@integrity-labs/agt-cli 0.28.1014 → 0.28.1016

package/dist/mcp/telegram-channel.js

@@ -30672,6 +30672,26 @@ function parsePeerAgentModeEnv(raw) {
 }
 
 // ../core/dist/channels/governance/sender-policy-decline.js
+function teamOnlyReason(allowlist) {
+  return allowlist && allowlist.length > 0 ? "mode_team_only" : "mode_team_only_no_principals";
+}
+function managerOnlyReason(principalId) {
+  return principalId ? "mode_manager_only" : "mode_manager_only_no_principals";
+}
+function classifyTelegramPolicyBlock(policy) {
+  switch (policy.mode) {
+    case "manager_only":
+      return managerOnlyReason(policy.principalTelegramUserId);
+    case "team_only":
+      return teamOnlyReason(policy.teamPrincipalTelegramUserIds);
+    case "team_agents_only":
+      return "mode_team_agents_only";
+    case "agents_only":
+      return "mode_agents_only";
+    case "all":
+      throw new Error("classifyTelegramPolicyBlock called with mode 'all', which never blocks. The caller must have a forward:false verdict from decideSenderPolicyForwardTelegram before classifying.");
+  }
+}
 function politeDeclineCopy(reason) {
   switch (reason) {
     case "internal_only":
@@ -30690,6 +30710,16 @@ function politeDeclineCopy(reason) {
       return "Sorry, I only respond to other agents in this channel.";
   }
 }
+function isTelegramDeclineAddressed(input) {
+  if (input.isFromBot)
+    return false;
+  if (input.chatType === "private")
+    return true;
+  if (input.botId !== null && input.replyToFromId !== null && input.replyToFromId !== void 0 && input.replyToFromId === input.botId) {
+    return true;
+  }
+  return !!input.botUsername && typeof input.text === "string" && input.text.toLowerCase().includes(`@${input.botUsername.toLowerCase()}`);
+}
 function decideDeclineReply(input) {
   const last = input.cache.get(input.key);
   if (last !== void 0) {
@@ -30744,6 +30774,65 @@ function decideInboundAccess(input) {
   return { kind: "admit" };
 }
 
+// ../core/dist/channels/governance/telegram-inbound-filter.js
+function isBotSender(evt) {
+  return evt.from?.is_bot === true;
+}
+function isSameTeamPeer(evt) {
+  const gate = evt.peerGatePath;
+  return gate === "same_team" || gate === void 0;
+}
+function decideSenderPolicyForwardTelegram(evt, policy) {
+  if (policy.mode === "all")
+    return { forward: true };
+  const fromId = evt.from?.id;
+  if (fromId === void 0)
+    return { forward: false, reason: "sender_policy" };
+  const fromIdStr = String(fromId);
+  if (policy.mode === "manager_only") {
+    return policy.principalTelegramUserId && fromIdStr === policy.principalTelegramUserId ? { forward: true } : { forward: false, reason: "sender_policy" };
+  }
+  if (policy.mode === "team_only") {
+    const list = policy.teamPrincipalTelegramUserIds;
+    if (list && list.length > 0 && list.includes(fromIdStr)) {
+      return { forward: true };
+    }
+    return isBotSender(evt) && isSameTeamPeer(evt) ? { forward: true } : { forward: false, reason: "sender_policy" };
+  }
+  if (policy.mode === "team_agents_only") {
+    return isBotSender(evt) && isSameTeamPeer(evt) ? { forward: true } : { forward: false, reason: "sender_policy" };
+  }
+  return isBotSender(evt) ? { forward: true } : { forward: false, reason: "sender_policy" };
+}
+
+// ../core/dist/channels/governance/telegram-inbound-config.js
+function buildTelegramSenderPolicyFromEnv(env2, ctx) {
+  const raw = (env2["TELEGRAM_SENDER_POLICY"] ?? "all").trim().toLowerCase();
+  const teamId = ctx.agentTeamId;
+  if (raw === "all")
+    return { mode: "all" };
+  if (raw === "agents_only")
+    return { mode: "agents_only" };
+  if (raw === "team_agents_only") {
+    if (!teamId)
+      throw new Error("TELEGRAM_SENDER_POLICY=team_agents_only requires AGT_TEAM_ID");
+    return { mode: "team_agents_only", teamId };
+  }
+  if (raw === "team_only") {
+    if (!teamId)
+      throw new Error("TELEGRAM_SENDER_POLICY=team_only requires AGT_TEAM_ID");
+    const teamPrincipalTelegramUserIds = (env2["TELEGRAM_SENDER_POLICY_TEAM_PRINCIPAL_IDS"] ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    return { mode: "team_only", teamId, teamPrincipalTelegramUserIds };
+  }
+  if (raw === "manager_only") {
+    if (!teamId)
+      throw new Error("TELEGRAM_SENDER_POLICY=manager_only requires AGT_TEAM_ID");
+    const principalTelegramUserId = env2["TELEGRAM_SENDER_POLICY_PRINCIPAL_ID"];
+    return principalTelegramUserId ? { mode: "manager_only", teamId, principalTelegramUserId } : { mode: "manager_only", teamId };
+  }
+  throw new Error(`Invalid TELEGRAM_SENDER_POLICY=${JSON.stringify(env2["TELEGRAM_SENDER_POLICY"])}`);
+}
+
 // src/help-command-syntax.ts
 var TELEGRAM_HELP_SYNTAX_RE = /^\/help(?:@([A-Za-z0-9_]{1,64}))?(?:\s|$)/;
 function isTelegramHelpSyntax(text) {
@@ -42868,6 +42957,12 @@ var ALLOWED_CHATS = new Set(
   (process.env.TELEGRAM_ALLOWED_CHATS ?? "").split(",").map((s) => s.trim()).filter(Boolean)
 );
 var PRIVATE_CHATS_ONLY = process.env.TELEGRAM_PRIVATE_CHATS_ONLY === "1";
+var TELEGRAM_SENDER_POLICY = buildTelegramSenderPolicyFromEnv(
+  process.env,
+  { agentTeamId: process.env.AGT_TEAM_ID ?? null }
+);
+var TELEGRAM_DECLINE_CACHE = /* @__PURE__ */ new Map();
+var TELEGRAM_DECLINE_COOLDOWN_MS = 30 * 60 * 1e3;
 var DIAGNOSTIC_CHAT_IDS = new Set(
   (process.env.TELEGRAM_DIAGNOSTIC_CHAT_IDS ?? "").split(",").map((s) => s.trim()).filter(Boolean)
 );
@@ -46523,6 +46618,19 @@ async function pollLoop() {
             };
           }
         }
+        const telegramPeerGatePath = isFromBot && msg.from ? PEER_CLASSIFIER_CONFIG.peers.find((pr) => pr.bot_id === msg.from.id)?.gate_path : void 0;
+        const telegramSenderPolicyVerdict = decideSenderPolicyForwardTelegram(
+          {
+            from: msg.from ? { id: msg.from.id, username: msg.from.username, is_bot: msg.from.is_bot } : void 0,
+            chat: { id: msg.chat?.id ?? 0, type: msg.chat?.type ?? "" },
+            peerGatePath: telegramPeerGatePath
+          },
+          TELEGRAM_SENDER_POLICY
+        );
+        const telegramSenderPolicyLeaf = telegramSenderPolicyVerdict.forward ? { forward: true } : {
+          forward: false,
+          reason: classifyTelegramPolicyBlock(TELEGRAM_SENDER_POLICY)
+        };
         const access = decideInboundAccess({
           content: { forward: true },
           // empty content already filtered above
@@ -46542,14 +46650,97 @@ async function pollLoop() {
           // agent is not permitted to be in.
           chatType: PRIVATE_CHATS_ONLY && !isTelegramPrivateChat(msg.chat?.type) ? { forward: false } : { forward: true },
           command: telegramCommand ? { command: telegramCommand, authorized: true } : void 0,
-          // No sender-policy mode system on Telegram, so no same-org decline.
-          sameOrg: false
+          // ENG-9665: the sender-policy axis. Applied to ALL senders - a
+          // label-bearing peer agent is gated here too, before peer governance
+          // - matching Slack and Teams. `mode: 'all'` is a no-op, so an agent
+          // with no policy set behaves exactly as before.
+          senderPolicy: telegramSenderPolicyLeaf,
+          // `sameOrg` decides decline-vs-silence. Telegram puts no membership
+          // signal on an inbound, only the chat id, so a sender counts as
+          // same-org ONLY when the operator explicitly listed this chat in
+          // TELEGRAM_ALLOWED_CHATS. Conservative in the existence-leak
+          // direction on purpose: an agent with no allowlist stays silent
+          // rather than confirming it exists to a stranger.
+          //
+          // WHAT THAT COSTS, recorded because the paragraph above only stated
+          // the benefit (Obi Wan `70c8a2bc8bca`). The chat allowlist is
+          // OPTIONAL and usually unset, so `sameOrg` is false for most agents,
+          // so the whole ENG-10440 decline path is unreachable for them. A real
+          // team member whose `telegram_chat_id` was never linked is then
+          // dropped by `team_only` in COMPLETE SILENCE - no decline to her, and
+          // no alert, because `planSenderPolicyCoverageAlerts` opens only at
+          // `deliverable === 0` and partial coverage is not zero. That is the
+          // shape of the two-month outage ENG-10440 was filed for, and Slack is
+          // strictly better off here because `isSameSlackWorkspace`'s auth.test
+          // fallback keeps its decline reachable.
+          //
+          // NOT fixed by guessing: at this point a team member with no linked
+          // id is byte-for-byte indistinguishable from a stranger, so any
+          // heuristic that declined to her would also decline to him, which is
+          // the existence leak this field exists to prevent. The tractable half
+          // is the ALERT - comparing `deliverable` against `coverage.
+          // resolvedPeople` would catch the partial case - and that is a
+          // separate change: it needs its own alert type (the current one is
+          // literally named `sender_policy_zero_identities`), its own
+          // threshold and its own noise budget across the fleet.
+          sameOrg: ALLOWED_CHATS.size > 0 && ALLOWED_CHATS.has(chatId)
         });
-        if (access.kind === "drop" && (access.reason === "org_boundary" || access.reason === "chat_type" || access.reason.startsWith("content:"))) {
+        if (access.kind === "drop" && (access.reason === "org_boundary" || access.reason === "chat_type" || access.reason.startsWith("sender_policy:") || access.reason.startsWith("content:"))) {
           process.stderr.write(
             `telegram-channel(${AGENT_CODE_NAME}): inbound drop reason=${access.reason} chat=${redactId(chatId)}
 `
           );
+          const selfIdentity = access.decline !== void 0 ? await resolveBotIdentity() : null;
+          if (access.decline !== void 0 && msg.from?.id != null && selfIdentity !== null && isTelegramDeclineAddressed({
+            chatType: msg.chat?.type,
+            text: msg.text,
+            botUsername: selfIdentity.bot_username,
+            botId: selfIdentity.bot_id,
+            replyToFromId: msg.reply_to_message?.from?.id ?? null,
+            isFromBot: msg.from?.is_bot === true
+          })) {
+            const subReason = classifyTelegramPolicyBlock(TELEGRAM_SENDER_POLICY);
+            const gate = decideDeclineReply({
+              cache: TELEGRAM_DECLINE_CACHE,
+              key: `${chatId}|${msg.from.id}|${subReason}`,
+              cooldownMs: TELEGRAM_DECLINE_COOLDOWN_MS,
+              now: Date.now()
+            });
+            if (gate.reply) {
+              const declineKey = `${chatId}|${msg.from.id}|${subReason}`;
+              const resp2 = await telegramApiCall(
+                "sendMessage",
+                {
+                  chat_id: chatId,
+                  text: politeDeclineCopy(subReason),
+                  reply_to_message_id: msg.message_id
+                },
+                1e4
+              ).catch((err) => {
+                TELEGRAM_DECLINE_CACHE.delete(declineKey);
+                process.stderr.write(
+                  // Obi Wan `7ac26ddc2aea`: redact the path shapes, as handleHelpCommand does.
+                  `telegram-channel(${AGENT_CODE_NAME}): decline reply failed: ${redactAugmentedPaths(err.message)}
+`
+                );
+                return null;
+              });
+              if (resp2 !== null && resp2.ok !== true) {
+                TELEGRAM_DECLINE_CACHE.delete(declineKey);
+                process.stderr.write(
+                  // Obi Wan `7ac26ddc2aea`: `redactId`, not the raw id. Every other
+                  // `chat=` log in this file redacts, including the drop line just
+                  // above - and in a PRIVATE chat a Telegram chat id IS the user's
+                  // telegram user id, the exact `contact_preferences.telegram_chat_id`
+                  // value ENG-9662 spent a ticket keeping off the wire. Logging it raw
+                  // in a change whose whole premise is the privacy of those ids was the
+                  // worst possible place to break the convention.
+                  `telegram-channel(${AGENT_CODE_NAME}): decline reply rejected chat=${redactId(chatId)} reason=${subReason}: ${String(resp2.description ?? "no description")}
+`
+                );
+              }
+            }
+          }
           continue;
         }
         const perfReplyRef = typeof msg.text === "string" && msg.text.trim().length > 0 && msg.reply_to_message?.from?.is_bot === true && msg.reply_to_message?.text ? PERF_REVIEW_REF_RE.exec(msg.reply_to_message.text) : null;

package/dist/{persistent-session-IEGA6OSO.js → persistent-session-AQGEDGJR.js}

@@ -65,8 +65,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-QBQLG2PY.js";
-import "./chunk-MLCGPEN6.js";
+} from "./chunk-YPS4AUHN.js";
+import "./chunk-B7XGAC54.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 import "./chunk-EL5MWGGH.js";
@@ -139,4 +139,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-IEGA6OSO.js.map
+//# sourceMappingURL=persistent-session-AQGEDGJR.js.map

package/dist/{responsiveness-probe-KWFVG5EI.js → responsiveness-probe-BDARO76E.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-QBQLG2PY.js";
-import "./chunk-MLCGPEN6.js";
+} from "./chunk-YPS4AUHN.js";
+import "./chunk-B7XGAC54.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 import "./chunk-EL5MWGGH.js";
@@ -802,4 +802,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-KWFVG5EI.js.map
+//# sourceMappingURL=responsiveness-probe-BDARO76E.js.map

package/dist/{session-auth-dead-P6KOHDYJ.js → session-auth-dead-2CCORXIW.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-MLCGPEN6.js";
+} from "./chunk-B7XGAC54.js";
 import "./chunk-DGUM43GV.js";
 
 // src/lib/session-auth-dead.ts
@@ -204,4 +204,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-P6KOHDYJ.js.map
+//# sourceMappingURL=session-auth-dead-2CCORXIW.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.1014",
+  "version": "0.28.1016",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {