@integrity-labs/agt-cli 0.28.779 → 0.28.781

package/dist/mcp/direct-chat-channel.js

@@ -37660,6 +37660,27 @@ var FLAG_REGISTRY = [
     // docs/runbooks/async-export-rollout.md, so the placeholder has a named
     // owner and a named moment rather than being a deferral nobody holds.
     since: "0.29.0"
+  },
+  {
+    key: "artefact-export-public-jobs",
+    description: "ADR-0077 / ENG-9730 - whether the PUBLIC Download button may create an async artefact-export job. OFF (default) = today's synchronous render on the public route. SEPARATE FROM artefact-export-jobs-start ON PURPOSE, and the reason is the whole point of the flag. That one is ordered against the agt CLI fleet: a pre-ENG-9729 agent cannot read a job-id body, so arming it early BREAKS an export. This lane's client is a BROWSER, which has no version to converge on - the waiting page is generated fresh by the server on every request. Sharing one lever would hold the customer-facing half hostage to an agent-side constraint that does not apply to it. Note what this flag does NOT gate: a navigation always gets HTML rather than a JSON error body. That is the fix for a live defect (a renderer outage used to navigate a reader off their document to a raw error) and is not conditional on async. Reading artefact-export-jobs-serve as an AND still applies - the master switch turns off both lanes. ONE CHECK BEFORE ARMING, and it is not fleet convergence: the lane assumes a browser NAVIGATES to the waiting page rather than saving it, which holds because the cross-origin download attribute is ignored. Documented for Chrome/Firefox/ WebKit, but unverified on a real Safari - and a phone is where a contract link gets opened. Run the desktop+iOS Safari smoke check in the runbook first. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark, like every other lane in this ADR. What it changes is real - a slow
+    // render stops completing in place and starts arriving via a waiting page -
+    // so it wants a deliberate flip per tenant, not a deploy-time default.
+    defaultValue: false
+    // Deliberately NOT sensitive, and the contrast with artefact-export-jobs-start
+    // is the argument. That flag is `sensitive` because arming it can hand a job
+    // id to a binary that answers with a TypeError - an unguarded write breaks a
+    // caller we do not control. Here the worst case is a reader seeing an
+    // explanatory page a few seconds sooner than they otherwise would, on a
+    // client that is re-served from this deploy on every request. Marking it
+    // sensitive would spend a confirmation step on a reversible display change
+    // and blunt the signal on the flags where confirmation is load-bearing.
+    //
+    // No `since` for the same reason: there is no host-side reader and no fleet
+    // to converge, so `classifyHostReach` returning `honors` for every host is
+    // the literal truth here rather than the trap it is one flag above.
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/index.js

@@ -44709,6 +44709,27 @@ var FLAG_REGISTRY = [
     // docs/runbooks/async-export-rollout.md, so the placeholder has a named
     // owner and a named moment rather than being a deferral nobody holds.
     since: "0.29.0"
+  },
+  {
+    key: "artefact-export-public-jobs",
+    description: "ADR-0077 / ENG-9730 - whether the PUBLIC Download button may create an async artefact-export job. OFF (default) = today's synchronous render on the public route. SEPARATE FROM artefact-export-jobs-start ON PURPOSE, and the reason is the whole point of the flag. That one is ordered against the agt CLI fleet: a pre-ENG-9729 agent cannot read a job-id body, so arming it early BREAKS an export. This lane's client is a BROWSER, which has no version to converge on - the waiting page is generated fresh by the server on every request. Sharing one lever would hold the customer-facing half hostage to an agent-side constraint that does not apply to it. Note what this flag does NOT gate: a navigation always gets HTML rather than a JSON error body. That is the fix for a live defect (a renderer outage used to navigate a reader off their document to a raw error) and is not conditional on async. Reading artefact-export-jobs-serve as an AND still applies - the master switch turns off both lanes. ONE CHECK BEFORE ARMING, and it is not fleet convergence: the lane assumes a browser NAVIGATES to the waiting page rather than saving it, which holds because the cross-origin download attribute is ignored. Documented for Chrome/Firefox/ WebKit, but unverified on a real Safari - and a phone is where a contract link gets opened. Run the desktop+iOS Safari smoke check in the runbook first. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark, like every other lane in this ADR. What it changes is real - a slow
+    // render stops completing in place and starts arriving via a waiting page -
+    // so it wants a deliberate flip per tenant, not a deploy-time default.
+    defaultValue: false
+    // Deliberately NOT sensitive, and the contrast with artefact-export-jobs-start
+    // is the argument. That flag is `sensitive` because arming it can hand a job
+    // id to a binary that answers with a TypeError - an unguarded write breaks a
+    // caller we do not control. Here the worst case is a reader seeing an
+    // explanatory page a few seconds sooner than they otherwise would, on a
+    // client that is re-served from this deploy on every request. Marking it
+    // sensitive would spend a confirmation step on a reversible display change
+    // and blunt the signal on the flags where confirmation is load-bearing.
+    //
+    // No `since` for the same reason: there is no host-side reader and no fleet
+    // to converge, so `classifyHostReach` returning `honors` for every host is
+    // the literal truth here rather than the trap it is one flag above.
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/origami.js

@@ -43384,6 +43384,27 @@ var FLAG_REGISTRY = [
     // docs/runbooks/async-export-rollout.md, so the placeholder has a named
     // owner and a named moment rather than being a deferral nobody holds.
     since: "0.29.0"
+  },
+  {
+    key: "artefact-export-public-jobs",
+    description: "ADR-0077 / ENG-9730 - whether the PUBLIC Download button may create an async artefact-export job. OFF (default) = today's synchronous render on the public route. SEPARATE FROM artefact-export-jobs-start ON PURPOSE, and the reason is the whole point of the flag. That one is ordered against the agt CLI fleet: a pre-ENG-9729 agent cannot read a job-id body, so arming it early BREAKS an export. This lane's client is a BROWSER, which has no version to converge on - the waiting page is generated fresh by the server on every request. Sharing one lever would hold the customer-facing half hostage to an agent-side constraint that does not apply to it. Note what this flag does NOT gate: a navigation always gets HTML rather than a JSON error body. That is the fix for a live defect (a renderer outage used to navigate a reader off their document to a raw error) and is not conditional on async. Reading artefact-export-jobs-serve as an AND still applies - the master switch turns off both lanes. ONE CHECK BEFORE ARMING, and it is not fleet convergence: the lane assumes a browser NAVIGATES to the waiting page rather than saving it, which holds because the cross-origin download attribute is ignored. Documented for Chrome/Firefox/ WebKit, but unverified on a real Safari - and a phone is where a contract link gets opened. Run the desktop+iOS Safari smoke check in the runbook first. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark, like every other lane in this ADR. What it changes is real - a slow
+    // render stops completing in place and starts arriving via a waiting page -
+    // so it wants a deliberate flip per tenant, not a deploy-time default.
+    defaultValue: false
+    // Deliberately NOT sensitive, and the contrast with artefact-export-jobs-start
+    // is the argument. That flag is `sensitive` because arming it can hand a job
+    // id to a binary that answers with a TypeError - an unguarded write breaks a
+    // caller we do not control. Here the worst case is a reader seeing an
+    // explanatory page a few seconds sooner than they otherwise would, on a
+    // client that is re-served from this deploy on every request. Marking it
+    // sensitive would spend a confirmation step on a reversible display change
+    // and blunt the signal on the flags where confirmation is load-bearing.
+    //
+    // No `since` for the same reason: there is no host-side reader and no fleet
+    // to converge, so `classifyHostReach` returning `honors` for every host is
+    // the literal truth here rather than the trap it is one flag above.
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/slack-channel.js

@@ -37907,6 +37907,27 @@ var FLAG_REGISTRY = [
     // docs/runbooks/async-export-rollout.md, so the placeholder has a named
     // owner and a named moment rather than being a deferral nobody holds.
     since: "0.29.0"
+  },
+  {
+    key: "artefact-export-public-jobs",
+    description: "ADR-0077 / ENG-9730 - whether the PUBLIC Download button may create an async artefact-export job. OFF (default) = today's synchronous render on the public route. SEPARATE FROM artefact-export-jobs-start ON PURPOSE, and the reason is the whole point of the flag. That one is ordered against the agt CLI fleet: a pre-ENG-9729 agent cannot read a job-id body, so arming it early BREAKS an export. This lane's client is a BROWSER, which has no version to converge on - the waiting page is generated fresh by the server on every request. Sharing one lever would hold the customer-facing half hostage to an agent-side constraint that does not apply to it. Note what this flag does NOT gate: a navigation always gets HTML rather than a JSON error body. That is the fix for a live defect (a renderer outage used to navigate a reader off their document to a raw error) and is not conditional on async. Reading artefact-export-jobs-serve as an AND still applies - the master switch turns off both lanes. ONE CHECK BEFORE ARMING, and it is not fleet convergence: the lane assumes a browser NAVIGATES to the waiting page rather than saving it, which holds because the cross-origin download attribute is ignored. Documented for Chrome/Firefox/ WebKit, but unverified on a real Safari - and a phone is where a contract link gets opened. Run the desktop+iOS Safari smoke check in the runbook first. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark, like every other lane in this ADR. What it changes is real - a slow
+    // render stops completing in place and starts arriving via a waiting page -
+    // so it wants a deliberate flip per tenant, not a deploy-time default.
+    defaultValue: false
+    // Deliberately NOT sensitive, and the contrast with artefact-export-jobs-start
+    // is the argument. That flag is `sensitive` because arming it can hand a job
+    // id to a binary that answers with a TypeError - an unguarded write breaks a
+    // caller we do not control. Here the worst case is a reader seeing an
+    // explanatory page a few seconds sooner than they otherwise would, on a
+    // client that is re-served from this deploy on every request. Marking it
+    // sensitive would spend a confirmation step on a reversible display change
+    // and blunt the signal on the flags where confirmation is load-bearing.
+    //
+    // No `since` for the same reason: there is no host-side reader and no fleet
+    // to converge, so `classifyHostReach` returning `honors` for every host is
+    // the literal truth here rather than the trap it is one flag above.
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/telegram-channel.js

@@ -38065,6 +38065,27 @@ var FLAG_REGISTRY = [
     // docs/runbooks/async-export-rollout.md, so the placeholder has a named
     // owner and a named moment rather than being a deferral nobody holds.
     since: "0.29.0"
+  },
+  {
+    key: "artefact-export-public-jobs",
+    description: "ADR-0077 / ENG-9730 - whether the PUBLIC Download button may create an async artefact-export job. OFF (default) = today's synchronous render on the public route. SEPARATE FROM artefact-export-jobs-start ON PURPOSE, and the reason is the whole point of the flag. That one is ordered against the agt CLI fleet: a pre-ENG-9729 agent cannot read a job-id body, so arming it early BREAKS an export. This lane's client is a BROWSER, which has no version to converge on - the waiting page is generated fresh by the server on every request. Sharing one lever would hold the customer-facing half hostage to an agent-side constraint that does not apply to it. Note what this flag does NOT gate: a navigation always gets HTML rather than a JSON error body. That is the fix for a live defect (a renderer outage used to navigate a reader off their document to a raw error) and is not conditional on async. Reading artefact-export-jobs-serve as an AND still applies - the master switch turns off both lanes. ONE CHECK BEFORE ARMING, and it is not fleet convergence: the lane assumes a browser NAVIGATES to the waiting page rather than saving it, which holds because the cross-origin download attribute is ignored. Documented for Chrome/Firefox/ WebKit, but unverified on a real Safari - and a phone is where a contract link gets opened. Run the desktop+iOS Safari smoke check in the runbook first. Org-scoped, so it can be armed for one tenant at a time. Deliberately NO envVar (ENG-7972 4KB cap, ENG-8303 pin).",
+    flagType: "boolean",
+    // Dark, like every other lane in this ADR. What it changes is real - a slow
+    // render stops completing in place and starts arriving via a waiting page -
+    // so it wants a deliberate flip per tenant, not a deploy-time default.
+    defaultValue: false
+    // Deliberately NOT sensitive, and the contrast with artefact-export-jobs-start
+    // is the argument. That flag is `sensitive` because arming it can hand a job
+    // id to a binary that answers with a TypeError - an unguarded write breaks a
+    // caller we do not control. Here the worst case is a reader seeing an
+    // explanatory page a few seconds sooner than they otherwise would, on a
+    // client that is re-served from this deploy on every request. Marking it
+    // sensitive would spend a confirmation step on a reversible display change
+    // and blunt the signal on the flags where confirmation is load-bearing.
+    //
+    // No `since` for the same reason: there is no host-side reader and no fleet
+    // to converge, so `classifyHostReach` returning `honors` for every host is
+    // the literal truth here rather than the trap it is one flag above.
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/{persistent-session-GHIBAWHI.js → persistent-session-PX5UJ3WY.js}

@@ -49,8 +49,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-NTWABPKO.js";
-import "./chunk-LLBJLKGL.js";
+} from "./chunk-YA5PGNN2.js";
+import "./chunk-TNETRPYC.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -104,4 +104,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-GHIBAWHI.js.map
+//# sourceMappingURL=persistent-session-PX5UJ3WY.js.map

package/dist/{responsiveness-probe-TT3LAALK.js → responsiveness-probe-U4BEPPKX.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-NTWABPKO.js";
-import "./chunk-LLBJLKGL.js";
+} from "./chunk-YA5PGNN2.js";
+import "./chunk-TNETRPYC.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -745,4 +745,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-TT3LAALK.js.map
+//# sourceMappingURL=responsiveness-probe-U4BEPPKX.js.map

package/dist/{session-auth-dead-OHPGSHYL.js → session-auth-dead-2TLMBIM6.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-LLBJLKGL.js";
+} from "./chunk-TNETRPYC.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-OHPGSHYL.js.map
+//# sourceMappingURL=session-auth-dead-2TLMBIM6.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.779",
+  "version": "0.28.781",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {