@integrity-labs/agt-cli 0.28.330 → 0.28.332

package/dist/mcp/teams-channel.js

@@ -13865,19 +13865,19 @@ var StdioServerTransport = class {
 
 // src/teams-channel.ts
 import {
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync4,
-  renameSync,
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync5,
+  renameSync as renameSync2,
   rmSync,
   statSync,
-  unlinkSync,
+  unlinkSync as unlinkSync2,
   watch,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join5, resolve as resolvePath2 } from "path";
+import { join as join7, resolve as resolvePath2 } from "path";
 import { basename } from "path";
 
 // src/slack-loop-throttle.ts
@@ -15133,6 +15133,59 @@ function isThreadEntry(value) {
   return (v.involvement === "started" || v.involvement === "mentioned") && typeof v.last_seen_at === "string";
 }
 
+// src/recovery-ledger.ts
+import { existsSync as existsSync4, unlinkSync } from "fs";
+import { join as join5 } from "path";
+function removeRecoveryLedgerEntry(ledgerDir, markerName, unlink = (p) => {
+  if (existsSync4(p)) unlinkSync(p);
+}) {
+  if (!ledgerDir || !markerName) return;
+  if (markerName.includes("/") || markerName.includes("\\") || markerName.includes("..")) return;
+  try {
+    unlink(join5(ledgerDir, markerName));
+  } catch {
+  }
+}
+
+// src/inbound-delivery-ledger.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, renameSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
+function safeInboundId(inboundId) {
+  return inboundId.replace(/[^A-Za-z0-9_-]/g, "_");
+}
+var defaultDeps = {
+  mkdir: (dir) => mkdirSync4(dir, { recursive: true }),
+  writeFile: (path, data) => writeFileSync5(path, data, "utf8"),
+  rename: (from, to) => renameSync(from, to),
+  readdir: (dir) => readdirSync2(dir),
+  readFile: (path) => readFileSync4(path, "utf8"),
+  exists: (path) => existsSync5(path)
+};
+function writeInboundDeliveryLedgerEntry(dir, record2, deps = defaultDeps) {
+  if (!dir || !record2.inbound_id || !record2.conv_key) return;
+  const safe = safeInboundId(record2.inbound_id);
+  if (!safe || safe.includes("/") || safe.includes("\\") || safe.includes("..")) return;
+  try {
+    deps.mkdir(dir);
+    const final = join6(dir, `${safe}.json`);
+    const tmp = `${final}.tmp`;
+    deps.writeFile(tmp, JSON.stringify(record2));
+    deps.rename(tmp, final);
+  } catch {
+  }
+}
+
+// src/channel-inbound-id.ts
+import { createHash } from "crypto";
+var INBOUND_ID_HEX_LEN = 12;
+function hashInboundId(payload) {
+  const digest = createHash("sha256").update(payload).digest("hex").slice(0, INBOUND_ID_HEX_LEN);
+  return `ib_${digest}`;
+}
+function teamsInboundId(conversationId, activityId) {
+  return hashInboundId(`${conversationId}|${activityId}`);
+}
+
 // src/teams-channel.ts
 var APP_ID = process.env.MSTEAMS_APP_ID ?? null;
 var CLIENT_SECRET = process.env.MSTEAMS_CLIENT_SECRET ?? null;
@@ -15216,7 +15269,7 @@ var ADAPTIVE_CARDS_ENABLED = process.env.MSTEAMS_ADAPTIVE_CARDS_ENABLED === "tru
 var ADAPTIVE_CARDS_ASK_USER_ENABLED = process.env.MSTEAMS_ADAPTIVE_CARDS_ASK_USER_ENABLED === "true";
 var ASK_USER_DEFAULT_TIMEOUT_SECONDS = 300;
 var ASK_USER_POLL_INTERVAL_MS = 1e3;
-var PROJECT_DIR = AGENT_CODE_NAME ? resolvePath2(join5(homedir3(), ".augmented", AGENT_CODE_NAME, "project")) : null;
+var PROJECT_DIR = AGENT_CODE_NAME ? resolvePath2(join7(homedir3(), ".augmented", AGENT_CODE_NAME, "project")) : null;
 var MAX_UPLOAD_BYTES = 4 * 1024 * 1024;
 var AAD_TOKEN_URL = (tenantId) => `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`;
 var BOT_FRAMEWORK_SCOPE = "https://api.botframework.com/.default";
@@ -15336,7 +15389,7 @@ var trackedThreads = /* @__PURE__ */ new Map();
 var threadPersister = null;
 function threadStorePath() {
   if (!AGENT_CODE_NAME) return null;
-  return join5(homedir3(), ".augmented", AGENT_CODE_NAME, "msteams-tracked-threads.json");
+  return join7(homedir3(), ".augmented", AGENT_CODE_NAME, "msteams-tracked-threads.json");
 }
 function loadTrackedThreads() {
   const path = threadStorePath();
@@ -15381,14 +15434,14 @@ function rememberThread(conversationId, serviceUrl, mode, activityId) {
   });
   threadPersister?.schedule(trackedThreads);
 }
-var AGENT_DIR = AGENT_CODE_NAME ? join5(homedir3(), ".augmented", AGENT_CODE_NAME) : null;
-var PENDING_INBOUND_DIR = AGENT_DIR ? join5(AGENT_DIR, "msteams-pending-inbound") : null;
-var PROCESSED_DIR = PENDING_INBOUND_DIR ? join5(PENDING_INBOUND_DIR, ".processed") : null;
+var AGENT_DIR = AGENT_CODE_NAME ? join7(homedir3(), ".augmented", AGENT_CODE_NAME) : null;
+var PENDING_INBOUND_DIR = AGENT_DIR ? join7(AGENT_DIR, "msteams-pending-inbound") : null;
+var PROCESSED_DIR = PENDING_INBOUND_DIR ? join7(PENDING_INBOUND_DIR, ".processed") : null;
 function ensurePendingDirs() {
   if (!PENDING_INBOUND_DIR || !PROCESSED_DIR) return;
   try {
-    mkdirSync4(PENDING_INBOUND_DIR, { recursive: true });
-    mkdirSync4(PROCESSED_DIR, { recursive: true });
+    mkdirSync5(PENDING_INBOUND_DIR, { recursive: true });
+    mkdirSync5(PROCESSED_DIR, { recursive: true });
   } catch (err) {
     process.stderr.write(
       `teams-channel: failed to ensure pending-inbound dir (${err.message})
@@ -15399,10 +15452,10 @@ function ensurePendingDirs() {
 async function processPendingFile(filename) {
   if (!PENDING_INBOUND_DIR || !PROCESSED_DIR) return;
   if (!filename.endsWith(".json")) return;
-  const fullPath = join5(PENDING_INBOUND_DIR, filename);
+  const fullPath = join7(PENDING_INBOUND_DIR, filename);
   let activity;
   try {
-    const raw = readFileSync4(fullPath, "utf8");
+    const raw = readFileSync5(fullPath, "utf8");
     activity = JSON.parse(raw);
   } catch (err) {
     process.stderr.write(
@@ -15411,7 +15464,7 @@ async function processPendingFile(filename) {
     );
     if (PROCESSED_DIR) {
       try {
-        renameSync(fullPath, join5(PROCESSED_DIR, `${filename}.invalid`));
+        renameSync2(fullPath, join7(PROCESSED_DIR, `${filename}.invalid`));
       } catch {
       }
     }
@@ -15425,7 +15478,7 @@ async function processPendingFile(filename) {
     peerAgentMode: PEER_AGENT_MODE
   });
   try {
-    renameSync(fullPath, join5(PROCESSED_DIR, filename));
+    renameSync2(fullPath, join7(PROCESSED_DIR, filename));
   } catch {
     return;
   }
@@ -15581,7 +15634,7 @@ function startPendingInboundWatcher() {
   }
   ensurePendingDirs();
   try {
-    const entries = readdirSync2(PENDING_INBOUND_DIR).filter((f) => f.endsWith(".json")).map((f) => ({ f, m: safeMtimeMs(join5(PENDING_INBOUND_DIR, f)) })).sort((a, b) => a.m - b.m).map((e) => e.f);
+    const entries = readdirSync3(PENDING_INBOUND_DIR).filter((f) => f.endsWith(".json")).map((f) => ({ f, m: safeMtimeMs(join7(PENDING_INBOUND_DIR, f)) })).sort((a, b) => a.m - b.m).map((e) => e.f);
     for (const f of entries) {
       void processPendingFile(f).catch((err) => {
         process.stderr.write(
@@ -15606,7 +15659,7 @@ function startPendingInboundWatcher() {
     if (!name || typeof name !== "string") return;
     if (!name.endsWith(".json")) return;
     if (name.startsWith(".")) return;
-    const fullPath = join5(PENDING_INBOUND_DIR, name);
+    const fullPath = join7(PENDING_INBOUND_DIR, name);
     try {
       statSync(fullPath);
     } catch {
@@ -15863,6 +15916,12 @@ async function handleReply(args) {
     });
     recordReply(conversationId, throttleKey, now, throttleCfg);
     clearPendingMarkersForConversation(conversationId);
+    writeInboundDeliveryLedgerEntry(DELIVERY_LEDGER_DIR, {
+      inbound_id: teamsInboundId(conversationId, replyToId ?? ""),
+      source: "msteams",
+      conv_key: conversationId,
+      delivered_at: (/* @__PURE__ */ new Date()).toISOString()
+    });
     if (THREAD_AUTO_FOLLOW !== "off") {
       rememberThread(conversationId, serviceUrl, replyToId ? "mentioned" : "started", result.id);
     }
@@ -16025,11 +16084,11 @@ function optionalStringArg(args, key2) {
 function errResult(text) {
   return { content: [{ type: "text", text }], isError: true };
 }
-var PENDING_INTERACTIONS_DIR = AGENT_DIR ? join5(AGENT_DIR, "msteams-pending-interactions") : null;
+var PENDING_INTERACTIONS_DIR = AGENT_DIR ? join7(AGENT_DIR, "msteams-pending-interactions") : null;
 function ensurePendingInteractionsDir() {
   if (!PENDING_INTERACTIONS_DIR) return;
   try {
-    mkdirSync4(PENDING_INTERACTIONS_DIR, { recursive: true });
+    mkdirSync5(PENDING_INTERACTIONS_DIR, { recursive: true });
   } catch (err) {
     process.stderr.write(
       `teams-channel: failed to ensure pending-interactions dir (${err.message})
@@ -16040,16 +16099,16 @@ function ensurePendingInteractionsDir() {
 function writePendingInteraction(entry) {
   if (!PENDING_INTERACTIONS_DIR) return;
   ensurePendingInteractionsDir();
-  writeFileSync5(
-    join5(PENDING_INTERACTIONS_DIR, `${entry.interaction_id}.json`),
+  writeFileSync6(
+    join7(PENDING_INTERACTIONS_DIR, `${entry.interaction_id}.json`),
     JSON.stringify(entry, null, 2)
   );
 }
 function readInteractionAnswer(interactionId) {
   if (!PENDING_INTERACTIONS_DIR) return null;
-  const path = join5(PENDING_INTERACTIONS_DIR, `${interactionId}.answer.json`);
+  const path = join7(PENDING_INTERACTIONS_DIR, `${interactionId}.answer.json`);
   try {
-    const raw = readFileSync4(path, "utf8");
+    const raw = readFileSync5(path, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.value !== "string") return null;
     return {
@@ -16071,9 +16130,9 @@ function readInteractionAnswer(interactionId) {
 function clearPendingInteraction(interactionId) {
   if (!PENDING_INTERACTIONS_DIR) return;
   for (const suffix of [".json", ".answer.json"]) {
-    const path = join5(PENDING_INTERACTIONS_DIR, `${interactionId}${suffix}`);
+    const path = join7(PENDING_INTERACTIONS_DIR, `${interactionId}${suffix}`);
     try {
-      unlinkSync(path);
+      unlinkSync2(path);
     } catch (err) {
       const code = err.code;
       if (code !== "ENOENT") {
@@ -16235,7 +16294,7 @@ async function handleUploadFile(args) {
     );
   }
   try {
-    buffer = readFileSync4(sandboxed.resolved);
+    buffer = readFileSync5(sandboxed.resolved);
   } catch (err) {
     return errResult(`Failed to read file: ${err.message}`);
   }
@@ -16278,8 +16337,10 @@ async function handleUploadFile(args) {
     return errResult(`Failed: ${err.message}`);
   }
 }
-var PENDING_MARKER_DIR = PENDING_INBOUND_DIR ? join5(PENDING_INBOUND_DIR, ".markers") : null;
-var RECOVERY_OUTBOX_DIR = AGENT_DIR ? join5(AGENT_DIR, "msteams-recovery-outbox") : null;
+var PENDING_MARKER_DIR = PENDING_INBOUND_DIR ? join7(PENDING_INBOUND_DIR, ".markers") : null;
+var RECOVERY_OUTBOX_DIR = AGENT_DIR ? join7(AGENT_DIR, "msteams-recovery-outbox") : null;
+var RECOVERY_LEDGER_DIR = AGENT_DIR ? join7(AGENT_DIR, ".agt-msteams-recovery-ledger") : null;
+var DELIVERY_LEDGER_DIR = AGENT_DIR ? join7(AGENT_DIR, ".agt-inbound-delivery-ledger") : null;
 var STALE_MARKER_MS = 24 * 60 * 60 * 1e3;
 var RECOVERY_RETRY_SCAN_INTERVAL_MS = 6e4;
 var RECOVERY_RETRY_BACKOFFS_MS = [6e4, 12e4, 24e4];
@@ -16288,7 +16349,7 @@ function ensureGhostReplyDirs() {
   for (const dir of [PENDING_MARKER_DIR, RECOVERY_OUTBOX_DIR]) {
     if (!dir) continue;
     try {
-      mkdirSync4(dir, { recursive: true });
+      mkdirSync5(dir, { recursive: true });
     } catch (err) {
       process.stderr.write(
         `teams-channel: failed to ensure ${dir} (${err.message})
@@ -16306,8 +16367,8 @@ function writePendingMarker(activity) {
   ensureGhostReplyDirs();
   const name = safeMarkerName(activity.conversation.id, activity.id);
   try {
-    writeFileSync5(
-      join5(PENDING_MARKER_DIR, name),
+    writeFileSync6(
+      join7(PENDING_MARKER_DIR, name),
       JSON.stringify(
         {
           conversation_id: activity.conversation.id,
@@ -16315,7 +16376,10 @@ function writePendingMarker(activity) {
           activity_id: activity.id,
           from: activity.from,
           text: activity.text,
-          received_at: (/* @__PURE__ */ new Date()).toISOString()
+          received_at: (/* @__PURE__ */ new Date()).toISOString(),
+          // ENG-7806 (fm1): deterministic inbound id (marker-semantics-neutral);
+          // the Stop hook reads it to look up the inbound-delivery ledger.
+          inbound_id: teamsInboundId(activity.conversation.id, activity.id ?? "")
         },
         null,
         2
@@ -16333,14 +16397,14 @@ function clearPendingMarkersForConversation(conversationId) {
   const safe = Buffer.from(conversationId, "utf8").toString("hex").slice(0, 64);
   let entries;
   try {
-    entries = readdirSync2(PENDING_MARKER_DIR);
+    entries = readdirSync3(PENDING_MARKER_DIR);
   } catch {
     return;
   }
   for (const f of entries) {
     if (f.startsWith(`${safe}--`)) {
       try {
-        unlinkSync(join5(PENDING_MARKER_DIR, f));
+        unlinkSync2(join7(PENDING_MARKER_DIR, f));
       } catch {
       }
     }
@@ -16350,18 +16414,18 @@ function sweepStaleMarkersOnBoot() {
   if (!PENDING_MARKER_DIR) return;
   let entries;
   try {
-    entries = readdirSync2(PENDING_MARKER_DIR);
+    entries = readdirSync3(PENDING_MARKER_DIR);
   } catch {
     return;
   }
   let pruned = 0;
   const now = Date.now();
   for (const f of entries) {
-    const path = join5(PENDING_MARKER_DIR, f);
+    const path = join7(PENDING_MARKER_DIR, f);
     try {
       const stats = statSync(path);
       if (now - stats.mtimeMs > STALE_MARKER_MS) {
-        unlinkSync(path);
+        unlinkSync2(path);
         pruned++;
       }
     } catch {
@@ -16389,17 +16453,17 @@ function recoveryNextAttempt(filename) {
 }
 async function processRecoveryFile(filename) {
   if (!RECOVERY_OUTBOX_DIR) return;
-  const fullPath = join5(RECOVERY_OUTBOX_DIR, filename);
+  const fullPath = join7(RECOVERY_OUTBOX_DIR, filename);
   let payload;
   try {
-    payload = JSON.parse(readFileSync4(fullPath, "utf8"));
+    payload = JSON.parse(readFileSync5(fullPath, "utf8"));
   } catch (err) {
     process.stderr.write(
       `teams-channel: recovery file ${filename} unreadable (${err.message}) \u2014 dropping
 `
     );
     try {
-      unlinkSync(fullPath);
+      unlinkSync2(fullPath);
     } catch {
     }
     return;
@@ -16407,8 +16471,10 @@ async function processRecoveryFile(filename) {
   if (!isRecoveryPayload(payload)) {
     process.stderr.write(`teams-channel: recovery file ${filename} malformed \u2014 dropping
 `);
+    const malformedMarker = typeof payload === "object" && payload && "marker_name" in payload ? payload.marker_name : void 0;
+    removeRecoveryLedgerEntry(RECOVERY_LEDGER_DIR, malformedMarker);
     try {
-      unlinkSync(fullPath);
+      unlinkSync2(fullPath);
     } catch {
     }
     return;
@@ -16433,8 +16499,9 @@ async function processRecoveryFile(filename) {
     );
     if (decision.action === "suppress") {
       clearPendingMarkersForConversation(payload.conversation_id);
+      removeRecoveryLedgerEntry(RECOVERY_LEDGER_DIR, payload.marker_name);
       try {
-        unlinkSync(fullPath);
+        unlinkSync2(fullPath);
       } catch {
       }
       return;
@@ -16446,8 +16513,10 @@ async function processRecoveryFile(filename) {
       text: apiErr.text,
       ...payload.reply_to_id ? { replyToId: payload.reply_to_id } : {}
     });
+    clearPendingMarkersForConversation(payload.conversation_id);
+    removeRecoveryLedgerEntry(RECOVERY_LEDGER_DIR, payload.marker_name);
     try {
-      unlinkSync(fullPath);
+      unlinkSync2(fullPath);
     } catch {
     }
     process.stderr.write(`teams-channel: recovery delivered ${filename}
@@ -16459,14 +16528,15 @@ async function processRecoveryFile(filename) {
         `teams-channel: recovery ${filename} exhausted retries (${err.message}) \u2014 dropping
 `
       );
+      removeRecoveryLedgerEntry(RECOVERY_LEDGER_DIR, payload.marker_name);
       try {
-        unlinkSync(fullPath);
+        unlinkSync2(fullPath);
       } catch {
       }
       return;
     }
     try {
-      renameSync(fullPath, join5(RECOVERY_OUTBOX_DIR, next.next));
+      renameSync2(fullPath, join7(RECOVERY_OUTBOX_DIR, next.next));
       process.stderr.write(
         `teams-channel: recovery ${filename} \u2192 attempt ${next.attempt} (${err.message})
 `
@@ -16488,11 +16558,11 @@ function startRecoveryOutboxWatcher() {
   ensureGhostReplyDirs();
   const scan = () => {
     try {
-      const entries = readdirSync2(RECOVERY_OUTBOX_DIR);
+      const entries = readdirSync3(RECOVERY_OUTBOX_DIR);
       for (const f of entries) {
         if (!f.endsWith(".json")) continue;
         if (f.startsWith(".")) continue;
-        const path = join5(RECOVERY_OUTBOX_DIR, f);
+        const path = join7(RECOVERY_OUTBOX_DIR, f);
         let mtimeMs;
         try {
           mtimeMs = statSync(path).mtimeMs;
@@ -16517,7 +16587,7 @@ function startRecoveryOutboxWatcher() {
     if (!name || typeof name !== "string") return;
     if (!name.endsWith(".json")) return;
     if (name.startsWith(".")) return;
-    const path = join5(RECOVERY_OUTBOX_DIR, name);
+    const path = join7(RECOVERY_OUTBOX_DIR, name);
     let mtimeMs;
     try {
       mtimeMs = statSync(path).mtimeMs;
@@ -16583,7 +16653,7 @@ ensureGhostReplyDirs();
 sweepStaleMarkersOnBoot();
 startPendingInboundWatcher();
 startRecoveryOutboxWatcher();
-var NOTICE_OUTBOX_DIR = AGENT_DIR ? join5(AGENT_DIR, "msteams-notice-outbox") : null;
+var NOTICE_OUTBOX_DIR = AGENT_DIR ? join7(AGENT_DIR, "msteams-notice-outbox") : null;
 var NOTICE_MAX_AGE_MS = 9e4;
 function isNoticePayload(value) {
   if (!value || typeof value !== "object") return false;
@@ -16597,7 +16667,7 @@ async function processNoticeFile(filename) {
   if (filename.startsWith(".") || filename.endsWith(".tmp") || !filename.endsWith(".json")) return;
   if (NOTICE_INFLIGHT.has(filename)) return;
   NOTICE_INFLIGHT.add(filename);
-  const fullPath = join5(NOTICE_OUTBOX_DIR, filename);
+  const fullPath = join7(NOTICE_OUTBOX_DIR, filename);
   try {
     let mtimeMs;
     try {
@@ -16607,24 +16677,24 @@ async function processNoticeFile(filename) {
     }
     if (Date.now() - mtimeMs > NOTICE_MAX_AGE_MS) {
       try {
-        unlinkSync(fullPath);
+        unlinkSync2(fullPath);
       } catch {
       }
       return;
     }
     let payload;
     try {
-      payload = JSON.parse(readFileSync4(fullPath, "utf8"));
+      payload = JSON.parse(readFileSync5(fullPath, "utf8"));
     } catch {
       try {
-        unlinkSync(fullPath);
+        unlinkSync2(fullPath);
       } catch {
       }
       return;
     }
     if (!isNoticePayload(payload)) {
       try {
-        unlinkSync(fullPath);
+        unlinkSync2(fullPath);
       } catch {
       }
       return;
@@ -16635,7 +16705,7 @@ async function processNoticeFile(filename) {
       defaultValue: false
     })) {
       try {
-        unlinkSync(fullPath);
+        unlinkSync2(fullPath);
       } catch {
       }
       return;
@@ -16655,7 +16725,7 @@ async function processNoticeFile(filename) {
       );
     }
     try {
-      unlinkSync(fullPath);
+      unlinkSync2(fullPath);
     } catch {
     }
   } finally {
@@ -16665,20 +16735,20 @@ async function processNoticeFile(filename) {
 function startNoticeOutboxWatcher() {
   if (!NOTICE_OUTBOX_DIR) return;
   try {
-    mkdirSync4(NOTICE_OUTBOX_DIR, { recursive: true, mode: 448 });
+    mkdirSync5(NOTICE_OUTBOX_DIR, { recursive: true, mode: 448 });
   } catch (err) {
     process.stderr.write(`teams-channel: notice outbox mkdir failed (${err.message})
 `);
     return;
   }
   try {
-    for (const f of readdirSync2(NOTICE_OUTBOX_DIR)) void processNoticeFile(f);
+    for (const f of readdirSync3(NOTICE_OUTBOX_DIR)) void processNoticeFile(f);
   } catch {
   }
   try {
     const w = watch(NOTICE_OUTBOX_DIR, (_event, name) => {
       if (!name) return;
-      if (existsSync4(join5(NOTICE_OUTBOX_DIR, name))) void processNoticeFile(name);
+      if (existsSync6(join7(NOTICE_OUTBOX_DIR, name))) void processNoticeFile(name);
     });
     w.unref?.();
   } catch (err) {