@integrity-labs/agt-cli 0.28.441 → 0.28.442

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-6KTN6GTT.js";
+} from "../chunk-JIZ6Z6EX.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -71,7 +71,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-NQP2W2RD.js";
+} from "../chunk-XMJ5VMWV.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.441" : "dev";
+var cliVersion = true ? "0.28.442" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.441" : "dev";
+var cliVersion2 = true ? "0.28.442" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-6KTN6GTT.js → chunk-JIZ6Z6EX.js}

@@ -29,7 +29,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-NQP2W2RD.js";
+} from "./chunk-XMJ5VMWV.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -4901,7 +4901,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.441" : "dev";
+var agtCliVersion = true ? "0.28.442" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7402,4 +7402,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-6KTN6GTT.js.map
+//# sourceMappingURL=chunk-JIZ6Z6EX.js.map

package/dist/{chunk-NQP2W2RD.js → chunk-XMJ5VMWV.js}

@@ -1325,8 +1325,31 @@ var DEFAULT_SCOPES = [
   // links an inbound Slack sender to their organization_people record (inbound
   // identity reconcile). Existing installs without it degrade gracefully - the
   // reconcile no-ops until the bot is re-authorised with the wider scope set.
-  "users:read.email",
-  "users.profile:write"
+  "users:read.email"
+  // ENG-8203: 'users.profile:write' is deliberately NOT here.
+  //
+  // It is registered with `token_type: 'user'` (ENG-4812 — Slack rejects it
+  // under oauth_config.scopes.bot with `illegal_bot_scopes`). The MANIFEST
+  // generator partitions on that flag; the OAuth install-URL builder does not —
+  // `buildSlackAuthorizeUrl` puts every stored scope into `scope=` — so a
+  // default-scoped OAuth install sent a user-only scope as a bot scope and
+  // Slack rejected the whole authorization with "Invalid permissions
+  // requested". That blocked EVERY new install on the default set.
+  //
+  // Removing it rather than routing it to `user_scope=` is deliberate: the
+  // callback destructures `authed_user?: { id?: string }` and persists only the
+  // BOT token (oauth-callback/route.ts:217,246). `authed_user.access_token` is
+  // never read, so asking for the scope would put an extra consent screen in
+  // front of the installing admin and then discard the token it returned.
+  //
+  // Nothing is lost. `users.profile.set` needs an `xoxp-` user token, which no
+  // OAuth-installed agent has ever had — the bot-status/live-presence indicator
+  // only ever worked where an operator pasted a user token into the wizard by
+  // hand, and that path is untouched. The registry definition stays so existing
+  // configs still render and the `token_type: 'user'` knowledge is preserved.
+  //
+  // Wiring the indicator for OAuth installs means persisting
+  // `authed_user.access_token` first, THEN adding `user_scope=`. Separate work.
 ];
 function getDefaultSlackScopes() {
   return [...DEFAULT_SCOPES];
@@ -14125,4 +14148,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-NQP2W2RD.js.map
+//# sourceMappingURL=chunk-XMJ5VMWV.js.map