@integrity-labs/agt-cli 0.28.321 → 0.28.323

package/dist/mcp/origami.js

@@ -37623,6 +37623,11 @@ var DEFAULT_SCOPES = [
   "reactions:read",
   "reactions:write",
   "users:read",
+  // ENG-7791: needed so users.info returns the sender's email, the join key that
+  // links an inbound Slack sender to their organization_people record (inbound
+  // identity reconcile). Existing installs without it degrade gracefully - the
+  // reconcile no-ops until the bot is re-authorised with the wider scope set.
+  "users:read.email",
   "users.profile:write"
 ];
 var SLACK_SCOPE_PRESETS = {

package/dist/mcp/slack-channel.js

@@ -18031,8 +18031,76 @@ function createInboundContextClient(args) {
   };
 }
 
-// src/slack-bot-user-id-client.ts
+// src/reconcile-identity-client.ts
 var REQUEST_TIMEOUT_MS5 = 1e4;
+function createReconcileIdentityClient(args) {
+  if (!args.agtHost || !args.agtApiKey || !args.agentId) return null;
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const log = args.log ?? (() => {
+  });
+  const base = args.agtHost.replace(/\/+$/, "");
+  const agentId = args.agentId;
+  const apiKey = args.agtApiKey;
+  let cachedToken = null;
+  let cachedTokenExpiresAt = 0;
+  async function getToken() {
+    if (cachedToken && Date.now() < cachedTokenExpiresAt) return cachedToken;
+    const resp = await fetchImpl(`${base}/host/exchange`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      // Scope the exchange to this agent (per-agent org gate, ADR-0042 P1).
+      body: JSON.stringify({ host_key: apiKey, agent_id: agentId }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS5)
+    });
+    if (!resp.ok) {
+      const body = await resp.text().catch(() => "");
+      throw new Error(`/host/exchange failed (${resp.status}): ${body.slice(0, 200)}`);
+    }
+    const data = await resp.json();
+    cachedToken = data.token;
+    cachedTokenExpiresAt = data.expires_at ? new Date(data.expires_at).getTime() - 12e4 : Date.now() + 55 * 6e4;
+    return cachedToken;
+  }
+  async function postOnce(body) {
+    const token = await getToken();
+    return fetchImpl(`${base}/host/reconcile-sender-identity`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS5)
+    });
+  }
+  async function emit(args2) {
+    const body = {
+      agent_id: agentId,
+      platform: args2.platform,
+      sender_id: args2.senderId,
+      email: args2.email
+    };
+    try {
+      let resp = await postOnce(body);
+      if (resp.status === 401) {
+        cachedToken = null;
+        cachedTokenExpiresAt = 0;
+        resp = await postOnce(body);
+      }
+      if (!resp.ok) {
+        const text = await resp.text().catch(() => "");
+        log(`reconcile-identity: POST failed (${resp.status}) platform=${args2.platform}: ${text.slice(0, 200)}`);
+      }
+    } catch (err) {
+      log(`reconcile-identity: emit threw platform=${args2.platform}: ${err.message}`);
+    }
+  }
+  return {
+    reconcile(args2) {
+      void emit(args2);
+    }
+  };
+}
+
+// src/slack-bot-user-id-client.ts
+var REQUEST_TIMEOUT_MS6 = 1e4;
 function createSlackBotUserIdClient(args) {
   if (!args.agtHost || !args.agtApiKey || !args.agentId) return null;
   const fetchImpl = args.fetchImpl ?? fetch;
@@ -18051,7 +18119,7 @@ function createSlackBotUserIdClient(args) {
       headers: { "Content-Type": "application/json" },
       // ENG-7438: scope the exchange to this agent (per-agent org gate, ADR-0042 P1).
       body: JSON.stringify({ host_key: apiKey, agent_id: agentId }),
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS5)
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS6)
     });
     if (!resp.ok) {
       const body = await resp.text().catch(() => "");
@@ -18068,7 +18136,7 @@ function createSlackBotUserIdClient(args) {
       method: "POST",
       headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
       body: JSON.stringify({ agent_id: agentId, bot_user_id: botUserId2 }),
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS5)
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS6)
     });
   }
   async function emitAsync(botUserId2) {
@@ -18100,7 +18168,7 @@ function createSlackBotUserIdClient(args) {
         method: "POST",
         headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
         body: JSON.stringify({ agent_id: agentId, channel_id: "slack", healthy }),
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS5)
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS6)
       });
     };
     try {
@@ -18454,6 +18522,13 @@ var inboundContextClient = createInboundContextClient({
   log: (line) => process.stderr.write(`slack-channel: ${line}
 `)
 });
+var reconcileIdentityClient = createReconcileIdentityClient({
+  agtHost: AGT_HOST,
+  agtApiKey: AGT_API_KEY,
+  agentId: AGT_AGENT_ID,
+  log: (line) => process.stderr.write(`slack-channel: ${line}
+`)
+});
 var kanbanCardActiveClient = createKanbanCardActiveClient({
   agtHost: AGT_HOST,
   agtApiKey: AGT_API_KEY,
@@ -22249,10 +22324,11 @@ var slackReplayTimer = setInterval(() => {
   });
 }, SLACK_REPLAY_SCAN_INTERVAL_MS);
 slackReplayTimer.unref?.();
-var userNameCache = /* @__PURE__ */ new Map();
-async function resolveUserName(userId) {
-  if (!userId || userId === "unknown") return userId ?? "unknown";
-  const cached2 = userNameCache.get(userId);
+var userProfileCache = /* @__PURE__ */ new Map();
+var reconciledSlackSenders = /* @__PURE__ */ new Set();
+async function resolveUserProfile(userId) {
+  if (!userId || userId === "unknown") return null;
+  const cached2 = userProfileCache.get(userId);
   if (cached2 !== void 0) return cached2;
   try {
     const res = await fetch(
@@ -22260,14 +22336,30 @@ async function resolveUserName(userId) {
       { headers: { Authorization: `Bearer ${BOT_TOKEN}` } }
     );
     const data = await res.json();
-    const name = data.user?.profile?.display_name || data.user?.profile?.real_name || userId;
-    userNameCache.set(userId, name);
-    return name;
+    if (!data.ok) return null;
+    const profile = {
+      name: data.user?.profile?.display_name || data.user?.profile?.real_name || userId,
+      email: data.user?.profile?.email?.trim() || null,
+      isStranger: data.user?.is_stranger === true
+    };
+    userProfileCache.set(userId, profile);
+    return profile;
   } catch {
-    userNameCache.set(userId, userId);
-    return userId;
+    return null;
   }
 }
+async function resolveUserName(userId) {
+  if (!userId || userId === "unknown") return userId ?? "unknown";
+  const profile = await resolveUserProfile(userId);
+  return profile?.name ?? userId;
+}
+async function resolveUserEmail(userId) {
+  if (!userId || userId === "unknown") return null;
+  const profile = await resolveUserProfile(userId);
+  if (!profile) return null;
+  if (profile.isStranger) return null;
+  return profile.email;
+}
 var currentWs = null;
 var isShuttingDown = false;
 var acquiredLockPath = null;
@@ -22703,6 +22795,17 @@ async function connectSocketMode() {
       if (channel && !isFromBot && evt.user !== botUserId) {
         resetThread(channel, threadTs);
       }
+      if (reconcileIdentityClient && !isFromBot && evt.user && !reconciledSlackSenders.has(evt.user)) {
+        const senderId = evt.user;
+        reconciledSlackSenders.add(senderId);
+        void resolveUserEmail(senderId).then((email2) => {
+          if (email2) {
+            reconcileIdentityClient.reconcile({ platform: "slack", senderId, email: email2 });
+          } else {
+            reconciledSlackSenders.delete(senderId);
+          }
+        });
+      }
       const isAutoFollowed = !isDirectMessage && evt.type === "message" && isThreadReply && !!threadKey && trackedThreads.has(threadKey);
       const shouldEngage = decideSlackEngagement({
         type: evt.type ?? "message",

package/dist/{persistent-session-ZQSAZIVM.js → persistent-session-5FKI4NCL.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-NAS4DZNG.js";
+} from "./chunk-JTQ6RYGM.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-ZQSAZIVM.js.map
+//# sourceMappingURL=persistent-session-5FKI4NCL.js.map

package/dist/{responsiveness-probe-NARLJJGH.js → responsiveness-probe-R42UJ5ZR.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-NAS4DZNG.js";
+} from "./chunk-JTQ6RYGM.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -427,4 +427,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-NARLJJGH.js.map
+//# sourceMappingURL=responsiveness-probe-R42UJ5ZR.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.321",
+  "version": "0.28.323",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {