@integrity-labs/agt-cli 0.28.326 → 0.28.328

package/dist/mcp/direct-chat-channel.js

@@ -14255,6 +14255,67 @@ function writeTurnInitiatorMarker(input) {
   }
 }
 
+// src/direct-chat-pending-inbound.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readdirSync,
+  renameSync as renameSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { join as join3 } from "path";
+function hexEncodeSegment(value) {
+  return Buffer.from(value, "utf8").toString("hex");
+}
+function directChatMarkerName(sessionId, messageId) {
+  return `${hexEncodeSegment(sessionId)}__${hexEncodeSegment(messageId)}.json`;
+}
+var defaultClearMarkerFile = (fullPath) => {
+  try {
+    if (existsSync2(fullPath)) unlinkSync(fullPath);
+  } catch {
+  }
+};
+function directChatInboundId(sessionId, messageId) {
+  return `direct-chat|${sessionId.length}|${sessionId}|${messageId}`;
+}
+function writeDirectChatPendingInboundMarker(dir, sessionId, messageId) {
+  if (!dir || !sessionId || !messageId) return;
+  try {
+    mkdirSync2(dir, { recursive: true });
+    const marker = {
+      channel: "direct-chat",
+      session_id: sessionId,
+      message_id: messageId,
+      received_at: (/* @__PURE__ */ new Date()).toISOString(),
+      inbound_id: directChatInboundId(sessionId, messageId)
+    };
+    const final = join3(dir, directChatMarkerName(sessionId, messageId));
+    const tmp = `${final}.tmp`;
+    writeFileSync2(tmp, JSON.stringify(marker), "utf8");
+    renameSync2(tmp, final);
+  } catch {
+  }
+}
+function clearDirectChatPendingMarkersForSession(dir, sessionId, op = defaultClearMarkerFile) {
+  if (!dir || !sessionId) return 0;
+  const prefix = `${hexEncodeSegment(sessionId)}__`;
+  let cleared = 0;
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return 0;
+  }
+  for (const name of names) {
+    if (!name.startsWith(prefix) || !name.endsWith(".json")) continue;
+    op(join3(dir, name));
+    cleared += 1;
+  }
+  return cleared;
+}
+
 // src/direct-chat-poll-guard.ts
 function evaluatePollGuard(state, nowMs, stuckMs) {
   if (!state.inFlight) return { run: true, stuck: false };
@@ -14277,14 +14338,14 @@ async function fetchWithTimeout(input, init, timeoutMs, fetchImpl = fetch) {
 
 // src/mcp-spawn-lock.ts
 import {
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
-  renameSync as renameSync2,
-  unlinkSync,
-  writeFileSync as writeFileSync2
+  renameSync as renameSync3,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function defaultIsPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   try {
@@ -14302,7 +14363,7 @@ function acquireMcpSpawnLock(args) {
   const isPidAlive = options.isPidAlive ?? defaultIsPidAlive;
   const selfPid = options.selfPid ?? process.pid;
   const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const path = join3(agentDir, basename);
+  const path = join4(agentDir, basename);
   const existing = readLockHolder(path);
   if (existing) {
     if (existing.pid === selfPid) {
@@ -14312,11 +14373,11 @@ function acquireMcpSpawnLock(args) {
       return { kind: "blocked", path, holder: existing };
     }
   }
-  mkdirSync2(agentDir, { recursive: true, mode: 448 });
+  mkdirSync3(agentDir, { recursive: true, mode: 448 });
   const tmpPath = `${path}.${selfPid}.tmp`;
   const payload = { pid: selfPid, started_at: now() };
-  writeFileSync2(tmpPath, JSON.stringify(payload), { mode: 384 });
-  renameSync2(tmpPath, path);
+  writeFileSync3(tmpPath, JSON.stringify(payload), { mode: 384 });
+  renameSync3(tmpPath, path);
   return { kind: "acquired", path };
 }
 function releaseMcpSpawnLock(lockPath, opts = {}) {
@@ -14326,12 +14387,12 @@ function releaseMcpSpawnLock(lockPath, opts = {}) {
   if (!existing) return;
   if (existing.pid !== selfPid) return;
   try {
-    unlinkSync(lockPath);
+    unlinkSync2(lockPath);
   } catch {
   }
 }
 function readLockHolder(path) {
-  if (!existsSync2(path)) return null;
+  if (!existsSync3(path)) return null;
   try {
     const raw = readFileSync3(path, "utf8");
     const parsed = JSON.parse(raw);
@@ -14346,35 +14407,35 @@ function readLockHolder(path) {
 
 // src/direct-chat-channel.ts
 import { homedir as homedir2 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { randomUUID } from "crypto";
 import {
   watch,
-  mkdirSync as mkdirSync3,
-  writeFileSync as writeFileSync3,
+  mkdirSync as mkdirSync4,
+  writeFileSync as writeFileSync4,
   readFileSync as readFileSync5,
-  existsSync as existsSync4,
-  renameSync as renameSync3,
-  unlinkSync as unlinkSync2
+  existsSync as existsSync5,
+  renameSync as renameSync4,
+  unlinkSync as unlinkSync3
 } from "fs";
 
 // src/direct-chat-inbound-attachments.ts
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 var MAX_INBOUND_ATTACHMENT_BYTES = 10 * 1024 * 1024;
 var INBOUND_ATTACHMENTS_SUBDIR = "direct-chat-inbound";
 function resolveInboundAttachmentsDir(input) {
   const { codeName, turnInitiatorFile, agentId, homeDir } = input;
   const codeNameTrimmed = typeof codeName === "string" ? codeName.trim() : "";
   if (codeNameTrimmed) {
-    return join4(homeDir, ".augmented", codeNameTrimmed, INBOUND_ATTACHMENTS_SUBDIR);
+    return join5(homeDir, ".augmented", codeNameTrimmed, INBOUND_ATTACHMENTS_SUBDIR);
   }
   const initiator = typeof turnInitiatorFile === "string" ? turnInitiatorFile.trim() : "";
   if (initiator) {
-    return join4(dirname2(initiator), INBOUND_ATTACHMENTS_SUBDIR);
+    return join5(dirname2(initiator), INBOUND_ATTACHMENTS_SUBDIR);
   }
   const agentIdTrimmed = typeof agentId === "string" ? agentId.trim() : "";
   if (agentIdTrimmed) {
-    return join4(homeDir, ".augmented", agentIdTrimmed, INBOUND_ATTACHMENTS_SUBDIR);
+    return join5(homeDir, ".augmented", agentIdTrimmed, INBOUND_ATTACHMENTS_SUBDIR);
   }
   return null;
 }
@@ -14472,11 +14533,11 @@ async function downloadInboundAttachments(attachments, dir, deps) {
 }
 
 // src/flags-cache-read.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 import { homedir } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 function defaultFlagsCachePath() {
-  return join5(homedir(), ".augmented", "flags-cache.json");
+  return join6(homedir(), ".augmented", "flags-cache.json");
 }
 function envBoolean(raw) {
   if (raw === void 0) return void 0;
@@ -14488,7 +14549,7 @@ function envBoolean(raw) {
 }
 function cachedBoolean(key, path) {
   try {
-    if (!existsSync3(path)) return void 0;
+    if (!existsSync4(path)) return void 0;
     const parsed = JSON.parse(readFileSync4(path, "utf8"));
     if (!parsed || typeof parsed !== "object") return void 0;
     const flags = parsed.flags;
@@ -14826,7 +14887,7 @@ var DIRECT_CHAT_MAINTENANCE_COOLDOWN_MS = (() => {
 var AGT_HOST = process.env.AGT_HOST;
 var AGT_API_KEY = process.env.AGT_API_KEY;
 var AGT_AGENT_ID = process.env.AGT_AGENT_ID;
-var DIRECT_CHAT_AGENT_DIR = AGT_AGENT_ID ? join6(homedir2(), ".augmented", AGT_AGENT_ID) : null;
+var DIRECT_CHAT_AGENT_DIR = AGT_AGENT_ID ? join7(homedir2(), ".augmented", AGT_AGENT_ID) : null;
 var INBOUND_ATTACHMENTS_DIR = resolveInboundAttachmentsDir({
   codeName: process.env.AGT_AGENT_CODE_NAME,
   turnInitiatorFile: process.env.AGT_TURN_INITIATOR_FILE,
@@ -14834,7 +14895,8 @@ var INBOUND_ATTACHMENTS_DIR = resolveInboundAttachmentsDir({
   homeDir: homedir2()
 });
 var AGT_AGENT_CODE_NAME = process.env.AGT_AGENT_CODE_NAME;
-var PROGRESS_HEARTBEAT_PATH = AGT_AGENT_CODE_NAME ? join6(homedir2(), ".augmented", AGT_AGENT_CODE_NAME, "channel-progress-heartbeat.json") : null;
+var PROGRESS_HEARTBEAT_PATH = AGT_AGENT_CODE_NAME ? join7(homedir2(), ".augmented", AGT_AGENT_CODE_NAME, "channel-progress-heartbeat.json") : null;
+var DIRECT_CHAT_PENDING_INBOUND_DIR = AGT_AGENT_CODE_NAME ? join7(homedir2(), ".augmented", AGT_AGENT_CODE_NAME, "direct-chat-pending-inbound") : null;
 var progressReceivedAt = /* @__PURE__ */ new Map();
 var directChatProgressState = { tracked: null };
 var directChatProgressTickRunning = false;
@@ -14851,7 +14913,7 @@ var directChatKanbanCardClient = createKanbanCardActiveClient({
 `)
 });
 function readProgressHeartbeat() {
-  if (!PROGRESS_HEARTBEAT_PATH || !existsSync4(PROGRESS_HEARTBEAT_PATH)) return null;
+  if (!PROGRESS_HEARTBEAT_PATH || !existsSync5(PROGRESS_HEARTBEAT_PATH)) return null;
   try {
     return parseProgressHeartbeat(readFileSync5(PROGRESS_HEARTBEAT_PATH, "utf-8"));
   } catch {
@@ -14862,12 +14924,12 @@ function seedProgressHeartbeat() {
   if (!PROGRESS_HEARTBEAT_PATH) return;
   const tmp = `${PROGRESS_HEARTBEAT_PATH}.${process.pid}.tmp`;
   try {
-    mkdirSync3(join6(homedir2(), ".augmented", AGT_AGENT_CODE_NAME), { recursive: true });
-    writeFileSync3(tmp, serializeProgressHeartbeat(SEED_PROGRESS_STEP, Date.now()), { mode: 384 });
-    renameSync3(tmp, PROGRESS_HEARTBEAT_PATH);
+    mkdirSync4(join7(homedir2(), ".augmented", AGT_AGENT_CODE_NAME), { recursive: true });
+    writeFileSync4(tmp, serializeProgressHeartbeat(SEED_PROGRESS_STEP, Date.now()), { mode: 384 });
+    renameSync4(tmp, PROGRESS_HEARTBEAT_PATH);
   } catch {
     try {
-      unlinkSync2(tmp);
+      unlinkSync3(tmp);
     } catch {
     }
   }
@@ -15020,9 +15082,9 @@ var inboundAttachmentDeps = {
       bytes: async () => new Uint8Array(await res.arrayBuffer())
     };
   },
-  ensureDir: (dir) => mkdirSync3(dir, { recursive: true }),
-  writeFile: (path, bytes) => writeFileSync3(path, bytes, { mode: 384 }),
-  joinPath: (...parts) => join6(...parts),
+  ensureDir: (dir) => mkdirSync4(dir, { recursive: true }),
+  writeFile: (path, bytes) => writeFileSync4(path, bytes, { mode: 384 }),
+  joinPath: (...parts) => join7(...parts),
   warn: (msg) => process.stderr.write(`${msg}
 `)
 };
@@ -15190,6 +15252,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
           };
         }
         claimTracker.clear(session_id, message_ids);
+        clearDirectChatPendingMarkersForSession(DIRECT_CHAT_PENDING_INBOUND_DIR, session_id);
         const messageId = data.message_id;
         for (let i = 1; i < slices.length; i++) {
           await sleep(STREAM_REPLY_FLUSH_MS);
@@ -15234,6 +15297,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
         };
       }
       claimTracker.clear(session_id, message_ids);
+      clearDirectChatPendingMarkersForSession(DIRECT_CHAT_PENDING_INBOUND_DIR, session_id);
       return { content: [{ type: "text", text: "sent" }] };
     } catch (err) {
       return {
@@ -15262,6 +15326,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
         };
       }
       claimTracker.clear(session_id, message_ids);
+      clearDirectChatPendingMarkersForSession(DIRECT_CHAT_PENDING_INBOUND_DIR, session_id);
       return { content: [{ type: "text", text: "consumed" }] };
     } catch (err) {
       return {
@@ -15361,6 +15426,13 @@ async function pollForMessages(sinceMs) {
           }
         }
       });
+      if (!isNotice) {
+        writeDirectChatPendingInboundMarker(
+          DIRECT_CHAT_PENDING_INBOUND_DIR,
+          msg.session_id,
+          msg.id
+        );
+      }
       if (!isNotice && msg.sender_id) {
         writeTurnInitiatorMarker({
           channel: "direct-chat",
@@ -15450,7 +15522,7 @@ var doorbellWatcher = null;
 var safetyNetTimer = null;
 if (DOORBELL_ENABLED && DIRECT_CHAT_AGENT_DIR) {
   try {
-    mkdirSync3(DIRECT_CHAT_AGENT_DIR, { recursive: true });
+    mkdirSync4(DIRECT_CHAT_AGENT_DIR, { recursive: true });
   } catch {
   }
   const sessionState = readDirectChatSessionState(DIRECT_CHAT_AGENT_DIR, Date.now());

package/dist/mcp/origami.js

@@ -39592,7 +39592,8 @@ var WAITING_KINDS = [
   "pr-merged",
   "human",
   "external",
-  "other"
+  "other",
+  "approval"
 ];
 var WAITING_KIND_SET = new Set(WAITING_KINDS);
 
@@ -39985,6 +39986,16 @@ var FLAG_REGISTRY = [
     defaultValue: false,
     envVar: "AGT_LIVE_STREAM_PRODUCER_ENABLED"
   },
+  {
+    key: "auto-provision-agt-live",
+    description: "Auto-provision the Augmented Live integration (free tier, watermarked) into every NEW organization as an org-scoped install (ENG-7819). Consumed in TWO places: the seed_default_live_integration AFTER INSERT trigger on organizations reads the EXPLICIT feature_flags row (a plpgsql trigger cannot see this compiled default, so dark = no row = trigger no-ops; flipping the flag on this page writes the row the trigger reads - GLOBAL value only, per-org overrides are not consulted by the trigger), and the POST /organizations route evaluates it normally to send the owner provisioning notice. Restricted-posture orgs are skipped; opt-out (remove/block) is permanent - no reconciler. Boolean gate; ships dark. Pre-flip gates: docs/operator/default-integrations-admission.md.",
+    flagType: "boolean",
+    defaultValue: false,
+    // Grants every new open org a public-publishing capability by default;
+    // flipping it on is fleet-shaping and worth an explicit confirm (ADR-0022
+    // §4, same treatment as augmented-support-auto-provision).
+    sensitive: true
+  },
   {
     key: "admin-live-pane",
     description: "Live agent pane streaming on the platform-admin surfaces (ENG-6588): the agent Diagnostics tab and the /admin embed poll GET /admin/agents/:id/pane (tmux capture-pane over SSM) ~every 3s for a bounded window. Boolean gate; ships dark; when OFF the route returns feature_disabled and the UI falls back to the 30s static diagnostics snapshot. It is the no-deploy kill switch bounding the shared-SSM blast radius (SSM SendCommand throttles account-wide, shared with incident-response runbooks).",

package/dist/mcp/slack-channel.js

@@ -18388,14 +18388,17 @@ var SLACK_SENDER_POLICY = (() => {
     );
   }
   const internalOnlyFields = internalOnly ? { internalOnly: true, homeTeamId } : {};
+  const registeredAgentSlackUserIds = /* @__PURE__ */ new Set();
   const slackPeersRaw = process.env.SLACK_PEERS;
-  const registryFields = slackPeersRaw && slackPeersRaw.trim().length > 0 ? {
-    registeredAgentSlackUserIds: new Set(
-      parsePeersEnv(slackPeersRaw, process.env.SLACK_PEERS_GATE).map(
-        (p) => p.bot_user_id
-      )
-    )
-  } : {};
+  if (slackPeersRaw && slackPeersRaw.trim().length > 0) {
+    for (const p of parsePeersEnv(slackPeersRaw, process.env.SLACK_PEERS_GATE)) {
+      registeredAgentSlackUserIds.add(p.bot_user_id);
+    }
+  }
+  for (const id of parseTeamPeerUserIdsEnv(process.env.SLACK_TEAM_PEER_USER_IDS)) {
+    registeredAgentSlackUserIds.add(id);
+  }
+  const registryFields = registeredAgentSlackUserIds.size > 0 ? { registeredAgentSlackUserIds } : {};
   if (raw === "all") return { mode: "all", ...internalOnlyFields, ...registryFields };
   if (raw === "agents_only") return { mode: "agents_only", ...internalOnlyFields, ...registryFields };
   if (raw === "team_agents_only") {

package/dist/{persistent-session-BICDYHOC.js → persistent-session-5IV24YKT.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-BSTFCC62.js";
+} from "./chunk-GAWNDPGM.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-BICDYHOC.js.map
+//# sourceMappingURL=persistent-session-5IV24YKT.js.map

package/dist/{responsiveness-probe-FEAFPNUF.js → responsiveness-probe-TTGD44MW.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-BSTFCC62.js";
+} from "./chunk-GAWNDPGM.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -427,4 +427,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-FEAFPNUF.js.map
+//# sourceMappingURL=responsiveness-probe-TTGD44MW.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.326",
+  "version": "0.28.328",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {