@integrity-labs/agt-cli 0.28.797 → 0.28.799

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-BLPEFF5R.js";
+} from "../chunk-BPAGPPAN.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-KGOED2L3.js";
+} from "../chunk-M3IVSY6S.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-ZL7RC5VO.js";
+} from "../chunk-XEPLW5LY.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.797" : "dev";
+var cliVersion = true ? "0.28.799" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.797" : "dev";
+var cliVersion2 = true ? "0.28.799" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-BLPEFF5R.js → chunk-BPAGPPAN.js}

@@ -14,7 +14,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-KGOED2L3.js";
+} from "./chunk-M3IVSY6S.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -69,7 +69,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-ZL7RC5VO.js";
+} from "./chunk-XEPLW5LY.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6521,7 +6521,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.797" : "dev";
+var agtCliVersion = true ? "0.28.799" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10765,4 +10765,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-BLPEFF5R.js.map
+//# sourceMappingURL=chunk-BPAGPPAN.js.map

package/dist/{chunk-KGOED2L3.js → chunk-M3IVSY6S.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-ZL7RC5VO.js";
+} from "./chunk-XEPLW5LY.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5166,4 +5166,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-KGOED2L3.js.map
+//# sourceMappingURL=chunk-M3IVSY6S.js.map

package/dist/{chunk-ZL7RC5VO.js → chunk-XEPLW5LY.js}

@@ -5412,6 +5412,23 @@ var FLAG_REGISTRY = [
     // the flip is a deliberate, confirmed one (ADR-0022 sensitive-flag confirm).
     sensitive: true
   },
+  {
+    key: "org-email-domain-derivation",
+    description: "Auto-derive an organization's own email domain from its members' signup addresses (ENG-9888) and add it to organization_email_domains already verified, so email.domain_restrict's internal_only mode has the allow set it resolves against. Without a verified domain internal_only is a runtime no-op (an empty allow set would block every send), which was the live state for 22 of 23 orgs while the console showed the strictest egress mode. Server-side only \u2014 the API derives lazily when the guard finds no verified domain; there is no host-side reader, hence no envVar. Flipping this ON is the backfill: derivation runs per-org on first need rather than as a batch job, and the vendor-domain exclusion is what stops the six orgs whose earliest member is a staff account from being given integritylabs.dev.",
+    flagType: "boolean",
+    // Ships dark. The safe value is `false` (derive nothing) because arming this
+    // gives internal_only a real allow set, which CHANGES what the guard evaluates
+    // for every org it touches — and not only the guard: getVerifiedOrgEmailDomains
+    // also feeds the Linear customer-need linker and the support/host-runtime
+    // prompts, so a row appearing is visible beyond the send path. A flag-read
+    // error must never start writing verified domains on its own.
+    defaultValue: false,
+    // Arming it makes a previously-inert egress control start evaluating, so the
+    // flip wants a deliberate confirm rather than a casual toggle. Before flipping,
+    // check which orgs sit at the `enforce` / `require_approval` email-guard stage:
+    // those are the ones where a newly-effective policy can reach a real block.
+    sensitive: true
+  },
   {
     key: "memory-extraction",
     description: "Host-side durable-memory extraction (ENG-6200): the manager extracts candidate memories from completed conversations and POSTs them to /host/memories/candidates, which writes dream_log via promoteCandidates. Post persistent-session cutover this is the ONLY live consolidation path. Boolean gate; ships dark \u2014 when off the manager runs no extraction, so 0 dream_log rows fleet-wide is the expected steady state until it is armed.",
@@ -13613,4 +13630,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-ZL7RC5VO.js.map
+//# sourceMappingURL=chunk-XEPLW5LY.js.map