@integrity-labs/agt-cli 0.28.917 → 0.28.919

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-YDFEK6C6.js";
+} from "../chunk-DUPUJAZE.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.917" : "dev";
+var cliVersion = true ? "0.28.919" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6682,7 +6682,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.917" : "dev";
+var cliVersion2 = true ? "0.28.919" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-YDFEK6C6.js → chunk-DUPUJAZE.js}

@@ -5684,7 +5684,16 @@ ${sections}`
               // MCP boot guard fails closed at startup rather than admitting
               // every sender as "internal".
               ...senderPolicyInternalOnly ? { SLACK_INTERNAL_ONLY: "true" } : {},
-              ...senderPolicyInternalOnly && typeof config["team_id"] === "string" && config["team_id"].length > 0 ? { SLACK_HOME_TEAM_ID: config["team_id"] } : {},
+              // ENG-10440: SLACK_HOME_TEAM_ID is emitted whenever the install
+              // knows its workspace, NOT only under internal_only. The MCP's
+              // same-org test (decline vs silent drop, ENG-5859/ENG-6236) reads
+              // it for EVERY restrictive mode and fails closed when it is
+              // absent — so gating it on internal_only made every mode-block
+              // decline dead for orgs without internal_only, which is most of
+              // them. It is the install's identity, not a policy knob; the
+              // internal_only boot guard still only fires when INTERNAL_ONLY
+              // is set. The MCP also falls back to its own auth.test team_id.
+              ...typeof config["team_id"] === "string" && config["team_id"].length > 0 ? { SLACK_HOME_TEAM_ID: config["team_id"] } : {},
               // ENG-7919: inject the bot's own Slack user ID so it is available at
               // MCP startup before auth.test resolves. Populated by the slack-bot-user-id
               // client on first startup and stored in agent_channel_configs.config.bot_user_id.
@@ -5955,7 +5964,11 @@ ${sections}`
         // SLACK_HOME_TEAM_ID-equivalent emission when the install hasn't
         // pinned a real tenant. MCP boot guard fails closed.
         ...senderPolicyInternalOnly ? { MSTEAMS_INTERNAL_ONLY: "true" } : {},
-        ...senderPolicyInternalOnly && tenantId !== "common" ? { MSTEAMS_HOME_TENANT_ID: tenantId } : {}
+        // ENG-10440: emitted whenever a real tenant is pinned, not only under
+        // internal_only — teams-channel's same-org test reads it for every
+        // restrictive mode, exactly as the Slack pair above. 'common' is still
+        // never emitted.
+        ...tenantId !== "common" ? { MSTEAMS_HOME_TENANT_ID: tenantId } : {}
       };
       if (isPersistent && existsSync4(localTeamsChannel)) {
         mcpServers["msteams"] = {
@@ -6929,7 +6942,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.917" : "dev";
+var agtCliVersion = true ? "0.28.919" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11539,4 +11552,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-YDFEK6C6.js.map
+//# sourceMappingURL=chunk-DUPUJAZE.js.map