@integrity-labs/agt-cli 0.28.978 → 0.28.980

package/dist/mcp/teams-channel.js

@@ -15227,6 +15227,59 @@ function teamsInboundId(conversationId, activityId) {
   return hashInboundId(`${conversationId}|${activityId}`);
 }
 
+// src/impersonation.ts
+var ENV_VAR = "AGT_ACT_AS_AGENT_ID";
+var OVERRIDE_ENV_VAR = "ENABLE_IMPERSONATION_CHANNELS";
+function isImpersonating() {
+  return impersonatedAgentId() !== null;
+}
+function impersonatedAgentId() {
+  const raw = process.env[ENV_VAR];
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function channelsEnabledOverride() {
+  const raw = process.env[OVERRIDE_ENV_VAR];
+  if (typeof raw !== "string") return false;
+  const trimmed = raw.trim().toLowerCase();
+  return trimmed === "1" || trimmed === "true" || trimmed === "yes" || trimmed === "on";
+}
+var IMPERSONATION_REFUSAL_CODE = "CHANNEL.IMPERSONATION_DISABLED";
+var IMPERSONATION_REFUSAL_MESSAGE = "Posting as an agent under impersonation is disabled in v0 \u2014 quit impersonation with `agt impersonate exit` to send as yourself.";
+function buildImpersonationRefusal(toolName) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify({
+          error: {
+            code: IMPERSONATION_REFUSAL_CODE,
+            message: IMPERSONATION_REFUSAL_MESSAGE,
+            tool: toolName
+          }
+        })
+      }
+    ],
+    isError: true
+  };
+}
+function shouldRefuseImpersonatedEgress(toolName, egressTools) {
+  if (!isImpersonating()) return null;
+  if (channelsEnabledOverride()) return null;
+  if (!egressTools.has(toolName)) return null;
+  return buildImpersonationRefusal(toolName);
+}
+
+// src/channel-egress-tools.ts
+var TEAMS_EGRESS_TOOLS = /* @__PURE__ */ new Set([
+  "teams.reply",
+  "teams.react",
+  "teams.send_structured",
+  "teams.ask_user",
+  "teams.upload_file"
+]);
+
 // src/teams-channel.ts
 var APP_ID = process.env.MSTEAMS_APP_ID ?? null;
 var CLIENT_SECRET = process.env.MSTEAMS_CLIENT_SECRET ?? null;
@@ -15907,6 +15960,13 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
 mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
   const { name, arguments: args } = req.params;
   const a = args ?? {};
+  const impersonationRefusal = shouldRefuseImpersonatedEgress(
+    name,
+    TEAMS_EGRESS_TOOLS
+  );
+  if (impersonationRefusal) {
+    return { ...impersonationRefusal };
+  }
   if (name === "teams.reply") return handleReply(a);
   if (name === "teams.react") return handleReact(a);
   if (name === "teams.read_thread") return handleReadThread(a);

package/dist/mcp/whatsapp-channel.js

@@ -155882,6 +155882,56 @@ async function startBaileysSession(opts) {
   };
 }
 
+// src/impersonation.ts
+var ENV_VAR = "AGT_ACT_AS_AGENT_ID";
+var OVERRIDE_ENV_VAR = "ENABLE_IMPERSONATION_CHANNELS";
+function isImpersonating() {
+  return impersonatedAgentId() !== null;
+}
+function impersonatedAgentId() {
+  const raw = process.env[ENV_VAR];
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function channelsEnabledOverride() {
+  const raw = process.env[OVERRIDE_ENV_VAR];
+  if (typeof raw !== "string") return false;
+  const trimmed = raw.trim().toLowerCase();
+  return trimmed === "1" || trimmed === "true" || trimmed === "yes" || trimmed === "on";
+}
+var IMPERSONATION_REFUSAL_CODE = "CHANNEL.IMPERSONATION_DISABLED";
+var IMPERSONATION_REFUSAL_MESSAGE = "Posting as an agent under impersonation is disabled in v0 \u2014 quit impersonation with `agt impersonate exit` to send as yourself.";
+function buildImpersonationRefusal(toolName) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify({
+          error: {
+            code: IMPERSONATION_REFUSAL_CODE,
+            message: IMPERSONATION_REFUSAL_MESSAGE,
+            tool: toolName
+          }
+        })
+      }
+    ],
+    isError: true
+  };
+}
+function shouldRefuseImpersonatedEgress(toolName, egressTools) {
+  if (!isImpersonating()) return null;
+  if (channelsEnabledOverride()) return null;
+  if (!egressTools.has(toolName)) return null;
+  return buildImpersonationRefusal(toolName);
+}
+
+// src/channel-egress-tools.ts
+var WHATSAPP_EGRESS_TOOLS = /* @__PURE__ */ new Set([
+  "whatsapp.reply",
+  "whatsapp.send_template"
+]);
+
 // src/whatsapp-channel.ts
 var CODE_NAME = process.env["AGT_AGENT_CODE_NAME"] ?? "";
 var PENDING_INBOUND_DIR = CODE_NAME ? join4(homedir(), ".augmented", CODE_NAME, "whatsapp-pending-inbound") : null;
@@ -156091,13 +156141,30 @@ var sendTemplateTool = {
 };
 mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
   // Templates are a Cloud-API (kapso) concept — not exposed in baileys mode.
-  tools: IS_BAILEYS ? [replyTool] : [replyTool, sendTemplateTool]
+  //
+  // ENG-10753 — written as one array with a conditional tail rather than
+  // `IS_BAILEYS ? [replyTool] : [replyTool, sendTemplateTool]`, which is the
+  // same registration and was not readable. The egress test enumerates each
+  // server's tools from this AST to assert every one is classified as egress
+  // or read-only; the ternary form made that walk THROW, and a server whose
+  // registration cannot be read is a server the classification test cannot
+  // cover — which is how this file came to have no impersonation gate while
+  // three of its siblings did. Keep both branches enumerable: a tool behind a
+  // provider flag is still a tool, and still needs gating.
+  tools: [replyTool, ...IS_BAILEYS ? [] : [sendTemplateTool]]
 }));
 var errResult = (text) => ({ content: [{ type: "text", text }], isError: true });
 var stringArg = (a, k) => typeof a[k] === "string" && a[k].length > 0 ? a[k] : null;
 mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
   const { name, arguments: args } = req.params;
   const a = args ?? {};
+  const impersonationRefusal = shouldRefuseImpersonatedEgress(
+    name,
+    WHATSAPP_EGRESS_TOOLS
+  );
+  if (impersonationRefusal) {
+    return { ...impersonationRefusal };
+  }
   if (name === "whatsapp.reply") return handleReply(a);
   if (name === "whatsapp.send_template") return handleSendTemplate(a);
   return errResult(`Unknown tool: ${name}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.978",
+  "version": "0.28.980",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {