@integrity-labs/agt-cli 0.28.706 → 0.28.708

package/dist/mcp/slack-channel.js

@@ -7647,6 +7647,31 @@ var init_snooze = __esm({
 });
 
 // ../core/dist/channels/slack-block-kit.js
+function isFetchableHttpUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    return false;
+  return parsed.hostname.length > 0;
+}
+function isSvgImageUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return false;
+  }
+  let pathname = parsed.pathname;
+  try {
+    pathname = decodeURIComponent(pathname);
+  } catch {
+  }
+  return pathname.toLowerCase().endsWith(".svg");
+}
 function decodeActionId(actionId) {
   const m = ACTION_ID_RE.exec(actionId);
   if (!m)
@@ -7659,11 +7684,12 @@ function isRoutableActionId(actionId) {
 function isLinkButton(element) {
   return typeof element.url === "string" && element.url.length > 0;
 }
-var ACTION_ID_RE, UNROUTABLE_ACTION_ID_MESSAGE;
+var SVG_IMAGE_URL_MESSAGE, ACTION_ID_RE, UNROUTABLE_ACTION_ID_MESSAGE;
 var init_slack_block_kit = __esm({
   "../core/dist/channels/slack-block-kit.js"() {
     "use strict";
     init_snooze();
+    SVG_IMAGE_URL_MESSAGE = "Slack cannot render SVG in an image element \u2014 use a PNG, JPG or GIF (our mirrored logos at logos.augmented.team are PNGs)";
     ACTION_ID_RE = /^aug:([0-9a-f-]{36}):([A-Za-z0-9_-]{1,200})$/;
     UNROUTABLE_ACTION_ID_MESSAGE = "interactive buttons must be created with the `request_buttons` tool \u2014 it mints the `aug:<callback-id>:<token>` action_id that makes a tap routable. A hand-written action_id renders fine but its click is silently dropped: the agent is never notified and the buttons are never swapped for the chosen value. For a non-interactive button, set `url` to make it a link button.";
   }
@@ -22683,10 +22709,37 @@ function validateContextBlock(b, path, push) {
     push(`${path}.elements`, "context requires non-empty `elements` array");
     return;
   }
+  if (elements.length > SLACK_LIMITS.contextElements) {
+    push(`${path}.elements`, `max ${SLACK_LIMITS.contextElements} context elements (got ${elements.length})`);
+  }
   elements.forEach((el, i) => {
-    validateTextObject(el, `${path}.elements[${i}]`, SLACK_LIMITS.sectionTextChars, ["plain_text", "mrkdwn"], push);
+    const elPath = `${path}.elements[${i}]`;
+    const element = el ?? {};
+    if (element.type === "image") {
+      validateContextImageElement(element, elPath, push);
+      return;
+    }
+    validateTextObject(el, elPath, SLACK_LIMITS.sectionTextChars, ["plain_text", "mrkdwn"], push);
   });
 }
+function validateContextImageElement(element, elPath, push) {
+  if (typeof element.image_url !== "string" || element.image_url.length === 0) {
+    push(`${elPath}.image_url`, "image element requires a non-empty image_url");
+  } else {
+    if (!isFetchableHttpUrl(element.image_url)) {
+      push(`${elPath}.image_url`, "image_url must be an http(s) url Slack can fetch");
+    }
+    if (element.image_url.length > SLACK_LIMITS.imageUrlChars) {
+      push(`${elPath}.image_url`, `max ${SLACK_LIMITS.imageUrlChars} chars in image_url (got ${element.image_url.length})`);
+    }
+    if (isSvgImageUrl(element.image_url)) {
+      push(`${elPath}.image_url`, SVG_IMAGE_URL_MESSAGE);
+    }
+  }
+  if (typeof element.alt_text !== "string" || element.alt_text.trim().length === 0) {
+    push(`${elPath}.alt_text`, "image element requires non-empty alt_text");
+  }
+}
 function validateActionsBlock(b, path, push) {
   const elements = b.elements;
   if (!Array.isArray(elements) || elements.length === 0) {
@@ -22860,7 +22913,11 @@ var init_slack_block_kit_runtime = __esm({
       buttonLabelChars: 75,
       identifierChars: 255,
       optionValueChars: 2e3,
-      headerTextChars: 150
+      headerTextChars: 150,
+      // ENG-9548: context limits, matching core's SLACK_LIMITS. Pinned equal by
+      // slack-context-image-validation.test.ts so the two cannot drift silently.
+      contextElements: 10,
+      imageUrlChars: 3e3
     };
     SUPPORTED_BLOCK_TYPES = ["header", "section", "divider", "context", "actions"];
     SUPPORTED_ACTION_ELEMENTS = ["button"];
@@ -39133,6 +39190,131 @@ function emitUrlAsteriskStripTelemetry(channel, count = 0) {
   }
 }
 
+// src/markdown-to-mrkdwn.ts
+function segmentByCode(text) {
+  const segments = [];
+  let plainStart = 0;
+  let i = 0;
+  const pushPlain = (end) => {
+    if (end > plainStart) segments.push({ text: text.slice(plainStart, end), code: false });
+  };
+  while (i < text.length) {
+    if (text[i] !== "`") {
+      i += 1;
+      continue;
+    }
+    let backslashes = 0;
+    for (let j = i - 1; j >= 0 && text[j] === "\\"; j -= 1) backslashes += 1;
+    if (backslashes % 2 === 1) {
+      i += 1;
+      continue;
+    }
+    let runLen = 1;
+    while (text[i + runLen] === "`") runLen += 1;
+    if (runLen >= 3) {
+      const close = text.indexOf("```", i + runLen);
+      const end2 = close === -1 ? text.length : close + 3;
+      pushPlain(i);
+      segments.push({ text: text.slice(i, end2), code: true });
+      plainStart = end2;
+      i = end2;
+      continue;
+    }
+    const afterOpen = i + runLen;
+    const lineEnd = text.indexOf("\n", afterOpen);
+    const windowEnd = lineEnd === -1 ? text.length : lineEnd;
+    const closeIdx = text.slice(afterOpen, windowEnd).indexOf("`".repeat(runLen));
+    if (closeIdx === -1) {
+      i = afterOpen;
+      continue;
+    }
+    const end = afterOpen + closeIdx + runLen;
+    pushPlain(i);
+    segments.push({ text: text.slice(i, end), code: true });
+    plainStart = end;
+    i = end;
+  }
+  pushPlain(text.length);
+  return segments;
+}
+var TARGET = String.raw`(<[^<>]*>|[^()\s]+(?:\([^()\s]*\)[^()\s]*)*)`;
+var TITLE = String.raw`(?:\s+"[^"]*")?`;
+var WHOLE_LINE_BLANK_IMAGE = new RegExp(
+  String.raw`^[ \t]*!\[[ \t]*\]\(\s*${TARGET}${TITLE}\s*\)[ \t]*\r?\n?`,
+  "gm"
+);
+var INLINE_BLANK_IMAGE = new RegExp(
+  String.raw`!\[[ \t]*\]\(\s*${TARGET}${TITLE}\s*\)[ \t]*`,
+  "g"
+);
+var IMAGE = new RegExp(String.raw`!\[([^\]]*)\]\(\s*${TARGET}${TITLE}\s*\)`, "g");
+var LINK = new RegExp(String.raw`(?<!!)\[([^\]]*)\]\(\s*${TARGET}${TITLE}\s*\)`, "g");
+function normalizeTarget(raw) {
+  let url = raw.trim();
+  const slackWrapped = /^<(https?:\/\/[^|>\s]+)(?:\|[^>]*)?>$/i.exec(url);
+  if (slackWrapped?.[1]) {
+    url = slackWrapped[1];
+  } else if (url.startsWith("<") && url.endsWith(">")) {
+    url = url.slice(1, -1).trim();
+  }
+  if (!/^(?:https?:\/\/|mailto:)/i.test(url)) return null;
+  if (/[\s<>|]/.test(url)) return null;
+  return url;
+}
+function escapeLabel(label) {
+  return label.trim().replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function convertProse(input, tally) {
+  let out = input;
+  out = out.replace(WHOLE_LINE_BLANK_IMAGE, () => {
+    tally.images += 1;
+    return "";
+  });
+  out = out.replace(INLINE_BLANK_IMAGE, () => {
+    tally.images += 1;
+    return "";
+  });
+  out = out.replace(IMAGE, (match, alt, target) => {
+    const label = escapeLabel(alt);
+    const url = normalizeTarget(target);
+    tally.images += 1;
+    if (!url) return label;
+    return `<${url}|${label}>`;
+  });
+  out = out.replace(LINK, (match, label, target) => {
+    const url = normalizeTarget(target);
+    if (!url) return match;
+    tally.links += 1;
+    const clean = escapeLabel(label);
+    return clean ? `<${url}|${clean}>` : url;
+  });
+  return out;
+}
+function markdownToMrkdwn(text) {
+  if (!text || !text.includes("](")) {
+    return { text, converted: false, links: 0, images: 0 };
+  }
+  const tally = { links: 0, images: 0 };
+  const out = segmentByCode(text).map((segment) => segment.code ? segment.text : convertProse(segment.text, tally)).join("");
+  const converted = tally.links > 0 || tally.images > 0;
+  return { text: converted ? out : text, converted, links: tally.links, images: tally.images };
+}
+function emitMarkdownToMrkdwnTelemetry(channel, links = 0, images = 0) {
+  const agentCode = process.env.AGT_AGENT_CODE_NAME ?? "unknown";
+  try {
+    process.stderr.write(
+      `agt.egress.markdown_to_mrkdwn_converted ${JSON.stringify({
+        channel,
+        agent_code: agentCode,
+        links,
+        images
+      })}
+`
+    );
+  } catch {
+  }
+}
+
 // src/slack-pending-inbound-cleanup.ts
 import { existsSync as existsSync4, readdirSync as readdirSync4, statSync as statSync3, unlinkSync } from "fs";
 import { join as join9 } from "path";
@@ -42739,7 +42921,9 @@ async function processSlackRecoveryOutboxFile(filename) {
   if (recoveredGuarded.redacted) emitToolCallMarkupRedactionTelemetry("slack");
   const apiErr = rewriteTransientApiError(recoveredGuarded.text);
   if (apiErr.rewritten) emitTransientApiErrorTelemetry("slack", apiErr.match, apiErr.original);
-  const urlFixed = stripUrlWrappingAsterisks(apiErr.text);
+  const mrkdwn = markdownToMrkdwn(apiErr.text);
+  if (mrkdwn.converted) emitMarkdownToMrkdwnTelemetry("slack", mrkdwn.links, mrkdwn.images);
+  const urlFixed = stripUrlWrappingAsterisks(mrkdwn.text);
   if (urlFixed.stripped) emitUrlAsteriskStripTelemetry("slack", urlFixed.count);
   const text = urlFixed.text;
   const ghostReplyMode = resolveGhostReplyMode();
@@ -44911,7 +45095,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
             channel: { type: "string", description: "Slack channel ID" },
             blocks: {
               type: "array",
-              description: "Array of Block Kit blocks. Supported block types: header, section, divider, context, actions. Supported interactive elements (inside actions blocks): button. Hard limits: 50 blocks per message, 5 elements per actions block, 3000 chars per section text, 75 chars per button label."
+              description: 'Array of Block Kit blocks. Supported block types: header, section, divider, context, actions. Supported interactive elements (inside actions blocks): button. IMAGES: a context block is the only way to show one \u2014 message text is mrkdwn, which has no inline image syntax, so `![](url)` never renders. Use { type: "image", image_url, alt_text } (alt_text required) alongside an mrkdwn element, one context block per row, since elements flow as a single wrapping line. image_url must be a PNG, JPG or GIF: Slack does not render SVG. For vendor/product logos use our mirror at logos.augmented.team rather than hotlinking the upstream source (upload.wikimedia.org and friends) \u2014 those are the sync scripts\' INPUT, and three had already rotted before the mirror existed. Hard limits: 50 blocks per message, 10 elements per context block, 5 elements per actions block, 3000 chars per section text, 3000 chars per image_url, 75 chars per button label.'
             },
             text: { type: "string", description: "Plain-text fallback for push notifications and unfurls. Required." },
             thread_ts: { type: "string", description: "Thread timestamp for an existing thread reply (from the thread_ts attribute). Safe to omit: for a channel message the server automatically threads your reply off the message you are answering (via message_ts), and a DM reply posts inline." },
@@ -45317,7 +45501,9 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
     if (sanitizedGuarded.redacted) emitToolCallMarkupRedactionTelemetry("slack");
     const apiErr = rewriteTransientApiError(sanitizedGuarded.text);
     if (apiErr.rewritten) emitTransientApiErrorTelemetry("slack", apiErr.match, apiErr.original);
-    const urlFixed = stripUrlWrappingAsterisks(apiErr.text);
+    const mrkdwn = markdownToMrkdwn(apiErr.text);
+    if (mrkdwn.converted) emitMarkdownToMrkdwnTelemetry("slack", mrkdwn.links, mrkdwn.images);
+    const urlFixed = stripUrlWrappingAsterisks(mrkdwn.text);
     if (urlFixed.stripped) emitUrlAsteriskStripTelemetry("slack", urlFixed.count);
     try {
       const res = await fetch("https://slack.com/api/chat.postMessage", {

package/dist/mcp/telegram-channel.js

@@ -7647,6 +7647,31 @@ var init_snooze = __esm({
 });
 
 // ../core/dist/channels/slack-block-kit.js
+function isFetchableHttpUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    return false;
+  return parsed.hostname.length > 0;
+}
+function isSvgImageUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return false;
+  }
+  let pathname = parsed.pathname;
+  try {
+    pathname = decodeURIComponent(pathname);
+  } catch {
+  }
+  return pathname.toLowerCase().endsWith(".svg");
+}
 function decodeActionId(actionId) {
   const m = ACTION_ID_RE.exec(actionId);
   if (!m)
@@ -7659,11 +7684,12 @@ function isRoutableActionId(actionId) {
 function isLinkButton(element) {
   return typeof element.url === "string" && element.url.length > 0;
 }
-var ACTION_ID_RE, UNROUTABLE_ACTION_ID_MESSAGE;
+var SVG_IMAGE_URL_MESSAGE, ACTION_ID_RE, UNROUTABLE_ACTION_ID_MESSAGE;
 var init_slack_block_kit = __esm({
   "../core/dist/channels/slack-block-kit.js"() {
     "use strict";
     init_snooze();
+    SVG_IMAGE_URL_MESSAGE = "Slack cannot render SVG in an image element \u2014 use a PNG, JPG or GIF (our mirrored logos at logos.augmented.team are PNGs)";
     ACTION_ID_RE = /^aug:([0-9a-f-]{36}):([A-Za-z0-9_-]{1,200})$/;
     UNROUTABLE_ACTION_ID_MESSAGE = "interactive buttons must be created with the `request_buttons` tool \u2014 it mints the `aug:<callback-id>:<token>` action_id that makes a tap routable. A hand-written action_id renders fine but its click is silently dropped: the agent is never notified and the buttons are never swapped for the chosen value. For a non-interactive button, set `url` to make it a link button.";
   }
@@ -22683,10 +22709,37 @@ function validateContextBlock(b, path, push) {
     push(`${path}.elements`, "context requires non-empty `elements` array");
     return;
   }
+  if (elements.length > SLACK_LIMITS.contextElements) {
+    push(`${path}.elements`, `max ${SLACK_LIMITS.contextElements} context elements (got ${elements.length})`);
+  }
   elements.forEach((el, i) => {
-    validateTextObject(el, `${path}.elements[${i}]`, SLACK_LIMITS.sectionTextChars, ["plain_text", "mrkdwn"], push);
+    const elPath = `${path}.elements[${i}]`;
+    const element = el ?? {};
+    if (element.type === "image") {
+      validateContextImageElement(element, elPath, push);
+      return;
+    }
+    validateTextObject(el, elPath, SLACK_LIMITS.sectionTextChars, ["plain_text", "mrkdwn"], push);
   });
 }
+function validateContextImageElement(element, elPath, push) {
+  if (typeof element.image_url !== "string" || element.image_url.length === 0) {
+    push(`${elPath}.image_url`, "image element requires a non-empty image_url");
+  } else {
+    if (!isFetchableHttpUrl(element.image_url)) {
+      push(`${elPath}.image_url`, "image_url must be an http(s) url Slack can fetch");
+    }
+    if (element.image_url.length > SLACK_LIMITS.imageUrlChars) {
+      push(`${elPath}.image_url`, `max ${SLACK_LIMITS.imageUrlChars} chars in image_url (got ${element.image_url.length})`);
+    }
+    if (isSvgImageUrl(element.image_url)) {
+      push(`${elPath}.image_url`, SVG_IMAGE_URL_MESSAGE);
+    }
+  }
+  if (typeof element.alt_text !== "string" || element.alt_text.trim().length === 0) {
+    push(`${elPath}.alt_text`, "image element requires non-empty alt_text");
+  }
+}
 function validateActionsBlock(b, path, push) {
   const elements = b.elements;
   if (!Array.isArray(elements) || elements.length === 0) {
@@ -22860,7 +22913,11 @@ var init_slack_block_kit_runtime = __esm({
       buttonLabelChars: 75,
       identifierChars: 255,
       optionValueChars: 2e3,
-      headerTextChars: 150
+      headerTextChars: 150,
+      // ENG-9548: context limits, matching core's SLACK_LIMITS. Pinned equal by
+      // slack-context-image-validation.test.ts so the two cannot drift silently.
+      contextElements: 10,
+      imageUrlChars: 3e3
     };
     SUPPORTED_BLOCK_TYPES = ["header", "section", "divider", "context", "actions"];
     SUPPORTED_ACTION_ELEMENTS = ["button"];

package/dist/{persistent-session-TPP35O6H.js → persistent-session-GIRGRUMF.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-326G325O.js";
-import "./chunk-QRGNDW6C.js";
+} from "./chunk-VYG4CTEQ.js";
+import "./chunk-NOGQSRQM.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-TPP35O6H.js.map
+//# sourceMappingURL=persistent-session-GIRGRUMF.js.map

package/dist/{responsiveness-probe-3HITHSYU.js → responsiveness-probe-PIRS3LTX.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-326G325O.js";
-import "./chunk-QRGNDW6C.js";
+} from "./chunk-VYG4CTEQ.js";
+import "./chunk-NOGQSRQM.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -745,4 +745,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-3HITHSYU.js.map
+//# sourceMappingURL=responsiveness-probe-PIRS3LTX.js.map

package/dist/{session-auth-dead-LY5264IN.js → session-auth-dead-PYWTMI43.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-QRGNDW6C.js";
+} from "./chunk-NOGQSRQM.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-LY5264IN.js.map
+//# sourceMappingURL=session-auth-dead-PYWTMI43.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.706",
+  "version": "0.28.708",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {