@integrity-labs/agt-cli 0.28.733 → 0.28.735

package/dist/mcp/slack-channel.js

@@ -30477,6 +30477,9 @@ function decideInboundAccess(input) {
   if (input.orgBoundary && !input.orgBoundary.forward) {
     return { kind: "drop", reason: "org_boundary" };
   }
+  if (input.chatType && !input.chatType.forward) {
+    return { kind: "drop", reason: "chat_type" };
+  }
   if (input.senderPolicy && !input.senderPolicy.forward) {
     const reason = input.senderPolicy.reason;
     const declineWorthy = input.sameOrg && reason !== "internal_only";

package/dist/mcp/teams-channel.js

@@ -14930,6 +14930,9 @@ function decideInboundAccess(input) {
   if (input.orgBoundary && !input.orgBoundary.forward) {
     return { kind: "drop", reason: "org_boundary" };
   }
+  if (input.chatType && !input.chatType.forward) {
+    return { kind: "drop", reason: "chat_type" };
+  }
   if (input.senderPolicy && !input.senderPolicy.forward) {
     const reason = input.senderPolicy.reason;
     const declineWorthy = input.sameOrg && reason !== "internal_only";

package/dist/mcp/telegram-channel.js

@@ -30709,6 +30709,9 @@ function decideInboundAccess(input) {
   if (input.orgBoundary && !input.orgBoundary.forward) {
     return { kind: "drop", reason: "org_boundary" };
   }
+  if (input.chatType && !input.chatType.forward) {
+    return { kind: "drop", reason: "chat_type" };
+  }
   if (input.senderPolicy && !input.senderPolicy.forward) {
     const reason = input.senderPolicy.reason;
     const declineWorthy = input.sameOrg && reason !== "internal_only";
@@ -30737,12 +30740,14 @@ function decideInboundAccess(input) {
   return { kind: "admit" };
 }
 
-// src/onboarding-dm-gate.ts
-var ONBOARDING_DM_ONLY_MESSAGE = "Sorry, I can only be onboarded from a Direct Message (DM).";
+// ../core/dist/channels/governance/telegram-chat-type.js
 function isTelegramPrivateChat(chatType) {
   return chatType === "private";
 }
 
+// src/onboarding-dm-gate.ts
+var ONBOARDING_DM_ONLY_MESSAGE = "Sorry, I can only be onboarded from a Direct Message (DM).";
+
 // src/flags-cache-read.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -40585,6 +40590,7 @@ var AGT_AGENT_ID = process.env.AGT_AGENT_ID ?? null;
 var ALLOWED_CHATS = new Set(
   (process.env.TELEGRAM_ALLOWED_CHATS ?? "").split(",").map((s) => s.trim()).filter(Boolean)
 );
+var PRIVATE_CHATS_ONLY = process.env.TELEGRAM_PRIVATE_CHATS_ONLY === "1";
 var DIAGNOSTIC_CHAT_IDS = new Set(
   (process.env.TELEGRAM_DIAGNOSTIC_CHAT_IDS ?? "").split(",").map((s) => s.trim()).filter(Boolean)
 );
@@ -44057,16 +44063,6 @@ async function pollLoop() {
         }
         const msg = update.message;
         if (!msg) continue;
-        const perfReplyRef = typeof msg.text === "string" && msg.text.trim().length > 0 && msg.reply_to_message?.from?.is_bot === true && msg.reply_to_message?.text ? PERF_REVIEW_REF_RE.exec(msg.reply_to_message.text) : null;
-        if (perfReplyRef && msg.from?.id != null) {
-          await postPerfReviewResolve(
-            perfReplyRef[1],
-            PERF_REVIEW_COMMENT_TOKEN,
-            String(msg.from.id),
-            msg.text.trim()
-          );
-          continue;
-        }
         const classifiedAttachments = classifyTelegramAttachments(msg);
         const content = typeof msg.text === "string" && msg.text.length > 0 ? msg.text : typeof msg.caption === "string" && msg.caption.length > 0 ? msg.caption : "";
         if (content.length === 0 && classifiedAttachments.length === 0) continue;
@@ -44128,17 +44124,31 @@ async function pollLoop() {
           // TELEGRAM_ALLOWED_CHATS is Telegram's org-boundary axis (the drift
           // the consolidation names). An unlisted chat is external ⇒ silent.
           orgBoundary: ALLOWED_CHATS.size > 0 && !ALLOWED_CHATS.has(chatId) ? { forward: false } : { forward: true },
+          // CS-1628: chat-kind axis. Evaluated before command routing by the
+          // composer, so a `/restart` from a group cannot execute in a chat the
+          // agent is not permitted to be in.
+          chatType: PRIVATE_CHATS_ONLY && !isTelegramPrivateChat(msg.chat?.type) ? { forward: false } : { forward: true },
           command: telegramCommand ? { command: telegramCommand, authorized: true } : void 0,
           // No sender-policy mode system on Telegram, so no same-org decline.
           sameOrg: false
         });
-        if (access.kind === "drop" && (access.reason === "org_boundary" || access.reason.startsWith("content:"))) {
+        if (access.kind === "drop" && (access.reason === "org_boundary" || access.reason === "chat_type" || access.reason.startsWith("content:"))) {
           process.stderr.write(
             `telegram-channel(${AGENT_CODE_NAME}): inbound drop reason=${access.reason} chat=${redactId(chatId)}
 `
           );
           continue;
         }
+        const perfReplyRef = typeof msg.text === "string" && msg.text.trim().length > 0 && msg.reply_to_message?.from?.is_bot === true && msg.reply_to_message?.text ? PERF_REVIEW_REF_RE.exec(msg.reply_to_message.text) : null;
+        if (perfReplyRef && msg.from?.id != null) {
+          await postPerfReviewResolve(
+            perfReplyRef[1],
+            PERF_REVIEW_COMMENT_TOKEN,
+            String(msg.from.id),
+            msg.text.trim()
+          );
+          continue;
+        }
         if (msg.chat.type === "private" && !isFromBot && chatId) {
           recordDmActivity(recentDms, String(chatId));
           if (isShuttingDown) recentDmPersister?.flush(recentDms);

package/dist/{persistent-session-H7CP2TUX.js → persistent-session-4KGDH66U.js}

@@ -46,7 +46,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-7KT2QNXF.js";
+} from "./chunk-5CF4DRXA.js";
 import "./chunk-IBBBIE4K.js";
 import "./chunk-XWVM4KPK.js";
 export {
@@ -98,4 +98,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-H7CP2TUX.js.map
+//# sourceMappingURL=persistent-session-4KGDH66U.js.map

package/dist/{responsiveness-probe-MPPDJSOL.js → responsiveness-probe-HNUYLIFJ.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-7KT2QNXF.js";
+} from "./chunk-5CF4DRXA.js";
 import "./chunk-IBBBIE4K.js";
 import "./chunk-XWVM4KPK.js";
 
@@ -745,4 +745,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-MPPDJSOL.js.map
+//# sourceMappingURL=responsiveness-probe-HNUYLIFJ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.733",
+  "version": "0.28.735",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {