@integrity-labs/agt-cli 0.27.143 → 0.27.144

package/dist/{claude-pair-runtime-Z2WAQRSW.js → claude-pair-runtime-GIUCD7IG.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-255IRT6T.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-35PWSTLO.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-Z2WAQRSW.js.map
+//# sourceMappingURL=claude-pair-runtime-GIUCD7IG.js.map

package/dist/lib/manager-worker.js

@@ -18,7 +18,7 @@ import {
   provisionStopHook,
   requireHost,
   safeWriteJsonAtomic
-} from "../chunk-IKJYJYPI.js";
+} from "../chunk-HPUIWWKD.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -54,7 +54,7 @@ import {
   stopPersistentSession,
   takeWatchdogGiveUpCount,
   takeZombieDetection
-} from "../chunk-BQCBWYT3.js";
+} from "../chunk-7GKJZBTB.js";
 import {
   KANBAN_CHECK_COMMAND,
   MAX_AVATAR_ENV_URL_BYTES,
@@ -83,7 +83,7 @@ import {
   resolveDmTarget,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "../chunk-ZXIGQDOP.js";
+} from "../chunk-WOOYOAPG.js";
 import {
   isAgentIdle,
   isStaleForToday,
@@ -4760,7 +4760,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.143" : "dev";
+var agtCliVersion = true ? "0.27.144" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -5958,7 +5958,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-255IRT6T.js");
+      const { collectDiagnostics } = await import("../persistent-session-35PWSTLO.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -6045,12 +6045,12 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-Q35EEOHM.js");
+      } = await import("../responsiveness-probe-MA4M2QM4.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
         if (probeCodeNames.length > 0) {
-          const { takeAcpxExecFailureCount, creditAcpxExecFailureCount } = await import("../persistent-session-255IRT6T.js");
+          const { takeAcpxExecFailureCount, creditAcpxExecFailureCount } = await import("../persistent-session-35PWSTLO.js");
           const drainedGiveUps = /* @__PURE__ */ new Map();
           const drainedAcpxFailures = /* @__PURE__ */ new Map();
           const probes = collectResponsivenessProbes(probeCodeNames).map((p) => {
@@ -6084,7 +6084,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           deadLetterPendingInbound
-        } = await import("../responsiveness-probe-Q35EEOHM.js");
+        } = await import("../responsiveness-probe-MA4M2QM4.js");
         const { transcriptActivityAgeSeconds } = await import("../daily-session-PNQX5URX.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
@@ -10615,7 +10615,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-Z2WAQRSW.js");
+  } = await import("../claude-pair-runtime-GIUCD7IG.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/slack-channel.js

@@ -15568,6 +15568,19 @@ function mergeInboundText(text, blocks) {
   return { content, recoveredTable: rendered.length > 0 && content !== text };
 }
 
+// src/slack-allowlist-source.ts
+function parseAllowedUsersCsv(raw) {
+  return new Set(
+    (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0)
+  );
+}
+function extractAllowedUsersFromMcpJson(jsonText) {
+  const parsed = JSON.parse(jsonText);
+  const slackServer = parsed.mcpServers?.["slack"];
+  if (!slackServer) return null;
+  return parseAllowedUsersCsv(slackServer.env?.["SLACK_ALLOWED_USERS"]);
+}
+
 // src/slack-response-mode.ts
 var MODES = [
   "mention_only",
@@ -16306,9 +16319,7 @@ async function maybeSendSenderPolicyDecline(args) {
 var BLOCK_KIT_ENABLED = process.env.SLACK_BLOCK_KIT_ENABLED === "true";
 var BLOCK_KIT_ASK_USER_ENABLED = process.env.SLACK_BLOCK_KIT_ASK_USER_ENABLED === "true";
 var BLOCK_KIT_DISABLED = process.env.SLACK_BLOCK_KIT_DISABLED === "true";
-var ALLOWED_USERS = new Set(
-  (process.env.SLACK_ALLOWED_USERS ?? "").split(",").map((s) => s.trim()).filter(Boolean)
-);
+var ALLOWED_USERS = parseAllowedUsersCsv(process.env.SLACK_ALLOWED_USERS);
 var THREAD_AUTO_FOLLOW = process.env.SLACK_THREAD_AUTO_FOLLOW ?? "off";
 var CHANNEL_RESPONSE_MODE = parseResponseMode(process.env.SLACK_CHANNEL_RESPONSE_MODE);
 var SLACK_PEER_DISABLED_MODE = (() => {
@@ -16355,6 +16366,28 @@ var SLACK_PEER_CLASSIFIER_CONFIG = {
   peer_disabled_mode: SLACK_PEER_DISABLED_MODE
 };
 var SLACK_AGENT_DIR = AGENT_CODE_NAME ? join6(homedir2(), ".augmented", AGENT_CODE_NAME) : null;
+var SLACK_MCP_CONFIG_PATH = SLACK_AGENT_DIR ? join6(SLACK_AGENT_DIR, "project", ".mcp.json") : null;
+var liveAllowedUsersCache = null;
+function readLiveAllowedUsers() {
+  if (!SLACK_MCP_CONFIG_PATH) return null;
+  try {
+    const mtimeMs = statSync2(SLACK_MCP_CONFIG_PATH).mtimeMs;
+    if (liveAllowedUsersCache && liveAllowedUsersCache.mtimeMs === mtimeMs) {
+      return liveAllowedUsersCache.value;
+    }
+    const value = extractAllowedUsersFromMcpJson(
+      readFileSync7(SLACK_MCP_CONFIG_PATH, "utf-8")
+    );
+    if (value === null) return null;
+    liveAllowedUsersCache = { mtimeMs, value };
+    return value;
+  } catch {
+    return null;
+  }
+}
+function getEffectiveAllowedUsers() {
+  return readLiveAllowedUsers() ?? ALLOWED_USERS;
+}
 var SLACK_PENDING_INBOUND_DIR = SLACK_AGENT_DIR ? join6(SLACK_AGENT_DIR, "slack-pending-inbound") : null;
 var SLACK_RECOVERY_OUTBOX_DIR = SLACK_AGENT_DIR ? join6(SLACK_AGENT_DIR, "slack-recovery-outbox") : null;
 var SLACK_RESTART_CONFIRM_FILE = SLACK_AGENT_DIR ? join6(SLACK_AGENT_DIR, "slack-restart-confirm.json") : null;
@@ -17298,7 +17331,7 @@ async function handleDebugSlashCommand(payload, responseUrl) {
   const verdict = evaluateDebugGate({
     channelId: payload.channel_id,
     userId: payload.user_id,
-    allowedUsers: ALLOWED_USERS
+    allowedUsers: getEffectiveAllowedUsers()
   });
   const investigateCmd = agentSlashCommand("/investigate");
   if (!verdict.ok) {
@@ -17400,7 +17433,8 @@ async function handleSlashCommandEnvelope(payload) {
     return;
   }
   if (matchesAgentCommand(command, "/restart")) {
-    if (ALLOWED_USERS.size > 0 && (!payload.user_id || !ALLOWED_USERS.has(payload.user_id))) {
+    const restartAllowedUsers = getEffectiveAllowedUsers();
+    if (restartAllowedUsers.size > 0 && (!payload.user_id || !restartAllowedUsers.has(payload.user_id))) {
       process.stderr.write(
         `slack-channel(${codeName}): /restart slash-command denied \u2014 user not in SLACK_ALLOWED_USERS
 `
@@ -19085,7 +19119,7 @@ async function connectSocketMode() {
         return;
       }
       if (isRestartCommand) {
-        const senderAllowed = isRestartSenderAllowed(ALLOWED_USERS, evt.user);
+        const senderAllowed = isRestartSenderAllowed(getEffectiveAllowedUsers(), evt.user);
         if (!senderAllowed) {
           await denyUnauthorizedRestart({
             channel: evt.channel ?? "",

package/dist/{persistent-session-255IRT6T.js → persistent-session-35PWSTLO.js}

@@ -25,8 +25,8 @@ import {
   takeAcpxExecFailureCount,
   takeZombieDetection,
   writePersistentClaudeWrapper
-} from "./chunk-BQCBWYT3.js";
-import "./chunk-ZXIGQDOP.js";
+} from "./chunk-7GKJZBTB.js";
+import "./chunk-WOOYOAPG.js";
 import "./chunk-354FAVQR.js";
 import "./chunk-XWVM4KPK.js";
 export {
@@ -57,4 +57,4 @@ export {
   takeZombieDetection,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-255IRT6T.js.map
+//# sourceMappingURL=persistent-session-35PWSTLO.js.map

package/dist/{responsiveness-probe-Q35EEOHM.js → responsiveness-probe-MA4M2QM4.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-BQCBWYT3.js";
-import "./chunk-ZXIGQDOP.js";
+} from "./chunk-7GKJZBTB.js";
+import "./chunk-WOOYOAPG.js";
 import "./chunk-354FAVQR.js";
 import "./chunk-XWVM4KPK.js";
 
@@ -155,4 +155,4 @@ export {
   livePendingInboundOldestAgeSeconds,
   oldestLivePendingInboundMtimeMs
 };
-//# sourceMappingURL=responsiveness-probe-Q35EEOHM.js.map
+//# sourceMappingURL=responsiveness-probe-MA4M2QM4.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.27.143",
+  "version": "0.27.144",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {