@integrity-labs/agt-cli 0.27.142 → 0.27.144

package/dist/mcp/slack-channel.js

@@ -15568,6 +15568,19 @@ function mergeInboundText(text, blocks) {
   return { content, recoveredTable: rendered.length > 0 && content !== text };
 }
 
+// src/slack-allowlist-source.ts
+function parseAllowedUsersCsv(raw) {
+  return new Set(
+    (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0)
+  );
+}
+function extractAllowedUsersFromMcpJson(jsonText) {
+  const parsed = JSON.parse(jsonText);
+  const slackServer = parsed.mcpServers?.["slack"];
+  if (!slackServer) return null;
+  return parseAllowedUsersCsv(slackServer.env?.["SLACK_ALLOWED_USERS"]);
+}
+
 // src/slack-response-mode.ts
 var MODES = [
   "mention_only",
@@ -16306,9 +16319,7 @@ async function maybeSendSenderPolicyDecline(args) {
 var BLOCK_KIT_ENABLED = process.env.SLACK_BLOCK_KIT_ENABLED === "true";
 var BLOCK_KIT_ASK_USER_ENABLED = process.env.SLACK_BLOCK_KIT_ASK_USER_ENABLED === "true";
 var BLOCK_KIT_DISABLED = process.env.SLACK_BLOCK_KIT_DISABLED === "true";
-var ALLOWED_USERS = new Set(
-  (process.env.SLACK_ALLOWED_USERS ?? "").split(",").map((s) => s.trim()).filter(Boolean)
-);
+var ALLOWED_USERS = parseAllowedUsersCsv(process.env.SLACK_ALLOWED_USERS);
 var THREAD_AUTO_FOLLOW = process.env.SLACK_THREAD_AUTO_FOLLOW ?? "off";
 var CHANNEL_RESPONSE_MODE = parseResponseMode(process.env.SLACK_CHANNEL_RESPONSE_MODE);
 var SLACK_PEER_DISABLED_MODE = (() => {
@@ -16355,6 +16366,28 @@ var SLACK_PEER_CLASSIFIER_CONFIG = {
   peer_disabled_mode: SLACK_PEER_DISABLED_MODE
 };
 var SLACK_AGENT_DIR = AGENT_CODE_NAME ? join6(homedir2(), ".augmented", AGENT_CODE_NAME) : null;
+var SLACK_MCP_CONFIG_PATH = SLACK_AGENT_DIR ? join6(SLACK_AGENT_DIR, "project", ".mcp.json") : null;
+var liveAllowedUsersCache = null;
+function readLiveAllowedUsers() {
+  if (!SLACK_MCP_CONFIG_PATH) return null;
+  try {
+    const mtimeMs = statSync2(SLACK_MCP_CONFIG_PATH).mtimeMs;
+    if (liveAllowedUsersCache && liveAllowedUsersCache.mtimeMs === mtimeMs) {
+      return liveAllowedUsersCache.value;
+    }
+    const value = extractAllowedUsersFromMcpJson(
+      readFileSync7(SLACK_MCP_CONFIG_PATH, "utf-8")
+    );
+    if (value === null) return null;
+    liveAllowedUsersCache = { mtimeMs, value };
+    return value;
+  } catch {
+    return null;
+  }
+}
+function getEffectiveAllowedUsers() {
+  return readLiveAllowedUsers() ?? ALLOWED_USERS;
+}
 var SLACK_PENDING_INBOUND_DIR = SLACK_AGENT_DIR ? join6(SLACK_AGENT_DIR, "slack-pending-inbound") : null;
 var SLACK_RECOVERY_OUTBOX_DIR = SLACK_AGENT_DIR ? join6(SLACK_AGENT_DIR, "slack-recovery-outbox") : null;
 var SLACK_RESTART_CONFIRM_FILE = SLACK_AGENT_DIR ? join6(SLACK_AGENT_DIR, "slack-restart-confirm.json") : null;
@@ -17298,7 +17331,7 @@ async function handleDebugSlashCommand(payload, responseUrl) {
   const verdict = evaluateDebugGate({
     channelId: payload.channel_id,
     userId: payload.user_id,
-    allowedUsers: ALLOWED_USERS
+    allowedUsers: getEffectiveAllowedUsers()
   });
   const investigateCmd = agentSlashCommand("/investigate");
   if (!verdict.ok) {
@@ -17400,7 +17433,8 @@ async function handleSlashCommandEnvelope(payload) {
     return;
   }
   if (matchesAgentCommand(command, "/restart")) {
-    if (ALLOWED_USERS.size > 0 && (!payload.user_id || !ALLOWED_USERS.has(payload.user_id))) {
+    const restartAllowedUsers = getEffectiveAllowedUsers();
+    if (restartAllowedUsers.size > 0 && (!payload.user_id || !restartAllowedUsers.has(payload.user_id))) {
       process.stderr.write(
         `slack-channel(${codeName}): /restart slash-command denied \u2014 user not in SLACK_ALLOWED_USERS
 `
@@ -19085,7 +19119,7 @@ async function connectSocketMode() {
         return;
       }
       if (isRestartCommand) {
-        const senderAllowed = isRestartSenderAllowed(ALLOWED_USERS, evt.user);
+        const senderAllowed = isRestartSenderAllowed(getEffectiveAllowedUsers(), evt.user);
         if (!senderAllowed) {
           await denyUnauthorizedRestart({
             channel: evt.channel ?? "",

package/dist/{persistent-session-SOCMTNFC.js → persistent-session-35PWSTLO.js}

@@ -25,8 +25,8 @@ import {
   takeAcpxExecFailureCount,
   takeZombieDetection,
   writePersistentClaudeWrapper
-} from "./chunk-IDDSO7Q5.js";
-import "./chunk-WCXA7EEP.js";
+} from "./chunk-7GKJZBTB.js";
+import "./chunk-WOOYOAPG.js";
 import "./chunk-354FAVQR.js";
 import "./chunk-XWVM4KPK.js";
 export {
@@ -57,4 +57,4 @@ export {
   takeZombieDetection,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-SOCMTNFC.js.map
+//# sourceMappingURL=persistent-session-35PWSTLO.js.map

package/dist/{responsiveness-probe-USWGCI4C.js → responsiveness-probe-MA4M2QM4.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-IDDSO7Q5.js";
-import "./chunk-WCXA7EEP.js";
+} from "./chunk-7GKJZBTB.js";
+import "./chunk-WOOYOAPG.js";
 import "./chunk-354FAVQR.js";
 import "./chunk-XWVM4KPK.js";
 
@@ -155,4 +155,4 @@ export {
   livePendingInboundOldestAgeSeconds,
   oldestLivePendingInboundMtimeMs
 };
-//# sourceMappingURL=responsiveness-probe-USWGCI4C.js.map
+//# sourceMappingURL=responsiveness-probe-MA4M2QM4.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.27.142",
+  "version": "0.27.144",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {