@integrity-labs/agt-cli 0.28.269 → 0.28.270

package/dist/{claude-pair-runtime-CXM2IH7U.js → claude-pair-runtime-WZLKWP74.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-ZQDTWV3D.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-FMFTNDJO.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-CXM2IH7U.js.map
+//# sourceMappingURL=claude-pair-runtime-WZLKWP74.js.map

package/dist/lib/manager-worker.js

@@ -38,7 +38,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-ZH3CEX2A.js";
+} from "../chunk-ND4BBPV5.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -123,7 +123,7 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-JW6CWBNF.js";
+} from "../chunk-RH4FTCZK.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -6700,7 +6700,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.269" : "dev";
+var agtCliVersion = true ? "0.28.270" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7550,7 +7550,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-ZQDTWV3D.js");
+      const { collectDiagnostics } = await import("../persistent-session-FMFTNDJO.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -7648,7 +7648,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-ZQDTWV3D.js");
+      const { collectDiagnostics } = await import("../persistent-session-FMFTNDJO.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -7796,7 +7796,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-74SDDDGN.js");
+      } = await import("../responsiveness-probe-FPTBS6RZ.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -7828,7 +7828,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-74SDDDGN.js");
+        } = await import("../responsiveness-probe-FPTBS6RZ.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -10686,7 +10686,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-ZQDTWV3D.js");
+        const { collectDiagnostics } = await import("../persistent-session-FMFTNDJO.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -10736,7 +10736,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-ZQDTWV3D.js");
+      const { collectDiagnostics } = await import("../persistent-session-FMFTNDJO.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -11127,7 +11127,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-CXM2IH7U.js");
+  } = await import("../claude-pair-runtime-WZLKWP74.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/origami.js

@@ -38739,13 +38739,13 @@ var INTEGRATION_REGISTRY = [
     id: "image-gen",
     name: "Image Generation",
     category: "media",
-    description: "AI image generation for Augmented Live pages. An agent authoring a page passes a text prompt (agt_live.generate_image) and gets back a generated raster image, stored on the page asset CDN so there is no image to source or host. Augmented Team manages the model access for you - there is no key to enter. Generation runs through the Vercel AI Gateway (OpenAI gpt-image-2 today). It is a PREMIUM, usage-billed capability, separate from Augmented Live text and audio: gated on a per-org opt-in and a monthly USD budget, and metered per generated image.",
+    description: "AI image generation from a text prompt. An agent passes a prompt to generate_image and gets back a generated raster image, which it can deliver to a chat channel or embed on an Augmented Live page (ENG-7535). Augmented Team manages the model access for you - there is no key to enter. Generation runs through the Vercel AI Gateway (OpenAI gpt-image-2 today). It is a PREMIUM, usage-billed capability: gated on a per-org opt-in and a monthly USD budget, and metered per generated image.",
     // No vendor key to enter: Augmented owns the shared Vercel AI Gateway virtual
     // key (AI_GATEWAY_API_KEY) that fronts the image providers, so auth is `none`
     // (customers never enter a key), same as ElevenLabs.
     supported_auth_types: ["none"],
     capabilities: [
-      { id: "image-gen:generate", name: "Generate Image", description: "Generate a raster image from a text prompt for an Augmented Live page (agt_live.generate_image)", access: "write" }
+      { id: "image-gen:generate", name: "Generate Image", description: "Generate a raster image from a text prompt (generate_image), deliverable to a chat channel or an Augmented Live page", access: "write" }
     ],
     docs_url: "https://platform.openai.com/docs/guides/images",
     beta: true,
@@ -38762,7 +38762,7 @@ var INTEGRATION_REGISTRY = [
     // declared here; the handler fails CLOSED when the deployed model maps to an
     // undeclared meter, so a version bump without a rate card refuses rather than
     // silently disabling the budget. Adding a model = declare its meter here + seed
-    // its rate card + add a normalizer entry in augmented-live-image-gen.ts.
+    // its rate card + add a normalizer entry in image-generation.ts.
     premium: {
       pricing: "usage",
       note: "Billed per generated image; the rate depends on the model/version used.",
@@ -40033,6 +40033,19 @@ var FLAG_REGISTRY = [
     // env var is retired.
     envVar: "AUGMENTED_CONNECTIVITY_ESCALATION_ENABLED"
   },
+  {
+    key: "managed-health-connectivity-flip",
+    description: "Arm the managed-connection-health status flip on data-plane hard-down (ENG-7539). When on, the managed-connection-health cron flips a managed integration to needs_reauth when the host-side connectivity probe reports a sustained hard-down (consecutive_connectivity_failures at/over the hysteresis threshold with a down observation), even if Composio account-status still reads ACTIVE. When off it keeps the pre-ENG-7539 behaviour: status is driven only by the account-status probe, so a live 401 behind an ACTIVE account never flips status. Boolean gate; ships dark. Sibling of integration-connectivity-escalation: that flag arms the alert; this flag arms the status flip plus the reconnect notification.",
+    flagType: "boolean",
+    // Declared safe value is `false` (no auto status flip). It preserves the
+    // pre-ENG-7539 fleet behaviour where managed status derives solely from the
+    // account-status probe, so merging this dark changes nothing until an
+    // operator arms it per-stage from the admin Feature Flags page. `false` is
+    // also the fail-safe direction: a flag-DB read error must never start
+    // flipping statuses (and firing reconnect notifications) on its own. No env
+    // override - this is a net-new gate, so it is registry-only (ADR-0022).
+    defaultValue: false
+  },
   {
     key: "projects-menu",
     description: "Show the Projects nav item in the webapp (ADR-0017 Projects soft launch, ENG-6342). Replaces the isAdmin/adminOnly gate with a per-org rollout flag.",

package/dist/mcp/telegram-channel.js

@@ -2985,7 +2985,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve2.call(this, root, ref);
+      let _sch = resolve3.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3012,7 +3012,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve2(root, ref) {
+    function resolve3(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3587,7 +3587,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve2(baseURI, relativeURI, options) {
+    function resolve3(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -3814,7 +3814,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve2,
+      resolve: resolve3,
       resolveComponent,
       equal,
       serialize,
@@ -13054,7 +13054,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
+        await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -13071,7 +13071,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -13149,7 +13149,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve2(parseResult.data);
+            resolve3(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -13410,12 +13410,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve2, interval);
+      const timeoutId = setTimeout(resolve3, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -14476,12 +14476,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve2();
+        resolve3();
       } else {
-        this._stdout.once("drain", resolve2);
+        this._stdout.once("drain", resolve3);
       }
     });
   }
@@ -14499,6 +14499,7 @@ import {
   openSync,
   readFileSync as readFileSync11,
   readdirSync as readdirSync3,
+  realpathSync,
   renameSync as renameSync6,
   statSync as statSync2,
   unlinkSync as unlinkSync6,
@@ -14507,7 +14508,7 @@ import {
   writeSync
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join10 } from "path";
+import { basename, extname, join as join10, resolve as resolve2 } from "path";
 
 // src/channel-attachments.ts
 import { homedir } from "os";
@@ -16539,9 +16540,60 @@ var TELEGRAM_EGRESS_TOOLS = /* @__PURE__ */ new Set([
   "telegram.reply",
   "telegram.send_message",
   "telegram.react",
+  "telegram.upload_file",
   "channel_request_input"
 ]);
 
+// src/telegram-upload.ts
+var TELEGRAM_PHOTO_MAX_BYTES = 10 * 1024 * 1024;
+var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
+var TELEGRAM_IMAGE_EXTS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp"]);
+var TELEGRAM_EXT_CONTENT_TYPE = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".pdf": "application/pdf",
+  ".mp4": "video/mp4",
+  ".mp3": "audio/mpeg",
+  ".txt": "text/plain",
+  ".json": "application/json",
+  ".csv": "text/csv"
+};
+function chooseTelegramUploadMethod(input) {
+  const ext = input.ext.toLowerCase();
+  const isImage = TELEGRAM_IMAGE_EXTS.has(ext);
+  let sendAsPhoto = isImage && input.asDocument !== true;
+  const downgradedToDocument = sendAsPhoto && input.sizeBytes > TELEGRAM_PHOTO_MAX_BYTES;
+  if (downgradedToDocument) sendAsPhoto = false;
+  return {
+    method: sendAsPhoto ? "sendPhoto" : "sendDocument",
+    fileField: sendAsPhoto ? "photo" : "document",
+    contentType: TELEGRAM_EXT_CONTENT_TYPE[ext] ?? "application/octet-stream",
+    downgradedToDocument
+  };
+}
+function sanitizeMultipartFilename(name) {
+  return name.replace(/[\r\n"]/g, "_");
+}
+function buildTelegramMultipartBody(boundary, fileField, file, fields) {
+  const CRLF = "\r\n";
+  const safeName = sanitizeMultipartFilename(file.filename);
+  const parts = [];
+  for (const [k, v] of Object.entries(fields)) {
+    parts.push(Buffer.from(`--${boundary}${CRLF}Content-Disposition: form-data; name="${k}"${CRLF}${CRLF}${v}${CRLF}`));
+  }
+  parts.push(
+    Buffer.from(
+      `--${boundary}${CRLF}Content-Disposition: form-data; name="${fileField}"; filename="${safeName}"${CRLF}Content-Type: ${file.contentType}${CRLF}${CRLF}`
+    ),
+    Buffer.from(file.bytes),
+    Buffer.from(`${CRLF}--${boundary}--${CRLF}`)
+  );
+  return Buffer.concat(parts);
+}
+
 // src/strip-repost-preamble.ts
 var PRIOR_ATTEMPT_CUE = /\b(a moment ago|just now|a second ago|earlier|moments ago|previously|last (?:time|attempt)|drafted|dialled|dialed|typed|composed|wrote|sent) (?:this|that|it)?\b|\b(?:drafted|dialled|dialed|typed|composed)\b/i;
 var FAILURE_CUE = /\b(?:did(?:n['’]t| not)|could(?:n['’]t| not)|would(?:n['’]t| not)|wasn['’]t|fail(?:ed)?|never)\b[^.!?\n]*?\b(?:parse[d]?|send|sent|go through|went through|land|deliver(?:ed)?|post(?:ed)?|come through|came through)\b/i;
@@ -16751,7 +16803,7 @@ function ensureEmptyMcpConfig() {
   return p;
 }
 function runClaudeP(prompt, model) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const args = [
       "-p",
       prompt,
@@ -16781,7 +16833,7 @@ function runClaudeP(prompt, model) {
           reject(new Error("claude -p returned no output"));
           return;
         }
-        resolve2(text);
+        resolve3(text);
       }
     );
   });
@@ -17103,12 +17155,12 @@ function defaultIsPidAlive(pid) {
   }
 }
 function acquireMcpSpawnLock(args) {
-  const { agentDir, basename, options = {} } = args;
+  const { agentDir, basename: basename2, options = {} } = args;
   if (!agentDir) return { kind: "no-agent-dir" };
   const isPidAlive = options.isPidAlive ?? defaultIsPidAlive;
   const selfPid = options.selfPid ?? process.pid;
   const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const path = join8(agentDir, basename);
+  const path = join8(agentDir, basename2);
   const existing = readLockHolder(path);
   if (existing) {
     if (existing.pid === selfPid) {
@@ -17530,7 +17582,7 @@ if (AGENT_CODE_NAME && AGENT_CODE_NAME !== "unknown") {
   }
 }
 function telegramApiCall(method, body, timeoutMs) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const postData = JSON.stringify(body);
     const req = https.request(
       {
@@ -17552,7 +17604,7 @@ function telegramApiCall(method, body, timeoutMs) {
         });
         res.on("end", () => {
           try {
-            resolve2(JSON.parse(data));
+            resolve3(JSON.parse(data));
           } catch {
             reject(new Error("Invalid JSON from Telegram API"));
           }
@@ -17568,6 +17620,46 @@ function telegramApiCall(method, body, timeoutMs) {
     req.end();
   });
 }
+function sendTelegramFileMultipart(method, fileField, file, fields, timeoutMs) {
+  return new Promise((resolvePromise, reject) => {
+    const boundary = `----augmented${randomUUID3().replace(/-/g, "")}`;
+    const body = buildTelegramMultipartBody(boundary, fileField, file, fields);
+    const req = https.request(
+      {
+        hostname: "api.telegram.org",
+        port: 443,
+        path: `/bot${BOT_TOKEN}/${method}`,
+        method: "POST",
+        family: 4,
+        timeout: timeoutMs,
+        headers: {
+          "Content-Type": `multipart/form-data; boundary=${boundary}`,
+          "Content-Length": body.length
+        }
+      },
+      (res) => {
+        let data = "";
+        res.on("data", (d) => {
+          data += d;
+        });
+        res.on("end", () => {
+          try {
+            resolvePromise(JSON.parse(data));
+          } catch {
+            reject(new Error("Invalid JSON from Telegram API"));
+          }
+        });
+      }
+    );
+    req.on("error", reject);
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error("Telegram API timeout"));
+    });
+    req.write(body);
+    req.end();
+  });
+}
 var TELEGRAM_MAINTENANCE_NOTICE_CACHE = /* @__PURE__ */ new Map();
 var TELEGRAM_MAINTENANCE_COOLDOWN_MS = (() => {
   const raw = process.env["TELEGRAM_MAINTENANCE_NOTICE_COOLDOWN_SEC"];
@@ -18242,7 +18334,7 @@ function investigateNowUtcLabel() {
   return `${(/* @__PURE__ */ new Date()).toISOString().slice(11, 19)} UTC`;
 }
 function investigateSleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function classifyInvestigateCommand(text) {
   const needsUsername = /@[A-Za-z0-9_]{1,64}(?:\s|$)/.test(text);
@@ -19494,6 +19586,40 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
         required: ["chat_id", "text"]
       }
     },
+    {
+      name: "telegram.upload_file",
+      description: "Send a file from the agent project dir to a Telegram chat. Use this for images, PDFs, reports, and any binary deliverable the agent generates (e.g. an image returned by generate_image: download its URL to a file under ~/.augmented/<codeName>/project/ first, then upload it here). Images (png/jpg/gif/webp) are sent as photos with an inline preview; everything else is sent as a document. The path must be inside the agent project dir.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          path: {
+            type: "string",
+            description: "Absolute path to the local file. Must be within the agent project dir (~/.augmented/<codeName>/project/)."
+          },
+          chat_id: {
+            type: "string",
+            description: "Telegram chat ID to send the file to (from the chat_id attribute in the <channel> tag)"
+          },
+          caption: {
+            type: "string",
+            description: "Optional caption shown with the file (plain text, up to 1024 chars)"
+          },
+          reply_to_message_id: {
+            type: "string",
+            description: "Optional Telegram message_id to send the file as a quote-reply to"
+          },
+          as_document: {
+            type: "boolean",
+            description: "Force sending as an uncompressed document even for images (preserves full quality / original file). Default: images are sent as photos, everything else as a document."
+          },
+          filename: {
+            type: "string",
+            description: "Override the filename shown in Telegram (defaults to the basename of path)"
+          }
+        },
+        required: ["path", "chat_id"]
+      }
+    },
     {
       name: "telegram.download_attachment",
       description: "Download an inbound Telegram attachment on demand. Use this for non-image files (PDFs, docx, voice, video, audio, animations) that arrived via a <channel> tag \u2014 look for `file_id` in the `files` meta. Requires the `chat_id` from the same <channel> tag so the tool can verify the attachment was shared in the current conversation. Returns the local path where the file was written (inside ~/.augmented/<codeName>/telegram-inbound/). Images are auto-downloaded on receipt and don't need this tool.",
@@ -19544,6 +19670,119 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
   if (name === "channel_request_input") {
     return handleChannelRequestInput(args ?? {});
   }
+  if (name === "telegram.upload_file") {
+    const { path, chat_id, caption, reply_to_message_id, as_document, filename } = args;
+    if (!AGENT_CODE_NAME || AGENT_CODE_NAME === "unknown") {
+      return {
+        content: [{
+          type: "text",
+          text: "Upload refused: AGT_AGENT_CODE_NAME not set in the MCP server env. Reprovision the telegram channel so the upload tool can scope paths."
+        }],
+        isError: true
+      };
+    }
+    const allowedRoot = resolve2(homedir4(), ".augmented", AGENT_CODE_NAME, "project") + "/";
+    const resolvedPath = resolve2(path);
+    if (!resolvedPath.startsWith(allowedRoot)) {
+      return {
+        content: [{
+          type: "text",
+          text: `Upload refused: ${resolvedPath} is outside the agent's project dir (${allowedRoot}). Move the file under that dir first.`
+        }],
+        isError: true
+      };
+    }
+    if (ALLOWED_CHATS.size > 0 && !ALLOWED_CHATS.has(chat_id)) {
+      return {
+        content: [{ type: "text", text: `Chat ${chat_id} is not in TELEGRAM_ALLOWED_CHATS` }],
+        isError: true
+      };
+    }
+    const peerActiveOnChat = PEER_CLASSIFIER_CONFIG.peer_agent_mode !== "off" && PEER_CLASSIFIER_CONFIG.peer_group_ids.length > 0 && PEER_CLASSIFIER_CONFIG.peer_group_ids.includes(chat_id);
+    if (peerActiveOnChat) {
+      if (PEER_DISABLED_GLOBAL) {
+        process.stderr.write(
+          `telegram-channel(${AGENT_CODE_NAME}): outgress_blocked reason=peer_disabled_global tool=upload_file chat=${redactId(chat_id)}
+`
+        );
+        return {
+          content: [{ type: "text", text: "Multi-agent collaboration is disabled (TELEGRAM_PEER_DISABLED). Cannot send files on this chat." }],
+          isError: true
+        };
+      }
+      if (peerPresence.shouldDropOutgress(chat_id, Date.now()) === "no_human_recent") {
+        process.stderr.write(
+          `telegram-channel(${AGENT_CODE_NAME}): outgress_blocked reason=no_human_recent tool=upload_file chat=${redactId(chat_id)}
+`
+        );
+        return {
+          content: [{ type: "text", text: "No human message in this chat in the last 30 minutes. Peer-agent collaboration is paused for this chat until a human posts." }],
+          isError: true
+        };
+      }
+    }
+    let realPath;
+    try {
+      realPath = realpathSync(resolvedPath);
+    } catch (err) {
+      return { content: [{ type: "text", text: `Failed to read file: ${err.message}` }], isError: true };
+    }
+    let realRoot = allowedRoot;
+    try {
+      realRoot = realpathSync(resolve2(homedir4(), ".augmented", AGENT_CODE_NAME, "project")) + "/";
+    } catch {
+    }
+    if (!realPath.startsWith(realRoot)) {
+      return {
+        content: [{
+          type: "text",
+          text: `Upload refused: ${resolvedPath} resolves (via a symlink) outside the agent's project dir. Move a real file under ${allowedRoot}.`
+        }],
+        isError: true
+      };
+    }
+    let bytes;
+    let size;
+    try {
+      const st = statSync2(realPath);
+      if (!st.isFile()) {
+        return { content: [{ type: "text", text: `Upload refused: ${resolvedPath} is not a regular file.` }], isError: true };
+      }
+      size = st.size;
+      if (size === 0) {
+        return { content: [{ type: "text", text: "Upload refused: the file is empty." }], isError: true };
+      }
+      if (size > TELEGRAM_DOCUMENT_MAX_BYTES) {
+        return {
+          content: [{ type: "text", text: `Upload refused: the file is ${(size / 1024 / 1024).toFixed(1)} MB; Telegram's bot upload limit is 50 MB.` }],
+          isError: true
+        };
+      }
+      bytes = readFileSync11(realPath);
+    } catch (err) {
+      return { content: [{ type: "text", text: `Failed to read file: ${err.message}` }], isError: true };
+    }
+    const fname = (filename ?? basename(resolvedPath)).trim() || basename(resolvedPath);
+    const { method, fileField, contentType } = chooseTelegramUploadMethod({
+      ext: extname(fname),
+      sizeBytes: size,
+      asDocument: as_document
+    });
+    const fields = { chat_id };
+    if (typeof caption === "string" && caption.trim().length > 0) fields.caption = caption.slice(0, 1024);
+    if (reply_to_message_id) fields.reply_to_message_id = reply_to_message_id;
+    try {
+      const resp = await sendTelegramFileMultipart(method, fileField, { filename: fname, contentType, bytes }, fields, 6e4);
+      if (!resp.ok) {
+        return { content: [{ type: "text", text: `Telegram ${method} failed: ${resp.description ?? "unknown"}` }], isError: true };
+      }
+      return {
+        content: [{ type: "text", text: `Sent ${fname} (${(size / 1024).toFixed(0)} KB) to chat ${chat_id} as a ${fileField === "photo" ? "photo" : "document"}.` }]
+      };
+    } catch (err) {
+      return { content: [{ type: "text", text: `Telegram ${method} error: ${err.message}` }], isError: true };
+    }
+  }
   if (name === "telegram.reply" || name === "telegram.send_message") {
     const { chat_id, text, reply_to_message_id, interim } = args;
     if (ALLOWED_CHATS.size > 0 && !ALLOWED_CHATS.has(chat_id)) {
@@ -20158,7 +20397,7 @@ var telegramHttp = {
     return { file_path: resp.result.file_path, file_size: resp.result.file_size };
   },
   async fetchBytes(filePath, signal, maxBytes) {
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const req = https.request(
         {
           hostname: "api.telegram.org",
@@ -20202,7 +20441,7 @@ var telegramHttp = {
             chunks.push(c);
           });
           res.on("end", () => {
-            if (!aborted2) resolve2(Buffer.concat(chunks));
+            if (!aborted2) resolve3(Buffer.concat(chunks));
           });
           res.on("error", reject);
         }
@@ -20747,7 +20986,7 @@ async function pollLoop() {
   }
 }
 function sleep2(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms).unref());
+  return new Promise((resolve3) => setTimeout(resolve3, ms).unref());
 }
 function shutdown(reason) {
   if (isShuttingDown) return;

package/dist/{persistent-session-ZQDTWV3D.js → persistent-session-FMFTNDJO.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-JW6CWBNF.js";
+} from "./chunk-RH4FTCZK.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-ZQDTWV3D.js.map
+//# sourceMappingURL=persistent-session-FMFTNDJO.js.map

package/dist/{responsiveness-probe-74SDDDGN.js → responsiveness-probe-FPTBS6RZ.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-JW6CWBNF.js";
+} from "./chunk-RH4FTCZK.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -418,4 +418,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-74SDDDGN.js.map
+//# sourceMappingURL=responsiveness-probe-FPTBS6RZ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.269",
+  "version": "0.28.270",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {