@integrity-labs/agt-cli 0.27.25 → 0.27.27

package/dist/bin/agt.js

@@ -27,7 +27,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-GI73VOGA.js";
+} from "../chunk-ZYFZYWPV.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -4643,7 +4643,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.25" : "dev";
+var cliVersion = true ? "0.27.27" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5175,7 +5175,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.25" : "dev";
+var cliVersion2 = true ? "0.27.27" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", (thisCommand) => {

package/dist/{chunk-GI73VOGA.js → chunk-ZYFZYWPV.js}

@@ -6945,4 +6945,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-GI73VOGA.js.map
+//# sourceMappingURL=chunk-ZYFZYWPV.js.map

package/dist/lib/manager-worker.js

@@ -15,7 +15,7 @@ import {
   provisionOrientHook,
   provisionStopHook,
   requireHost
-} from "../chunk-GI73VOGA.js";
+} from "../chunk-ZYFZYWPV.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -3208,7 +3208,7 @@ var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.25" : "dev";
+var agtCliVersion = true ? "0.27.27" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/slack-channel.js

@@ -14261,11 +14261,62 @@ function decideSenderPolicyForward(evt, policy) {
   return decideModeForward(evt, policy);
 }
 
+// src/sender-policy-decline.ts
+function classifySlackPolicyBlock(evt, policy) {
+  if (policy.internalOnly && (!policy.homeTeamId || evt.team !== policy.homeTeamId)) {
+    return "internal_only";
+  }
+  switch (policy.mode) {
+    case "manager_only":
+      return "mode_manager_only";
+    case "team_agents_only":
+      return "mode_team_agents_only";
+    case "agents_only":
+      return "mode_agents_only";
+    case "all":
+      return "internal_only";
+  }
+}
+function politeDeclineCopy(reason) {
+  switch (reason) {
+    case "internal_only":
+      return "Sorry, I can only respond to people inside our organisation. This conversation appears to be from outside.";
+    case "mode_manager_only":
+      return "Sorry, I only respond to my manager in this channel.";
+    case "mode_team_agents_only":
+      return "Sorry, I only respond to agents on my team in this channel.";
+    case "mode_agents_only":
+      return "Sorry, I only respond to other agents in this channel.";
+  }
+}
+function decideDeclineReply(input) {
+  const last = input.cache.get(input.key);
+  if (last !== void 0) {
+    const elapsed = input.now - last;
+    if (elapsed < input.cooldownMs) {
+      return { reply: false, remainingMs: input.cooldownMs - elapsed };
+    }
+  }
+  input.cache.set(input.key, input.now);
+  return { reply: true };
+}
+function declineCacheKey(channelId, senderId, reason) {
+  return `${channelId}|${senderId}|${reason}`;
+}
+function readDeclineCooldownMs(envVarName, defaultSeconds = 1800) {
+  const raw = process.env[envVarName];
+  if (!raw) return defaultSeconds * 1e3;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) return defaultSeconds * 1e3;
+  return parsed * 1e3;
+}
+
 // src/ack-reaction.ts
 import { readdirSync, readFileSync } from "fs";
 import { join } from "path";
 var REPLY_WEDGED_THRESHOLD_MS = 5 * 60 * 1e3;
 var ACK_STARTUP_GRACE_MS = 6e4;
+var ACK_PANE_FRESH_THRESHOLD_MS = 6e4;
 function decideAckReaction(i) {
   if (!i.hasTarget) return "none";
   if (!i.integrationReady) return "undeliverable";
@@ -14273,6 +14324,11 @@ function decideAckReaction(i) {
   if (!i.withinStartupGrace && i.claude === "dead") return "undeliverable";
   const threshold = i.pendingStaleThresholdMs ?? REPLY_WEDGED_THRESHOLD_MS;
   if (i.oldestPendingAgeMs != null && i.oldestPendingAgeMs > threshold) {
+    const paneFreshThreshold = i.paneFreshThresholdMs ?? ACK_PANE_FRESH_THRESHOLD_MS;
+    const paneIsFresh = i.paneLogFreshAgeMs != null && i.paneLogFreshAgeMs <= paneFreshThreshold;
+    if (paneIsFresh && i.tmux === "alive" && i.claude === "alive") {
+      return "ack";
+    }
     return "undeliverable";
   }
   return "ack";
@@ -14567,6 +14623,69 @@ var SLACK_EGRESS_TOOLS = /* @__PURE__ */ new Set([
   "slack.upload_file"
 ]);
 
+// src/slack-pending-inbound-cleanup.ts
+import { existsSync, readdirSync as readdirSync2, statSync, unlinkSync } from "fs";
+import { join as join2 } from "path";
+function sanitizeMarkerSegment(value) {
+  return value.replace(/[^A-Za-z0-9_-]/g, "_");
+}
+var defaultClearMarkerFile = (fullPath) => {
+  try {
+    if (existsSync(fullPath)) unlinkSync(fullPath);
+  } catch {
+  }
+};
+function clearAllSlackPendingMarkersForThread(dir, channel, threadTs, clear = defaultClearMarkerFile) {
+  if (!dir) return 0;
+  const prefix = `${sanitizeMarkerSegment(channel)}__${sanitizeMarkerSegment(threadTs)}__`;
+  let cleared = 0;
+  try {
+    for (const f of readdirSync2(dir)) {
+      if (!f.startsWith(prefix) || !f.endsWith(".json")) continue;
+      clear(join2(dir, f));
+      cleared += 1;
+    }
+  } catch {
+  }
+  return cleared;
+}
+function clearSlackPendingMarkerByMessageTs(dir, channel, messageTs, clear = defaultClearMarkerFile) {
+  if (!dir) return 0;
+  const channelPrefix = `${sanitizeMarkerSegment(channel)}__`;
+  const messageSuffix = `__${sanitizeMarkerSegment(messageTs)}.json`;
+  let cleared = 0;
+  try {
+    for (const f of readdirSync2(dir)) {
+      if (!f.startsWith(channelPrefix) || !f.endsWith(messageSuffix)) continue;
+      clear(join2(dir, f));
+      cleared += 1;
+    }
+  } catch {
+  }
+  return cleared;
+}
+function clearOldestSlackPendingMarkerInChannel(dir, channel, clear = defaultClearMarkerFile) {
+  if (!dir) return null;
+  const channelPrefix = `${sanitizeMarkerSegment(channel)}__`;
+  try {
+    const entries = readdirSync2(dir).filter((f) => f.startsWith(channelPrefix) && f.endsWith(".json")).map((f) => {
+      const full = join2(dir, f);
+      let mtime = 0;
+      try {
+        mtime = statSync(full).mtimeMs;
+      } catch {
+      }
+      return { name: f, full, mtime };
+    }).filter((e) => e.mtime > 0).sort((a, b) => a.mtime - b.mtime);
+    const oldest = entries[0];
+    if (!oldest) return null;
+    clear(oldest.full);
+    return oldest.name;
+  } catch {
+    return null;
+  }
+}
+
 // ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process2 from "process";
 
@@ -14663,17 +14782,17 @@ var StdioServerTransport = class {
 import {
   chmodSync,
   createWriteStream,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync4,
-  readdirSync as readdirSync2,
+  readdirSync as readdirSync3,
   renameSync as renameSync2,
-  statSync,
-  unlinkSync as unlinkSync2,
+  statSync as statSync2,
+  unlinkSync as unlinkSync3,
   watch,
   writeFileSync as writeFileSync3
 } from "fs";
-import { basename, join as join4, resolve as resolve2 } from "path";
+import { basename, join as join5, resolve as resolve2 } from "path";
 import { homedir as homedir2 } from "os";
 import { createHash, randomUUID } from "crypto";
 
@@ -14804,9 +14923,9 @@ async function runOrRetry(fn, opts) {
 
 // src/channel-attachments.ts
 import { homedir } from "os";
-import { join as join2, resolve, sep } from "path";
+import { join as join3, resolve, sep } from "path";
 function resolveChannelInboundDir(codeName, channelSlug) {
-  const base = join2(homedir(), ".augmented");
+  const base = join3(homedir(), ".augmented");
   const allowedSegment = /^[A-Za-z0-9_-]+$/;
   if (!allowedSegment.test(codeName) || !allowedSegment.test(channelSlug)) {
     throw new Error(
@@ -15450,14 +15569,14 @@ function createSlackBotUserIdClient(args) {
 
 // src/mcp-spawn-lock.ts
 import {
-  existsSync,
+  existsSync as existsSync2,
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync3,
   renameSync,
-  unlinkSync,
+  unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function defaultIsPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   try {
@@ -15475,7 +15594,7 @@ function acquireMcpSpawnLock(args) {
   const isPidAlive = options.isPidAlive ?? defaultIsPidAlive;
   const selfPid = options.selfPid ?? process.pid;
   const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const path = join3(agentDir, basename2);
+  const path = join4(agentDir, basename2);
   const existing = readLockHolder(path);
   if (existing) {
     if (existing.pid === selfPid) {
@@ -15499,12 +15618,12 @@ function releaseMcpSpawnLock(lockPath, opts = {}) {
   if (!existing) return;
   if (existing.pid !== selfPid) return;
   try {
-    unlinkSync(lockPath);
+    unlinkSync2(lockPath);
   } catch {
   }
 }
 function readLockHolder(path) {
-  if (!existsSync(path)) return null;
+  if (!existsSync2(path)) return null;
   try {
     const raw = readFileSync3(path, "utf8");
     const parsed = JSON.parse(raw);
@@ -15557,6 +15676,58 @@ var SLACK_SENDER_POLICY = (() => {
   }
   throw new Error(`Invalid SLACK_SENDER_POLICY=${JSON.stringify(process.env.SLACK_SENDER_POLICY)}`);
 })();
+var SLACK_POLICY_DECLINE_CACHE = /* @__PURE__ */ new Map();
+var SLACK_POLICY_DECLINE_COOLDOWN_MS = readDeclineCooldownMs(
+  "SLACK_SENDER_POLICY_REPLY_COOLDOWN_SEC"
+);
+async function maybeSendSenderPolicyDecline(args) {
+  if (!BOT_TOKEN) return;
+  if (!args.channel || !args.senderId) return;
+  const key2 = declineCacheKey(args.channel, args.senderId, args.subReason);
+  const decision = decideDeclineReply({
+    cache: SLACK_POLICY_DECLINE_CACHE,
+    key: key2,
+    cooldownMs: SLACK_POLICY_DECLINE_COOLDOWN_MS,
+    now: Date.now()
+  });
+  if (!decision.reply) {
+    process.stderr.write(
+      `slack-channel(${AGENT_CODE_NAME}): decline suppressed by cooldown (channel=${redactSlackId(args.channel)}, sender=${redactSlackId(args.senderId)}, reason=${args.subReason}, remaining=${decision.remainingMs}ms)
+`
+    );
+    return;
+  }
+  const text = politeDeclineCopy(args.subReason);
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const res = await fetch("https://slack.com/api/chat.postMessage", {
+      method: "POST",
+      signal: controller.signal,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${BOT_TOKEN}`
+      },
+      body: JSON.stringify({
+        channel: args.channel,
+        text,
+        // Reply in-thread if the inbound was a thread message — keeps
+        // the decline next to the message that caused it. For top-level
+        // posts (DMs / channel root) omit thread_ts and post inline.
+        ...args.threadTs ? { thread_ts: args.threadTs } : {}
+      })
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      process.stderr.write(
+        `slack-channel(${AGENT_CODE_NAME}): decline post failed: ${data.error ?? "unknown"}
+`
+      );
+    }
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
 var BLOCK_KIT_ENABLED = process.env.SLACK_BLOCK_KIT_ENABLED === "true";
 var BLOCK_KIT_ASK_USER_ENABLED = process.env.SLACK_BLOCK_KIT_ASK_USER_ENABLED === "true";
 var BLOCK_KIT_DISABLED = process.env.SLACK_BLOCK_KIT_DISABLED === "true";
@@ -15608,9 +15779,9 @@ var SLACK_PEER_CLASSIFIER_CONFIG = {
   peers: parsePeersEnv(process.env.SLACK_PEERS, process.env.SLACK_PEERS_GATE),
   peer_disabled_mode: SLACK_PEER_DISABLED_MODE
 };
-var SLACK_AGENT_DIR = AGENT_CODE_NAME ? join4(homedir2(), ".augmented", AGENT_CODE_NAME) : null;
-var SLACK_PENDING_INBOUND_DIR = SLACK_AGENT_DIR ? join4(SLACK_AGENT_DIR, "slack-pending-inbound") : null;
-var SLACK_RECOVERY_OUTBOX_DIR = SLACK_AGENT_DIR ? join4(SLACK_AGENT_DIR, "slack-recovery-outbox") : null;
+var SLACK_AGENT_DIR = AGENT_CODE_NAME ? join5(homedir2(), ".augmented", AGENT_CODE_NAME) : null;
+var SLACK_PENDING_INBOUND_DIR = SLACK_AGENT_DIR ? join5(SLACK_AGENT_DIR, "slack-pending-inbound") : null;
+var SLACK_RECOVERY_OUTBOX_DIR = SLACK_AGENT_DIR ? join5(SLACK_AGENT_DIR, "slack-recovery-outbox") : null;
 var SLACK_MAX_RECOVERY_ATTEMPTS = 3;
 function redactSlackId(id) {
   if (!id) return "<none>";
@@ -15622,7 +15793,7 @@ function safeSlackMarkerName(channel, threadTs, messageTs) {
 }
 function slackPendingInboundPath(channel, threadTs, messageTs) {
   if (!SLACK_PENDING_INBOUND_DIR) return null;
-  return join4(SLACK_PENDING_INBOUND_DIR, safeSlackMarkerName(channel, threadTs, messageTs));
+  return join5(SLACK_PENDING_INBOUND_DIR, safeSlackMarkerName(channel, threadTs, messageTs));
 }
 function writeSlackPendingInboundMarker(channel, threadTs, messageTs, undeliverable = false) {
   const path = slackPendingInboundPath(channel, threadTs, messageTs);
@@ -15678,22 +15849,32 @@ function clearSlackMarkerFileWithHeal(fullPath) {
     healSlackUndeliverable(marker.channel, marker.message_ts);
   }
   try {
-    if (existsSync2(fullPath)) unlinkSync2(fullPath);
+    if (existsSync3(fullPath)) unlinkSync3(fullPath);
   } catch {
   }
 }
-function clearAllSlackPendingMarkersForThread(channel, threadTs) {
-  if (!SLACK_PENDING_INBOUND_DIR) return;
-  const safeChan = channel.replace(/[^A-Za-z0-9_-]/g, "_");
-  const safeThread = threadTs.replace(/[^A-Za-z0-9_-]/g, "_");
-  const prefix = `${safeChan}__${safeThread}__`;
-  try {
-    for (const f of readdirSync2(SLACK_PENDING_INBOUND_DIR)) {
-      if (!f.startsWith(prefix) || !f.endsWith(".json")) continue;
-      clearSlackMarkerFileWithHeal(join4(SLACK_PENDING_INBOUND_DIR, f));
-    }
-  } catch {
-  }
+function clearAllSlackPendingMarkersForThread2(channel, threadTs) {
+  clearAllSlackPendingMarkersForThread(
+    SLACK_PENDING_INBOUND_DIR,
+    channel,
+    threadTs,
+    clearSlackMarkerFileWithHeal
+  );
+}
+function clearSlackPendingMarkerByMessageTs2(channel, messageTs) {
+  clearSlackPendingMarkerByMessageTs(
+    SLACK_PENDING_INBOUND_DIR,
+    channel,
+    messageTs,
+    clearSlackMarkerFileWithHeal
+  );
+}
+function clearOldestSlackPendingMarkerInChannel2(channel) {
+  clearOldestSlackPendingMarkerInChannel(
+    SLACK_PENDING_INBOUND_DIR,
+    channel,
+    clearSlackMarkerFileWithHeal
+  );
 }
 function slackNextRetryName(filename) {
   const match = filename.match(/^(.*?)(?:\.retry-(\d+))?\.json$/);
@@ -15709,7 +15890,7 @@ function slackNextRetryName(filename) {
 async function processSlackRecoveryOutboxFile(filename) {
   if (!SLACK_RECOVERY_OUTBOX_DIR) return;
   if (filename.endsWith(".poison.json") || filename.endsWith(".tmp")) return;
-  const fullPath = join4(SLACK_RECOVERY_OUTBOX_DIR, filename);
+  const fullPath = join5(SLACK_RECOVERY_OUTBOX_DIR, filename);
   let payload;
   try {
     payload = JSON.parse(readFileSync4(fullPath, "utf-8"));
@@ -15778,7 +15959,7 @@ async function processSlackRecoveryOutboxFile(filename) {
   }
   if (sendSucceeded) {
     try {
-      unlinkSync2(fullPath);
+      unlinkSync3(fullPath);
     } catch {
     }
     return;
@@ -15786,7 +15967,7 @@ async function processSlackRecoveryOutboxFile(filename) {
   const next = slackNextRetryName(filename);
   if (next) {
     try {
-      renameSync2(fullPath, join4(SLACK_RECOVERY_OUTBOX_DIR, next.next));
+      renameSync2(fullPath, join5(SLACK_RECOVERY_OUTBOX_DIR, next.next));
       if (next.attempt >= SLACK_MAX_RECOVERY_ATTEMPTS) {
         process.stderr.write(
           `slack-channel(${AGENT_CODE_NAME}): ghost-reply recovery exhausted retries \u2014 moved to ${next.next}
@@ -15816,7 +15997,7 @@ function scanSlackRecoveryRetries() {
   if (!SLACK_RECOVERY_OUTBOX_DIR) return;
   let entries;
   try {
-    entries = readdirSync2(SLACK_RECOVERY_OUTBOX_DIR);
+    entries = readdirSync3(SLACK_RECOVERY_OUTBOX_DIR);
   } catch {
     return;
   }
@@ -15825,7 +16006,7 @@ function scanSlackRecoveryRetries() {
     if (!f.includes(".retry-") || f.endsWith(".poison.json")) continue;
     let mtimeMs;
     try {
-      mtimeMs = statSync(join4(SLACK_RECOVERY_OUTBOX_DIR, f)).mtimeMs;
+      mtimeMs = statSync2(join5(SLACK_RECOVERY_OUTBOX_DIR, f)).mtimeMs;
     } catch {
       continue;
     }
@@ -15846,7 +16027,7 @@ function startSlackRecoveryOutboxWatcher() {
     return;
   }
   try {
-    for (const f of readdirSync2(SLACK_RECOVERY_OUTBOX_DIR)) {
+    for (const f of readdirSync3(SLACK_RECOVERY_OUTBOX_DIR)) {
       if (isFirstAttemptSlackOutboxFile(f)) void processSlackRecoveryOutboxFile(f);
     }
   } catch {
@@ -15855,7 +16036,7 @@ function startSlackRecoveryOutboxWatcher() {
     const watcher = watch(SLACK_RECOVERY_OUTBOX_DIR, (event, filename) => {
       if (event !== "rename" || !filename) return;
       if (!isFirstAttemptSlackOutboxFile(filename)) return;
-      if (existsSync2(join4(SLACK_RECOVERY_OUTBOX_DIR, filename))) {
+      if (existsSync3(join5(SLACK_RECOVERY_OUTBOX_DIR, filename))) {
         void processSlackRecoveryOutboxFile(filename);
       }
     });
@@ -15876,10 +16057,10 @@ function trackPendingMessage(channel, threadTs, messageTs, undeliverable = false
 }
 function sweepSlackStaleMarkersOnBoot() {
   if (!SLACK_PENDING_INBOUND_DIR) return;
-  if (!existsSync2(SLACK_PENDING_INBOUND_DIR)) return;
+  if (!existsSync3(SLACK_PENDING_INBOUND_DIR)) return;
   let filenames;
   try {
-    filenames = readdirSync2(SLACK_PENDING_INBOUND_DIR);
+    filenames = readdirSync3(SLACK_PENDING_INBOUND_DIR);
   } catch (err) {
     process.stderr.write(
       `slack-channel(${AGENT_CODE_NAME}): stale-marker readdir failed: ${err.message}
@@ -15892,7 +16073,7 @@ function sweepSlackStaleMarkersOnBoot() {
   for (const filename of filenames) {
     if (!filename.endsWith(".json")) continue;
     if (filename.endsWith(".tmp")) continue;
-    const fullPath = join4(SLACK_PENDING_INBOUND_DIR, filename);
+    const fullPath = join5(SLACK_PENDING_INBOUND_DIR, filename);
     let marker;
     try {
       marker = JSON.parse(readFileSync4(fullPath, "utf-8"));
@@ -15902,7 +16083,7 @@ function sweepSlackStaleMarkersOnBoot() {
 `
       );
       try {
-        unlinkSync2(fullPath);
+        unlinkSync3(fullPath);
       } catch {
       }
       cleared++;
@@ -15911,7 +16092,7 @@ function sweepSlackStaleMarkersOnBoot() {
     const { channel, thread_ts, message_ts, received_at } = marker;
     if (!channel || !thread_ts || !message_ts || !received_at) {
       try {
-        unlinkSync2(fullPath);
+        unlinkSync3(fullPath);
       } catch {
       }
       cleared++;
@@ -15920,7 +16101,7 @@ function sweepSlackStaleMarkersOnBoot() {
     const receivedAtMs = Date.parse(received_at);
     if (!Number.isFinite(receivedAtMs) || receivedAtMs > now || now - receivedAtMs > STALE_MARKER_MS) {
       try {
-        unlinkSync2(fullPath);
+        unlinkSync3(fullPath);
       } catch {
       }
       cleared++;
@@ -15935,7 +16116,7 @@ function sweepSlackStaleMarkersOnBoot() {
 }
 sweepSlackStaleMarkersOnBoot();
 function clearPendingMessage(channel, threadTs) {
-  clearAllSlackPendingMarkersForThread(channel, threadTs);
+  clearAllSlackPendingMarkersForThread2(channel, threadTs);
 }
 function noteThreadActivity(channel, threadTs) {
   if (!channel || !threadTs) return;
@@ -15945,10 +16126,10 @@ function noteThreadActivityByMessageTs(channel, messageTs) {
   if (!channel || !messageTs) return;
   clearPendingMessage(channel, messageTs);
   if (!SLACK_PENDING_INBOUND_DIR) return;
-  if (!existsSync2(SLACK_PENDING_INBOUND_DIR)) return;
+  if (!existsSync3(SLACK_PENDING_INBOUND_DIR)) return;
   let filenames;
   try {
-    filenames = readdirSync2(SLACK_PENDING_INBOUND_DIR);
+    filenames = readdirSync3(SLACK_PENDING_INBOUND_DIR);
   } catch {
     return;
   }
@@ -15959,10 +16140,10 @@ function noteThreadActivityByMessageTs(channel, messageTs) {
   for (const filename of filenames) {
     if (!filename.startsWith(channelPrefix)) continue;
     if (!filename.endsWith(messageSuffix)) continue;
-    clearSlackMarkerFileWithHeal(join4(SLACK_PENDING_INBOUND_DIR, filename));
+    clearSlackMarkerFileWithHeal(join5(SLACK_PENDING_INBOUND_DIR, filename));
   }
 }
-var RESTART_FLAGS_DIR = join4(homedir2(), ".augmented", "restart-flags");
+var RESTART_FLAGS_DIR = join5(homedir2(), ".augmented", "restart-flags");
 function buildAugmentedSlackMetadata() {
   if (!AGT_TEAM_ID) return void 0;
   return {
@@ -16141,10 +16322,10 @@ async function handleSlashCommandEnvelope(payload) {
       return;
     }
     try {
-      if (!existsSync2(RESTART_FLAGS_DIR)) {
+      if (!existsSync3(RESTART_FLAGS_DIR)) {
         mkdirSync3(RESTART_FLAGS_DIR, { recursive: true });
       }
-      const flagPath = join4(RESTART_FLAGS_DIR, `${codeName}.flag`);
+      const flagPath = join5(RESTART_FLAGS_DIR, `${codeName}.flag`);
       const flag = {
         codeName,
         source: "slack",
@@ -16248,10 +16429,10 @@ async function handleHelpCommand(opts) {
 async function handleRestartCommand(opts) {
   const codeName = AGENT_CODE_NAME ?? "unknown";
   try {
-    if (!existsSync2(RESTART_FLAGS_DIR)) {
+    if (!existsSync3(RESTART_FLAGS_DIR)) {
       mkdirSync3(RESTART_FLAGS_DIR, { recursive: true });
     }
-    const flagPath = join4(RESTART_FLAGS_DIR, `${codeName}.flag`);
+    const flagPath = join5(RESTART_FLAGS_DIR, `${codeName}.flag`);
     const flag = {
       codeName,
       source: "slack",
@@ -16310,7 +16491,7 @@ var THREAD_STORE_TTL_DAYS = parseTtlDays(process.env.SLACK_THREAD_FOLLOW_TTL_DAY
 var threadPersister = null;
 function resolveThreadStorePath() {
   if (!AGENT_CODE_NAME) return null;
-  return join4(homedir2(), ".augmented", AGENT_CODE_NAME, "slack-tracked-threads.json");
+  return join5(homedir2(), ".augmented", AGENT_CODE_NAME, "slack-tracked-threads.json");
 }
 function parseTtlDays(raw) {
   if (!raw) return void 0;
@@ -16345,9 +16526,9 @@ if (!BOT_TOKEN || !APP_TOKEN) {
 var slackStderrLogStream = null;
 if (AGENT_CODE_NAME) {
   try {
-    const logDir = join4(homedir2(), ".augmented", AGENT_CODE_NAME);
+    const logDir = join5(homedir2(), ".augmented", AGENT_CODE_NAME);
     mkdirSync3(logDir, { recursive: true });
-    slackStderrLogStream = createWriteStream(join4(logDir, "slack-channel-stderr.log"), {
+    slackStderrLogStream = createWriteStream(join5(logDir, "slack-channel-stderr.log"), {
       flags: "a",
       mode: 384
     });
@@ -16431,7 +16612,7 @@ var mcp = new Server(
       // Highest-priority lines first — Claude Code truncates this string at
       // 2048 chars, so anything appended late silently disappears.
       "CRITICAL: every response to a Slack <channel> tag MUST go through slack.reply. Text in your session WITHOUT a slack.reply call never reaches the user \u2014 the message dies inside the agent process.",
-      `Inbound: <channel ... thread_ts="..." [thread_context="..."]>. Pass channel + thread_ts to slack.reply on threads. thread_context = thread pre-loaded; ground replies ONLY in it, never another channel's.`,
+      `Inbound: <channel ... thread_ts="..." message_ts="..." [thread_context="..."]>. Pass channel + message_ts to slack.reply (and thread_ts on threads). thread_context = thread pre-loaded; ground replies ONLY in it, never another channel's.`,
       "Inbound attachments: <channel> `files` is a JSON-serialised array \u2014 JSON.parse it. If an entry has `path`, the image is already downloaded \u2014 Read it directly, do NOT call slack.download_attachment. Use that tool only for entries with `file_id` but NO `path` (PDF, docx, csv): pass file_id + channel verbatim, then Read the returned path. Single-image messages also get a top-level `image_path`. Don't surface internal file-handling errors that don't affect the answer.",
       "Address users by user_name, never by raw user ID. In multi-participant threads the CURRENT speaker is the one on the latest <channel> tag.",
       'Mentioned in a channel \u2192 respond in that thread. DM \u2192 respond directly. auto_followed="true" \u2192 only reply if useful, OR if your own bot user is @-mentioned (counts even in auto_followed).',
@@ -16456,7 +16637,18 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
           text: { type: "string", description: "The message to send" },
           thread_ts: {
             type: "string",
-            description: "Thread timestamp for threaded replies (from the thread_ts attribute)"
+            description: "Thread timestamp for threaded replies (from the thread_ts attribute). Omit for a top-level reply (e.g. a fresh DM)."
+          },
+          // ENG-5861: explicit message_ts so the cleanup gate can match the
+          // exact pending-inbound marker — necessary because top-level DM
+          // replies legitimately have no thread_ts and the marker filename
+          // is `<channel>__<thread_ts>__<message_ts>.json`. Without this
+          // the marker sat undrained, eventually tripping ENG-5832\'s
+          // "wedged" threshold and firing a false-positive red ✗ on the
+          // next inbound.
+          message_ts: {
+            type: "string",
+            description: "The message_ts of the specific inbound this reply addresses (from the message_ts attribute on the <channel> tag). Used by the pending-inbound cleanup gate so the marker is reliably cleared even for top-level DMs that have no thread_ts."
           }
         },
         required: ["channel", "text"]
@@ -16694,7 +16886,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
     return buildImpersonationRefusal(name);
   }
   if (name === "slack.reply") {
-    const { channel, text, thread_ts } = args;
+    const { channel, text, thread_ts, message_ts } = args;
     if (channel && thread_ts) {
       const killed = await isThreadKilled({
         channelType: "slack",
@@ -16753,8 +16945,15 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
         isError: true
       };
     }
-    if (channel && thread_ts) {
-      clearPendingMessage(channel, thread_ts);
+    if (channel) {
+      if (message_ts) {
+        clearSlackPendingMarkerByMessageTs2(channel, message_ts);
+        if (thread_ts) clearPendingMessage(channel, thread_ts);
+      } else if (thread_ts) {
+        clearPendingMessage(channel, thread_ts);
+      } else {
+        clearOldestSlackPendingMarkerInChannel2(channel);
+      }
     }
     try {
       const res = await fetch("https://slack.com/api/chat.postMessage", {
@@ -16906,7 +17105,7 @@ ${result.formatted}` : "Thread is empty or not found."
     let bytes;
     let size;
     try {
-      const stat = statSync(resolvedPath);
+      const stat = statSync2(resolvedPath);
       if (!stat.isFile()) {
         return {
           content: [{ type: "text", text: `Upload refused: ${resolvedPath} is not a regular file.` }],
@@ -17807,8 +18006,27 @@ async function connectSocketMode() {
       }
       const senderPolicyDecision = decideSenderPolicyForward(evt, SLACK_SENDER_POLICY);
       if (!senderPolicyDecision.forward) {
-        process.stderr.write(`slack-channel: dropped message event (reason=sender_policy, mode=${SLACK_SENDER_POLICY.mode}, ts=${evt.ts ?? "n/a"})
+        const subReason = classifySlackPolicyBlock(evt, SLACK_SENDER_POLICY);
+        process.stderr.write(`slack-channel: dropped message event (reason=sender_policy, sub=${subReason}, mode=${SLACK_SENDER_POLICY.mode}, ts=${evt.ts ?? "n/a"})
 `);
+        await maybeSendSenderPolicyDecline({
+          channel: evt.channel,
+          senderId: evt.user,
+          // CR on PR #1623: top-level posts (DMs, channel root messages)
+          // arrive with no `thread_ts` and MUST decline inline, not in a
+          // new thread off the inbound message. The `?? evt.ts` fallback
+          // forced every root message into a thread reply — exactly the
+          // case the helper's "omit thread_ts when undefined" branch was
+          // meant to handle. Pass through as-is: in-thread for thread
+          // replies (thread_ts present), inline for everything else.
+          threadTs: evt.thread_ts,
+          subReason
+        }).catch((err) => {
+          process.stderr.write(
+            `slack-channel(${AGENT_CODE_NAME}): decline reply failed: ${err.message}
+`
+          );
+        });
         return;
       }
       recordActivity("inbound");
@@ -17935,13 +18153,22 @@ async function connectSocketMode() {
         botUserId
       });
       const ackProbe = process.env.TMUX && AGENT_CODE_NAME ? probeAgentSessionCached(AGENT_CODE_NAME) : { tmux: "unknown", claude: "unknown" };
+      let paneLogFreshAgeMs = null;
+      if (SLACK_AGENT_DIR) {
+        try {
+          const paneMtimeMs = statSync2(join5(SLACK_AGENT_DIR, "pane.log")).mtimeMs;
+          paneLogFreshAgeMs = Math.max(0, Date.now() - paneMtimeMs);
+        } catch {
+        }
+      }
       const ackDecision = decideAckReaction({
         hasTarget: decideSlackAckReaction({ channel, ts }),
         integrationReady: Boolean(BOT_TOKEN),
         tmux: ackProbe.tmux,
         claude: ackProbe.claude,
         withinStartupGrace: process.uptime() * 1e3 < ACK_STARTUP_GRACE_MS,
-        oldestPendingAgeMs: oldestPendingMarkerAgeMs(SLACK_PENDING_INBOUND_DIR)
+        oldestPendingAgeMs: oldestPendingMarkerAgeMs(SLACK_PENDING_INBOUND_DIR),
+        paneLogFreshAgeMs
       });
       if (ackDecision !== "none") {
         const reactionName = ackDecision === "undeliverable" ? "x" : "eyes";
@@ -17996,6 +18223,13 @@ async function connectSocketMode() {
             user_name: userName,
             channel,
             thread_ts: threadTs,
+            // ENG-5861: explicit message_ts so the agent can pass it back
+            // to slack.reply for reliable pending-inbound cleanup. For
+            // top-level messages threadTs === ts; for threaded replies
+            // threadTs is the thread root and message_ts is the specific
+            // reply being addressed — different keys, both needed by the
+            // marker-cleanup gate.
+            message_ts: ts,
             event_type: evt.type,
             ...isAutoFollowed ? { auto_followed: "true" } : {},
             // Only set these when we actually have attachments to avoid

package/dist/mcp/telegram-channel.js

@@ -15506,6 +15506,7 @@ import { readdirSync, readFileSync as readFileSync2 } from "fs";
 import { join as join3 } from "path";
 var REPLY_WEDGED_THRESHOLD_MS = 5 * 60 * 1e3;
 var ACK_STARTUP_GRACE_MS = 6e4;
+var ACK_PANE_FRESH_THRESHOLD_MS = 6e4;
 function decideAckReaction(i) {
   if (!i.hasTarget) return "none";
   if (!i.integrationReady) return "undeliverable";
@@ -15513,6 +15514,11 @@ function decideAckReaction(i) {
   if (!i.withinStartupGrace && i.claude === "dead") return "undeliverable";
   const threshold = i.pendingStaleThresholdMs ?? REPLY_WEDGED_THRESHOLD_MS;
   if (i.oldestPendingAgeMs != null && i.oldestPendingAgeMs > threshold) {
+    const paneFreshThreshold = i.paneFreshThresholdMs ?? ACK_PANE_FRESH_THRESHOLD_MS;
+    const paneIsFresh = i.paneLogFreshAgeMs != null && i.paneLogFreshAgeMs <= paneFreshThreshold;
+    if (paneIsFresh && i.tmux === "alive" && i.claude === "alive") {
+      return "ack";
+    }
     return "undeliverable";
   }
   return "ack";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.27.25",
+  "version": "0.27.27",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {