@integrity-labs/agt-cli 0.27.7-test.6 → 0.27.8-test.10

package/dist/{chunk-AACMX6LE.js → chunk-2E5OABKX.js}

@@ -9,7 +9,7 @@ import {
   parseDeliveryTarget,
   registerFramework,
   wrapScheduledTaskPrompt
-} from "./chunk-YSBGIXJG.js";
+} from "./chunk-6HFXSNNY.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -174,7 +174,15 @@ var INTEGRATION_REGISTRY = [
       { id: "qmd:search", name: "Search Memory", description: "Semantic + keyword search over indexed memory files", access: "read" },
       { id: "qmd:get", name: "Get Memory", description: "Read memory files by path and line range", access: "read" }
     ],
-    beta: true
+    beta: true,
+    // ENG-5815: migrated from buildMcpJson's hardcoded if-block. qmd is
+    // the simplest of the four pre-data-driven entries — no env, no
+    // conditional logic, just `qmd mcp`. The byte-identical render is
+    // pinned by claudecode-qmd-data-driven.test.ts.
+    nativeMcp: {
+      command: "qmd",
+      args: ["mcp"]
+    }
   },
   {
     id: "v0",
@@ -310,6 +318,35 @@ var INTEGRATION_REGISTRY = [
     },
     docs_url: "https://www.coderabbit.ai/cli"
   },
+  {
+    id: "aws",
+    name: "AWS",
+    category: "infrastructure",
+    description: "Amazon Web Services \u2014 query AWS APIs (EC2, S3, IAM, Lambda, etc.) via AWS Labs' official AWS API MCP server",
+    supported_auth_types: ["api_key", "managed", "none"],
+    capabilities: [
+      { id: "aws:read", name: "Read AWS Resources", description: "List and describe AWS resources across services (EC2, S3, IAM, Lambda, \u2026)", access: "read" },
+      { id: "aws:write", name: "Write AWS Resources", description: "Create and update AWS resources. Pair with an aws-no-destructive-ops guardrail.", access: "write" }
+    ],
+    docs_url: "https://github.com/awslabs/mcp/tree/main/src/aws-api-mcp-server",
+    beta: true,
+    // ENG-5815: first integration shipped purely via the data-driven
+    // path — buildMcpJson never grew an `aws` if-block. The AWS Labs
+    // AWS API MCP server runs through uvx (Python tooling), which the
+    // host bootstrap installs alongside python3. Credentials are
+    // resolved via the standard AWS_* env / shared credentials file
+    // chain on the host; the spec doesn't override them.
+    nativeMcp: {
+      command: "uvx",
+      args: ["awslabs.aws-api-mcp-server@latest"],
+      env: {
+        AWS_REGION: "{{empty_if_no_env.AWS_REGION}}",
+        AWS_PROFILE: "{{empty_if_no_env.AWS_PROFILE}}",
+        PATH: "{{process_env.PATH}}",
+        HOME: "{{process_env.HOME}}"
+      }
+    }
+  },
   {
     id: "custom",
     name: "Custom Integration",
@@ -2644,42 +2681,6 @@ If your charter doesn't authorise team-scope skill writes
 refused server-side \u2014 surface that error to the user rather than
 falling back to a local-disk write.
 
-`;
-}
-function buildProgressHeartbeatSection(resolvedChannels) {
-  const hasSlack = !!resolvedChannels?.includes("slack");
-  const hasDirectChat = !!resolvedChannels?.includes("direct-chat");
-  if (!hasSlack && !hasDirectChat)
-    return "";
-  const bullets = [];
-  if (hasSlack) {
-    bullets.push("- **Slack threads:** `slack_progress_start` (channel + thread_ts from the inbound `<channel>` tag, label = short task name) \u2192 `slack_progress_update` between steps (pass `step_label`, optional `step_current`/`step_total`) \u2192 `slack_progress_complete` (summary) or `slack_progress_fail` (one-sentence reason).");
-  }
-  if (hasDirectChat) {
-    bullets.push("- **Direct Chat sessions:** `direct_chat_progress_start` (session_id from the inbound tag, label) \u2192 `direct_chat_progress_update` \u2192 `direct_chat_progress_complete` / `_fail`.");
-  }
-  return `
-## Progress heartbeats during multi-step work
-
-When a task involves **\u22653 tool calls or is likely to take >5 seconds**
-of tool work, open an in-place progress anchor instead of streaming
-"working on\u2026" / "still working\u2026" / "done" messages. The operator sees
-one message that ticks forward as you advance, not a thread flooded
-with status pings.
-
-${bullets.join("\n")}
-
-The state machine debounces updates to roughly one API call per second
-per channel, so it's safe to call \`_update\` after every step rather
-than batching. Always end with \`_complete\` or \`_fail\` \u2014 leaving an
-anchor in the "working" state means a future stale-state sweep flips it
-to \u26A0\uFE0F "agent unresponsive" once the heartbeat goes cold.
-
-**Skip the heartbeat for one-shot replies.** A single \`slack.reply\` /
-\`direct_chat.reply\` is still the right pattern when there's no
-multi-step work to surface. Heartbeats are for the case where you'd
-otherwise emit several intermediate messages.
-
 `;
 }
 function buildPersonalitySection(seed) {
@@ -2900,6 +2901,37 @@ function formatConfigLines(config) {
     return `  - ${k}: ${rendered}`;
   });
 }
+var EMAIL_DOMAIN_RESTRICT_DEF = "email.domain_restrict";
+function stringList(value) {
+  return Array.isArray(value) ? value.filter((d) => typeof d === "string") : [];
+}
+function formatEmailDomainConfigLines(config) {
+  const mode = typeof config.mode === "string" ? config.mode : void 0;
+  const lines = [];
+  if (mode)
+    lines.push(`  - mode: ${mode}`);
+  if (mode === "allowlist") {
+    const allowed = stringList(config.allowed_domains);
+    lines.push(`  - allowed_domains: ${allowed.length ? allowed.join(", ") : "(none \u2014 no external email permitted)"}`);
+  } else if (mode === "blocklist") {
+    const blocked = stringList(config.blocked_domains);
+    lines.push(`  - blocked_domains: ${blocked.length ? blocked.join(", ") : "(none)"}`);
+  } else if (mode === "internal_only") {
+    lines.push(`  - only your organization's own email domain is permitted`);
+  }
+  lines.push(`  *Advisory: honor this restriction \u2014 it is guidance in your instructions, not a hard block at send time.*`);
+  return lines;
+}
+var CALENDAR_CONFIDENTIALITY_DEF = "calendar.confidentiality";
+function formatCalendarConfidentialityLines(config) {
+  const stage = typeof config.stage === "string" ? config.stage : "shadow";
+  const lines = [`  - stage: ${stage}`];
+  lines.push(`  *Cross-turn re-query: when answering a different person about your principal's calendar, ALWAYS re-query the calendar tool \u2014 never reuse meeting details remembered from an earlier turn that involved a different recipient. The tool's response is filtered per-recipient at the API layer; relying on memory bypasses the filter.*`);
+  if (stage !== "enforce") {
+    lines.push(`  *Currently observe-only \u2014 the API records redaction decisions to guardrail_audit_log but returns calendar responses unchanged. Treat the policy as authoritative anyway; the runtime flip is operator-side.*`);
+  }
+  return lines;
+}
 function renderGuardrailBullet(g) {
   const lines = [];
   const header = `- **${g.displayName}** (${g.category}, from ${g.source})`;
@@ -2907,16 +2939,26 @@ function renderGuardrailBullet(g) {
   if (g.description?.trim()) {
     lines.push(`  ${g.description.trim()}`);
   }
-  lines.push(...formatConfigLines(g.config));
+  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : g.definitionId === CALENDAR_CONFIDENTIALITY_DEF ? formatCalendarConfidentialityLines(g.config) : formatConfigLines(g.config));
   if (g.overrideApplied && g.overrideReason?.trim()) {
     lines.push(`  *Override applied: ${g.overrideReason.trim()}*`);
   }
   return lines.join("\n");
 }
+function effectiveCalendarEnforcement(g) {
+  if (g.definitionId !== CALENDAR_CONFIDENTIALITY_DEF)
+    return g.enforcement;
+  const stage = typeof g.config?.["stage"] === "string" ? g.config["stage"] : "shadow";
+  if (stage === "enforce")
+    return "enforce";
+  if (stage === "warn" && g.enforcement !== "enforce")
+    return "warn";
+  return g.enforcement;
+}
 function buildGuardrailsSection(guardrails) {
   if (!guardrails || guardrails.length === 0)
     return "";
-  const active = guardrails.filter((g) => g.enforcement !== "disabled");
+  const active = guardrails.map((g) => ({ ...g, enforcement: effectiveCalendarEnforcement(g) })).filter((g) => g.enforcement !== "disabled");
   if (active.length === 0)
     return "";
   const enforce = active.filter((g) => g.enforcement === "enforce");
@@ -3019,7 +3061,7 @@ inline replies \u2014 they do NOT replace this dispatch decision.
 If the work turns out to be unexpectedly slow after you started inline,
 finish the current sub-step, then dispatch the rest. Don't apologise for
 mid-task switching \u2014 operators care about responsiveness, not consistency.
-${buildProgressHeartbeatSection(resolvedChannels)}
+
 ${activeTasksSection}${personalitySection}## Identity
 
 - Code Name: ${frontmatter.code_name}
@@ -3028,6 +3070,21 @@ ${activeTasksSection}${personalitySection}## Identity
 - Risk Tier: ${frontmatter.risk_tier}
 - Timezone: ${timezone?.trim() || "UTC"}
 - Channels: ${channelList}
+
+> **What the Channels list above means** (ENG-5851): \`Channels:\`
+> enumerates the messaging **protocols** you may use \u2014 \`slack\`,
+> \`telegram\`, \`msteams\`, etc. It is **not** a list of specific
+> Slack channels / Telegram chats / Teams threads you're approved to
+> post in. There is no per-recipient "approved channels" allowlist
+> anywhere in this platform; you decide where to post based on the
+> task and the conversation context. If you call a send tool and the
+> target channel rejects it (e.g. Slack returns \`not_in_channel\` /
+> \`channel_not_found\`, or Teams returns \`team_not_allowed\`), surface
+> the error to the user with the recovery action \u2014 typically asking
+> them to run \`/invite @<your bot handle>\` in the channel so you can
+> post there next time. Do **not** refuse a posting request on the
+> grounds that the channel "isn't on the allowlist" \u2014 that conflation
+> is the bug ENG-5851 was filed to fix.
 ${resolvedChannels?.includes("slack") ? `
 ## Slack
 
@@ -3494,6 +3551,66 @@ function buildRemoteMcpEntry(definitionId) {
   };
 }
 
+// ../../packages/core/dist/provisioning/native-mcp.js
+function buildNativeMcpEntry(spec, ctx) {
+  const resolvedCommand = resolveTemplate(spec.command, ctx);
+  if (resolvedCommand.omit) {
+    throw new Error("NativeMcpSpec: empty_if_no_env is only valid in env values (not in `command`)");
+  }
+  const command = resolvedCommand.value;
+  const args = spec.args.map((a, i) => {
+    const resolved = resolveTemplate(a, ctx);
+    if (resolved.omit) {
+      throw new Error(`NativeMcpSpec: empty_if_no_env is only valid in env values (not in args[${i}])`);
+    }
+    return resolved.value;
+  });
+  if (spec.env === void 0) {
+    return { command, args };
+  }
+  const env = {};
+  for (const [k, raw] of Object.entries(spec.env)) {
+    const { value, omit } = resolveTemplate(raw, ctx);
+    if (omit)
+      continue;
+    env[k] = value;
+  }
+  return { command, args, env };
+}
+function resolveTemplate(input, ctx) {
+  const TOKEN = /\{\{([^}]+)\}\}/g;
+  const hasEmptyIfNoEnv = /\{\{\s*empty_if_no_env\./.test(input);
+  const isWholeValueEmptyIfNoEnv = /^\{\{\s*empty_if_no_env\.[^}]+\}\}$/.test(input);
+  if (hasEmptyIfNoEnv && !isWholeValueEmptyIfNoEnv) {
+    throw new Error(`NativeMcpSpec: empty_if_no_env must be the sole content of the value, never mixed with literal text or other tokens (value: ${JSON.stringify(input)})`);
+  }
+  let omit = false;
+  const value = input.replace(TOKEN, (whole, expr) => {
+    const trimmed = expr.trim();
+    if (trimmed === "agent_id")
+      return ctx.agentId;
+    if (trimmed === "agent_code_name")
+      return ctx.agentCodeName;
+    if (trimmed === "integration_id")
+      return ctx.integration?.id ?? "";
+    if (trimmed.startsWith("process_env.")) {
+      const name = trimmed.slice("process_env.".length);
+      return process.env[name] ?? "";
+    }
+    if (trimmed.startsWith("empty_if_no_env.")) {
+      const name = trimmed.slice("empty_if_no_env.".length);
+      const v = process.env[name] ?? "";
+      if (v.length === 0) {
+        omit = true;
+        return "";
+      }
+      return v;
+    }
+    return whole;
+  });
+  return { value, omit };
+}
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
 var VALID_CODE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var SECRET_FILE_MODE = 384;
@@ -4353,7 +4470,7 @@ The parent passes you in the task description:
 Your job:
 
 1. Do the work the message asks for (Xero pull, research, multi-step skill, etc.). Use whichever tools you need.
-2. Post the reply yourself via the matching channel tool \u2014 slack.reply for Slack, telegram.reply for Telegram, teams.reply for Microsoft Teams, directchat.reply for Direct Chat. Use the metadata the parent gave you to address the right thread/conversation.
+2. Post the reply yourself via the matching channel tool \u2014 slack.reply for Slack, telegram.reply for Telegram, teams.reply for Microsoft Teams, direct_chat.reply for Direct Chat. Use the metadata the parent gave you to address the right thread/conversation.
 3. End. Do not do additional follow-up work; if more is needed, the user will send another message.
 
 Do NOT post intermediate progress updates unless the work spans 5+ minutes \u2014 keep noise low. The parent already sent a single-line acknowledgement before dispatching you.
@@ -4405,12 +4522,16 @@ function buildMcpJson(input) {
       HOME: process.env["HOME"] ?? ""
     }
   };
-  const hasQmd = input.integrations?.some((i) => i.definition_id === "qmd");
-  if (hasQmd) {
-    mcpServers["qmd"] = {
-      command: "qmd",
-      args: ["mcp"]
-    };
+  for (const integration of input.integrations ?? []) {
+    const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+    if (!def?.nativeMcp)
+      continue;
+    const key = def.nativeMcp.key ?? integration.definition_id;
+    mcpServers[key] = buildNativeMcpEntry(def.nativeMcp, {
+      agentId: input.agent.agent_id,
+      agentCodeName: input.agent.code_name,
+      integration
+    });
   }
   const xeroIntegration = input.integrations?.find((i) => i.definition_id === "xero");
   if (xeroIntegration) {
@@ -4750,6 +4871,12 @@ ${sections}`
   },
   writeChannelCredentials(codeName, channelId, config, options) {
     const tzEnv = options?.agentTimezone && options.agentTimezone.trim() !== "" ? { TZ: options.agentTimezone.trim() } : {};
+    const senderPolicyMode = options?.senderPolicy?.mode;
+    const senderPolicyTeamId = options?.senderPolicy?.mode === "team_agents_only" || options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.team_id : void 0;
+    const slackPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.slack_user_id : void 0;
+    const teamsPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.teams_aad_object_id : void 0;
+    const senderPolicyInternalOnly = options?.senderPolicy?.internal_only === true;
+    const senderPolicyEnv = senderPolicyTeamId ? { AGT_TEAM_ID: senderPolicyTeamId } : {};
     const agentDir = getAgentDir(codeName);
     mkdirSync4(agentDir, { recursive: true });
     const isPersistent = options?.sessionMode === "persistent";
@@ -4901,7 +5028,30 @@ ${sections}`
               // (ENG-4936) honours PEER_DISABLED with identical
               // semantics. Only emit when non-default so the env block
               // stays clean for the common case.
-              ...peerDisabledMode !== "off" ? { PEER_DISABLED: peerDisabledMode } : {}
+              ...peerDisabledMode !== "off" ? { PEER_DISABLED: peerDisabledMode } : {},
+              // ENG-5841: SLACK_SENDER_POLICY drives slack-inbound-filter.ts.
+              // Only emitted when the effective mode is restrictive (default
+              // 'all' is the absence of the env var — same convention the
+              // MCP filter uses on its own end).
+              ...senderPolicyMode ? { SLACK_SENDER_POLICY: senderPolicyMode } : {},
+              ...senderPolicyEnv,
+              // AGT_TEAM_ID when team_agents_only
+              // ENG-5842: principal ID for manager_only — Slack user_id from
+              // people.contact_preferences.slack_user_id. Omitted when the
+              // principal has no Slack ID; MCP filter fails closed on the
+              // missing env var by dropping all human inbound.
+              ...slackPrincipalId ? { SLACK_SENDER_POLICY_PRINCIPAL_ID: slackPrincipalId } : {},
+              // ENG-5843: org-boundary gate. SLACK_INTERNAL_ONLY signals the
+              // filter to check sender's workspace against SLACK_HOME_TEAM_ID
+              // (sourced from the bot install's team_id, populated by
+              // auth.test at install / first-run). Omitted unless explicitly
+              // enabled — the consumer's env-absent default is "no gate".
+              // When INTERNAL_ONLY is true but home team_id can't be
+              // resolved (config['team_id'] not set on the install), the
+              // MCP boot guard fails closed at startup rather than admitting
+              // every sender as "internal".
+              ...senderPolicyInternalOnly ? { SLACK_INTERNAL_ONLY: "true" } : {},
+              ...senderPolicyInternalOnly && typeof config["team_id"] === "string" && config["team_id"].length > 0 ? { SLACK_HOME_TEAM_ID: config["team_id"] } : {}
             }
           };
           const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
@@ -5077,7 +5227,24 @@ ${sections}`
         ...peerTeamIds.length > 0 ? { MSTEAMS_PEER_TEAM_IDS: peerTeamIds.join(",") } : {},
         ...knownPeerBotIds.length > 0 ? { MSTEAMS_KNOWN_PEER_BOT_IDS: knownPeerBotIds.join(",") } : {},
         ...msteamsAgtAuthEnv,
-        ...tzEnv
+        ...tzEnv,
+        // ENG-5841: MSTEAMS_SENDER_POLICY drives teams-inbound-filter.ts.
+        // Mirrors the Slack branch above — only emitted when restrictive.
+        ...senderPolicyMode ? { MSTEAMS_SENDER_POLICY: senderPolicyMode } : {},
+        ...senderPolicyEnv,
+        // AGT_TEAM_ID when team_agents_only
+        // ENG-5842: principal ID for manager_only — Teams AAD object id from
+        // people.contact_preferences.teams_aad_object_id. Same fail-closed
+        // contract as the Slack branch above.
+        ...teamsPrincipalId ? { MSTEAMS_SENDER_POLICY_PRINCIPAL_ID: teamsPrincipalId } : {},
+        // ENG-5843: org-boundary gate. MSTEAMS_INTERNAL_ONLY + MSTEAMS_HOME_TENANT_ID
+        // mirror the Slack pair. Source is the same tenantId the existing
+        // MSTEAMS_TENANT_ID env var already carries — defaulting to "common"
+        // would be wrong here (it'd admit any tenant), so we skip the
+        // SLACK_HOME_TEAM_ID-equivalent emission when the install hasn't
+        // pinned a real tenant. MCP boot guard fails closed.
+        ...senderPolicyInternalOnly ? { MSTEAMS_INTERNAL_ONLY: "true" } : {},
+        ...senderPolicyInternalOnly && tenantId !== "common" ? { MSTEAMS_HOME_TENANT_ID: tenantId } : {}
       };
       if (isPersistent && existsSync5(localTeamsChannel)) {
         mcpServers["msteams"] = {
@@ -5194,9 +5361,16 @@ ${sections}`
       chmodSync4(envPath, SECRET_FILE_MODE);
     }
     writeXurlStoreForIntegrations(decryptedIntegrations);
-    const hasQmd = integrations.some((i) => i.definition_id === "qmd");
-    if (hasQmd) {
-      this.writeMcpServer(codeName, "qmd", { command: "qmd", args: ["mcp"] });
+    for (const integration of decryptedIntegrations) {
+      const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+      if (!def?.nativeMcp)
+        continue;
+      const key = def.nativeMcp.key ?? integration.definition_id;
+      this.writeMcpServer(codeName, key, buildNativeMcpEntry(def.nativeMcp, {
+        agentId: agentId ?? "",
+        agentCodeName: codeName,
+        integration
+      }));
     }
     const xeroIntegration = integrations.find((i) => i.definition_id === "xero");
     if (xeroIntegration) {
@@ -5255,16 +5429,15 @@ ${sections}`
       }
     }
     if (this.removeMcpServer) {
+      const nativeMcpKeys = INTEGRATION_REGISTRY.filter((d) => d.nativeMcp !== void 0).map((d) => d.nativeMcp.key ?? d.id);
       const integrationDerivedKeys = /* @__PURE__ */ new Set([
-        "qmd",
         "xero",
         "postiz",
         "cloud-broker",
+        ...nativeMcpKeys,
         ...Object.entries(OAUTH_PROVIDERS).filter(([, provider]) => Boolean(provider.mcpUrl)).map(([id]) => id)
       ]);
       const expectedKeys = /* @__PURE__ */ new Set();
-      if (hasQmd)
-        expectedKeys.add("qmd");
       if (xeroIntegration)
         expectedKeys.add("xero");
       if (postizIntegration)
@@ -5272,6 +5445,10 @@ ${sections}`
       if (hasCloudBroker)
         expectedKeys.add("cloud-broker");
       for (const integration of integrations) {
+        const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+        if (def?.nativeMcp) {
+          expectedKeys.add(def.nativeMcp.key ?? integration.definition_id);
+        }
         if (buildRemoteMcpEntry(integration.definition_id)) {
           expectedKeys.add(integration.definition_id);
         }
@@ -5933,12 +6110,15 @@ function setActiveTeam(slug) {
   config.active_team = slug;
   saveConfig(config);
 }
-var DEFAULT_AGT_HOST = "https://api.augmented.team";
+var PROD_AGT_HOST = "https://api.augmented.team";
+var AGT_HOST_UNSET_MESSAGE = "AGT_HOST is not set. Set it to the API URL for your stage before running this command:\n  Production:        export AGT_HOST=https://api.augmented.team\n  Non-prod stage:    export AGT_HOST=https://<stage>.api.staging.augmented.team\n  Local development: export AGT_HOST=http://api.agt.localhost:1355\n\nFor first-time host setup, pass --api-host <url> to `agt setup` instead \u2014 the setup command does NOT silently default to prod (ENG-5831).";
 function getHost() {
   const envHost = process.env["AGT_HOST"]?.trim();
-  return envHost ? envHost : DEFAULT_AGT_HOST;
+  if (!envHost) {
+    throw new Error(AGT_HOST_UNSET_MESSAGE);
+  }
+  return envHost;
 }
-var AGT_HOST = getHost();
 function requireHost() {
   return getHost();
 }
@@ -6761,7 +6941,7 @@ export {
   getApiKey,
   getActiveTeam,
   setActiveTeam,
-  DEFAULT_AGT_HOST,
+  PROD_AGT_HOST,
   getHost,
   requireHost,
   exchangeApiKey,
@@ -6785,4 +6965,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-AACMX6LE.js.map
+//# sourceMappingURL=chunk-2E5OABKX.js.map