@integrity-labs/agt-cli 0.28.98 → 0.28.100

package/dist/mcp/slack-channel.js

@@ -14353,6 +14353,12 @@ function decideInboundAccess(input) {
   return { kind: "admit" };
 }
 
+// src/onboarding-dm-gate.ts
+var ONBOARDING_DM_ONLY_MESSAGE = "Sorry, I can only be onboarded from a Direct Message (DM).";
+function isSlackDirectMessage(channelId) {
+  return typeof channelId === "string" && channelId.startsWith("D");
+}
+
 // src/flags-cache-read.ts
 import { existsSync, readFileSync } from "fs";
 import { homedir } from "os";
@@ -18193,6 +18199,14 @@ async function postEphemeralViaResponseUrl(responseUrl, text, logTag) {
 }
 async function forwardOnboardingSlashCommand(opts) {
   const { verb, path, userId, channelId, responseUrl, codeName } = opts;
+  if (!isSlackDirectMessage(channelId)) {
+    await postEphemeralViaResponseUrl(
+      responseUrl,
+      `:warning: ${ONBOARDING_DM_ONLY_MESSAGE}`,
+      codeName
+    );
+    return;
+  }
   if (!AGT_HOST || !AGT_API_KEY || !AGT_AGENT_ID) {
     await postEphemeralViaResponseUrl(
       responseUrl,

package/dist/mcp/telegram-channel.js

@@ -15033,6 +15033,12 @@ function decideInboundAccess(input) {
   return { kind: "admit" };
 }
 
+// src/onboarding-dm-gate.ts
+var ONBOARDING_DM_ONLY_MESSAGE = "Sorry, I can only be onboarded from a Direct Message (DM).";
+function isTelegramPrivateChat(chatType) {
+  return chatType === "private";
+}
+
 // src/flags-cache-read.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -15698,14 +15704,18 @@ var RESTART = {
   command: "restart",
   description: "Restart this agent"
 };
+var ONBOARD = {
+  command: "onboard",
+  description: "Re-run this agent's onboarding (re-interview; config kept)"
+};
 var INVESTIGATE = {
   command: "investigate",
   description: "Live tail of this agent's terminal pane (operators only)"
 };
 function buildCommandRegistrations() {
   return [
-    { scope: { type: "default" }, commands: [HELP, STATUS, RESTART] },
-    { scope: { type: "all_private_chats" }, commands: [HELP, STATUS, RESTART, INVESTIGATE] }
+    { scope: { type: "default" }, commands: [HELP, STATUS, RESTART, ONBOARD] },
+    { scope: { type: "all_private_chats" }, commands: [HELP, STATUS, RESTART, ONBOARD, INVESTIGATE] }
   ];
 }
 
@@ -17334,6 +17344,14 @@ async function handleOnboardingCommand(opts) {
       );
     }
   };
+  if (!isTelegramPrivateChat(opts.chatType)) {
+    process.stderr.write(
+      `telegram-channel(${AGENT_CODE_NAME}): ${verb} rejected \u2014 not a DM (chat ${redactId(opts.chatId)}, type=${opts.chatType ?? "unknown"})
+`
+    );
+    await reply(`\u26A0\uFE0F ${ONBOARDING_DM_ONLY_MESSAGE}`);
+    return;
+  }
   if (!AGT_HOST || !AGT_API_KEY || !AGT_AGENT_ID) {
     process.stderr.write(
       `telegram-channel(${AGENT_CODE_NAME}): ${verb} missing AGT_* env \u2014 cannot reach host runtime
@@ -19383,7 +19401,9 @@ async function pollLoop() {
               mode: access.command === "onboard" ? "reset" : "resume",
               // ENG-6578: the manager gate compares the SENDER's user-id (not the
               // chat id — they differ in groups) to the resolved manager principal.
-              senderId: msg.from?.id != null ? String(msg.from.id) : void 0
+              senderId: msg.from?.id != null ? String(msg.from.id) : void 0,
+              // ENG-6646: DM-only — reject group/supergroup/channel before forwarding.
+              chatType: msg.chat.type ?? null
             });
           }
           continue;

package/dist/{persistent-session-KAOPVQPC.js → persistent-session-6CU3BIHP.js}

@@ -34,8 +34,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-5NQ652SP.js";
-import "./chunk-TRKWWYRN.js";
+} from "./chunk-WNN5WT42.js";
+import "./chunk-5DYG42FL.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -74,4 +74,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-KAOPVQPC.js.map
+//# sourceMappingURL=persistent-session-6CU3BIHP.js.map

package/dist/{responsiveness-probe-OJPF6XDF.js → responsiveness-probe-GLZZZ2OK.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-5NQ652SP.js";
-import "./chunk-TRKWWYRN.js";
+} from "./chunk-WNN5WT42.js";
+import "./chunk-5DYG42FL.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -250,4 +250,4 @@ export {
   parkPendingInbound,
   readAndResetChannelDeflections
 };
-//# sourceMappingURL=responsiveness-probe-OJPF6XDF.js.map
+//# sourceMappingURL=responsiveness-probe-GLZZZ2OK.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.98",
+  "version": "0.28.100",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {