@integrity-labs/agt-cli 0.28.848 → 0.28.849

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-N4TMATK2.js";
+} from "../chunk-JFCISESR.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-PMQNTU7W.js";
+} from "../chunk-XCAI3GSF.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-MFU2FD4N.js";
+} from "../chunk-WUXQVP7A.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.848" : "dev";
+var cliVersion = true ? "0.28.849" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.848" : "dev";
+var cliVersion2 = true ? "0.28.849" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-N4TMATK2.js → chunk-JFCISESR.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-PMQNTU7W.js";
+} from "./chunk-XCAI3GSF.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -76,7 +76,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-MFU2FD4N.js";
+} from "./chunk-WUXQVP7A.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6566,7 +6566,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.848" : "dev";
+var agtCliVersion = true ? "0.28.849" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10924,4 +10924,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-N4TMATK2.js.map
+//# sourceMappingURL=chunk-JFCISESR.js.map

package/dist/{chunk-MFU2FD4N.js → chunk-WUXQVP7A.js}

@@ -6636,10 +6636,22 @@ var FLAG_REGISTRY = [
     // See the description: `shadow` is what prod compiles today, so it is the
     // only default that ships this flag as a no-op.
     defaultValue: "shadow",
-    // enforce changes the admission rule on the platform's front door, and the
-    // families it starts refusing include mcp-proxy — one of the fleet's
-    // dominant callers. This is precisely the deliberate, audited flip ADR-0022
-    // §4 reserves confirmation for.
+    // enforce changes the admission rule on the platform's front door. This is
+    // precisely the deliberate, audited flip ADR-0022 §4 reserves confirmation
+    // for, and it stays `sensitive` — but NOT for the reason first written here.
+    // That read "the families it starts refusing include mcp-proxy, one of the
+    // fleet's dominant callers", and ENG-9895 measured otherwise: mcp-proxy
+    // verifies its own token on a route carrying no `authMiddleware`, so it is a
+    // dominant caller of a different door and cannot be in the refused set. The
+    // measured population at that door is ZERO over 298,839,353 prod log records
+    // / 14 days, and the impersonation families are absent too — one
+    // structurally (`X-Agent-Impersonation` header, own verifier), one by
+    // measurement (307 requests through that door, zero lines). What keeps this
+    // `sensitive` is therefore NOT an unresolved residue: it is that `enforce`
+    // changes an admission rule on the front door, and that the predicate is
+    // structural, so a FUTURE family 13 is born refusable without an edit here.
+    // That is exactly the deliberate, audited flip ADR-0022 §4 reserves
+    // confirmation for. docs/research/eng-9895-prod-shadow-measurement.md
     sensitive: true
   },
   {
@@ -13960,4 +13972,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-MFU2FD4N.js.map
+//# sourceMappingURL=chunk-WUXQVP7A.js.map