@integrity-labs/agt-cli 0.28.943 → 0.28.945

package/dist/{claude-pair-runtime-7ZXVEOXN.js → claude-pair-runtime-K2J6WVEN.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-VS57VBUF.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-523F5U4H.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-7ZXVEOXN.js.map
+//# sourceMappingURL=claude-pair-runtime-K2J6WVEN.js.map

package/dist/lib/manager-worker.js

@@ -63,7 +63,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-44X625BP.js";
+} from "../chunk-U5ETXDXQ.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -136,7 +136,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-NB7WT7MA.js";
+} from "../chunk-XN5MOKSV.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -232,7 +232,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-HF2GMFMJ.js";
+} from "../chunk-YZ5HGHPG.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -13257,7 +13257,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-ZCNVWA6X.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-CHGET573.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13942,7 +13942,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.943" : "dev";
+var agtCliVersion = true ? "0.28.945" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15532,7 +15532,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-VS57VBUF.js");
+      const { collectDiagnostics } = await import("../persistent-session-523F5U4H.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15674,7 +15674,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-VS57VBUF.js");
+      const { collectDiagnostics } = await import("../persistent-session-523F5U4H.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15849,7 +15849,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-ZCNVWA6X.js");
+      } = await import("../responsiveness-probe-CHGET573.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -15966,7 +15966,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-ZCNVWA6X.js");
+        } = await import("../responsiveness-probe-CHGET573.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16122,7 +16122,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-YDAYAWNL.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-T5SUK2HT.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20386,7 +20386,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-ZCNVWA6X.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-CHGET573.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20429,7 +20429,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-VS57VBUF.js");
+        const { collectDiagnostics } = await import("../persistent-session-523F5U4H.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20480,7 +20480,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-VS57VBUF.js");
+      const { collectDiagnostics } = await import("../persistent-session-523F5U4H.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -21122,7 +21122,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-7ZXVEOXN.js");
+  } = await import("../claude-pair-runtime-K2J6WVEN.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/augmented-admin.js

@@ -21564,6 +21564,7 @@ var queryAuditLogSchema = strictObject({
   since_hours: external_exports.number().int().min(1).max(720).optional().describe("Only events newer than this many hours. Omit for no time bound."),
   limit: limitSchema
 });
+var REMEDIAL_WRITE_BOUNDARY = 'REACHABILITY (ENG-10145): the approval path above exists only for an agent whose org you hold WRITE authorization on (Integrity-Labs-internal orgs, or an org a human has issued a write grant for). Against any other customer org this is refused BEFORE any approval card is created (403 when you can read the org, the uniform 404 "target agent not found" when you cannot): no request_id, nobody is paged, and debug_request_access cannot change it (it mints read grants only). Check `org_write_authorized` on debug_get_agent first. When it is false, do not call this tool and do not report a pending approval; escalate to an Integrity Labs operator with the agent id, the action you need and why. When it is null the check itself failed: that is indeterminate, not a refusal and not an authorization. This tool re-checks and may return 500 "failed to verify write authorization"; relay that error as it is, do not infer a 403/404 or claim a pending approval from it, and escalate.';
 
 // package.json
 var package_default = {
@@ -21654,7 +21655,7 @@ server.registerTool(
 );
 server.registerTool(
   "debug_get_agent",
-  { description: 'Fetch a composite diagnostic for ONE agent: the agent projection plus its host (heartbeat verdict, framework, EC2/auth status), its integrations, and recent alerts. The primary "why is this agent unhealthy?" read. Never returns credentials. Pass { agent_id }.\n\nThe payload carries TWO integration reads, and confusing them produces wrong root-cause (ENG-8271):\n  \u2022 `effective_integrations` \u2014 the COMPLETE set the agent runs with: agent + team + ORG scope, each entry carrying `scope` ("agent" | "team" | "org") and `source_id`. Read THIS to answer "does this agent have integration X?". `effective_count` equals the manager\'s `Integrations provisioned for \'<code_name>\' (N)`, so the two reconcile; `by_scope`, `inherited_definition_ids`, `scopes_skipped`, `excluded_control_plane_only`, `shadowed_by_more_specific` and `duplicate_merge_keys` attribute any row that did not make the count.\n  \u2022 `agent_integrations` \u2014 PER-AGENT rows only, kept for compatibility. Team- and org-scoped installs are ABSENT. Do NOT infer "not installed" from an absence here: an org-level install is genuinely missing from this array while being fully present on the agent. Same warning ships in-payload as `agent_integrations_note`.', inputSchema: getAgentSchema },
+  { description: 'Fetch a composite diagnostic for ONE agent: the agent projection plus its host (heartbeat verdict, framework, EC2/auth status), its integrations, and recent alerts. The primary "why is this agent unhealthy?" read. Never returns credentials. Pass { agent_id }.\n\nThe payload carries TWO integration reads, and confusing them produces wrong root-cause (ENG-8271):\n  \u2022 `effective_integrations` \u2014 the COMPLETE set the agent runs with: agent + team + ORG scope, each entry carrying `scope` ("agent" | "team" | "org") and `source_id`. Read THIS to answer "does this agent have integration X?". `effective_count` equals the manager\'s `Integrations provisioned for \'<code_name>\' (N)`, so the two reconcile; `by_scope`, `inherited_definition_ids`, `scopes_skipped`, `excluded_control_plane_only`, `shadowed_by_more_specific` and `duplicate_merge_keys` attribute any row that did not make the count.\n  \u2022 `agent_integrations` \u2014 PER-AGENT rows only, kept for compatibility. Team- and org-scoped installs are ABSENT. Do NOT infer "not installed" from an absence here: an org-level install is genuinely missing from this array while being fully present on the agent. Same warning ships in-payload as `agent_integrations_note`.\n\n`org_write_authorized` (ENG-10145) says whether this agent\'s org passes the write-authorization check that every HITL-gated remedial tool (debug_resume_agent, debug_restart_agent, request_action, request_config_update, request_ssm_run, debug_replay_dead_letter, request_clear_restart_request) runs first: false means every one of them is refused with a 403 before an approval card exists (404 only if your read access lapsed in between), so escalate to an Integrity Labs operator instead. true means only that this check passes; write mode, token capability and approval routing are still checked at call time. null means the check itself failed: indeterminate, not a refusal, and a remedial call may then return 500 "failed to verify write authorization" - relay that, never report a pending approval, and escalate. `org_write_authorized_note` explains it in-payload.', inputSchema: getAgentSchema },
   async (args) => {
     try {
       const result = await client.getAgent(args.agent_id);
@@ -21866,7 +21867,7 @@ server.registerTool(
 );
 server.registerTool(
   "request_clear_restart_request",
-  { description: "Request a HITL-gated CLEAR of a STUCK restart request \u2014 cancel a restart the manager never acked (listed by debug_inspect_restart_requests) and resolve its agent_restart_stuck alert. Use it to clear a restart signal wedged open for hours/days/weeks. This is NOT a restart and NOT a host action: it nulls the agent's `restart_requested_at` signal in the central DB and closes the alert/incident; the agent keeps running as-is, no in-flight work is destroyed. Reversible \u2014 request a fresh restart afterwards if one is still needed. A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). Async: returns { request_id, status, write_mode, notification_status }; after approval, poll check_action_status (result_payload carries { cleared_bindings, alert_closed }). Pass { target_agent_id, reason }.", inputSchema: clearRestartRequestSchema },
+  { description: "Request a HITL-gated CLEAR of a STUCK restart request \u2014 cancel a restart the manager never acked (listed by debug_inspect_restart_requests) and resolve its agent_restart_stuck alert. Use it to clear a restart signal wedged open for hours/days/weeks. This is NOT a restart and NOT a host action: it nulls the agent's `restart_requested_at` signal in the central DB and closes the alert/incident; the agent keeps running as-is, no in-flight work is destroyed. Reversible \u2014 request a fresh restart afterwards if one is still needed. A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). Async: returns { request_id, status, write_mode, notification_status }; after approval, poll check_action_status (result_payload carries { cleared_bindings, alert_closed }). Pass { target_agent_id, reason }. " + REMEDIAL_WRITE_BOUNDARY, inputSchema: clearRestartRequestSchema },
   async (args) => {
     try {
       const result = await client.requestClearRestartRequest({
@@ -21908,7 +21909,7 @@ server.registerTool(
 );
 server.registerTool(
   "request_action",
-  { description: `Request a HITL-gated remedial action on a customer agent: "restart" (bounce the agent \u2014 reversible, backlog replays) or "clear_pending_inbound" (move stuck pending-inbound markers aside \u2014 drops queued inbound messages, NOT reprocessed). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { action, target_agent_id, reason }.`, inputSchema: requestActionSchema },
+  { description: `Request a HITL-gated remedial action on a customer agent: "restart" (bounce the agent \u2014 reversible, backlog replays) or "clear_pending_inbound" (move stuck pending-inbound markers aside \u2014 drops queued inbound messages, NOT reprocessed). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Returns { request_id, status, write_mode, notification_status }. Only when the response is status "pending" with a request_id, surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"); on a refusal (403/404/409/503) or any other result nothing was filed, so relay that outcome instead and never say an approval was requested. Pass { action, target_agent_id, reason }. ` + REMEDIAL_WRITE_BOUNDARY, inputSchema: requestActionSchema },
   async (args) => {
     try {
       const result = await client.requestAction(args.action, {
@@ -21923,7 +21924,7 @@ server.registerTool(
 );
 server.registerTool(
   "debug_restart_agent",
-  { description: `Request a HITL-gated RESTART of a customer agent \u2014 bounce its session so the manager respawns it on the next poll (reversible; the inbound backlog replays). Use this to recover a wedged agent or to make it pick up a newly-bound integration/config change. NOT for a PAUSED agent: a paused agent's manager does not respawn it, so a restart against one does nothing at all - use \`debug_resume_agent\`, which is the only tool that ends a pause (ENG-9343). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Org-agnostic: keyed on the agent's host assignment, so it works cross-org without an active-org dependency. This is the same path as request_action({ action: "restart" }), exposed as a dedicated tool for discoverability. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { target_agent_id, reason }.`, inputSchema: restartAgentSchema },
+  { description: `Request a HITL-gated RESTART of a customer agent \u2014 bounce its session so the manager respawns it on the next poll (reversible; the inbound backlog replays). Use this to recover a wedged agent or to make it pick up a newly-bound integration/config change. NOT for a PAUSED agent: a paused agent's manager does not respawn it, so a restart against one does nothing at all - use \`debug_resume_agent\`, which is the only tool that ends a pause (ENG-9343). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Org-agnostic: keyed on the agent's host assignment, so it works cross-org without an active-org dependency. This is the same path as request_action({ action: "restart" }), exposed as a dedicated tool for discoverability. Returns { request_id, status, write_mode, notification_status }. Only when the response is status "pending" with a request_id, surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"); on a refusal (403/404/409/503) or any other result nothing was filed, so relay that outcome instead and never say an approval was requested. Pass { target_agent_id, reason }. ` + REMEDIAL_WRITE_BOUNDARY, inputSchema: restartAgentSchema },
   async (args) => {
     try {
       const result = await client.requestAction("restart", {
@@ -21938,7 +21939,7 @@ server.registerTool(
 );
 server.registerTool(
   "debug_resume_agent",
-  { description: 'Request a HITL-gated END to a customer agent\'s CIRCUIT-BREAKER pause - flip it back to active so its manager respawns it, close the agent_paused alert, and clear any pending restart request. This is the ONLY tool that ends a pause; debug_restart_agent does NOT, because a paused agent\'s manager never respawns it, so a restart against a paused agent is a no-op. SCOPE: it touches ONLY pauses whose reason is `circuit_breaker`. A "manual" pause (a person clicked Pause) and an "hourly_cost_exceeded" pause (a budget guard) are refused with a 409 - do not retry those, escalate to a human. BEFORE YOU CALL IT: the approval card names the breaker\'s trip reason and count and flags when that condition still appears to hold (e.g. other agents on the same host tripping on the same driver), so write a `reason` that addresses the driver, not just the downtime - the approver is deciding "resume DESPITE day-rollover=3", not "resume". Resuming while the driver is still live just re-trips the breaker and the agent flaps instead of failing cleanly. A HUMAN must approve in Slack, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). Returns { request_id, status, write_mode, trip_driver, trip_count, precondition_verdict, precondition_signals, notification_status }; after approval, poll check_action_status (result_payload carries { resumed, alert_closed, cleared_restart_bindings } or { resumed: false, not_eligible }). Pass { target_agent_id, reason }.', inputSchema: resumeAgentSchema },
+  { description: 'Request a HITL-gated END to a customer agent\'s CIRCUIT-BREAKER pause - flip it back to active so its manager respawns it, close the agent_paused alert, and clear any pending restart request. This is the ONLY tool that ends a pause; debug_restart_agent does NOT, because a paused agent\'s manager never respawns it, so a restart against a paused agent is a no-op. SCOPE: it touches ONLY pauses whose reason is `circuit_breaker`. A "manual" pause (a person clicked Pause) and an "hourly_cost_exceeded" pause (a budget guard) are refused with a 409 - do not retry those, escalate to a human. BEFORE YOU CALL IT: the approval card names the breaker\'s trip reason and count and flags when that condition still appears to hold (e.g. other agents on the same host tripping on the same driver), so write a `reason` that addresses the driver, not just the downtime - the approver is deciding "resume DESPITE day-rollover=3", not "resume". Resuming while the driver is still live just re-trips the breaker and the agent flaps instead of failing cleanly. A HUMAN must approve in Slack, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). Returns { request_id, status, write_mode, trip_driver, trip_count, precondition_verdict, precondition_signals, notification_status }; after approval, poll check_action_status (result_payload carries { resumed, alert_closed, cleared_restart_bindings } or { resumed: false, not_eligible }). Pass { target_agent_id, reason }. ' + REMEDIAL_WRITE_BOUNDARY, inputSchema: resumeAgentSchema },
   async (args) => {
     try {
       const result = await client.requestResumeAgent({
@@ -21953,7 +21954,7 @@ server.registerTool(
 );
 server.registerTool(
   "request_config_update",
-  { description: "Request a HITL-gated change to a customer agent's model config (primary/secondary/tertiary_model). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). The change is reversible and applies at the agent's NEXT session launch after /host/refresh \u2014 it does not restart the agent. The new value is validated against the agent before approval is requested: Claude Code (subscription) agents take a family alias (fable/opus/opus[fast]/sonnet/haiku); routed agents take a full stored model id (e.g. openrouter/anthropic/claude-opus-4-6). Use this to fix a misconfigured model (e.g. an agent wedged on a model its auth can't access). Returns { request_id, status, write_mode, notification_status }. Pass { target_agent_id, field, new_value, reason }.", inputSchema: requestConfigUpdateSchema },
+  { description: "Request a HITL-gated change to a customer agent's model config (primary/secondary/tertiary_model). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). The change is reversible and applies at the agent's NEXT session launch after /host/refresh \u2014 it does not restart the agent. The new value is validated against the agent before approval is requested: Claude Code (subscription) agents take a family alias (fable/opus/opus[fast]/sonnet/haiku); routed agents take a full stored model id (e.g. openrouter/anthropic/claude-opus-4-6). Use this to fix a misconfigured model (e.g. an agent wedged on a model its auth can't access). Returns { request_id, status, write_mode, notification_status }. Pass { target_agent_id, field, new_value, reason }. " + REMEDIAL_WRITE_BOUNDARY, inputSchema: requestConfigUpdateSchema },
   async (args) => {
     try {
       const result = await client.requestConfigUpdate({
@@ -21970,7 +21971,7 @@ server.registerTool(
 );
 server.registerTool(
   "request_ssm_run",
-  { description: "Request a HITL-gated, ALLOWLISTED read-only DIAGNOSTIC command on a customer agent's host over SSM \u2014 the escape hatch for host/process/service facts the typed read tools (debug_get_agent, debug_tail_logs, debug_host_versions) don't cover. A HUMAN must approve the EXACT command in Slack before it runs, and only if writes are armed (shadow mode runs the approval but executes nothing). This is NOT a shell: `command` is a CLOSED enum \u2014 host_health (uptime/df/free), manager_status (systemctl status agt-manager), manager_journal (journalctl -n 200), process_list (ps comm-only, no argv/env), agent_dir (ls -la ~/.augmented/<code_name>/, names only). No free-form commands, no file-content reads (use debug_tail_logs for log contents). Async: returns { request_id, status, write_mode, command_key, resolved_command, notification_status }; after approval, poll check_action_status to read the command OUTPUT in result_payload. Pass { target_agent_id, command, reason }.", inputSchema: requestSsmRunSchema },
+  { description: "Request a HITL-gated, ALLOWLISTED read-only DIAGNOSTIC command on a customer agent's host over SSM \u2014 the escape hatch for host/process/service facts the typed read tools (debug_get_agent, debug_tail_logs, debug_host_versions) don't cover. A HUMAN must approve the EXACT command in Slack before it runs, and only if writes are armed (shadow mode runs the approval but executes nothing). This is NOT a shell: `command` is a CLOSED enum \u2014 host_health (uptime/df/free), manager_status (systemctl status agt-manager), manager_journal (journalctl -n 200), process_list (ps comm-only, no argv/env), agent_dir (ls -la ~/.augmented/<code_name>/, names only). No free-form commands, no file-content reads (use debug_tail_logs for log contents). Async: returns { request_id, status, write_mode, command_key, resolved_command, notification_status }; after approval, poll check_action_status to read the command OUTPUT in result_payload. Pass { target_agent_id, command, reason }. " + REMEDIAL_WRITE_BOUNDARY, inputSchema: requestSsmRunSchema },
   async (args) => {
     try {
       const result = await client.requestSsmRun({
@@ -21986,7 +21987,7 @@ server.registerTool(
 );
 server.registerTool(
   "debug_replay_dead_letter",
-  { description: "Request a HITL-gated REPLAY of ONE dead-lettered inbound \u2014 re-inject a customer message that was parked on the host (listed by debug_inspect_dead_letters) back into the agent's live inbound so it is reprocessed. This is the inverse of clear_pending_inbound: use it to recover a message a wedged agent missed. A HUMAN must approve in Slack before anything happens, and only if writes are armed (shadow mode runs the approval but executes nothing). The marker is matched on the host by the exact (channel, store, marker_name) you pass \u2014 copy them verbatim from the inspect result \u2014 so a stale or wrong selector safely no-ops (`replayed:false, reason:not_found`) rather than moving the wrong message. Async: returns { request_id, status, write_mode, notification_status }; after approval, poll check_action_status (result_payload carries { replayed, moved_to }). Pass { target_agent_id, channel, store, marker_name, reason }.", inputSchema: replayDeadLetterSchema },
+  { description: "Request a HITL-gated REPLAY of ONE dead-lettered inbound \u2014 re-inject a customer message that was parked on the host (listed by debug_inspect_dead_letters) back into the agent's live inbound so it is reprocessed. This is the inverse of clear_pending_inbound: use it to recover a message a wedged agent missed. A HUMAN must approve in Slack before anything happens, and only if writes are armed (shadow mode runs the approval but executes nothing). The marker is matched on the host by the exact (channel, store, marker_name) you pass \u2014 copy them verbatim from the inspect result \u2014 so a stale or wrong selector safely no-ops (`replayed:false, reason:not_found`) rather than moving the wrong message. Async: returns { request_id, status, write_mode, notification_status }; after approval, poll check_action_status (result_payload carries { replayed, moved_to }). Pass { target_agent_id, channel, store, marker_name, reason }. " + REMEDIAL_WRITE_BOUNDARY, inputSchema: replayDeadLetterSchema },
   async (args) => {
     try {
       const result = await client.requestReplayDeadLetter({

package/dist/mcp/direct-chat-channel.js

@@ -32980,7 +32980,24 @@ var composio_approved_egress_default = {
     "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
     "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
     "address: add it here in the same change that lands it, or the detector correctly",
-    "reports that hosts are leaving from an address no key allows. Do not loosen the check."
+    "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
+    "",
+    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "",
+    "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
+    "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
+    "be reassigned to another AWS customer at any time. An allowlist entry naming it would",
+    "then permit a stranger's host rather than simply failing closed. Nothing was armed when",
+    "this happened, so no key ever held it - but this file IS what an operator pastes from,",
+    "which is why it is removed here the same day.",
+    "",
+    "WHY retainOnDelete DID NOT SAVE IT, because the next person will assume it would.",
+    "The option was added in the SAME change that set dev's natMode to `none`. Pulumi reads",
+    "delete-time options from the STATE recorded at the resource's last registration, and by",
+    "the time this ran the resource was no longer in the program at all - so the state still",
+    "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
+    "resource before it protects anything. The two prod EIPs above are protected, because",
+    "this apply registered them with the option set."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -32992,10 +33009,10 @@ var composio_approved_egress_default = {
       note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
     },
     {
-      ip: "15.135.204.192",
-      stage: "dev",
-      seenAsGateway: "nat-01122e6efaf4c4eaa",
-      note: "Dev-stage hosts NAT, same account. 2 instances measured 2026-09-12; their host rows live in the dev Supabase project."
+      ip: "54.253.255.215",
+      stage: "prod",
+      seenAsGateway: "nat-04384e27ab04973b5",
+      note: "Prod hosts NAT in ap-southeast-2b, created 2026-09-15 by ENG-9426. The 12 prod hosts in the 2b private subnet egress here instead of crossing to 2a. Verified live after the Pulumi apply, not predicted."
     }
   ]
 };

package/dist/mcp/index.js

@@ -25581,7 +25581,24 @@ var composio_approved_egress_default = {
     "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
     "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
     "address: add it here in the same change that lands it, or the detector correctly",
-    "reports that hosts are leaving from an address no key allows. Do not loosen the check."
+    "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
+    "",
+    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "",
+    "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
+    "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
+    "be reassigned to another AWS customer at any time. An allowlist entry naming it would",
+    "then permit a stranger's host rather than simply failing closed. Nothing was armed when",
+    "this happened, so no key ever held it - but this file IS what an operator pastes from,",
+    "which is why it is removed here the same day.",
+    "",
+    "WHY retainOnDelete DID NOT SAVE IT, because the next person will assume it would.",
+    "The option was added in the SAME change that set dev's natMode to `none`. Pulumi reads",
+    "delete-time options from the STATE recorded at the resource's last registration, and by",
+    "the time this ran the resource was no longer in the program at all - so the state still",
+    "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
+    "resource before it protects anything. The two prod EIPs above are protected, because",
+    "this apply registered them with the option set."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -25593,10 +25610,10 @@ var composio_approved_egress_default = {
       note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
     },
     {
-      ip: "15.135.204.192",
-      stage: "dev",
-      seenAsGateway: "nat-01122e6efaf4c4eaa",
-      note: "Dev-stage hosts NAT, same account. 2 instances measured 2026-09-12; their host rows live in the dev Supabase project."
+      ip: "54.253.255.215",
+      stage: "prod",
+      seenAsGateway: "nat-04384e27ab04973b5",
+      note: "Prod hosts NAT in ap-southeast-2b, created 2026-09-15 by ENG-9426. The 12 prod hosts in the 2b private subnet egress here instead of crossing to 2a. Verified live after the Pulumi apply, not predicted."
     }
   ]
 };

package/dist/mcp/origami.js

@@ -39711,7 +39711,24 @@ var composio_approved_egress_default = {
     "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
     "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
     "address: add it here in the same change that lands it, or the detector correctly",
-    "reports that hosts are leaving from an address no key allows. Do not loosen the check."
+    "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
+    "",
+    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "",
+    "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
+    "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
+    "be reassigned to another AWS customer at any time. An allowlist entry naming it would",
+    "then permit a stranger's host rather than simply failing closed. Nothing was armed when",
+    "this happened, so no key ever held it - but this file IS what an operator pastes from,",
+    "which is why it is removed here the same day.",
+    "",
+    "WHY retainOnDelete DID NOT SAVE IT, because the next person will assume it would.",
+    "The option was added in the SAME change that set dev's natMode to `none`. Pulumi reads",
+    "delete-time options from the STATE recorded at the resource's last registration, and by",
+    "the time this ran the resource was no longer in the program at all - so the state still",
+    "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
+    "resource before it protects anything. The two prod EIPs above are protected, because",
+    "this apply registered them with the option set."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -39723,10 +39740,10 @@ var composio_approved_egress_default = {
       note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
     },
     {
-      ip: "15.135.204.192",
-      stage: "dev",
-      seenAsGateway: "nat-01122e6efaf4c4eaa",
-      note: "Dev-stage hosts NAT, same account. 2 instances measured 2026-09-12; their host rows live in the dev Supabase project."
+      ip: "54.253.255.215",
+      stage: "prod",
+      seenAsGateway: "nat-04384e27ab04973b5",
+      note: "Prod hosts NAT in ap-southeast-2b, created 2026-09-15 by ENG-9426. The 12 prod hosts in the 2b private subnet egress here instead of crossing to 2a. Verified live after the Pulumi apply, not predicted."
     }
   ]
 };

package/dist/mcp/slack-channel.js

@@ -33949,7 +33949,24 @@ var composio_approved_egress_default = {
     "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
     "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
     "address: add it here in the same change that lands it, or the detector correctly",
-    "reports that hosts are leaving from an address no key allows. Do not loosen the check."
+    "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
+    "",
+    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "",
+    "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
+    "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
+    "be reassigned to another AWS customer at any time. An allowlist entry naming it would",
+    "then permit a stranger's host rather than simply failing closed. Nothing was armed when",
+    "this happened, so no key ever held it - but this file IS what an operator pastes from,",
+    "which is why it is removed here the same day.",
+    "",
+    "WHY retainOnDelete DID NOT SAVE IT, because the next person will assume it would.",
+    "The option was added in the SAME change that set dev's natMode to `none`. Pulumi reads",
+    "delete-time options from the STATE recorded at the resource's last registration, and by",
+    "the time this ran the resource was no longer in the program at all - so the state still",
+    "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
+    "resource before it protects anything. The two prod EIPs above are protected, because",
+    "this apply registered them with the option set."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -33961,10 +33978,10 @@ var composio_approved_egress_default = {
       note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
     },
     {
-      ip: "15.135.204.192",
-      stage: "dev",
-      seenAsGateway: "nat-01122e6efaf4c4eaa",
-      note: "Dev-stage hosts NAT, same account. 2 instances measured 2026-09-12; their host rows live in the dev Supabase project."
+      ip: "54.253.255.215",
+      stage: "prod",
+      seenAsGateway: "nat-04384e27ab04973b5",
+      note: "Prod hosts NAT in ap-southeast-2b, created 2026-09-15 by ENG-9426. The 12 prod hosts in the 2b private subnet egress here instead of crossing to 2a. Verified live after the Pulumi apply, not predicted."
     }
   ]
 };

