@integrity-labs/agt-cli 0.27.30 → 0.27.32

package/dist/{chunk-2L2CHPOJ.js → chunk-J5BIXLKB.js}

@@ -9,7 +9,7 @@ import {
   parseDeliveryTarget,
   registerFramework,
   wrapScheduledTaskPrompt
-} from "./chunk-6HFXSNNY.js";
+} from "./chunk-NZWPRYJO.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -4872,9 +4872,11 @@ ${sections}`
   writeChannelCredentials(codeName, channelId, config, options) {
     const tzEnv = options?.agentTimezone && options.agentTimezone.trim() !== "" ? { TZ: options.agentTimezone.trim() } : {};
     const senderPolicyMode = options?.senderPolicy?.mode;
-    const senderPolicyTeamId = options?.senderPolicy?.mode === "team_agents_only" || options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.team_id : void 0;
+    const senderPolicyTeamId = options?.senderPolicy?.mode === "team_agents_only" || options?.senderPolicy?.mode === "manager_only" || options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_id : void 0;
     const slackPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.slack_user_id : void 0;
     const teamsPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.teams_aad_object_id : void 0;
+    const slackTeamPrincipalIds = options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_principals?.slack_user_ids?.join(",") : void 0;
+    const teamsTeamPrincipalIds = options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_principals?.teams_aad_object_ids?.join(",") : void 0;
     const senderPolicyInternalOnly = options?.senderPolicy?.internal_only === true;
     const senderPolicyEnv = senderPolicyTeamId ? { AGT_TEAM_ID: senderPolicyTeamId } : {};
     const agentDir = getAgentDir(codeName);
@@ -5041,6 +5043,12 @@ ${sections}`
               // principal has no Slack ID; MCP filter fails closed on the
               // missing env var by dropping all human inbound.
               ...slackPrincipalId ? { SLACK_SENDER_POLICY_PRINCIPAL_ID: slackPrincipalId } : {},
+              // ENG-5871: team_only mode injects a comma-separated list of
+              // team-member Slack user_ids. Absent/empty = MCP filter drops
+              // humans on Slack but still admits same-team agents via label.
+              // No additional shape parsing on the MCP side — `.split(',')`
+              // works because Slack user_ids are `[A-Z0-9]+` (no commas).
+              ...slackTeamPrincipalIds ? { SLACK_SENDER_POLICY_TEAM_PRINCIPAL_IDS: slackTeamPrincipalIds } : {},
               // ENG-5843: org-boundary gate. SLACK_INTERNAL_ONLY signals the
               // filter to check sender's workspace against SLACK_HOME_TEAM_ID
               // (sourced from the bot install's team_id, populated by
@@ -5237,6 +5245,10 @@ ${sections}`
         // people.contact_preferences.teams_aad_object_id. Same fail-closed
         // contract as the Slack branch above.
         ...teamsPrincipalId ? { MSTEAMS_SENDER_POLICY_PRINCIPAL_ID: teamsPrincipalId } : {},
+        // ENG-5871: team_only mode injects a comma-separated list of team-
+        // member Teams AAD object IDs. Same fail-closed contract as Slack.
+        // AAD IDs are UUIDs (no commas), so .split(',') is safe.
+        ...teamsTeamPrincipalIds ? { MSTEAMS_SENDER_POLICY_TEAM_PRINCIPAL_IDS: teamsTeamPrincipalIds } : {},
         // ENG-5843: org-boundary gate. MSTEAMS_INTERNAL_ONLY + MSTEAMS_HOME_TENANT_ID
         // mirror the Slack pair. Source is the same tenantId the existing
         // MSTEAMS_TENANT_ID env var already carries — defaulting to "common"
@@ -6965,4 +6977,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-2L2CHPOJ.js.map
+//# sourceMappingURL=chunk-J5BIXLKB.js.map