@integrity-labs/agt-cli 0.28.985 → 0.28.987

package/dist/{claude-pair-runtime-4E4UQNRR.js → claude-pair-runtime-GQM26I3M.js}

@@ -258,7 +258,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-UA7UEZUB.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-PYYD53GZ.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -580,4 +580,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-4E4UQNRR.js.map
+//# sourceMappingURL=claude-pair-runtime-GQM26I3M.js.map

package/dist/lib/manager-worker.js

@@ -63,7 +63,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-XPCEY3CL.js";
+} from "../chunk-4GGJKBP7.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -140,7 +140,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-V5HXKGU3.js";
+} from "../chunk-6KYXH6ZZ.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -238,7 +238,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-IOV5NDDZ.js";
+} from "../chunk-TGCA3LTI.js";
 import "../chunk-DHWNVVX4.js";
 import {
   reapOrphanChannelMcps
@@ -13292,7 +13292,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-WFCKAA6B.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-JENZOOKG.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14035,7 +14035,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.985" : "dev";
+var agtCliVersion = true ? "0.28.987" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15651,7 +15651,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-UA7UEZUB.js");
+      const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15793,7 +15793,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-UA7UEZUB.js");
+      const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15969,7 +15969,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-WFCKAA6B.js");
+      } = await import("../responsiveness-probe-JENZOOKG.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16086,7 +16086,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-WFCKAA6B.js");
+        } = await import("../responsiveness-probe-JENZOOKG.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16242,7 +16242,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-LY6ZNPYR.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-BGXRQB27.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20530,7 +20530,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-WFCKAA6B.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-JENZOOKG.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20573,7 +20573,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-UA7UEZUB.js");
+        const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20624,7 +20624,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-UA7UEZUB.js");
+      const { collectDiagnostics } = await import("../persistent-session-PYYD53GZ.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -21268,7 +21268,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-4E4UQNRR.js");
+  } = await import("../claude-pair-runtime-GQM26I3M.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -33132,9 +33132,51 @@ var composio_approved_egress_default = {
     "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
     "a tidy file.",
     "",
-    "PASTE ALL FOUR, ALWAYS. Composio's field takes explicit comma-delimited addresses and",
-    "no CIDR, so a key armed with the hosts pair alone locks out every server-side call the",
-    "control plane makes, and one armed with the bridge pair alone locks out the fleet."
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "legitimately have a known egress address and no entry here - see Zanda below - and the",
+    "posture page must withhold its paste value rather than offer the shared set.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ABSENCE BELOW IS DELIBERATE.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - and as of 2026-09-20 its egress address IS known:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). It is not",
+    "recorded because nobody has approved it. That host carries ZERO assigned agents, so it",
+    "makes no Composio calls and the omission costs nothing today; the approval queue for",
+    "exactly this decision is ENG-10668, unbuilt. The consequence is intended and measured:",
+    "Zanda's org IS `fully_managed` (read from prod 2026-09-20), so it holds a",
+    "platform-managed Composio key and DOES appear on /admin/composio-key-posture - with no",
+    "paste value and a reason. That row is the feature working. Do not 'fix' it by adding",
+    "3.107.131.133 below - add the approval.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and only Zanda's lacks a recorded address. Every other org's row is the",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -33171,13 +33213,29 @@ var composio_approved_egress_default = {
       seenAsGateway: "nat-02a4721d4ce678cf7",
       note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
     }
-  ]
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    }
+  }
 };
 
 // ../core/dist/integrations/composio-approved-egress.js
 var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
 
 // ../core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {

package/dist/mcp/index.js

@@ -25714,9 +25714,51 @@ var composio_approved_egress_default = {
     "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
     "a tidy file.",
     "",
-    "PASTE ALL FOUR, ALWAYS. Composio's field takes explicit comma-delimited addresses and",
-    "no CIDR, so a key armed with the hosts pair alone locks out every server-side call the",
-    "control plane makes, and one armed with the bridge pair alone locks out the fleet."
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "legitimately have a known egress address and no entry here - see Zanda below - and the",
+    "posture page must withhold its paste value rather than offer the shared set.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ABSENCE BELOW IS DELIBERATE.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - and as of 2026-09-20 its egress address IS known:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). It is not",
+    "recorded because nobody has approved it. That host carries ZERO assigned agents, so it",
+    "makes no Composio calls and the omission costs nothing today; the approval queue for",
+    "exactly this decision is ENG-10668, unbuilt. The consequence is intended and measured:",
+    "Zanda's org IS `fully_managed` (read from prod 2026-09-20), so it holds a",
+    "platform-managed Composio key and DOES appear on /admin/composio-key-posture - with no",
+    "paste value and a reason. That row is the feature working. Do not 'fix' it by adding",
+    "3.107.131.133 below - add the approval.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and only Zanda's lacks a recorded address. Every other org's row is the",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -25753,13 +25795,29 @@ var composio_approved_egress_default = {
       seenAsGateway: "nat-02a4721d4ce678cf7",
       note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
     }
-  ]
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    }
+  }
 };
 
 // ../core/dist/integrations/composio-approved-egress.js
 var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
 
 // ../core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {

package/dist/mcp/origami.js

@@ -39865,9 +39865,51 @@ var composio_approved_egress_default = {
     "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
     "a tidy file.",
     "",
-    "PASTE ALL FOUR, ALWAYS. Composio's field takes explicit comma-delimited addresses and",
-    "no CIDR, so a key armed with the hosts pair alone locks out every server-side call the",
-    "control plane makes, and one armed with the bridge pair alone locks out the fleet."
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "legitimately have a known egress address and no entry here - see Zanda below - and the",
+    "posture page must withhold its paste value rather than offer the shared set.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ABSENCE BELOW IS DELIBERATE.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - and as of 2026-09-20 its egress address IS known:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). It is not",
+    "recorded because nobody has approved it. That host carries ZERO assigned agents, so it",
+    "makes no Composio calls and the omission costs nothing today; the approval queue for",
+    "exactly this decision is ENG-10668, unbuilt. The consequence is intended and measured:",
+    "Zanda's org IS `fully_managed` (read from prod 2026-09-20), so it holds a",
+    "platform-managed Composio key and DOES appear on /admin/composio-key-posture - with no",
+    "paste value and a reason. That row is the feature working. Do not 'fix' it by adding",
+    "3.107.131.133 below - add the approval.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and only Zanda's lacks a recorded address. Every other org's row is the",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -39904,13 +39946,29 @@ var composio_approved_egress_default = {
       seenAsGateway: "nat-02a4721d4ce678cf7",
       note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
     }
-  ]
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    }
+  }
 };
 
 // ../core/dist/integrations/composio-approved-egress.js
 var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
 
 // ../core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {

package/dist/mcp/slack-channel.js

@@ -34082,9 +34082,51 @@ var composio_approved_egress_default = {
     "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
     "a tidy file.",
     "",
-    "PASTE ALL FOUR, ALWAYS. Composio's field takes explicit comma-delimited addresses and",
-    "no CIDR, so a key armed with the hosts pair alone locks out every server-side call the",
-    "control plane makes, and one armed with the bridge pair alone locks out the fleet."
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "legitimately have a known egress address and no entry here - see Zanda below - and the",
+    "posture page must withhold its paste value rather than offer the shared set.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ABSENCE BELOW IS DELIBERATE.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - and as of 2026-09-20 its egress address IS known:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). It is not",
+    "recorded because nobody has approved it. That host carries ZERO assigned agents, so it",
+    "makes no Composio calls and the omission costs nothing today; the approval queue for",
+    "exactly this decision is ENG-10668, unbuilt. The consequence is intended and measured:",
+    "Zanda's org IS `fully_managed` (read from prod 2026-09-20), so it holds a",
+    "platform-managed Composio key and DOES appear on /admin/composio-key-posture - with no",
+    "paste value and a reason. That row is the feature working. Do not 'fix' it by adding",
+    "3.107.131.133 below - add the approval.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and only Zanda's lacks a recorded address. Every other org's row is the",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -34121,13 +34163,29 @@ var composio_approved_egress_default = {
       seenAsGateway: "nat-02a4721d4ce678cf7",
       note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
     }
-  ]
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    }
+  }
 };
 
 // ../core/dist/integrations/composio-approved-egress.js
 var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
 
 // ../core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {

package/dist/mcp/telegram-channel.js

@@ -34102,9 +34102,51 @@ var composio_approved_egress_default = {
     "Trimming it would make the allowlist incomplete, which is a fleet-wide 401 rather than",
     "a tidy file.",
     "",
-    "PASTE ALL FOUR, ALWAYS. Composio's field takes explicit comma-delimited addresses and",
-    "no CIDR, so a key armed with the hosts pair alone locks out every server-side call the",
-    "control plane makes, and one armed with the bridge pair alone locks out the fleet."
+    "PASTE THE WHOLE SHARED SET, ALWAYS. Composio's field takes explicit comma-delimited",
+    "addresses and no CIDR, so a key armed with the hosts pair alone locks out every",
+    "server-side call the control plane makes, and one armed with the bridge pair alone locks",
+    "out the fleet. This used to read 'PASTE ALL FOUR, ALWAYS', which `orgAddresses` below",
+    "makes false: for an org with a BYO host the shared set is NOT the whole value, and an",
+    "operator following the old sentence would arm a key that refuses that org's own agents.",
+    "",
+    "`orgAddresses` - THE SHARED SET IS NOT EVERY ORG'S SET (ENG-10718).",
+    "An org whose agents run on a host we do not operate the network for - a BYO host in the",
+    "customer's AWS account, or a `self` host on hardware we never see - egresses from an",
+    "address no shared entry above carries. These are recorded per org rather than",
+    "merged into `addresses`, because they are not fleet-wide: pasting one org's BYO address",
+    "into another org's key widens that key for no reason. The drift detector and",
+    "fleet-egress-enum.sh both read `addresses` and only `addresses`, so nothing here is ever",
+    "compared against a hosts-account scan - which is correct, since these addresses live in",
+    "accounts neither ever enumerates.",
+    "",
+    "AN OBSERVED ADDRESS IS NOT AN APPROVED ONE, AND THAT IS THE WHOLE POINT OF THIS FILE.",
+    "`host_attested_egress` (ENG-10666) records the address a BYO host was SEEN calling from,",
+    "and it is the only way to learn one - the `augmented-byo-provisioner` role grants neither",
+    "`DescribeRouteTables` nor `DescribeNatGateways`, so enumeration cannot answer it. But",
+    "seeing an address is not deciding it may hold a key. A row appears here when a human",
+    "decides it, in a PR, which is the same ceremony every other entry gets. So an org can",
+    "legitimately have a known egress address and no entry here - see Zanda below - and the",
+    "posture page must withhold its paste value rather than offer the shared set.",
+    "",
+    "ZANDA IS THE LIVE EXAMPLE, AND ITS ABSENCE BELOW IS DELIBERATE.",
+    "Zanda has an active BYO host - d0a78e4f-7a21-4d8d-85db-66a167fdd8cb in account",
+    "585819234046, created 2026-09-16 - and as of 2026-09-20 its egress address IS known:",
+    "3.107.131.133, resolved from `host_attested_egress` after an account enumeration failed",
+    "to find it (it is a THIRD account, which no census had thought to scan). It is not",
+    "recorded because nobody has approved it. That host carries ZERO assigned agents, so it",
+    "makes no Composio calls and the omission costs nothing today; the approval queue for",
+    "exactly this decision is ENG-10668, unbuilt. The consequence is intended and measured:",
+    "Zanda's org IS `fully_managed` (read from prod 2026-09-20), so it holds a",
+    "platform-managed Composio key and DOES appear on /admin/composio-key-posture - with no",
+    "paste value and a reason. That row is the feature working. Do not 'fix' it by adding",
+    "3.107.131.133 below - add the approval.",
+    "",
+    "THE SAME READ FOUND ZERO `self` HOSTS FLEET-WIDE (2026-09-20), which is why widening the",
+    "rule beyond the BYO pointer costs nothing today: exactly two orgs have a host outside our",
+    "NATs, both BYO, and only Zanda's lacks a recorded address. Every other org's row is the",
+    "shared set, byte-identical to what ENG-10713 already served it. If that ratio ever",
+    "inverts - many orgs withholding - the answer is to record addresses or build ENG-10668,",
+    "NOT to narrow the rule back."
   ],
   account: "711726113003",
   homeRegion: "ap-southeast-2",
@@ -34141,13 +34183,29 @@ var composio_approved_egress_default = {
       seenAsGateway: "nat-02a4721d4ce678cf7",
       note: "The us-east-2b half of the same managed multi-AZ NAT. Two addresses is what `az: 2` costs on the allowlist, accepted deliberately in ENG-9684: adding an address AFTER arming is a blind hand edit of every key with production 401s as the only completion signal."
     }
-  ]
+  ],
+  orgAddresses: {
+    "a4bba5c8-f664-46fe-a894-c95679c615ac": {
+      orgSlug: "integritylabs",
+      addresses: [
+        {
+          ip: "54.153.194.237",
+          stage: "prod-byo",
+          account: "436812233703",
+          region: null,
+          seenAsGateway: "nat-0c3cc231a8701a0e9",
+          note: 'The BYO "Agents" account\'s NAT, serving `asha` on prod-integritylabs-integritylabs-4. Measured 2026-09-19 (ENG-10718) and again in the 24h /host/* census on 2026-09-20: 55,109 requests from 32 distinct paths. `region` is null because it is NOT RECORDED and cannot be enumerated from here - see the $comment; the comparison is on `ip` alone, so a null costs nothing, whereas a guessed region would be a fact this file states without evidence. THIS ORG WAS ARMED DURING THE GATE 5 REHEARSAL (ENG-10712) WITHOUT THIS ADDRESS. It passed only because nothing on that host called Composio inside the ~15-minute window; had it, the call would have been refused.'
+        }
+      ]
+    }
+  }
 };
 
 // ../core/dist/integrations/composio-approved-egress.js
 var APPROVED_EGRESS_ACCOUNT = composio_approved_egress_default.account;
 var APPROVED_EGRESS_HOME_REGION = composio_approved_egress_default.homeRegion;
 var APPROVED_EGRESS_ADDRESSES = composio_approved_egress_default.addresses;
+var ORG_EGRESS_ADDRESSES = composio_approved_egress_default.orgAddresses ?? {};
 
 // ../core/dist/integrations/remote-mcp-proxy-env.js
 var REMOTE_MCP_PROXY_ENV = {

package/dist/{persistent-session-UA7UEZUB.js → persistent-session-PYYD53GZ.js}

@@ -62,8 +62,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-V5HXKGU3.js";
-import "./chunk-IOV5NDDZ.js";
+} from "./chunk-6KYXH6ZZ.js";
+import "./chunk-TGCA3LTI.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 export {
@@ -131,4 +131,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-UA7UEZUB.js.map
+//# sourceMappingURL=persistent-session-PYYD53GZ.js.map

package/dist/{responsiveness-probe-WFCKAA6B.js → responsiveness-probe-JENZOOKG.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-V5HXKGU3.js";
-import "./chunk-IOV5NDDZ.js";
+} from "./chunk-6KYXH6ZZ.js";
+import "./chunk-TGCA3LTI.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 
@@ -800,4 +800,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-WFCKAA6B.js.map
+//# sourceMappingURL=responsiveness-probe-JENZOOKG.js.map

package/dist/{session-auth-dead-LY6ZNPYR.js → session-auth-dead-BGXRQB27.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-IOV5NDDZ.js";
+} from "./chunk-TGCA3LTI.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-LY6ZNPYR.js.map
+//# sourceMappingURL=session-auth-dead-BGXRQB27.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.985",
+  "version": "0.28.987",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {