agim-cli 1.2.68 → 1.2.69

package/dist/web/server.js

@@ -1509,17 +1509,29 @@ async function handleGetConfig(_req, res) {
         const { isGlobalImEnabled, isRemoteAgentEnabled } = await import('../core/feature-flags.js');
         const showGlobalIm = isGlobalImEnabled();
         const showRemoteAgent = isRemoteAgentEnabled();
+        // v1.2.69 — IM platform blacklist. When an operator sets
+        // IMHUB_PLATFORM_BLACKLIST=telegram,discord (etc.), those platforms
+        // are hidden from the admin SPA entirely — credentials still live
+        // on disk but the UI shows nothing for that platform AND the
+        // registry refuses to register the adapter at boot. Default empty.
+        const { isPlatformBlacklisted: blocked } = await import('../core/registry.js');
+        // v1.2.69 — strip blacklisted entries from the `messengers`
+        // dictionary so the SPA's per-platform toggle row also vanishes
+        // (rendered from this object's keys).
+        const visibleMessengers = config.messengers
+            ? Object.fromEntries(Object.entries(config.messengers).filter(([k]) => !blocked(k)))
+            : config.messengers;
         sendJson(res, 200, {
-            messengers: config.messengers,
+            messengers: visibleMessengers,
             agents: config.agents,
             defaultAgent: config.defaultAgent,
-            telegram: showGlobalIm && config.telegram
+            telegram: showGlobalIm && config.telegram && !blocked('telegram')
                 ? { botToken: mask(config.telegram.botToken), channelId: config.telegram.channelId }
                 : undefined,
-            feishu: config.feishu
+            feishu: config.feishu && !blocked('feishu')
                 ? { appId: config.feishu.appId, appSecret: mask(config.feishu.appSecret) }
                 : undefined,
-            dingtalk: config.dingtalk
+            dingtalk: config.dingtalk && !blocked('dingtalk')
                 ? {
                     clientId: config.dingtalk.clientId,
                     clientSecret: mask(config.dingtalk.clientSecret),
@@ -1543,7 +1555,7 @@ async function handleGetConfig(_req, res) {
                         : undefined,
                 }
                 : undefined,
-            discord: showGlobalIm && config.discord
+            discord: showGlobalIm && config.discord && !blocked('discord')
                 ? {
                     botToken: mask(config.discord.botToken),
                     channelId: config.discord.channelId,
@@ -2686,6 +2698,10 @@ const ENV_EDITABLE_KEYS = [
     'IMHUB_EXEC_MAX_OUTPUT',
     // Native call_agent per-turn cap.
     'IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN',
+    // v1.2.69 — IM platform blacklist (CSV of platform ids). Default
+    // empty (no blocks); listed platforms vanish from web + CLI + are
+    // refused at registry.registerMessenger.
+    'IMHUB_PLATFORM_BLACKLIST',
 ];
 const SECRET_KEYS = new Set(['IMHUB_SMTP_PASS', 'IMHUB_BAIDU_MAP_AK', 'IMHUB_MEMORY_VECTOR_OPENAI_API_KEY']);
 // maskSecret moved to ./env-mask.ts (imported at the top of this file
@@ -2720,6 +2736,8 @@ async function handleSecurityDiagnostics(_req, res) {
         const senderAllowlistConfigured = isSenderAllowlistConfigured();
         const { isAllowlistConfigured: isAdminConfigured } = await import('../core/admin-allowlist.js');
         const adminAllowlistConfigured = isAdminConfigured();
+        const { getPlatformBlacklist } = await import('../core/registry.js');
+        const platformBlacklist = getPlatformBlacklist();
         sendJson(res, 200, {
             diagnostics: {
                 runningAsRoot,
@@ -2727,6 +2745,7 @@ async function handleSecurityDiagnostics(_req, res) {
                 bwrapAvailable,
                 senderAllowlistConfigured,
                 adminAllowlistConfigured,
+                platformBlacklist,
                 // Live env values so the UI can show what's effectively in force
                 // (process.env, which is what runtime sees) without round-tripping
                 // through the env file.