@integrity-labs/agt-cli 0.27.31 → 0.27.33

package/dist/assets/impersonate-statusline.sh

@@ -57,10 +57,15 @@ PY
       fi
     fi
 
+    # Pin an explicit bright-white foreground (97) alongside the coloured
+    # background. Without it the badge text falls back to the terminal's
+    # default foreground, which is a dark colour on many themes and renders
+    # near-illegibly on the magenta/red background (ENG-5818 follow-up —
+    # dark-on-magenta reported on Scout's impersonation badge).
     if [ "$expired" = "1" ]; then
-      printf "\033[1;41m 🤖 %s EXPIRED \033[0m " "$display_name"
+      printf "\033[1;97;41m 🤖 %s EXPIRED \033[0m " "$display_name"
     else
-      printf "\033[1;45m 🤖 %s \033[0m " "$display_name"
+      printf "\033[1;97;45m 🤖 %s \033[0m " "$display_name"
     fi
 
     # Also rename the terminal tab to the agent name so operators with

package/dist/bin/agt.js

@@ -27,7 +27,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-E6MGOZTL.js";
+} from "../chunk-IQP6CNDB.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -53,7 +53,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-6HFXSNNY.js";
+} from "../chunk-NZWPRYJO.js";
 
 // src/bin/agt.ts
 import { join as join15 } from "path";
@@ -4658,7 +4658,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.31" : "dev";
+var cliVersion = true ? "0.27.33" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5190,7 +5190,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.31" : "dev";
+var cliVersion2 = true ? "0.27.33" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", (thisCommand) => {

package/dist/{chunk-E6MGOZTL.js → chunk-IQP6CNDB.js}

@@ -9,7 +9,7 @@ import {
   parseDeliveryTarget,
   registerFramework,
   wrapScheduledTaskPrompt
-} from "./chunk-6HFXSNNY.js";
+} from "./chunk-NZWPRYJO.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -4872,9 +4872,11 @@ ${sections}`
   writeChannelCredentials(codeName, channelId, config, options) {
     const tzEnv = options?.agentTimezone && options.agentTimezone.trim() !== "" ? { TZ: options.agentTimezone.trim() } : {};
     const senderPolicyMode = options?.senderPolicy?.mode;
-    const senderPolicyTeamId = options?.senderPolicy?.mode === "team_agents_only" || options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.team_id : void 0;
+    const senderPolicyTeamId = options?.senderPolicy?.mode === "team_agents_only" || options?.senderPolicy?.mode === "manager_only" || options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_id : void 0;
     const slackPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.slack_user_id : void 0;
     const teamsPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.teams_aad_object_id : void 0;
+    const slackTeamPrincipalIds = options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_principals?.slack_user_ids?.join(",") : void 0;
+    const teamsTeamPrincipalIds = options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_principals?.teams_aad_object_ids?.join(",") : void 0;
     const senderPolicyInternalOnly = options?.senderPolicy?.internal_only === true;
     const senderPolicyEnv = senderPolicyTeamId ? { AGT_TEAM_ID: senderPolicyTeamId } : {};
     const agentDir = getAgentDir(codeName);
@@ -5041,6 +5043,12 @@ ${sections}`
               // principal has no Slack ID; MCP filter fails closed on the
               // missing env var by dropping all human inbound.
               ...slackPrincipalId ? { SLACK_SENDER_POLICY_PRINCIPAL_ID: slackPrincipalId } : {},
+              // ENG-5871: team_only mode injects a comma-separated list of
+              // team-member Slack user_ids. Absent/empty = MCP filter drops
+              // humans on Slack but still admits same-team agents via label.
+              // No additional shape parsing on the MCP side — `.split(',')`
+              // works because Slack user_ids are `[A-Z0-9]+` (no commas).
+              ...slackTeamPrincipalIds ? { SLACK_SENDER_POLICY_TEAM_PRINCIPAL_IDS: slackTeamPrincipalIds } : {},
               // ENG-5843: org-boundary gate. SLACK_INTERNAL_ONLY signals the
               // filter to check sender's workspace against SLACK_HOME_TEAM_ID
               // (sourced from the bot install's team_id, populated by
@@ -5237,6 +5245,10 @@ ${sections}`
         // people.contact_preferences.teams_aad_object_id. Same fail-closed
         // contract as the Slack branch above.
         ...teamsPrincipalId ? { MSTEAMS_SENDER_POLICY_PRINCIPAL_ID: teamsPrincipalId } : {},
+        // ENG-5871: team_only mode injects a comma-separated list of team-
+        // member Teams AAD object IDs. Same fail-closed contract as Slack.
+        // AAD IDs are UUIDs (no commas), so .split(',') is safe.
+        ...teamsTeamPrincipalIds ? { MSTEAMS_SENDER_POLICY_TEAM_PRINCIPAL_IDS: teamsTeamPrincipalIds } : {},
         // ENG-5843: org-boundary gate. MSTEAMS_INTERNAL_ONLY + MSTEAMS_HOME_TENANT_ID
         // mirror the Slack pair. Source is the same tenantId the existing
         // MSTEAMS_TENANT_ID env var already carries — defaulting to "common"
@@ -6965,4 +6977,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-E6MGOZTL.js.map
+//# sourceMappingURL=chunk-IQP6CNDB.js.map