@integrity-labs/agt-cli 0.28.973 → 0.28.975

package/dist/mcp/index.js

@@ -24656,21 +24656,80 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // ancestors too - a wider style mutation than intended, for a probe whose
   // result the caller then rejects anyway.
   function textNodeAtPointThrough(x,y,target){
+    return throughOverlays(x,y,target,function(){ return textNodeAtPoint(x,y); });
+  }
+  // Run probe() with everything stacked IN FRONT of target muted for pointer
+  // hit-testing, then restore it. Shared by the text-node probe above and the
+  // caret placement below (ENG-10632), so there is one overlay-muting path.
+  // A target that is not in the hit stack (or no elementsFromPoint at all) runs
+  // the probe unmuted, for the reason given on textNodeAtPointThrough.
+  function throughOverlays(x,y,target,probe){
     var stack;
-    try{ stack=document.elementsFromPoint(x,y)||[]; }catch(e){ return textNodeAtPoint(x,y); }
+    try{ stack=document.elementsFromPoint(x,y)||[]; }catch(e){ return probe(); }
     var cut=-1, i;
-    for(i=0;i<stack.length;i++){ if(stack[i]===target){ cut=i; break; } }
-    if(cut<0) return textNodeAtPoint(x,y);
+    for(i=0;i<stack.length;i++){ if(stack[i]===target || (target && target.contains && stack[i] && stack[i].nodeType && target.contains(stack[i]))){ cut=i; break; } }
+    if(cut<0) return probe();
     var muted=[];
     for(i=0;i<cut;i++){
       muted.push([stack[i], stack[i].style ? stack[i].style.pointerEvents : '']);
       try{ stack[i].style.pointerEvents='none'; }catch(e){}
     }
-    try{ return textNodeAtPoint(x,y); }
+    try{ return probe(); }
     finally{
       for(i=0;i<muted.length;i++){ try{ muted[i][0].style.pointerEvents=muted[i][1]||''; }catch(e){} }
     }
   }
+  // ENG-10632: is this pointer event aimed INSIDE the open editor?
+  //
+  // 'direct' - the event's own target is the editor or inside it (no overlay).
+  // 'through' - the target is something laid over the editor (a deck click
+  //   zone), but the editor is in the hit stack under the pointer.
+  // null     - no edit is open, or the press is genuinely elsewhere.
+  //
+  // WHY NOT e.target ALONE. That is exactly the ENG-8477 blind spot: a pointer
+  // event targets the HIT-TEST result, and a deck's full-viewport zones win the
+  // hit test, so e.target is the zone for every press on slide text. ENG-8477
+  // fixed the click that OPENS an editor this way and left the guards that
+  // protect an OPEN editor keyed on e.target, so the second click - the one that
+  // places the caret - was handed to the zone and paged the slide.
+  //
+  // A keydown is different: it targets the FOCUSED element, so the ENG-8500 key
+  // guard's e.target test is correct and stays as it is.
+  function pointInEditor(e){
+    if(!editing || !e) return null;
+    var t=e.target;
+    if(t===editing || (editing.contains && t && t.nodeType && editing.contains(t))) return 'direct';
+    if(typeof e.clientX!=='number' || typeof e.clientY!=='number') return null;
+    var stack;
+    try{ stack=document.elementsFromPoint(e.clientX, e.clientY)||[]; }catch(err){ return null; }
+    for(var i=0;i<stack.length;i++){
+      var n=stack[i];
+      if(n===editing || (editing.contains && n && n.nodeType && editing.contains(n))) return 'through';
+    }
+    return null;
+  }
+  // ENG-10632: put the caret where the viewer pressed, as the browser would have
+  // if nothing covered the editor. The browser's own caret placement goes to the
+  // topmost element, which is the overlay, so it places nothing in the text.
+  // Returns true when a caret was placed inside the editor.
+  function placeCaretAtPointThrough(x,y,el){
+    return throughOverlays(x,y,el,function(){
+      try{
+        var node=null, offset=0, r=null;
+        if(document.caretRangeFromPoint){
+          r=document.caretRangeFromPoint(x,y);
+          if(r){ node=r.startContainer; offset=r.startOffset||0; }
+        } else if(document.caretPositionFromPoint){
+          var p=document.caretPositionFromPoint(x,y);
+          if(p){ node=p.offsetNode; offset=p.offset||0; }
+        }
+        if(!node || !(node===el || (el.contains && el.contains(node.nodeType===3 ? node.parentNode||node.parentElement : node)))) return false;
+        if(!r){ r=document.createRange(); r.setStart(node, offset); r.collapse(true); }
+        var s=document.getSelection(); s.removeAllRanges(); s.addRange(r);
+        return true;
+      }catch(err){ return false; }
+    });
+  }
   // Index of a text node among its parent's child TEXT nodes, in order - the same
   // counting the server uses to re-locate it in source_html (ENG-6856).
   function textIndexOf(container, tn){
@@ -24678,6 +24737,13 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     for(var k=0;k<ns.length;k++){ if(ns[k].nodeType===3){ i++; if(ns[k]===tn) return i; } }
     return -1;
   }
+  function keepCaretIn(el){
+    try{
+      var s=document.getSelection(), n=s && s.rangeCount ? s.anchorNode : null;
+      if(n && (n===el || (el.contains && el.contains(n.nodeType===3 ? n.parentNode : n)))) return;
+    }catch(err){}
+    placeCaretEnd(el);
+  }
   function placeCaretEnd(el){ try{ var r=document.createRange(); r.selectNodeContents(el); r.collapse(false); var s=document.getSelection(); s.removeAllRanges(); s.addRange(r); }catch(e){} }
   // The Save/Cancel toolbar anchored above el. Shared by whole-element edits
   // (startEdit) and per-text-node edits (startEditTextNode).
@@ -24887,9 +24953,35 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // press that lands inside the editor. A press anywhere else is the viewer
   // leaving, and the artefact keeps it.
   window.addEventListener('pointerdown', function(e){
-    if(!editing) return;
-    var t=e.target;
-    if(t!==editing && !(editing.contains && t && t.nodeType && editing.contains(t))) return;
+    // ENG-10632: "inside the editor" is decided through the hit stack, not from
+    // e.target, which a deck's click zone always wins. See pointInEditor.
+    var where=pointInEditor(e);
+    if(!where) return;
+    e.stopImmediatePropagation();
+    if(where==='through'){
+      // The overlay is the browser's hit target, so its default action would
+      // move focus off the editor and place no caret in the text. Take both over.
+      try{ e.preventDefault(); }catch(err){}
+      try{ editing.focus(); }catch(err){}
+      // The press is suppressed either way, so a probe that cannot resolve a
+      // point inside the editor must not leave it without a caret: keep one the
+      // editor already holds, otherwise put it at the end of the text.
+      if(!placeCaretAtPointThrough(e.clientX, e.clientY, editing)) keepCaretIn(editing);
+    }
+  }, true);
+  // ENG-10632: the same press also arrives as mousedown and click, and the deck
+  // can page on either. Only a press that went THROUGH an overlay into the open
+  // editor is swallowed; a direct press keeps its native behaviour (caret,
+  // drag-select), and a press anywhere else is the viewer leaving and is left to
+  // the artefact.
+  window.addEventListener('mousedown', function(e){
+    if(pointInEditor(e)!=='through') return;
+    try{ e.preventDefault(); }catch(err){}
+    e.stopImmediatePropagation();
+  }, true);
+  window.addEventListener('click', function(e){
+    if(pointInEditor(e)!=='through') return;
+    try{ e.preventDefault(); }catch(err){}
     e.stopImmediatePropagation();
   }, true);
   // ENG-8477: the hover affordance has the same blind spot as the click did -
@@ -30498,11 +30590,18 @@ var FLAG_REGISTRY = [
   },
   {
     key: "ip-allowlist-enforce-admin-debug",
-    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. There is deliberately NO counterpart flag for the per-agent MCP surface: that one is shadow-only structurally (its ENFORCE_FLAG entry is null), so arming this one does not and cannot arm that one. See the comment below this entry for why.",
     flagType: "boolean",
-    // Shadow. The measurement comes first: nobody yet knows the real set of
-    // staff addresses, and arming against a guess locks you out of the very
-    // tool you would use to diagnose the lockout.
+    // Shadow. The measurement comes first - and ENG-10664 corrected what the
+    // measurement is OF. This comment used to say "nobody yet knows the real set
+    // of staff addresses": there is no such set. Measured over 48h, all 315
+    // requests to this surface came from ONE address, the agt-hosts AZ-2a NAT
+    // EIP - an AGENT calling the debug_* tools, not a person. The decided policy
+    // is that it stays that way (admin-debug is only ever reached from our own
+    // NAT gateways). So the pre-arm check is not "does my laptop appear" but
+    // "is every NAT EIP in the list", because an AZ whose NAT has not yet
+    // carried a debug_* call is absent from the log and would be refused the
+    // instant this flips. See docs/runbooks/ip-allowlist-rollout.md step 3.
     defaultValue: false,
     // Arming it changes who can reach production diagnostics. Worth one
     // confirmation.
@@ -30517,20 +30616,34 @@ var FLAG_REGISTRY = [
   // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
   // flag is consulted and no flag flip can arm it.
   //
-  // Why it is not simply a second flag defaulting false: most of that surface's
-  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
-  // agt-hosts account egress through stable NAT EIPs; a host with
-  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
-  // an address the control plane cannot know. Arming against that population
-  // black-holes a customer's whole fleet, and per
-  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // Why it is not simply a second flag defaulting false (CORRECTED, ENG-10664):
+  //
+  // This comment used to say the callers are agent HOSTS, most of which have no
+  // allowlistable address per ADR-0032. That is the wrong caller. Agent hosts do
+  // not call this surface at all: its handler's first act is
+  // validateMcpAccessToken() against `mcp_oauth_tokens` (routes/mcp.ts:87, token
+  // check at :91), so a host JWT is rejected outright - routes/host-runtime.ts
+  // :33421 says so in as many words, which is why the ENG-4724 /host/* twins
+  // exist. The caller set is remote MCP OAuth clients, structurally.
+  //
+  // The conclusion is unchanged and ONLY the reason has moved. Allowlisting this
+  // surface would mean pinning a THIRD PARTY's egress ranges rather than our own
+  // NAT EIPs - a different control, a different owner, a different failure mode:
+  // they move a range and agent MCP access breaks with no signal on our side.
+  // Per docs/runbooks/composio-allowlist-rollout.md this class of change has no
   // fleet-level undo. A flag would leave that one toggle away during an
   // incident, from someone who had just armed the admin-debug surface and
   // reasonably assumed the pair moved together. Requiring a code change puts
   // review in front of an irreversible action, which is the right price.
   //
-  // If the shadow data ever shows the population IS allowlistable, adding the
-  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
+  // Keeping the false rationale would have been worse than having none: a reader
+  // who checked it would find it does not hold and might "fix" it by adding the
+  // flag. That is the failure this rewrite exists to prevent.
+  //
+  // If we ever DECIDE to take on that third-party dependency deliberately,
+  // adding the flag here and a key in ENFORCE_FLAG is a small diff - but it is a
+  // decision to own someone else's egress, not a discovery that the population
+  // was allowlistable all along.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 

package/dist/mcp/origami.js

@@ -38807,21 +38807,80 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // ancestors too - a wider style mutation than intended, for a probe whose
   // result the caller then rejects anyway.
   function textNodeAtPointThrough(x,y,target){
+    return throughOverlays(x,y,target,function(){ return textNodeAtPoint(x,y); });
+  }
+  // Run probe() with everything stacked IN FRONT of target muted for pointer
+  // hit-testing, then restore it. Shared by the text-node probe above and the
+  // caret placement below (ENG-10632), so there is one overlay-muting path.
+  // A target that is not in the hit stack (or no elementsFromPoint at all) runs
+  // the probe unmuted, for the reason given on textNodeAtPointThrough.
+  function throughOverlays(x,y,target,probe){
     var stack;
-    try{ stack=document.elementsFromPoint(x,y)||[]; }catch(e){ return textNodeAtPoint(x,y); }
+    try{ stack=document.elementsFromPoint(x,y)||[]; }catch(e){ return probe(); }
     var cut=-1, i;
-    for(i=0;i<stack.length;i++){ if(stack[i]===target){ cut=i; break; } }
-    if(cut<0) return textNodeAtPoint(x,y);
+    for(i=0;i<stack.length;i++){ if(stack[i]===target || (target && target.contains && stack[i] && stack[i].nodeType && target.contains(stack[i]))){ cut=i; break; } }
+    if(cut<0) return probe();
     var muted=[];
     for(i=0;i<cut;i++){
       muted.push([stack[i], stack[i].style ? stack[i].style.pointerEvents : '']);
       try{ stack[i].style.pointerEvents='none'; }catch(e){}
     }
-    try{ return textNodeAtPoint(x,y); }
+    try{ return probe(); }
     finally{
       for(i=0;i<muted.length;i++){ try{ muted[i][0].style.pointerEvents=muted[i][1]||''; }catch(e){} }
     }
   }
+  // ENG-10632: is this pointer event aimed INSIDE the open editor?
+  //
+  // 'direct' - the event's own target is the editor or inside it (no overlay).
+  // 'through' - the target is something laid over the editor (a deck click
+  //   zone), but the editor is in the hit stack under the pointer.
+  // null     - no edit is open, or the press is genuinely elsewhere.
+  //
+  // WHY NOT e.target ALONE. That is exactly the ENG-8477 blind spot: a pointer
+  // event targets the HIT-TEST result, and a deck's full-viewport zones win the
+  // hit test, so e.target is the zone for every press on slide text. ENG-8477
+  // fixed the click that OPENS an editor this way and left the guards that
+  // protect an OPEN editor keyed on e.target, so the second click - the one that
+  // places the caret - was handed to the zone and paged the slide.
+  //
+  // A keydown is different: it targets the FOCUSED element, so the ENG-8500 key
+  // guard's e.target test is correct and stays as it is.
+  function pointInEditor(e){
+    if(!editing || !e) return null;
+    var t=e.target;
+    if(t===editing || (editing.contains && t && t.nodeType && editing.contains(t))) return 'direct';
+    if(typeof e.clientX!=='number' || typeof e.clientY!=='number') return null;
+    var stack;
+    try{ stack=document.elementsFromPoint(e.clientX, e.clientY)||[]; }catch(err){ return null; }
+    for(var i=0;i<stack.length;i++){
+      var n=stack[i];
+      if(n===editing || (editing.contains && n && n.nodeType && editing.contains(n))) return 'through';
+    }
+    return null;
+  }
+  // ENG-10632: put the caret where the viewer pressed, as the browser would have
+  // if nothing covered the editor. The browser's own caret placement goes to the
+  // topmost element, which is the overlay, so it places nothing in the text.
+  // Returns true when a caret was placed inside the editor.
+  function placeCaretAtPointThrough(x,y,el){
+    return throughOverlays(x,y,el,function(){
+      try{
+        var node=null, offset=0, r=null;
+        if(document.caretRangeFromPoint){
+          r=document.caretRangeFromPoint(x,y);
+          if(r){ node=r.startContainer; offset=r.startOffset||0; }
+        } else if(document.caretPositionFromPoint){
+          var p=document.caretPositionFromPoint(x,y);
+          if(p){ node=p.offsetNode; offset=p.offset||0; }
+        }
+        if(!node || !(node===el || (el.contains && el.contains(node.nodeType===3 ? node.parentNode||node.parentElement : node)))) return false;
+        if(!r){ r=document.createRange(); r.setStart(node, offset); r.collapse(true); }
+        var s=document.getSelection(); s.removeAllRanges(); s.addRange(r);
+        return true;
+      }catch(err){ return false; }
+    });
+  }
   // Index of a text node among its parent's child TEXT nodes, in order - the same
   // counting the server uses to re-locate it in source_html (ENG-6856).
   function textIndexOf(container, tn){
@@ -38829,6 +38888,13 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     for(var k=0;k<ns.length;k++){ if(ns[k].nodeType===3){ i++; if(ns[k]===tn) return i; } }
     return -1;
   }
+  function keepCaretIn(el){
+    try{
+      var s=document.getSelection(), n=s && s.rangeCount ? s.anchorNode : null;
+      if(n && (n===el || (el.contains && el.contains(n.nodeType===3 ? n.parentNode : n)))) return;
+    }catch(err){}
+    placeCaretEnd(el);
+  }
   function placeCaretEnd(el){ try{ var r=document.createRange(); r.selectNodeContents(el); r.collapse(false); var s=document.getSelection(); s.removeAllRanges(); s.addRange(r); }catch(e){} }
   // The Save/Cancel toolbar anchored above el. Shared by whole-element edits
   // (startEdit) and per-text-node edits (startEditTextNode).
@@ -39038,9 +39104,35 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // press that lands inside the editor. A press anywhere else is the viewer
   // leaving, and the artefact keeps it.
   window.addEventListener('pointerdown', function(e){
-    if(!editing) return;
-    var t=e.target;
-    if(t!==editing && !(editing.contains && t && t.nodeType && editing.contains(t))) return;
+    // ENG-10632: "inside the editor" is decided through the hit stack, not from
+    // e.target, which a deck's click zone always wins. See pointInEditor.
+    var where=pointInEditor(e);
+    if(!where) return;
+    e.stopImmediatePropagation();
+    if(where==='through'){
+      // The overlay is the browser's hit target, so its default action would
+      // move focus off the editor and place no caret in the text. Take both over.
+      try{ e.preventDefault(); }catch(err){}
+      try{ editing.focus(); }catch(err){}
+      // The press is suppressed either way, so a probe that cannot resolve a
+      // point inside the editor must not leave it without a caret: keep one the
+      // editor already holds, otherwise put it at the end of the text.
+      if(!placeCaretAtPointThrough(e.clientX, e.clientY, editing)) keepCaretIn(editing);
+    }
+  }, true);
+  // ENG-10632: the same press also arrives as mousedown and click, and the deck
+  // can page on either. Only a press that went THROUGH an overlay into the open
+  // editor is swallowed; a direct press keeps its native behaviour (caret,
+  // drag-select), and a press anywhere else is the viewer leaving and is left to
+  // the artefact.
+  window.addEventListener('mousedown', function(e){
+    if(pointInEditor(e)!=='through') return;
+    try{ e.preventDefault(); }catch(err){}
+    e.stopImmediatePropagation();
+  }, true);
+  window.addEventListener('click', function(e){
+    if(pointInEditor(e)!=='through') return;
+    try{ e.preventDefault(); }catch(err){}
     e.stopImmediatePropagation();
   }, true);
   // ENG-8477: the hover affordance has the same blind spot as the click did -
@@ -44446,11 +44538,18 @@ var FLAG_REGISTRY = [
   },
   {
     key: "ip-allowlist-enforce-admin-debug",
-    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. There is deliberately NO counterpart flag for the per-agent MCP surface: that one is shadow-only structurally (its ENFORCE_FLAG entry is null), so arming this one does not and cannot arm that one. See the comment below this entry for why.",
     flagType: "boolean",
-    // Shadow. The measurement comes first: nobody yet knows the real set of
-    // staff addresses, and arming against a guess locks you out of the very
-    // tool you would use to diagnose the lockout.
+    // Shadow. The measurement comes first - and ENG-10664 corrected what the
+    // measurement is OF. This comment used to say "nobody yet knows the real set
+    // of staff addresses": there is no such set. Measured over 48h, all 315
+    // requests to this surface came from ONE address, the agt-hosts AZ-2a NAT
+    // EIP - an AGENT calling the debug_* tools, not a person. The decided policy
+    // is that it stays that way (admin-debug is only ever reached from our own
+    // NAT gateways). So the pre-arm check is not "does my laptop appear" but
+    // "is every NAT EIP in the list", because an AZ whose NAT has not yet
+    // carried a debug_* call is absent from the log and would be refused the
+    // instant this flips. See docs/runbooks/ip-allowlist-rollout.md step 3.
     defaultValue: false,
     // Arming it changes who can reach production diagnostics. Worth one
     // confirmation.
@@ -44465,20 +44564,34 @@ var FLAG_REGISTRY = [
   // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
   // flag is consulted and no flag flip can arm it.
   //
-  // Why it is not simply a second flag defaulting false: most of that surface's
-  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
-  // agt-hosts account egress through stable NAT EIPs; a host with
-  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
-  // an address the control plane cannot know. Arming against that population
-  // black-holes a customer's whole fleet, and per
-  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // Why it is not simply a second flag defaulting false (CORRECTED, ENG-10664):
+  //
+  // This comment used to say the callers are agent HOSTS, most of which have no
+  // allowlistable address per ADR-0032. That is the wrong caller. Agent hosts do
+  // not call this surface at all: its handler's first act is
+  // validateMcpAccessToken() against `mcp_oauth_tokens` (routes/mcp.ts:87, token
+  // check at :91), so a host JWT is rejected outright - routes/host-runtime.ts
+  // :33421 says so in as many words, which is why the ENG-4724 /host/* twins
+  // exist. The caller set is remote MCP OAuth clients, structurally.
+  //
+  // The conclusion is unchanged and ONLY the reason has moved. Allowlisting this
+  // surface would mean pinning a THIRD PARTY's egress ranges rather than our own
+  // NAT EIPs - a different control, a different owner, a different failure mode:
+  // they move a range and agent MCP access breaks with no signal on our side.
+  // Per docs/runbooks/composio-allowlist-rollout.md this class of change has no
   // fleet-level undo. A flag would leave that one toggle away during an
   // incident, from someone who had just armed the admin-debug surface and
   // reasonably assumed the pair moved together. Requiring a code change puts
   // review in front of an irreversible action, which is the right price.
   //
-  // If the shadow data ever shows the population IS allowlistable, adding the
-  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
+  // Keeping the false rationale would have been worse than having none: a reader
+  // who checked it would find it does not hold and might "fix" it by adding the
+  // flag. That is the failure this rewrite exists to prevent.
+  //
+  // If we ever DECIDE to take on that third-party dependency deliberately,
+  // adding the flag here and a key in ENFORCE_FLAG is a small diff - but it is a
+  // decision to own someone else's egress, not a discovery that the population
+  // was allowlistable all along.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 

package/dist/mcp/slack-channel.js

@@ -33024,21 +33024,80 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // ancestors too - a wider style mutation than intended, for a probe whose
   // result the caller then rejects anyway.
   function textNodeAtPointThrough(x,y,target){
+    return throughOverlays(x,y,target,function(){ return textNodeAtPoint(x,y); });
+  }
+  // Run probe() with everything stacked IN FRONT of target muted for pointer
+  // hit-testing, then restore it. Shared by the text-node probe above and the
+  // caret placement below (ENG-10632), so there is one overlay-muting path.
+  // A target that is not in the hit stack (or no elementsFromPoint at all) runs
+  // the probe unmuted, for the reason given on textNodeAtPointThrough.
+  function throughOverlays(x,y,target,probe){
     var stack;
-    try{ stack=document.elementsFromPoint(x,y)||[]; }catch(e){ return textNodeAtPoint(x,y); }
+    try{ stack=document.elementsFromPoint(x,y)||[]; }catch(e){ return probe(); }
     var cut=-1, i;
-    for(i=0;i<stack.length;i++){ if(stack[i]===target){ cut=i; break; } }
-    if(cut<0) return textNodeAtPoint(x,y);
+    for(i=0;i<stack.length;i++){ if(stack[i]===target || (target && target.contains && stack[i] && stack[i].nodeType && target.contains(stack[i]))){ cut=i; break; } }
+    if(cut<0) return probe();
     var muted=[];
     for(i=0;i<cut;i++){
       muted.push([stack[i], stack[i].style ? stack[i].style.pointerEvents : '']);
       try{ stack[i].style.pointerEvents='none'; }catch(e){}
     }
-    try{ return textNodeAtPoint(x,y); }
+    try{ return probe(); }
     finally{
       for(i=0;i<muted.length;i++){ try{ muted[i][0].style.pointerEvents=muted[i][1]||''; }catch(e){} }
     }
   }
+  // ENG-10632: is this pointer event aimed INSIDE the open editor?
+  //
+  // 'direct' - the event's own target is the editor or inside it (no overlay).
+  // 'through' - the target is something laid over the editor (a deck click
+  //   zone), but the editor is in the hit stack under the pointer.
+  // null     - no edit is open, or the press is genuinely elsewhere.
+  //
+  // WHY NOT e.target ALONE. That is exactly the ENG-8477 blind spot: a pointer
+  // event targets the HIT-TEST result, and a deck's full-viewport zones win the
+  // hit test, so e.target is the zone for every press on slide text. ENG-8477
+  // fixed the click that OPENS an editor this way and left the guards that
+  // protect an OPEN editor keyed on e.target, so the second click - the one that
+  // places the caret - was handed to the zone and paged the slide.
+  //
+  // A keydown is different: it targets the FOCUSED element, so the ENG-8500 key
+  // guard's e.target test is correct and stays as it is.
+  function pointInEditor(e){
+    if(!editing || !e) return null;
+    var t=e.target;
+    if(t===editing || (editing.contains && t && t.nodeType && editing.contains(t))) return 'direct';
+    if(typeof e.clientX!=='number' || typeof e.clientY!=='number') return null;
+    var stack;
+    try{ stack=document.elementsFromPoint(e.clientX, e.clientY)||[]; }catch(err){ return null; }
+    for(var i=0;i<stack.length;i++){
+      var n=stack[i];
+      if(n===editing || (editing.contains && n && n.nodeType && editing.contains(n))) return 'through';
+    }
+    return null;
+  }
+  // ENG-10632: put the caret where the viewer pressed, as the browser would have
+  // if nothing covered the editor. The browser's own caret placement goes to the
+  // topmost element, which is the overlay, so it places nothing in the text.
+  // Returns true when a caret was placed inside the editor.
+  function placeCaretAtPointThrough(x,y,el){
+    return throughOverlays(x,y,el,function(){
+      try{
+        var node=null, offset=0, r=null;
+        if(document.caretRangeFromPoint){
+          r=document.caretRangeFromPoint(x,y);
+          if(r){ node=r.startContainer; offset=r.startOffset||0; }
+        } else if(document.caretPositionFromPoint){
+          var p=document.caretPositionFromPoint(x,y);
+          if(p){ node=p.offsetNode; offset=p.offset||0; }
+        }
+        if(!node || !(node===el || (el.contains && el.contains(node.nodeType===3 ? node.parentNode||node.parentElement : node)))) return false;
+        if(!r){ r=document.createRange(); r.setStart(node, offset); r.collapse(true); }
+        var s=document.getSelection(); s.removeAllRanges(); s.addRange(r);
+        return true;
+      }catch(err){ return false; }
+    });
+  }
   // Index of a text node among its parent's child TEXT nodes, in order - the same
   // counting the server uses to re-locate it in source_html (ENG-6856).
   function textIndexOf(container, tn){
@@ -33046,6 +33105,13 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
     for(var k=0;k<ns.length;k++){ if(ns[k].nodeType===3){ i++; if(ns[k]===tn) return i; } }
     return -1;
   }
+  function keepCaretIn(el){
+    try{
+      var s=document.getSelection(), n=s && s.rangeCount ? s.anchorNode : null;
+      if(n && (n===el || (el.contains && el.contains(n.nodeType===3 ? n.parentNode : n)))) return;
+    }catch(err){}
+    placeCaretEnd(el);
+  }
   function placeCaretEnd(el){ try{ var r=document.createRange(); r.selectNodeContents(el); r.collapse(false); var s=document.getSelection(); s.removeAllRanges(); s.addRange(r); }catch(e){} }
   // The Save/Cancel toolbar anchored above el. Shared by whole-element edits
   // (startEdit) and per-text-node edits (startEditTextNode).
@@ -33255,9 +33321,35 @@ var MARKUP_BRIDGE_SCRIPT = `<script>(function(){
   // press that lands inside the editor. A press anywhere else is the viewer
   // leaving, and the artefact keeps it.
   window.addEventListener('pointerdown', function(e){
-    if(!editing) return;
-    var t=e.target;
-    if(t!==editing && !(editing.contains && t && t.nodeType && editing.contains(t))) return;
+    // ENG-10632: "inside the editor" is decided through the hit stack, not from
+    // e.target, which a deck's click zone always wins. See pointInEditor.
+    var where=pointInEditor(e);
+    if(!where) return;
+    e.stopImmediatePropagation();
+    if(where==='through'){
+      // The overlay is the browser's hit target, so its default action would
+      // move focus off the editor and place no caret in the text. Take both over.
+      try{ e.preventDefault(); }catch(err){}
+      try{ editing.focus(); }catch(err){}
+      // The press is suppressed either way, so a probe that cannot resolve a
+      // point inside the editor must not leave it without a caret: keep one the
+      // editor already holds, otherwise put it at the end of the text.
+      if(!placeCaretAtPointThrough(e.clientX, e.clientY, editing)) keepCaretIn(editing);
+    }
+  }, true);
+  // ENG-10632: the same press also arrives as mousedown and click, and the deck
+  // can page on either. Only a press that went THROUGH an overlay into the open
+  // editor is swallowed; a direct press keeps its native behaviour (caret,
+  // drag-select), and a press anywhere else is the viewer leaving and is left to
+  // the artefact.
+  window.addEventListener('mousedown', function(e){
+    if(pointInEditor(e)!=='through') return;
+    try{ e.preventDefault(); }catch(err){}
+    e.stopImmediatePropagation();
+  }, true);
+  window.addEventListener('click', function(e){
+    if(pointInEditor(e)!=='through') return;
+    try{ e.preventDefault(); }catch(err){}
     e.stopImmediatePropagation();
   }, true);
   // ENG-8477: the hover affordance has the same blind spot as the click did -
@@ -39085,11 +39177,18 @@ var FLAG_REGISTRY = [
   },
   {
     key: "ip-allowlist-enforce-admin-debug",
-    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. There is deliberately NO counterpart flag for the per-agent MCP surface: that one is shadow-only structurally (its ENFORCE_FLAG entry is null), so arming this one does not and cannot arm that one. See the comment below this entry for why.",
     flagType: "boolean",
-    // Shadow. The measurement comes first: nobody yet knows the real set of
-    // staff addresses, and arming against a guess locks you out of the very
-    // tool you would use to diagnose the lockout.
+    // Shadow. The measurement comes first - and ENG-10664 corrected what the
+    // measurement is OF. This comment used to say "nobody yet knows the real set
+    // of staff addresses": there is no such set. Measured over 48h, all 315
+    // requests to this surface came from ONE address, the agt-hosts AZ-2a NAT
+    // EIP - an AGENT calling the debug_* tools, not a person. The decided policy
+    // is that it stays that way (admin-debug is only ever reached from our own
+    // NAT gateways). So the pre-arm check is not "does my laptop appear" but
+    // "is every NAT EIP in the list", because an AZ whose NAT has not yet
+    // carried a debug_* call is absent from the log and would be refused the
+    // instant this flips. See docs/runbooks/ip-allowlist-rollout.md step 3.
     defaultValue: false,
     // Arming it changes who can reach production diagnostics. Worth one
     // confirmation.
@@ -39104,20 +39203,34 @@ var FLAG_REGISTRY = [
   // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
   // flag is consulted and no flag flip can arm it.
   //
-  // Why it is not simply a second flag defaulting false: most of that surface's
-  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
-  // agt-hosts account egress through stable NAT EIPs; a host with
-  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
-  // an address the control plane cannot know. Arming against that population
-  // black-holes a customer's whole fleet, and per
-  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // Why it is not simply a second flag defaulting false (CORRECTED, ENG-10664):
+  //
+  // This comment used to say the callers are agent HOSTS, most of which have no
+  // allowlistable address per ADR-0032. That is the wrong caller. Agent hosts do
+  // not call this surface at all: its handler's first act is
+  // validateMcpAccessToken() against `mcp_oauth_tokens` (routes/mcp.ts:87, token
+  // check at :91), so a host JWT is rejected outright - routes/host-runtime.ts
+  // :33421 says so in as many words, which is why the ENG-4724 /host/* twins
+  // exist. The caller set is remote MCP OAuth clients, structurally.
+  //
+  // The conclusion is unchanged and ONLY the reason has moved. Allowlisting this
+  // surface would mean pinning a THIRD PARTY's egress ranges rather than our own
+  // NAT EIPs - a different control, a different owner, a different failure mode:
+  // they move a range and agent MCP access breaks with no signal on our side.
+  // Per docs/runbooks/composio-allowlist-rollout.md this class of change has no
   // fleet-level undo. A flag would leave that one toggle away during an
   // incident, from someone who had just armed the admin-debug surface and
   // reasonably assumed the pair moved together. Requiring a code change puts
   // review in front of an irreversible action, which is the right price.
   //
-  // If the shadow data ever shows the population IS allowlistable, adding the
-  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
+  // Keeping the false rationale would have been worse than having none: a reader
+  // who checked it would find it does not hold and might "fix" it by adding the
+  // flag. That is the failure this rewrite exists to prevent.
+  //
+  // If we ever DECIDE to take on that third-party dependency deliberately,
+  // adding the flag here and a key in ENFORCE_FLAG is a small diff - but it is a
+  // decision to own someone else's egress, not a discovery that the population
+  // was allowlistable all along.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));