@integrity-labs/agt-cli 0.28.773 → 0.28.774

package/dist/mcp/telegram-channel.js

@@ -37544,6 +37544,74 @@ var FLAG_REGISTRY = [
     // dominant callers. This is precisely the deliberate, audited flip ADR-0022
     // §4 reserves confirmation for.
     sensitive: true
+  },
+  {
+    key: "artefact-export-jobs-serve",
+    description: 'ADR-0077 / ENG-9729 \u2014 the MASTER switch for the async artefact-export lane. ON (default) = a route may resolve an export request to an artefact_export_jobs row: attach to one that is already rendering, or hand back the bytes of one that has completed. OFF = the job lane is invisible and every export renders synchronously, which is the pre-ADR-0077 behaviour. DEFAULT true DOES NOT MEAN ASYNC IS ON. Nothing CREATES a job unless artefact-export-jobs-start is also on, so with the shipped defaults this flag governs an empty table and no caller can tell it exists. WHY THE LANE IS TWO FLAGS AND NOT ONE. Disarming the start lever while renders are in flight must not strand the callers holding their job ids: those renders keep running (a Lambda invocation nobody awaits still runs to completion), and their bytes land in the private bucket regardless. A single flag would take the only door to them away at the moment it was most needed. So "stop creating new jobs" and "keep serving the ones that exist" are separate, and this is the second one. READ-ONLY BY CONSTRUCTION: with start off, the route looks up a REUSABLE row and nothing more \u2014 it never inserts, never requeues a terminal row, and never dispatches a renderer. A requeue mints an attempt and fires an invoke, so a serve lever that requeued would start new renders under a disarmed start lever, which is the exact thing disarming it was meant to stop. Evaluated server-side per request (org-scoped), so a flip applies within the evaluation cache TTL with no deploy and no host update. Deliberately NO envVar: the consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and a literal in sst.config.ts would pin every stage and make the admin control inert (ENG-8303).',
+    flagType: "boolean",
+    // ON is the no-op default here, which looks like the wrong direction until
+    // you read it with the start lever: serving an empty table is
+    // indistinguishable from not serving at all. Shipping it OFF would instead
+    // mean that arming async later takes TWO flips, and that the second one is
+    // the easy one to forget — leaving a fleet that creates jobs it refuses to
+    // serve, i.e. every slow export failing while the flag page reads "async: on".
+    defaultValue: true
+  },
+  {
+    key: "artefact-export-jobs-start",
+    description: "ADR-0077 / ENG-9729 \u2014 whether a route may CREATE an async artefact-export job: insert or requeue an artefact_export_jobs row, dispatch the worker, and answer a caller with a job id instead of bytes when the ~20s grace window is exceeded. OFF (default) = today's synchronous render on every export. THIS IS THE ROLLOUT GATE, AND IT IS ORDERED AGAINST A CLIENT, NOT A DEPLOY. The agent caller is `artefacts_download`, which ships inside the agt CLI to a permanently mixed-version fleet \u2014 hosts self-update overnight and some never do. Arming this against a CLI that cannot read a job-id body does not degrade an export, it BREAKS one: the pre-ENG-9729 tool does Buffer.from(data.base64) with no branch for any other shape, so a job id arrives as a TypeError deep in file-write logic. That is strictly worse than the 503 + Retry-After it would replace, which the tool already understands. A published CLI version is NOT evidence of convergence \u2014 measure hosts.agt_version across recently-seen hosts first. The procedure is docs/runbooks/async-export-rollout.md; arm this only after running it. Turning it back OFF stops new jobs and leaves artefact-export-jobs-serve delivering the in-flight ones, which is why the two are separate. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark. The client half of this change publishes with the same merge, and
+    // the fleet has not converged on it at merge time by construction — see the
+    // runbook. Arming is an operator action taken against a measurement.
+    defaultValue: false,
+    // Arming this changes the RESPONSE SHAPE of a route whose callers include a
+    // binary we do not control the version of. ADR-0022 section 4 reserves
+    // confirmation for exactly this: a flip that a single unguarded write should
+    // not be able to make.
+    sensitive: true,
+    // `since` USED SLIGHTLY OFF-LABEL, AND THAT IS THE POINT.
+    //
+    // The field's docblock says it records the CLI whose build first shipped
+    // this flag's HOST-SIDE READER, and this flag has none — it is evaluated
+    // server-side in the export route, so every host "honors" a flip the instant
+    // it is made. Read literally, `since` should therefore be undefined.
+    //
+    // Undefined is the dangerous answer. `classifyHostReach` returns `honors`
+    // for every host when `since` is unset, so the flip-reach modal — the screen
+    // an operator is looking at AT THE MOMENT OF THE FLIP — would report full
+    // reach for the one flag whose entire purpose is "do not flip this until you
+    // have measured the fleet". It would be telling the truth about the
+    // mechanism (the flip does reach every host immediately) while giving
+    // exactly the wrong answer to the question being asked (can those hosts
+    // survive it). The dependency is real; it is on the CLI's ability to SURVIVE
+    // the flag, not to READ it, and the modal cannot tell those apart.
+    //
+    // Pinned ABOVE every published release on purpose, the `agt-bin-path`
+    // precedent: it classifies EVERY host as `stale`, so the modal reports no
+    // reach rather than reach it has no basis for. A guessed number would be
+    // worse than a placeholder, and the two directions are not symmetric —
+    // too HIGH over-warns (annoying), too LOW promises reach to a build that
+    // answers a job id with a TypeError inside file-write logic (a broken export
+    // reported to the agent as "download failed").
+    //
+    // The exact version cannot be known here: the CLI auto-publishes ON MERGE of
+    // this change, patch-bumping from whatever is current, so any pre-merge
+    // value is a guess. Do NOT read it off `apps/cli/package.json`, and do NOT
+    // trust a version produced by re-running a failed publish job (ENG-9647: a
+    // re-run rebuilds the ORIGINAL tree under a HIGHER number, so the version
+    // string would claim a capability the bytes do not carry).
+    //
+    // AND `since` IS ADVISORY, NOT A GUARD. It is read in exactly one place —
+    // the flip-reach modal. Nothing in the evaluation or override-write path
+    // consults it, so this changes what an operator is TOLD and does not stop a
+    // flip on an under-`since` host. What holds the line is `defaultValue:
+    // false` + `sensitive: true` + the runbook.
+    //
+    // REPLACING IT IS STEP 1 OF THE ARMING PROCEDURE in
+    // docs/runbooks/async-export-rollout.md, so the placeholder has a named
+    // owner and a named moment rather than being a deferral nobody holds.
+    since: "0.29.0"
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/{persistent-session-E4AHQHRA.js → persistent-session-C2Y4CSAY.js}

@@ -49,8 +49,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-UL2W5NY6.js";
-import "./chunk-75UAJFJJ.js";
+} from "./chunk-SXTHAF3R.js";
+import "./chunk-PMKI7ZTP.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -104,4 +104,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-E4AHQHRA.js.map
+//# sourceMappingURL=persistent-session-C2Y4CSAY.js.map

package/dist/{responsiveness-probe-EN6IOLBG.js → responsiveness-probe-7CVB5NBT.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-UL2W5NY6.js";
-import "./chunk-75UAJFJJ.js";
+} from "./chunk-SXTHAF3R.js";
+import "./chunk-PMKI7ZTP.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -745,4 +745,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-EN6IOLBG.js.map
+//# sourceMappingURL=responsiveness-probe-7CVB5NBT.js.map

package/dist/{session-auth-dead-LNYMXEHY.js → session-auth-dead-E3WEZYEH.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-75UAJFJJ.js";
+} from "./chunk-PMKI7ZTP.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-LNYMXEHY.js.map
+//# sourceMappingURL=session-auth-dead-E3WEZYEH.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.773",
+  "version": "0.28.774",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {