@integrity-labs/agt-cli 0.28.984 → 0.28.986

package/dist/{claude-pair-runtime-YKJQT3SJ.js → claude-pair-runtime-GQM26I3M.js}

@@ -258,7 +258,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-R6WKQT2N.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-PYYD53GZ.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -580,4 +580,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-YKJQT3SJ.js.map
+//# sourceMappingURL=claude-pair-runtime-GQM26I3M.js.map

package/dist/lib/manager-worker.js

@@ -63,7 +63,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-PVMVQ5IL.js";
+} from "../chunk-XEI5QMZ7.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -140,7 +140,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-72J5FCKI.js";
+} from "../chunk-6KYXH6ZZ.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -238,7 +238,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-DI4Q2OVR.js";
+} from "../chunk-TGCA3LTI.js";
 import "../chunk-DHWNVVX4.js";
 import {
   reapOrphanChannelMcps
@@ -13292,7 +13292,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-M3QTWJGG.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-JENZOOKG.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14035,7 +14035,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.984" : "dev";
+var agtCliVersion = true ? "0.28.986" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15651,7 +15651,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-R6WKQT2N.js");
+      const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15793,7 +15793,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-R6WKQT2N.js");
+      const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15969,7 +15969,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-M3QTWJGG.js");
+      } = await import("../responsiveness-probe-JENZOOKG.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16086,7 +16086,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-M3QTWJGG.js");
+        } = await import("../responsiveness-probe-JENZOOKG.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16242,7 +16242,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-FQ3N3BJ5.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-BGXRQB27.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20530,7 +20530,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-M3QTWJGG.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-JENZOOKG.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20573,7 +20573,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-R6WKQT2N.js");
+        const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20624,7 +20624,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-R6WKQT2N.js");
+      const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -21268,7 +21268,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-YKJQT3SJ.js");
+  } = await import("../claude-pair-runtime-GQM26I3M.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -33132,9 +33132,51 @@ var composio_approved_egress_default = {
     "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
     "a tidy file.",
     "",
-    "PASTE ALL FOUR, ALWAYS. Composio's field takes explicit comma-delimited addresses and",
-    "no CIDR, so a key armed with the hosts pair alone locks out every server-side call the",
-    "control plane makes, and one armed with the bridge pair alone locks out the fleet."
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "legitimately have a known egress address and no entry here - see Zanda below - and the",
+    "posture page must withhold its paste value rather than offer the shared set.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ABSENCE BELOW IS DELIBERATE.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - and as of 2026-09-20 its egress address IS known:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). It is not",
+    "recorded because nobody has approved it. That host carries ZERO assigned agents, so it",
+    "makes no Composio calls and the omission costs nothing today; the approval queue for",
+    "exactly this decision is ENG-10668, unbuilt. The consequence is intended and measured:",
+    "Zanda's org IS `fully_managed` (read from prod 2026-09-20), so it holds a",
+    "platform-managed Composio key and DOES appear on /admin/composio-key-posture - with no",
+    "paste value and a reason. That row is the feature working. Do not 'fix' it by adding",
+    "3.107.131.133 below - add the approval.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and only Zanda's lacks a recorded address. Every other org's row is the",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -33171,13 +33213,29 @@ var composio_approved_egress_default = {
       seenAsGateway: "nat-02a4721d4ce678cf7",
       note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
     }
-  ]
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    }
+  }
 };
 
 // ../core/dist/integrations/composio-approved-egress.js
 var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
 
 // ../core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {
@@ -39859,6 +39917,34 @@ function computeStreamSlices(content, config2 = DEFAULT_STREAM_SLICE_CONFIG) {
   return slices;
 }
 
+// ../core/dist/channels/progress-step.js
+var AUTO_PROGRESS_FALLBACK_STEP = "Working\u2026";
+var VERBS = [
+  ["Running", "Running a command"],
+  ["Editing", "Editing a file"],
+  ["Writing", "Writing a file"],
+  ["Reading", "Reading a file"],
+  ["Searching the web", "Searching the web"],
+  ["Searching", "Searching"],
+  ["Finding files", "Searching"],
+  ["Fetching", "Fetching a page"],
+  ["Working on", "Working on a subtask"],
+  ["Using", "Using a tool"]
+];
+function sanitizeAutoProgressStep(raw) {
+  const text = raw.trim();
+  if (!text)
+    return "";
+  for (const [prefix, label] of VERBS) {
+    if (!text.startsWith(prefix))
+      continue;
+    const next = text.charAt(prefix.length);
+    if (next === "" || next === " " || next === ":")
+      return label;
+  }
+  return AUTO_PROGRESS_FALLBACK_STEP;
+}
+
 // src/channel-progress.ts
 function channelLiveProgressEnabled() {
   return resolveHostBooleanFlag({
@@ -39915,7 +40001,7 @@ function parseProgressHeartbeat(raw) {
   if (!raw) return null;
   try {
     const obj = JSON.parse(raw);
-    const step = typeof obj.step === "string" ? obj.step.trim() : "";
+    const step = typeof obj.step === "string" ? sanitizeAutoProgressStep(obj.step) : "";
     const updatedAtMs = typeof obj.updated_at_ms === "number" ? obj.updated_at_ms : NaN;
     if (!step || !Number.isFinite(updatedAtMs)) return null;
     return { step, updatedAtMs };

package/dist/mcp/index.js

@@ -25714,9 +25714,51 @@ var composio_approved_egress_default = {
     "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
     "a tidy file.",
     "",
-    "PASTE ALL FOUR, ALWAYS. Composio's field takes explicit comma-delimited addresses and",
-    "no CIDR, so a key armed with the hosts pair alone locks out every server-side call the",
-    "control plane makes, and one armed with the bridge pair alone locks out the fleet."
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "legitimately have a known egress address and no entry here - see Zanda below - and the",
+    "posture page must withhold its paste value rather than offer the shared set.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ABSENCE BELOW IS DELIBERATE.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - and as of 2026-09-20 its egress address IS known:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). It is not",
+    "recorded because nobody has approved it. That host carries ZERO assigned agents, so it",
+    "makes no Composio calls and the omission costs nothing today; the approval queue for",
+    "exactly this decision is ENG-10668, unbuilt. The consequence is intended and measured:",
+    "Zanda's org IS `fully_managed` (read from prod 2026-09-20), so it holds a",
+    "platform-managed Composio key and DOES appear on /admin/composio-key-posture - with no",
+    "paste value and a reason. That row is the feature working. Do not 'fix' it by adding",
+    "3.107.131.133 below - add the approval.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and only Zanda's lacks a recorded address. Every other org's row is the",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -25753,13 +25795,29 @@ var composio_approved_egress_default = {
       seenAsGateway: "nat-02a4721d4ce678cf7",
       note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
     }
-  ]
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    }
+  }
 };
 
 // ../core/dist/integrations/composio-approved-egress.js
 var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
 
 // ../core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {
@@ -47212,7 +47270,7 @@ server.tool(
     source_external_id: external_exports.string().optional().describe('ID in the external system (e.g., "ENG-123")'),
     source_url: external_exports.string().optional().describe("Deep link URL to the external source"),
     deliver_to: external_exports.string().optional().describe(
-      "Optional: the Slack user id of the person who asked for this (the requester), so you can notify/deliver to them when the task needs their input or is done. If omitted on a card that came FROM a conversation, it defaults to the person you are talking to. It never defaults for a card created with no_channel_origin: true."
+      'Optional: the Slack user id of the person who asked for this (the requester), so you can notify/deliver to them when the task needs their input or is done. If omitted on a card that came FROM a conversation, it defaults to the person you are talking to. It never defaults for a card created with no_channel_origin: true. Pass the literal "none" to track the work without notifying the requester: no progress card is posted into the conversation and no completion card, result DM or waiting-on prompt is sent to them (reply to the person yourself when you have something for them). Operational escalation still happens: if the result cannot be delivered at all, the dead-letter path can notify the manager or team admins of the agent. Cannot be combined with notify_channel/notify_to.'
     ),
     no_channel_origin: external_exports.boolean().optional().describe(
       "Set true when this card did NOT come from a message someone sent you: work you started yourself, a scheduled/routine run, follow-up you decided to do, anything not answering a specific conversation. Without it, a card created shortly after any inbound message is attached to THAT conversation - its progress card posts into that person's thread and its result is addressed to them, even if the work has nothing to do with them. Leave it unset for a card that IS the answer to the message you are handling."

package/dist/mcp/origami.js

@@ -39865,9 +39865,51 @@ var composio_approved_egress_default = {
     "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
     "a tidy file.",
     "",
-    "PASTE ALL FOUR, ALWAYS. Composio's field takes explicit comma-delimited addresses and",
-    "no CIDR, so a key armed with the hosts pair alone locks out every server-side call the",
-    "control plane makes, and one armed with the bridge pair alone locks out the fleet."
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "legitimately have a known egress address and no entry here - see Zanda below - and the",
+    "posture page must withhold its paste value rather than offer the shared set.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ABSENCE BELOW IS DELIBERATE.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - and as of 2026-09-20 its egress address IS known:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). It is not",
+    "recorded because nobody has approved it. That host carries ZERO assigned agents, so it",
+    "makes no Composio calls and the omission costs nothing today; the approval queue for",
+    "exactly this decision is ENG-10668, unbuilt. The consequence is intended and measured:",
+    "Zanda's org IS `fully_managed` (read from prod 2026-09-20), so it holds a",
+    "platform-managed Composio key and DOES appear on /admin/composio-key-posture - with no",
+    "paste value and a reason. That row is the feature working. Do not 'fix' it by adding",
+    "3.107.131.133 below - add the approval.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and only Zanda's lacks a recorded address. Every other org's row is the",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -39904,13 +39946,29 @@ var composio_approved_egress_default = {
       seenAsGateway: "nat-02a4721d4ce678cf7",
       note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
     }
-  ]
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    }
+  }
 };
 
 // ../core/dist/integrations/composio-approved-egress.js
 var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
 
 // ../core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {

package/dist/mcp/slack-channel.js

@@ -34082,9 +34082,51 @@ var composio_approved_egress_default = {
     "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
     "a tidy file.",
     "",
-    "PASTE ALL FOUR, ALWAYS. Composio's field takes explicit comma-delimited addresses and",
-    "no CIDR, so a key armed with the hosts pair alone locks out every server-side call the",
-    "control plane makes, and one armed with the bridge pair alone locks out the fleet."
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "legitimately have a known egress address and no entry here - see Zanda below - and the",
+    "posture page must withhold its paste value rather than offer the shared set.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ABSENCE BELOW IS DELIBERATE.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - and as of 2026-09-20 its egress address IS known:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). It is not",
+    "recorded because nobody has approved it. That host carries ZERO assigned agents, so it",
+    "makes no Composio calls and the omission costs nothing today; the approval queue for",
+    "exactly this decision is ENG-10668, unbuilt. The consequence is intended and measured:",
+    "Zanda's org IS `fully_managed` (read from prod 2026-09-20), so it holds a",
+    "platform-managed Composio key and DOES appear on /admin/composio-key-posture - with no",
+    "paste value and a reason. That row is the feature working. Do not 'fix' it by adding",
+    "3.107.131.133 below - add the approval.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and only Zanda's lacks a recorded address. Every other org's row is the",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -34121,13 +34163,29 @@ var composio_approved_egress_default = {
       seenAsGateway: "nat-02a4721d4ce678cf7",
       note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
     }
-  ]
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    }
+  }
 };
 
 // ../core/dist/integrations/composio-approved-egress.js
 var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
 
 // ../core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {
@@ -41781,6 +41839,34 @@ function removeRecoveryLedgerEntry(ledgerDir, markerName, unlink = (p2) => {
   }
 }
 
+// ../core/dist/channels/progress-step.js
+var AUTO_PROGRESS_FALLBACK_STEP = "Working\u2026";
+var VERBS = [
+  ["Running", "Running a command"],
+  ["Editing", "Editing a file"],
+  ["Writing", "Writing a file"],
+  ["Reading", "Reading a file"],
+  ["Searching the web", "Searching the web"],
+  ["Searching", "Searching"],
+  ["Finding files", "Searching"],
+  ["Fetching", "Fetching a page"],
+  ["Working on", "Working on a subtask"],
+  ["Using", "Using a tool"]
+];
+function sanitizeAutoProgressStep(raw) {
+  const text = raw.trim();
+  if (!text)
+    return "";
+  for (const [prefix, label] of VERBS) {
+    if (!text.startsWith(prefix))
+      continue;
+    const next = text.charAt(prefix.length);
+    if (next === "" || next === " " || next === ":")
+      return label;
+  }
+  return AUTO_PROGRESS_FALLBACK_STEP;
+}
+
 // src/channel-progress.ts
 function channelLiveProgressEnabled() {
   return resolveHostBooleanFlag({
@@ -41837,7 +41923,7 @@ function parseProgressHeartbeat(raw) {
   if (!raw) return null;
   try {
     const obj = JSON.parse(raw);
-    const step = typeof obj.step === "string" ? obj.step.trim() : "";
+    const step = typeof obj.step === "string" ? sanitizeAutoProgressStep(obj.step) : "";
     const updatedAtMs = typeof obj.updated_at_ms === "number" ? obj.updated_at_ms : NaN;
     if (!step || !Number.isFinite(updatedAtMs)) return null;
     return { step, updatedAtMs };