@integrity-labs/agt-cli 0.28.962 → 0.28.964

package/dist/{chunk-MNARTDPO.js → chunk-WVOB2TIP.js}

@@ -20,7 +20,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-D3FGOGI2.js";
+} from "./chunk-SMZQHDO7.js";
 import {
   classifyUnanswerablePane,
   findUsageLimitResetHint,
@@ -5575,4 +5575,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-MNARTDPO.js.map
+//# sourceMappingURL=chunk-WVOB2TIP.js.map

package/dist/{claude-pair-runtime-6DGCWXRM.js → claude-pair-runtime-QEVUC7L4.js}

@@ -236,7 +236,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-22PIKH3S.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-TZO2JPCC.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -558,4 +558,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-6DGCWXRM.js.map
+//# sourceMappingURL=claude-pair-runtime-QEVUC7L4.js.map

package/dist/lib/manager-worker.js

@@ -63,7 +63,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-37AUMVY3.js";
+} from "../chunk-JCAQEJYK.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -140,7 +140,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-MNARTDPO.js";
+} from "../chunk-WVOB2TIP.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -236,7 +236,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-D3FGOGI2.js";
+} from "../chunk-SMZQHDO7.js";
 import "../chunk-DHWNVVX4.js";
 import {
   reapOrphanChannelMcps
@@ -13262,7 +13262,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-3HPANEK6.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-DW7SMQGE.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13947,7 +13947,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.962" : "dev";
+var agtCliVersion = true ? "0.28.964" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15549,7 +15549,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-22PIKH3S.js");
+      const { collectDiagnostics } = await import("../persistent-session-TZO2JPCC.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15691,7 +15691,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-22PIKH3S.js");
+      const { collectDiagnostics } = await import("../persistent-session-TZO2JPCC.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15867,7 +15867,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-3HPANEK6.js");
+      } = await import("../responsiveness-probe-DW7SMQGE.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -15984,7 +15984,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-3HPANEK6.js");
+        } = await import("../responsiveness-probe-DW7SMQGE.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16140,7 +16140,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-FAIJPJUK.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-5D3XND6M.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20416,7 +20416,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-3HPANEK6.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-DW7SMQGE.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20459,7 +20459,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-22PIKH3S.js");
+        const { collectDiagnostics } = await import("../persistent-session-TZO2JPCC.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20510,7 +20510,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-22PIKH3S.js");
+      const { collectDiagnostics } = await import("../persistent-session-TZO2JPCC.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -21152,7 +21152,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-6DGCWXRM.js");
+  } = await import("../claude-pair-runtime-QEVUC7L4.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -32977,12 +32977,12 @@ var composio_approved_egress_default = {
     "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
     "EIP adoption exists to create.",
     "",
-    "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
-    "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
-    "address: add it here in the same change that lands it, or the detector correctly",
+    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
+    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
+    "same change that created it. Do the same for the next one, or the detector correctly",
     "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
-    "",
-    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
+    "account at all - which is why the bridge note below is written out by hand instead.",
     "",
     "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
     "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
@@ -32996,8 +32996,24 @@ var composio_approved_egress_default = {
     "delete-time options from the STATE recorded at the resource's last registration, and by",
     "the time this ran the resource was no longer in the program at all - so the state still",
     "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
-    "resource before it protects anything. The two prod EIPs above are protected, because",
-    "this apply registered them with the option set."
+    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
+    "this apply registered them with the option set.",
+    "",
+    "TWO BRIDGE ADDRESSES ARE STILL MISSING FROM THIS FILE (ENG-9684, 2026-09-15).",
+    "The control-plane egress bridge is being deployed to prod with a managed multi-AZ NAT,",
+    "which allocates two more Elastic IPs - in the CONTROL PLANE account (109039361030), not",
+    "the hosts account. They are not listed here yet because they do not exist until that",
+    "deploy runs; read them from SSM at",
+    "/augmented/prod/secrets/COMPOSIO_EGRESS_IPS (comma-separated, ready to paste) and add",
+    "them here in the same change that arms anything.",
+    "",
+    "THE DETECTOR CANNOT VERIFY THOSE TWO, AND THAT IS CORRECT, NOT A BUG.",
+    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
+    "only the addresses instances there actually route through. Bridge addresses will sit in",
+    "this set unmatched and unflagged. Do NOT 'fix' that by trimming this file to what the",
+    "detector checks: the file records what the ALLOWLIST must hold, which is a superset of",
+    "what any one account scan can see. Trimming it would make the allowlist incomplete,",
+    "which is a fleet-wide 401 rather than a tidy file."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",

package/dist/mcp/index.js

@@ -25578,12 +25578,12 @@ var composio_approved_egress_default = {
     "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
     "EIP adoption exists to create.",
     "",
-    "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
-    "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
-    "address: add it here in the same change that lands it, or the detector correctly",
+    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
+    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
+    "same change that created it. Do the same for the next one, or the detector correctly",
     "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
-    "",
-    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
+    "account at all - which is why the bridge note below is written out by hand instead.",
     "",
     "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
     "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
@@ -25597,8 +25597,24 @@ var composio_approved_egress_default = {
     "delete-time options from the STATE recorded at the resource's last registration, and by",
     "the time this ran the resource was no longer in the program at all - so the state still",
     "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
-    "resource before it protects anything. The two prod EIPs above are protected, because",
-    "this apply registered them with the option set."
+    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
+    "this apply registered them with the option set.",
+    "",
+    "TWO BRIDGE ADDRESSES ARE STILL MISSING FROM THIS FILE (ENG-9684, 2026-09-15).",
+    "The control-plane egress bridge is being deployed to prod with a managed multi-AZ NAT,",
+    "which allocates two more Elastic IPs - in the CONTROL PLANE account (109039361030), not",
+    "the hosts account. They are not listed here yet because they do not exist until that",
+    "deploy runs; read them from SSM at",
+    "/augmented/prod/secrets/COMPOSIO_EGRESS_IPS (comma-separated, ready to paste) and add",
+    "them here in the same change that arms anything.",
+    "",
+    "THE DETECTOR CANNOT VERIFY THOSE TWO, AND THAT IS CORRECT, NOT A BUG.",
+    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
+    "only the addresses instances there actually route through. Bridge addresses will sit in",
+    "this set unmatched and unflagged. Do NOT 'fix' that by trimming this file to what the",
+    "detector checks: the file records what the ALLOWLIST must hold, which is a superset of",
+    "what any one account scan can see. Trimming it would make the allowlist incomplete,",
+    "which is a fleet-wide 401 rather than a tidy file."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",

package/dist/mcp/origami.js

@@ -39729,12 +39729,12 @@ var composio_approved_egress_default = {
     "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
     "EIP adoption exists to create.",
     "",
-    "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
-    "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
-    "address: add it here in the same change that lands it, or the detector correctly",
+    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
+    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
+    "same change that created it. Do the same for the next one, or the detector correctly",
     "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
-    "",
-    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
+    "account at all - which is why the bridge note below is written out by hand instead.",
     "",
     "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
     "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
@@ -39748,8 +39748,24 @@ var composio_approved_egress_default = {
     "delete-time options from the STATE recorded at the resource's last registration, and by",
     "the time this ran the resource was no longer in the program at all - so the state still",
     "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
-    "resource before it protects anything. The two prod EIPs above are protected, because",
-    "this apply registered them with the option set."
+    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
+    "this apply registered them with the option set.",
+    "",
+    "TWO BRIDGE ADDRESSES ARE STILL MISSING FROM THIS FILE (ENG-9684, 2026-09-15).",
+    "The control-plane egress bridge is being deployed to prod with a managed multi-AZ NAT,",
+    "which allocates two more Elastic IPs - in the CONTROL PLANE account (109039361030), not",
+    "the hosts account. They are not listed here yet because they do not exist until that",
+    "deploy runs; read them from SSM at",
+    "/augmented/prod/secrets/COMPOSIO_EGRESS_IPS (comma-separated, ready to paste) and add",
+    "them here in the same change that arms anything.",
+    "",
+    "THE DETECTOR CANNOT VERIFY THOSE TWO, AND THAT IS CORRECT, NOT A BUG.",
+    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
+    "only the addresses instances there actually route through. Bridge addresses will sit in",
+    "this set unmatched and unflagged. Do NOT 'fix' that by trimming this file to what the",
+    "detector checks: the file records what the ALLOWLIST must hold, which is a superset of",
+    "what any one account scan can see. Trimming it would make the allowlist incomplete,",
+    "which is a fleet-wide 401 rather than a tidy file."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",

package/dist/mcp/slack-channel.js

@@ -33946,12 +33946,12 @@ var composio_approved_egress_default = {
     "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
     "EIP adoption exists to create.",
     "",
-    "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
-    "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
-    "address: add it here in the same change that lands it, or the detector correctly",
+    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
+    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
+    "same change that created it. Do the same for the next one, or the detector correctly",
     "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
-    "",
-    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
+    "account at all - which is why the bridge note below is written out by hand instead.",
     "",
     "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
     "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
@@ -33965,8 +33965,24 @@ var composio_approved_egress_default = {
     "delete-time options from the STATE recorded at the resource's last registration, and by",
     "the time this ran the resource was no longer in the program at all - so the state still",
     "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
-    "resource before it protects anything. The two prod EIPs above are protected, because",
-    "this apply registered them with the option set."
+    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
+    "this apply registered them with the option set.",
+    "",
+    "TWO BRIDGE ADDRESSES ARE STILL MISSING FROM THIS FILE (ENG-9684, 2026-09-15).",
+    "The control-plane egress bridge is being deployed to prod with a managed multi-AZ NAT,",
+    "which allocates two more Elastic IPs - in the CONTROL PLANE account (109039361030), not",
+    "the hosts account. They are not listed here yet because they do not exist until that",
+    "deploy runs; read them from SSM at",
+    "/augmented/prod/secrets/COMPOSIO_EGRESS_IPS (comma-separated, ready to paste) and add",
+    "them here in the same change that arms anything.",
+    "",
+    "THE DETECTOR CANNOT VERIFY THOSE TWO, AND THAT IS CORRECT, NOT A BUG.",
+    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
+    "only the addresses instances there actually route through. Bridge addresses will sit in",
+    "this set unmatched and unflagged. Do NOT 'fix' that by trimming this file to what the",
+    "detector checks: the file records what the ALLOWLIST must hold, which is a superset of",
+    "what any one account scan can see. Trimming it would make the allowlist incomplete,",
+    "which is a fleet-wide 401 rather than a tidy file."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",

package/dist/mcp/telegram-channel.js

@@ -33964,12 +33964,12 @@ var composio_approved_egress_default = {
     "id, so comparing ids would red on the safe case - which is precisely the case Part 2's",
     "EIP adoption exists to create.",
     "",
-    "WHEN ENG-9426 LANDS THIS GOES RED UNTIL IT IS UPDATED. That is the forcing function",
-    "working, not a fault. ENG-9426 adds a NAT in ap-southeast-2b, i.e. a THIRD egress",
-    "address: add it here in the same change that lands it, or the detector correctly",
+    "ANY NEW HOSTS-ACCOUNT EGRESS ADDRESS TURNS THE DETECTOR RED UNTIL IT IS ADDED HERE.",
+    "That is the forcing function working, not a fault: ENG-9426's 2b NAT was added in the",
+    "same change that created it. Do the same for the next one, or the detector correctly",
     "reports that hosts are leaving from an address no key allows. Do not loosen the check.",
-    "",
-    "         crossing to 2a and stop dying with it. The address does not exist until",
+    "A CONTROL-PLANE address gets no such forcing function - the detector never sees that",
+    "account at all - which is why the bridge note below is written out by hand instead.",
     "",
     "15.135.204.192 IS GONE AND MUST NOT BE RE-ADDED (ENG-9426, 2026-09-15).",
     "The dev NAT was retired and that address was RELEASED back to the AWS pool, so it can",
@@ -33983,8 +33983,24 @@ var composio_approved_egress_default = {
     "delete-time options from the STATE recorded at the resource's last registration, and by",
     "the time this ran the resource was no longer in the program at all - so the state still",
     "said 'delete normally'. retainOnDelete has to land in a deploy that STILL DECLARES the",
-    "resource before it protects anything. The two prod EIPs above are protected, because",
-    "this apply registered them with the option set."
+    "resource before it protects anything. The two prod hosts EIPs listed below are protected, because",
+    "this apply registered them with the option set.",
+    "",
+    "TWO BRIDGE ADDRESSES ARE STILL MISSING FROM THIS FILE (ENG-9684, 2026-09-15).",
+    "The control-plane egress bridge is being deployed to prod with a managed multi-AZ NAT,",
+    "which allocates two more Elastic IPs - in the CONTROL PLANE account (109039361030), not",
+    "the hosts account. They are not listed here yet because they do not exist until that",
+    "deploy runs; read them from SSM at",
+    "/augmented/prod/secrets/COMPOSIO_EGRESS_IPS (comma-separated, ready to paste) and add",
+    "them here in the same change that arms anything.",
+    "",
+    "THE DETECTOR CANNOT VERIFY THOSE TWO, AND THAT IS CORRECT, NOT A BUG.",
+    "ComposioEgressAddressDrift enumerates ONE account - the hosts account - so it compares",
+    "only the addresses instances there actually route through. Bridge addresses will sit in",
+    "this set unmatched and unflagged. Do NOT 'fix' that by trimming this file to what the",
+    "detector checks: the file records what the ALLOWLIST must hold, which is a superset of",
+    "what any one account scan can see. Trimming it would make the allowlist incomplete,",
+    "which is a fleet-wide 401 rather than a tidy file."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",

package/dist/mcp/xero.js

@@ -114353,6 +114353,16 @@ function pickTenantId(tenants, desired) {
   return desired;
 }
 
+// src/helpers/tenant-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var store = new AsyncLocalStorage();
+function runWithTenant(tenantId, fn) {
+  return store.run({ tenantId }, fn);
+}
+function currentCallTenant() {
+  return store.getStore()?.tenantId;
+}
+
 // src/clients/broker-credential-client.ts
 function makeError(status, message, needsReauth = false) {
   const err = new Error(message);
@@ -114437,7 +114447,11 @@ var BrokerCredentialClient = class {
           tenantId: res.data.tenant_id ?? null,
           expiresAt: res.data.expires_at ?? null,
           grantedScopes: res.data.granted_scopes ?? null,
-          effectiveScopes: res.data.effective_scopes ?? null
+          effectiveScopes: res.data.effective_scopes ?? null,
+          allowedTenants: Array.isArray(res.data.allowed_tenants) ? res.data.allowed_tenants.filter((t) => typeof t?.tenant_id === "string" && t.tenant_id.trim() !== "").map((t) => ({
+            tenantId: t.tenant_id.trim(),
+            tenantName: typeof t.tenant_name === "string" ? t.tenant_name : null
+          })) : null
         };
       } catch (err) {
         if (err.status !== void 0) throw err;
@@ -114512,12 +114526,44 @@ if (!broker_mode && !bearer_token && (!client_id || !client_secret)) {
   throw Error("Environment Variables not set - please check your .env file");
 }
 var MCPXeroClient = class extends import_xero_node.XeroClient {
-  tenantId;
-  shortCode;
+  pinnedTenantId = "";
+  // CS-1739: one short code per organisation, since a call can now target any
+  // allowed organisation and a deep link must point at the right one.
+  shortCodes = /* @__PURE__ */ new Map();
+  /** CS-1739: the organisations the platform allows for this login (broker mode). */
+  /**
+   * CS-1739: the operator's organisation list from the broker.
+   *   null = the platform sent none (older API, or a non-broker install), so
+   *          the single pinned tenant applies;
+   *   []   = an EXPLICIT empty list (nothing intersected), which must refuse
+   *          every call rather than fall back to the pin. CodeRabbit on #6188:
+   *          collapsing both to [] let a call run against the pinned tenant
+   *          despite the operator allowing nothing.
+   */
+  allowedTenants = null;
   constructor(config2) {
     super(config2);
-    this.tenantId = "";
-    this.shortCode = "";
+  }
+  /**
+   * The tenant for the CURRENT tool call when one was chosen (CS-1739), else
+   * the pinned tenant. Handlers keep reading `xeroClient.tenantId` unchanged.
+   */
+  get tenantId() {
+    return currentCallTenant() ?? this.pinnedTenantId;
+  }
+  set tenantId(value) {
+    this.pinnedTenantId = value;
+  }
+  /**
+   * CS-1739: the organisations a tool call may target. The broker's list when
+   * it sent one; otherwise the single pinned tenant (older API / non-broker).
+   */
+  async getAllowedTenants() {
+    await this.authenticate();
+    if (this.allowedTenants !== null) return this.allowedTenants;
+    if (!this.pinnedTenantId) return [];
+    const match = (this.tenants ?? []).find((t) => t?.tenantId === this.pinnedTenantId);
+    return [{ tenantId: this.pinnedTenantId, tenantName: match?.tenantName ?? null }];
   }
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   async updateTenants(fullOrgDetails) {
@@ -114537,10 +114583,11 @@ var MCPXeroClient = class extends import_xero_node.XeroClient {
     return organisation;
   }
   async getShortCode() {
-    if (!this.shortCode) {
+    const key = this.tenantId;
+    if (!this.shortCodes.has(key)) {
       try {
         const organisation = await this.getOrganisation();
-        this.shortCode = organisation.shortCode ?? "";
+        this.shortCodes.set(key, organisation.shortCode ?? "");
       } catch (error2) {
         const err = ensureError(error2);
         throw new Error(
@@ -114548,7 +114595,7 @@ var MCPXeroClient = class extends import_xero_node.XeroClient {
         );
       }
     }
-    return this.shortCode;
+    return this.shortCodes.get(key);
   }
 };
 var CustomConnectionsXeroClient = class extends MCPXeroClient {
@@ -114681,6 +114728,7 @@ var BrokerBearerTokenXeroClient = class extends MCPXeroClient {
     this.setTokenSet({
       access_token: cred.accessToken
     });
+    this.allowedTenants = cred.allowedTenants ?? null;
     if (cred.tenantId) {
       this.tenantId = cred.tenantId;
     } else {
@@ -120844,6 +120892,100 @@ var UpdateTools = [
   update_repeating_invoice_tool_default
 ];
 
+// src/tools/list/list-organisations.tool.ts
+var ListOrganisationsTool = CreateXeroTool(
+  "list-organisations",
+  "Lists the Xero organisations this agent is allowed to use, with each organisation's tenant_id. Pass one of these tenant_id values to any Xero tool to target that organisation. Read-only.",
+  {},
+  async () => {
+    try {
+      const allowed = await xeroClient.getAllowedTenants();
+      if (allowed.length === 0) {
+        return {
+          content: [{ type: "text", text: "No Xero organisation is selected for this agent. Ask an admin to choose one in the console." }],
+          isError: true
+        };
+      }
+      const lines = allowed.map(
+        (t, i) => `${i + 1}. ${t.tenantName ?? "(name unknown)"} - tenant_id: ${t.tenantId}${i === 0 ? " (default)" : ""}`
+      );
+      return {
+        content: [{ type: "text", text: `Xero organisations this agent may use:
+${lines.join("\n")}` }]
+      };
+    } catch (error2) {
+      return {
+        content: [{ type: "text", text: `Could not list Xero organisations: ${ensureError(error2).message}` }],
+        isError: true
+      };
+    }
+  }
+);
+var list_organisations_tool_default = ListOrganisationsTool;
+
+// src/helpers/resolve-call-tenant.ts
+function describe(allowed) {
+  return allowed.map((t) => t.tenantName ? `${t.tenantName} (${t.tenantId})` : t.tenantId).join(", ");
+}
+function resolveCallTenant(allowed, requested) {
+  const wanted = typeof requested === "string" ? requested.trim() : "";
+  if (allowed !== null && allowed.length === 0) {
+    return {
+      ok: false,
+      message: "This agent has no Xero organisations selected, so no Xero call can run. Ask an admin to choose the organisations for this integration."
+    };
+  }
+  if (allowed === null) {
+    if (wanted) {
+      return {
+        ok: false,
+        message: `tenant_id ${wanted} cannot be used: this Xero connection has no organisation list to check it against.`
+      };
+    }
+    return { ok: true, tenantId: void 0 };
+  }
+  if (wanted) {
+    if (allowed.some((t) => t.tenantId === wanted)) return { ok: true, tenantId: wanted };
+    return {
+      ok: false,
+      message: `tenant_id ${wanted} is not one of the Xero organisations this agent may use: ${describe(allowed)}.`
+    };
+  }
+  if (allowed.length === 1) return { ok: true, tenantId: allowed[0].tenantId };
+  return {
+    ok: false,
+    message: `This agent can use more than one Xero organisation, so pass tenant_id. Allowed: ${describe(allowed)}. Call list-organisations to see them.`
+  };
+}
+
+// src/tools/tenant-scope.ts
+var TENANT_ID_ARG_DESCRIPTION = "Optional. The Xero organisation id (tenant) to use. Needed only when this agent can use more than one Xero organisation; call list-organisations to see them. Defaults to the only allowed organisation.";
+function errorResult(text) {
+  return { content: [{ type: "text", text }], isError: true };
+}
+function withTenantScope(tool) {
+  const schema = tool.schema ?? {};
+  if ("tenant_id" in schema) return tool;
+  return {
+    ...tool,
+    schema: { ...schema, tenant_id: external_exports.string().optional().describe(TENANT_ID_ARG_DESCRIPTION) },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    handler: (async (args, extra) => {
+      const { tenant_id: requested, ...rest } = args ?? {};
+      let allowed;
+      try {
+        allowed = await xeroClient.getAllowedTenants();
+      } catch (error2) {
+        return errorResult(`Could not resolve the Xero organisations for this agent: ${ensureError(error2).message}`);
+      }
+      const choice = resolveCallTenant(allowed, typeof requested === "string" ? requested : void 0);
+      if (!choice.ok) return errorResult(choice.message);
+      const call = () => tool.handler(rest, extra);
+      return choice.tenantId === void 0 ? call() : runWithTenant(choice.tenantId, call);
+    })
+  };
+}
+
 // src/tools/tool-factory.ts
 function writesGoViaBroker() {
   const raw = (process.env.XERO_WRITES_VIA_BROKER ?? "").trim().toLowerCase();
@@ -120877,15 +121019,17 @@ function ToolFactory(server, effectiveScopes = null) {
       "xero-mcp-server: agent policy excludes payroll scopes \u2014 payroll tools not registered (ENG-7824)."
     );
   }
-  GetTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
-  ListTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
-  AttachmentTools.map((tool) => tool()).forEach(
+  const listOrganisations = list_organisations_tool_default();
+  server.tool(listOrganisations.name, listOrganisations.description, listOrganisations.schema, listOrganisations.handler);
+  GetTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  ListTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  AttachmentTools.map((tool) => tool()).map(withTenantScope).forEach(
     (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
   );
   if (readOnly) return;
-  DeleteTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
-  CreateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
-  UpdateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  DeleteTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  CreateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  UpdateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
 }
 
 // src/index.ts

package/dist/{persistent-session-22PIKH3S.js → persistent-session-TZO2JPCC.js}

@@ -62,8 +62,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-MNARTDPO.js";
-import "./chunk-D3FGOGI2.js";
+} from "./chunk-WVOB2TIP.js";
+import "./chunk-SMZQHDO7.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 export {
@@ -131,4 +131,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-22PIKH3S.js.map
+//# sourceMappingURL=persistent-session-TZO2JPCC.js.map