@integrity-labs/agt-cli 0.28.892 → 0.28.894

package/dist/{chunk-WMJBXN6N.js → chunk-RAEBKUW2.js}

@@ -19,7 +19,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-FZ6KIIYX.js";
+} from "./chunk-5464FJVN.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5730,4 +5730,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-WMJBXN6N.js.map
+//# sourceMappingURL=chunk-RAEBKUW2.js.map

package/dist/{chunk-SUVQ2KSP.js → chunk-WRFHISNG.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-WMJBXN6N.js";
+} from "./chunk-RAEBKUW2.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -76,7 +76,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-FZ6KIIYX.js";
+} from "./chunk-5464FJVN.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6841,7 +6841,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.892" : "dev";
+var agtCliVersion = true ? "0.28.894" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11451,4 +11451,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-SUVQ2KSP.js.map
+//# sourceMappingURL=chunk-WRFHISNG.js.map

package/dist/{claude-pair-runtime-RTD7ZCVS.js → claude-pair-runtime-3MK5MUPN.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-ARKZDYMX.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-5HSYQBF7.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-RTD7ZCVS.js.map
+//# sourceMappingURL=claude-pair-runtime-3MK5MUPN.js.map

package/dist/lib/manager-worker.js

@@ -63,7 +63,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-SUVQ2KSP.js";
+} from "../chunk-WRFHISNG.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -136,7 +136,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-WMJBXN6N.js";
+} from "../chunk-RAEBKUW2.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -231,7 +231,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-FZ6KIIYX.js";
+} from "../chunk-5464FJVN.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -13003,7 +13003,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-X2WXPIUI.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-ZSB3DLLI.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13671,7 +13671,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.892" : "dev";
+var agtCliVersion = true ? "0.28.894" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15261,7 +15261,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-ARKZDYMX.js");
+      const { collectDiagnostics } = await import("../persistent-session-5HSYQBF7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15403,7 +15403,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-ARKZDYMX.js");
+      const { collectDiagnostics } = await import("../persistent-session-5HSYQBF7.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15572,7 +15572,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-X2WXPIUI.js");
+      } = await import("../responsiveness-probe-ZSB3DLLI.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -15689,7 +15689,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-X2WXPIUI.js");
+        } = await import("../responsiveness-probe-ZSB3DLLI.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15845,7 +15845,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-BLEV4AUJ.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-J7SQAYRR.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20103,7 +20103,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-X2WXPIUI.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-ZSB3DLLI.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20146,7 +20146,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-ARKZDYMX.js");
+        const { collectDiagnostics } = await import("../persistent-session-5HSYQBF7.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20197,7 +20197,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-ARKZDYMX.js");
+      const { collectDiagnostics } = await import("../persistent-session-5HSYQBF7.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20839,7 +20839,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-RTD7ZCVS.js");
+  } = await import("../claude-pair-runtime-3MK5MUPN.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/augmented-admin.js

@@ -21478,14 +21478,30 @@ var resumeAgentSchema = strictObject({
 });
 var listAlertsSchema = strictObject({
   severity: external_exports.string().max(16).optional().describe("Filter by severity (critical | warning | info)."),
-  // ENG-8566: without this, an old alert of a specific kind is unreachable —
-  // the listing is newest-first and capped at 100, and the open board exceeds
-  // that. Twelve slack_manifest_drift warnings sat unfindable for 48 days.
+  // ENG-8566: without this, an alert of a specific kind could be unreachable —
+  // the listing is capped at 100 and the open board exceeds that. Twelve
+  // slack_manifest_drift warnings sat unfindable for 48 days.
+  //
+  // ENG-10379 corrected the ordering claim this comment used to carry ("the
+  // listing is newest-first"). It is severity-first, then OLDEST-first within a
+  // severity, so the rows a truncated page drops are the NEWEST of the lowest
+  // severity present. `cursor` below is now the general escape hatch; `kind`
+  // remains the narrow one for when you already know what you are hunting.
   kind: external_exports.string().max(64).optional().describe(
-    "Filter by alert kind, exact match (e.g. slack_manifest_drift, host_down, integration_down). Use this to reach older alerts of one kind: the list is newest-first and capped at 100, so without a kind filter an old alert below that cutoff cannot be retrieved at all."
+    "Filter by alert kind, exact match (e.g. slack_manifest_drift, host_down, integration_down). ENG-10379: ordering is severity first (critical, then warning, then info) and OLDEST-first within each severity, so the rows a truncated page drops are the NEWEST of the lowest severity present - not the oldest. Page with `cursor` to reach them; `kind` narrows the set when you already know what you are looking for."
   ),
   open: external_exports.boolean().optional().describe("When true, only currently-open (unclosed) alerts."),
-  limit: limitSchema
+  limit: limitSchema,
+  // ENG-10379: the API has accepted a keyset `cursor` since ENG-9295 and returns
+  // `next_cursor`, but this schema never exposed one - and these schemas are
+  // STRICT, so a caller passing `cursor` was REJECTED rather than ignored. The
+  // paging existed and could not be driven from here, which is what left rows
+  // past the 100-row cap unreachable: on a board over the cap those are the
+  // NEWEST alerts of the lowest severity present, and one of them was a 25-hour
+  // channel outage nobody could see.
+  cursor: external_exports.string().min(1).max(512).optional().describe(
+    "Keyset cursor from a previous response's `next_cursor`. Pass it to fetch the NEXT page, and repeat until `next_cursor` is null to walk the whole board. Opaque: it encodes (severity_rank, opened_at, id) as one string, and a malformed cursor is refused rather than silently serving page one again."
+  )
 });
 var requestAccessSchema = strictObject({
   target_org_id: external_exports.string().min(1).max(64).describe("UUID of the customer organization to open scoped read access to."),
@@ -21693,7 +21709,7 @@ server.registerTool(
 );
 server.registerTool(
   "debug_list_alerts",
-  { description: "List recent platform alerts across authorized orgs (host-down, agent-stale, probe-timeout, auth-failed), including NULL-team host alerts. Returns a projection per alert (kind, severity, message, source, open/closed state), plus { count, total, truncated } \u2014 `total` is the matches before the 100-row cap, so `truncated: true` means you are NOT seeing everything. Filter with { kind, severity, open, limit }. **ENG-10030 \u2014 two fields that change how you read `message`.** `dedupe_key` is the alert's identity (`<kind>:<subject id>`), so it tells you which ROW an alert is about, not just which agent. `updated_at` tells you whether `message` is CURRENT: `open_alert` overwrites `message` on every re-raise but never touches `opened_at`, so a message is a snapshot unless the monitor re-raised that `(kind, dedupe_key)` since the alert opened \u2014 and it reads like live output either way. ONE DIRECTION IS PROOF, THE OTHER IS A HINT: `updated_at === opened_at` is CONCLUSIVE (never written since insert, so never re-raised, so `message` is frozen at `opened_at` \u2014 check this before proposing a fix for what a message describes, because the code may have moved since); `updated_at > opened_at` is SUGGESTIVE ONLY, because the `alerts_set_updated_at` trigger fires on EVERY write \u2014 an acknowledge, a snooze, a close, or a backfill migration. Compare against `acknowledged_at` / `snoozed_until` / `closed_at`: if `updated_at` matches one of them, that write was the human action, not a re-raise. Matching NONE of them is evidence of a re-raise but not proof, because a migration that touches the row leaves no timestamp of its own. Reading it as a biconditional is expensive: on one measured board 63 of 98 open alerts were acknowledged, so ~64% would falsely report current text. Two reads an hour apart remain the only unambiguous positive test. **Use `kind` to find older alerts**: results are newest-first and hard-capped at 100, so on a busy board an alert below that cutoff is unreachable without it (ENG-8566: 12 slack_manifest_drift warnings sat unfindable for 48 days for exactly this reason).", inputSchema: listAlertsSchema },
+  { description: "List recent platform alerts across authorized orgs (host-down, agent-stale, probe-timeout, auth-failed), including NULL-team host alerts. Returns a projection per alert (kind, severity, message, source, open/closed state), plus { count, total, truncated } \u2014 `total` is the matches before the 100-row cap, so `truncated: true` means you are NOT seeing everything. Filter with { kind, severity, open, limit }. **ENG-10030 \u2014 two fields that change how you read `message`.** `dedupe_key` is the alert's identity (`<kind>:<subject id>`), so it tells you which ROW an alert is about, not just which agent. `updated_at` tells you whether `message` is CURRENT: `open_alert` overwrites `message` on every re-raise but never touches `opened_at`, so a message is a snapshot unless the monitor re-raised that `(kind, dedupe_key)` since the alert opened \u2014 and it reads like live output either way. ONE DIRECTION IS PROOF, THE OTHER IS A HINT: `updated_at === opened_at` is CONCLUSIVE (never written since insert, so never re-raised, so `message` is frozen at `opened_at` \u2014 check this before proposing a fix for what a message describes, because the code may have moved since); `updated_at > opened_at` is SUGGESTIVE ONLY, because the `alerts_set_updated_at` trigger fires on EVERY write \u2014 an acknowledge, a snooze, a close, or a backfill migration. Compare against `acknowledged_at` / `snoozed_until` / `closed_at`: if `updated_at` matches one of them, that write was the human action, not a re-raise. Matching NONE of them is evidence of a re-raise but not proof, because a migration that touches the row leaves no timestamp of its own. Reading it as a biconditional is expensive: on one measured board 63 of 98 open alerts were acknowledged, so ~64% would falsely report current text. Two reads an hour apart remain the only unambiguous positive test. **ORDERING AND PAGING - ENG-10379, and the previous text here was wrong.** Results are ordered by SEVERITY first (critical, then warning, then info) and OLDEST-FIRST within each severity. They are not ordered newest first. So on a board past the 100-row cap, the rows dropped are the NEWEST alerts of the lowest severity present - which is how a sweep that reads one page missed a live 25-hour channel outage. `truncated: true` still means exactly what it always did (more matches exist than this page carries); to REACH them, pass `cursor` set to this response's `next_cursor` and repeat until `next_cursor` comes back null, which walks the whole board in order. `kind` still narrows the set when you already know what you are looking for (ENG-8566: 12 slack_manifest_drift warnings sat unfindable for 48 days).", inputSchema: listAlertsSchema },
   async (args) => {
     try {
       const result = await client.listAlerts(args);

package/dist/mcp/direct-chat-channel.js

@@ -37526,14 +37526,38 @@ var FLAG_REGISTRY = [
   },
   {
     key: "app-top-nav-shell",
-    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). Ships dark.",
+    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). NO LONGER DARK: ENG-9831 cutover step 1 flipped the default to true, so an org with no override now gets the top-nav shell. The key survives only until cutover step 2 deletes it.",
     flagType: "boolean",
-    // Declared safe value is `false` = the current left sidebar. Fail-closed to the
-    // shell that ships today if the flag DB is unreachable.
-    defaultValue: false,
-    // Read CLIENT-SIDE by the dashboard layout + sidebar ("use client") via
-    // usePublicBooleanFlag, so the key must be in the browser-exposed public map.
-    // Additive layout gate — not sensitive.
+    // ENG-9831 (cutover step 1): flipped `false` -> `true`. The comment this
+    // replaces called `false` the fail-closed direction — "the shell that ships
+    // today". That was true while the sidebar was the shell that shipped; the
+    // top nav is now the one being cut over to, so `false` points at the layout
+    // being retired. The old rationale is recorded rather than deleted because
+    // it was correct under a premise that has expired.
+    //
+    // NOTE the same split as ninjafy-brand below: this value is consulted by the
+    // API evaluator when building the `GET /flags` map for an org with no
+    // override. It is NOT the fallback the webapp uses on an outage — that is
+    // the argument passed at the call site. Four call sites carry `true` to
+    // match: (dashboard)/layout.tsx and the three legacy redirect hubs
+    // (settings, team, organization/settings). Flipping the registry alone
+    // leaves the cutover half-applied.
+    defaultValue: true,
+    // ENG-9831: NO LONGER read client-side. It was — via usePublicBooleanFlag in
+    // sidebar.tsx (twice) and top-nav.tsx — and that is precisely what this
+    // slice removed: a client hook starts at its default and corrects after an
+    // async GET /flags, so the console painted the sidebar and then replaced the
+    // WHOLE dashboard chrome after hydration. The ENG-8858/ENG-9227 flash at
+    // layout scale. It is now resolved once server-side in (dashboard)/
+    // layout.tsx and passed to both shells as a required prop.
+    //
+    // `public` MUST STAY ANYWAY — the same trap documented on ninjafy-brand.
+    // getPublicBooleanFlagServer resolves against the very same public-filtered
+    // `GET /flags` the browser uses (routes/flags.ts filters to
+    // listPublicFlagKeys()). Drop `public` and the key is simply absent from the
+    // map, the server helper falls through to its default forever, and every org
+    // silently gets whatever that default happens to be with no error anywhere.
+    // `public` means "readable through the public map", not "read by a browser".
     public: true
   },
   {

package/dist/mcp/index.js

@@ -29821,14 +29821,38 @@ var FLAG_REGISTRY = [
   },
   {
     key: "app-top-nav-shell",
-    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). Ships dark.",
+    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). NO LONGER DARK: ENG-9831 cutover step 1 flipped the default to true, so an org with no override now gets the top-nav shell. The key survives only until cutover step 2 deletes it.",
     flagType: "boolean",
-    // Declared safe value is `false` = the current left sidebar. Fail-closed to the
-    // shell that ships today if the flag DB is unreachable.
-    defaultValue: false,
-    // Read CLIENT-SIDE by the dashboard layout + sidebar ("use client") via
-    // usePublicBooleanFlag, so the key must be in the browser-exposed public map.
-    // Additive layout gate — not sensitive.
+    // ENG-9831 (cutover step 1): flipped `false` -> `true`. The comment this
+    // replaces called `false` the fail-closed direction — "the shell that ships
+    // today". That was true while the sidebar was the shell that shipped; the
+    // top nav is now the one being cut over to, so `false` points at the layout
+    // being retired. The old rationale is recorded rather than deleted because
+    // it was correct under a premise that has expired.
+    //
+    // NOTE the same split as ninjafy-brand below: this value is consulted by the
+    // API evaluator when building the `GET /flags` map for an org with no
+    // override. It is NOT the fallback the webapp uses on an outage — that is
+    // the argument passed at the call site. Four call sites carry `true` to
+    // match: (dashboard)/layout.tsx and the three legacy redirect hubs
+    // (settings, team, organization/settings). Flipping the registry alone
+    // leaves the cutover half-applied.
+    defaultValue: true,
+    // ENG-9831: NO LONGER read client-side. It was — via usePublicBooleanFlag in
+    // sidebar.tsx (twice) and top-nav.tsx — and that is precisely what this
+    // slice removed: a client hook starts at its default and corrects after an
+    // async GET /flags, so the console painted the sidebar and then replaced the
+    // WHOLE dashboard chrome after hydration. The ENG-8858/ENG-9227 flash at
+    // layout scale. It is now resolved once server-side in (dashboard)/
+    // layout.tsx and passed to both shells as a required prop.
+    //
+    // `public` MUST STAY ANYWAY — the same trap documented on ninjafy-brand.
+    // getPublicBooleanFlagServer resolves against the very same public-filtered
+    // `GET /flags` the browser uses (routes/flags.ts filters to
+    // listPublicFlagKeys()). Drop `public` and the key is simply absent from the
+    // map, the server helper falls through to its default forever, and every org
+    // silently gets whatever that default happens to be with no error anywhere.
+    // `public` means "readable through the public map", not "read by a browser".
     public: true
   },
   {
@@ -44984,6 +45008,73 @@ function truncate(text, max) {
   return text.length > max ? `${text.slice(0, max)}\u2026` : text;
 }
 
+// src/integration-improve-render.ts
+function fenceFor(...values) {
+  let longest = 0;
+  for (const value of values) {
+    for (const run of value.match(/`+/g) ?? []) longest = Math.max(longest, run.length);
+  }
+  return "`".repeat(Math.max(3, longest + 1));
+}
+function renderImproveResponse(data) {
+  const typedChanges = data.proposed.changed_fields ?? [];
+  const overridesChanged = !!data.proposed.appended_to_overrides;
+  const nothingChanged = typedChanges.length === 0 && !overridesChanged;
+  const lines = [];
+  lines.push(data.applied ? "\u2705 Applied integration context update" : "\u{1F4CB} Proposed integration context update (preview)");
+  lines.push("");
+  lines.push(`Rationale: ${data.proposed.rationale}`);
+  if (typedChanges.length > 0) {
+    lines.push("");
+    lines.push("## Typed field changes");
+    for (const field of typedChanges) {
+      const before = JSON.stringify(data.current.values[field] ?? null);
+      const after = JSON.stringify(data.proposed.values[field] ?? null);
+      lines.push(`- \`${field}\`: ${before} \u2192 ${after}`);
+    }
+  }
+  if (overridesChanged) {
+    lines.push("");
+    lines.push("## Overrides change");
+    const note = data.proposed.overrides_append;
+    if (typeof note === "string" && note.length > 0) {
+      lines.push("Appending this note. The existing overrides text is kept exactly as it is:");
+      const fence = fenceFor(note);
+      lines.push(fence);
+      lines.push(note);
+      lines.push(fence);
+    } else {
+      const fence = fenceFor(data.current.overrides ?? "", data.proposed.overrides ?? "");
+      lines.push("Before:");
+      lines.push(fence);
+      lines.push(data.current.overrides || "(empty)");
+      lines.push(fence);
+      lines.push("After:");
+      lines.push(fence);
+      lines.push(data.proposed.overrides || "(empty)");
+      lines.push(fence);
+    }
+  }
+  if (nothingChanged) {
+    lines.push("");
+    lines.push("## No change proposed");
+    lines.push(
+      data.applied ? "Nothing was changed: no typed field changes and nothing added to the overrides." : "Nothing to apply: no typed field changes and nothing to add to the overrides. The rationale above says why."
+    );
+  }
+  if (!data.applied) {
+    if (!nothingChanged) {
+      lines.push("");
+      lines.push("---");
+      lines.push("Show this diff to the user. If they confirm, call `integration_improve` again with `auto_apply: true` and the same arguments to apply.");
+    }
+  } else if (!nothingChanged) {
+    lines.push("");
+    lines.push("Update applied. The manager will re-render the integration's SKILL.md files on the next refresh cycle.");
+  }
+  return lines.join("\n");
+}
+
 // src/kanban-list-render.ts
 var KANBAN_LIST_DISPLAY_ORDER = [
   "in_progress",
@@ -48834,7 +48925,7 @@ server.tool(
   // Description leads with the user phrasings the agent should match against,
   // then explains the safety rule. Order matters — Claude\'s tool selection
   // weights the first line of a description heavily.
-  `Update, edit, or add a rule to an installed integration (e.g. the Coding integration, the Knowledge Base integration, the Slack integration). USE THIS TOOL when the user says any of: "update the X integration", "add a rule to integration Y", "tell the X integration not to do Z", "change the X integration so it does Y", "the Coding integration should always/never...", "remember this for the X integration". This is the ONLY correct way to modify an integration's behavior. NEVER edit SKILL.md files under .claude/skills/integration-* directly \u2014 those files are derived from the platform database and your edits will be silently overwritten on the next manager refresh. The platform calls an LLM to translate the user's request into a structured update of the integration's typed context fields and/or freeform overrides text, then returns a diff for you to show the user. Default flow is preview-then-apply: call once to get the proposed diff, show it to the user, then call again with auto_apply=true if they confirm. Only works for integrations that are actually installed on this agent.`,
+  `Update, edit, or add a rule to an installed integration (e.g. the Coding integration, the Knowledge Base integration, the Slack integration). USE THIS TOOL when the user says any of: "update the X integration", "add a rule to integration Y", "tell the X integration not to do Z", "change the X integration so it does Y", "the Coding integration should always/never...", "remember this for the X integration". This is the ONLY correct way to modify an integration's behavior. NEVER edit SKILL.md files under .claude/skills/integration-* directly \u2014 those files are derived from the platform database and your edits will be silently overwritten on the next manager refresh. The platform calls an LLM to translate the user's request into a structured update of the integration's typed context fields and/or freeform overrides text, then returns a diff for you to show the user. Default flow is preview-then-apply: call once to get the proposed diff, show it to the user, then call again with auto_apply=true if they confirm. Only works for integrations that are actually installed on this agent. Stored overrides are never rewritten: a note is only ever appended after them, and existing overrides text cannot be removed or reworded through this tool. If an auto_apply=true call fails as INDETERMINATE, do NOT retry it: a retry generates the note again and can append it twice. Tell the user the outcome is unknown instead.`,
   {
     integration_slug: external_exports.string().optional().describe('Integration slug to improve (e.g. "claude-code-github"). Either this or integration_id is required.'),
     integration_id: external_exports.string().optional().describe("Integration UUID. Either this or integration_slug is required."),
@@ -48856,50 +48947,23 @@ server.tool(
         content: [{ type: "text", text: "Error: either integration_slug or integration_id is required." }]
       };
     }
-    const data = await apiPost("/host/improve-integration", {
-      agent_id: AGT_AGENT_ID,
-      integration_slug: integrationSlug,
-      integration_id: integrationId,
-      feedback: params.feedback,
-      transcript_snippet: params.transcript_snippet,
-      auto_apply: params.auto_apply ?? false
-    });
-    const lines = [];
-    lines.push(data.applied ? "\u2705 Applied integration context update" : "\u{1F4CB} Proposed integration context update (preview)");
-    lines.push("");
-    lines.push(`Rationale: ${data.proposed.rationale}`);
-    if (data.proposed.changed_fields.length > 0) {
-      lines.push("");
-      lines.push("## Typed field changes");
-      for (const field of data.proposed.changed_fields) {
-        const before = JSON.stringify(data.current.values[field] ?? null);
-        const after = JSON.stringify(data.proposed.values[field] ?? null);
-        lines.push(`- \`${field}\`: ${before} \u2192 ${after}`);
-      }
-    }
-    if (data.proposed.appended_to_overrides) {
-      lines.push("");
-      lines.push("## Overrides change");
-      const before = data.current.overrides || "(empty)";
-      const after = data.proposed.overrides || "(empty)";
-      lines.push("Before:");
-      lines.push("```");
-      lines.push(before);
-      lines.push("```");
-      lines.push("After:");
-      lines.push("```");
-      lines.push(after);
-      lines.push("```");
-    }
-    if (!data.applied) {
-      lines.push("");
-      lines.push("---");
-      lines.push("Show this diff to the user. If they confirm, call `integration_improve` again with `auto_apply: true` and the same arguments to apply.");
-    } else {
-      lines.push("");
-      lines.push("Update applied. The manager will re-render the integration's SKILL.md files on the next refresh cycle.");
-    }
-    return { content: [{ type: "text", text: lines.join("\n") }] };
+    const autoApply = params.auto_apply ?? false;
+    const data = await apiPost(
+      "/host/improve-integration",
+      {
+        agent_id: AGT_AGENT_ID,
+        integration_slug: integrationSlug,
+        integration_id: integrationId,
+        feedback: params.feedback,
+        transcript_snippet: params.transcript_snippet,
+        auto_apply: autoApply
+      },
+      false,
+      FORWARD_TOOL_CALL_TIMEOUT_MS,
+      "integration_improve",
+      !autoApply
+    );
+    return { content: [{ type: "text", text: renderImproveResponse(data) }] };
   }
 );
 server.tool(

package/dist/mcp/origami.js

@@ -43749,14 +43749,38 @@ var FLAG_REGISTRY = [
   },
   {
     key: "app-top-nav-shell",
-    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). Ships dark.",
+    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). NO LONGER DARK: ENG-9831 cutover step 1 flipped the default to true, so an org with no override now gets the top-nav shell. The key survives only until cutover step 2 deletes it.",
     flagType: "boolean",
-    // Declared safe value is `false` = the current left sidebar. Fail-closed to the
-    // shell that ships today if the flag DB is unreachable.
-    defaultValue: false,
-    // Read CLIENT-SIDE by the dashboard layout + sidebar ("use client") via
-    // usePublicBooleanFlag, so the key must be in the browser-exposed public map.
-    // Additive layout gate — not sensitive.
+    // ENG-9831 (cutover step 1): flipped `false` -> `true`. The comment this
+    // replaces called `false` the fail-closed direction — "the shell that ships
+    // today". That was true while the sidebar was the shell that shipped; the
+    // top nav is now the one being cut over to, so `false` points at the layout
+    // being retired. The old rationale is recorded rather than deleted because
+    // it was correct under a premise that has expired.
+    //
+    // NOTE the same split as ninjafy-brand below: this value is consulted by the
+    // API evaluator when building the `GET /flags` map for an org with no
+    // override. It is NOT the fallback the webapp uses on an outage — that is
+    // the argument passed at the call site. Four call sites carry `true` to
+    // match: (dashboard)/layout.tsx and the three legacy redirect hubs
+    // (settings, team, organization/settings). Flipping the registry alone
+    // leaves the cutover half-applied.
+    defaultValue: true,
+    // ENG-9831: NO LONGER read client-side. It was — via usePublicBooleanFlag in
+    // sidebar.tsx (twice) and top-nav.tsx — and that is precisely what this
+    // slice removed: a client hook starts at its default and corrects after an
+    // async GET /flags, so the console painted the sidebar and then replaced the
+    // WHOLE dashboard chrome after hydration. The ENG-8858/ENG-9227 flash at
+    // layout scale. It is now resolved once server-side in (dashboard)/
+    // layout.tsx and passed to both shells as a required prop.
+    //
+    // `public` MUST STAY ANYWAY — the same trap documented on ninjafy-brand.
+    // getPublicBooleanFlagServer resolves against the very same public-filtered
+    // `GET /flags` the browser uses (routes/flags.ts filters to
+    // listPublicFlagKeys()). Drop `public` and the key is simply absent from the
+    // map, the server helper falls through to its default forever, and every org
+    // silently gets whatever that default happens to be with no error anywhere.
+    // `public` means "readable through the public map", not "read by a browser".
     public: true
   },
   {

package/dist/mcp/slack-channel.js

@@ -38386,14 +38386,38 @@ var FLAG_REGISTRY = [
   },
   {
     key: "app-top-nav-shell",
-    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). Ships dark.",
+    description: "Global top-navigation shell redesign (ENG-8478 epic / ENG-8486). When ON, the dashboard chrome replaces the left sidebar with a top navigation bar (team switcher \xB7 destinations \xB7 command palette + account) so the left side is free for an agent-scoped rail; when OFF, the existing left sidebar is unchanged. Additive layout gate \u2014 no data-model change. Composes independently with agent-unified-screen (the two flags are reconciled in ENG-8488). NO LONGER DARK: ENG-9831 cutover step 1 flipped the default to true, so an org with no override now gets the top-nav shell. The key survives only until cutover step 2 deletes it.",
     flagType: "boolean",
-    // Declared safe value is `false` = the current left sidebar. Fail-closed to the
-    // shell that ships today if the flag DB is unreachable.
-    defaultValue: false,
-    // Read CLIENT-SIDE by the dashboard layout + sidebar ("use client") via
-    // usePublicBooleanFlag, so the key must be in the browser-exposed public map.
-    // Additive layout gate — not sensitive.
+    // ENG-9831 (cutover step 1): flipped `false` -> `true`. The comment this
+    // replaces called `false` the fail-closed direction — "the shell that ships
+    // today". That was true while the sidebar was the shell that shipped; the
+    // top nav is now the one being cut over to, so `false` points at the layout
+    // being retired. The old rationale is recorded rather than deleted because
+    // it was correct under a premise that has expired.
+    //
+    // NOTE the same split as ninjafy-brand below: this value is consulted by the
+    // API evaluator when building the `GET /flags` map for an org with no
+    // override. It is NOT the fallback the webapp uses on an outage — that is
+    // the argument passed at the call site. Four call sites carry `true` to
+    // match: (dashboard)/layout.tsx and the three legacy redirect hubs
+    // (settings, team, organization/settings). Flipping the registry alone
+    // leaves the cutover half-applied.
+    defaultValue: true,
+    // ENG-9831: NO LONGER read client-side. It was — via usePublicBooleanFlag in
+    // sidebar.tsx (twice) and top-nav.tsx — and that is precisely what this
+    // slice removed: a client hook starts at its default and corrects after an
+    // async GET /flags, so the console painted the sidebar and then replaced the
+    // WHOLE dashboard chrome after hydration. The ENG-8858/ENG-9227 flash at
+    // layout scale. It is now resolved once server-side in (dashboard)/
+    // layout.tsx and passed to both shells as a required prop.
+    //
+    // `public` MUST STAY ANYWAY — the same trap documented on ninjafy-brand.
+    // getPublicBooleanFlagServer resolves against the very same public-filtered
+    // `GET /flags` the browser uses (routes/flags.ts filters to
+    // listPublicFlagKeys()). Drop `public` and the key is simply absent from the
+    // map, the server helper falls through to its default forever, and every org
+    // silently gets whatever that default happens to be with no error anywhere.
+    // `public` means "readable through the public map", not "read by a browser".
     public: true
   },
   {