@integrity-labs/agt-cli 0.28.947 → 0.28.949

package/dist/mcp/direct-chat-channel.js

@@ -38072,7 +38072,42 @@ var FLAG_REGISTRY = [
     // Deliberately NOT public. The browser has no decision to make here; the
     // consumers are the host payload that builds `input.integrations` and the
     // grant route that refuses to install the row while the flag is off.
+  },
+  {
+    key: "ip-allowlist-enforce-admin-debug",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    flagType: "boolean",
+    // Shadow. The measurement comes first: nobody yet knows the real set of
+    // staff addresses, and arming against a guess locks you out of the very
+    // tool you would use to diagnose the lockout.
+    defaultValue: false,
+    // Arming it changes who can reach production diagnostics. Worth one
+    // confirmation.
+    sensitive: true
+    // Not public: the browser makes no decision from this. The only consumer is
+    // packages/api/src/middleware/ip-allowlist.ts.
   }
+  // THERE IS DELIBERATELY NO `ip-allowlist-enforce-mcp` FLAG.
+  //
+  // The per-agent MCP surface (POST /agents/:codeName/mcp) is allowlist
+  // SHADOW-ONLY, enforced structurally rather than by a default: its entry in
+  // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
+  // flag is consulted and no flag flip can arm it.
+  //
+  // Why it is not simply a second flag defaulting false: most of that surface's
+  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
+  // agt-hosts account egress through stable NAT EIPs; a host with
+  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
+  // an address the control plane cannot know. Arming against that population
+  // black-holes a customer's whole fleet, and per
+  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // fleet-level undo. A flag would leave that one toggle away during an
+  // incident, from someone who had just armed the admin-debug surface and
+  // reasonably assumed the pair moved together. Requiring a code change puts
+  // review in front of an irreversible action, which is the right price.
+  //
+  // If the shadow data ever shows the population IS allowlistable, adding the
+  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 

package/dist/mcp/index.js

@@ -30388,7 +30388,42 @@ var FLAG_REGISTRY = [
     // Deliberately NOT public. The browser has no decision to make here; the
     // consumers are the host payload that builds `input.integrations` and the
     // grant route that refuses to install the row while the flag is off.
+  },
+  {
+    key: "ip-allowlist-enforce-admin-debug",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    flagType: "boolean",
+    // Shadow. The measurement comes first: nobody yet knows the real set of
+    // staff addresses, and arming against a guess locks you out of the very
+    // tool you would use to diagnose the lockout.
+    defaultValue: false,
+    // Arming it changes who can reach production diagnostics. Worth one
+    // confirmation.
+    sensitive: true
+    // Not public: the browser makes no decision from this. The only consumer is
+    // packages/api/src/middleware/ip-allowlist.ts.
   }
+  // THERE IS DELIBERATELY NO `ip-allowlist-enforce-mcp` FLAG.
+  //
+  // The per-agent MCP surface (POST /agents/:codeName/mcp) is allowlist
+  // SHADOW-ONLY, enforced structurally rather than by a default: its entry in
+  // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
+  // flag is consulted and no flag flip can arm it.
+  //
+  // Why it is not simply a second flag defaulting false: most of that surface's
+  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
+  // agt-hosts account egress through stable NAT EIPs; a host with
+  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
+  // an address the control plane cannot know. Arming against that population
+  // black-holes a customer's whole fleet, and per
+  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // fleet-level undo. A flag would leave that one toggle away during an
+  // incident, from someone who had just armed the admin-debug surface and
+  // reasonably assumed the pair moved together. Requiring a code change puts
+  // review in front of an irreversible action, which is the right price.
+  //
+  // If the shadow data ever shows the population IS allowlistable, adding the
+  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 

package/dist/mcp/origami.js

@@ -44315,7 +44315,42 @@ var FLAG_REGISTRY = [
     // Deliberately NOT public. The browser has no decision to make here; the
     // consumers are the host payload that builds `input.integrations` and the
     // grant route that refuses to install the row while the flag is off.
+  },
+  {
+    key: "ip-allowlist-enforce-admin-debug",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    flagType: "boolean",
+    // Shadow. The measurement comes first: nobody yet knows the real set of
+    // staff addresses, and arming against a guess locks you out of the very
+    // tool you would use to diagnose the lockout.
+    defaultValue: false,
+    // Arming it changes who can reach production diagnostics. Worth one
+    // confirmation.
+    sensitive: true
+    // Not public: the browser makes no decision from this. The only consumer is
+    // packages/api/src/middleware/ip-allowlist.ts.
   }
+  // THERE IS DELIBERATELY NO `ip-allowlist-enforce-mcp` FLAG.
+  //
+  // The per-agent MCP surface (POST /agents/:codeName/mcp) is allowlist
+  // SHADOW-ONLY, enforced structurally rather than by a default: its entry in
+  // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
+  // flag is consulted and no flag flip can arm it.
+  //
+  // Why it is not simply a second flag defaulting false: most of that surface's
+  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
+  // agt-hosts account egress through stable NAT EIPs; a host with
+  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
+  // an address the control plane cannot know. Arming against that population
+  // black-holes a customer's whole fleet, and per
+  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // fleet-level undo. A flag would leave that one toggle away during an
+  // incident, from someone who had just armed the admin-debug surface and
+  // reasonably assumed the pair moved together. Requiring a code change puts
+  // review in front of an irreversible action, which is the right price.
+  //
+  // If the shadow data ever shows the population IS allowlistable, adding the
+  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 

package/dist/mcp/slack-channel.js

@@ -38972,7 +38972,42 @@ var FLAG_REGISTRY = [
     // Deliberately NOT public. The browser has no decision to make here; the
     // consumers are the host payload that builds `input.integrations` and the
     // grant route that refuses to install the row while the flag is off.
+  },
+  {
+    key: "ip-allowlist-enforce-admin-debug",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    flagType: "boolean",
+    // Shadow. The measurement comes first: nobody yet knows the real set of
+    // staff addresses, and arming against a guess locks you out of the very
+    // tool you would use to diagnose the lockout.
+    defaultValue: false,
+    // Arming it changes who can reach production diagnostics. Worth one
+    // confirmation.
+    sensitive: true
+    // Not public: the browser makes no decision from this. The only consumer is
+    // packages/api/src/middleware/ip-allowlist.ts.
   }
+  // THERE IS DELIBERATELY NO `ip-allowlist-enforce-mcp` FLAG.
+  //
+  // The per-agent MCP surface (POST /agents/:codeName/mcp) is allowlist
+  // SHADOW-ONLY, enforced structurally rather than by a default: its entry in
+  // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
+  // flag is consulted and no flag flip can arm it.
+  //
+  // Why it is not simply a second flag defaulting false: most of that surface's
+  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
+  // agt-hosts account egress through stable NAT EIPs; a host with
+  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
+  // an address the control plane cannot know. Arming against that population
+  // black-holes a customer's whole fleet, and per
+  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // fleet-level undo. A flag would leave that one toggle away during an
+  // incident, from someone who had just armed the admin-debug surface and
+  // reasonably assumed the pair moved together. Requiring a code change puts
+  // review in front of an irreversible action, which is the right price.
+  //
+  // If the shadow data ever shows the population IS allowlistable, adding the
+  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 

package/dist/mcp/telegram-channel.js

@@ -38984,7 +38984,42 @@ var FLAG_REGISTRY = [
     // Deliberately NOT public. The browser has no decision to make here; the
     // consumers are the host payload that builds `input.integrations` and the
     // grant route that refuses to install the row while the flag is off.
+  },
+  {
+    key: "ip-allowlist-enforce-admin-debug",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    flagType: "boolean",
+    // Shadow. The measurement comes first: nobody yet knows the real set of
+    // staff addresses, and arming against a guess locks you out of the very
+    // tool you would use to diagnose the lockout.
+    defaultValue: false,
+    // Arming it changes who can reach production diagnostics. Worth one
+    // confirmation.
+    sensitive: true
+    // Not public: the browser makes no decision from this. The only consumer is
+    // packages/api/src/middleware/ip-allowlist.ts.
   }
+  // THERE IS DELIBERATELY NO `ip-allowlist-enforce-mcp` FLAG.
+  //
+  // The per-agent MCP surface (POST /agents/:codeName/mcp) is allowlist
+  // SHADOW-ONLY, enforced structurally rather than by a default: its entry in
+  // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
+  // flag is consulted and no flag flip can arm it.
+  //
+  // Why it is not simply a second flag defaulting false: most of that surface's
+  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
+  // agt-hosts account egress through stable NAT EIPs; a host with
+  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
+  // an address the control plane cannot know. Arming against that population
+  // black-holes a customer's whole fleet, and per
+  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // fleet-level undo. A flag would leave that one toggle away during an
+  // incident, from someone who had just armed the admin-debug surface and
+  // reasonably assumed the pair moved together. Requiring a code change puts
+  // review in front of an irreversible action, which is the right price.
+  //
+  // If the shadow data ever shows the population IS allowlistable, adding the
+  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 

package/dist/{persistent-session-523F5U4H.js → persistent-session-VX26HP7Z.js}

@@ -62,8 +62,9 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-XN5MOKSV.js";
-import "./chunk-YZ5HGHPG.js";
+} from "./chunk-A3T3WOC2.js";
+import "./chunk-JANAAFED.js";
+import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 export {
   CLAUDE_HOST_WIDE,
@@ -130,4 +131,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-523F5U4H.js.map
+//# sourceMappingURL=persistent-session-VX26HP7Z.js.map

package/dist/{responsiveness-probe-CHGET573.js → responsiveness-probe-5LUHQCKN.js}

@@ -1,7 +1,8 @@
 import {
   paneLogPath
-} from "./chunk-XN5MOKSV.js";
-import "./chunk-YZ5HGHPG.js";
+} from "./chunk-A3T3WOC2.js";
+import "./chunk-JANAAFED.js";
+import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -799,4 +800,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-CHGET573.js.map
+//# sourceMappingURL=responsiveness-probe-5LUHQCKN.js.map