@integrity-labs/agt-cli 0.26.2-eng5706.1 → 0.27.0-test.4

package/dist/mcp/direct-chat-channel.js

@@ -13982,6 +13982,75 @@ function createDirectChatProgressFlush(opts) {
   };
 }
 
+// src/inbound-context-client.ts
+var REQUEST_TIMEOUT_MS = 1e4;
+function createInboundContextClient(args) {
+  if (!args.agtHost || !args.agtApiKey || !args.agentId) return null;
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const log = args.log ?? (() => {
+  });
+  const base = args.agtHost.replace(/\/+$/, "");
+  const agentId = args.agentId;
+  const apiKey = args.agtApiKey;
+  let cachedToken = null;
+  let cachedTokenExpiresAt = 0;
+  async function getToken() {
+    if (cachedToken && Date.now() < cachedTokenExpiresAt) return cachedToken;
+    const resp = await fetchImpl(`${base}/host/exchange`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ host_key: apiKey }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+    if (!resp.ok) {
+      const body = await resp.text().catch(() => "");
+      throw new Error(`/host/exchange failed (${resp.status}): ${body.slice(0, 200)}`);
+    }
+    const data = await resp.json();
+    cachedToken = data.token;
+    cachedTokenExpiresAt = data.expires_at ? new Date(data.expires_at).getTime() - 12e4 : Date.now() + 55 * 6e4;
+    return cachedToken;
+  }
+  async function postOnce(body) {
+    const token = await getToken();
+    return fetchImpl(`${base}/host/inbound-context`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+  }
+  async function emit(args2) {
+    const body = {
+      agent_id: agentId,
+      source_integration: args2.sourceIntegration,
+      source_external_id: args2.sourceExternalId,
+      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {}
+    };
+    try {
+      let resp = await postOnce(body);
+      if (resp.status === 401) {
+        cachedToken = null;
+        cachedTokenExpiresAt = 0;
+        resp = await postOnce(body);
+      }
+      if (!resp.ok) {
+        const text = await resp.text().catch(() => "");
+        log(
+          `inbound-context: POST failed (${resp.status}) integration=${args2.sourceIntegration}: ${text.slice(0, 200)}`
+        );
+      }
+    } catch (err) {
+      log(`inbound-context: emit threw integration=${args2.sourceIntegration}: ${err.message}`);
+    }
+  }
+  return {
+    recordInbound(args2) {
+      void emit(args2);
+    }
+  };
+}
+
 // src/progress-tools.ts
 import { randomUUID } from "crypto";
 
@@ -14299,10 +14368,89 @@ function isMode(value) {
   return value === "thinking" || value === "working" || value === "waiting";
 }
 
+// src/mcp-spawn-lock.ts
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { join } from "path";
+function defaultIsPidAlive(pid) {
+  if (!Number.isFinite(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH") return false;
+    return true;
+  }
+}
+function acquireMcpSpawnLock(args) {
+  const { agentDir, basename, options = {} } = args;
+  if (!agentDir) return { kind: "no-agent-dir" };
+  const isPidAlive = options.isPidAlive ?? defaultIsPidAlive;
+  const selfPid = options.selfPid ?? process.pid;
+  const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const path = join(agentDir, basename);
+  const existing = readLockHolder(path);
+  if (existing) {
+    if (existing.pid === selfPid) {
+      return { kind: "acquired", path };
+    }
+    if (isPidAlive(existing.pid)) {
+      return { kind: "blocked", path, holder: existing };
+    }
+  }
+  mkdirSync(agentDir, { recursive: true, mode: 448 });
+  const tmpPath = `${path}.${selfPid}.tmp`;
+  const payload = { pid: selfPid, started_at: now() };
+  writeFileSync(tmpPath, JSON.stringify(payload), { mode: 384 });
+  renameSync(tmpPath, path);
+  return { kind: "acquired", path };
+}
+function releaseMcpSpawnLock(lockPath, opts = {}) {
+  if (!lockPath) return;
+  const selfPid = opts.selfPid ?? process.pid;
+  const existing = readLockHolder(lockPath);
+  if (!existing) return;
+  if (existing.pid !== selfPid) return;
+  try {
+    unlinkSync(lockPath);
+  } catch {
+  }
+}
+function readLockHolder(path) {
+  if (!existsSync(path)) return null;
+  try {
+    const raw = readFileSync(path, "utf8");
+    const parsed = JSON.parse(raw);
+    const pid = typeof parsed.pid === "number" ? parsed.pid : Number(parsed.pid);
+    if (!Number.isFinite(pid) || pid <= 0) return null;
+    const startedAt = typeof parsed.started_at === "string" ? parsed.started_at : "";
+    return { pid, started_at: startedAt };
+  } catch {
+    return null;
+  }
+}
+
 // src/direct-chat-channel.ts
+import { homedir } from "os";
+import { join as join2 } from "path";
 var AGT_HOST = process.env.AGT_HOST;
 var AGT_API_KEY = process.env.AGT_API_KEY;
 var AGT_AGENT_ID = process.env.AGT_AGENT_ID;
+var DIRECT_CHAT_AGENT_DIR = AGT_AGENT_ID ? join2(homedir(), ".augmented", AGT_AGENT_ID) : null;
+var inboundContextClient = createInboundContextClient({
+  agtHost: AGT_HOST ?? null,
+  agtApiKey: AGT_API_KEY ?? null,
+  agentId: AGT_AGENT_ID ?? null,
+  log: (line) => process.stderr.write(`direct-chat-channel: ${line}
+`)
+});
 if (!AGT_HOST || !AGT_API_KEY || !AGT_AGENT_ID) {
   process.stderr.write(
     "direct-chat-channel: Missing AGT_HOST, AGT_API_KEY, or AGT_AGENT_ID. Cannot start.\n"
@@ -14488,6 +14636,22 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
   throw new Error(`Unknown tool: ${name}`);
 });
 await mcp.connect(new StdioServerTransport());
+var acquiredLockPath = null;
+{
+  const lockResult = acquireMcpSpawnLock({
+    agentDir: DIRECT_CHAT_AGENT_DIR,
+    basename: "direct-chat-channel.lock"
+  });
+  if (lockResult.kind === "blocked") {
+    process.stderr.write(
+      `direct-chat-channel: another instance pid=${lockResult.holder.pid} already running (since ${lockResult.holder.started_at}), exiting
+`
+    );
+    process.exit(0);
+  } else if (lockResult.kind === "acquired") {
+    acquiredLockPath = lockResult.path;
+  }
+}
 process.stderr.write(
   `direct-chat-channel: Started (agent=${AGT_AGENT_ID}, polling=disabled \u2014 using Realtime)
 `
@@ -14498,6 +14662,10 @@ function shutdown(reason) {
   isShuttingDown = true;
   process.stderr.write(`direct-chat-channel: ${reason} \u2014 exiting
 `);
+  try {
+    releaseMcpSpawnLock(acquiredLockPath);
+  } catch {
+  }
   setTimeout(() => process.exit(0), 100).unref();
 }
 process.stdin.on("close", () => shutdown("stdin closed"));

package/dist/mcp/slack-channel.js

@@ -14230,6 +14230,24 @@ function decideSlackEngagement(input) {
 function decideSlackAckReaction(input) {
   return Boolean(input.channel && input.ts);
 }
+function extractAugmentedSlackLabel(evt) {
+  if (evt.metadata?.event_type !== "augmented_agent_message") return null;
+  return {
+    teamId: evt.metadata.event_payload?.["augmented_team_id"],
+    agentId: evt.metadata.event_payload?.["augmented_agent_id"]
+  };
+}
+function decideSenderPolicyForward(evt, policy) {
+  if (policy.mode === "all") return { forward: true };
+  const label = extractAugmentedSlackLabel(evt);
+  if (!label) return { forward: false, reason: "sender_policy" };
+  if (policy.mode === "team_agents_only") {
+    if (!policy.teamId || label.teamId !== policy.teamId) {
+      return { forward: false, reason: "sender_policy" };
+    }
+  }
+  return { forward: true };
+}
 
 // src/slack-loop-throttle.ts
 var DEFAULT_THROTTLE = {
@@ -15495,8 +15513,77 @@ function createConversationIngestClient(args) {
   };
 }
 
-// src/slack-bot-user-id-client.ts
+// src/inbound-context-client.ts
 var REQUEST_TIMEOUT_MS3 = 1e4;
+function createInboundContextClient(args) {
+  if (!args.agtHost || !args.agtApiKey || !args.agentId) return null;
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const log = args.log ?? (() => {
+  });
+  const base = args.agtHost.replace(/\/+$/, "");
+  const agentId = args.agentId;
+  const apiKey = args.agtApiKey;
+  let cachedToken = null;
+  let cachedTokenExpiresAt = 0;
+  async function getToken() {
+    if (cachedToken && Date.now() < cachedTokenExpiresAt) return cachedToken;
+    const resp = await fetchImpl(`${base}/host/exchange`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ host_key: apiKey }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
+    });
+    if (!resp.ok) {
+      const body = await resp.text().catch(() => "");
+      throw new Error(`/host/exchange failed (${resp.status}): ${body.slice(0, 200)}`);
+    }
+    const data = await resp.json();
+    cachedToken = data.token;
+    cachedTokenExpiresAt = data.expires_at ? new Date(data.expires_at).getTime() - 12e4 : Date.now() + 55 * 6e4;
+    return cachedToken;
+  }
+  async function postOnce(body) {
+    const token = await getToken();
+    return fetchImpl(`${base}/host/inbound-context`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
+    });
+  }
+  async function emit(args2) {
+    const body = {
+      agent_id: agentId,
+      source_integration: args2.sourceIntegration,
+      source_external_id: args2.sourceExternalId,
+      ...args2.sourceUrl ? { source_url: args2.sourceUrl } : {}
+    };
+    try {
+      let resp = await postOnce(body);
+      if (resp.status === 401) {
+        cachedToken = null;
+        cachedTokenExpiresAt = 0;
+        resp = await postOnce(body);
+      }
+      if (!resp.ok) {
+        const text = await resp.text().catch(() => "");
+        log(
+          `inbound-context: POST failed (${resp.status}) integration=${args2.sourceIntegration}: ${text.slice(0, 200)}`
+        );
+      }
+    } catch (err) {
+      log(`inbound-context: emit threw integration=${args2.sourceIntegration}: ${err.message}`);
+    }
+  }
+  return {
+    recordInbound(args2) {
+      void emit(args2);
+    }
+  };
+}
+
+// src/slack-bot-user-id-client.ts
+var REQUEST_TIMEOUT_MS4 = 1e4;
 function createSlackBotUserIdClient(args) {
   if (!args.agtHost || !args.agtApiKey || !args.agentId) return null;
   const fetchImpl = args.fetchImpl ?? fetch;
@@ -15514,7 +15601,7 @@ function createSlackBotUserIdClient(args) {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ host_key: apiKey }),
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS4)
     });
     if (!resp.ok) {
       const body = await resp.text().catch(() => "");
@@ -15531,7 +15618,7 @@ function createSlackBotUserIdClient(args) {
       method: "POST",
       headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
       body: JSON.stringify({ agent_id: agentId, bot_user_id: botUserId2 }),
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS4)
     });
   }
   async function emitAsync(botUserId2) {
@@ -15563,7 +15650,7 @@ function createSlackBotUserIdClient(args) {
         method: "POST",
         headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
         body: JSON.stringify({ agent_id: agentId, channel_id: "slack", healthy }),
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS4)
       });
     };
     try {
@@ -15607,7 +15694,7 @@ function createSlackBotUserIdClient(args) {
   };
 }
 
-// src/slack-spawn-lock.ts
+// src/mcp-spawn-lock.ts
 import {
   existsSync,
   mkdirSync as mkdirSync2,
@@ -15617,7 +15704,6 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import { join as join2 } from "path";
-var DEFAULT_LOCK_BASENAME = "slack-channel.lock";
 function defaultIsPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   try {
@@ -15629,12 +15715,13 @@ function defaultIsPidAlive(pid) {
     return true;
   }
 }
-function acquireSlackSpawnLock(slackAgentDir, opts = {}) {
-  if (!slackAgentDir) return { kind: "no-agent-dir" };
-  const isPidAlive = opts.isPidAlive ?? defaultIsPidAlive;
-  const selfPid = opts.selfPid ?? process.pid;
-  const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const path = join2(slackAgentDir, DEFAULT_LOCK_BASENAME);
+function acquireMcpSpawnLock(args) {
+  const { agentDir, basename: basename2, options = {} } = args;
+  if (!agentDir) return { kind: "no-agent-dir" };
+  const isPidAlive = options.isPidAlive ?? defaultIsPidAlive;
+  const selfPid = options.selfPid ?? process.pid;
+  const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const path = join2(agentDir, basename2);
   const existing = readLockHolder(path);
   if (existing) {
     if (existing.pid === selfPid) {
@@ -15644,14 +15731,14 @@ function acquireSlackSpawnLock(slackAgentDir, opts = {}) {
       return { kind: "blocked", path, holder: existing };
     }
   }
-  mkdirSync2(slackAgentDir, { recursive: true, mode: 448 });
+  mkdirSync2(agentDir, { recursive: true, mode: 448 });
   const tmpPath = `${path}.${selfPid}.tmp`;
   const payload = { pid: selfPid, started_at: now() };
   writeFileSync2(tmpPath, JSON.stringify(payload), { mode: 384 });
   renameSync(tmpPath, path);
   return { kind: "acquired", path };
 }
-function releaseSlackSpawnLock(lockPath, opts = {}) {
+function releaseMcpSpawnLock(lockPath, opts = {}) {
   if (!lockPath) return;
   const selfPid = opts.selfPid ?? process.pid;
   const existing = readLockHolder(lockPath);
@@ -15683,6 +15770,19 @@ var AGENT_CODE_NAME = process.env.AGT_AGENT_CODE_NAME ?? null;
 var AGT_HOST = process.env.AGT_HOST ?? null;
 var AGT_API_KEY = process.env.AGT_API_KEY ?? null;
 var AGT_AGENT_ID = process.env.AGT_AGENT_ID ?? null;
+var AGT_TEAM_ID = process.env.AGT_TEAM_ID ?? null;
+var SLACK_SENDER_POLICY = (() => {
+  const raw = (process.env.SLACK_SENDER_POLICY ?? "all").trim().toLowerCase();
+  if (raw === "all") return { mode: "all" };
+  if (raw === "agents_only") return { mode: "agents_only" };
+  if (raw === "team_agents_only") {
+    if (!AGT_TEAM_ID) {
+      throw new Error("SLACK_SENDER_POLICY=team_agents_only requires AGT_TEAM_ID");
+    }
+    return { mode: "team_agents_only", teamId: AGT_TEAM_ID };
+  }
+  throw new Error(`Invalid SLACK_SENDER_POLICY=${JSON.stringify(process.env.SLACK_SENDER_POLICY)}`);
+})();
 var BLOCK_KIT_ENABLED = process.env.SLACK_BLOCK_KIT_ENABLED === "true";
 var BLOCK_KIT_ASK_USER_ENABLED = process.env.SLACK_BLOCK_KIT_ASK_USER_ENABLED === "true";
 var BLOCK_KIT_DISABLED = process.env.SLACK_BLOCK_KIT_DISABLED === "true";
@@ -15721,6 +15821,13 @@ var conversationIngestClient = createConversationIngestClient({
   log: (line) => process.stderr.write(`slack-channel: ${line}
 `)
 });
+var inboundContextClient = createInboundContextClient({
+  agtHost: AGT_HOST,
+  agtApiKey: AGT_API_KEY,
+  agentId: AGT_AGENT_ID,
+  log: (line) => process.stderr.write(`slack-channel: ${line}
+`)
+});
 var SLACK_PEER_CLASSIFIER_CONFIG = {
   peer_agent_mode: parsePeerAgentModeEnv(process.env.SLACK_PEER_AGENT_MODE),
   peer_group_ids: parsePeerGroupIdsEnv(process.env.SLACK_PEER_GROUP_IDS),
@@ -16049,6 +16156,16 @@ function noteThreadActivityByMessageTs(channel, messageTs) {
   }
 }
 var RESTART_FLAGS_DIR = join3(homedir2(), ".augmented", "restart-flags");
+function buildAugmentedSlackMetadata() {
+  if (!AGT_TEAM_ID) return void 0;
+  return {
+    event_type: "augmented_agent_message",
+    event_payload: {
+      augmented_team_id: AGT_TEAM_ID,
+      ...AGT_AGENT_ID ? { augmented_agent_id: AGT_AGENT_ID } : {}
+    }
+  };
+}
 function hashChannelId(id) {
   return createHash("sha256").update(id).digest("hex").slice(0, 8);
 }
@@ -16056,6 +16173,8 @@ function hashId(id) {
   return createHash("sha256").update(id).digest("hex").slice(0, 8);
 }
 async function postSlackMessage(body) {
+  const augmentedMeta = buildAugmentedSlackMetadata();
+  const bodyWithLabel = augmentedMeta ? { ...body, metadata: augmentedMeta } : body;
   try {
     const res = await fetch("https://slack.com/api/chat.postMessage", {
       method: "POST",
@@ -16063,7 +16182,7 @@ async function postSlackMessage(body) {
         "Content-Type": "application/json; charset=utf-8",
         Authorization: `Bearer ${BOT_TOKEN}`
       },
-      body: JSON.stringify(body),
+      body: JSON.stringify(bodyWithLabel),
       // Hard deadline so a hung Slack API can't stall the live Socket Mode
       // event loop or the manager's restart ack path. Matches the timeout
       // used elsewhere in this file for chat.postMessage.
@@ -16865,7 +16984,10 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
         body: JSON.stringify({
           channel,
           text,
-          ...thread_ts ? { thread_ts } : {}
+          ...thread_ts ? { thread_ts } : {},
+          ...buildAugmentedSlackMetadata() ? { metadata: buildAugmentedSlackMetadata() } : {}
+          // ↑ Labels this message as Augmented-agent-originated so peer agents
+          //   enforcing sender_policy=team_agents_only can verify the sender.
         })
       });
       const data = await res.json();
@@ -17289,6 +17411,8 @@ function forwardingHostAvailable() {
   return Boolean(AGT_HOST && AGT_API_KEY && AGT_AGENT_ID);
 }
 async function postSlackMessageWithTs(payload) {
+  const augmentedMeta = buildAugmentedSlackMetadata();
+  const payloadWithLabel = augmentedMeta ? { ...payload, metadata: augmentedMeta } : payload;
   try {
     const res = await fetch("https://slack.com/api/chat.postMessage", {
       method: "POST",
@@ -17296,7 +17420,7 @@ async function postSlackMessageWithTs(payload) {
         "Content-Type": "application/json; charset=utf-8",
         Authorization: `Bearer ${BOT_TOKEN}`
       },
-      body: JSON.stringify(payload),
+      body: JSON.stringify(payloadWithLabel),
       signal: AbortSignal.timeout(SLACK_DOWNLOAD_TIMEOUT_MS)
     });
     const data = await res.json();
@@ -17920,6 +18044,12 @@ async function connectSocketMode() {
       const filterDecision = decideSlackMessageForward(evt);
       if (!filterDecision.forward) {
         process.stderr.write(`slack-channel: dropped message event (reason=${filterDecision.reason}, subtype=${evt.subtype ?? "none"}, ts=${evt.ts ?? "n/a"})
+`);
+        return;
+      }
+      const senderPolicyDecision = decideSenderPolicyForward(evt, SLACK_SENDER_POLICY);
+      if (!senderPolicyDecision.forward) {
+        process.stderr.write(`slack-channel: dropped message event (reason=sender_policy, mode=${SLACK_SENDER_POLICY.mode}, ts=${evt.ts ?? "n/a"})
 `);
         return;
       }
@@ -18094,6 +18224,12 @@ async function connectSocketMode() {
           is_bot: isFromBot,
           bot_id: evt.bot_id ?? null
         });
+        if (!isFromBot && threadTs) {
+          inboundContextClient?.recordInbound({
+            sourceIntegration: "slack",
+            sourceExternalId: `${channel}:${threadTs}`
+          });
+        }
       }
     } catch (err) {
       process.stderr.write(`slack-channel: Event error: ${err.message}
@@ -18133,7 +18269,7 @@ function shutdown(reason, exitCode = 0) {
   } catch {
   }
   try {
-    releaseSlackSpawnLock(acquiredLockPath);
+    releaseMcpSpawnLock(acquiredLockPath);
   } catch {
   }
   setTimeout(() => process.exit(exitCode), 500).unref();
@@ -18149,7 +18285,10 @@ process.on("unhandledRejection", (reason) => {
 `);
 });
 {
-  const lockResult = acquireSlackSpawnLock(SLACK_AGENT_DIR);
+  const lockResult = acquireMcpSpawnLock({
+    agentDir: SLACK_AGENT_DIR,
+    basename: "slack-channel.lock"
+  });
   if (lockResult.kind === "blocked") {
     process.stderr.write(
       `slack-channel: another instance pid=${lockResult.holder.pid} already running (since ${lockResult.holder.started_at}), exiting