@integrity-labs/agt-cli 0.28.796 → 0.28.798

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-EPFWARON.js";
+} from "../chunk-OAMCPYXK.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-L474SPDE.js";
+} from "../chunk-3GA3RMTS.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-NTRKYVCG.js";
+} from "../chunk-CAH2TFA6.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.796" : "dev";
+var cliVersion = true ? "0.28.798" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.796" : "dev";
+var cliVersion2 = true ? "0.28.798" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-L474SPDE.js → chunk-3GA3RMTS.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-NTRKYVCG.js";
+} from "./chunk-CAH2TFA6.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5166,4 +5166,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-L474SPDE.js.map
+//# sourceMappingURL=chunk-3GA3RMTS.js.map

package/dist/{chunk-NTRKYVCG.js → chunk-CAH2TFA6.js}

@@ -5412,6 +5412,23 @@ var FLAG_REGISTRY = [
     // the flip is a deliberate, confirmed one (ADR-0022 sensitive-flag confirm).
     sensitive: true
   },
+  {
+    key: "org-email-domain-derivation",
+    description: "Auto-derive an organization's own email domain from its members' signup addresses (ENG-9888) and add it to organization_email_domains already verified, so email.domain_restrict's internal_only mode has the allow set it resolves against. Without a verified domain internal_only is a runtime no-op (an empty allow set would block every send), which was the live state for 22 of 23 orgs while the console showed the strictest egress mode. Server-side only \u2014 the API derives lazily when the guard finds no verified domain; there is no host-side reader, hence no envVar. Flipping this ON is the backfill: derivation runs per-org on first need rather than as a batch job, and the vendor-domain exclusion is what stops the six orgs whose earliest member is a staff account from being given integritylabs.dev.",
+    flagType: "boolean",
+    // Ships dark. The safe value is `false` (derive nothing) because arming this
+    // gives internal_only a real allow set, which CHANGES what the guard evaluates
+    // for every org it touches — and not only the guard: getVerifiedOrgEmailDomains
+    // also feeds the Linear customer-need linker and the support/host-runtime
+    // prompts, so a row appearing is visible beyond the send path. A flag-read
+    // error must never start writing verified domains on its own.
+    defaultValue: false,
+    // Arming it makes a previously-inert egress control start evaluating, so the
+    // flip wants a deliberate confirm rather than a casual toggle. Before flipping,
+    // check which orgs sit at the `enforce` / `require_approval` email-guard stage:
+    // those are the ones where a newly-effective policy can reach a real block.
+    sensitive: true
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",
@@ -11115,6 +11132,21 @@ async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch) {
   }
 }
 
+// ../../packages/core/dist/integrations/probe-path.js
+var PROBE_TOOLKIT_PATH_DIRS = [
+  "/home/linuxbrew/.linuxbrew/bin",
+  "/opt/homebrew/bin"
+];
+var PROBE_HOME_RELATIVE_PATH_SEGMENTS = [".local/bin"];
+var PROBE_SYSTEM_PATH_FLOOR = [
+  "/usr/local/sbin",
+  "/usr/local/bin",
+  "/usr/sbin",
+  "/usr/bin",
+  "/sbin",
+  "/bin"
+];
+
 // ../../packages/core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {
   url: "AGT_REMOTE_MCP_URL",
@@ -13504,6 +13536,9 @@ export {
   probeComposioAccount,
   probeComposioMcpToolCall,
   probeHttpProvider,
+  PROBE_TOOLKIT_PATH_DIRS,
+  PROBE_HOME_RELATIVE_PATH_SEGMENTS,
+  PROBE_SYSTEM_PATH_FLOOR,
   REMOTE_MCP_PROXY_ENV,
   readRemoteMcpAuthConfig,
   buildForwardHeaders,
@@ -13595,4 +13630,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-NTRKYVCG.js.map
+//# sourceMappingURL=chunk-CAH2TFA6.js.map