@integrity-labs/agt-cli 0.28.916 → 0.28.918

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-OJK2OMY7.js";
+} from "../chunk-BGZHJNKK.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-5N43343H.js";
+} from "../chunk-GYUOGI3N.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-ASZOPO2M.js";
+} from "../chunk-YBCJHIWM.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.916" : "dev";
+var cliVersion = true ? "0.28.918" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6682,7 +6682,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.916" : "dev";
+var cliVersion2 = true ? "0.28.918" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-OJK2OMY7.js → chunk-BGZHJNKK.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-5N43343H.js";
+} from "./chunk-GYUOGI3N.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -76,7 +76,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-ASZOPO2M.js";
+} from "./chunk-YBCJHIWM.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -5684,7 +5684,16 @@ ${sections}`
               // MCP boot guard fails closed at startup rather than admitting
               // every sender as "internal".
               ...senderPolicyInternalOnly ? { SLACK_INTERNAL_ONLY: "true" } : {},
-              ...senderPolicyInternalOnly && typeof config["team_id"] === "string" && config["team_id"].length > 0 ? { SLACK_HOME_TEAM_ID: config["team_id"] } : {},
+              // ENG-10440: SLACK_HOME_TEAM_ID is emitted whenever the install
+              // knows its workspace, NOT only under internal_only. The MCP's
+              // same-org test (decline vs silent drop, ENG-5859/ENG-6236) reads
+              // it for EVERY restrictive mode and fails closed when it is
+              // absent — so gating it on internal_only made every mode-block
+              // decline dead for orgs without internal_only, which is most of
+              // them. It is the install's identity, not a policy knob; the
+              // internal_only boot guard still only fires when INTERNAL_ONLY
+              // is set. The MCP also falls back to its own auth.test team_id.
+              ...typeof config["team_id"] === "string" && config["team_id"].length > 0 ? { SLACK_HOME_TEAM_ID: config["team_id"] } : {},
               // ENG-7919: inject the bot's own Slack user ID so it is available at
               // MCP startup before auth.test resolves. Populated by the slack-bot-user-id
               // client on first startup and stored in agent_channel_configs.config.bot_user_id.
@@ -5955,7 +5964,11 @@ ${sections}`
         // SLACK_HOME_TEAM_ID-equivalent emission when the install hasn't
         // pinned a real tenant. MCP boot guard fails closed.
         ...senderPolicyInternalOnly ? { MSTEAMS_INTERNAL_ONLY: "true" } : {},
-        ...senderPolicyInternalOnly && tenantId !== "common" ? { MSTEAMS_HOME_TENANT_ID: tenantId } : {}
+        // ENG-10440: emitted whenever a real tenant is pinned, not only under
+        // internal_only — teams-channel's same-org test reads it for every
+        // restrictive mode, exactly as the Slack pair above. 'common' is still
+        // never emitted.
+        ...tenantId !== "common" ? { MSTEAMS_HOME_TENANT_ID: tenantId } : {}
       };
       if (isPersistent && existsSync4(localTeamsChannel)) {
         mcpServers["msteams"] = {
@@ -6929,7 +6942,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.916" : "dev";
+var agtCliVersion = true ? "0.28.918" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11539,4 +11552,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-OJK2OMY7.js.map
+//# sourceMappingURL=chunk-BGZHJNKK.js.map