@integrity-labs/agt-cli 0.28.806 → 0.28.807

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-7TIQODEK.js";
+} from "../chunk-SHQCTBFE.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-TWZFTSGP.js";
+} from "../chunk-GIV6ORI3.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-RMBASAMS.js";
+} from "../chunk-VK35F6O7.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.806" : "dev";
+var cliVersion = true ? "0.28.807" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.806" : "dev";
+var cliVersion2 = true ? "0.28.807" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-TWZFTSGP.js → chunk-GIV6ORI3.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-RMBASAMS.js";
+} from "./chunk-VK35F6O7.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5209,4 +5209,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-TWZFTSGP.js.map
+//# sourceMappingURL=chunk-GIV6ORI3.js.map

package/dist/{chunk-7TIQODEK.js → chunk-SHQCTBFE.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-TWZFTSGP.js";
+} from "./chunk-GIV6ORI3.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -71,7 +71,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-RMBASAMS.js";
+} from "./chunk-VK35F6O7.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6523,7 +6523,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.806" : "dev";
+var agtCliVersion = true ? "0.28.807" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10818,4 +10818,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-7TIQODEK.js.map
+//# sourceMappingURL=chunk-SHQCTBFE.js.map

package/dist/{chunk-RMBASAMS.js → chunk-VK35F6O7.js}

@@ -6041,6 +6041,26 @@ var FLAG_REGISTRY = [
     // env var is retired.
     envVar: "AUGMENTED_CONNECTIVITY_ESCALATION_ENABLED"
   },
+  {
+    key: "slack-manifest-remediate",
+    description: "Let the Slack manifest drift monitor PUSH, not just alert (ENG-9963). updateSlackManifest had exactly one caller \u2014 a console button \u2014 so nothing but a human click ever pushed a manifest; ENG-7762 changed the generator with no rollout mechanism and 26 agents went 53 days with no working per-agent slash commands. When on, the daily drift cron pushes the generated manifest for a drifted agent. When off it alerts exactly as before. NOTE what arming this authorises: a push REPLACES a customer-owned Slack app's entire manifest, so the cron only ever pushes drift whose diffs are purely additive (isSafelyRemediable) \u2014 an app with live-only entries a push would destroy is declined and left for a human. Boolean gate; ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` (alert-only), matching the cron's compiled
+    // default. The fail-safe direction is the opposite of a paging gate's and
+    // matters more: a flag-DB read error must never authorise a WRITE to a
+    // customer's Slack app.
+    defaultValue: false,
+    // Operator override, same precedence and vocabulary as the connectivity
+    // escalation gate above, so an operator who knows one knows both.
+    envVar: "AUGMENTED_SLACK_MANIFEST_REMEDIATE_ENABLED",
+    // ADR-0022 §4. NOTE this is where it diverges from the connectivity gate it
+    // otherwise mirrors, and the divergence is the point: arming THAT one only
+    // causes alerts to open, while arming THIS one authorises a cron to REPLACE
+    // manifests on customer-owned Slack apps. That is precisely the class the
+    // sensitive marker exists for — a control whose relaxation should not be one
+    // unguarded write away.
+    sensitive: true
+  },
   {
     key: "integration-reauth-reminders",
     description: "Re-notify an integration that stays in needs_reauth (ENG-8370). Failure notification is at-most-once PER TRANSITION, so an integration nobody repairs is announced once and then silent forever - prod carried a row failing every 30-minute tick for ~21 days on a single day-one notification. When on, the IntegrationReauthReminder cron re-fires the existing reconnect notification on a backoff measured from failure ONSET (+1d, +3d, +7d, then weekly), skipping rows an operator has muted. When off the cron still scans and logs what it WOULD have sent, so the volume can be sized before anyone is messaged. Boolean gate; ships dark.",
@@ -13687,4 +13707,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-RMBASAMS.js.map
+//# sourceMappingURL=chunk-VK35F6O7.js.map