@agents-at-scale/ark 0.1.68 → 0.1.70

package/dist/arkServices.js

@@ -108,6 +108,9 @@ const defaultArkServices = {
         category: 'core',
         chartPath: `${REGISTRY_BASE}/ark-tenant:${CHART_VERSION}`,
         installArgs: [],
+        // Without a broker, a tenant loses conversation history (issue #2642).
+        requires: ['ark-broker'],
+        dependencyOverrideArgs: ['--set', 'memory.requireBroker=false'],
     },
     'ark-api': {
         name: 'ark-api',
@@ -158,6 +161,7 @@ const defaultArkServices = {
         helmReleaseName: 'ark-broker',
         description: 'In-memory storage service with streaming support for Ark queries',
         enabled: true,
+        mandatory: true,
         category: 'service',
         chartPath: `${REGISTRY_BASE}/ark-broker:${CHART_VERSION}`,
         installArgs: [],

package/dist/commands/export/index.js

@@ -3,6 +3,14 @@ import * as fs from 'fs/promises';
 import yaml from 'yaml';
 import { listResources } from '../../lib/kubectl.js';
 import output from '../../lib/output.js';
+// Argo workflow resources, in dependency order (cluster templates before the
+// namespaced templates that may reference them). These live in Argo CRDs that
+// may not be installed on the source cluster, so they are treated as optional.
+const ARGO_RESOURCE_TYPES = [
+    'clusterworkflowtemplates',
+    'workflowtemplates',
+    'cronworkflows',
+];
 // resource types in dependency order so that they can be loaded correctly
 // by default these will all be exported if not specified; can be overridden with defaultExportTypes in config
 const RESOURCE_ORDER = [
@@ -13,7 +21,15 @@ const RESOURCE_ORDER = [
     'teams',
     'mcpservers',
     'a2aservers',
+    ...ARGO_RESOURCE_TYPES,
 ];
+// resource types whose CRDs may be absent; a missing CRD is warned and skipped
+// rather than failing the whole export
+const OPTIONAL_RESOURCE_TYPES = new Set(ARGO_RESOURCE_TYPES);
+// cluster-scoped types have no namespace to filter on, so a namespace-scoped
+// export skips them rather than sweeping in cluster-wide resources shared across
+// tenants; they are captured by a cluster-wide export (no --namespace)
+const CLUSTER_SCOPED_TYPES = new Set(['clusterworkflowtemplates']);
 const SERVER_MANAGED_METADATA_FIELDS = [
     'resourceVersion',
     'uid',
@@ -30,6 +46,20 @@ const LAST_APPLIED_ANNOTATION = 'kubectl.kubernetes.io/last-applied-configuratio
 function isRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
+function errorText(error) {
+    const stderr = isRecord(error) && typeof error.stderr === 'string' ? error.stderr : '';
+    const message = error instanceof Error ? error.message : String(error);
+    return `${stderr}\n${message}`;
+}
+function isResourceTypeNotFoundError(error) {
+    const combined = errorText(error);
+    return (combined.includes("doesn't have a resource type") ||
+        combined.includes('could not find the requested resource'));
+}
+function isForbiddenError(error) {
+    const combined = errorText(error);
+    return (combined.includes('(Forbidden)') || combined.includes('is forbidden:'));
+}
 function sanitizeResource(resource) {
     const sanitized = { ...resource };
     delete sanitized.status;
@@ -94,11 +124,31 @@ async function exportResources(options, config) {
                 output.warning(`unknown resource type: ${resourceType}, skipping`);
                 continue;
             }
+            if (options.namespace && CLUSTER_SCOPED_TYPES.has(resourceType)) {
+                output.info(`skipping cluster-scoped ${resourceType} for namespace-scoped export`);
+                continue;
+            }
             output.info(`fetching ${resourceType}...`);
-            const resources = await listResources(resourceType, {
-                namespace: options.namespace,
-                labels: options.labels,
-            });
+            let resources;
+            try {
+                resources = await listResources(resourceType, {
+                    namespace: options.namespace,
+                    labels: options.labels,
+                });
+            }
+            catch (error) {
+                if (OPTIONAL_RESOURCE_TYPES.has(resourceType)) {
+                    if (isResourceTypeNotFoundError(error)) {
+                        output.warning(`${resourceType} CRD not installed on this cluster, skipping`);
+                        continue;
+                    }
+                    if (isForbiddenError(error)) {
+                        output.warning(`not authorized to list ${resourceType}, skipping`);
+                        continue;
+                    }
+                }
+                throw error;
+            }
             const resourceCount = resources.length;
             if (resources.length > 0) {
                 output.success(`found ${resourceCount} ${resourceType}`);

package/dist/commands/install/index.d.ts

@@ -7,5 +7,6 @@ export declare function installArk(config: ArkConfig, serviceNames?: string[], o
     arkVersion?: string;
     marketplaceVersion?: string;
     backend?: string;
+    deps?: boolean;
 }): Promise<void>;
 export declare function createInstallCommand(config: ArkConfig): Command;

package/dist/commands/install/index.js

@@ -85,6 +85,43 @@ function exitIfServicesSkipped(skipped) {
     output.error(`installation incomplete: ${skipped.length} service(s) skipped because the requested version was not found: ${detail}`);
     process.exit(1);
 }
+function findService(services, name) {
+    return Object.values(services).find((s) => s.name === name || s.helmReleaseName === name);
+}
+/**
+ * Expand requested service names to include their transitive `requires`,
+ * dependencies first. A visited set both de-duplicates and guards against
+ * a cycle in `requires` (a node already being visited is never re-entered).
+ * A dependency that does not resolve to an installable service (disabled,
+ * or excluded for the current backend) is skipped with a warning rather
+ * than pushed through to a confusing "service not found" error for a name
+ * the caller never typed.
+ */
+function resolveServiceOrder(requestedNames, services, skipDeps) {
+    const resolved = [];
+    const visited = new Set();
+    function visit(name) {
+        if (visited.has(name))
+            return;
+        visited.add(name);
+        if (!skipDeps) {
+            const service = findService(services, name);
+            for (const dep of service?.requires || []) {
+                if (findService(services, dep)) {
+                    visit(dep);
+                }
+                else {
+                    output.warning(`${name} requires ${dep}, but it is not installable in this configuration — skipping it`);
+                }
+            }
+        }
+        resolved.push(name);
+    }
+    for (const name of requestedNames) {
+        visit(name);
+    }
+    return resolved;
+}
 async function uninstallPrerequisites(service, verbose = false) {
     if (!service.prerequisiteUninstalls?.length)
         return;
@@ -204,7 +241,23 @@ export async function installArk(config, serviceNames = [], options = {}) {
     }
     // If specific services are requested, install only those services
     if (serviceNames.length > 0) {
-        for (const serviceName of serviceNames) {
+        const installableServices = getInstallableServices(backend);
+        const skipDeps = options.deps === false;
+        const resolvedServiceNames = resolveServiceOrder(serviceNames, installableServices, skipDeps);
+        if (skipDeps) {
+            const skippedDeps = resolveServiceOrder(serviceNames, installableServices, false).filter((name) => !serviceNames.includes(name));
+            if (skippedDeps.length > 0) {
+                output.warning(`--no-deps: not installing ${skippedDeps.join(', ')} automatically; the requested service(s) may not behave as expected without them`);
+            }
+        }
+        else {
+            for (const name of resolvedServiceNames) {
+                if (!serviceNames.includes(name)) {
+                    output.info(`${name} is required by a requested service, installing it first...`);
+                }
+            }
+        }
+        for (const serviceName of resolvedServiceNames) {
             // Check if it's a marketplace item
             if (isMarketplaceService(serviceName)) {
                 const service = await getMarketplaceItem(serviceName);
@@ -249,19 +302,29 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 continue;
             }
             // Core ARK service
-            const services = getInstallableServices(backend);
-            const service = Object.values(services).find((s) => s.name === serviceName);
+            const service = findService(installableServices, serviceName);
             if (!service) {
                 output.error(`service '${serviceName}' not found`);
                 output.info('available services:');
-                for (const s of Object.values(services)) {
+                for (const s of Object.values(installableServices)) {
                     output.info(`  ${s.name}`);
                 }
                 process.exit(1);
             }
+            // Apply the override only for a service actually missing one of its
+            // `requires` from this install — whether because --no-deps skipped it
+            // globally, or because a specific dependency wasn't installable (e.g.
+            // disabled in .arkrc.yaml) — not just because --no-deps was passed at
+            // all, which would wrongly override a service whose dependency IS
+            // being installed alongside it (e.g. `ark install ark-broker
+            // ark-tenant --no-deps`).
+            const missingRequires = (service.requires || []).some((dep) => !resolvedServiceNames.includes(dep));
             output.info(`installing ${service.name}...`);
             try {
-                await installService(service, options.verbose, options.arkVersion, options.marketplaceVersion, backendInstallArgs(service, backend, postgresValues));
+                await installService(service, options.verbose, options.arkVersion, options.marketplaceVersion, [
+                    ...backendInstallArgs(service, backend, postgresValues),
+                    ...(missingRequires ? service.dependencyOverrideArgs || [] : []),
+                ]);
                 output.success(`${service.name} installed successfully`);
                 // Wait for ark-apiserver to be ready before continuing to other services
                 if (service.helmReleaseName === 'ark-apiserver' && backend === 'postgresql') {
@@ -416,9 +479,13 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 }
             }
         }
-        // Install selected services
-        for (const serviceName of selectedComponents) {
-            const service = Object.values(arkServices).find((s) => s.helmReleaseName === serviceName);
+        // Install selected services, dependencies first: `mandatory` only forces
+        // a service into `selectedComponents`, it says nothing about install
+        // order, so a `requires` dependency (e.g. ark-broker for ark-tenant) must
+        // still be resolved here even though every mandatory name is present.
+        const orderedComponents = resolveServiceOrder(selectedComponents, arkServices, false);
+        for (const serviceName of orderedComponents) {
+            const service = findService(arkServices, serviceName);
             if (!service || !service.chartPath) {
                 continue;
             }
@@ -473,7 +540,9 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 process.exit(1);
             }
         }
-        // Install all services
+        // Install all services. Every service is selected here, so alphabetical
+        // order happens to put ark-broker before ark-tenant today — resolve
+        // `requires` explicitly anyway rather than depend on that coincidence.
         const services = getInstallableServices(backend);
         const sortedServices = Object.values(services).sort((a, b) => {
             // Ensure ark-controller is always first
@@ -483,10 +552,22 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 return 1;
             return a.name.localeCompare(b.name);
         });
-        for (const service of sortedServices) {
+        const orderedNames = resolveServiceOrder(sortedServices.map((s) => s.name), services, false);
+        const orderedServices = orderedNames
+            .map((name) => findService(services, name))
+            .filter((s) => Boolean(s));
+        for (const service of orderedServices) {
             output.info(`installing ${service.name}...`);
+            // A `requires` dependency disabled in .arkrc.yaml gets dropped (with a
+            // warning) by resolveServiceOrder above rather than installed — apply
+            // the same override as the named-service path so the dependent isn't
+            // then refused by its own chart-level guard.
+            const missingRequires = (service.requires || []).some((dep) => !orderedNames.includes(dep));
             try {
-                await installService(service, options.verbose, options.arkVersion, options.marketplaceVersion, backendInstallArgs(service, backend, postgresValues));
+                await installService(service, options.verbose, options.arkVersion, options.marketplaceVersion, [
+                    ...backendInstallArgs(service, backend, postgresValues),
+                    ...(missingRequires ? service.dependencyOverrideArgs || [] : []),
+                ]);
                 console.log(); // Add blank line after command output
             }
             catch (error) {
@@ -555,6 +636,7 @@ export function createInstallCommand(config) {
         .option('--marketplace-version <version>', 'Marketplace item version to install (e.g., 0.1.5)')
         .option('--wait-for-ready <timeout>', 'wait for Ark to be ready after installation (e.g., 30s, 2m)')
         .option('--backend <type>', "storage backend: 'etcd' (default) or 'postgresql' (overrides storage.backend in .arkrc.yaml)")
+        .option('--no-deps', "skip a requested service's dependencies (e.g. ark-broker for ark-tenant); the resulting install may lose the guarantees those dependencies provide")
         .option('-v, --verbose', 'show commands being executed')
         .action(async (services, options) => {
         await installArk(config, services, options);

package/dist/commands/status/index.js

@@ -5,7 +5,7 @@ import { StatusChecker } from '../../components/statusChecker.js';
 import { StatusFormatter, } from '../../ui/statusFormatter.js';
 import { fetchVersionInfo } from '../../lib/versions.js';
 import { waitForServicesReady, } from '../../lib/waitForReady.js';
-import { runReadinessChecks, describeStorageBackend, } from '../../lib/readinessChecks.js';
+import { runReadinessChecks, describeStorageBackend, describeNamespaceMemory, } from '../../lib/readinessChecks.js';
 import { arkServices } from '../../arkServices.js';
 import output from '../../lib/output.js';
 import { parseTimeoutToSeconds } from '../../lib/timeout.js';
@@ -68,7 +68,26 @@ function backendStatusLine(detection) {
         details,
     };
 }
-function buildStatusSections(data, versionInfo, backend) {
+function namespaceMemoryStatusLine(check) {
+    const display = {
+        ready: { icon: '●', color: 'green', details: check.message },
+        unresolved: { icon: '✗', color: 'red', details: 'not resolving' },
+        missing: { icon: '✗', color: 'red', details: 'missing' },
+        'no-broker': { icon: '○', color: 'yellow', details: 'not configured' },
+        undetermined: { icon: '?', color: 'yellow', details: 'undetermined' },
+    };
+    const { icon, color, details } = display[check.status];
+    return {
+        icon,
+        iconColor: color,
+        status: 'default memory',
+        statusColor: color,
+        name: '',
+        details,
+        subtext: check.status === 'ready' ? undefined : check.message,
+    };
+}
+function buildStatusSections(data, versionInfo, backend, namespaceMemory) {
     const sections = [];
     // Dependencies section
     sections.push({
@@ -270,6 +289,9 @@ function buildStatusSections(data, versionInfo, backend) {
             }
         }
     }
+    if (namespaceMemory) {
+        arkStatusLines.push(namespaceMemoryStatusLine(namespaceMemory));
+    }
     if (backend) {
         arkStatusLines.push(backendStatusLine(backend));
     }
@@ -289,16 +311,24 @@ export async function checkStatus(serviceNames, options) {
             fetchVersionInfo(),
         ]);
         // Only probe for the storage backend if the cluster is reachable; probing an
-        // unreachable cluster would just retry to its timeout.
-        const detection = statusData.clusterAccess
-            ? await describeStorageBackend()
-            : {
-                backend: 'unknown',
-                status: 'unreachable',
-                message: 'Cluster is not reachable — cannot determine the storage backend.',
-            };
+        // unreachable cluster would just retry to its timeout. The memory check is
+        // scoped to the kubeconfig's current namespace: the invariant it reports on
+        // is per-namespace, and that is the namespace the user's queries land in.
+        // Both probes are independent, so they run together rather than in series.
+        const [detection, namespaceMemory] = await Promise.all([
+            statusData.clusterAccess
+                ? describeStorageBackend()
+                : Promise.resolve({
+                    backend: 'unknown',
+                    status: 'unreachable',
+                    message: 'Cluster is not reachable — cannot determine the storage backend.',
+                }),
+            statusData.clusterAccess && statusData.arkReady
+                ? describeNamespaceMemory(statusData.clusterInfo?.namespace || 'default')
+                : Promise.resolve(undefined),
+        ]);
         spinner.stop();
-        const sections = buildStatusSections(statusData, versionInfo, detection);
+        const sections = buildStatusSections(statusData, versionInfo, detection, namespaceMemory);
         StatusFormatter.printSections(sections);
         if (options?.waitForReady) {
             const timeoutSeconds = parseTimeoutToSeconds(options.waitForReady);

package/dist/lib/chatClient.js

@@ -32,9 +32,6 @@ export class ChatClient {
         if (config.a2aContextId) {
             annotations[QUERY_ANNOTATIONS.A2A_CONTEXT_ID] = config.a2aContextId;
         }
-        if (config.streamingEnabled && onChunk) {
-            annotations['ark.mckinsey.com/streaming-enabled'] = 'true';
-        }
         const queryResult = await this.arkApiClient.createQuery({
             input,
             target: { type: targetType, name: targetName },

