@integrity-labs/agt-cli 0.28.732 → 0.28.734

package/dist/mcp/direct-chat-channel.js

@@ -29878,11 +29878,19 @@ function buildDirectChatChannelMeta(input) {
   if (input.userName) identity.user_name = input.userName;
   if (input.userEmail) identity.user_email = input.userEmail;
   if (input.userRole) identity.user_role = input.userRole;
+  const page = {};
+  if (input.pageSlug) page.page_slug = input.pageSlug;
+  if (input.pageTitle) page.page_title = input.pageTitle;
+  if (input.pageUrl) page.page_url = input.pageUrl;
+  if (input.pageContentUrl) page.page_content_url = input.pageContentUrl;
+  if (input.pageArtefactId) page.page_artefact_id = input.pageArtefactId;
+  if (input.pageGated != null) page.page_gated = input.pageGated ? "true" : "false";
   return {
     session_id: input.sessionId,
     user: "webapp",
     source: "direct-chat",
     ...identity,
+    ...page,
     // String flag the agent's channel instructions (and the renderer) read:
     // 'false' = notice (do not reply), 'true' = normal message (reply expected).
     requires_reply: input.isNotice ? "false" : "true",
@@ -31876,7 +31884,11 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    // ENG-9486 (ADR-0074). Authoring is owner+admin, matching every other action
+    // that can write a secret or change what an org is billed for.
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   admin: [
     "org.manage_settings",
@@ -31884,7 +31896,9 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   member: [
     "org.manage_teams",
@@ -36577,7 +36591,22 @@ var FLAG_REGISTRY = [
     // seeding code, so `listNewOrgFlagOverrides()` is the one answer to "which flags
     // does a new org get". `defaultValue` stays false so the ~4 months of orgs already
     // carrying an inert enforce-level email.require_approval row are NOT armed on deploy.
-    newOrgOverride: true
+    newOrgOverride: true,
+    // ENG-9630: API-created organizations only, and this is a deliberate,
+    // reviewed asymmetry rather than an oversight.
+    //
+    // Arming this holds EVERY dispatching send for human approval. The hold
+    // itself works fine on a self-serve org — `hitl-approval-routing` has
+    // defaulted to 'on' since ENG-7828, so a real Human Approval card is minted
+    // and it is actionable at /organization/approvals. What a self-serve org
+    // does NOT have is any means of being TOLD: no Slack alert channel is wired
+    // at signup, so the card sits in a console surface nobody has pointed the
+    // user at, and their agent's first email silently waits on it.
+    //
+    // So the blocker is the notification path, not the control. Whoever revisits
+    // this should treat "a self-serve org actually receives the card" as the
+    // prerequisite and then drop this line — do not simply widen it.
+    newOrgOverrideOrigins: ["api"]
   },
   {
     key: "mail-rule-control-enforcement",
@@ -39199,7 +39228,17 @@ async function pollForMessages(sinceMs) {
               // ENG-8047: pure passthrough of the server-resolved human identity.
               userName: msg.sender_name,
               userEmail: msg.sender_email,
-              userRole: msg.sender_role
+              userRole: msg.sender_role,
+              // ENG-9518: pure passthrough, same as the identity block. The
+              // server already decided what this agent may know about the page,
+              // including withholding the content URL on a gated page it does
+              // not own, so there is nothing left to judge here.
+              pageArtefactId: msg.page_context?.artefact_id ?? null,
+              pageSlug: msg.page_context?.slug ?? null,
+              pageTitle: msg.page_context?.title ?? null,
+              pageUrl: msg.page_context?.live_url ?? null,
+              pageContentUrl: msg.page_context?.content_url ?? null,
+              pageGated: msg.page_context?.gated ?? null
             }),
             ...attachmentMeta
           }

package/dist/mcp/index.js

@@ -39276,7 +39276,11 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    // ENG-9486 (ADR-0074). Authoring is owner+admin, matching every other action
+    // that can write a secret or change what an org is billed for.
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   admin: [
     "org.manage_settings",
@@ -39284,7 +39288,9 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   member: [
     "org.manage_teams",
@@ -43538,7 +43544,22 @@ var FLAG_REGISTRY = [
     // seeding code, so `listNewOrgFlagOverrides()` is the one answer to "which flags
     // does a new org get". `defaultValue` stays false so the ~4 months of orgs already
     // carrying an inert enforce-level email.require_approval row are NOT armed on deploy.
-    newOrgOverride: true
+    newOrgOverride: true,
+    // ENG-9630: API-created organizations only, and this is a deliberate,
+    // reviewed asymmetry rather than an oversight.
+    //
+    // Arming this holds EVERY dispatching send for human approval. The hold
+    // itself works fine on a self-serve org — `hitl-approval-routing` has
+    // defaulted to 'on' since ENG-7828, so a real Human Approval card is minted
+    // and it is actionable at /organization/approvals. What a self-serve org
+    // does NOT have is any means of being TOLD: no Slack alert channel is wired
+    // at signup, so the card sits in a console surface nobody has pointed the
+    // user at, and their agent's first email silently waits on it.
+    //
+    // So the blocker is the notification path, not the control. Whoever revisits
+    // this should treat "a self-serve org actually receives the card" as the
+    // prerequisite and then drop this line — do not simply widen it.
+    newOrgOverrideOrigins: ["api"]
   },
   {
     key: "mail-rule-control-enforcement",

package/dist/mcp/origami.js

@@ -38068,7 +38068,11 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    // ENG-9486 (ADR-0074). Authoring is owner+admin, matching every other action
+    // that can write a secret or change what an org is billed for.
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   admin: [
     "org.manage_settings",
@@ -38076,7 +38080,9 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   member: [
     "org.manage_teams",
@@ -42309,7 +42315,22 @@ var FLAG_REGISTRY = [
     // seeding code, so `listNewOrgFlagOverrides()` is the one answer to "which flags
     // does a new org get". `defaultValue` stays false so the ~4 months of orgs already
     // carrying an inert enforce-level email.require_approval row are NOT armed on deploy.
-    newOrgOverride: true
+    newOrgOverride: true,
+    // ENG-9630: API-created organizations only, and this is a deliberate,
+    // reviewed asymmetry rather than an oversight.
+    //
+    // Arming this holds EVERY dispatching send for human approval. The hold
+    // itself works fine on a self-serve org — `hitl-approval-routing` has
+    // defaulted to 'on' since ENG-7828, so a real Human Approval card is minted
+    // and it is actionable at /organization/approvals. What a self-serve org
+    // does NOT have is any means of being TOLD: no Slack alert channel is wired
+    // at signup, so the card sits in a console surface nobody has pointed the
+    // user at, and their agent's first email silently waits on it.
+    //
+    // So the blocker is the notification path, not the control. Whoever revisits
+    // this should treat "a self-serve org actually receives the card" as the
+    // prerequisite and then drop this line — do not simply widen it.
+    newOrgOverrideOrigins: ["api"]
   },
   {
     key: "mail-rule-control-enforcement",

package/dist/mcp/slack-channel.js

@@ -30477,6 +30477,9 @@ function decideInboundAccess(input) {
   if (input.orgBoundary && !input.orgBoundary.forward) {
     return { kind: "drop", reason: "org_boundary" };
   }
+  if (input.chatType && !input.chatType.forward) {
+    return { kind: "drop", reason: "chat_type" };
+  }
   if (input.senderPolicy && !input.senderPolicy.forward) {
     const reason = input.senderPolicy.reason;
     const declineWorthy = input.sameOrg && reason !== "internal_only";
@@ -32175,7 +32178,11 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    // ENG-9486 (ADR-0074). Authoring is owner+admin, matching every other action
+    // that can write a secret or change what an org is billed for.
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   admin: [
     "org.manage_settings",
@@ -32183,7 +32190,9 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   member: [
     "org.manage_teams",
@@ -36829,7 +36838,22 @@ var FLAG_REGISTRY = [
     // seeding code, so `listNewOrgFlagOverrides()` is the one answer to "which flags
     // does a new org get". `defaultValue` stays false so the ~4 months of orgs already
     // carrying an inert enforce-level email.require_approval row are NOT armed on deploy.
-    newOrgOverride: true
+    newOrgOverride: true,
+    // ENG-9630: API-created organizations only, and this is a deliberate,
+    // reviewed asymmetry rather than an oversight.
+    //
+    // Arming this holds EVERY dispatching send for human approval. The hold
+    // itself works fine on a self-serve org — `hitl-approval-routing` has
+    // defaulted to 'on' since ENG-7828, so a real Human Approval card is minted
+    // and it is actionable at /organization/approvals. What a self-serve org
+    // does NOT have is any means of being TOLD: no Slack alert channel is wired
+    // at signup, so the card sits in a console surface nobody has pointed the
+    // user at, and their agent's first email silently waits on it.
+    //
+    // So the blocker is the notification path, not the control. Whoever revisits
+    // this should treat "a self-serve org actually receives the card" as the
+    // prerequisite and then drop this line — do not simply widen it.
+    newOrgOverrideOrigins: ["api"]
   },
   {
     key: "mail-rule-control-enforcement",

package/dist/mcp/teams-channel.js

@@ -14930,6 +14930,9 @@ function decideInboundAccess(input) {
   if (input.orgBoundary && !input.orgBoundary.forward) {
     return { kind: "drop", reason: "org_boundary" };
   }
+  if (input.chatType && !input.chatType.forward) {
+    return { kind: "drop", reason: "chat_type" };
+  }
   if (input.senderPolicy && !input.senderPolicy.forward) {
     const reason = input.senderPolicy.reason;
     const declineWorthy = input.sameOrg && reason !== "internal_only";

package/dist/mcp/telegram-channel.js

@@ -30709,6 +30709,9 @@ function decideInboundAccess(input) {
   if (input.orgBoundary && !input.orgBoundary.forward) {
     return { kind: "drop", reason: "org_boundary" };
   }
+  if (input.chatType && !input.chatType.forward) {
+    return { kind: "drop", reason: "chat_type" };
+  }
   if (input.senderPolicy && !input.senderPolicy.forward) {
     const reason = input.senderPolicy.reason;
     const declineWorthy = input.sameOrg && reason !== "internal_only";
@@ -30737,12 +30740,14 @@ function decideInboundAccess(input) {
   return { kind: "admit" };
 }
 
-// src/onboarding-dm-gate.ts
-var ONBOARDING_DM_ONLY_MESSAGE = "Sorry, I can only be onboarded from a Direct Message (DM).";
+// ../core/dist/channels/governance/telegram-chat-type.js
 function isTelegramPrivateChat(chatType) {
   return chatType === "private";
 }
 
+// src/onboarding-dm-gate.ts
+var ONBOARDING_DM_ONLY_MESSAGE = "Sorry, I can only be onboarded from a Direct Message (DM).";
+
 // src/flags-cache-read.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -32337,7 +32342,11 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    // ENG-9486 (ADR-0074). Authoring is owner+admin, matching every other action
+    // that can write a secret or change what an org is billed for.
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   admin: [
     "org.manage_settings",
@@ -32345,7 +32354,9 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   member: [
     "org.manage_teams",
@@ -36985,7 +36996,22 @@ var FLAG_REGISTRY = [
     // seeding code, so `listNewOrgFlagOverrides()` is the one answer to "which flags
     // does a new org get". `defaultValue` stays false so the ~4 months of orgs already
     // carrying an inert enforce-level email.require_approval row are NOT armed on deploy.
-    newOrgOverride: true
+    newOrgOverride: true,
+    // ENG-9630: API-created organizations only, and this is a deliberate,
+    // reviewed asymmetry rather than an oversight.
+    //
+    // Arming this holds EVERY dispatching send for human approval. The hold
+    // itself works fine on a self-serve org — `hitl-approval-routing` has
+    // defaulted to 'on' since ENG-7828, so a real Human Approval card is minted
+    // and it is actionable at /organization/approvals. What a self-serve org
+    // does NOT have is any means of being TOLD: no Slack alert channel is wired
+    // at signup, so the card sits in a console surface nobody has pointed the
+    // user at, and their agent's first email silently waits on it.
+    //
+    // So the blocker is the notification path, not the control. Whoever revisits
+    // this should treat "a self-serve org actually receives the card" as the
+    // prerequisite and then drop this line — do not simply widen it.
+    newOrgOverrideOrigins: ["api"]
   },
   {
     key: "mail-rule-control-enforcement",
@@ -40564,6 +40590,7 @@ var AGT_AGENT_ID = process.env.AGT_AGENT_ID ?? null;
 var ALLOWED_CHATS = new Set(
   (process.env.TELEGRAM_ALLOWED_CHATS ?? "").split(",").map((s) => s.trim()).filter(Boolean)
 );
+var PRIVATE_CHATS_ONLY = process.env.TELEGRAM_PRIVATE_CHATS_ONLY === "1";
 var DIAGNOSTIC_CHAT_IDS = new Set(
   (process.env.TELEGRAM_DIAGNOSTIC_CHAT_IDS ?? "").split(",").map((s) => s.trim()).filter(Boolean)
 );
@@ -44036,16 +44063,6 @@ async function pollLoop() {
         }
         const msg = update.message;
         if (!msg) continue;
-        const perfReplyRef = typeof msg.text === "string" && msg.text.trim().length > 0 && msg.reply_to_message?.from?.is_bot === true && msg.reply_to_message?.text ? PERF_REVIEW_REF_RE.exec(msg.reply_to_message.text) : null;
-        if (perfReplyRef && msg.from?.id != null) {
-          await postPerfReviewResolve(
-            perfReplyRef[1],
-            PERF_REVIEW_COMMENT_TOKEN,
-            String(msg.from.id),
-            msg.text.trim()
-          );
-          continue;
-        }
         const classifiedAttachments = classifyTelegramAttachments(msg);
         const content = typeof msg.text === "string" && msg.text.length > 0 ? msg.text : typeof msg.caption === "string" && msg.caption.length > 0 ? msg.caption : "";
         if (content.length === 0 && classifiedAttachments.length === 0) continue;
@@ -44107,17 +44124,31 @@ async function pollLoop() {
           // TELEGRAM_ALLOWED_CHATS is Telegram's org-boundary axis (the drift
           // the consolidation names). An unlisted chat is external ⇒ silent.
           orgBoundary: ALLOWED_CHATS.size > 0 && !ALLOWED_CHATS.has(chatId) ? { forward: false } : { forward: true },
+          // CS-1628: chat-kind axis. Evaluated before command routing by the
+          // composer, so a `/restart` from a group cannot execute in a chat the
+          // agent is not permitted to be in.
+          chatType: PRIVATE_CHATS_ONLY && !isTelegramPrivateChat(msg.chat?.type) ? { forward: false } : { forward: true },
           command: telegramCommand ? { command: telegramCommand, authorized: true } : void 0,
           // No sender-policy mode system on Telegram, so no same-org decline.
           sameOrg: false
         });
-        if (access.kind === "drop" && (access.reason === "org_boundary" || access.reason.startsWith("content:"))) {
+        if (access.kind === "drop" && (access.reason === "org_boundary" || access.reason === "chat_type" || access.reason.startsWith("content:"))) {
           process.stderr.write(
             `telegram-channel(${AGENT_CODE_NAME}): inbound drop reason=${access.reason} chat=${redactId(chatId)}
 `
           );
           continue;
         }
+        const perfReplyRef = typeof msg.text === "string" && msg.text.trim().length > 0 && msg.reply_to_message?.from?.is_bot === true && msg.reply_to_message?.text ? PERF_REVIEW_REF_RE.exec(msg.reply_to_message.text) : null;
+        if (perfReplyRef && msg.from?.id != null) {
+          await postPerfReviewResolve(
+            perfReplyRef[1],
+            PERF_REVIEW_COMMENT_TOKEN,
+            String(msg.from.id),
+            msg.text.trim()
+          );
+          continue;
+        }
         if (msg.chat.type === "private" && !isFromBot && chatId) {
           recordDmActivity(recentDms, String(chatId));
           if (isShuttingDown) recentDmPersister?.flush(recentDms);

package/dist/{persistent-session-BHJLZTYX.js → persistent-session-4KGDH66U.js}

@@ -46,8 +46,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-QB6TIA3Z.js";
-import "./chunk-BADE2W6M.js";
+} from "./chunk-5CF4DRXA.js";
+import "./chunk-IBBBIE4K.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -98,4 +98,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-BHJLZTYX.js.map
+//# sourceMappingURL=persistent-session-4KGDH66U.js.map

package/dist/{responsiveness-probe-457EYSWZ.js → responsiveness-probe-HNUYLIFJ.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-QB6TIA3Z.js";
-import "./chunk-BADE2W6M.js";
+} from "./chunk-5CF4DRXA.js";
+import "./chunk-IBBBIE4K.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -745,4 +745,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-457EYSWZ.js.map
+//# sourceMappingURL=responsiveness-probe-HNUYLIFJ.js.map

package/dist/{session-auth-dead-YUPZGR3F.js → session-auth-dead-TK3KNAH4.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-BADE2W6M.js";
+} from "./chunk-IBBBIE4K.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-YUPZGR3F.js.map
+//# sourceMappingURL=session-auth-dead-TK3KNAH4.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.732",
+  "version": "0.28.734",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {