@integrity-labs/agt-cli 0.27.22 → 0.27.23

package/dist/{chunk-F4NG4EXD.js → chunk-JIETOJQV.js}

@@ -1,7 +1,7 @@
 import {
   claudeModelAlias,
   isClaudeFastMode
-} from "./chunk-HT6EETEL.js";
+} from "./chunk-6HFXSNNY.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -1125,4 +1125,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-F4NG4EXD.js.map
+//# sourceMappingURL=chunk-JIETOJQV.js.map

package/dist/{chunk-SUYULB5G.js → chunk-RM4XYPLD.js}

@@ -9,7 +9,7 @@ import {
   parseDeliveryTarget,
   registerFramework,
   wrapScheduledTaskPrompt
-} from "./chunk-HT6EETEL.js";
+} from "./chunk-6HFXSNNY.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -4851,20 +4851,11 @@ ${sections}`
   },
   writeChannelCredentials(codeName, channelId, config, options) {
     const tzEnv = options?.agentTimezone && options.agentTimezone.trim() !== "" ? { TZ: options.agentTimezone.trim() } : {};
-    const senderPolicyEnv = (() => {
-      const sp = options?.senderPolicy;
-      if (!sp)
-        return {};
-      return {
-        // Channel-specific var name to match what the consumer MCP reads;
-        // spread below selects the right one per channelId.
-        ...sp.mode === "team_agents_only" && sp.team_id ? { AGT_TEAM_ID: sp.team_id } : {},
-        // sentinel keys consumed by the per-channel spread below
-        _SENDER_POLICY_MODE: sp.mode
-      };
-    })();
-    const senderPolicyMode = senderPolicyEnv["_SENDER_POLICY_MODE"];
-    delete senderPolicyEnv["_SENDER_POLICY_MODE"];
+    const senderPolicyMode = options?.senderPolicy?.mode;
+    const senderPolicyTeamId = options?.senderPolicy?.mode === "team_agents_only" || options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.team_id : void 0;
+    const slackPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.slack_user_id : void 0;
+    const teamsPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.teams_aad_object_id : void 0;
+    const senderPolicyEnv = senderPolicyTeamId ? { AGT_TEAM_ID: senderPolicyTeamId } : {};
     const agentDir = getAgentDir(codeName);
     mkdirSync4(agentDir, { recursive: true });
     const isPersistent = options?.sessionMode === "persistent";
@@ -5022,8 +5013,13 @@ ${sections}`
               // 'all' is the absence of the env var — same convention the
               // MCP filter uses on its own end).
               ...senderPolicyMode ? { SLACK_SENDER_POLICY: senderPolicyMode } : {},
-              ...senderPolicyEnv
+              ...senderPolicyEnv,
               // AGT_TEAM_ID when team_agents_only
+              // ENG-5842: principal ID for manager_only — Slack user_id from
+              // people.contact_preferences.slack_user_id. Omitted when the
+              // principal has no Slack ID; MCP filter fails closed on the
+              // missing env var by dropping all human inbound.
+              ...slackPrincipalId ? { SLACK_SENDER_POLICY_PRINCIPAL_ID: slackPrincipalId } : {}
             }
           };
           const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
@@ -5203,8 +5199,12 @@ ${sections}`
         // ENG-5841: MSTEAMS_SENDER_POLICY drives teams-inbound-filter.ts.
         // Mirrors the Slack branch above — only emitted when restrictive.
         ...senderPolicyMode ? { MSTEAMS_SENDER_POLICY: senderPolicyMode } : {},
-        ...senderPolicyEnv
+        ...senderPolicyEnv,
         // AGT_TEAM_ID when team_agents_only
+        // ENG-5842: principal ID for manager_only — Teams AAD object id from
+        // people.contact_preferences.teams_aad_object_id. Same fail-closed
+        // contract as the Slack branch above.
+        ...teamsPrincipalId ? { MSTEAMS_SENDER_POLICY_PRINCIPAL_ID: teamsPrincipalId } : {}
       };
       if (isPersistent && existsSync5(localTeamsChannel)) {
         mcpServers["msteams"] = {
@@ -6925,4 +6925,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-SUYULB5G.js.map
+//# sourceMappingURL=chunk-RM4XYPLD.js.map