@integrity-labs/agt-cli 0.27.25 → 0.27.26

package/dist/bin/agt.js

@@ -27,7 +27,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-GI73VOGA.js";
+} from "../chunk-S53Y2M2Q.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -4643,7 +4643,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.25" : "dev";
+var cliVersion = true ? "0.27.26" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5175,7 +5175,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.25" : "dev";
+var cliVersion2 = true ? "0.27.26" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", (thisCommand) => {

package/dist/{chunk-GI73VOGA.js → chunk-S53Y2M2Q.js}

@@ -6945,4 +6945,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-GI73VOGA.js.map
+//# sourceMappingURL=chunk-S53Y2M2Q.js.map

package/dist/lib/manager-worker.js

@@ -15,7 +15,7 @@ import {
   provisionOrientHook,
   provisionStopHook,
   requireHost
-} from "../chunk-GI73VOGA.js";
+} from "../chunk-S53Y2M2Q.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -3208,7 +3208,7 @@ var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.25" : "dev";
+var agtCliVersion = true ? "0.27.26" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/slack-channel.js

@@ -14261,6 +14261,56 @@ function decideSenderPolicyForward(evt, policy) {
   return decideModeForward(evt, policy);
 }
 
+// src/sender-policy-decline.ts
+function classifySlackPolicyBlock(evt, policy) {
+  if (policy.internalOnly && (!policy.homeTeamId || evt.team !== policy.homeTeamId)) {
+    return "internal_only";
+  }
+  switch (policy.mode) {
+    case "manager_only":
+      return "mode_manager_only";
+    case "team_agents_only":
+      return "mode_team_agents_only";
+    case "agents_only":
+      return "mode_agents_only";
+    case "all":
+      return "internal_only";
+  }
+}
+function politeDeclineCopy(reason) {
+  switch (reason) {
+    case "internal_only":
+      return "Sorry, I can only respond to people inside our organisation. This conversation appears to be from outside.";
+    case "mode_manager_only":
+      return "Sorry, I only respond to my manager in this channel.";
+    case "mode_team_agents_only":
+      return "Sorry, I only respond to agents on my team in this channel.";
+    case "mode_agents_only":
+      return "Sorry, I only respond to other agents in this channel.";
+  }
+}
+function decideDeclineReply(input) {
+  const last = input.cache.get(input.key);
+  if (last !== void 0) {
+    const elapsed = input.now - last;
+    if (elapsed < input.cooldownMs) {
+      return { reply: false, remainingMs: input.cooldownMs - elapsed };
+    }
+  }
+  input.cache.set(input.key, input.now);
+  return { reply: true };
+}
+function declineCacheKey(channelId, senderId, reason) {
+  return `${channelId}|${senderId}|${reason}`;
+}
+function readDeclineCooldownMs(envVarName, defaultSeconds = 1800) {
+  const raw = process.env[envVarName];
+  if (!raw) return defaultSeconds * 1e3;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) return defaultSeconds * 1e3;
+  return parsed * 1e3;
+}
+
 // src/ack-reaction.ts
 import { readdirSync, readFileSync } from "fs";
 import { join } from "path";
@@ -15557,6 +15607,58 @@ var SLACK_SENDER_POLICY = (() => {
   }
   throw new Error(`Invalid SLACK_SENDER_POLICY=${JSON.stringify(process.env.SLACK_SENDER_POLICY)}`);
 })();
+var SLACK_POLICY_DECLINE_CACHE = /* @__PURE__ */ new Map();
+var SLACK_POLICY_DECLINE_COOLDOWN_MS = readDeclineCooldownMs(
+  "SLACK_SENDER_POLICY_REPLY_COOLDOWN_SEC"
+);
+async function maybeSendSenderPolicyDecline(args) {
+  if (!BOT_TOKEN) return;
+  if (!args.channel || !args.senderId) return;
+  const key2 = declineCacheKey(args.channel, args.senderId, args.subReason);
+  const decision = decideDeclineReply({
+    cache: SLACK_POLICY_DECLINE_CACHE,
+    key: key2,
+    cooldownMs: SLACK_POLICY_DECLINE_COOLDOWN_MS,
+    now: Date.now()
+  });
+  if (!decision.reply) {
+    process.stderr.write(
+      `slack-channel(${AGENT_CODE_NAME}): decline suppressed by cooldown (channel=${redactSlackId(args.channel)}, sender=${redactSlackId(args.senderId)}, reason=${args.subReason}, remaining=${decision.remainingMs}ms)
+`
+    );
+    return;
+  }
+  const text = politeDeclineCopy(args.subReason);
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const res = await fetch("https://slack.com/api/chat.postMessage", {
+      method: "POST",
+      signal: controller.signal,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${BOT_TOKEN}`
+      },
+      body: JSON.stringify({
+        channel: args.channel,
+        text,
+        // Reply in-thread if the inbound was a thread message — keeps
+        // the decline next to the message that caused it. For top-level
+        // posts (DMs / channel root) omit thread_ts and post inline.
+        ...args.threadTs ? { thread_ts: args.threadTs } : {}
+      })
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      process.stderr.write(
+        `slack-channel(${AGENT_CODE_NAME}): decline post failed: ${data.error ?? "unknown"}
+`
+      );
+    }
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
 var BLOCK_KIT_ENABLED = process.env.SLACK_BLOCK_KIT_ENABLED === "true";
 var BLOCK_KIT_ASK_USER_ENABLED = process.env.SLACK_BLOCK_KIT_ASK_USER_ENABLED === "true";
 var BLOCK_KIT_DISABLED = process.env.SLACK_BLOCK_KIT_DISABLED === "true";
@@ -17807,8 +17909,27 @@ async function connectSocketMode() {
       }
       const senderPolicyDecision = decideSenderPolicyForward(evt, SLACK_SENDER_POLICY);
       if (!senderPolicyDecision.forward) {
-        process.stderr.write(`slack-channel: dropped message event (reason=sender_policy, mode=${SLACK_SENDER_POLICY.mode}, ts=${evt.ts ?? "n/a"})
+        const subReason = classifySlackPolicyBlock(evt, SLACK_SENDER_POLICY);
+        process.stderr.write(`slack-channel: dropped message event (reason=sender_policy, sub=${subReason}, mode=${SLACK_SENDER_POLICY.mode}, ts=${evt.ts ?? "n/a"})
 `);
+        await maybeSendSenderPolicyDecline({
+          channel: evt.channel,
+          senderId: evt.user,
+          // CR on PR #1623: top-level posts (DMs, channel root messages)
+          // arrive with no `thread_ts` and MUST decline inline, not in a
+          // new thread off the inbound message. The `?? evt.ts` fallback
+          // forced every root message into a thread reply — exactly the
+          // case the helper's "omit thread_ts when undefined" branch was
+          // meant to handle. Pass through as-is: in-thread for thread
+          // replies (thread_ts present), inline for everything else.
+          threadTs: evt.thread_ts,
+          subReason
+        }).catch((err) => {
+          process.stderr.write(
+            `slack-channel(${AGENT_CODE_NAME}): decline reply failed: ${err.message}
+`
+          );
+        });
         return;
       }
       recordActivity("inbound");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.27.25",
+  "version": "0.27.26",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {