@integrity-labs/agt-cli 0.27.9-test.13 → 0.27.9-test.14

package/dist/mcp/teams-channel.js

@@ -14430,6 +14430,45 @@ function readDeclineCooldownMs(envVarName, defaultSeconds = 1800) {
   return parsed * 1e3;
 }
 
+// src/inbound-access.ts
+function decideInboundAccess(input) {
+  if (!input.content.forward) {
+    return { kind: "drop", reason: `content:${input.content.reason}` };
+  }
+  if (input.isSelf) {
+    return { kind: "drop", reason: "self" };
+  }
+  if (input.orgBoundary && !input.orgBoundary.forward) {
+    return { kind: "drop", reason: "org_boundary" };
+  }
+  if (input.senderPolicy && !input.senderPolicy.forward) {
+    const reason = input.senderPolicy.reason;
+    const declineWorthy = input.sameOrg && reason !== "internal_only";
+    return {
+      kind: "drop",
+      reason: `sender_policy:${reason}`,
+      decline: declineWorthy ? politeDeclineCopy(reason) : void 0
+    };
+  }
+  if (input.command && !input.isBot) {
+    return {
+      kind: "command",
+      command: input.command.command,
+      authorized: input.command.authorized
+    };
+  }
+  if (input.isBot) {
+    const peer = input.peer;
+    if (!peer || peer.kind === "self") {
+      return { kind: "drop", reason: peer?.kind === "self" ? "self" : "peer:unclassified" };
+    }
+    if (peer.kind === "drop") {
+      return { kind: "drop", reason: `peer:${peer.reason ?? "unspecified"}` };
+    }
+  }
+  return { kind: "admit" };
+}
+
 // src/teams-peer-classifier.ts
 function classifyTeamsPeerMessage(input) {
   const { activity, config: config2 } = input;
@@ -14901,34 +14940,8 @@ async function processPendingFile(filename) {
   } catch {
     return;
   }
-  if (!decision.forward) {
-    process.stderr.write(
-      `teams-channel: dropped activity id=${activity.id ?? "?"} reason=${decision.reason}
-`
-    );
-    return;
-  }
   const senderPolicyDecision = decideSenderPolicyForwardTeams(activity, MSTEAMS_SENDER_POLICY);
-  if (!senderPolicyDecision.forward) {
-    const subReason = classifyTeamsPolicyBlock(activity, MSTEAMS_SENDER_POLICY);
-    process.stderr.write(
-      `teams-channel: dropped activity id=${activity.id ?? "?"} reason=sender_policy sub=${subReason} mode=${MSTEAMS_SENDER_POLICY.mode}
-`
-    );
-    await maybeSendTeamsSenderPolicyDecline({
-      serviceUrl: activity.serviceUrl,
-      conversationId: activity.conversation?.id,
-      replyToId: activity.id,
-      senderId: activity.from?.aadObjectId ?? activity.from?.id,
-      subReason
-    }).catch((err) => {
-      process.stderr.write(
-        `teams-channel: decline reply failed: ${err.message}
-`
-      );
-    });
-    return;
-  }
+  const policyBlockReason = senderPolicyDecision.forward ? void 0 : classifyTeamsPolicyBlock(activity, MSTEAMS_SENDER_POLICY);
   const peerDecision = classifyTeamsPeerMessage({
     activity,
     config: {
@@ -14937,11 +14950,42 @@ async function processPendingFile(filename) {
       mode: PEER_AGENT_MODE
     }
   });
-  if (peerDecision.classification === "peer_agent" && peerDecision.action === "drop") {
+  const peerKind = peerDecision.classification === "peer_agent" && peerDecision.action === "drop" ? "drop" : peerDecision.classification === "peer_agent" ? "peer-ingress" : "human";
+  const senderTenantId = activity.channelData?.tenant?.id ?? activity.conversation?.tenantId;
+  const homeTenantId = process.env.MSTEAMS_HOME_TENANT_ID;
+  const sameOrg = !!homeTenantId && homeTenantId !== "common" && senderTenantId === homeTenantId;
+  const access = decideInboundAccess({
+    content: decision.forward ? { forward: true } : { forward: false, reason: decision.reason },
+    isSelf: false,
+    // self-drop handled inside decideTeamsActivityForward
+    isBot: true,
+    // the peer classifier ran for every activity; 'human' falls through
+    peer: {
+      kind: peerKind,
+      reason: "reason" in peerDecision ? peerDecision.reason : void 0
+    },
+    senderPolicy: senderPolicyDecision.forward ? { forward: true } : { forward: false, reason: policyBlockReason },
+    sameOrg
+  });
+  if (access.kind === "drop") {
     process.stderr.write(
-      `teams-channel: dropped peer activity id=${activity.id ?? "?"} reason=${peerDecision.reason}
+      `teams-channel: inbound drop id=${activity.id ?? "?"} reason=${access.reason}
 `
     );
+    if (access.decline !== void 0 && policyBlockReason) {
+      await maybeSendTeamsSenderPolicyDecline({
+        serviceUrl: activity.serviceUrl,
+        conversationId: activity.conversation?.id,
+        replyToId: activity.id,
+        senderId: activity.from?.aadObjectId ?? activity.from?.id,
+        subReason: policyBlockReason
+      }).catch((err) => {
+        process.stderr.write(
+          `teams-channel: decline reply failed: ${err.message}
+`
+        );
+      });
+    }
     return;
   }
   if (activity.serviceUrl && activity.conversation?.id) {