package/dist/lib/readinessChecks.d.ts

@@ -12,7 +12,30 @@ export interface ReadinessCheckResult {
     durationMs: number;
     message?: string;
 }
+export type NamespaceMemoryStatus = 'ready' | 'unresolved' | 'missing' | 'no-broker' | 'undetermined';
+export interface NamespaceMemoryCheck {
+    status: NamespaceMemoryStatus;
+    namespace: string;
+    memoryName: string;
+    message: string;
+}
 export type ReadinessProgress = (result: ReadinessCheckResult) => void;
 export declare function describeStorageBackend(): Promise<BackendDetection>;
+/**
+ * Report whether the namespace ends up with a Memory the executor can use.
+ *
+ * Existence is not the question: NewHTTPMemory errors when
+ * status.lastResolvedAddress is empty, so a Memory left unresolved by a
+ * missing broker Service fails every query in the namespace rather than
+ * degrading. A namespace with no broker is expected to have no Memory, so that
+ * is reported as unconfigured rather than broken.
+ *
+ * ArkConfig.defaultMemory only changes the answer when the Memory it names
+ * both exists and resolves: resolveInjectableMemory declines to inject
+ * otherwise, and NewMemoryForQuery then falls back to the hardcoded name
+ * `default`. So the override is a candidate, and `default` decides the verdict
+ * whenever that candidate is not usable.
+ */
+export declare function describeNamespaceMemory(namespace: string): Promise<NamespaceMemoryCheck>;
 export declare function detectStorageBackend(): Promise<DetectedBackend>;
 export declare function runReadinessChecks(timeoutSeconds: number, backend: DetectedBackend, onProgress?: ReadinessProgress): Promise<ReadinessCheckResult[]>;

package/dist/lib/readinessChecks.js

@@ -14,8 +14,13 @@ async function runKubectl(args, timeoutMs) {
         stderr: result.stderr ?? '',
     };
 }
+// A resource type the cluster does not serve at all. kubectl reports this
+// differently from a missing object, and it is just as final an answer — the
+// aggregated API server serves no arkconfigs, so this is the normal reply
+// there rather than something to retry.
+const UNSERVED_RESOURCE_PATTERN = /doesn't have a resource type|no matches for kind|the server could not find the requested resource/i;
 function classifyFailure(stderr) {
-    if (/not\s*found/i.test(stderr)) {
+    if (/not\s*found/i.test(stderr) || UNSERVED_RESOURCE_PATTERN.test(stderr)) {
         return 'not-found';
     }
     if (/forbidden|unauthorized/i.test(stderr)) {
@@ -32,7 +37,8 @@ function isAuthoritativeResult(result) {
     if (result.exitCode === 0) {
         return true;
     }
-    return /not\s*found|forbidden/i.test(result.stderr);
+    return (/not\s*found|forbidden/i.test(result.stderr) ||
+        UNSERVED_RESOURCE_PATTERN.test(result.stderr));
 }
 async function probeKubectl(args, timeoutMs, maxRetries = DETECT_MAX_RETRIES) {
     let result = await runKubectl(args, timeoutMs);
@@ -95,6 +101,236 @@ export async function describeStorageBackend() {
     }
     return unknownFrom(apiReason);
 }
+// The Memory name the broker chart creates, and the one NewMemoryForQuery
+// hardcodes when a Query carries no spec.memory. ArkConfig can name a
+// different one, but only as a candidate — see describeNamespaceMemory.
+const FALLBACK_MEMORY_NAME = 'default';
+// Either ConfigMap is a broker presence signal, and only when its data carries
+// enabled: "true" — the same test BrokerServiceRefFor applies before the
+// controller's default-Memory backstop will act on it.
+const BROKER_CONFIGMAP_NAMES = ['ark-config-broker', 'ark-config-streaming'];
+// The ConfigMaps are not the whole story: they are rendered only when
+// otelEndpoint.enabled / streaming.enabled are set, both of which default true
+// but are independently disablable. A broker installed purely for message and
+// session storage has neither, and reporting "no broker in this namespace"
+// there is a confident claim that happens to be false. The label is the
+// chart's rather than the release's, so a renamed release still matches. This
+// mirrors DefaultMemoryReconciler's own two-signal lookup.
+const BROKER_SERVICE_SELECTOR = 'app.kubernetes.io/name=ark-broker';
+const BROKER_ENABLED_JSONPATH = '{range .items[*]}{.data.enabled}{"\\n"}{end}';
+// kubectl reports a missing namespace and a missing object with the same
+// NotFound status, so the two are told apart by the message. Reporting on a
+// namespace that does not exist as "no broker here" would be a confident
+// answer drawn from nothing.
+function isMissingNamespace(stderr) {
+    return /namespaces?\s+"[^"]*"\s+not\s+found/i.test(stderr);
+}
+async function probeMemory(namespace, name) {
+    const result = await probeKubectl(['get', 'memory', name, '--namespace', namespace, '-o', 'json'], 10000);
+    if (result.exitCode !== 0) {
+        if (isMissingNamespace(result.stderr)) {
+            return {
+                outcome: 'undetermined',
+                detail: `namespace ${namespace} does not exist`,
+            };
+        }
+        const reason = classifyFailure(result.stderr);
+        if (reason === 'not-found') {
+            return { outcome: 'absent' };
+        }
+        return { outcome: 'undetermined', detail: reason };
+    }
+    let address = '';
+    let phase = '';
+    let statusMessage = '';
+    try {
+        const parsed = JSON.parse(result.stdout);
+        address = parsed?.status?.lastResolvedAddress || '';
+        phase = parsed?.status?.phase || '';
+        statusMessage = parsed?.status?.message || '';
+    }
+    catch {
+        return { outcome: 'undetermined', detail: 'unreadable kubectl output' };
+    }
+    if (address) {
+        return { outcome: 'resolved', address };
+    }
+    return {
+        outcome: 'unresolved',
+        detail: statusMessage || phase || 'no resolved address',
+    };
+}
+async function probeBrokerConfigMaps(namespace) {
+    const result = await probeKubectl([
+        'get',
+        'configmap',
+        ...BROKER_CONFIGMAP_NAMES,
+        '--namespace',
+        namespace,
+        '--ignore-not-found',
+        '-o',
+        `jsonpath=${BROKER_ENABLED_JSONPATH}`,
+    ], 10000);
+    if (result.exitCode !== 0) {
+        return 'undetermined';
+    }
+    const enabled = result.stdout
+        .split('\n')
+        .some((line) => line.trim() === 'true');
+    return enabled ? 'present' : 'absent';
+}
+async function probeBrokerService(namespace) {
+    const result = await probeKubectl([
+        'get',
+        'service',
+        '--namespace',
+        namespace,
+        '--selector',
+        BROKER_SERVICE_SELECTOR,
+        '-o',
+        'name',
+    ], 10000);
+    if (result.exitCode !== 0) {
+        return 'undetermined';
+    }
+    return result.stdout.trim() ? 'present' : 'absent';
+}
+async function probeBroker(namespace) {
+    const fromConfigMaps = await probeBrokerConfigMaps(namespace);
+    if (fromConfigMaps === 'present') {
+        return fromConfigMaps;
+    }
+    const fromService = await probeBrokerService(namespace);
+    if (fromService === 'present') {
+        return fromService;
+    }
+    // Neither signal found it. Say so only if both probes actually answered.
+    if (fromConfigMaps === 'undetermined' || fromService === 'undetermined') {
+        return 'undetermined';
+    }
+    return 'absent';
+}
+// ArkConfig is cluster-scoped and optional, and the aggregated API server does
+// not serve it at all — both of which classifyFailure reports as not-found, a
+// legitimate "there is no override". "Could not tell" is different: a
+// namespace-scoped user is forbidden from reading a cluster-scoped resource,
+// and would otherwise be judged against the wrong name.
+async function readDefaultMemoryOverride() {
+    const result = await probeKubectl([
+        'get',
+        'arkconfig',
+        'default',
+        '-o',
+        'jsonpath={.spec.defaultMemory.name}',
+    ], 10000);
+    if (result.exitCode === 0) {
+        const name = result.stdout.trim();
+        return name ? { kind: 'name', name } : { kind: 'none' };
+    }
+    if (classifyFailure(result.stderr) === 'not-found') {
+        return { kind: 'none' };
+    }
+    return { kind: 'undetermined' };
+}
+/**
+ * Report whether the namespace ends up with a Memory the executor can use.
+ *
+ * Existence is not the question: NewHTTPMemory errors when
+ * status.lastResolvedAddress is empty, so a Memory left unresolved by a
+ * missing broker Service fails every query in the namespace rather than
+ * degrading. A namespace with no broker is expected to have no Memory, so that
+ * is reported as unconfigured rather than broken.
+ *
+ * ArkConfig.defaultMemory only changes the answer when the Memory it names
+ * both exists and resolves: resolveInjectableMemory declines to inject
+ * otherwise, and NewMemoryForQuery then falls back to the hardcoded name
+ * `default`. So the override is a candidate, and `default` decides the verdict
+ * whenever that candidate is not usable.
+ */
+export async function describeNamespaceMemory(namespace) {
+    const override = await readDefaultMemoryOverride();
+    if (override.kind === 'name' && override.name !== FALLBACK_MEMORY_NAME) {
+        const probe = await probeMemory(namespace, override.name);
+        if (probe.outcome === 'resolved') {
+            return {
+                namespace,
+                memoryName: override.name,
+                status: 'ready',
+                message: probe.address,
+            };
+        }
+        if (probe.outcome === 'undetermined') {
+            return {
+                namespace,
+                memoryName: override.name,
+                status: 'undetermined',
+                message: `Could not read Memory "${override.name}" in namespace ${namespace} (${probe.detail}).`,
+            };
+        }
+    }
+    const unusedOverride = override.kind === 'name' && override.name !== FALLBACK_MEMORY_NAME
+        ? override.name
+        : undefined;
+    const check = await describeFallbackMemory(namespace, unusedOverride);
+    // The override read failed, so this verdict may be judging the wrong name.
+    // Only downgrade one that accuses the namespace of being broken.
+    if (override.kind === 'undetermined' &&
+        (check.status === 'missing' || check.status === 'unresolved')) {
+        return {
+            ...check,
+            status: 'undetermined',
+            message: `${check.message} ArkConfig could not be read, so a cluster-wide default memory name may apply instead.`,
+        };
+    }
+    return check;
+}
+async function describeFallbackMemory(namespace, unusedOverride) {
+    const base = { namespace, memoryName: FALLBACK_MEMORY_NAME };
+    // The operator asked for a different name and is not getting it. Without
+    // saying so, the remediation below reads as "create Memory/default", which
+    // is right for the executor and confusing next to their own ArkConfig.
+    const overrideNote = unusedOverride
+        ? ` ArkConfig names "${unusedOverride}", which is not usable here, so resolution falls back to "${FALLBACK_MEMORY_NAME}".`
+        : '';
+    const probe = await probeMemory(namespace, FALLBACK_MEMORY_NAME);
+    if (probe.outcome === 'resolved') {
+        return { ...base, status: 'ready', message: probe.address };
+    }
+    if (probe.outcome === 'undetermined') {
+        return {
+            ...base,
+            status: 'undetermined',
+            message: `Could not read Memory "${FALLBACK_MEMORY_NAME}" in namespace ${namespace} (${probe.detail}).`,
+        };
+    }
+    if (probe.outcome === 'unresolved') {
+        return {
+            ...base,
+            status: 'unresolved',
+            message: `Memory "${FALLBACK_MEMORY_NAME}" in namespace ${namespace} has not resolved an address (${probe.detail}); queries using it will fail.${overrideNote}`,
+        };
+    }
+    const broker = await probeBroker(namespace);
+    if (broker === 'undetermined') {
+        return {
+            ...base,
+            status: 'undetermined',
+            message: `Could not determine whether namespace ${namespace} has a broker, so a missing Memory cannot be judged.`,
+        };
+    }
+    if (broker === 'present') {
+        return {
+            ...base,
+            status: 'missing',
+            message: `Namespace ${namespace} has a broker but no Memory "${FALLBACK_MEMORY_NAME}"; chats there will silently lose conversation history.${overrideNote}`,
+        };
+    }
+    return {
+        ...base,
+        status: 'no-broker',
+        message: `No broker in namespace ${namespace}, so no conversation history is kept there.`,
+    };
+}
 export async function detectStorageBackend() {
     return (await describeStorageBackend()).backend;
 }

package/dist/types/arkService.d.ts

@@ -13,6 +13,8 @@ export interface ArkService {
     chartPath?: string;
     installArgs?: string[];
     prerequisiteUninstalls?: PrerequisiteUninstall[];
+    requires?: string[];
+    dependencyOverrideArgs?: string[];
     k8sServiceName?: string;
     k8sServicePort?: number;
     k8sPortForwardLocalPort?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-at-scale/ark",
-  "version": "0.1.68",
+  "version": "0.1.70",
   "description": "Ark CLI - Interactive terminal interface for ARK agents",
   "main": "dist/index.js",
   "type": "module",
@@ -43,8 +43,8 @@
   },
   "dependencies": {
     "@kubernetes/client-node": "^1.3.0",
-    "@modelcontextprotocol/sdk": "^1.27.1",
-    "axios": "^1.18.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
+    "axios": "^1.20.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",
     "debug": "^4.4.1",
@@ -85,7 +85,7 @@
     "node": ">=18.0.0"
   },
   "overrides": {
-    "brace-expansion": ">=5.0.9",
+    "brace-expansion": "^5.0.12",
     "ip-address": "^10.3.1",
     "js-yaml": "^4.3.1",
     "minimatch": "^10.2.3",
@@ -95,10 +95,12 @@
     "flatted": "^3.4.2",
     "tar": "^7.5.11",
     "express-rate-limit": "^8.3.0",
-    "fast-uri": "^3.1.5",
+    "fast-uri": "^4.1.4",
     "ws": "^8.21.0",
     "esbuild": "^0.28.1",
     "form-data": "^4.0.6",
-    "postcss": "^8.5.18"
+    "postcss": "^8.5.18",
+    "proxy-addr": "^2.0.8",
+    "source-map-js": "^1.2.2"
   }
 }

package/templates/tool/uv.lock

@@ -31,16 +31,15 @@ wheels = [
 
 [[package]]
 name = "anyio"
-version = "4.9.0"
+version = "4.14.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "idna" },
-    { name = "sniffio" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/95/7d/4c1bd541d4dffa1b52bd83fb8527089e097a106fc90b467a7313b105f840/anyio-4.9.0.tar.gz", hash = "sha256:673c0c244e15788651a4ff38710fea9675823028a6f08a5eda409e0c9840a028", size = 190949, upload-time = "2025-03-17T00:02:54.77Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a1/ee/48ca1a7c89ffec8b6a0c5d02b89c305671d5ffd8d3c94acf8b8c408575bb/anyio-4.9.0-py3-none-any.whl", hash = "sha256:9f76d541cad6e36af7beb62e978876f3b41e3e04f2c1fbf0884604c0a9c4d93c", size = 100916, upload-time = "2025-03-17T00:02:52.713Z" },
+    { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" },
 ]
 
 [[package]]
@@ -1104,15 +1103,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b7/46/f5af3402b579fd5e11573ce652019a67074317e18c1935cc0b4ba9b35552/secretstorage-3.5.0-py3-none-any.whl", hash = "sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137", size = 15554, upload-time = "2025-11-23T19:02:51.545Z" },
 ]
 
-[[package]]
-name = "sniffio"
-version = "1.3.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a2/87/a6771e1546d97e7e041b6ae58d80074f81b7d5121207425c964ddf5cfdbd/sniffio-1.3.1.tar.gz", hash = "sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc", size = 20372, upload-time = "2024-02-25T23:20:04.057Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/e9/44/75a9c9421471a6c4805dbf2356f7c181a29c1879239abab1ea2cc8f38b40/sniffio-1.3.1-py3-none-any.whl", hash = "sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2", size = 10235, upload-time = "2024-02-25T23:20:01.196Z" },
-]
-
 [[package]]
 name = "sse-starlette"
 version = "2.3.6"