@integrity-labs/agt-cli 0.28.815 → 0.28.816

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-47VV63KT.js";
+} from "../chunk-PNHF5TJN.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-UQKTHEYS.js";
+} from "../chunk-5RZBTMBD.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-7DTMJSAF.js";
+} from "../chunk-SZ47B4KO.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.815" : "dev";
+var cliVersion = true ? "0.28.816" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.815" : "dev";
+var cliVersion2 = true ? "0.28.816" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-UQKTHEYS.js → chunk-5RZBTMBD.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-7DTMJSAF.js";
+} from "./chunk-SZ47B4KO.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5209,4 +5209,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-UQKTHEYS.js.map
+//# sourceMappingURL=chunk-5RZBTMBD.js.map

package/dist/{chunk-47VV63KT.js → chunk-PNHF5TJN.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-UQKTHEYS.js";
+} from "./chunk-5RZBTMBD.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -71,7 +71,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-7DTMJSAF.js";
+} from "./chunk-SZ47B4KO.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6523,7 +6523,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.815" : "dev";
+var agtCliVersion = true ? "0.28.816" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10818,4 +10818,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-47VV63KT.js.map
+//# sourceMappingURL=chunk-PNHF5TJN.js.map

package/dist/{chunk-7DTMJSAF.js → chunk-SZ47B4KO.js}

@@ -386,16 +386,15 @@ function shouldWarnClaudeMdOverBudget(codeName, size, nowMs = Date.now()) {
 function buildMemorySection() {
   const recall = `### Recall
 
-Before answering questions about past work, decisions, or preferences, **search
-first with \`context_search\`** \u2014 semantic search over knowledge, memories and past
-tasks. It reaches everything you have written; reading \`MEMORY.md\` and today's log
-only reaches what you already thought to look for. Fall back to those files
-directly if the search returns nothing.
+**Search first with \`context_search\`** \u2014 semantic search over knowledge, memories
+and past tasks. Search before answering questions about past work, decisions or
+preferences, and before ACTING where a stored preference could set a default:
+filing a ticket, sending a message. \`MEMORY.md\` and today's log reach only what
+you already thought to look for; fall back to them if it finds nothing.
 `;
   return `## Memory
 
-A file-based memory system \u2014 persist important information so future sessions have
-context. Two Markdown file types:
+Persist what future sessions will need. Two Markdown file types:
 
 1. **Daily logs** (\`memory/YYYY-MM-DD.md\`): append-only operational notes for the
    day \u2014 what you worked on, decisions, blockers, outcomes. New file each day.
@@ -5463,6 +5462,29 @@ var FLAG_REGISTRY = [
     // which is the ADR-0022 sensitive-flag shape.
     sensitive: true
   },
+  {
+    key: "host-alarm-reconciler-repair",
+    description: "Arms the CREATE and DRIFT-REPAIR halves of the ENG-8325 host-alarm reconciler. The cron computes and LOGS the full diff for every host on every run regardless of this flag, on the host-poll-rate-alarm precedent, so the fleet diff is measurable before anything mutates. Off = measure and log, create nothing and re-put nothing. Evaluated PER ORGANIZATION from the host row, so arming can be staged one org at a time and watched. It does NOT gate the reap - see host-alarm-reconciler-reap, which is deliberately fleet-wide because an orphan alarm whose host row is gone has no organization to scope by. AGT_HOST_ALARM_RECONCILER_APPLY outranks this flag and forces BOTH gates on fleet-wide; it is deliberately not declared as this flag's envVar, because it is a master override of two flags rather than the operator override of this one. Boolean gate; ships dark. Evaluated API-side, in the cron.",
+    flagType: "boolean",
+    // Safe value is `false` for a specific reason, not a habitual one: the
+    // first applying run creates one alarm per host that lacks one, and a
+    // PutMetricAlarm on a fleet whose expected set is wrong is not a no-op you
+    // can shrug off - it is monitoring that now exists and will page.
+    defaultValue: false,
+    // It mutates CloudWatch for every host in the armed org, which is the
+    // ADR-0022 sensitive-flag shape.
+    sensitive: true
+  },
+  {
+    key: "host-alarm-reconciler-reap",
+    description: "Arms the REAP half of the ENG-8325 host-alarm reconciler: deleting alarms under augmented/{env}/host/ whose parsed host id is not in the live set. Off = count and name the orphan candidates, delete nothing. DELIBERATELY EVALUATED GLOBALLY, with no organization scope, and that is not an oversight to be tidied up later. An orphan is defined as an alarm whose host id resolves to no live host; where the host row is gone entirely there is no organization to scope by, so the property that makes an alarm an orphan is the same one that makes it unattributable. A per-org gate here would silently reap other orgs' orphans the moment any one org was armed, which is staged creates with an unstaged reap - the more dangerous half. AGT_HOST_ALARM_RECONCILER_APPLY outranks this flag and forces both gates on. Boolean gate; ships dark. Evaluated API-side, in the cron.",
+    flagType: "boolean",
+    // The destructive half. Measured on prod 2026-09-03: a first applying run
+    // deletes 84 alarms across 33 dead instance ids. Nothing about that is
+    // recoverable by re-running, so the safe value is not a formality.
+    defaultValue: false,
+    sensitive: true
+  },
   {
     key: "agt-version-drift-alarm",
     description: "Arms the ENG-8341 agt CLI version-drift alert. When a host has fallen behind its EFFECTIVE target (env pin > DB pin > release channel) across two or more of its OWN maintenance windows, the monitor opens a host_agt_version_drift alert. OBSERVE-FIRST rollout gate: the cron computes and LOGS the drift for every host on every run regardless of this flag, so the real fleet spread is measurable before anyone is paged - the ticket asks for the threshold to be set from observed data rather than a guess. Off = compute and log, open nothing. Boolean gate; ships dark. Evaluated API-side, in the cron.",
@@ -5494,6 +5516,12 @@ var FLAG_REGISTRY = [
     // flip wants a deliberate confirm rather than a casual toggle. Before flipping,
     // check which orgs sit at the `enforce` / `require_approval` email-guard stage:
     // those are the ones where a newly-effective policy can reach a real block.
+    //
+    // Run that pre-flight per `docs/runbooks/org-email-domain-derivation-rollout.md`,
+    // and read it before acting on the result: the dry run reports `would-derive`
+    // for orgs where arming is provably inert (an unverified row for the candidate
+    // domain makes the insert collide and write nothing), so the report reads as
+    // riskier than it is and invites per-org overrides that are not needed.
     sensitive: true
   },
   {
@@ -13775,4 +13803,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-7DTMJSAF.js.map
+//# sourceMappingURL=chunk-SZ47B4KO.js.map