@integrity-labs/agt-cli 0.28.1015 → 0.28.1016

package/dist/{claude-pair-runtime-GSPFYCG4.js → claude-pair-runtime-VE6KUMQY.js}

@@ -266,7 +266,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-YP2UTQGA.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-AQGEDGJR.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -734,4 +734,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-GSPFYCG4.js.map
+//# sourceMappingURL=claude-pair-runtime-VE6KUMQY.js.map

package/dist/lib/manager-worker.js

@@ -65,7 +65,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-GHHDFHKE.js";
+} from "../chunk-DFKQZGM7.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -146,7 +146,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-MHDNKKEO.js";
+} from "../chunk-YPS4AUHN.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -187,6 +187,7 @@ import {
   classifyCursorAdvance,
   classifyOutput,
   classifySlackPolicyBlock,
+  classifyTelegramPolicyBlock,
   classifyTranscriptRateLimit,
   coerceOnboardingState,
   cursorAdvanceCounterKey,
@@ -250,7 +251,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-RJ3SI5JG.js";
+} from "../chunk-B7XGAC54.js";
 import "../chunk-DHWNVVX4.js";
 import {
   reapOrphanChannelMcps
@@ -305,7 +306,44 @@ var TELEGRAM_RESTART_ON_CHANGE_ENV_KEYS = [
   /** Peer kill switch. A switch whose purpose is stopping something promptly. */
   "PEER_DISABLED",
   /** Derived boolean mirror of the same switch, kept for the rollout. */
-  "TELEGRAM_PEER_DISABLED"
+  "TELEGRAM_PEER_DISABLED",
+  // ENG-9665. These are the purest case this list exists for: they ARE the
+  // sender policy, so a change to them is an operator changing who may talk to
+  // the agent, made in the console and visible there immediately. Waiting for
+  // an unrelated respawn would mean the console shows a restriction the running
+  // session is not applying - which is the exact ENG-9802 defect, and the same
+  // gap this file's header notes for SLACK_SENDER_POLICY.
+  //
+  // WHICH MECHANISM ACTUALLY RESPAWNS FOR THESE - Obi Wan `1c6a60a29aa5`, and
+  // it is `decideSenderPolicyRestart`, NOT this list's hash.
+  //
+  // Being classified here is a statement that a change is restart-worthy. It is
+  // NOT, for these three, the thing that delivers the restart:
+  // `telegramPolicyEnvFromInputs` builds the restart basis from the CHANNEL
+  // CONFIG, and a sender policy is not in the channel config - it is a column on
+  // `agents`. So these keys can never enter that hash, and the earlier comment
+  // here (and commit 97868b5a's message) credited a mechanism that does not
+  // reach them.
+  //
+  // The restart does happen, via `decideSenderPolicyRestart`, which reads the
+  // policy from where it actually lives and now covers telegram because
+  // `senderPolicyIsEnforcedOn('telegram')` is true. Deliberately NOT plumbed
+  // into the basis as well: that would mean two mechanisms racing to respawn on
+  // one edit, and the config-shaped one would be reading a value that is not in
+  // the config.
+  //
+  // KNOWN CONSEQUENCE, stated rather than left to be found:
+  // `isTelegramPolicyRestrictive` reads the basis, so it returns false for an
+  // agent whose ONLY Telegram restriction is a sender policy. That feeds the
+  // ENG-7771 unknown-baseline branch. Correct today only because
+  // `decideSenderPolicyRestart` covers the same agent by a different route; if
+  // that ever stops being true, this is where the gap reappears.
+  /** The mode itself. Nothing else decides more about who is admitted. */
+  "TELEGRAM_SENDER_POLICY",
+  /** manager_only's single admitted counterparty. */
+  "TELEGRAM_SENDER_POLICY_PRINCIPAL_ID",
+  /** team_only's admitted set. An edit here adds or removes people. */
+  "TELEGRAM_SENDER_POLICY_TEAM_PRINCIPAL_IDS"
 ];
 function telegramPolicyEnvBasis(env) {
   const parts = [];
@@ -11241,6 +11279,37 @@ function parsePeerAgentModeEnv2(raw) {
   return "off";
 }
 
+// ../../packages/core/dist/channels/governance/telegram-inbound-filter.js
+function isBotSender(evt) {
+  return evt.from?.is_bot === true;
+}
+function isSameTeamPeer(evt) {
+  const gate = evt.peerGatePath;
+  return gate === "same_team" || gate === void 0;
+}
+function decideSenderPolicyForwardTelegram(evt, policy) {
+  if (policy.mode === "all")
+    return { forward: true };
+  const fromId = evt.from?.id;
+  if (fromId === void 0)
+    return { forward: false, reason: "sender_policy" };
+  const fromIdStr = String(fromId);
+  if (policy.mode === "manager_only") {
+    return policy.principalTelegramUserId && fromIdStr === policy.principalTelegramUserId ? { forward: true } : { forward: false, reason: "sender_policy" };
+  }
+  if (policy.mode === "team_only") {
+    const list = policy.teamPrincipalTelegramUserIds;
+    if (list && list.length > 0 && list.includes(fromIdStr)) {
+      return { forward: true };
+    }
+    return isBotSender(evt) && isSameTeamPeer(evt) ? { forward: true } : { forward: false, reason: "sender_policy" };
+  }
+  if (policy.mode === "team_agents_only") {
+    return isBotSender(evt) && isSameTeamPeer(evt) ? { forward: true } : { forward: false, reason: "sender_policy" };
+  }
+  return isBotSender(evt) ? { forward: true } : { forward: false, reason: "sender_policy" };
+}
+
 // ../../packages/core/dist/channels/governance/telegram-chat-type.js
 function isTelegramPrivateChat(chatType) {
   return chatType === "private";
@@ -11254,6 +11323,7 @@ function evaluateTelegramInboundGate(evt, deps) {
   const content = text.length > 0 ? { forward: true } : { forward: false, reason: "empty" };
   let peerLeaf;
   let isSelf = false;
+  let peerGatePath;
   if (isBot) {
     const classifierMsg = {
       message_id: evt.message_id,
@@ -11271,6 +11341,13 @@ function evaluateTelegramInboundGate(evt, deps) {
     const c = classifyPeerMessage2(classifierMsg, deps.peerConfig, deps.self);
     isSelf = c.kind === "self";
     peerLeaf = { kind: c.kind, reason: c.kind === "drop" ? c.reason : void 0 };
+    peerGatePath = evt.from ? deps.peerConfig.peers.find((pr) => pr.bot_id === evt.from.id)?.gate_path : void 0;
+  }
+  const policy = deps.senderPolicy;
+  let senderPolicyLeaf;
+  if (policy) {
+    const verdict = decideSenderPolicyForwardTelegram({ ...evt, peerGatePath }, policy);
+    senderPolicyLeaf = verdict.forward ? { forward: true } : { forward: false, reason: classifyTelegramPolicyBlock(policy) };
   }
   const decision = decideInboundAccess({
     content,
@@ -11286,7 +11363,27 @@ function evaluateTelegramInboundGate(evt, deps) {
     // this is `{ forward: true }`, which the composer treats identically to the
     // field being absent.
     chatType: deps.privateChatsOnly && !isTelegramPrivateChat(evt.chat.type) ? { forward: false } : { forward: true },
-    // No sender-policy mode system and no command dispatch on the injection gate.
+    // ENG-9665: the sender-policy axis, applied to ALL senders (a peer agent is
+    // gated here too, before peer governance) exactly as on Slack and Teams.
+    // Absent policy means `all`, which is a no-op.
+    senderPolicy: senderPolicyLeaf,
+    // Injection gate: no command dispatch, and NO DECLINE IS EVER SENT on this
+    // path - so `sameOrg` has nothing to decide here.
+    //
+    // Obi Wan `2d99e22b7e8d`: this used to compute
+    // `allowedChats.size > 0 && allowedChats.has(chatId)` under a comment
+    // reasoning about decline-vs-silence as if it were live. It is not. This
+    // function returns `{ admit, reason }` and DISCARDS `decision.decline`, and
+    // `dispatchTelegramInbound` only logs and returns 'dropped_gate'. So the
+    // computed value had no observable effect for any allowlist, while the
+    // comment implied an agent WITH one would decline. A reader auditing the
+    // insider-decline posture would have concluded opencode Telegram delivers
+    // declines when it delivers silence in every case.
+    //
+    // `slack-sender-gate.ts` states this honestly with a flat `sameOrg: false`,
+    // so this now matches its sibling. IF a decline is ever wired on this
+    // runtime, this is the line to revisit - and the argument for what to put
+    // here lives in telegram-channel.ts, where declines are actually sent.
     sameOrg: false
   });
   if (decision.kind === "drop")
@@ -11317,6 +11414,32 @@ function buildTelegramPeerClassifierConfigFromEnv(env, opts) {
     peer_disabled_mode: parseTelegramPeerDisabledModeEnv(env, opts?.onWarn)
   };
 }
+function buildTelegramSenderPolicyFromEnv(env, ctx) {
+  const raw = (env["TELEGRAM_SENDER_POLICY"] ?? "all").trim().toLowerCase();
+  const teamId = ctx.agentTeamId;
+  if (raw === "all")
+    return { mode: "all" };
+  if (raw === "agents_only")
+    return { mode: "agents_only" };
+  if (raw === "team_agents_only") {
+    if (!teamId)
+      throw new Error("TELEGRAM_SENDER_POLICY=team_agents_only requires AGT_TEAM_ID");
+    return { mode: "team_agents_only", teamId };
+  }
+  if (raw === "team_only") {
+    if (!teamId)
+      throw new Error("TELEGRAM_SENDER_POLICY=team_only requires AGT_TEAM_ID");
+    const teamPrincipalTelegramUserIds = (env["TELEGRAM_SENDER_POLICY_TEAM_PRINCIPAL_IDS"] ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    return { mode: "team_only", teamId, teamPrincipalTelegramUserIds };
+  }
+  if (raw === "manager_only") {
+    if (!teamId)
+      throw new Error("TELEGRAM_SENDER_POLICY=manager_only requires AGT_TEAM_ID");
+    const principalTelegramUserId = env["TELEGRAM_SENDER_POLICY_PRINCIPAL_ID"];
+    return principalTelegramUserId ? { mode: "manager_only", teamId, principalTelegramUserId } : { mode: "manager_only", teamId };
+  }
+  throw new Error(`Invalid TELEGRAM_SENDER_POLICY=${JSON.stringify(env["TELEGRAM_SENDER_POLICY"])}`);
+}
 
 // src/lib/telegram-ingest.ts
 var nodeHttpsTelegramFetch = (url, init) => new Promise((resolve2, reject) => {
@@ -11375,7 +11498,7 @@ function memoryOffsetStore(initial = 0) {
     value = o;
   } };
 }
-function resolveTelegramIngestParamsFromEnv(env) {
+function resolveTelegramIngestParamsFromEnv(env, ctx) {
   const botToken = env["TELEGRAM_BOT_TOKEN"];
   if (!botToken) return null;
   const ackReaction = (env["TELEGRAM_ACK_REACTION"] ?? "").trim() || "\u{1F440}";
@@ -11384,6 +11507,7 @@ function resolveTelegramIngestParamsFromEnv(env) {
     botToken,
     allowedChats: parseTelegramAllowedChatsEnv(env),
     peerConfig: buildTelegramPeerClassifierConfigFromEnv(env),
+    senderPolicy: buildTelegramSenderPolicyFromEnv(env, ctx),
     ackReaction,
     ...skipReaction ? { skipReaction } : {}
   };
@@ -11441,7 +11565,12 @@ async function dispatchTelegramInbound(update, ctx) {
   const decision = evaluateTelegramInboundGate(msg, {
     allowedChats: ctx.allowedChats,
     peerConfig: ctx.peerConfig,
-    self: ctx.self
+    self: ctx.self,
+    // ENG-9665 / Obi Wan `526be87f0cbd`: THE LINE THAT WAS MISSING. Without it
+    // `deps.senderPolicy` is undefined, which the gate treats as `all`, so the
+    // registry's claim that both runtimes supply this leaf was false on this
+    // path. eng-9665-opencode-sender-policy.test.ts fails if it is removed.
+    senderPolicy: ctx.senderPolicy
   });
   if (!decision.admit) {
     ctx.log(`[telegram-ingest:${ctx.codeName}] dropped chat=${redactId(chatId)} reason=${decision.reason}`);
@@ -11548,6 +11677,7 @@ function startTelegramIngest(config2) {
     codeName: config2.codeName,
     allowedChats: config2.allowedChats,
     peerConfig: config2.peerConfig,
+    senderPolicy: config2.senderPolicy,
     self: config2.self,
     inject: config2.inject,
     sendReply,
@@ -11635,6 +11765,10 @@ function fingerprint2(params) {
       botToken: params.botToken,
       allowedChats: [...params.allowedChats].sort(),
       peerConfig: params.peerConfig,
+      // The whole policy: the mode AND the principal identities. A revocation
+      // changes only the ids, so hashing the mode alone would miss exactly the
+      // case `3ff390e32af6` describes.
+      senderPolicy: params.senderPolicy,
       ackReaction: params.ackReaction ?? null,
       skipReaction: params.skipReaction ?? null
     })
@@ -11704,7 +11838,7 @@ async function ensureOpencodeTelegramIngest(opts) {
       stopOpencodeTelegramIngest(codeName, log2);
       return;
     }
-    params = resolveTelegramIngestParamsFromEnv(env);
+    params = resolveTelegramIngestParamsFromEnv(env, { agentTeamId: env["AGT_TEAM_ID"] ?? null });
   } catch (err) {
     stopOpencodeTelegramIngest(codeName, log2);
     log2(`[telegram-ingest:${codeName}] not started: ${err instanceof Error ? err.message : String(err)}`);
@@ -11740,6 +11874,7 @@ async function ensureOpencodeTelegramIngest(opts) {
     botToken: params.botToken,
     allowedChats: params.allowedChats,
     peerConfig: params.peerConfig,
+    senderPolicy: params.senderPolicy,
     self,
     inject: (msg) => injectOpencodeMessage(codeName, msg, { awaitReply: true }),
     log: log2,
@@ -13654,7 +13789,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-YTFWHUTQ.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-BDARO76E.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14397,7 +14532,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1015" : "dev";
+var agtCliVersion = true ? "0.28.1016" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16032,7 +16167,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-YP2UTQGA.js");
+      const { collectDiagnostics } = await import("../persistent-session-AQGEDGJR.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -16174,7 +16309,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-YP2UTQGA.js");
+      const { collectDiagnostics } = await import("../persistent-session-AQGEDGJR.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -16350,7 +16485,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-YTFWHUTQ.js");
+      } = await import("../responsiveness-probe-BDARO76E.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16467,7 +16602,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-YTFWHUTQ.js");
+        } = await import("../responsiveness-probe-BDARO76E.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16623,7 +16758,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-TX4YQUTJ.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-2CCORXIW.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -21007,7 +21142,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-YTFWHUTQ.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-BDARO76E.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -21050,7 +21185,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-YP2UTQGA.js");
+        const { collectDiagnostics } = await import("../persistent-session-AQGEDGJR.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -21101,7 +21236,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-YP2UTQGA.js");
+      const { collectDiagnostics } = await import("../persistent-session-AQGEDGJR.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -21772,7 +21907,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-GSPFYCG4.js");
+  } = await import("../claude-pair-runtime-VE6KUMQY.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));