@integrity-labs/agt-cli 0.28.440 → 0.28.442

package/dist/mcp/direct-chat-channel.js

@@ -31989,8 +31989,31 @@ var DEFAULT_SCOPES = [
   // links an inbound Slack sender to their organization_people record (inbound
   // identity reconcile). Existing installs without it degrade gracefully - the
   // reconcile no-ops until the bot is re-authorised with the wider scope set.
-  "users:read.email",
-  "users.profile:write"
+  "users:read.email"
+  // ENG-8203: 'users.profile:write' is deliberately NOT here.
+  //
+  // It is registered with `token_type: 'user'` (ENG-4812 — Slack rejects it
+  // under oauth_config.scopes.bot with `illegal_bot_scopes`). The MANIFEST
+  // generator partitions on that flag; the OAuth install-URL builder does not —
+  // `buildSlackAuthorizeUrl` puts every stored scope into `scope=` — so a
+  // default-scoped OAuth install sent a user-only scope as a bot scope and
+  // Slack rejected the whole authorization with "Invalid permissions
+  // requested". That blocked EVERY new install on the default set.
+  //
+  // Removing it rather than routing it to `user_scope=` is deliberate: the
+  // callback destructures `authed_user?: { id?: string }` and persists only the
+  // BOT token (oauth-callback/route.ts:217,246). `authed_user.access_token` is
+  // never read, so asking for the scope would put an extra consent screen in
+  // front of the installing admin and then discard the token it returned.
+  //
+  // Nothing is lost. `users.profile.set` needs an `xoxp-` user token, which no
+  // OAuth-installed agent has ever had — the bot-status/live-presence indicator
+  // only ever worked where an operator pasted a user token into the wizard by
+  // hand, and that path is untouched. The registry definition stays so existing
+  // configs still render and the `token_type: 'user'` knowledge is preserved.
+  //
+  // Wiring the indicator for OAuth installs means persisting
+  // `authed_user.access_token` first, THEN adding `user_scope=`. Separate work.
 ];
 var SLACK_SCOPE_PRESETS = {
   minimal: [

package/dist/mcp/origami.js

@@ -37627,8 +37627,31 @@ var DEFAULT_SCOPES = [
   // links an inbound Slack sender to their organization_people record (inbound
   // identity reconcile). Existing installs without it degrade gracefully - the
   // reconcile no-ops until the bot is re-authorised with the wider scope set.
-  "users:read.email",
-  "users.profile:write"
+  "users:read.email"
+  // ENG-8203: 'users.profile:write' is deliberately NOT here.
+  //
+  // It is registered with `token_type: 'user'` (ENG-4812 — Slack rejects it
+  // under oauth_config.scopes.bot with `illegal_bot_scopes`). The MANIFEST
+  // generator partitions on that flag; the OAuth install-URL builder does not —
+  // `buildSlackAuthorizeUrl` puts every stored scope into `scope=` — so a
+  // default-scoped OAuth install sent a user-only scope as a bot scope and
+  // Slack rejected the whole authorization with "Invalid permissions
+  // requested". That blocked EVERY new install on the default set.
+  //
+  // Removing it rather than routing it to `user_scope=` is deliberate: the
+  // callback destructures `authed_user?: { id?: string }` and persists only the
+  // BOT token (oauth-callback/route.ts:217,246). `authed_user.access_token` is
+  // never read, so asking for the scope would put an extra consent screen in
+  // front of the installing admin and then discard the token it returned.
+  //
+  // Nothing is lost. `users.profile.set` needs an `xoxp-` user token, which no
+  // OAuth-installed agent has ever had — the bot-status/live-presence indicator
+  // only ever worked where an operator pasted a user token into the wizard by
+  // hand, and that path is untouched. The registry definition stays so existing
+  // configs still render and the `token_type: 'user'` knowledge is preserved.
+  //
+  // Wiring the indicator for OAuth installs means persisting
+  // `authed_user.access_token` first, THEN adding `user_scope=`. Separate work.
 ];
 var SLACK_SCOPE_PRESETS = {
   minimal: [

package/dist/mcp/slack-channel.js

@@ -31558,8 +31558,31 @@ var DEFAULT_SCOPES = [
   // links an inbound Slack sender to their organization_people record (inbound
   // identity reconcile). Existing installs without it degrade gracefully - the
   // reconcile no-ops until the bot is re-authorised with the wider scope set.
-  "users:read.email",
-  "users.profile:write"
+  "users:read.email"
+  // ENG-8203: 'users.profile:write' is deliberately NOT here.
+  //
+  // It is registered with `token_type: 'user'` (ENG-4812 — Slack rejects it
+  // under oauth_config.scopes.bot with `illegal_bot_scopes`). The MANIFEST
+  // generator partitions on that flag; the OAuth install-URL builder does not —
+  // `buildSlackAuthorizeUrl` puts every stored scope into `scope=` — so a
+  // default-scoped OAuth install sent a user-only scope as a bot scope and
+  // Slack rejected the whole authorization with "Invalid permissions
+  // requested". That blocked EVERY new install on the default set.
+  //
+  // Removing it rather than routing it to `user_scope=` is deliberate: the
+  // callback destructures `authed_user?: { id?: string }` and persists only the
+  // BOT token (oauth-callback/route.ts:217,246). `authed_user.access_token` is
+  // never read, so asking for the scope would put an extra consent screen in
+  // front of the installing admin and then discard the token it returned.
+  //
+  // Nothing is lost. `users.profile.set` needs an `xoxp-` user token, which no
+  // OAuth-installed agent has ever had — the bot-status/live-presence indicator
+  // only ever worked where an operator pasted a user token into the wizard by
+  // hand, and that path is untouched. The registry definition stays so existing
+  // configs still render and the `token_type: 'user'` knowledge is preserved.
+  //
+  // Wiring the indicator for OAuth installs means persisting
+  // `authed_user.access_token` first, THEN adding `user_scope=`. Separate work.
 ];
 var SLACK_SCOPE_PRESETS = {
   minimal: [

package/dist/mcp/telegram-channel.js

@@ -31860,8 +31860,31 @@ var DEFAULT_SCOPES = [
   // links an inbound Slack sender to their organization_people record (inbound
   // identity reconcile). Existing installs without it degrade gracefully - the
   // reconcile no-ops until the bot is re-authorised with the wider scope set.
-  "users:read.email",
-  "users.profile:write"
+  "users:read.email"
+  // ENG-8203: 'users.profile:write' is deliberately NOT here.
+  //
+  // It is registered with `token_type: 'user'` (ENG-4812 — Slack rejects it
+  // under oauth_config.scopes.bot with `illegal_bot_scopes`). The MANIFEST
+  // generator partitions on that flag; the OAuth install-URL builder does not —
+  // `buildSlackAuthorizeUrl` puts every stored scope into `scope=` — so a
+  // default-scoped OAuth install sent a user-only scope as a bot scope and
+  // Slack rejected the whole authorization with "Invalid permissions
+  // requested". That blocked EVERY new install on the default set.
+  //
+  // Removing it rather than routing it to `user_scope=` is deliberate: the
+  // callback destructures `authed_user?: { id?: string }` and persists only the
+  // BOT token (oauth-callback/route.ts:217,246). `authed_user.access_token` is
+  // never read, so asking for the scope would put an extra consent screen in
+  // front of the installing admin and then discard the token it returned.
+  //
+  // Nothing is lost. `users.profile.set` needs an `xoxp-` user token, which no
+  // OAuth-installed agent has ever had — the bot-status/live-presence indicator
+  // only ever worked where an operator pasted a user token into the wizard by
+  // hand, and that path is untouched. The registry definition stays so existing
+  // configs still render and the `token_type: 'user'` knowledge is preserved.
+  //
+  // Wiring the indicator for OAuth installs means persisting
+  // `authed_user.access_token` first, THEN adding `user_scope=`. Separate work.
 ];
 var SLACK_SCOPE_PRESETS = {
   minimal: [

package/dist/{persistent-session-4MIMM3TN.js → persistent-session-VMWQYV5B.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-R6GVWACQ.js";
+} from "./chunk-XMJ5VMWV.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-4MIMM3TN.js.map
+//# sourceMappingURL=persistent-session-VMWQYV5B.js.map

package/dist/{responsiveness-probe-5SRDBI4B.js → responsiveness-probe-WMJEL7IZ.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-R6GVWACQ.js";
+} from "./chunk-XMJ5VMWV.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -471,4 +471,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-5SRDBI4B.js.map
+//# sourceMappingURL=responsiveness-probe-WMJEL7IZ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.440",
+  "version": "0.28.442",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {