3;
 var GATEWAY_TIMEOUT_MARGIN_MS = 3e3;
@@ -44134,6 +44188,74 @@ var FLAG_REGISTRY = [
     // dominant callers. This is precisely the deliberate, audited flip ADR-0022
     // §4 reserves confirmation for.
     sensitive: true
+  },
+  {
+    key: "artefact-export-jobs-serve",
+    description: 'ADR-0077 / ENG-9729 \u2014 the MASTER switch for the async artefact-export lane. ON (default) = a route may resolve an export request to an artefact_export_jobs row: attach to one that is already rendering, or hand back the bytes of one that has completed. OFF = the job lane is invisible and every export renders synchronously, which is the pre-ADR-0077 behaviour. DEFAULT true DOES NOT MEAN ASYNC IS ON. Nothing CREATES a job unless artefact-export-jobs-start is also on, so with the shipped defaults this flag governs an empty table and no caller can tell it exists. WHY THE LANE IS TWO FLAGS AND NOT ONE. Disarming the start lever while renders are in flight must not strand the callers holding their job ids: those renders keep running (a Lambda invocation nobody awaits still runs to completion), and their bytes land in the private bucket regardless. A single flag would take the only door to them away at the moment it was most needed. So "stop creating new jobs" and "keep serving the ones that exist" are separate, and this is the second one. READ-ONLY BY CONSTRUCTION: with start off, the route looks up a REUSABLE row and nothing more \u2014 it never inserts, never requeues a terminal row, and never dispatches a renderer. A requeue mints an attempt and fires an invoke, so a serve lever that requeued would start new renders under a disarmed start lever, which is the exact thing disarming it was meant to stop. Evaluated server-side per request (org-scoped), so a flip applies within the evaluation cache TTL with no deploy and no host update. Deliberately NO envVar: the consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and a literal in sst.config.ts would pin every stage and make the admin control inert (ENG-8303).',
+    flagType: "boolean",
+    // ON is the no-op default here, which looks like the wrong direction until
+    // you read it with the start lever: serving an empty table is
+    // indistinguishable from not serving at all. Shipping it OFF would instead
+    // mean that arming async later takes TWO flips, and that the second one is
+    // the easy one to forget — leaving a fleet that creates jobs it refuses to
+    // serve, i.e. every slow export failing while the flag page reads "async: on".
+    defaultValue: true
+  },
+  {
+    key: "artefact-export-jobs-start",
+    description: "ADR-0077 / ENG-9729 \u2014 whether a route may CREATE an async artefact-export job: insert or requeue an artefact_export_jobs row, dispatch the worker, and answer a caller with a job id instead of bytes when the ~20s grace window is exceeded. OFF (default) = today's synchronous render on every export. THIS IS THE ROLLOUT GATE, AND IT IS ORDERED AGAINST A CLIENT, NOT A DEPLOY. The agent caller is `artefacts_download`, which ships inside the agt CLI to a permanently mixed-version fleet \u2014 hosts self-update overnight and some never do. Arming this against a CLI that cannot read a job-id body does not degrade an export, it BREAKS one: the pre-ENG-9729 tool does Buffer.from(data.base64) with no branch for any other shape, so a job id arrives as a TypeError deep in file-write logic. That is strictly worse than the 503 + Retry-After it would replace, which the tool already understands. A published CLI version is NOT evidence of convergence \u2014 measure hosts.agt_version across recently-seen hosts first. The procedure is docs/runbooks/async-export-rollout.md; arm this only after running it. Turning it back OFF stops new jobs and leaves artefact-export-jobs-serve delivering the in-flight ones, which is why the two are separate. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark. The client half of this change publishes with the same merge, and
+    // the fleet has not converged on it at merge time by construction — see the
+    // runbook. Arming is an operator action taken against a measurement.
+    defaultValue: false,
+    // Arming this changes the RESPONSE SHAPE of a route whose callers include a
+    // binary we do not control the version of. ADR-0022 section 4 reserves
+    // confirmation for exactly this: a flip that a single unguarded write should
+    // not be able to make.
+    sensitive: true,
+    // `since` USED SLIGHTLY OFF-LABEL, AND THAT IS THE POINT.
+    //
+    // The field's docblock says it records the CLI whose build first shipped
+    // this flag's HOST-SIDE READER, and this flag has none — it is evaluated
+    // server-side in the export route, so every host "honors" a flip the instant
+    // it is made. Read literally, `since` should therefore be undefined.
+    //
+    // Undefined is the dangerous answer. `classifyHostReach` returns `honors`
+    // for every host when `since` is unset, so the flip-reach modal — the screen
+    // an operator is looking at AT THE MOMENT OF THE FLIP — would report full
+    // reach for the one flag whose entire purpose is "do not flip this until you
+    // have measured the fleet". It would be telling the truth about the
+    // mechanism (the flip does reach every host immediately) while giving
+    // exactly the wrong answer to the question being asked (can those hosts
+    // survive it). The dependency is real; it is on the CLI's ability to SURVIVE
+    // the flag, not to READ it, and the modal cannot tell those apart.
+    //
+    // Pinned ABOVE every published release on purpose, the `agt-bin-path`
+    // precedent: it classifies EVERY host as `stale`, so the modal reports no
+    // reach rather than reach it has no basis for. A guessed number would be
+    // worse than a placeholder, and the two directions are not symmetric —
+    // too HIGH over-warns (annoying), too LOW promises reach to a build that
+    // answers a job id with a TypeError inside file-write logic (a broken export
+    // reported to the agent as "download failed").
+    //
+    // The exact version cannot be known here: the CLI auto-publishes ON MERGE of
+    // this change, patch-bumping from whatever is current, so any pre-merge
+    // value is a guess. Do NOT read it off `apps/cli/package.json`, and do NOT
+    // trust a version produced by re-running a failed publish job (ENG-9647: a
+    // re-run rebuilds the ORIGINAL tree under a HIGHER number, so the version
+    // string would claim a capability the bytes do not carry).
+    //
+    // AND `since` IS ADVISORY, NOT A GUARD. It is read in exactly one place —
+    // the flip-reach modal. Nothing in the evaluation or override-write path
+    // consults it, so this changes what an operator is TOLD and does not stop a
+    // flip on an under-`since` host. What holds the line is `defaultValue:
+    // false` + `sensitive: true` + the runbook.
+    //
+    // REPLACING IT IS STEP 1 OF THE ARMING PROCEDURE in
+    // docs/runbooks/async-export-rollout.md, so the placeholder has a named
+    // owner and a named moment rather than being a deferral nobody holds.
+    since: "0.29.0"
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
@@ -46523,6 +46645,54 @@ server.tool(
     return { content: [{ type: "text", text: lines.join("\n") }] };
   }
 );
+server.tool(
+  "rule_list",
+  "List the standing rules currently in force for you \u2014 the short instructions your people have asked you to follow on EVERY turn, rendered into your instructions verbatim. Use this before adding a rule (so you know whether you are at the limit and what you would be replacing), and whenever someone asks what rules you are operating under. Rules are not task-specific and are not skills: a skill loads only when its description matches the task, a rule applies always.",
+  {},
+  async () => {
+    const data = await apiGet(`/host/agent-rules?agent_id=${encodeURIComponent(AGT_AGENT_ID ?? "")}`);
+    if (!data.ok) {
+      return { content: [{ type: "text", text: "Could not read your standing rules." }], isError: true };
+    }
+    if (!data.rules.length) {
+      return {
+        content: [
+          { type: "text", text: `No standing rules yet. You can hold up to ${data.max}, each up to ${data.max_chars} characters.` }
+        ]
+      };
+    }
+    const lines = data.rules.map((r) => `- ${r.text}  (id: ${r.id})`).join("\n");
+    return {
+      content: [
+        { type: "text", text: `${data.rules.length} of ${data.max} standing rules in force:
+${lines}` }
+      ]
+    };
+  }
+);
+server.tool(
+  "rule_add",
+  'Turn a repeated instruction into a STANDING RULE that applies on every turn. Use when someone asks for the same thing more than once, or phrases it as a standing instruction ("always...", "every time...", "from now on..."). Propose it in plain language first and get a yes \u2014 never create one silently, and never make the person learn the word "skill" or "rule" to get it. Keep it SHORT: a rule is resident in your instructions on every single request, so if it needs more than a sentence it is really a skill (skill_create), which costs nothing until the task comes up. If you are already at the limit, pass replace_id with the id of the rule this one supersedes (rule_list shows the ids) \u2014 and tell the person what you dropped, in the same message. There is deliberately no way to remove a rule without adding one in its place: a rule that quietly stops applying is worse than one that was never made, because nobody notices.',
+  {
+    text: external_exports.string().describe("The rule, in the person's own words where possible. One sentence. It applies on every turn, so write it as a standing instruction rather than a task."),
+    replace_id: external_exports.string().optional().describe("The id of an existing rule this one replaces (from rule_list). Required once you are at the limit. The person MUST be told which rule was dropped, in the same reply.")
+  },
+  async (params) => {
+    const data = await apiPost("/host/agent-rules", {
+      agent_id: AGT_AGENT_ID,
+      text: params.text,
+      ...params.replace_id ? { replace_id: params.replace_id } : {}
+    });
+    if (!data.ok) {
+      return {
+        content: [{ type: "text", text: data.message ?? "Could not save that rule." }],
+        isError: true
+      };
+    }
+    const said = data.evicted ? `Added the rule. To make room I dropped: "${data.evicted.text}". Tell the person BOTH of these, not just the addition.` : `Added the rule: "${data.rule?.text}".`;
+    return { content: [{ type: "text", text: said }] };
+  }
+);
 server.tool(
   "knowledge_add",
   'Save a new durable fact or learning to the knowledge base. Use when the user explicitly asks you to save/remember something, or when you discover information that will be useful on future runs (e.g. a tenant id, an API key name, a company policy). Do NOT use for tasks (use kanban_add) or trivial one-off answers. Defaults to TEAM scope; pass scope:"org" only when the user asks for organization/company-wide knowledge (visible to every team in the org). Returns the new entry id so you can target it with knowledge_update / knowledge_delete.',
@@ -47037,6 +47207,11 @@ var LOCAL_TOOL_NAMES = /* @__PURE__ */ new Set([
   "kanban_reopen",
   // ENG-9375: the READ path over a teammate's board (counts only).
   "kanban_peek",
+  // ENG-9789: per-agent standing rules. No rule_remove by design — see the
+  // registration below; an agent may only displace a rule by naming it while
+  // adding another.
+  "rule_list",
+  "rule_add",
   // ENG-6953: agent + people directory lookup (always registered locally).
   "directory_lookup",
   "status_standup",
@@ -47398,21 +47573,36 @@ async function exportArtefactToFile(dir, artefactId, format, item) {
     // it, the gateway replaces our authored error with its opaque envelope and
     // we lose the ability to say whether the render landed.
     //
-    // NOT a readiness signal. Raising the budget does not make this caller able
-    // to consume ADR-0077's async response: the `data.base64` read just below
-    // has no branch for a `{ job_id }` body and would throw on one. So a fleet
-    // fully updated to this CLI is converged on the TIMEOUT and no more ready
-    // for the RESPONSE than before. The server's async path must stay dark for
-    // this route until job-response handling ships here (ENG-9729) — reading a
-    // published version number as evidence of a capability it does not carry is
-    // exactly the mistake this comment's first paragraph describes.
+    // ENG-9729 closed the readiness gap this comment used to describe: the
+    // response is now classified before anything reads `base64`, so a `{ job_id }`
+    // body is handled rather than thrown on. The budget above is what makes the
+    // server's ~20s grace window reachable from here at all.
+    //
+    // WHAT IS STILL NOT TRUE: a published CLI version is not convergence. This
+    // build can read a job body; the fleet is a mixed-version population and
+    // hosts update overnight, some never. The server's start lever
+    // (`artefact-export-jobs-start`) must therefore stay off until
+    // hosts.agt_version has been MEASURED — docs/runbooks/async-export-rollout.md
+    // — because arming it against an older CLI does not degrade an export, it
+    // throws a TypeError inside file-write logic, which is strictly worse than
+    // the 503 + Retry-After that build already understands.
     FORWARD_TOOL_CALL_TIMEOUT_MS
   );
+  const outcome = classifyExportResponse(data);
+  if (outcome.kind === "pending") {
+    return { kind: "pending", jobId: outcome.jobId, retryAfterMs: outcome.retryAfterMs };
+  }
   const fallback = `${artefactId}${item !== void 0 ? `-item-${item + 1}` : ""}.${format}`;
-  const filePath = join4(dir, safeDownloadName(data.filename, fallback));
-  const buf = Buffer.from(data.base64, "base64");
+  const filePath = join4(dir, safeDownloadName(outcome.body.filename, fallback));
+  const buf = Buffer.from(outcome.body.base64, "base64");
   await writeFile(filePath, buf);
-  return { path: filePath, bytes: buf.length, contentType: data.content_type, version: data.version };
+  return {
+    kind: "file",
+    path: filePath,
+    bytes: buf.length,
+    contentType: outcome.body.content_type,
+    version: outcome.body.version
+  };
 }
 async function resolveItemCountForPng(artefactId) {
   try {
@@ -47445,8 +47635,18 @@ async function downloadArtefactText(params) {
   const saved = [];
   let contentType = "";
   let version2 = 0;
-  for (const item of items) {
-    const r = await exportArtefactToFile(dir, params.artefact_id, params.format, item);
+  for (let i = 0; i < items.length; i++) {
+    const r = await exportArtefactToFile(dir, params.artefact_id, params.format, items[i]);
+    if (r.kind === "pending") {
+      return pendingExportText({
+        format: params.format,
+        saved: saved.map((f) => f.path),
+        totalItems: items.length,
+        pendingPosition: i + 1,
+        jobId: r.jobId,
+        retryAfterMs: r.retryAfterMs
+      });
+    }
     saved.push({ path: r.path, bytes: r.bytes });
     contentType = r.contentType;
     version2 = r.version;

package/dist/mcp/origami.js

@@ -42863,6 +42863,74 @@ var FLAG_REGISTRY = [
     // dominant callers. This is precisely the deliberate, audited flip ADR-0022
     // §4 reserves confirmation for.
     sensitive: true
+  },
+  {
+    key: "artefact-export-jobs-serve",
+    description: 'ADR-0077 / ENG-9729 \u2014 the MASTER switch for the async artefact-export lane. ON (default) = a route may resolve an export request to an artefact_export_jobs row: attach to one that is already rendering, or hand back the bytes of one that has completed. OFF = the job lane is invisible and every export renders synchronously, which is the pre-ADR-0077 behaviour. DEFAULT true DOES NOT MEAN ASYNC IS ON. Nothing CREATES a job unless artefact-export-jobs-start is also on, so with the shipped defaults this flag governs an empty table and no caller can tell it exists. WHY THE LANE IS TWO FLAGS AND NOT ONE. Disarming the start lever while renders are in flight must not strand the callers holding their job ids: those renders keep running (a Lambda invocation nobody awaits still runs to completion), and their bytes land in the private bucket regardless. A single flag would take the only door to them away at the moment it was most needed. So "stop creating new jobs" and "keep serving the ones that exist" are separate, and this is the second one. READ-ONLY BY CONSTRUCTION: with start off, the route looks up a REUSABLE row and nothing more \u2014 it never inserts, never requeues a terminal row, and never dispatches a renderer. A requeue mints an attempt and fires an invoke, so a serve lever that requeued would start new renders under a disarmed start lever, which is the exact thing disarming it was meant to stop. Evaluated server-side per request (org-scoped), so a flip applies within the evaluation cache TTL with no deploy and no host update. Deliberately NO envVar: the consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and a literal in sst.config.ts would pin every stage and make the admin control inert (ENG-8303).',
+    flagType: "boolean",
+    // ON is the no-op default here, which looks like the wrong direction until
+    // you read it with the start lever: serving an empty table is
+    // indistinguishable from not serving at all. Shipping it OFF would instead
+    // mean that arming async later takes TWO flips, and that the second one is
+    // the easy one to forget — leaving a fleet that creates jobs it refuses to
+    // serve, i.e. every slow export failing while the flag page reads "async: on".
+    defaultValue: true
+  },
+  {
+    key: "artefact-export-jobs-start",
+    description: "ADR-0077 / ENG-9729 \u2014 whether a route may CREATE an async artefact-export job: insert or requeue an artefact_export_jobs row, dispatch the worker, and answer a caller with a job id instead of bytes when the ~20s grace window is exceeded. OFF (default) = today's synchronous render on every export. THIS IS THE ROLLOUT GATE, AND IT IS ORDERED AGAINST A CLIENT, NOT A DEPLOY. The agent caller is `artefacts_download`, which ships inside the agt CLI to a permanently mixed-version fleet \u2014 hosts self-update overnight and some never do. Arming this against a CLI that cannot read a job-id body does not degrade an export, it BREAKS one: the pre-ENG-9729 tool does Buffer.from(data.base64) with no branch for any other shape, so a job id arrives as a TypeError deep in file-write logic. That is strictly worse than the 503 + Retry-After it would replace, which the tool already understands. A published CLI version is NOT evidence of convergence \u2014 measure hosts.agt_version across recently-seen hosts first. The procedure is docs/runbooks/async-export-rollout.md; arm this only after running it. Turning it back OFF stops new jobs and leaves artefact-export-jobs-serve delivering the in-flight ones, which is why the two are separate. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark. The client half of this change publishes with the same merge, and
+    // the fleet has not converged on it at merge time by construction — see the
+    // runbook. Arming is an operator action taken against a measurement.
+    defaultValue: false,
+    // Arming this changes the RESPONSE SHAPE of a route whose callers include a
+    // binary we do not control the version of. ADR-0022 section 4 reserves
+    // confirmation for exactly this: a flip that a single unguarded write should
+    // not be able to make.
+    sensitive: true,
+    // `since` USED SLIGHTLY OFF-LABEL, AND THAT IS THE POINT.
+    //
+    // The field's docblock says it records the CLI whose build first shipped
+    // this flag's HOST-SIDE READER, and this flag has none — it is evaluated
+    // server-side in the export route, so every host "honors" a flip the instant
+    // it is made. Read literally, `since` should therefore be undefined.
+    //
+    // Undefined is the dangerous answer. `classifyHostReach` returns `honors`
+    // for every host when `since` is unset, so the flip-reach modal — the screen
+    // an operator is looking at AT THE MOMENT OF THE FLIP — would report full
+    // reach for the one flag whose entire purpose is "do not flip this until you
+    // have measured the fleet". It would be telling the truth about the
+    // mechanism (the flip does reach every host immediately) while giving
+    // exactly the wrong answer to the question being asked (can those hosts
+    // survive it). The dependency is real; it is on the CLI's ability to SURVIVE
+    // the flag, not to READ it, and the modal cannot tell those apart.
+    //
+    // Pinned ABOVE every published release on purpose, the `agt-bin-path`
+    // precedent: it classifies EVERY host as `stale`, so the modal reports no
+    // reach rather than reach it has no basis for. A guessed number would be
+    // worse than a placeholder, and the two directions are not symmetric —
+    // too HIGH over-warns (annoying), too LOW promises reach to a build that
+    // answers a job id with a TypeError inside file-write logic (a broken export
+    // reported to the agent as "download failed").
+    //
+    // The exact version cannot be known here: the CLI auto-publishes ON MERGE of
+    // this change, patch-bumping from whatever is current, so any pre-merge
+    // value is a guess. Do NOT read it off `apps/cli/package.json`, and do NOT
+    // trust a version produced by re-running a failed publish job (ENG-9647: a
+    // re-run rebuilds the ORIGINAL tree under a HIGHER number, so the version
+    // string would claim a capability the bytes do not carry).
+    //
+    // AND `since` IS ADVISORY, NOT A GUARD. It is read in exactly one place —
+    // the flip-reach modal. Nothing in the evaluation or override-write path
+    // consults it, so this changes what an operator is TOLD and does not stop a
+    // flip on an under-`since` host. What holds the line is `defaultValue:
+    // false` + `sensitive: true` + the runbook.
+    //
+    // REPLACING IT IS STEP 1 OF THE ARMING PROCEDURE in
+    // docs/runbooks/async-export-rollout.md, so the placeholder has a named
+    // owner and a named moment rather than being a deferral nobody holds.
+    since: "0.29.0"
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));