@integrity-labs/agt-cli 0.28.324 → 0.28.326

package/dist/bin/agt.js

@@ -38,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-KHSPRKK2.js";
+} from "../chunk-3PT6JAFU.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4827,7 +4827,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.324" : "dev";
+var cliVersion = true ? "0.28.326" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5931,7 +5931,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.324" : "dev";
+var cliVersion2 = true ? "0.28.326" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-KHSPRKK2.js → chunk-3PT6JAFU.js}

@@ -6705,7 +6705,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.324" : "dev";
+var agtCliVersion = true ? "0.28.326" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9102,4 +9102,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-KHSPRKK2.js.map
+//# sourceMappingURL=chunk-3PT6JAFU.js.map

package/dist/lib/manager-worker.js

@@ -43,7 +43,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-KHSPRKK2.js";
+} from "../chunk-3PT6JAFU.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -5989,6 +5989,11 @@ function decideModeForward(evt, policy) {
   const label = extractAugmentedSlackLabel(evt);
   if (!label)
     return { forward: false, reason: "sender_policy" };
+  if (policy.registeredAgentSlackUserIds !== void 0) {
+    if (typeof evt.user !== "string" || !policy.registeredAgentSlackUserIds.has(evt.user)) {
+      return { forward: false, reason: "sender_policy" };
+    }
+  }
   if (policy.mode === "team_agents_only" || policy.mode === "manager_only" || policy.mode === "team_only") {
     if (!policy.teamId || label.teamId !== policy.teamId) {
       return { forward: false, reason: "sender_policy" };
@@ -6079,7 +6084,8 @@ function parsePeersEnv(raw, gateRaw) {
     return [];
   const gateMap = /* @__PURE__ */ new Map();
   let gateConfigInvalid = false;
-  if (gateRaw && gateRaw.trim().length > 0) {
+  const gatePresent = !!(gateRaw && gateRaw.trim().length > 0);
+  if (gatePresent) {
     try {
       const gateParsed = JSON.parse(gateRaw);
       if (!gateParsed || typeof gateParsed !== "object" || Array.isArray(gateParsed)) {
@@ -6122,6 +6128,8 @@ function parsePeersEnv(raw, gateRaw) {
         peer.gate_path = null;
       } else if (gateMap.has(e.bot_user_id)) {
         peer.gate_path = gateMap.get(e.bot_user_id) ?? null;
+      } else if (gatePresent) {
+        peer.gate_path = null;
       }
       out.push(peer);
     }
@@ -6252,23 +6260,27 @@ function buildSlackSenderPolicyFromEnv(env, ctx) {
     throw new Error("SLACK_INTERNAL_ONLY=true requires SLACK_HOME_TEAM_ID. The bot install must have a known team_id (run auth.test against the workspace and persist the result).");
   }
   const internalOnlyFields = internalOnly ? { internalOnly: true, homeTeamId } : {};
+  const slackPeersRaw = env["SLACK_PEERS"];
+  const registryFields = slackPeersRaw && slackPeersRaw.trim().length > 0 ? {
+    registeredAgentSlackUserIds: new Set(parsePeersEnv(slackPeersRaw, env["SLACK_PEERS_GATE"]).map((p) => p.bot_user_id))
+  } : {};
   const teamId = ctx.agentTeamId;
   if (raw === "all")
-    return { mode: "all", ...internalOnlyFields };
+    return { mode: "all", ...internalOnlyFields, ...registryFields };
   if (raw === "agents_only")
-    return { mode: "agents_only", ...internalOnlyFields };
+    return { mode: "agents_only", ...internalOnlyFields, ...registryFields };
   if (raw === "team_agents_only") {
     if (!teamId) {
       throw new Error("SLACK_SENDER_POLICY=team_agents_only requires AGT_TEAM_ID");
     }
-    return { mode: "team_agents_only", teamId, ...internalOnlyFields };
+    return { mode: "team_agents_only", teamId, ...internalOnlyFields, ...registryFields };
   }
   if (raw === "team_only") {
     if (!teamId) {
       throw new Error("SLACK_SENDER_POLICY=team_only requires AGT_TEAM_ID");
     }
     const teamPrincipalSlackUserIds = (env["SLACK_SENDER_POLICY_TEAM_PRINCIPAL_IDS"] ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-    return { mode: "team_only", teamId, teamPrincipalSlackUserIds, ...internalOnlyFields };
+    return { mode: "team_only", teamId, teamPrincipalSlackUserIds, ...internalOnlyFields, ...registryFields };
   }
   if (raw === "manager_only") {
     const principalSlackUserId = env["SLACK_SENDER_POLICY_PRINCIPAL_ID"];
@@ -6278,7 +6290,7 @@ function buildSlackSenderPolicyFromEnv(env, ctx) {
     if (!principalSlackUserId) {
       throw new Error("SLACK_SENDER_POLICY=manager_only requires SLACK_SENDER_POLICY_PRINCIPAL_ID. Set agent.reports_to_person with a slack_user_id in contact_preferences and re-run /host/refresh.");
     }
-    return { mode: "manager_only", teamId, principalSlackUserId, ...internalOnlyFields };
+    return { mode: "manager_only", teamId, principalSlackUserId, ...internalOnlyFields, ...registryFields };
   }
   throw new Error(`Invalid SLACK_SENDER_POLICY=${JSON.stringify(env["SLACK_SENDER_POLICY"])}`);
 }
@@ -8362,7 +8374,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.324" : "dev";
+var agtCliVersion = true ? "0.28.326" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();