@integrity-labs/agt-cli 0.27.163 → 0.27.164

package/dist/bin/agt.js

@@ -33,7 +33,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-DTZKJYJP.js";
+} from "../chunk-OIX32YSR.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -5019,7 +5019,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.163" : "dev";
+var cliVersion = true ? "0.27.164" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5942,7 +5942,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.163" : "dev";
+var cliVersion2 = true ? "0.27.164" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-DTZKJYJP.js → chunk-OIX32YSR.js}

@@ -8222,4 +8222,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-DTZKJYJP.js.map
+//# sourceMappingURL=chunk-OIX32YSR.js.map

package/dist/lib/manager-worker.js

@@ -22,7 +22,7 @@ import {
   provisionStopHook,
   requireHost,
   safeWriteJsonAtomic
-} from "../chunk-DTZKJYJP.js";
+} from "../chunk-OIX32YSR.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -5012,7 +5012,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.163" : "dev";
+var agtCliVersion = true ? "0.27.164" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/slack-channel.js

@@ -14344,6 +14344,110 @@ function decideInboundAccess(input) {
   return { kind: "admit" };
 }
 
+// src/watch-command.ts
+var WATCH_DEFAULT_DURATION_MS = 2 * 60 * 60 * 1e3;
+var WATCH_MAX_DURATION_MS = 7 * 24 * 60 * 60 * 1e3;
+var WATCH_MIN_DURATION_MS = 5 * 60 * 1e3;
+function extractDriveFileId(s) {
+  const trimmed = s.trim().replace(/^<|>$/g, "");
+  const pathId = trimmed.match(/\/d\/([A-Za-z0-9_-]{10,})/);
+  if (pathId?.[1]) return pathId[1];
+  const idParam = trimmed.match(/[?&]id=([A-Za-z0-9_-]{10,})/);
+  if (idParam?.[1]) return idParam[1];
+  if (!/[/:?]/.test(trimmed) && /^[A-Za-z0-9_-]{20,}$/.test(trimmed)) return trimmed;
+  return null;
+}
+function parseDurationToken(token) {
+  const m = token.trim().match(/^(\d+)\s*([smhd])?$/i);
+  if (!m?.[1]) return null;
+  const n = Number.parseInt(m[1], 10);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  const unit = (m[2] ?? "m").toLowerCase();
+  const mult = unit === "s" ? 1e3 : unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5;
+  return n * mult;
+}
+function parseWatchArgs(args) {
+  const parts = args.trim().split(/\s+/).filter(Boolean);
+  const first = parts[0];
+  if (!first) return { ok: false, error: "usage" };
+  if (parts.length > 2) return { ok: false, error: "usage" };
+  const fileId = extractDriveFileId(first);
+  if (!fileId) return { ok: false, error: "bad-url" };
+  let durationMs = WATCH_DEFAULT_DURATION_MS;
+  const durationToken = parts[1];
+  if (durationToken !== void 0) {
+    const parsed = parseDurationToken(durationToken);
+    if (parsed === null) return { ok: false, error: "bad-duration" };
+    durationMs = Math.min(Math.max(parsed, WATCH_MIN_DURATION_MS), WATCH_MAX_DURATION_MS);
+  }
+  return { ok: true, value: { fileId, durationMs } };
+}
+function watchArgsFromText(strippedText, codeName, opts) {
+  const forms = [];
+  if (opts?.allowBare ?? true) forms.push("/watch");
+  if (codeName) forms.push(`/watch-${codeName}`);
+  for (const f of forms) {
+    if (strippedText === f) return "";
+    if (strippedText.startsWith(`${f} `)) return strippedText.slice(f.length + 1).trim();
+  }
+  return null;
+}
+async function postWatchTrigger(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  try {
+    const res = await doFetch(`${opts.host}/host/triggers`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json; charset=utf-8",
+        Authorization: `Bearer ${opts.apiKey}`
+      },
+      body: JSON.stringify({
+        agent_id: opts.agentId,
+        provider: "gdrive_comments",
+        config: { fileId: opts.fileId },
+        expires_at: opts.expiresAtIso
+      }),
+      signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
+    });
+    if (!res.ok) {
+      let msg = `HTTP ${res.status}`;
+      try {
+        const j2 = await res.json();
+        if (j2?.error) msg = j2.error;
+      } catch {
+      }
+      return { ok: false, status: res.status, error: msg };
+    }
+    const j = await res.json().catch(() => ({}));
+    return { ok: true, status: res.status, reused: !!j.reused, expiresAt: j.expires_at ?? null };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function humanDuration(ms) {
+  const mins = Math.round(ms / 6e4);
+  if (mins % 1440 === 0) return `${mins / 1440}d`;
+  if (mins % 60 === 0) return `${mins / 60}h`;
+  return `${mins}m`;
+}
+function watchUsageText() {
+  return "Usage: `/watch <google-doc-url> [duration]` \u2014 e.g. `/watch https://docs.google.com/document/d/\u2026/edit 2h`. Duration defaults to 2h (max 7d).";
+}
+function watchBadUrlText() {
+  return "That doesn't look like a Google Doc link. Paste the doc's share URL (the part with `/d/<id>`).";
+}
+function watchBadDurationText() {
+  return "I couldn't read that duration. Try `30m`, `2h`, or `1d` (max 7d).";
+}
+function watchErrorText() {
+  return "\u274C I couldn't set up that watch just now. Please try again in a moment.";
+}
+function watchSuccessTextSlack(fileId, durationMs, reused) {
+  const url = `https://docs.google.com/document/d/${fileId}/edit`;
+  const verb = reused ? "Extended my watch on" : "Watching";
+  return `\u{1F440} ${verb} <${url}|that doc> for new comments that mention me, for the next ${humanDuration(durationMs)}. I'll pause automatically when the window's up. (Make sure Google Drive is connected with comment access, or I won't see them.)`;
+}
+
 // src/ack-reaction.ts
 import { readdirSync, readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
@@ -17214,6 +17318,7 @@ function buildSlackHelpMessage(codeName) {
     `\u2022 \`${agentSlashCommand("/help")}\` (or type \`/help\`) \u2014 show this help`,
     `\u2022 \`${agentSlashCommand("/restart")}\` \u2014 restart this agent`,
     `\u2022 \`${agentSlashCommand("/status")}\` \u2014 this agent's model, session origin, uptime + connectivity`,
+    "\u2022 `/watch <google-doc-url> [duration]` (type it in chat) \u2014 watch a Google Doc for comments that mention me (default 2h, max 7d; auto-pauses when the window ends). In a shared channel, address me as `/watch-<my-name>`.",
     "\u2022 `/kill` \u2014 silence all agents in this thread for 6h (use as a thread reply)",
     "\u2022 `/unkill` \u2014 clear a kill (use as a thread reply)",
     `\u2022 \`${agentSlashCommand("/investigate")}\` \u2014 live tail of this agent's terminal pane (DM only, allowlisted users; works while the channel process is alive \u2014 a wedged host still needs SSM diagnostics)`
@@ -17727,6 +17832,61 @@ async function denyUnauthorizedRestart(opts) {
     ...opts.threadTs ? { thread_ts: opts.threadTs } : {}
   });
 }
+async function handleWatchCommand(opts) {
+  const codeName = AGENT_CODE_NAME ?? "unknown";
+  const replyThread = opts.threadTs ?? opts.ts;
+  const post = (text) => postSlackMessage({
+    channel: opts.channel,
+    text,
+    ...replyThread ? { thread_ts: replyThread } : {}
+  });
+  const parsed = parseWatchArgs(watchArgsFromText(opts.rawText, AGENT_CODE_NAME) ?? "");
+  if (!parsed.ok) {
+    await post(
+      parsed.error === "bad-url" ? watchBadUrlText() : parsed.error === "bad-duration" ? watchBadDurationText() : watchUsageText()
+    );
+    return;
+  }
+  if (!AGT_HOST || !AGT_API_KEY || !AGT_AGENT_ID) {
+    process.stderr.write(`slack-channel(${codeName}): /watch missing AGT_* env \u2014 cannot create watch
+`);
+    await post(watchErrorText());
+    return;
+  }
+  const expiresAtIso = new Date(Date.now() + parsed.value.durationMs).toISOString();
+  const res = await postWatchTrigger({
+    host: AGT_HOST,
+    apiKey: AGT_API_KEY,
+    agentId: AGT_AGENT_ID,
+    fileId: parsed.value.fileId,
+    expiresAtIso
+  });
+  if (!res.ok) {
+    process.stderr.write(
+      `slack-channel(${codeName}): /watch create failed (status=${res.status ?? "?"}): ${res.error ?? "unknown"}
+`
+    );
+    await post(watchErrorText());
+    return;
+  }
+  process.stderr.write(
+    `slack-channel(${codeName}): /watch ${res.reused ? "extended" : "created"} for doc ${parsed.value.fileId.slice(0, 8)}\u2026 channel ${hashChannelId(opts.channel)}
+`
+  );
+  await post(watchSuccessTextSlack(parsed.value.fileId, parsed.value.durationMs, !!res.reused));
+}
+async function denyUnauthorizedWatch(opts) {
+  const codeName = AGENT_CODE_NAME ?? "unknown";
+  process.stderr.write(
+    `slack-channel(${codeName}): /watch denied \u2014 sender not in SLACK_ALLOWED_USERS, channel ${hashChannelId(opts.channel)}
+`
+  );
+  await postSlackMessage({
+    channel: opts.channel,
+    text: `\u{1F6AB} \`/watch\` denied \u2014 your Slack user is not in the allowlist for \`${codeName}\`.`,
+    ...opts.threadTs ? { thread_ts: opts.threadTs } : {}
+  });
+}
 var trackedThreads = /* @__PURE__ */ new Map();
 var THREAD_STORE_PATH = resolveThreadStorePath();
 var THREAD_STORE_TTL_DAYS = parseTtlDays(process.env.SLACK_THREAD_FOLLOW_TTL_DAYS);
@@ -19188,7 +19348,9 @@ async function connectSocketMode() {
       const helpSuffixed = agentSlashCommand("/help");
       const isRestartCommand = strippedText === "/restart" || strippedText.startsWith("/restart ") || strippedText === restartSuffixed || strippedText.startsWith(`${restartSuffixed} `);
       const isHelpCommand = strippedText === "/help" || strippedText.startsWith("/help ") || strippedText === helpSuffixed || strippedText.startsWith(`${helpSuffixed} `);
-      const command = isBot ? void 0 : isHelpCommand ? { command: "help", authorized: true } : isRestartCommand ? { command: "restart", authorized: isRestartSenderAllowed(getEffectiveAllowedUsers(), evt.user) } : void 0;
+      const isWatchDm = evt.channel?.startsWith("D") ?? false;
+      const isWatchCommand = !isBot && watchArgsFromText(strippedText, AGENT_CODE_NAME, { allowBare: isWatchDm }) !== null;
+      const command = isBot ? void 0 : isHelpCommand ? { command: "help", authorized: true } : isWatchCommand ? { command: "watch", authorized: isRestartSenderAllowed(getEffectiveAllowedUsers(), evt.user) } : isRestartCommand ? { command: "restart", authorized: isRestartSenderAllowed(getEffectiveAllowedUsers(), evt.user) } : void 0;
       const slackHomeTeamId = process.env.SLACK_HOME_TEAM_ID;
       const sameOrg = !!slackHomeTeamId && evt.team === slackHomeTeamId;
       const access = decideInboundAccess({
@@ -19247,6 +19409,22 @@ async function connectSocketMode() {
           });
           return;
         }
+        if (access.command === "watch") {
+          if (!access.authorized) {
+            await denyUnauthorizedWatch({
+              channel: evt.channel ?? "",
+              threadTs: evt.thread_ts
+            });
+            return;
+          }
+          await handleWatchCommand({
+            channel: evt.channel ?? "",
+            threadTs: evt.thread_ts,
+            ts: evt.ts ?? "",
+            rawText: strippedText
+          });
+          return;
+        }
         if (access.command === "restart") {
           if (!access.authorized) {
             await denyUnauthorizedRestart({

package/dist/mcp/telegram-channel.js

@@ -14868,6 +14868,100 @@ function decideInboundAccess(input) {
   return { kind: "admit" };
 }
 
+// src/watch-command.ts
+var WATCH_DEFAULT_DURATION_MS = 2 * 60 * 60 * 1e3;
+var WATCH_MAX_DURATION_MS = 7 * 24 * 60 * 60 * 1e3;
+var WATCH_MIN_DURATION_MS = 5 * 60 * 1e3;
+function extractDriveFileId(s) {
+  const trimmed = s.trim().replace(/^<|>$/g, "");
+  const pathId = trimmed.match(/\/d\/([A-Za-z0-9_-]{10,})/);
+  if (pathId?.[1]) return pathId[1];
+  const idParam = trimmed.match(/[?&]id=([A-Za-z0-9_-]{10,})/);
+  if (idParam?.[1]) return idParam[1];
+  if (!/[/:?]/.test(trimmed) && /^[A-Za-z0-9_-]{20,}$/.test(trimmed)) return trimmed;
+  return null;
+}
+function parseDurationToken(token) {
+  const m = token.trim().match(/^(\d+)\s*([smhd])?$/i);
+  if (!m?.[1]) return null;
+  const n = Number.parseInt(m[1], 10);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  const unit = (m[2] ?? "m").toLowerCase();
+  const mult = unit === "s" ? 1e3 : unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5;
+  return n * mult;
+}
+function parseWatchArgs(args) {
+  const parts = args.trim().split(/\s+/).filter(Boolean);
+  const first = parts[0];
+  if (!first) return { ok: false, error: "usage" };
+  if (parts.length > 2) return { ok: false, error: "usage" };
+  const fileId = extractDriveFileId(first);
+  if (!fileId) return { ok: false, error: "bad-url" };
+  let durationMs = WATCH_DEFAULT_DURATION_MS;
+  const durationToken = parts[1];
+  if (durationToken !== void 0) {
+    const parsed = parseDurationToken(durationToken);
+    if (parsed === null) return { ok: false, error: "bad-duration" };
+    durationMs = Math.min(Math.max(parsed, WATCH_MIN_DURATION_MS), WATCH_MAX_DURATION_MS);
+  }
+  return { ok: true, value: { fileId, durationMs } };
+}
+async function postWatchTrigger(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  try {
+    const res = await doFetch(`${opts.host}/host/triggers`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json; charset=utf-8",
+        Authorization: `Bearer ${opts.apiKey}`
+      },
+      body: JSON.stringify({
+        agent_id: opts.agentId,
+        provider: "gdrive_comments",
+        config: { fileId: opts.fileId },
+        expires_at: opts.expiresAtIso
+      }),
+      signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
+    });
+    if (!res.ok) {
+      let msg = `HTTP ${res.status}`;
+      try {
+        const j2 = await res.json();
+        if (j2?.error) msg = j2.error;
+      } catch {
+      }
+      return { ok: false, status: res.status, error: msg };
+    }
+    const j = await res.json().catch(() => ({}));
+    return { ok: true, status: res.status, reused: !!j.reused, expiresAt: j.expires_at ?? null };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function humanDuration(ms) {
+  const mins = Math.round(ms / 6e4);
+  if (mins % 1440 === 0) return `${mins / 1440}d`;
+  if (mins % 60 === 0) return `${mins / 60}h`;
+  return `${mins}m`;
+}
+function watchUsageText() {
+  return "Usage: `/watch <google-doc-url> [duration]` \u2014 e.g. `/watch https://docs.google.com/document/d/\u2026/edit 2h`. Duration defaults to 2h (max 7d).";
+}
+function watchBadUrlText() {
+  return "That doesn't look like a Google Doc link. Paste the doc's share URL (the part with `/d/<id>`).";
+}
+function watchBadDurationText() {
+  return "I couldn't read that duration. Try `30m`, `2h`, or `1d` (max 7d).";
+}
+function watchErrorText() {
+  return "\u274C I couldn't set up that watch just now. Please try again in a moment.";
+}
+function watchSuccessTextPlain(fileId, durationMs, reused) {
+  const url = `https://docs.google.com/document/d/${fileId}/edit`;
+  const verb = reused ? "Extended my watch on" : "Watching";
+  return `\u{1F440} ${verb} ${url} for new comments that mention me, for the next ${humanDuration(durationMs)}. I'll pause automatically when the window's up. (Make sure Google Drive is connected with comment access, or I won't see them.)`;
+}
+
 // src/telegram-peer-rate-limiter.ts
 var SECOND_MS = 1e3;
 var MINUTE_MS = 60 * SECOND_MS;
@@ -16533,6 +16627,7 @@ function buildTelegramHelpMessage(codeName) {
     `_Type these in any chat where the bot is present (intercepted by the agent):_`,
     `\u2022 /help \u2014 show this help`,
     `\u2022 /status \u2014 this agent's model, session origin, uptime + connectivity`,
+    `\u2022 /watch <google-doc-url> [duration] \u2014 watch a Google Doc for comments that mention me (default 2h, max 7d; auto-pauses when the window ends)`,
     `\u2022 /restart \u2014 restart this agent`,
     `\u2022 /investigate-${codeName} \u2014 live tail of this agent's terminal pane (DM only; team owners/admins and the agent's reports-to person)`
   ].join("\n");
@@ -16562,6 +16657,63 @@ async function handleHelpCommand(opts) {
     );
   }
 }
+async function handleWatchCommand(opts) {
+  const reply = async (text) => {
+    try {
+      const resp = await telegramApiCall(
+        "sendMessage",
+        { chat_id: opts.chatId, text, reply_to_message_id: Number(opts.messageId) },
+        1e4
+      );
+      if (!resp.ok) {
+        process.stderr.write(
+          `telegram-channel(${AGENT_CODE_NAME}): /watch reply rejected (chat ${redactId(opts.chatId)}): ${resp.description ?? "unknown"}
+`
+        );
+      }
+    } catch (err) {
+      process.stderr.write(
+        `telegram-channel(${AGENT_CODE_NAME}): /watch reply send failed: ${redactAugmentedPaths(err.message)}
+`
+      );
+    }
+  };
+  const args = opts.text.replace(/^\/watch(?:@[A-Za-z0-9_]{1,64})?\s*/i, "");
+  const parsed = parseWatchArgs(args);
+  if (!parsed.ok) {
+    await reply(
+      parsed.error === "bad-url" ? watchBadUrlText() : parsed.error === "bad-duration" ? watchBadDurationText() : watchUsageText()
+    );
+    return;
+  }
+  if (!AGT_HOST || !AGT_API_KEY || !AGT_AGENT_ID) {
+    process.stderr.write(`telegram-channel(${AGENT_CODE_NAME}): /watch missing AGT_* env \u2014 cannot create watch
+`);
+    await reply(watchErrorText());
+    return;
+  }
+  const expiresAtIso = new Date(Date.now() + parsed.value.durationMs).toISOString();
+  const res = await postWatchTrigger({
+    host: AGT_HOST,
+    apiKey: AGT_API_KEY,
+    agentId: AGT_AGENT_ID,
+    fileId: parsed.value.fileId,
+    expiresAtIso
+  });
+  if (!res.ok) {
+    process.stderr.write(
+      `telegram-channel(${AGENT_CODE_NAME}): /watch create failed (status=${res.status ?? "?"}): ${res.error ?? "unknown"}
+`
+    );
+    await reply(watchErrorText());
+    return;
+  }
+  process.stderr.write(
+    `telegram-channel(${AGENT_CODE_NAME}): /watch ${res.reused ? "extended" : "created"} for doc ${parsed.value.fileId.slice(0, 8)}\u2026 chat ${redactId(opts.chatId)}
+`
+  );
+  await reply(watchSuccessTextPlain(parsed.value.fileId, parsed.value.durationMs, !!res.reused));
+}
 function buildTelegramStatusReply() {
   const state = readAgentSessionState(TELEGRAM_AGENT_DIR);
   return buildAgentConfigReport({
@@ -16967,6 +17119,10 @@ var STATUS_SYNTAX_RE = /^\/status(?:@([A-Za-z0-9_]{1,64}))?(?:\s|$)/;
 function isStatusSyntax(text) {
   return STATUS_SYNTAX_RE.test(text);
 }
+var WATCH_SYNTAX_RE = /^\/watch(?:@([A-Za-z0-9_]{1,64}))?(?:\s|$)/;
+function isWatchSyntax(text) {
+  return WATCH_SYNTAX_RE.test(text);
+}
 function isRestartSyntax(text) {
   return RESTART_SYNTAX_RE.test(text);
 }
@@ -18208,7 +18364,7 @@ async function pollLoop() {
         const trimmedContent = content.trim();
         const isFromBot = !!msg.from?.is_bot;
         const nowMs = Date.now();
-        const telegramCommand = isHelpSyntax(trimmedContent) ? "help" : isStatusSyntax(trimmedContent) ? "status" : isRestartSyntax(trimmedContent) ? "restart" : isInvestigateSyntax(trimmedContent) ? "investigate" : void 0;
+        const telegramCommand = isHelpSyntax(trimmedContent) ? "help" : isStatusSyntax(trimmedContent) ? "status" : isWatchSyntax(trimmedContent) ? "watch" : isRestartSyntax(trimmedContent) ? "restart" : isInvestigateSyntax(trimmedContent) ? "investigate" : void 0;
         let classification;
         let peerLeaf;
         if (isFromBot) {
@@ -18288,6 +18444,19 @@ async function pollLoop() {
           }
           continue;
         }
+        if (access.kind === "command" && access.command === "watch") {
+          const disposition = await classifyRestartCommand(
+            trimmedContent.replace(/^\/watch(@[A-Za-z0-9_]{1,64})?/, "/restart$1")
+          );
+          if (disposition === "act") {
+            await handleWatchCommand({
+              chatId,
+              messageId: String(msg.message_id),
+              text: trimmedContent
+            });
+          }
+          continue;
+        }
         if (access.kind === "command" && access.command === "restart") {
           const disposition = await classifyRestartCommand(trimmedContent);
           if (disposition === "act") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.27.163",
+  "version": "0.27.164",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {