@integrity-labs/agt-cli 0.28.329 → 0.28.331

package/dist/mcp/telegram-channel.js

@@ -14522,7 +14522,7 @@ import { createHash, randomUUID as randomUUID3 } from "crypto";
 import {
   closeSync,
   createWriteStream,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   ftruncateSync,
   mkdirSync as mkdirSync8,
   openSync,
@@ -14531,13 +14531,13 @@ import {
   realpathSync,
   renameSync as renameSync6,
   statSync as statSync2,
-  unlinkSync as unlinkSync6,
+  unlinkSync as unlinkSync7,
   watch,
   writeFileSync as writeFileSync10,
   writeSync
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename, extname, join as join10, resolve as resolve2 } from "path";
+import { basename, extname, join as join11, resolve as resolve2 } from "path";
 
 // src/channel-attachments.ts
 import { homedir } from "os";
@@ -17024,6 +17024,29 @@ function applyToChatMarkers(pendingDir, chatId, op, cutoffMs) {
   return applied;
 }
 
+// src/recovery-ledger.ts
+import { existsSync as existsSync6, unlinkSync as unlinkSync5 } from "fs";
+import { join as join8 } from "path";
+function recoveryLedgerEntryExists(ledgerDir, markerName, exists = (p) => existsSync6(p)) {
+  if (!ledgerDir || !markerName) return false;
+  if (markerName.includes("/") || markerName.includes("\\") || markerName.includes("..")) return false;
+  try {
+    return exists(join8(ledgerDir, markerName));
+  } catch {
+    return false;
+  }
+}
+function removeRecoveryLedgerEntry(ledgerDir, markerName, unlink = (p) => {
+  if (existsSync6(p)) unlinkSync5(p);
+}) {
+  if (!ledgerDir || !markerName) return;
+  if (markerName.includes("/") || markerName.includes("\\") || markerName.includes("..")) return;
+  try {
+    unlink(join8(ledgerDir, markerName));
+  } catch {
+  }
+}
+
 // src/channel-progress.ts
 function channelLiveProgressEnabled() {
   return resolveHostBooleanFlag({
@@ -17208,14 +17231,14 @@ function createKanbanCardActiveClient(args) {
 
 // src/mcp-spawn-lock.ts
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync9,
   renameSync as renameSync5,
-  unlinkSync as unlinkSync5,
+  unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function defaultIsPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   try {
@@ -17233,7 +17256,7 @@ function acquireMcpSpawnLock(args) {
   const isPidAlive = options.isPidAlive ?? defaultIsPidAlive;
   const selfPid = options.selfPid ?? process.pid;
   const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const path = join8(agentDir, basename2);
+  const path = join9(agentDir, basename2);
   const existing = readLockHolder(path);
   if (existing) {
     if (existing.pid === selfPid) {
@@ -17257,12 +17280,12 @@ function releaseMcpSpawnLock(lockPath, opts = {}) {
   if (!existing) return;
   if (existing.pid !== selfPid) return;
   try {
-    unlinkSync5(lockPath);
+    unlinkSync6(lockPath);
   } catch {
   }
 }
 function readLockHolder(path) {
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   try {
     const raw = readFileSync9(path, "utf8");
     const parsed = JSON.parse(raw);
@@ -17277,7 +17300,7 @@ function readLockHolder(path) {
 
 // src/ack-reaction.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var REPLY_WEDGED_THRESHOLD_MS = 5 * 60 * 1e3;
 var ACK_STARTUP_GRACE_MS = 6e4;
 var ACK_PANE_FRESH_THRESHOLD_MS = 6e4;
@@ -17385,7 +17408,7 @@ function oldestPendingMarkerAgeMs(dir, now = Date.now(), opts) {
     if (!name.endsWith(".json")) continue;
     let receivedAt;
     try {
-      const raw = JSON.parse(readFileSync10(join9(dir, name), "utf-8"));
+      const raw = JSON.parse(readFileSync10(join10(dir, name), "utf-8"));
       if (raw.discretionary === true) continue;
       if (!opts?.includeSeen && typeof raw.seen_at === "string" && raw.seen_at) continue;
       receivedAt = raw.received_at;
@@ -17453,7 +17476,7 @@ function isMarkerGenuinelyAged(receivedAt, nowMs, thresholdMs) {
 }
 var DEFLECTION_COUNTER_SUFFIX = "-deflections.json";
 function deflectionCounterPath(agentDir, channel) {
-  return join9(agentDir, `${channel}${DEFLECTION_COUNTER_SUFFIX}`);
+  return join10(agentDir, `${channel}${DEFLECTION_COUNTER_SUFFIX}`);
 }
 function recordChannelDeflection(agentDir, channel, cause) {
   if (!agentDir) return;
@@ -17541,7 +17564,7 @@ function redactId(id) {
 }
 var BOT_TOKEN = process.env.TELEGRAM_BOT_TOKEN;
 var AGENT_CODE_NAME = process.env.AGT_AGENT_CODE_NAME ?? "unknown";
-var TELEGRAM_AGENT_DIR = AGENT_CODE_NAME && AGENT_CODE_NAME !== "unknown" ? join10(homedir4(), ".augmented", AGENT_CODE_NAME) : null;
+var TELEGRAM_AGENT_DIR = AGENT_CODE_NAME && AGENT_CODE_NAME !== "unknown" ? join11(homedir4(), ".augmented", AGENT_CODE_NAME) : null;
 var AGT_HOST = process.env.AGT_HOST ?? null;
 var AGT_API_KEY = process.env.AGT_API_KEY ?? null;
 var AGT_AGENT_ID = process.env.AGT_AGENT_ID ?? null;
@@ -17645,9 +17668,9 @@ if (!BOT_TOKEN) {
 var stderrLogStream = null;
 if (AGENT_CODE_NAME && AGENT_CODE_NAME !== "unknown") {
   try {
-    const logDir = join10(homedir4(), ".augmented", AGENT_CODE_NAME);
+    const logDir = join11(homedir4(), ".augmented", AGENT_CODE_NAME);
     mkdirSync8(logDir, { recursive: true });
-    stderrLogStream = createWriteStream(join10(logDir, "telegram-channel-stderr.log"), {
+    stderrLogStream = createWriteStream(join11(logDir, "telegram-channel-stderr.log"), {
       flags: "a",
       mode: 384
     });
@@ -17926,7 +17949,7 @@ function scheduleBusyAck(chatId, messageId, arrivedWhileBusy) {
     let paneLogFreshAgeMs = null;
     if (AGENT_DIR) {
       try {
-        const paneMtimeMs = statSync2(join10(AGENT_DIR, "pane.log")).mtimeMs;
+        const paneMtimeMs = statSync2(join11(AGENT_DIR, "pane.log")).mtimeMs;
         paneLogFreshAgeMs = Math.max(0, Date.now() - paneMtimeMs);
       } catch {
       }
@@ -17956,7 +17979,7 @@ function scheduleBusyAck(chatId, messageId, arrivedWhileBusy) {
 function __resetBusyAckNoticeThrottle() {
   lastBusyAckNoticeAt.clear();
 }
-var RESTART_FLAGS_DIR = join10(homedir4(), ".augmented", "restart-flags");
+var RESTART_FLAGS_DIR = join11(homedir4(), ".augmented", "restart-flags");
 function actuateHostRestartTelegram() {
   return actuateHostRestart({
     agtHost: AGT_HOST,
@@ -18338,10 +18361,10 @@ async function handleRestartCommand(opts) {
       writeTelegramRestartConfirm({ chat_id: opts.chatId, message_id: opts.messageId }, opts.requesterName);
     } else {
       writeTelegramRestartConfirm({ chat_id: opts.chatId, message_id: opts.messageId }, opts.requesterName);
-      if (!existsSync7(RESTART_FLAGS_DIR)) {
+      if (!existsSync8(RESTART_FLAGS_DIR)) {
         mkdirSync8(RESTART_FLAGS_DIR, { recursive: true });
       }
-      const flagPath = join10(RESTART_FLAGS_DIR, `${AGENT_CODE_NAME}.flag`);
+      const flagPath = join11(RESTART_FLAGS_DIR, `${AGENT_CODE_NAME}.flag`);
       const flag = {
         codeName: AGENT_CODE_NAME,
         source: "telegram",
@@ -18747,14 +18770,15 @@ async function classifyRestartCommand(text) {
   if (!ours) return "verification_failed";
   return target === ours ? "act" : "ignore";
 }
-var AGENT_DIR = AGENT_CODE_NAME && AGENT_CODE_NAME !== "unknown" ? join10(homedir4(), ".augmented", AGENT_CODE_NAME) : null;
-var PENDING_INBOUND_DIR = AGENT_DIR ? join10(AGENT_DIR, "telegram-pending-inbound") : null;
-var RECOVERY_OUTBOX_DIR = AGENT_DIR ? join10(AGENT_DIR, "telegram-recovery-outbox") : null;
-var RESTART_CONFIRM_FILE = AGENT_DIR ? join10(AGENT_DIR, "telegram-restart-confirm.json") : null;
+var AGENT_DIR = AGENT_CODE_NAME && AGENT_CODE_NAME !== "unknown" ? join11(homedir4(), ".augmented", AGENT_CODE_NAME) : null;
+var PENDING_INBOUND_DIR = AGENT_DIR ? join11(AGENT_DIR, "telegram-pending-inbound") : null;
+var RECOVERY_OUTBOX_DIR = AGENT_DIR ? join11(AGENT_DIR, "telegram-recovery-outbox") : null;
+var RECOVERY_LEDGER_DIR = AGENT_DIR ? join11(AGENT_DIR, ".agt-telegram-recovery-ledger") : null;
+var RESTART_CONFIRM_FILE = AGENT_DIR ? join11(AGENT_DIR, "telegram-restart-confirm.json") : null;
 var TELEGRAM_PROCESS_BOOT_MS = Date.now();
-var TELEGRAM_RECENT_DMS_FILE = AGENT_DIR ? join10(AGENT_DIR, "telegram-recent-dms.json") : null;
-var TELEGRAM_CHANNEL_ADD_RESTART_FILE = AGENT_DIR ? join10(AGENT_DIR, "telegram-channel-add-restart.json") : null;
-var TELEGRAM_OFFSET_FILE = AGENT_DIR ? join10(AGENT_DIR, "telegram-getupdates-offset.json") : null;
+var TELEGRAM_RECENT_DMS_FILE = AGENT_DIR ? join11(AGENT_DIR, "telegram-recent-dms.json") : null;
+var TELEGRAM_CHANNEL_ADD_RESTART_FILE = AGENT_DIR ? join11(AGENT_DIR, "telegram-channel-add-restart.json") : null;
+var TELEGRAM_OFFSET_FILE = AGENT_DIR ? join11(AGENT_DIR, "telegram-getupdates-offset.json") : null;
 var recentDms = /* @__PURE__ */ new Map();
 var recentDmPersister = TELEGRAM_RECENT_DMS_FILE ? createRecentDmPersister({
   filePath: TELEGRAM_RECENT_DMS_FILE,
@@ -18809,7 +18833,7 @@ function safeMarkerName(chatId, messageId) {
 }
 function pendingInboundPath(chatId, messageId) {
   if (!PENDING_INBOUND_DIR) return null;
-  return join10(PENDING_INBOUND_DIR, safeMarkerName(chatId, messageId));
+  return join11(PENDING_INBOUND_DIR, safeMarkerName(chatId, messageId));
 }
 function writePendingInboundMarker(chatId, messageId, chatType, undeliverable = false, payload) {
   const path = pendingInboundPath(chatId, messageId);
@@ -18865,7 +18889,7 @@ function clearTelegramMarkerFileWithHeal(fullPath) {
     notifyBackOnline(marker.chat_id);
   }
   try {
-    if (existsSync7(fullPath)) unlinkSync6(fullPath);
+    if (existsSync8(fullPath)) unlinkSync7(fullPath);
   } catch {
   }
 }
@@ -18898,7 +18922,7 @@ function markTelegramMarkerSeenWithHeal(fullPath) {
 }
 function readPendingInboundMarker(chatId, messageId) {
   const path = pendingInboundPath(chatId, messageId);
-  if (!path || !existsSync7(path)) return null;
+  if (!path || !existsSync8(path)) return null;
   try {
     return JSON.parse(readFileSync11(path, "utf-8"));
   } catch {
@@ -18920,7 +18944,7 @@ function nextRetryName(filename) {
 async function processRecoveryOutboxFile(filename) {
   if (!RECOVERY_OUTBOX_DIR) return;
   if (filename.endsWith(".poison.json") || filename.endsWith(".tmp")) return;
-  const fullPath = join10(RECOVERY_OUTBOX_DIR, filename);
+  const fullPath = join11(RECOVERY_OUTBOX_DIR, filename);
   let payload;
   try {
     const raw = readFileSync11(fullPath, "utf-8");
@@ -18941,6 +18965,7 @@ async function processRecoveryOutboxFile(filename) {
       `telegram-channel(${AGENT_CODE_NAME}): recovery outbox malformed (${filename}): missing chat_id or text
 `
     );
+    removeRecoveryLedgerEntry(RECOVERY_LEDGER_DIR, payload.marker_name);
     try {
       renameSync6(fullPath, `${fullPath}.malformed.poison`);
     } catch {
@@ -18969,8 +18994,9 @@ async function processRecoveryOutboxFile(filename) {
     );
     if (decision.action === "suppress") {
       clearPendingMessage(payload.chat_id, recoveryDrainCutoffMs);
+      removeRecoveryLedgerEntry(RECOVERY_LEDGER_DIR, payload.marker_name);
       try {
-        unlinkSync6(fullPath);
+        unlinkSync7(fullPath);
       } catch {
       }
       return;
@@ -19005,8 +19031,9 @@ async function processRecoveryOutboxFile(filename) {
     );
   }
   if (sendSucceeded) {
+    removeRecoveryLedgerEntry(RECOVERY_LEDGER_DIR, payload.marker_name);
     try {
-      unlinkSync6(fullPath);
+      unlinkSync7(fullPath);
     } catch {
     }
     return;
@@ -19014,12 +19041,13 @@ async function processRecoveryOutboxFile(filename) {
   const next = nextRetryName(filename);
   if (next) {
     try {
-      renameSync6(fullPath, join10(RECOVERY_OUTBOX_DIR, next.next));
+      renameSync6(fullPath, join11(RECOVERY_OUTBOX_DIR, next.next));
       if (next.attempt >= MAX_RECOVERY_ATTEMPTS) {
         process.stderr.write(
           `telegram-channel(${AGENT_CODE_NAME}): ghost-reply recovery exhausted retries \u2014 moved to ${next.next}
 `
         );
+        removeRecoveryLedgerEntry(RECOVERY_LEDGER_DIR, payload.marker_name);
       }
     } catch {
     }
@@ -19054,7 +19082,7 @@ function scanRecoveryRetries() {
     if (!f.includes(".retry-") || f.endsWith(".poison.json")) continue;
     let mtimeMs;
     try {
-      mtimeMs = statSync2(join10(RECOVERY_OUTBOX_DIR, f)).mtimeMs;
+      mtimeMs = statSync2(join11(RECOVERY_OUTBOX_DIR, f)).mtimeMs;
     } catch {
       continue;
     }
@@ -19084,7 +19112,7 @@ function startRecoveryOutboxWatcher() {
     const watcher = watch(RECOVERY_OUTBOX_DIR, (event, filename) => {
       if (event !== "rename" || !filename) return;
       if (!isFirstAttemptOutboxFile(filename)) return;
-      if (existsSync7(join10(RECOVERY_OUTBOX_DIR, filename))) {
+      if (existsSync8(join11(RECOVERY_OUTBOX_DIR, filename))) {
         void processRecoveryOutboxFile(filename);
       }
     });
@@ -19099,7 +19127,7 @@ function startRecoveryOutboxWatcher() {
   retryTimer.unref?.();
 }
 startRecoveryOutboxWatcher();
-var NOTICE_OUTBOX_DIR = AGENT_DIR ? join10(AGENT_DIR, "telegram-notice-outbox") : null;
+var NOTICE_OUTBOX_DIR = AGENT_DIR ? join11(AGENT_DIR, "telegram-notice-outbox") : null;
 var NOTICE_MAX_AGE_MS = 9e4;
 var NOTICE_INFLIGHT = /* @__PURE__ */ new Set();
 async function processNoticeOutboxFile(filename) {
@@ -19107,7 +19135,7 @@ async function processNoticeOutboxFile(filename) {
   if (filename.startsWith(".") || filename.endsWith(".tmp") || !filename.endsWith(".json")) return;
   if (NOTICE_INFLIGHT.has(filename)) return;
   NOTICE_INFLIGHT.add(filename);
-  const fullPath = join10(NOTICE_OUTBOX_DIR, filename);
+  const fullPath = join11(NOTICE_OUTBOX_DIR, filename);
   try {
     let mtimeMs;
     try {
@@ -19117,7 +19145,7 @@ async function processNoticeOutboxFile(filename) {
     }
     if (Date.now() - mtimeMs > NOTICE_MAX_AGE_MS) {
       try {
-        unlinkSync6(fullPath);
+        unlinkSync7(fullPath);
       } catch {
       }
       return;
@@ -19129,14 +19157,14 @@ async function processNoticeOutboxFile(filename) {
       payload = parsed;
     } catch {
       try {
-        unlinkSync6(fullPath);
+        unlinkSync7(fullPath);
       } catch {
       }
       return;
     }
     if (!payload.chat_id || !payload.text) {
       try {
-        unlinkSync6(fullPath);
+        unlinkSync7(fullPath);
       } catch {
       }
       return;
@@ -19147,7 +19175,7 @@ async function processNoticeOutboxFile(filename) {
       defaultValue: false
     })) {
       try {
-        unlinkSync6(fullPath);
+        unlinkSync7(fullPath);
       } catch {
       }
       return;
@@ -19176,7 +19204,7 @@ async function processNoticeOutboxFile(filename) {
       );
     }
     try {
-      unlinkSync6(fullPath);
+      unlinkSync7(fullPath);
     } catch {
     }
   } finally {
@@ -19201,7 +19229,7 @@ function startNoticeOutboxWatcher() {
   try {
     const watcher = watch(NOTICE_OUTBOX_DIR, (event, filename) => {
       if (event !== "rename" || !filename) return;
-      if (existsSync7(join10(NOTICE_OUTBOX_DIR, filename))) void processNoticeOutboxFile(filename);
+      if (existsSync8(join11(NOTICE_OUTBOX_DIR, filename))) void processNoticeOutboxFile(filename);
     });
     watcher.unref?.();
   } catch (err) {
@@ -19218,7 +19246,7 @@ function trackPendingMessage(chatId, messageId, chatType, undeliverable = false,
 }
 function sweepTelegramStaleMarkers(thresholdMs) {
   if (!PENDING_INBOUND_DIR) return;
-  if (!existsSync7(PENDING_INBOUND_DIR)) return;
+  if (!existsSync8(PENDING_INBOUND_DIR)) return;
   let filenames;
   try {
     filenames = readdirSync3(PENDING_INBOUND_DIR);
@@ -19234,7 +19262,7 @@ function sweepTelegramStaleMarkers(thresholdMs) {
   for (const filename of filenames) {
     if (!filename.endsWith(".json")) continue;
     if (filename.endsWith(".tmp")) continue;
-    const fullPath = join10(PENDING_INBOUND_DIR, filename);
+    const fullPath = join11(PENDING_INBOUND_DIR, filename);
     let marker;
     try {
       marker = JSON.parse(readFileSync11(fullPath, "utf-8"));
@@ -19244,7 +19272,7 @@ function sweepTelegramStaleMarkers(thresholdMs) {
 `
       );
       try {
-        unlinkSync6(fullPath);
+        unlinkSync7(fullPath);
       } catch {
       }
       cleared++;
@@ -19262,7 +19290,7 @@ function sweepTelegramStaleMarkers(thresholdMs) {
         );
       }
       try {
-        unlinkSync6(fullPath);
+        unlinkSync7(fullPath);
       } catch {
       }
       cleared++;
@@ -19283,11 +19311,11 @@ var orphanSweepTimer = setInterval(() => {
   checkWatchdogGiveUpNotice();
 }, orphanSweepIntervalMs());
 orphanSweepTimer.unref?.();
-var TELEGRAM_PROGRESS_HEARTBEAT_PATH = AGENT_DIR ? join10(AGENT_DIR, "channel-progress-heartbeat.json") : null;
+var TELEGRAM_PROGRESS_HEARTBEAT_PATH = AGENT_DIR ? join11(AGENT_DIR, "channel-progress-heartbeat.json") : null;
 var telegramTrackedProgress = null;
 var telegramProgressTickRunning = false;
 function readTelegramProgressHeartbeat() {
-  if (!TELEGRAM_PROGRESS_HEARTBEAT_PATH || !existsSync7(TELEGRAM_PROGRESS_HEARTBEAT_PATH)) return null;
+  if (!TELEGRAM_PROGRESS_HEARTBEAT_PATH || !existsSync8(TELEGRAM_PROGRESS_HEARTBEAT_PATH)) return null;
   try {
     return parseProgressHeartbeat(readFileSync11(TELEGRAM_PROGRESS_HEARTBEAT_PATH, "utf-8"));
   } catch {
@@ -19302,13 +19330,13 @@ function seedTelegramProgressHeartbeat() {
     renameSync6(tmp, TELEGRAM_PROGRESS_HEARTBEAT_PATH);
   } catch {
     try {
-      unlinkSync6(tmp);
+      unlinkSync7(tmp);
     } catch {
     }
   }
 }
 function findTelegramProgressTarget() {
-  if (!PENDING_INBOUND_DIR || !existsSync7(PENDING_INBOUND_DIR)) return null;
+  if (!PENDING_INBOUND_DIR || !existsSync8(PENDING_INBOUND_DIR)) return null;
   let best = null;
   let bestMs = Infinity;
   try {
@@ -19316,7 +19344,7 @@ function findTelegramProgressTarget() {
       if (!name.endsWith(".json")) continue;
       let m;
       try {
-        m = JSON.parse(readFileSync11(join10(PENDING_INBOUND_DIR, name), "utf-8"));
+        m = JSON.parse(readFileSync11(join11(PENDING_INBOUND_DIR, name), "utf-8"));
       } catch {
         continue;
       }
@@ -19440,14 +19468,14 @@ if (BOT_TOKEN && PENDING_INBOUND_DIR) {
 }
 var lastGiveUpHandledAtMs = null;
 function listPendingInboundChatIds() {
-  if (!PENDING_INBOUND_DIR || !existsSync7(PENDING_INBOUND_DIR)) return [];
+  if (!PENDING_INBOUND_DIR || !existsSync8(PENDING_INBOUND_DIR)) return [];
   const chats = /* @__PURE__ */ new Set();
   try {
     for (const name of readdirSync3(PENDING_INBOUND_DIR)) {
       if (!name.endsWith(".json")) continue;
       try {
         const marker = JSON.parse(
-          readFileSync11(join10(PENDING_INBOUND_DIR, name), "utf8")
+          readFileSync11(join11(PENDING_INBOUND_DIR, name), "utf8")
         );
         if (typeof marker.seen_at === "string" && marker.seen_at) continue;
         if (typeof marker.chat_id === "string" && marker.chat_id) chats.add(marker.chat_id);
@@ -19489,7 +19517,7 @@ async function notifyWatchdogGiveUp(chatId, reason) {
 }
 function checkWatchdogGiveUpNotice() {
   if (!AGENT_DIR) return;
-  const signal = readGiveUpSignal(join10(AGENT_DIR, GIVE_UP_SIGNAL_FILENAME));
+  const signal = readGiveUpSignal(join11(AGENT_DIR, GIVE_UP_SIGNAL_FILENAME));
   const signalAtMs = signal?.atMs ?? null;
   const act = decideGiveUpNotice({
     signalAtMs,
@@ -19551,7 +19579,7 @@ async function deliverQueuedReply(p) {
   }
 }
 function clearPendingMessage(chatId, cutoffMs = Number.POSITIVE_INFINITY) {
-  if (!PENDING_INBOUND_DIR || !existsSync7(PENDING_INBOUND_DIR)) return;
+  if (!PENDING_INBOUND_DIR || !existsSync8(PENDING_INBOUND_DIR)) return;
   clearAllTelegramPendingMarkersForChat(
     PENDING_INBOUND_DIR,
     chatId,
@@ -19560,7 +19588,7 @@ function clearPendingMessage(chatId, cutoffMs = Number.POSITIVE_INFINITY) {
   );
 }
 function markSeenPendingMessage(chatId, cutoffMs = Number.POSITIVE_INFINITY) {
-  if (!PENDING_INBOUND_DIR || !existsSync7(PENDING_INBOUND_DIR)) return;
+  if (!PENDING_INBOUND_DIR || !existsSync8(PENDING_INBOUND_DIR)) return;
   markSeenAllTelegramPendingMarkersForChat(
     PENDING_INBOUND_DIR,
     chatId,
@@ -20386,7 +20414,7 @@ await mcp.connect(new StdioServerTransport());
 var REPLAY_SCAN_INTERVAL_MS = 6e4;
 async function replayPendingTelegramMarkers() {
   if (!channelReplayEnabled()) return;
-  if (!PENDING_INBOUND_DIR || !existsSync7(PENDING_INBOUND_DIR)) return;
+  if (!PENDING_INBOUND_DIR || !existsSync8(PENDING_INBOUND_DIR)) return;
   const probe = process.env.TMUX && AGENT_CODE_NAME && AGENT_CODE_NAME !== "unknown" ? probeAgentSessionCached(AGENT_CODE_NAME) : { tmux: "unknown", claude: "unknown" };
   const sessionAlive = probe.tmux === "alive" && probe.claude === "alive";
   if (!sessionAlive) return;
@@ -20400,7 +20428,7 @@ async function replayPendingTelegramMarkers() {
   let paneFreshAgeMs = null;
   if (AGENT_DIR) {
     try {
-      paneFreshAgeMs = Math.max(0, now - statSync2(join10(AGENT_DIR, "pane.log")).mtimeMs);
+      paneFreshAgeMs = Math.max(0, now - statSync2(join11(AGENT_DIR, "pane.log")).mtimeMs);
     } catch {
     }
   }
@@ -20408,7 +20436,7 @@ async function replayPendingTelegramMarkers() {
   const entries = [];
   for (const name of filenames) {
     if (!name.endsWith(".json") || name.endsWith(".tmp")) continue;
-    const fullPath = join10(PENDING_INBOUND_DIR, name);
+    const fullPath = join11(PENDING_INBOUND_DIR, name);
     let marker;
     try {
       marker = JSON.parse(readFileSync11(fullPath, "utf-8"));
@@ -20421,6 +20449,7 @@ async function replayPendingTelegramMarkers() {
   }
   entries.sort((a, b) => b.ageMs - a.ageMs);
   for (const { path, marker, ageMs } of entries) {
+    if (recoveryLedgerEntryExists(RECOVERY_LEDGER_DIR, basename(path))) continue;
     if (!shouldReplayMarker({
       enabled: true,
       hasPayload: Boolean(marker.payload),
@@ -20930,7 +20959,7 @@ async function pollLoop() {
         let paneLogFreshAgeMs = null;
         if (AGENT_DIR) {
           try {
-            const paneMtimeMs = statSync2(join10(AGENT_DIR, "pane.log")).mtimeMs;
+            const paneMtimeMs = statSync2(join11(AGENT_DIR, "pane.log")).mtimeMs;
             paneLogFreshAgeMs = Math.max(0, Date.now() - paneMtimeMs);
           } catch {
           }

package/dist/mcp/xero.js

@@ -114409,7 +114409,8 @@ var BrokerCredentialClient = class {
           accessToken: res.data.access_token,
           tenantId: res.data.tenant_id ?? null,
           expiresAt: res.data.expires_at ?? null,
-          grantedScopes: res.data.granted_scopes ?? null
+          grantedScopes: res.data.granted_scopes ?? null,
+          effectiveScopes: res.data.effective_scopes ?? null
         };
       } catch (err) {
         if (err.status !== void 0) throw err;
@@ -120511,38 +120512,80 @@ function writesGoViaBroker() {
   const raw = (process.env.XERO_WRITES_VIA_BROKER ?? "").trim().toLowerCase();
   return raw === "true" || raw === "1" || raw === "yes";
 }
-function ToolFactory(server) {
+var SCOPE_GATES = [
+  { family: /payroll/i, requiresScope: "payroll" }
+];
+function makeToolGate(effectiveScopes) {
+  if (effectiveScopes == null) return () => true;
+  const scopes = effectiveScopes.toLowerCase();
+  return (toolName) => {
+    for (const gate of SCOPE_GATES) {
+      if (gate.family.test(toolName) && !scopes.includes(gate.requiresScope)) {
+        return false;
+      }
+    }
+    return true;
+  };
+}
+function ToolFactory(server, effectiveScopes = null) {
   const readOnly = writesGoViaBroker();
+  const allow = makeToolGate(effectiveScopes);
   if (readOnly) {
     console.error(
       "xero-mcp-server: XERO_WRITES_VIA_BROKER is set \u2014 registering read-only tools only (Get/List). Create/Update/Delete are gated through the Augmented xero-broker (HITL)."
     );
   }
-  GetTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
-  ListTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
+  if (effectiveScopes != null && !effectiveScopes.toLowerCase().includes("payroll")) {
+    console.error(
+      "xero-mcp-server: agent policy excludes payroll scopes \u2014 payroll tools not registered (ENG-7824)."
+    );
+  }
+  GetTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  ListTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
   AttachmentTools.map((tool) => tool()).forEach(
     (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
   );
   if (readOnly) return;
-  DeleteTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
-  CreateTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
-  UpdateTools.map((tool) => tool()).forEach(
-    (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
-  );
+  DeleteTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  CreateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  UpdateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
 }
 
 // src/index.ts
+async function resolveEffectiveScopes() {
+  const host = process.env.AGT_HOST;
+  const agentId = process.env.AGT_AGENT_ID;
+  const integrationId = process.env.AGT_INTEGRATION_ID;
+  const initialToken = process.env.AGT_TOKEN;
+  const apiKey = process.env.AGT_API_KEY;
+  const brokerMode = Boolean(host && agentId && integrationId && (initialToken || apiKey));
+  if (!brokerMode) return null;
+  try {
+    const client = new BrokerCredentialClient({
+      host,
+      initialToken,
+      apiKey,
+      agentId,
+      integrationId
+    });
+    const cred = await Promise.race([
+      client.fetchCredential(),
+      new Promise(
+        (_, reject) => setTimeout(() => reject(new Error("effective-scope resolution timed out")), 8e3)
+      )
+    ]);
+    return cred.effectiveScopes;
+  } catch (err) {
+    console.error(
+      `xero-mcp-server: effective-scope resolution failed, registering all tools (fail-open): ${err.message}`
+    );
+    return null;
+  }
+}
 var main = async () => {
   const server = XeroMcpServer.GetServer();
-  ToolFactory(server);
+  const effectiveScopes = await resolveEffectiveScopes();
+  ToolFactory(server, effectiveScopes);
   const transport = new StdioServerTransport();
   await server.connect(transport);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.329",
+  "version": "0.28.331",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {