@integrity-labs/agt-cli 0.27.90 → 0.27.92

package/dist/bin/agt.js

@@ -28,7 +28,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-BGXIKCLR.js";
+} from "../chunk-FXXCD523.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -4934,7 +4934,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.90" : "dev";
+var cliVersion = true ? "0.27.92" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5857,7 +5857,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.90" : "dev";
+var cliVersion2 = true ? "0.27.92" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-BGXIKCLR.js → chunk-FXXCD523.js}

@@ -5483,6 +5483,7 @@ ${sections}`
         const appToken = config["app_token"];
         const threadAutoFollow = config["thread_auto_follow"];
         const channelResponseMode = config["channel_response_mode"];
+        const allowedUsers = Array.isArray(config["allowed_users"]) ? config["allowed_users"].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [];
         const blockKitEnabled = config["block_kit_enabled"] === true;
         const blockKitAskUserEnabled = config["block_kit_ask_user_enabled"] === true;
         const blockKitDisabled = process.env["SLACK_BLOCK_KIT_DISABLED"] === "true";
@@ -5588,7 +5589,16 @@ ${sections}`
               // MCP boot guard fails closed at startup rather than admitting
               // every sender as "internal".
               ...senderPolicyInternalOnly ? { SLACK_INTERNAL_ONLY: "true" } : {},
-              ...senderPolicyInternalOnly && typeof config["team_id"] === "string" && config["team_id"].length > 0 ? { SLACK_HOME_TEAM_ID: config["team_id"] } : {}
+              ...senderPolicyInternalOnly && typeof config["team_id"] === "string" && config["team_id"].length > 0 ? { SLACK_HOME_TEAM_ID: config["team_id"] } : {},
+              // ENG-6035: per-agent diagnostic/restart allowlist. Gates
+              // /investigate-<code-name> (fail-closed: command disabled when
+              // unset) and /restart-<code-name> (open when unset). An explicit
+              // env entry here overrides any host-level systemd value, which
+              // is the point — the host-wide drop-in pattern wrongly scoped
+              // the allowlist to every agent on the host. Omitted when empty
+              // so the host fallback (and the fail-closed /investigate
+              // default) still apply to unconfigured agents.
+              ...allowedUsers.length > 0 ? { SLACK_ALLOWED_USERS: allowedUsers.join(",") } : {}
             }
           };
           const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
@@ -5644,6 +5654,8 @@ ${sections}`
       const slackAutoFollowEnv = slackThreadAutoFollow && slackThreadAutoFollow !== "off" ? { SLACK_THREAD_AUTO_FOLLOW: slackThreadAutoFollow } : {};
       const slackChannelResponseMode = config["channel_response_mode"];
       const slackResponseModeEnv = slackChannelResponseMode && slackChannelResponseMode !== "mention_only" ? { SLACK_CHANNEL_RESPONSE_MODE: slackChannelResponseMode } : {};
+      const slackAllowedUsersList = Array.isArray(config["allowed_users"]) ? config["allowed_users"].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [];
+      const slackAllowedUsersEnv = slackAllowedUsersList.length > 0 ? { SLACK_ALLOWED_USERS: slackAllowedUsersList.join(",") } : {};
       const oneshotBlockKitEnabled = config["block_kit_enabled"] === true;
       const oneshotBlockKitAskUserEnabled = config["block_kit_ask_user_enabled"] === true;
       const oneshotBlockKitDisabled = process.env["SLACK_BLOCK_KIT_DISABLED"] === "true";
@@ -5707,6 +5719,7 @@ ${sections}`
             ...appToken ? { SLACK_APP_TOKEN: "${SLACK_APP_TOKEN}" } : {},
             ...slackAutoFollowEnv,
             ...slackResponseModeEnv,
+            ...slackAllowedUsersEnv,
             ...oneshotBlockKitEnv,
             ...slackPeerEnv,
             ...slackAgtAuthEnv,
@@ -5722,6 +5735,7 @@ ${sections}`
             ...appToken ? { SLACK_APP_TOKEN: "${SLACK_APP_TOKEN}" } : {},
             ...slackAutoFollowEnv,
             ...slackResponseModeEnv,
+            ...slackAllowedUsersEnv,
             ...oneshotBlockKitEnv,
             ...slackPeerEnv,
             ...slackAgtAuthEnv,
@@ -7564,4 +7578,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-BGXIKCLR.js.map
+//# sourceMappingURL=chunk-FXXCD523.js.map