package/dist/mcp/telegram-channel.js

@@ -33967,7 +33967,24 @@ var composio_approved_egress_default = {
     "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
     "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
     "address: add it here in the same change that lands it, or the detector correctly",
-    "reports that hosts are leaving from an address no key allows. Do not loosen the check."
+    "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
+    "",
+    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "",
+    "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
+    "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
+    "be reassigned to another AWS customer at any time. An allowlist entry naming it would",
+    "then permit a stranger's host rather than simply failing closed. Nothing was armed when",
+    "this happened, so no key ever held it - but this file IS what an operator pastes from,",
+    "which is why it is removed here the same day.",
+    "",
+    "WHY retainOnDelete DID NOT SAVE IT, because the next person will assume it would.",
+    "The option was added in the SAME change that set dev's natMode to `none`. Pulumi reads",
+    "delete-time options from the STATE recorded at the resource's last registration, and by",
+    "the time this ran the resource was no longer in the program at all - so the state still",
+    "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
+    "resource before it protects anything. The two prod EIPs above are protected, because",
+    "this apply registered them with the option set."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -33979,10 +33996,10 @@ var composio_approved_egress_default = {
       note: "Prod hosts NAT. Measured 2026-09-12 (ENG-10392): 25 of 25 active prod host instances route 0.0.0.0/0 here."
     },
     {
-      ip: "15.135.204.192",
-      stage: "dev",
-      seenAsGateway: "nat-01122e6efaf4c4eaa",
-      note: "Dev-stage hosts NAT, same account. 2 instances measured 2026-09-12; their host rows live in the dev Supabase project."
+      ip: "54.253.255.215",
+      stage: "prod",
+      seenAsGateway: "nat-04384e27ab04973b5",
+      note: "Prod hosts NAT in ap-southeast-2b, created 2026-09-15 by ENG-9426. The 12 prod hosts in the 2b private subnet egress here instead of crossing to 2a. Verified live after the Pulumi apply, not predicted."
     }
   ]
 };

package/dist/{persistent-session-VS57VBUF.js → persistent-session-523F5U4H.js}

@@ -62,8 +62,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-NB7WT7MA.js";
-import "./chunk-HF2GMFMJ.js";
+} from "./chunk-XN5MOKSV.js";
+import "./chunk-YZ5HGHPG.js";
 import "./chunk-XWVM4KPK.js";
 export {
   CLAUDE_HOST_WIDE,
@@ -130,4 +130,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-VS57VBUF.js.map
+//# sourceMappingURL=persistent-session-523F5U4H.js.map

package/dist/{responsiveness-probe-ZCNVWA6X.js → responsiveness-probe-CHGET573.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-NB7WT7MA.js";
-import "./chunk-HF2GMFMJ.js";
+} from "./chunk-XN5MOKSV.js";
+import "./chunk-YZ5HGHPG.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -799,4 +799,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-ZCNVWA6X.js.map
+//# sourceMappingURL=responsiveness-probe-CHGET573.js.map

package/dist/{session-auth-dead-YDAYAWNL.js → session-auth-dead-T5SUK2HT.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-HF2GMFMJ.js";
+} from "./chunk-YZ5HGHPG.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-YDAYAWNL.js.map
+//# sourceMappingURL=session-auth-dead-T5SUK2HT.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.943",
+  "version": "0.28.945",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {