@integrity-labs/agt-cli 0.28.848 → 0.28.850

package/dist/{chunk-PMQNTU7W.js → chunk-XCAI3GSF.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-MFU2FD4N.js";
+} from "./chunk-WUXQVP7A.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5431,4 +5431,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-PMQNTU7W.js.map
+//# sourceMappingURL=chunk-XCAI3GSF.js.map

package/dist/{claude-pair-runtime-BQ5JUW5F.js → claude-pair-runtime-CJXQTVSC.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-JKES3FMW.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-YGK7YHPR.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-BQ5JUW5F.js.map
+//# sourceMappingURL=claude-pair-runtime-CJXQTVSC.js.map

package/dist/lib/manager-worker.js

@@ -60,7 +60,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-N4TMATK2.js";
+} from "../chunk-OQSPURDB.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -126,7 +126,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-PMQNTU7W.js";
+} from "../chunk-XCAI3GSF.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -221,7 +221,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-MFU2FD4N.js";
+} from "../chunk-WUXQVP7A.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -12996,7 +12996,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-P7EAWN6J.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-NGWO3JK3.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13664,7 +13664,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.848" : "dev";
+var agtCliVersion = true ? "0.28.850" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15254,7 +15254,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-JKES3FMW.js");
+      const { collectDiagnostics } = await import("../persistent-session-YGK7YHPR.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15396,7 +15396,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-JKES3FMW.js");
+      const { collectDiagnostics } = await import("../persistent-session-YGK7YHPR.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15565,7 +15565,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-P7EAWN6J.js");
+      } = await import("../responsiveness-probe-NGWO3JK3.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -15682,7 +15682,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-P7EAWN6J.js");
+        } = await import("../responsiveness-probe-NGWO3JK3.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15838,7 +15838,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-IFU2XLHO.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-4UZR5655.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20071,7 +20071,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-JKES3FMW.js");
+        const { collectDiagnostics } = await import("../persistent-session-YGK7YHPR.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20117,7 +20117,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-JKES3FMW.js");
+      const { collectDiagnostics } = await import("../persistent-session-YGK7YHPR.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20753,7 +20753,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-BQ5JUW5F.js");
+  } = await import("../claude-pair-runtime-CJXQTVSC.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/computer-use-proxy.js

@@ -7,6 +7,303 @@ import { createInterface } from "readline";
 import { spawn } from "child_process";
 import { fileURLToPath } from "url";
 import { resolve as resolvePath } from "path";
+
+// src/computer-use-gate.ts
+import { createHash } from "crypto";
+var MINIMUM_TOOL_FLOOR = "write_high_risk";
+var TOOL_FLOORS = Object.freeze({
+  // Reads - of the operator's screen and window state.
+  get_app_state: "write_high_risk",
+  // State-changing: focus, input, navigation.
+  open_app: "write_high_risk",
+  scroll: "write_high_risk",
+  click: "write_destructive",
+  type_text: "write_destructive",
+  press_key: "write_destructive",
+  set_value: "write_destructive",
+  perform_secondary_action: "write_destructive"
+});
+var UNGATED_TOOLS = Object.freeze(["list_apps"]);
+var APP_ARG_KEYS = ["app_name", "app", "application", "bundle_id"];
+var TEXT_PREVIEW_LIMIT = 200;
+var SESSION_PATH = "/host/computer-use/session";
+var ACTION_PATH = "/host/computer-use/action";
+function refuse(text) {
+  return { content: [{ type: "text", text }], isError: true };
+}
+function previewText(value, limit = TEXT_PREVIEW_LIMIT) {
+  if (typeof value !== "string" || value.length === 0) return void 0;
+  if (value.length <= limit) return value;
+  return `${value.slice(0, limit)}... (${value.length - limit} more characters)`;
+}
+function extractAppIdentifiers(args) {
+  if (typeof args !== "object" || args === null) return [];
+  const rec = args;
+  const found = [];
+  for (const key of APP_ARG_KEYS) {
+    const v = rec[key];
+    if (typeof v !== "string" || !v.trim()) continue;
+    const named = v.trim();
+    if (!found.some((f) => sameApp(f, named))) found.push(named);
+  }
+  return found;
+}
+function sameApp(a, b) {
+  if (!a || !b) return false;
+  return a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+function actionIdempotencyKey(sessionRequestId, tool, args) {
+  const canonical = `${sessionRequestId} ${tool} ${stableStringify(args)}`;
+  const digest = createHash("sha256").update(canonical).digest("hex").slice(0, 32);
+  return `cu-${sessionRequestId}-${tool}-${digest}`;
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const rec = value;
+  const keys = Object.keys(rec).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(rec[k])}`).join(",")}}`;
+}
+function createApprovalGate(deps) {
+  const logErr2 = deps.logErr ?? ((msg) => process.stderr.write(`[computer-use-gate] ${msg}
+`));
+  return async (toolName, args, ctx) => {
+    if (UNGATED_TOOLS.includes(toolName)) return null;
+    const floor = TOOL_FLOORS[toolName];
+    if (!floor) {
+      return refuse(
+        `computer-use: '${toolName || "(unnamed)"}' has no declared approval floor, so it is refused. Every tool this proxy forwards must be classified at '${MINIMUM_TOOL_FLOOR}' or above (packages/mcp/src/computer-use-gate.ts TOOL_FLOORS). Tell your operator which tool you needed.`
+      );
+    }
+    const appIds = extractAppIdentifiers(args);
+    if (appIds.length > 1) {
+      return refuse(
+        `computer-use: this call names more than one application (${appIds.map((a) => `'${a}'`).join(", ")}), so it was NOT sent to the Mac. A grant covers ONE application, and when the arguments disagree this proxy cannot tell which one the Mac would actually act on - so it refuses rather than guessing. Re-send the call naming the target exactly once.`
+      );
+    }
+    const requestedApp = appIds.length === 1 ? appIds[0] : void 0;
+    let grant;
+    try {
+      grant = await deps.apiGet(
+        `${SESSION_PATH}?agent_id=${encodeURIComponent(deps.agentId)}`
+      );
+    } catch (err) {
+      logErr2(`session lookup failed: ${err.message}`);
+      return refuse(
+        `computer-use: cannot reach the control plane to check your session, so this call was NOT sent to the Mac. This is not a denial and not a Mac problem - approval could not be checked, so nothing ran. Retry shortly.`
+      );
+    }
+    async function requestSession(lead) {
+      if (!requestedApp) {
+        return refuse(
+          `${lead} This call also does not name an application, so a session cannot be requested for it. Call list_apps first, then retry naming the app.`
+        );
+      }
+      try {
+        const filed = await deps.apiPost(SESSION_PATH, {
+          agent_id: deps.agentId,
+          target_app: requestedApp,
+          summary: `Drive ${requestedApp} on the operator's Mac (first call: ${toolName})`,
+          idempotency_key: `cu-session-${deps.agentId}-${requestedApp.toLowerCase()}`
+        });
+        return refuse(
+          `${lead} A session request for '${requestedApp}' has been filed` + (filed?.request_id ? ` (request ${filed.request_id})` : "") + `. A human will approve or deny it and choose whether you are prompted for each action. Poll with check_approval; once it is active, re-issue this call.`
+        );
+      } catch (err) {
+        logErr2(`session request failed: ${err.message}`);
+        return refuse(
+          `${lead} The request for a session could not be filed (${err.message}), so nothing is pending either. Tell your operator.`
+        );
+      }
+    }
+    switch (grant.state) {
+      case "active":
+        break;
+      case "pending":
+        return refuse(
+          `computer-use: your session request is still awaiting a human decision` + (grant.request_id ? ` (request ${grant.request_id})` : "") + `. Nothing has been sent to the Mac. Do not re-request - poll with check_approval, or do something else and come back.`
+        );
+      case "revoked":
+        return refuse(
+          `computer-use: your session was REVOKED by a human before it expired. Do not request another for the same task without asking them first - a revocation mid-session usually means they wanted you to stop, not to retry.`
+        );
+      case "denied":
+        return refuse(
+          `computer-use: a human DENIED your session request` + (grant.denial_reason ? `: ${grant.denial_reason}` : ".") + ` Do not retry the same request. Ask them what they would approve instead.`
+        );
+      case "expired":
+        return requestSession(
+          `computer-use: your session has EXPIRED - a human did grant it, and the window simply ran out. Nothing was sent to the Mac.`
+        );
+      case "none":
+      default:
+        return requestSession(
+          `computer-use: you have no active session, so nothing was sent to the Mac.`
+        );
+    }
+    if (requestedApp !== void 0 && !sameApp(grant.target_app, requestedApp)) {
+      return refuse(
+        `computer-use: your session is bound to '${grant.target_app ?? "(unknown)"}' and this call targets '${requestedApp ?? "(no app named)"}'. Nothing was sent to the Mac. A grant covers ONE application - if you genuinely need the other one, request a separate session for it and say why.`
+      );
+    }
+    const sessionRequestId = grant.request_id ?? "";
+    try {
+      const filed = await deps.apiPost(ACTION_PATH, {
+        agent_id: deps.agentId,
+        session_request_id: sessionRequestId,
+        tool: toolName,
+        target_app: grant.target_app,
+        target_element: previewText(readElement(args), 80),
+        text_preview: previewText(readTypedText(args)),
+        returns_screenshot: ctx?.includeScreenshot === true,
+        floor,
+        idempotency_key: actionIdempotencyKey(sessionRequestId, toolName, args),
+        summary: describeAction(toolName, grant.target_app, args)
+      });
+      switch (filed.status) {
+        case "auto_approve":
+        case "active":
+          return null;
+        // forward to the Mac
+        case "pending":
+          return refuse(
+            `computer-use: this action needs a human tap first (request ${filed.request_id}). Nothing was sent to the Mac. Poll with check_approval and re-issue this EXACT call once it is approved - re-issuing it re-attaches to the same request rather than filing another.`
+          );
+        case "denied":
+        case "hard_deny":
+          return refuse(
+            `computer-use: a human DENIED this action` + (filed.denial_reason ? `: ${filed.denial_reason}` : ".") + ` Nothing was sent to the Mac. Do not retry it - pick a different approach or ask them what to do.`
+          );
+        case "expired":
+          return refuse(
+            `computer-use: the approval for this action expired before anyone answered (request ${filed.request_id}). Nothing was sent to the Mac. This is not a refusal - re-issue the call to ask again.`
+          );
+        case "revoked":
+          return refuse(
+            `computer-use: your session was revoked while this action was awaiting approval. Nothing was sent to the Mac.`
+          );
+        case "consumed":
+          return refuse(
+            `computer-use: this exact action was already approved and already performed once, so it was NOT sent again. An approval covers ONE execution - if you genuinely need to repeat it, that is a new request. (If you are retrying because you could not tell whether the first one landed: read the accessibility tree, isError:false is not evidence either way.)`
+          );
+        default:
+          return refuse(
+            `computer-use: the control plane returned an approval status this proxy does not recognise ('${String(filed.status)}'), so the call was NOT sent to the Mac. Tell your operator.`
+          );
+      }
+    } catch (err) {
+      logErr2(`action filing failed: ${err.message}`);
+      return refuse(
+        `computer-use: the approval for this action could not be filed (${err.message}), so it was NOT sent to the Mac. This is not a denial. Retry shortly; if it persists, tell your operator.`
+      );
+    }
+  };
+}
+function readElement(args) {
+  if (typeof args !== "object" || args === null) return void 0;
+  const rec = args;
+  for (const key of ["element_index", "element", "role", "title"]) {
+    const v = rec[key];
+    if (typeof v === "string" && v.trim()) return v;
+    if (typeof v === "number") return String(v);
+  }
+  return void 0;
+}
+function readTypedText(args) {
+  if (typeof args !== "object" || args === null) return void 0;
+  const rec = args;
+  for (const key of ["text", "value", "keys", "key"]) {
+    const v = rec[key];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+function describeAction(tool, app, args) {
+  const where = app ? ` in ${app}` : "";
+  const el = readElement(args);
+  const elPart = el !== void 0 ? ` on element ${String(el)}` : "";
+  const text = previewText(readTypedText(args), 80);
+  const textPart = text ? ` with "${text}"` : "";
+  return `${tool}${elPart}${textPart}${where}`;
+}
+function createUnconfiguredGate(missing) {
+  return async () => refuse(
+    `computer-use: this proxy is not configured to check approvals (missing ${missing.join(", ")}), so it refuses every call rather than forwarding un-approved ones to the Mac. Nothing has been sent. Ask your operator to re-provision this agent.`
+  );
+}
+function resolveGate(env, makeClient) {
+  const agtHost = env.AGT_HOST?.trim();
+  const agtApiKey = env.AGT_API_KEY?.trim();
+  const agentId = env.AGT_AGENT_ID?.trim();
+  const missing = [];
+  if (!agtHost) missing.push("AGT_HOST");
+  if (!agtApiKey) missing.push("AGT_API_KEY");
+  if (!agentId) missing.push("AGT_AGENT_ID");
+  if (missing.length > 0) return { gate: createUnconfiguredGate(missing), missing };
+  const client = makeClient({ agtHost, agtApiKey, agentId });
+  return {
+    gate: createApprovalGate({ agentId, apiGet: client.apiGet, apiPost: client.apiPost }),
+    missing: []
+  };
+}
+
+// src/computer-use-api-client.ts
+var REQUEST_TIMEOUT_MS = 1e4;
+var TOKEN_SKEW_MS = 6e4;
+function createHostApiClient(config) {
+  const fetchImpl = config.fetchImpl ?? fetch;
+  const now = config.now ?? Date.now;
+  const base = config.agtHost.replace(/\/+$/, "");
+  let cachedToken = null;
+  let cachedTokenExpiresAt = 0;
+  async function getToken() {
+    if (cachedToken && now() < cachedTokenExpiresAt) return cachedToken;
+    const res = await fetchImpl(`${base}/host/exchange`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ host_key: config.agtApiKey, agent_id: config.agentId }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => res.statusText);
+      throw new Error(`host key exchange returned ${res.status}: ${text}`);
+    }
+    const body = await res.json();
+    if (!body.token) throw new Error("host key exchange returned no token");
+    cachedToken = body.token;
+    const lifetimeMs = (body.expires_in ?? 3600) * 1e3;
+    cachedTokenExpiresAt = now() + Math.max(0, lifetimeMs - TOKEN_SKEW_MS);
+    return cachedToken;
+  }
+  async function request(path, init, retried = false) {
+    const token = await getToken();
+    const res = await fetchImpl(`${base}${path}`, {
+      ...init,
+      headers: { ...init.headers ?? {}, Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+    if (res.status === 401 && !retried) {
+      cachedToken = null;
+      cachedTokenExpiresAt = 0;
+      return request(path, init, true);
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => res.statusText);
+      throw new Error(`API ${path} returned ${res.status}: ${text}`);
+    }
+    return await res.json();
+  }
+  return {
+    apiGet: (path) => request(path, { method: "GET" }),
+    apiPost: (path, body) => request(path, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    })
+  };
+}
+
+// src/computer-use-proxy.ts
 var INCLUDE_SCREENSHOT_PARAM = "include_screenshot";
 var STRIPPED_IMAGE_STUB = `[screenshot omitted to save tokens \u2014 pass ${INCLUDE_SCREENSHOT_PARAM}: true to receive it. Element indices in the accessibility tree above are usually enough to act.]`;
 var RELIABILITY_NOTE = `
@@ -108,6 +405,7 @@ function logErr(msg) {
 var allowAll = async () => null;
 function createProxy(deps) {
   const beforeForward = deps.beforeForward ?? allowAll;
+  const allowUnrequestedScreenshot = deps.allowUnrequestedScreenshot !== false;
   const pending = /* @__PURE__ */ new Map();
   async function handleDownstream(line) {
     const text = line.trim();
@@ -126,7 +424,7 @@ function createProxy(deps) {
     const { include, params } = takeIncludeScreenshot(frame.params);
     const toolName = typeof params?.name === "string" ? params.name : "";
     const args = params?.arguments;
-    const short = await beforeForward(toolName, args);
+    const short = await beforeForward(toolName, args, { includeScreenshot: include });
     if (short) {
       if (!isRequest) {
         logErr(`short-circuited notification tools/call ${toolName} (no reply sent)`);
@@ -171,8 +469,11 @@ function createProxy(deps) {
         (b) => typeof b === "object" && b !== null && b.type === "text"
       );
       if (treeBlock && !treeHasActionableContent(treeBlock.text)) {
-        logErr("tree carries no actionable content; keeping screenshot");
-        return [text];
+        if (allowUnrequestedScreenshot) {
+          logErr("tree carries no actionable content; keeping screenshot");
+          return [text];
+        }
+        logErr("tree carries no actionable content, but screenshots are gated; stripping");
       }
     }
     const { result, stripped } = stripImages(frame.result);
@@ -249,11 +550,23 @@ async function main(argv = process.argv) {
     logErr(`failed to spawn upstream: ${err.message}`);
     process.exit(1);
   }
+  const { gate, missing } = resolveGate(process.env, (c) => createHostApiClient(c));
+  if (missing.length > 0) {
+    logErr(
+      `NOT CONFIGURED for approval checks (missing ${missing.join(", ")}); refusing every call. No computer-use tool will reach the Mac until this agent is re-provisioned.`
+    );
+  }
   await wirePump({
     child,
     clientIn: process.stdin,
     clientOut: process.stdout,
-    proxy: createProxy({ upstream })
+    proxy: createProxy({
+      upstream,
+      beforeForward: gate,
+      // With a gate in place an image must never arrive unrequested - see the
+      // field's own note on why the accessibility-blind hatch closes here.
+      allowUnrequestedScreenshot: false
+    })
   });
 }
 var invokedDirectly = (() => {

package/dist/mcp/direct-chat-channel.js

@@ -37310,10 +37310,22 @@ var FLAG_REGISTRY = [
     // See the description: `shadow` is what prod compiles today, so it is the
     // only default that ships this flag as a no-op.
     defaultValue: "shadow",
-    // enforce changes the admission rule on the platform's front door, and the
-    // families it starts refusing include mcp-proxy — one of the fleet's
-    // dominant callers. This is precisely the deliberate, audited flip ADR-0022
-    // §4 reserves confirmation for.
+    // enforce changes the admission rule on the platform's front door. This is
+    // precisely the deliberate, audited flip ADR-0022 §4 reserves confirmation
+    // for, and it stays `sensitive` — but NOT for the reason first written here.
+    // That read "the families it starts refusing include mcp-proxy, one of the
+    // fleet's dominant callers", and ENG-9895 measured otherwise: mcp-proxy
+    // verifies its own token on a route carrying no `authMiddleware`, so it is a
+    // dominant caller of a different door and cannot be in the refused set. The
+    // measured population at that door is ZERO over 298,839,353 prod log records
+    // / 14 days, and the impersonation families are absent too — one
+    // structurally (`X-Agent-Impersonation` header, own verifier), one by
+    // measurement (307 requests through that door, zero lines). What keeps this
+    // `sensitive` is therefore NOT an unresolved residue: it is that `enforce`
+    // changes an admission rule on the front door, and that the predicate is
+    // structural, so a FUTURE family 13 is born refusable without an edit here.
+    // That is exactly the deliberate, audited flip ADR-0022 §4 reserves
+    // confirmation for. docs/research/eng-9895-prod-shadow-measurement.md
     sensitive: true
   },
   {

package/dist/mcp/index.js

@@ -29580,10 +29580,22 @@ var FLAG_REGISTRY = [
     // See the description: `shadow` is what prod compiles today, so it is the
     // only default that ships this flag as a no-op.
     defaultValue: "shadow",
-    // enforce changes the admission rule on the platform's front door, and the
-    // families it starts refusing include mcp-proxy — one of the fleet's
-    // dominant callers. This is precisely the deliberate, audited flip ADR-0022
-    // §4 reserves confirmation for.
+    // enforce changes the admission rule on the platform's front door. This is
+    // precisely the deliberate, audited flip ADR-0022 §4 reserves confirmation
+    // for, and it stays `sensitive` — but NOT for the reason first written here.
+    // That read "the families it starts refusing include mcp-proxy, one of the
+    // fleet's dominant callers", and ENG-9895 measured otherwise: mcp-proxy
+    // verifies its own token on a route carrying no `authMiddleware`, so it is a
+    // dominant caller of a different door and cannot be in the refused set. The
+    // measured population at that door is ZERO over 298,839,353 prod log records
+    // / 14 days, and the impersonation families are absent too — one
+    // structurally (`X-Agent-Impersonation` header, own verifier), one by
+    // measurement (307 requests through that door, zero lines). What keeps this
+    // `sensitive` is therefore NOT an unresolved residue: it is that `enforce`
+    // changes an admission rule on the front door, and that the predicate is
+    // structural, so a FUTURE family 13 is born refusable without an edit here.
+    // That is exactly the deliberate, audited flip ADR-0022 §4 reserves
+    // confirmation for. docs/research/eng-9895-prod-shadow-measurement.md
     sensitive: true
   },
   {
@@ -44565,6 +44577,22 @@ function renderKanbanFullCard(item, nowMs = Date.now()) {
   }
   return lines.join("\n");
 }
+function renderKanbanNoteHistory(requested, history, truncated) {
+  if (!requested) return "";
+  const entries = history ?? [];
+  if (entries.length === 0) {
+    return "\n\n## Durable note history\nNo note events recorded for this card. Notes written before the durable mirror existed will not appear here.";
+  }
+  const ordered = entries;
+  const head = `
+
+## Durable note history (${ordered.length}${truncated ? ", TRUNCATED \u2014 older entries exist beyond this page" : ""})
+The full text of every appended note, including entries that have rolled off the ~4 KB \`notes\` column.
+`;
+  return head + ordered.map((e) => `
+[${e.at}]
+${e.note}`).join("\n");
+}
 
 // src/kanban-peek-render.ts
 var PEEK_RENDER_COLUMNS = [
@@ -45802,12 +45830,22 @@ server.tool(
   "kanban_get",
   'Read ONE of your own kanban cards IN FULL, with no truncation anywhere - description, notes, result, deliverable, every field. kanban_list caps a description at 1,200 characters and kanban_search at 300; this is the one surface where "read the whole thing" always means the whole thing. Use it whenever a card matters enough to read completely - especially a scheduled-task card, whose description IS the routine prompt you are executing: a long one may already be silently truncated everywhere else you have seen it.',
   {
-    id: external_exports.string().describe("The card id (from kanban_list, kanban_search, or any other kanban tool's response).")
+    id: external_exports.string().describe("The card id (from kanban_list, kanban_search, or any other kanban tool's response)."),
+    include_note_history: external_exports.boolean().optional().describe(
+      "CS-1683: also return the DURABLE note history. `notes` is capped at ~4 KB and rolls off oldest-first, but every appended breadcrumb is retained in full elsewhere. Use this when a note you remember writing is no longer in `notes` \u2014 that text is not gone, it has rolled off the inline column."
+    )
   },
-  async ({ id }) => {
+  async ({ id, include_note_history }) => {
     let data;
     try {
-      data = await apiPost("/host/kanban/get", { agent_id: AGT_AGENT_ID, id }, false, 15e3, "kanban_get", true);
+      data = await apiPost(
+        "/host/kanban/get",
+        { agent_id: AGT_AGENT_ID, id, include_note_history: include_note_history === true },
+        false,
+        15e3,
+        "kanban_get",
+        true
+      );
     } catch (err) {
       const status = err instanceof ApiPostError ? err.status : null;
       return {
@@ -45817,7 +45855,19 @@ server.tool(
     if (!data.item) {
       return { content: [{ type: "text", text: kanbanGetErrorMessage(404, id, "card not found") }] };
     }
-    return { content: [{ type: "text", text: renderKanbanFullCard(data.item) }] };
+    const card = renderKanbanFullCard(data.item);
+    return {
+      content: [
+        {
+          type: "text",
+          text: card + renderKanbanNoteHistory(
+            include_note_history === true,
+            data.note_history,
+            data.note_history_truncated
+          )
+        }
+      ]
+    };
   }
 );
 server.tool(

package/dist/mcp/origami.js

@@ -43533,10 +43533,22 @@ var FLAG_REGISTRY = [
     // See the description: `shadow` is what prod compiles today, so it is the
     // only default that ships this flag as a no-op.
     defaultValue: "shadow",
-    // enforce changes the admission rule on the platform's front door, and the
-    // families it starts refusing include mcp-proxy — one of the fleet's
-    // dominant callers. This is precisely the deliberate, audited flip ADR-0022
-    // §4 reserves confirmation for.
+    // enforce changes the admission rule on the platform's front door. This is
+    // precisely the deliberate, audited flip ADR-0022 §4 reserves confirmation
+    // for, and it stays `sensitive` — but NOT for the reason first written here.
+    // That read "the families it starts refusing include mcp-proxy, one of the
+    // fleet's dominant callers", and ENG-9895 measured otherwise: mcp-proxy
+    // verifies its own token on a route carrying no `authMiddleware`, so it is a
+    // dominant caller of a different door and cannot be in the refused set. The
+    // measured population at that door is ZERO over 298,839,353 prod log records
+    // / 14 days, and the impersonation families are absent too — one
+    // structurally (`X-Agent-Impersonation` header, own verifier), one by
+    // measurement (307 requests through that door, zero lines). What keeps this
+    // `sensitive` is therefore NOT an unresolved residue: it is that `enforce`
+    // changes an admission rule on the front door, and that the predicate is
+    // structural, so a FUTURE family 13 is born refusable without an edit here.
+    // That is exactly the deliberate, audited flip ADR-0022 §4 reserves
+    // confirmation for. docs/research/eng-9895-prod-shadow-measurement.md
     sensitive: true
   },
   {