@integrity-labs/agt-cli 0.28.1014 → 0.28.1016

package/dist/{chunk-7QXIJNLA.js → chunk-DFKQZGM7.js}

@@ -15,7 +15,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-QBQLG2PY.js";
+} from "./chunk-YPS4AUHN.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -77,7 +77,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-MLCGPEN6.js";
+} from "./chunk-B7XGAC54.js";
 import {
   classifyUnanswerablePane,
   summarizeUnanswerablePane
@@ -1965,6 +1965,16 @@ function syncGitHubBrokerCredentialTooling(projectDir, enabled) {
 function getProjectDir2(codeName) {
   return join4(getAgentDir(codeName), "project");
 }
+function reapLegacyTokenFile(codeName, onWarn = void 0) {
+  const tokenFilePath = join4(getAgentDir(codeName), ".tokens.json");
+  try {
+    rmSync2(tokenFilePath, { force: true });
+    return true;
+  } catch (err) {
+    (onWarn ?? ((m) => console.warn(m)))(`[claudecode] ENG-10939: could not remove ${tokenFilePath} (${err.code ?? "unknown"}) \u2014 a plaintext OAuth token file remains on disk for '${codeName}' and needs manual removal`);
+    return false;
+  }
+}
 function getScratchDir(codeName) {
   return join4(getAgentDir(codeName), "scratch");
 }
@@ -5497,8 +5507,10 @@ ${sections}`
     const senderPolicyTeamId = options?.senderPolicy?.mode === "team_agents_only" || options?.senderPolicy?.mode === "manager_only" || options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_id : void 0;
     const slackPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.slack_user_id : void 0;
     const teamsPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.teams_aad_object_id : void 0;
+    const telegramPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.telegram_chat_id : void 0;
     const slackTeamPrincipalIds = options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_principals?.slack_user_ids?.join(",") : void 0;
     const teamsTeamPrincipalIds = options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_principals?.teams_aad_object_ids?.join(",") : void 0;
+    const telegramTeamPrincipalIds = options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_principals?.telegram_chat_ids?.join(",") : void 0;
     const senderPolicyInternalOnly = options?.senderPolicy?.internal_only === true;
     const senderPolicyEnv = senderPolicyTeamId ? { AGT_TEAM_ID: senderPolicyTeamId } : {};
     const agentDir = getAgentDir(codeName);
@@ -5536,6 +5548,18 @@ ${sections}`
       if (allowedChats && allowedChats.length > 0) {
         telegramEnv.TELEGRAM_ALLOWED_CHATS = allowedChats.join(",");
       }
+      if (senderPolicyMode) {
+        telegramEnv.TELEGRAM_SENDER_POLICY = senderPolicyMode;
+      }
+      for (const [policyKey, policyValue] of Object.entries(senderPolicyEnv)) {
+        telegramEnv[policyKey] = policyValue;
+      }
+      if (telegramPrincipalId) {
+        telegramEnv.TELEGRAM_SENDER_POLICY_PRINCIPAL_ID = telegramPrincipalId;
+      }
+      if (telegramTeamPrincipalIds) {
+        telegramEnv.TELEGRAM_SENDER_POLICY_TEAM_PRINCIPAL_IDS = telegramTeamPrincipalIds;
+      }
       const telegramAckReaction = config["ack_reaction"];
       if (typeof telegramAckReaction === "string" && telegramAckReaction.trim().length > 0) {
         telegramEnv.TELEGRAM_ACK_REACTION = telegramAckReaction.trim();
@@ -6165,6 +6189,7 @@ ${sections}`
       };
     });
     writeIntegrationsSummaryForAgent(codeName, summariesForSidecar);
+    reapLegacyTokenFile(codeName, options?.log);
     const decryptedIntegrations = integrations.map((integration) => ({
       ...integration,
       // atrest-reader-context-allow: host adapter — POST /host/agent-integrations decrypts server-side and returns PLAINTEXT creds (the host holds no AUTH_ENCRYPTION_KEY and ResolvedIntegration carries no org/rowId to build a ref). This decrypt is dead-defensive on plaintext; a v2 (enc:2) blob never reaches the host (ENG-9110 trace).
@@ -6176,30 +6201,27 @@ ${sections}`
       const unscopedPrefix = remoteMcpEnvPrefix(integration.definition_id, null);
       const creds = integration.credentials;
       const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
-      if (integration.credentialDelivery === "broker")
-        continue;
-      let token;
-      if (integration.auth_type === "oauth2" || integration.auth_type === "github_app") {
-        token = creds.access_token;
-        if (token) {
-          envUpdates[`${prefix}_ACCESS_TOKEN`] = token;
+      if (integration.credentialDelivery !== "broker") {
+        let token;
+        if (integration.auth_type === "oauth2" || integration.auth_type === "github_app") {
+          token = creds.access_token;
+          if (token) {
+            envUpdates[`${prefix}_ACCESS_TOKEN`] = token;
+          }
+        } else if (integration.auth_type === "api_key") {
+          token = creds.api_key;
+          if (token) {
+            envUpdates[`${prefix}_API_KEY`] = token;
+          }
         }
-      } else if (integration.auth_type === "api_key") {
-        token = creds.api_key;
-        if (token) {
-          envUpdates[`${prefix}_API_KEY`] = token;
+        if (def?.cli_tool?.env_key && token && !(def.cli_tool.env_key in envUpdates)) {
+          envUpdates[def.cli_tool.env_key] = token;
         }
       }
-      if (def?.cli_tool) {
-        const { env_key, extra_env } = def.cli_tool;
-        if (env_key && token && !(env_key in envUpdates)) {
-          envUpdates[env_key] = token;
-        }
-        if (extra_env) {
-          for (const [k, v] of Object.entries(extra_env)) {
-            if (typeof v === "string" && v && !(k in envUpdates)) {
-              envUpdates[k] = v;
-            }
+      if (def?.cli_tool?.extra_env) {
+        for (const [k, v] of Object.entries(def.cli_tool.extra_env)) {
+          if (typeof v === "string" && v && !(k in envUpdates)) {
+            envUpdates[k] = v;
           }
         }
       }
@@ -6864,29 +6886,6 @@ ${sections}`
       child.on("error", () => {
       });
     });
-  },
-  writeTokenFile(codeName, integrations) {
-    const agentDir = getAgentDir(codeName);
-    mkdirSync3(agentDir, { recursive: true });
-    const tokens = {};
-    for (const integration of integrations) {
-      if (integration.auth_type !== "oauth2" && integration.auth_type !== "github_app")
-        continue;
-      const creds = decryptIntegrationCredentials(integration.credentials);
-      const accessToken = creds.access_token;
-      if (!accessToken)
-        continue;
-      tokens[integration.definition_id] = {
-        access_token: accessToken,
-        ...Object.keys(integration.config).length > 0 ? { config: integration.config } : {},
-        ...creds.token_expires_at ? { expires_at: creds.token_expires_at } : {}
-      };
-    }
-    if (Object.keys(tokens).length === 0)
-      return;
-    const tokenPath = join4(agentDir, ".tokens.json");
-    writeFileSync4(tokenPath, JSON.stringify(tokens, null, 2));
-    chmodSync4(tokenPath, SECRET_FILE_MODE);
   }
 };
 registerFramework(claudeCodeAdapter);
@@ -7008,7 +7007,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1014" : "dev";
+var agtCliVersion = true ? "0.28.1016" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11700,6 +11699,7 @@ export {
   extractCommandNotFound,
   describeChannelWriteFailure,
   migrateAgentDirToIdKeyed,
+  reapLegacyTokenFile,
   provisionStopHook,
   provisionIsolationHook,
   provisionAutoKanbanProgressHook,
@@ -11789,4 +11789,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-7QXIJNLA.js.map
+//# sourceMappingURL=chunk-DFKQZGM7.js.map