@integrity-labs/agt-cli 0.28.974 → 0.28.976

package/dist/mcp/slack-channel.js

@@ -39177,11 +39177,18 @@ var FLAG_REGISTRY = [
   },
   {
     key: "ip-allowlist-enforce-admin-debug",
-    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. There is deliberately NO counterpart flag for the per-agent MCP surface: that one is shadow-only structurally (its ENFORCE_FLAG entry is null), so arming this one does not and cannot arm that one. See the comment below this entry for why.",
     flagType: "boolean",
-    // Shadow. The measurement comes first: nobody yet knows the real set of
-    // staff addresses, and arming against a guess locks you out of the very
-    // tool you would use to diagnose the lockout.
+    // Shadow. The measurement comes first - and ENG-10664 corrected what the
+    // measurement is OF. This comment used to say "nobody yet knows the real set
+    // of staff addresses": there is no such set. Measured over 48h, all 315
+    // requests to this surface came from ONE address, the agt-hosts AZ-2a NAT
+    // EIP - an AGENT calling the debug_* tools, not a person. The decided policy
+    // is that it stays that way (admin-debug is only ever reached from our own
+    // NAT gateways). So the pre-arm check is not "does my laptop appear" but
+    // "is every NAT EIP in the list", because an AZ whose NAT has not yet
+    // carried a debug_* call is absent from the log and would be refused the
+    // instant this flips. See docs/runbooks/ip-allowlist-rollout.md step 3.
     defaultValue: false,
     // Arming it changes who can reach production diagnostics. Worth one
     // confirmation.
@@ -39196,20 +39203,34 @@ var FLAG_REGISTRY = [
   // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
   // flag is consulted and no flag flip can arm it.
   //
-  // Why it is not simply a second flag defaulting false: most of that surface's
-  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
-  // agt-hosts account egress through stable NAT EIPs; a host with
-  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
-  // an address the control plane cannot know. Arming against that population
-  // black-holes a customer's whole fleet, and per
-  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // Why it is not simply a second flag defaulting false (CORRECTED, ENG-10664):
+  //
+  // This comment used to say the callers are agent HOSTS, most of which have no
+  // allowlistable address per ADR-0032. That is the wrong caller. Agent hosts do
+  // not call this surface at all: its handler's first act is
+  // validateMcpAccessToken() against `mcp_oauth_tokens` (routes/mcp.ts:87, token
+  // check at :91), so a host JWT is rejected outright - routes/host-runtime.ts
+  // :33421 says so in as many words, which is why the ENG-4724 /host/* twins
+  // exist. The caller set is remote MCP OAuth clients, structurally.
+  //
+  // The conclusion is unchanged and ONLY the reason has moved. Allowlisting this
+  // surface would mean pinning a THIRD PARTY's egress ranges rather than our own
+  // NAT EIPs - a different control, a different owner, a different failure mode:
+  // they move a range and agent MCP access breaks with no signal on our side.
+  // Per docs/runbooks/composio-allowlist-rollout.md this class of change has no
   // fleet-level undo. A flag would leave that one toggle away during an
   // incident, from someone who had just armed the admin-debug surface and
   // reasonably assumed the pair moved together. Requiring a code change puts
   // review in front of an irreversible action, which is the right price.
   //
-  // If the shadow data ever shows the population IS allowlistable, adding the
-  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
+  // Keeping the false rationale would have been worse than having none: a reader
+  // who checked it would find it does not hold and might "fix" it by adding the
+  // flag. That is the failure this rewrite exists to prevent.
+  //
+  // If we ever DECIDE to take on that third-party dependency deliberately,
+  // adding the flag here and a key in ENFORCE_FLAG is a small diff - but it is a
+  // decision to own someone else's egress, not a discovery that the population
+  // was allowlistable all along.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 
@@ -40436,7 +40457,7 @@ function formatThreadMessages(messages, nameById) {
 }
 function capThreadContext(formatted, maxChars) {
   if (formatted.length <= maxChars) return formatted;
-  const marker = "[\u2026earlier thread messages omitted \u2014 slack.read_thread for full history\u2026]\n";
+  const marker = "[\u2026earlier thread messages omitted \u2014 slack_read_thread for full history\u2026]\n";
   if (maxChars <= marker.length) return marker.slice(0, maxChars);
   const tailBudget = maxChars - marker.length;
   const tail = formatted.slice(formatted.length - tailBudget);
@@ -43136,13 +43157,13 @@ function classifyByCoords(mode, args, registry2, now, unknownInboundId, knownThr
 function buildSlackMcpInstructions(opts) {
   const { ackReaction, skipReactionOn, skipReaction } = opts;
   return [
-    "CRITICAL: every response to a Slack <channel> tag MUST go through slack.reply - typed text never reaches the user. Slow work: interim ack (slack.reply interim:true), then your FINAL answer as a separate slack.reply (interim omitted). An ack is not the answer.",
-    "Each inbound tag carries inbound_id and message_ts, and sometimes thread_context. Reply with slack.reply passing inbound_id (copy it verbatim from the tag you are answering) + text; the server routes it to the right thread. Multiple <channel> tags = separate conversations: NEVER answer one user in another's inbound_id/thread. thread_context = pre-loaded thread; ground replies ONLY in it. For a self-initiated message (not a reply) set proactive:true.",
-    "Attachments: <channel> `files` is a JSON string - JSON.parse it. Entry with `path` (or a top-level `image_path`) is already downloaded - Read it; do NOT call slack.download_attachment. Only entries with `file_id` and no `path` (PDF/docx/csv) need slack.download_attachment (pass file_id + channel), then Read the returned path. Don't surface file-handling errors that don't affect the answer.",
+    "CRITICAL: every response to a Slack <channel> tag MUST go through slack_reply - typed text never reaches the user. Slow work: interim ack (slack_reply interim:true), then your FINAL answer as a separate slack_reply (interim omitted). An ack is not the answer.",
+    "Each inbound tag carries inbound_id and message_ts, and sometimes thread_context. Reply with slack_reply passing inbound_id (copy it verbatim from the tag you are answering) + text; the server routes it to the right thread. Multiple <channel> tags = separate conversations: NEVER answer one user in another's inbound_id/thread. thread_context = pre-loaded thread; ground replies ONLY in it. For a self-initiated message (not a reply) set proactive:true.",
+    "Attachments: <channel> `files` is a JSON string - JSON.parse it. Entry with `path` (or a top-level `image_path`) is already downloaded - Read it; do NOT call slack_download_attachment. Only entries with `file_id` and no `path` (PDF/docx/csv) need slack_download_attachment (pass file_id + channel), then Read the returned path. Don't surface file-handling errors that don't affect the answer.",
     "Address users by user_name, never raw user ID. In multi-participant threads the CURRENT speaker is on the latest <channel> tag.",
-    `Reactions (slack.react sparingly - prefer a reply): :${ackReaction}: = ack (auto-added on inbound, don't duplicate); \u2705 = success.` + (skipReactionOn ? ` "${skipReaction}" = seen, not replying.` : "") + " NEVER react to signal failure of your work - on failure slack.reply one sentence explaining it (no stack traces/secrets). \u23F3 and \u274C are system-only; never add them.",
-    skipReactionOn ? `Decided NOT to reply to a DM or thread message (different @-mention, side chat, auto_followed catch-up, nothing useful)? slack.react with "${skipReaction}" so the sender knows you saw it - never post "this wasn't for me". Top-level channel messages you may skip silently.` : "A thread message NOT addressed to you (different @-mention, side chat, auto_followed catch-up): SILENTLY SKIP - no reaction, no reply.",
-    'auto_followed="true" \u2192 reply only if useful (self-mentions auto-cleared server-side). own_bot_user_id=your Slack user ID. File: slack.upload_file path+channel+inbound_id.'
+    `Reactions (slack_react sparingly - prefer a reply): :${ackReaction}: = ack (auto-added on inbound, don't duplicate); \u2705 = success.` + (skipReactionOn ? ` "${skipReaction}" = seen, not replying.` : "") + " NEVER react to signal failure of your work - on failure slack_reply one sentence explaining it (no stack traces/secrets). \u23F3 and \u274C are system-only; never add them.",
+    skipReactionOn ? `Decided NOT to reply to a DM or thread message (different @-mention, side chat, auto_followed catch-up, nothing useful)? slack_react with "${skipReaction}" so the sender knows you saw it - never post "this wasn't for me". Top-level channel messages you may skip silently.` : "A thread message NOT addressed to you (different @-mention, side chat, auto_followed catch-up): SILENTLY SKIP - no reaction, no reply.",
+    'auto_followed="true" \u2192 reply only if useful (self-mentions auto-cleared server-side). own_bot_user_id=your Slack user ID. File: slack_upload_file path+channel+inbound_id.'
   ].join(" ");
 }
 
@@ -43150,7 +43171,7 @@ function buildSlackMcpInstructions(opts) {
 function buildSlackReactToolDescription(opts) {
   const { skipReactionOn, skipReaction } = opts;
   const skip = skipReactionOn ? skipReaction.trim() : "";
-  return "Add an emoji reaction to a Slack message. Use sparingly \u2014 prefer a text reply. Reaction taxonomy: \u2705 = action completed successfully. " + (skip ? `":${skip}:" = seen, deliberately NOT replying \u2014 use it on a DM or thread message you correctly chose not to answer (different @-mention, side chat, auto_followed catch-up, nothing useful to add). This one is not cosmetic: it CLOSES the pending-inbound marker, so the message stops being re-delivered to you and the reply-recovery net will not publish your end-of-turn text into a thread you stayed out of. Skipping silently leaves that marker open. (Top-level channel messages you may skip silently.) ` : "") + "\u{1F4DD} (:memo:) and \u26A0\uFE0F (:warning:) are blessed for explicit multi-state STATUS pipelines only \u2014 e.g. marking a run/parent \u2705 done / \u{1F4DD} waiting / \u26A0\uFE0F failed for at-a-glance status. That exception is narrow: never use a reaction to tell a user that YOUR reply failed \u2014 NEVER react to signal failure of your own work; on failure call slack.reply with one sentence explaining what went wrong instead (no stack traces, no secrets). \u{1F440} (eyes) is already auto-applied on inbound; do not duplicate. \u23F3 (:hourglass_flowing_sand:) is reserved for the system to mark an inbound that arrived while the agent couldn't reply \u2014 never add \u23F3 or \u274C yourself. (A \u{1F512} you may see on a thread is the server's reply-throttle marker, not a coerced reaction \u2014 slack.react passes your emoji straight through to Slack and never rewrites it to \u{1F512}.)";
+  return "Add an emoji reaction to a Slack message. Use sparingly \u2014 prefer a text reply. Reaction taxonomy: \u2705 = action completed successfully. " + (skip ? `":${skip}:" = seen, deliberately NOT replying \u2014 use it on a DM or thread message you correctly chose not to answer (different @-mention, side chat, auto_followed catch-up, nothing useful to add). This one is not cosmetic: it CLOSES the pending-inbound marker, so the message stops being re-delivered to you and the reply-recovery net will not publish your end-of-turn text into a thread you stayed out of. Skipping silently leaves that marker open. (Top-level channel messages you may skip silently.) ` : "") + "\u{1F4DD} (:memo:) and \u26A0\uFE0F (:warning:) are blessed for explicit multi-state STATUS pipelines only \u2014 e.g. marking a run/parent \u2705 done / \u{1F4DD} waiting / \u26A0\uFE0F failed for at-a-glance status. That exception is narrow: never use a reaction to tell a user that YOUR reply failed \u2014 NEVER react to signal failure of your own work; on failure call slack_reply with one sentence explaining what went wrong instead (no stack traces, no secrets). \u{1F440} (eyes) is already auto-applied on inbound; do not duplicate. \u23F3 (:hourglass_flowing_sand:) is reserved for the system to mark an inbound that arrived while the agent couldn't reply \u2014 never add \u23F3 or \u274C yourself. (A \u{1F512} you may see on a thread is the server's reply-throttle marker, not a coerced reaction \u2014 slack_react passes your emoji straight through to Slack and never rewrites it to \u{1F512}.)";
 }
 
 // src/slack-routed-to-note.ts
@@ -47366,7 +47387,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
           // whether the agent still owes a substantive answer.
           interim: {
             type: "boolean",
-            description: 'Set true ONLY when this is an interim acknowledgement (e.g. "On it \u2014 checking now\u2026") and the real answer is still coming. The system keeps tracking this conversation as awaiting your final reply. Your eventual substantive answer MUST be a separate slack.reply with interim omitted/false \u2014 that is what marks the request complete. Omit (default false) for any reply that fully answers the user.'
+            description: 'Set true ONLY when this is an interim acknowledgement (e.g. "On it \u2014 checking now\u2026") and the real answer is still coming. The system keeps tracking this conversation as awaiting your final reply. Your eventual substantive answer MUST be a separate slack_reply with interim omitted/false \u2014 that is what marks the request complete. Omit (default false) for any reply that fully answers the user.'
           },
           // WS2 (cross-thread reply routing): the preferred way to target a reply.
           inbound_id: {
@@ -47404,14 +47425,14 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
         properties: {
           channel: { type: "string", description: "Slack channel ID" },
           timestamp: { type: "string", description: "Message timestamp to react to" },
-          emoji: { type: "string", description: 'Emoji name without colons (e.g. "white_check_mark", "memo", "warning"). Do NOT use "x" (\u274C) or "hourglass_flowing_sand" (\u23F3) \u2014 those are system-only. To signal that your own reply failed, send a slack.reply explaining it rather than a reaction. See the tool description for the full taxonomy.' }
+          emoji: { type: "string", description: 'Emoji name without colons (e.g. "white_check_mark", "memo", "warning"). Do NOT use "x" (\u274C) or "hourglass_flowing_sand" (\u23F3) \u2014 those are system-only. To signal that your own reply failed, send a slack_reply explaining it rather than a reaction. See the tool description for the full taxonomy.' }
         },
         required: ["channel", "timestamp", "emoji"]
       }
     },
     {
       name: "slack.update",
-      description: 'Edit the text of a Slack message YOU already sent (Slack chat.update). Pass the channel and the message\'s ts (slack.reply returns it as `(ts=\u2026)` on a successful send) plus the new text. You can only edit your OWN messages. This REPLACES the message text - any block layout on the original is cleared - so use it to correct a typo or update a message in place instead of posting a new one. NOTE: editing an interim "On it\u2026" into the final answer does NOT clear the pending-reply obligation - your final answer must still be a separate slack.reply (interim omitted). Common Slack errors: message_not_found (wrong ts/channel), cant_update_message (not your message), edit_window_closed.',
+      description: 'Edit the text of a Slack message YOU already sent (Slack chat.update). Pass the channel and the message\'s ts (slack_reply returns it as `(ts=\u2026)` on a successful send) plus the new text. You can only edit your OWN messages. This REPLACES the message text - any block layout on the original is cleared - so use it to correct a typo or update a message in place instead of posting a new one. NOTE: editing an interim "On it\u2026" into the final answer does NOT clear the pending-reply obligation - your final answer must still be a separate slack_reply (interim omitted). Common Slack errors: message_not_found (wrong ts/channel), cant_update_message (not your message), edit_window_closed.',
       inputSchema: {
         type: "object",
         properties: {
@@ -47421,7 +47442,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
           },
           ts: {
             type: "string",
-            description: 'Timestamp of the message to edit - the `ts` value slack.reply returned when you sent it (e.g. "1783902864.258519"). Must be a message the bot itself sent.'
+            description: 'Timestamp of the message to edit - the `ts` value slack_reply returned when you sent it (e.g. "1783902864.258519"). Must be a message the bot itself sent.'
           },
           text: { type: "string", description: "The new message text. Replaces the existing text." }
         },
@@ -47452,7 +47473,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: "slack.read_history",
-      description: `Read recent top-level messages in a Slack channel the bot is a member of (via conversations.history). Use this to catch up on what was said in a channel \u2014 e.g. an auto-followed channel you have not been @-mentioned in, or to gather context before posting. This reads CHANNEL history; for one thread's replies use slack.read_thread instead. Optional oldest/latest bound the time window (Slack ts values). Returns messages oldest\u2192newest. The bot only sees channels it has been invited to \u2014 a "not_in_channel" error means someone must /invite the bot first.`,
+      description: `Read recent top-level messages in a Slack channel the bot is a member of (via conversations.history). Use this to catch up on what was said in a channel \u2014 e.g. an auto-followed channel you have not been @-mentioned in, or to gather context before posting. This reads CHANNEL history; for one thread's replies use slack_read_thread instead. Optional oldest/latest bound the time window (Slack ts values). Returns messages oldest\u2192newest. The bot only sees channels it has been invited to \u2014 a "not_in_channel" error means someone must /invite the bot first.`,
       inputSchema: {
         type: "object",
         properties: {
@@ -47501,7 +47522,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
     ...blockKitToolsAvailable() ? [
       {
         name: "slack.send_structured",
-        description: "Send a Slack message built from Block Kit blocks (structured layout: headers, sections, dividers, context, action buttons). Use when plain text isn't enough \u2014 status reports, confirmations with multiple fields, calls-to-action with buttons. Pass a `text` fallback for push notifications. Returns { message_ts, permalink }. Does NOT block waiting for user interactions; for that use slack.ask_user.",
+        description: "Send a Slack message built from Block Kit blocks (structured layout: headers, sections, dividers, context, action buttons). Use when plain text isn't enough \u2014 status reports, confirmations with multiple fields, calls-to-action with buttons. Pass a `text` fallback for push notifications. Returns { message_ts, permalink }. Does NOT block waiting for user interactions; for that use slack_ask_user.",
         inputSchema: {
           type: "object",
           properties: {
@@ -47596,7 +47617,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
       },
       {
         name: "slack.ask_user",
-        description: "Post a question to Slack with multiple-choice buttons and BLOCK until the user taps one (or the timeout fires). Returns the user's choice as { value, label, responded_by, timed_out, responded_at }. Use sparingly \u2014 this stops the agent for up to 5 minutes by default. Prefer plain slack.reply for asking questions where you don't need a structured answer back.",
+        description: "Post a question to Slack with multiple-choice buttons and BLOCK until the user taps one (or the timeout fires). Returns the user's choice as { value, label, responded_by, timed_out, responded_at }. Use sparingly \u2014 this stops the agent for up to 5 minutes by default. Prefer plain slack_reply for asking questions where you don't need a structured answer back.",
         inputSchema: {
           type: "object",
           properties: {
@@ -47652,7 +47673,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: "slack.channel_info",
-      description: 'Verify the bot can post to a specific Slack channel, OR resolve who is on the other side of a DM. Use this before relying on a channel ID for delivery (e.g. before submitting an AWS access request that will notify an approval channel) to avoid silent posting failures, and to confirm the human behind a DM channel id before claiming a message reached a named person. Works for public AND private channels (unlike slack.list_channels, which is public-only) and for DM (`D0...`) channels. Returns `{ ok, channel: { id, name, is_private, is_archived, is_member, kind }, bot_user_handle, reason? }`. For a DM, `kind` is "dm" and the result also carries `channel.user` (the partner\'s Slack user id) plus best-effort `channel.user_handle` and `channel.user_name` (the human\'s handle and display name); use these to VERIFY a DM\'s recipient rather than assuming whose DM it is. When `ok=false`, branch on `reason`: "channel_not_found" or "not_in_channel" \u2192 tell the user to run `/invite @<bot_user_handle>` in that channel (the configured ID exists but your bot isn\'t a member, or the ID is from a workspace the bot isn\'t installed in); "archived" \u2192 the channel exists but is archived, ask an admin to point the integration at a non-archived channel; "auth_failed" \u2192 bot token is invalid, escalate to an operator (do not surface to the end user). Pass the raw C0.../G0.../D0... channel ID, not a human name (use slack.list_channels for name \u2192 ID).',
+      description: 'Verify the bot can post to a specific Slack channel, OR resolve who is on the other side of a DM. Use this before relying on a channel ID for delivery (e.g. before submitting an AWS access request that will notify an approval channel) to avoid silent posting failures, and to confirm the human behind a DM channel id before claiming a message reached a named person. Works for public AND private channels (unlike slack_list_channels, which is public-only) and for DM (`D0...`) channels. Returns `{ ok, channel: { id, name, is_private, is_archived, is_member, kind }, bot_user_handle, reason? }`. For a DM, `kind` is "dm" and the result also carries `channel.user` (the partner\'s Slack user id) plus best-effort `channel.user_handle` and `channel.user_name` (the human\'s handle and display name); use these to VERIFY a DM\'s recipient rather than assuming whose DM it is. When `ok=false`, branch on `reason`: "channel_not_found" or "not_in_channel" \u2192 tell the user to run `/invite @<bot_user_handle>` in that channel (the configured ID exists but your bot isn\'t a member, or the ID is from a workspace the bot isn\'t installed in); "archived" \u2192 the channel exists but is archived, ask an admin to point the integration at a non-archived channel; "auth_failed" \u2192 bot token is invalid, escalate to an operator (do not surface to the end user). Pass the raw C0.../G0.../D0... channel ID, not a human name (use slack_list_channels for name \u2192 ID).',
       inputSchema: {
         type: "object",
         properties: {
@@ -48029,7 +48050,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       });
       if (redirectNote) base += `. ${redirectNote}`;
       if (interim) {
-        const promiseNote = describePromiseStampOutcome(slackPromiseStampOutcome, "slack.reply");
+        const promiseNote = describePromiseStampOutcome(slackPromiseStampOutcome, "slack_reply");
         if (promiseNote) base += `. ${promiseNote}`;
         if (slackPromiseStampOutcome.attempted > slackPromiseStampOutcome.stamped) {
           process.stderr.write(
@@ -48110,7 +48131,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
     const { channel, ts, text } = args;
     if (!channel || !ts || typeof text !== "string") {
       return {
-        content: [{ type: "text", text: "slack.update requires channel, ts and text" }],
+        content: [{ type: "text", text: "slack_update requires channel, ts and text" }],
         isError: true
       };
     }
@@ -48317,13 +48338,13 @@ ${result.formatted}` : "No messages in range, or the bot is not a member of this
     const { file_id, channel } = args;
     if (typeof file_id !== "string" || !file_id.trim()) {
       return {
-        content: [{ type: "text", text: "slack.download_attachment requires a string `file_id`." }],
+        content: [{ type: "text", text: "slack_download_attachment requires a string `file_id`." }],
         isError: true
       };
     }
     if (typeof channel !== "string" || !channel.trim()) {
       return {
-        content: [{ type: "text", text: "slack.download_attachment requires a string `channel` (from the inbound <channel> tag)." }],
+        content: [{ type: "text", text: "slack_download_attachment requires a string `channel` (from the inbound <channel> tag)." }],
         isError: true
       };
     }
@@ -48586,7 +48607,7 @@ async function getPermalink(channel, ts) {
 async function handleSendStructured(args) {
   if (!blockKitToolsAvailable()) {
     return {
-      content: [{ type: "text", text: "slack.send_structured is disabled by the SLACK_BLOCK_KIT_DISABLED fleet kill switch." }],
+      content: [{ type: "text", text: "slack_send_structured is disabled by the SLACK_BLOCK_KIT_DISABLED fleet kill switch." }],
       isError: true
     };
   }
@@ -48681,7 +48702,7 @@ async function handleSendStructured(args) {
 }
 async function handleAskUser(args) {
   if (!askUserToolAvailable()) {
-    return errResult("slack.ask_user is disabled or the host MCP is missing AGT_HOST/AGT_API_KEY/AGT_AGENT_ID env wiring.");
+    return errResult("slack_ask_user is disabled or the host MCP is missing AGT_HOST/AGT_API_KEY/AGT_AGENT_ID env wiring.");
   }
   const { randomUUID: rndUUID } = await import("crypto");
   const runtime = await Promise.resolve().then(() => (init_slack_block_kit_runtime(), slack_block_kit_runtime_exports));

package/dist/mcp/teams-channel.js

@@ -15741,12 +15741,12 @@ var mcp = new Server(
     instructions: [
       // High-priority lines first — Claude Code truncates instructions at
       // 2048 chars, so anything appended late silently disappears.
-      "CRITICAL: every response to an MS Teams <channel> tag MUST go through teams.reply. Text in your session without a teams.reply call never reaches the user.",
-      "Messages from Teams arrive as a channel tag carrying user (an AAD id), user_name, conversation_id, service_url and reply_to_id. Pass conversation_id + service_url + reply_to_id from the tag to teams.reply verbatim; threaded replies must include reply_to_id.",
+      "CRITICAL: every response to an MS Teams <channel> tag MUST go through teams_reply. Text in your session without a teams_reply call never reaches the user.",
+      "Messages from Teams arrive as a channel tag carrying user (an AAD id), user_name, conversation_id, service_url and reply_to_id. Pass conversation_id + service_url + reply_to_id from the tag to teams_reply verbatim; threaded replies must include reply_to_id.",
       "Address users by user_name, never by raw user id (AAD object ids leak directory information).",
       "service_url is region-specific and arrives on every inbound \u2014 NEVER hardcode it, always echo the inbound value.",
       'Channel message + auto_followed="true": only reply if you have something useful to add; otherwise silently skip.',
-      "Reaction taxonomy (use teams.react sparingly \u2014 prefer a reply): like = ack; heart = success. NEVER react to signal failure \u2014 users can't tell why something failed from a reaction. On failure, teams.reply with one sentence explaining what went wrong."
+      "Reaction taxonomy (use teams_react sparingly \u2014 prefer a reply): like = ack; heart = success. NEVER react to signal failure \u2014 users can't tell why something failed from a reaction. On failure, teams_reply with one sentence explaining what went wrong."
     ].join(" ")
   }
 );
@@ -16195,7 +16195,7 @@ var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function handleSendStructured(args) {
   if (!ADAPTIVE_CARDS_ENABLED) {
     return errResult(
-      "teams.send_structured is disabled. Set MSTEAMS_ADAPTIVE_CARDS_ENABLED=true to enable Adaptive Cards."
+      "teams_send_structured is disabled. Set MSTEAMS_ADAPTIVE_CARDS_ENABLED=true to enable Adaptive Cards."
     );
   }
   const conversationId = stringArg(args, "conversation_id");
@@ -16223,7 +16223,7 @@ async function handleSendStructured(args) {
 async function handleAskUser(args) {
   if (!ADAPTIVE_CARDS_ENABLED || !ADAPTIVE_CARDS_ASK_USER_ENABLED) {
     return errResult(
-      "teams.ask_user is disabled. Set MSTEAMS_ADAPTIVE_CARDS_ENABLED=true AND MSTEAMS_ADAPTIVE_CARDS_ASK_USER_ENABLED=true to enable."
+      "teams_ask_user is disabled. Set MSTEAMS_ADAPTIVE_CARDS_ENABLED=true AND MSTEAMS_ADAPTIVE_CARDS_ASK_USER_ENABLED=true to enable."
     );
   }
   if (!PENDING_INTERACTIONS_DIR) {

package/dist/mcp/telegram-channel.js

@@ -39191,11 +39191,18 @@ var FLAG_REGISTRY = [
   },
   {
     key: "ip-allowlist-enforce-admin-debug",
-    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. Separate from the mcp flag on purpose - see that entry.",
+    description: "ENG-10594 - whether the IP allowlist on the admin-debug surface (/admin/debug/*, including the deliberately unauthenticated POST /admin/debug/token that exchanges a tlk_ key) REFUSES, or merely observes. OFF (default) = shadow: every request is still evaluated and logged with verdict=admit or verdict=would-refuse, and nothing is ever rejected. ON = a caller whose platform-attested source address is outside AGT_IP_ALLOWLIST_ADMIN_DEBUG gets a bare 403. THE SSM PARAMETER IS A SECOND LEVER AND BOTH ARE NEEDED: with the list unset this flag does nothing, because an unconfigured allowlist admits everyone by design. Arm in that order - populate the list, read the shadow logs until the would-refuse set is understood, then flip this. Deliberately global (evaluated with an empty context): the middleware runs BEFORE authentication, so there is no verified org to scope by, and taking one from an unverified request would let a caller choose its own enforcement posture. There is deliberately NO counterpart flag for the per-agent MCP surface: that one is shadow-only structurally (its ENFORCE_FLAG entry is null), so arming this one does not and cannot arm that one. See the comment below this entry for why.",
     flagType: "boolean",
-    // Shadow. The measurement comes first: nobody yet knows the real set of
-    // staff addresses, and arming against a guess locks you out of the very
-    // tool you would use to diagnose the lockout.
+    // Shadow. The measurement comes first - and ENG-10664 corrected what the
+    // measurement is OF. This comment used to say "nobody yet knows the real set
+    // of staff addresses": there is no such set. Measured over 48h, all 315
+    // requests to this surface came from ONE address, the agt-hosts AZ-2a NAT
+    // EIP - an AGENT calling the debug_* tools, not a person. The decided policy
+    // is that it stays that way (admin-debug is only ever reached from our own
+    // NAT gateways). So the pre-arm check is not "does my laptop appear" but
+    // "is every NAT EIP in the list", because an AZ whose NAT has not yet
+    // carried a debug_* call is absent from the log and would be refused the
+    // instant this flips. See docs/runbooks/ip-allowlist-rollout.md step 3.
     defaultValue: false,
     // Arming it changes who can reach production diagnostics. Worth one
     // confirmation.
@@ -39210,20 +39217,34 @@ var FLAG_REGISTRY = [
   // ENFORCE_FLAG (packages/api/src/middleware/ip-allowlist.ts) is null, so no
   // flag is consulted and no flag flip can arm it.
   //
-  // Why it is not simply a second flag defaulting false: most of that surface's
-  // callers have no allowlistable address at all. Per ADR-0032 only hosts in the
-  // agt-hosts account egress through stable NAT EIPs; a host with
-  // provision_source `self` or `customer-ec2`, or any BYO account, egresses from
-  // an address the control plane cannot know. Arming against that population
-  // black-holes a customer's whole fleet, and per
-  // docs/runbooks/composio-allowlist-rollout.md this class of change has no
+  // Why it is not simply a second flag defaulting false (CORRECTED, ENG-10664):
+  //
+  // This comment used to say the callers are agent HOSTS, most of which have no
+  // allowlistable address per ADR-0032. That is the wrong caller. Agent hosts do
+  // not call this surface at all: its handler's first act is
+  // validateMcpAccessToken() against `mcp_oauth_tokens` (routes/mcp.ts:87, token
+  // check at :91), so a host JWT is rejected outright - routes/host-runtime.ts
+  // :33421 says so in as many words, which is why the ENG-4724 /host/* twins
+  // exist. The caller set is remote MCP OAuth clients, structurally.
+  //
+  // The conclusion is unchanged and ONLY the reason has moved. Allowlisting this
+  // surface would mean pinning a THIRD PARTY's egress ranges rather than our own
+  // NAT EIPs - a different control, a different owner, a different failure mode:
+  // they move a range and agent MCP access breaks with no signal on our side.
+  // Per docs/runbooks/composio-allowlist-rollout.md this class of change has no
   // fleet-level undo. A flag would leave that one toggle away during an
   // incident, from someone who had just armed the admin-debug surface and
   // reasonably assumed the pair moved together. Requiring a code change puts
   // review in front of an irreversible action, which is the right price.
   //
-  // If the shadow data ever shows the population IS allowlistable, adding the
-  // flag here and a key in ENFORCE_FLAG is a small, deliberate diff.
+  // Keeping the false rationale would have been worse than having none: a reader
+  // who checked it would find it does not hold and might "fix" it by adding the
+  // flag. That is the failure this rewrite exists to prevent.
+  //
+  // If we ever DECIDE to take on that third-party dependency deliberately,
+  // adding the flag here and a key in ENFORCE_FLAG is a small diff - but it is a
+  // decision to own someone else's egress, not a discovery that the population
+  // was allowlistable all along.
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
 
@@ -40796,13 +40817,13 @@ function validateLeaveChatArgs(args) {
   if (typeof chat_id !== "string" || !chat_id.trim()) {
     return {
       ok: false,
-      message: "telegram.leave_chat requires chat_id (from the <channel> tag)."
+      message: "telegram_leave_chat requires chat_id (from the <channel> tag)."
     };
   }
   if (typeof reason !== "string" || !reason.trim()) {
     return {
       ok: false,
-      message: "telegram.leave_chat requires a reason (a non-empty string). It is logged, not sent to the chat."
+      message: "telegram_leave_chat requires a reason (a non-empty string). It is logged, not sent to the chat."
     };
   }
   return { ok: true, chatId: chat_id.trim(), reason: reason.trim() };
@@ -42555,19 +42576,19 @@ async function actuateHostRestart(opts) {
 
 // src/telegram-mcp-instructions.ts
 var MAX_SKIP_REACTION_UNITS = 8;
-var REACT_POLICY = `Reacting is egress and does NOT settle anything \u2014 telegram.consume is what settles. Never react in a chat you are barred from, and never post a "this wasn't for me" message.`;
+var REACT_POLICY = `Reacting is egress and does NOT settle anything \u2014 telegram_consume is what settles. Never react in a chat you are barred from, and never post a "this wasn't for me" message.`;
 function buildTelegramMcpInstructions(opts) {
   const emoji2 = opts.skipReaction ?? "";
   const skipReactionOn = opts.skipReactionOn && emoji2.length > 0 && emoji2.length <= MAX_SKIP_REACTION_UNITS;
   return [
-    "CRITICAL: every response to a Telegram <channel> tag MUST go through telegram.reply with the chat_id from the tag \u2014 typed text never reaches the user. Slow work: interim ack (telegram.reply interim:true), then your FINAL answer as a separate telegram.reply (interim omitted). An ack is not the answer.",
+    "CRITICAL: every response to a Telegram <channel> tag MUST go through telegram_reply with the chat_id from the tag \u2014 typed text never reaches the user. Slow work: interim ack (telegram_reply interim:true), then your FINAL answer as a separate telegram_reply (interim omitted). An ack is not the answer.",
     "Messages from Telegram arrive as a channel tag carrying chat_id, user, user_name and message_id. Pass reply_to_message_id from the tag so the response lands as a quote-reply in busy chats.",
-    "Deliberately NOT replying (a standing rule bars you from that chat, or the message only changed state)? Call telegram.consume with the chat_id and a short reason: it settles the message without posting anything. Without a reply or a consume it counts as undelivered and re-delivers to you forever.",
-    "Inbound attachments: `files` on the tag is a JSON string \u2014 JSON.parse it. An entry with `path` (or top-level `image_path`) is already downloaded \u2014 Read it. Entries with `file_id` and no `path` need telegram.download_attachment (file_id + chat_id), then Read the returned path.",
+    "Deliberately NOT replying (a standing rule bars you from that chat, or the message only changed state)? Call telegram_consume with the chat_id and a short reason: it settles the message without posting anything. Without a reply or a consume it counts as undelivered and re-delivers to you forever.",
+    "Inbound attachments: `files` on the tag is a JSON string \u2014 JSON.parse it. An entry with `path` (or top-level `image_path`) is already downloaded \u2014 Read it. Entries with `file_id` and no `path` need telegram_download_attachment (file_id + chat_id), then Read the returned path.",
     'For work >30s follow the CLAUDE.md kanban flow: kanban_add \u2192 reply "On it \u2014 tracking here: <kanban URL>" \u2192 in_progress \u2192 reply the result. Simple lookups skip kanban but still reply.',
     "Address users by user_name; user is the numeric Telegram ID. Resolve ambiguous times against your own Timezone from CLAUDE.md \u2014 do not ask.",
-    "Reactions (telegram.react sparingly \u2014 prefer a reply): \u{1F440} = ack (auto-added, do not duplicate); \u{1F44D} or \u{1F389} = success." + (skipReactionOn ? ` ${emoji2} = seen, not replying.` : "") + " NEVER react to signal failure of YOUR work \u2014 telegram.reply one sentence explaining it. Free-tier emoji only: \u{1F44D} \u{1F44E} \u2764 \u{1F525} \u{1F389} \u{1F64F} \u{1F44C} \u{1F440} \u{1F4AF} \u{1FAE1}.",
-    skipReactionOn ? `${REACT_POLICY} Where engaging IS permitted you may also telegram.react "${emoji2}" after consuming.` : REACT_POLICY
+    "Reactions (telegram_react sparingly \u2014 prefer a reply): \u{1F440} = ack (auto-added, do not duplicate); \u{1F44D} or \u{1F389} = success." + (skipReactionOn ? ` ${emoji2} = seen, not replying.` : "") + " NEVER react to signal failure of YOUR work \u2014 telegram_reply one sentence explaining it. Free-tier emoji only: \u{1F44D} \u{1F44E} \u2764 \u{1F525} \u{1F389} \u{1F64F} \u{1F44C} \u{1F440} \u{1F4AF} \u{1FAE1}.",
+    skipReactionOn ? `${REACT_POLICY} Where engaging IS permitted you may also telegram_react "${emoji2}" after consuming.` : REACT_POLICY
   ].filter(Boolean).join(" ");
 }
 
@@ -45100,7 +45121,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
           },
           interim: {
             type: "boolean",
-            description: 'Set true ONLY when this is an interim acknowledgement (e.g. "On it \u2014 checking now\u2026") and the real answer is still coming. The system keeps tracking this chat as awaiting your final reply. Your eventual substantive answer MUST be a separate telegram.reply with interim omitted/false \u2014 that is what marks the request complete. Omit (default false) for any reply that fully answers the user.'
+            description: 'Set true ONLY when this is an interim acknowledgement (e.g. "On it \u2014 checking now\u2026") and the real answer is still coming. The system keeps tracking this chat as awaiting your final reply. Your eventual substantive answer MUST be a separate telegram_reply with interim omitted/false \u2014 that is what marks the request complete. Omit (default false) for any reply that fully answers the user.'
           }
         },
         required: ["chat_id", "text"]
@@ -45108,7 +45129,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: "telegram.consume",
-      description: "Acknowledge Telegram message(s) you handled WITHOUT sending a reply \u2014 a message you deliberately did not answer because a standing rule forbids engaging in that chat, or one that only updated state. Pass the chat_id from the <channel> tag. If you send a telegram.reply you do NOT also need to consume: the reply already acknowledges the message. Without one of the two, a silently-handled message is treated as undelivered and is re-delivered to you indefinitely. Clears the chat, not one message \u2014 that is Telegram's conversation grain \u2014 and only messages received up to the one you are answering, so an inbound that arrives while you are deciding is never discarded unseen.",
+      description: "Acknowledge Telegram message(s) you handled WITHOUT sending a reply \u2014 a message you deliberately did not answer because a standing rule forbids engaging in that chat, or one that only updated state. Pass the chat_id from the <channel> tag. If you send a telegram_reply you do NOT also need to consume: the reply already acknowledges the message. Without one of the two, a silently-handled message is treated as undelivered and is re-delivered to you indefinitely. Clears the chat, not one message \u2014 that is Telegram's conversation grain \u2014 and only messages received up to the one you are answering, so an inbound that arrives while you are deciding is never discarded unseen.",
       inputSchema: {
         type: "object",
         properties: {
@@ -45211,7 +45232,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: "telegram.react",
-      description: `Add an emoji reaction to a Telegram message. Use sparingly \u2014 prefer a text reply via telegram.reply. Reaction taxonomy: \u{1F44D} or \u{1F389} = action completed successfully. NEVER react to signal failure of your work \u2014 users can't tell why it failed from a reaction. On failure, call telegram.reply with one sentence explaining what went wrong instead. \u{1F440} is already auto-applied on inbound; do not duplicate. Only free-tier emoji reactions are available to bots (Premium-only emoji fail silently). Pass an empty string or omit emoji to clear the bot's reaction on that message. (Note: when a message arrives while the agent is offline/wedged, the runtime \u2014 not you \u2014 posts a brief "can't respond right now" notice; you never need to add a failure reaction for that.)`,
+      description: `Add an emoji reaction to a Telegram message. Use sparingly \u2014 prefer a text reply via telegram_reply. Reaction taxonomy: \u{1F44D} or \u{1F389} = action completed successfully. NEVER react to signal failure of your work \u2014 users can't tell why it failed from a reaction. On failure, call telegram_reply with one sentence explaining what went wrong instead. \u{1F440} is already auto-applied on inbound; do not duplicate. Only free-tier emoji reactions are available to bots (Premium-only emoji fail silently). Pass an empty string or omit emoji to clear the bot's reaction on that message. (Note: when a message arrives while the agent is offline/wedged, the runtime \u2014 not you \u2014 posts a brief "can't respond right now" notice; you never need to add a failure reaction for that.)`,
       inputSchema: {
         type: "object",
         properties: {
@@ -45427,7 +45448,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
     const { chat_id, reason } = args;
     if (!chat_id) {
       return {
-        content: [{ type: "text", text: "telegram.consume requires chat_id (from the <channel> tag)." }],
+        content: [{ type: "text", text: "telegram_consume requires chat_id (from the <channel> tag)." }],
         isError: true
       };
     }
@@ -45563,7 +45584,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       if (name === "telegram.reply") {
         if (interim) {
           markPromisedPendingMessage(chat_id, drainCutoffMs);
-          promiseNote = describePromiseStampOutcome(telegramPromiseStampOutcome, "telegram.reply");
+          promiseNote = describePromiseStampOutcome(telegramPromiseStampOutcome, "telegram_reply");
         } else {
           clearPendingMessage(chat_id, drainCutoffMs);
         }
@@ -45623,13 +45644,13 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
     const { file_id, chat_id } = args;
     if (typeof file_id !== "string" || !file_id.trim()) {
       return {
-        content: [{ type: "text", text: "telegram.download_attachment requires a string `file_id`." }],
+        content: [{ type: "text", text: "telegram_download_attachment requires a string `file_id`." }],
         isError: true
       };
     }
     if (typeof chat_id !== "string" || !chat_id.trim()) {
       return {
-        content: [{ type: "text", text: "telegram.download_attachment requires a string `chat_id` (from the inbound <channel> tag)." }],
+        content: [{ type: "text", text: "telegram_download_attachment requires a string `chat_id` (from the inbound <channel> tag)." }],
         isError: true
       };
     }

package/dist/mcp/whatsapp-channel.js

@@ -156049,19 +156049,19 @@ var mcp = new Server(
       tools: {}
     },
     instructions: (IS_BAILEYS ? [
-      "CRITICAL: every response to a WhatsApp <channel> tag MUST go through whatsapp.reply. Text in your session without a tool call never reaches the user.",
-      "Messages arrive as a channel tag carrying sender (a JID), conversation_id and message_id. Pass the `sender` value verbatim as the `to` argument to whatsapp.reply.",
-      "whatsapp.reply sends free-form text with no restrictions (this is a linked personal number, not a business template flow)."
+      "CRITICAL: every response to a WhatsApp <channel> tag MUST go through whatsapp_reply. Text in your session without a tool call never reaches the user.",
+      "Messages arrive as a channel tag carrying sender (a JID), conversation_id and message_id. Pass the `sender` value verbatim as the `to` argument to whatsapp_reply.",
+      "whatsapp_reply sends free-form text with no restrictions (this is a linked personal number, not a business template flow)."
     ] : [
-      "CRITICAL: every response to a WhatsApp <channel> tag MUST go through whatsapp.reply (or whatsapp.send_template). Text in your session without a tool call never reaches the user.",
-      "Messages arrive as a channel tag carrying sender, conversation_id and message_id. Pass the `sender` value verbatim as the `to` argument to whatsapp.reply.",
-      "whatsapp.reply sends free-form text and only works inside the 24h customer-service window (24h since the user last messaged). If it reports the window is closed, use whatsapp.send_template with a pre-approved template instead."
+      "CRITICAL: every response to a WhatsApp <channel> tag MUST go through whatsapp_reply (or whatsapp_send_template). Text in your session without a tool call never reaches the user.",
+      "Messages arrive as a channel tag carrying sender, conversation_id and message_id. Pass the `sender` value verbatim as the `to` argument to whatsapp_reply.",
+      "whatsapp_reply sends free-form text and only works inside the 24h customer-service window (24h since the user last messaged). If it reports the window is closed, use whatsapp_send_template with a pre-approved template instead."
     ]).join(" ")
   }
 );
 var replyTool = {
   name: "whatsapp.reply",
-  description: IS_BAILEYS ? "Send a WhatsApp text reply. Pass the inbound `sender` (a JID) value as `to`. Free-form, no restrictions." : "Send a free-form WhatsApp text reply. Pass the inbound `sender` value as `to`. Only deliverable inside the 24h customer-service window; outside it, use whatsapp.send_template.",
+  description: IS_BAILEYS ? "Send a WhatsApp text reply. Pass the inbound `sender` (a JID) value as `to`. Free-form, no restrictions." : "Send a free-form WhatsApp text reply. Pass the inbound `sender` value as `to`. Only deliverable inside the 24h customer-service window; outside it, use whatsapp_send_template.",
   inputSchema: {
     type: "object",
     properties: {
@@ -156123,7 +156123,7 @@ async function handleReply(a) {
   const lastInbound = lastInboundBySender.get(to) ?? null;
   if (chooseOutboundMode(lastInbound, Date.now()) === "template") {
     return errResult(
-      "The 24h customer-service window for this recipient is closed (no inbound within 24h). Free-form text cannot be delivered \u2014 use whatsapp.send_template with a pre-approved template."
+      "The 24h customer-service window for this recipient is closed (no inbound within 24h). Free-form text cannot be delivered \u2014 use whatsapp_send_template with a pre-approved template."
     );
   }
   const res = await kapso.sendText(to, text);
@@ -156131,7 +156131,7 @@ async function handleReply(a) {
   return { content: [{ type: "text", text: `sent (message_id=${res.messageId ?? "unknown"})` }] };
 }
 async function handleSendTemplate(a) {
-  if (IS_BAILEYS) return errResult("Templates are not used in QR-link mode \u2014 use whatsapp.reply to send freely.");
+  if (IS_BAILEYS) return errResult("Templates are not used in QR-link mode \u2014 use whatsapp_reply to send freely.");
   if (!kapso) return errResult("WhatsApp outbound is not configured (missing WHATSAPP_PROJECT_API_KEY / WHATSAPP_PHONE_NUMBER_ID).");
   const to = stringArg(a, "to");
   const name = stringArg(a, "template");

package/dist/{persistent-session-YJJXZSUE.js → persistent-session-26W47NVS.js}

@@ -62,8 +62,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-PHPOHMSK.js";
-import "./chunk-HRHDATT5.js";
+} from "./chunk-KTFN2AIB.js";
+import "./chunk-VF5BT7BP.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 export {
@@ -131,4 +131,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-YJJXZSUE.js.map
+//# sourceMappingURL=persistent-session-26W47NVS.js.map

package/dist/{responsiveness-probe-SQZGSNVI.js → responsiveness-probe-KMHYGGYP.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-PHPOHMSK.js";
-import "./chunk-HRHDATT5.js";
+} from "./chunk-KTFN2AIB.js";
+import "./chunk-VF5BT7BP.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 
@@ -800,4 +800,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-SQZGSNVI.js.map
+//# sourceMappingURL=responsiveness-probe-KMHYGGYP.js.map

package/dist/{session-auth-dead-7OLNDHJC.js → session-auth-dead-CRG2ESD2.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-HRHDATT5.js";
+} from "./chunk-VF5BT7BP.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-7OLNDHJC.js.map
+//# sourceMappingURL=session-auth-dead-CRG2ESD2.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.974",
+  "version": "0.28.976",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {