@integrity-labs/agt-cli 0.28.81 → 0.28.83

package/dist/lib/manager-worker.js

@@ -28,7 +28,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-DA3DAU5V.js";
+} from "../chunk-WFIKSR3G.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -6803,7 +6803,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.81" : "dev";
+var agtCliVersion = true ? "0.28.83" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/slack-channel.js

@@ -15518,15 +15518,15 @@ import {
   createWriteStream,
   existsSync as existsSync7,
   ftruncateSync,
-  mkdirSync as mkdirSync6,
+  mkdirSync as mkdirSync7,
   openSync,
   readFileSync as readFileSync9,
   readdirSync as readdirSync3,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   statSync as statSync2,
   unlinkSync as unlinkSync5,
   watch,
-  writeFileSync as writeFileSync7,
+  writeFileSync as writeFileSync8,
   writeSync
 } from "fs";
 import { basename, join as join7, resolve as resolve2 } from "path";
@@ -15812,9 +15812,25 @@ async function runOrRetry(fn, opts) {
   }
 }
 
-// src/slack-bot-photo.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+// src/turn-initiator-marker.ts
+import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, renameSync as renameSync2 } from "fs";
 import { dirname as dirname4 } from "path";
+function writeTurnInitiatorMarker(input) {
+  const file = process.env["AGT_TURN_INITIATOR_FILE"];
+  if (!file || !input.sender_id) return;
+  try {
+    mkdirSync4(dirname4(file), { recursive: true });
+    const marker = { ...input, ts: Date.now() };
+    const tmp = `${file}.tmp`;
+    writeFileSync5(tmp, JSON.stringify(marker), "utf8");
+    renameSync2(tmp, file);
+  } catch {
+  }
+}
+
+// src/slack-bot-photo.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5 } from "path";
 async function applyBotPhoto(opts) {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const log = opts.log ?? ((m) => {
@@ -15864,8 +15880,8 @@ async function applyBotPhoto(opts) {
     }
     if (markerPath) {
       try {
-        mkdirSync4(dirname4(markerPath), { recursive: true, mode: 448 });
-        writeFileSync5(markerPath, avatarUrl, { mode: 384 });
+        mkdirSync5(dirname5(markerPath), { recursive: true, mode: 448 });
+        writeFileSync6(markerPath, avatarUrl, { mode: 384 });
       } catch {
       }
     }
@@ -16648,11 +16664,11 @@ function createSlackBotUserIdClient(args) {
 // src/mcp-spawn-lock.ts
 import {
   existsSync as existsSync6,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync6,
   readFileSync as readFileSync8,
-  renameSync as renameSync2,
+  renameSync as renameSync3,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "fs";
 import { join as join6 } from "path";
 function defaultIsPidAlive(pid) {
@@ -16682,11 +16698,11 @@ function acquireMcpSpawnLock(args) {
       return { kind: "blocked", path, holder: existing };
     }
   }
-  mkdirSync5(agentDir, { recursive: true, mode: 448 });
+  mkdirSync6(agentDir, { recursive: true, mode: 448 });
   const tmpPath = `${path}.${selfPid}.tmp`;
   const payload = { pid: selfPid, started_at: now() };
-  writeFileSync6(tmpPath, JSON.stringify(payload), { mode: 384 });
-  renameSync2(tmpPath, path);
+  writeFileSync7(tmpPath, JSON.stringify(payload), { mode: 384 });
+  renameSync3(tmpPath, path);
   return { kind: "acquired", path };
 }
 function releaseMcpSpawnLock(lockPath, opts = {}) {
@@ -16983,8 +16999,8 @@ function writeSlackPendingInboundMarker(channel, threadTs, messageTs, undelivera
     ...payload ? { payload } : {}
   };
   try {
-    mkdirSync6(SLACK_PENDING_INBOUND_DIR, { recursive: true, mode: 448 });
-    writeFileSync7(path, JSON.stringify(marker), { mode: 384 });
+    mkdirSync7(SLACK_PENDING_INBOUND_DIR, { recursive: true, mode: 448 });
+    writeFileSync8(path, JSON.stringify(marker), { mode: 384 });
   } catch (err) {
     process.stderr.write(
       `slack-channel(${AGENT_CODE_NAME}): pending-inbound marker write failed: ${err.message}
@@ -17257,7 +17273,7 @@ async function processSlackRecoveryOutboxFile(filename) {
 `
     );
     try {
-      renameSync3(fullPath, `${fullPath}.parse-error.poison`);
+      renameSync4(fullPath, `${fullPath}.parse-error.poison`);
     } catch {
     }
     return;
@@ -17268,7 +17284,7 @@ async function processSlackRecoveryOutboxFile(filename) {
 `
     );
     try {
-      renameSync3(fullPath, `${fullPath}.malformed.poison`);
+      renameSync4(fullPath, `${fullPath}.malformed.poison`);
     } catch {
     }
     return;
@@ -17326,7 +17342,7 @@ ${payload.text}`;
   const next = slackNextRetryName(filename);
   if (next) {
     try {
-      renameSync3(fullPath, join7(SLACK_RECOVERY_OUTBOX_DIR, next.next));
+      renameSync4(fullPath, join7(SLACK_RECOVERY_OUTBOX_DIR, next.next));
       if (next.attempt >= SLACK_MAX_RECOVERY_ATTEMPTS) {
         process.stderr.write(
           `slack-channel(${AGENT_CODE_NAME}): ghost-reply recovery exhausted retries \u2014 moved to ${next.next}
@@ -17377,7 +17393,7 @@ function scanSlackRecoveryRetries() {
 function startSlackRecoveryOutboxWatcher() {
   if (!SLACK_RECOVERY_OUTBOX_DIR) return;
   try {
-    mkdirSync6(SLACK_RECOVERY_OUTBOX_DIR, { recursive: true, mode: 448 });
+    mkdirSync7(SLACK_RECOVERY_OUTBOX_DIR, { recursive: true, mode: 448 });
   } catch (err) {
     process.stderr.write(
       `slack-channel(${AGENT_CODE_NAME}): recovery outbox mkdir failed: ${err.message}
@@ -18073,15 +18089,6 @@ async function postEphemeralViaResponseUrl(responseUrl, text, logTag) {
 }
 async function forwardOnboardingSlashCommand(opts) {
   const { verb, path, userId, responseUrl, codeName } = opts;
-  const allowed = getEffectiveAllowedUsers();
-  if (allowed.size > 0 && (!userId || !allowed.has(userId))) {
-    await postEphemeralViaResponseUrl(
-      responseUrl,
-      `\u{1F6AB} \`${verb}\` denied \u2014 your Slack user is not in the allowlist for \`${codeName}\`.`,
-      codeName
-    );
-    return;
-  }
   if (!AGT_HOST || !AGT_API_KEY || !AGT_AGENT_ID) {
     await postEphemeralViaResponseUrl(
       responseUrl,
@@ -18097,9 +18104,12 @@ async function forwardOnboardingSlashCommand(opts) {
       apiKey: AGT_API_KEY,
       agentId: AGT_AGENT_ID
     };
-    const res = await apiCall2(cfg, "POST", `/host${path}`, { agent_id: AGT_AGENT_ID });
+    const res = await apiCall2(cfg, "POST", `/host${path}`, {
+      agent_id: AGT_AGENT_ID,
+      initiator: { channel: "slack", user_id: userId }
+    });
     const data = await res.json();
-    const text = data.ok ? `\u{1F504} ${data.message ?? "Onboarding updated."}` : `:x: \`${verb}\` failed${data.error ? `: ${data.error}` : "."}`;
+    const text = data.ok ? `\u{1F504} ${data.message ?? "Onboarding updated."}` : data.message ?? `:x: \`${verb}\` failed${data.error ? `: ${data.error}` : "."}`;
     await postEphemeralViaResponseUrl(responseUrl, text, codeName);
   } catch (err) {
     process.stderr.write(
@@ -18340,7 +18350,7 @@ async function handleSlashCommandEnvelope(payload) {
     }
     try {
       if (!existsSync7(RESTART_FLAGS_DIR)) {
-        mkdirSync6(RESTART_FLAGS_DIR, { recursive: true });
+        mkdirSync7(RESTART_FLAGS_DIR, { recursive: true });
       }
       const flagPath = join7(RESTART_FLAGS_DIR, `${codeName}.flag`);
       writeSlackRestartConfirm(
@@ -18360,8 +18370,8 @@ async function handleSlashCommandEnvelope(payload) {
         }
       };
       const tmpPath = `${flagPath}.${process.pid}.${randomUUID2()}.tmp`;
-      writeFileSync7(tmpPath, JSON.stringify(flag) + "\n", "utf8");
-      renameSync3(tmpPath, flagPath);
+      writeFileSync8(tmpPath, JSON.stringify(flag) + "\n", "utf8");
+      renameSync4(tmpPath, flagPath);
       process.stderr.write(
         `slack-channel(${codeName}): /restart slash-command queued from channel ${hashChannelId(payload.channel_id)}
 `
@@ -18478,7 +18488,7 @@ async function handleRestartCommand(opts) {
   const codeName = AGENT_CODE_NAME ?? "unknown";
   try {
     if (!existsSync7(RESTART_FLAGS_DIR)) {
-      mkdirSync6(RESTART_FLAGS_DIR, { recursive: true });
+      mkdirSync7(RESTART_FLAGS_DIR, { recursive: true });
     }
     const flagPath = join7(RESTART_FLAGS_DIR, `${codeName}.flag`);
     writeSlackRestartConfirm(
@@ -18499,8 +18509,8 @@ async function handleRestartCommand(opts) {
       }
     };
     const tmpPath = `${flagPath}.${process.pid}.${randomUUID2()}.tmp`;
-    writeFileSync7(tmpPath, JSON.stringify(flag) + "\n", "utf8");
-    renameSync3(tmpPath, flagPath);
+    writeFileSync8(tmpPath, JSON.stringify(flag) + "\n", "utf8");
+    renameSync4(tmpPath, flagPath);
     process.stderr.write(
       `slack-channel(${codeName}): /restart queued from channel ${hashChannelId(opts.channel)}
 `
@@ -18643,7 +18653,7 @@ var slackStderrLogStream = null;
 if (AGENT_CODE_NAME) {
   try {
     const logDir = join7(homedir3(), ".augmented", AGENT_CODE_NAME);
-    mkdirSync6(logDir, { recursive: true });
+    mkdirSync7(logDir, { recursive: true });
     slackStderrLogStream = createWriteStream(join7(logDir, "slack-channel-stderr.log"), {
       flags: "a",
       mode: 384
@@ -19876,8 +19886,8 @@ async function downloadSlackFile(fileId, codeName) {
   if (!isPathInside(savedPath, dir)) {
     throw new Error(`refusing to write ${savedPath} outside ${dir}`);
   }
-  mkdirSync6(dir, { recursive: true });
-  writeFileSync7(savedPath, bytes, { mode: 384 });
+  mkdirSync7(dir, { recursive: true });
+  writeFileSync8(savedPath, bytes, { mode: 384 });
   try {
     chmodSync(savedPath, 384);
   } catch {
@@ -20493,6 +20503,14 @@ async function connectSocketMode() {
       if (channel && ts && armMarker) {
         attachSlackReplayPayload(channel, threadTs, ts, replayPayload);
       }
+      if (!isFromBot && evt.user && channel) {
+        writeTurnInitiatorMarker({
+          channel: "slack",
+          sender_id: evt.user,
+          sender_name: userName,
+          channel_ref: threadTs
+        });
+      }
       await mcp.notification({
         method: "notifications/claude/channel",
         params: replayPayload

package/dist/mcp/telegram-channel.js

@@ -17190,7 +17190,8 @@ async function handleOnboardingCommand(opts) {
       agentId: AGT_AGENT_ID
     };
     const res = await apiCall2(cfg, "POST", `/host/onboarding/${opts.mode}`, {
-      agent_id: AGT_AGENT_ID
+      agent_id: AGT_AGENT_ID,
+      initiator: { channel: "telegram", user_id: opts.senderId }
     });
     const data = await res.json();
     process.stderr.write(
@@ -17198,7 +17199,7 @@ async function handleOnboardingCommand(opts) {
 `
     );
     await reply(
-      data.ok ? `\u{1F504} ${data.message ?? "Onboarding updated."}` : `\u274C ${verb} failed${data.error ? `: ${data.error}` : "."}`
+      data.ok ? `\u{1F504} ${data.message ?? "Onboarding updated."}` : data.message ?? `\u274C ${verb} failed${data.error ? `: ${data.error}` : "."}`
     );
   } catch (err) {
     process.stderr.write(
@@ -19210,7 +19211,10 @@ async function pollLoop() {
             await handleOnboardingCommand({
               chatId,
               messageId: String(msg.message_id),
-              mode: access.command === "onboard" ? "reset" : "resume"
+              mode: access.command === "onboard" ? "reset" : "resume",
+              // ENG-6578: the manager gate compares the SENDER's user-id (not the
+              // chat id — they differ in groups) to the resolved manager principal.
+              senderId: msg.from?.id != null ? String(msg.from.id) : void 0
             });
           }
           continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.81",
+  "version": "0.28.83",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {