@agents-at-scale/ark 0.1.69 → 0.1.71

package/dist/arkServices.js

@@ -108,6 +108,9 @@ const defaultArkServices = {
         category: 'core',
         chartPath: `${REGISTRY_BASE}/ark-tenant:${CHART_VERSION}`,
         installArgs: [],
+        // Without a broker, a tenant loses conversation history (issue #2642).
+        requires: ['ark-broker'],
+        dependencyOverrideArgs: ['--set', 'memory.requireBroker=false'],
     },
     'ark-api': {
         name: 'ark-api',

package/dist/commands/install/index.d.ts

@@ -7,5 +7,6 @@ export declare function installArk(config: ArkConfig, serviceNames?: string[], o
     arkVersion?: string;
     marketplaceVersion?: string;
     backend?: string;
+    deps?: boolean;
 }): Promise<void>;
 export declare function createInstallCommand(config: ArkConfig): Command;

package/dist/commands/install/index.js

@@ -85,6 +85,43 @@ function exitIfServicesSkipped(skipped) {
     output.error(`installation incomplete: ${skipped.length} service(s) skipped because the requested version was not found: ${detail}`);
     process.exit(1);
 }
+function findService(services, name) {
+    return Object.values(services).find((s) => s.name === name || s.helmReleaseName === name);
+}
+/**
+ * Expand requested service names to include their transitive `requires`,
+ * dependencies first. A visited set both de-duplicates and guards against
+ * a cycle in `requires` (a node already being visited is never re-entered).
+ * A dependency that does not resolve to an installable service (disabled,
+ * or excluded for the current backend) is skipped with a warning rather
+ * than pushed through to a confusing "service not found" error for a name
+ * the caller never typed.
+ */
+function resolveServiceOrder(requestedNames, services, skipDeps) {
+    const resolved = [];
+    const visited = new Set();
+    function visit(name) {
+        if (visited.has(name))
+            return;
+        visited.add(name);
+        if (!skipDeps) {
+            const service = findService(services, name);
+            for (const dep of service?.requires || []) {
+                if (findService(services, dep)) {
+                    visit(dep);
+                }
+                else {
+                    output.warning(`${name} requires ${dep}, but it is not installable in this configuration — skipping it`);
+                }
+            }
+        }
+        resolved.push(name);
+    }
+    for (const name of requestedNames) {
+        visit(name);
+    }
+    return resolved;
+}
 async function uninstallPrerequisites(service, verbose = false) {
     if (!service.prerequisiteUninstalls?.length)
         return;
@@ -204,7 +241,23 @@ export async function installArk(config, serviceNames = [], options = {}) {
     }
     // If specific services are requested, install only those services
     if (serviceNames.length > 0) {
-        for (const serviceName of serviceNames) {
+        const installableServices = getInstallableServices(backend);
+        const skipDeps = options.deps === false;
+        const resolvedServiceNames = resolveServiceOrder(serviceNames, installableServices, skipDeps);
+        if (skipDeps) {
+            const skippedDeps = resolveServiceOrder(serviceNames, installableServices, false).filter((name) => !serviceNames.includes(name));
+            if (skippedDeps.length > 0) {
+                output.warning(`--no-deps: not installing ${skippedDeps.join(', ')} automatically; the requested service(s) may not behave as expected without them`);
+            }
+        }
+        else {
+            for (const name of resolvedServiceNames) {
+                if (!serviceNames.includes(name)) {
+                    output.info(`${name} is required by a requested service, installing it first...`);
+                }
+            }
+        }
+        for (const serviceName of resolvedServiceNames) {
             // Check if it's a marketplace item
             if (isMarketplaceService(serviceName)) {
                 const service = await getMarketplaceItem(serviceName);
@@ -249,19 +302,29 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 continue;
             }
             // Core ARK service
-            const services = getInstallableServices(backend);
-            const service = Object.values(services).find((s) => s.name === serviceName);
+            const service = findService(installableServices, serviceName);
             if (!service) {
                 output.error(`service '${serviceName}' not found`);
                 output.info('available services:');
-                for (const s of Object.values(services)) {
+                for (const s of Object.values(installableServices)) {
                     output.info(`  ${s.name}`);
                 }
                 process.exit(1);
             }
+            // Apply the override only for a service actually missing one of its
+            // `requires` from this install — whether because --no-deps skipped it
+            // globally, or because a specific dependency wasn't installable (e.g.
+            // disabled in .arkrc.yaml) — not just because --no-deps was passed at
+            // all, which would wrongly override a service whose dependency IS
+            // being installed alongside it (e.g. `ark install ark-broker
+            // ark-tenant --no-deps`).
+            const missingRequires = (service.requires || []).some((dep) => !resolvedServiceNames.includes(dep));
             output.info(`installing ${service.name}...`);
             try {
-                await installService(service, options.verbose, options.arkVersion, options.marketplaceVersion, backendInstallArgs(service, backend, postgresValues));
+                await installService(service, options.verbose, options.arkVersion, options.marketplaceVersion, [
+                    ...backendInstallArgs(service, backend, postgresValues),
+                    ...(missingRequires ? service.dependencyOverrideArgs || [] : []),
+                ]);
                 output.success(`${service.name} installed successfully`);
                 // Wait for ark-apiserver to be ready before continuing to other services
                 if (service.helmReleaseName === 'ark-apiserver' && backend === 'postgresql') {
@@ -416,9 +479,13 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 }
             }
         }
-        // Install selected services
-        for (const serviceName of selectedComponents) {
-            const service = Object.values(arkServices).find((s) => s.helmReleaseName === serviceName);
+        // Install selected services, dependencies first: `mandatory` only forces
+        // a service into `selectedComponents`, it says nothing about install
+        // order, so a `requires` dependency (e.g. ark-broker for ark-tenant) must
+        // still be resolved here even though every mandatory name is present.
+        const orderedComponents = resolveServiceOrder(selectedComponents, arkServices, false);
+        for (const serviceName of orderedComponents) {
+            const service = findService(arkServices, serviceName);
             if (!service || !service.chartPath) {
                 continue;
             }
@@ -473,7 +540,9 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 process.exit(1);
             }
         }
-        // Install all services
+        // Install all services. Every service is selected here, so alphabetical
+        // order happens to put ark-broker before ark-tenant today — resolve
+        // `requires` explicitly anyway rather than depend on that coincidence.
         const services = getInstallableServices(backend);
         const sortedServices = Object.values(services).sort((a, b) => {
             // Ensure ark-controller is always first
@@ -483,10 +552,22 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 return 1;
             return a.name.localeCompare(b.name);
         });
-        for (const service of sortedServices) {
+        const orderedNames = resolveServiceOrder(sortedServices.map((s) => s.name), services, false);
+        const orderedServices = orderedNames
+            .map((name) => findService(services, name))
+            .filter((s) => Boolean(s));
+        for (const service of orderedServices) {
             output.info(`installing ${service.name}...`);
+            // A `requires` dependency disabled in .arkrc.yaml gets dropped (with a
+            // warning) by resolveServiceOrder above rather than installed — apply
+            // the same override as the named-service path so the dependent isn't
+            // then refused by its own chart-level guard.
+            const missingRequires = (service.requires || []).some((dep) => !orderedNames.includes(dep));
             try {
-                await installService(service, options.verbose, options.arkVersion, options.marketplaceVersion, backendInstallArgs(service, backend, postgresValues));
+                await installService(service, options.verbose, options.arkVersion, options.marketplaceVersion, [
+                    ...backendInstallArgs(service, backend, postgresValues),
+                    ...(missingRequires ? service.dependencyOverrideArgs || [] : []),
+                ]);
                 console.log(); // Add blank line after command output
             }
             catch (error) {
@@ -555,6 +636,7 @@ export function createInstallCommand(config) {
         .option('--marketplace-version <version>', 'Marketplace item version to install (e.g., 0.1.5)')
         .option('--wait-for-ready <timeout>', 'wait for Ark to be ready after installation (e.g., 30s, 2m)')
         .option('--backend <type>', "storage backend: 'etcd' (default) or 'postgresql' (overrides storage.backend in .arkrc.yaml)")
+        .option('--no-deps', "skip a requested service's dependencies (e.g. ark-broker for ark-tenant); the resulting install may lose the guarantees those dependencies provide")
         .option('-v, --verbose', 'show commands being executed')
         .action(async (services, options) => {
         await installArk(config, services, options);

package/dist/commands/status/index.js

@@ -5,7 +5,7 @@ import { StatusChecker } from '../../components/statusChecker.js';
 import { StatusFormatter, } from '../../ui/statusFormatter.js';
 import { fetchVersionInfo } from '../../lib/versions.js';
 import { waitForServicesReady, } from '../../lib/waitForReady.js';
-import { runReadinessChecks, describeStorageBackend, } from '../../lib/readinessChecks.js';
+import { runReadinessChecks, describeStorageBackend, describeNamespaceMemory, } from '../../lib/readinessChecks.js';
 import { arkServices } from '../../arkServices.js';
 import output from '../../lib/output.js';
 import { parseTimeoutToSeconds } from '../../lib/timeout.js';
@@ -68,7 +68,26 @@ function backendStatusLine(detection) {
         details,
     };
 }
-function buildStatusSections(data, versionInfo, backend) {
+function namespaceMemoryStatusLine(check) {
+    const display = {
+        ready: { icon: '●', color: 'green', details: check.message },
+        unresolved: { icon: '✗', color: 'red', details: 'not resolving' },
+        missing: { icon: '✗', color: 'red', details: 'missing' },
+        'no-broker': { icon: '○', color: 'yellow', details: 'not configured' },
+        undetermined: { icon: '?', color: 'yellow', details: 'undetermined' },
+    };
+    const { icon, color, details } = display[check.status];
+    return {
+        icon,
+        iconColor: color,
+        status: 'default memory',
+        statusColor: color,
+        name: '',
+        details,
+        subtext: check.status === 'ready' ? undefined : check.message,
+    };
+}
+function buildStatusSections(data, versionInfo, backend, namespaceMemory) {
     const sections = [];
     // Dependencies section
     sections.push({
@@ -270,6 +289,9 @@ function buildStatusSections(data, versionInfo, backend) {
             }
         }
     }
+    if (namespaceMemory) {
+        arkStatusLines.push(namespaceMemoryStatusLine(namespaceMemory));
+    }
     if (backend) {
         arkStatusLines.push(backendStatusLine(backend));
     }
@@ -289,16 +311,24 @@ export async function checkStatus(serviceNames, options) {
             fetchVersionInfo(),
         ]);
         // Only probe for the storage backend if the cluster is reachable; probing an
-        // unreachable cluster would just retry to its timeout.
-        const detection = statusData.clusterAccess
-            ? await describeStorageBackend()
-            : {
-                backend: 'unknown',
-                status: 'unreachable',
-                message: 'Cluster is not reachable — cannot determine the storage backend.',
-            };
+        // unreachable cluster would just retry to its timeout. The memory check is
+        // scoped to the kubeconfig's current namespace: the invariant it reports on
+        // is per-namespace, and that is the namespace the user's queries land in.
+        // Both probes are independent, so they run together rather than in series.
+        const [detection, namespaceMemory] = await Promise.all([
+            statusData.clusterAccess
+                ? describeStorageBackend()
+                : Promise.resolve({
+                    backend: 'unknown',
+                    status: 'unreachable',
+                    message: 'Cluster is not reachable — cannot determine the storage backend.',
+                }),
+            statusData.clusterAccess && statusData.arkReady
+                ? describeNamespaceMemory(statusData.clusterInfo?.namespace || 'default')
+                : Promise.resolve(undefined),
+        ]);
         spinner.stop();
-        const sections = buildStatusSections(statusData, versionInfo, detection);
+        const sections = buildStatusSections(statusData, versionInfo, detection, namespaceMemory);
         StatusFormatter.printSections(sections);
         if (options?.waitForReady) {
             const timeoutSeconds = parseTimeoutToSeconds(options.waitForReady);

package/dist/lib/chatClient.js

@@ -32,9 +32,6 @@ export class ChatClient {
         if (config.a2aContextId) {
             annotations[QUERY_ANNOTATIONS.A2A_CONTEXT_ID] = config.a2aContextId;
         }
-        if (config.streamingEnabled && onChunk) {
-            annotations['ark.mckinsey.com/streaming-enabled'] = 'true';
-        }
         const queryResult = await this.arkApiClient.createQuery({
             input,
             target: { type: targetType, name: targetName },

package/dist/lib/readinessChecks.d.ts

@@ -12,7 +12,30 @@ export interface ReadinessCheckResult {
     durationMs: number;
     message?: string;
 }
+export type NamespaceMemoryStatus = 'ready' | 'unresolved' | 'missing' | 'no-broker' | 'undetermined';
+export interface NamespaceMemoryCheck {
+    status: NamespaceMemoryStatus;
+    namespace: string;
+    memoryName: string;
+    message: string;
+}
 export type ReadinessProgress = (result: ReadinessCheckResult) => void;
 export declare function describeStorageBackend(): Promise<BackendDetection>;
+/**
+ * Report whether the namespace ends up with a Memory the executor can use.
+ *
+ * Existence is not the question: NewHTTPMemory errors when
+ * status.lastResolvedAddress is empty, so a Memory left unresolved by a
+ * missing broker Service fails every query in the namespace rather than
+ * degrading. A namespace with no broker is expected to have no Memory, so that
+ * is reported as unconfigured rather than broken.
+ *
+ * ArkConfig.defaultMemory only changes the answer when the Memory it names
+ * both exists and resolves: resolveInjectableMemory declines to inject
+ * otherwise, and NewMemoryForQuery then falls back to the hardcoded name
+ * `default`. So the override is a candidate, and `default` decides the verdict
+ * whenever that candidate is not usable.
+ */
+export declare function describeNamespaceMemory(namespace: string): Promise<NamespaceMemoryCheck>;
 export declare function detectStorageBackend(): Promise<DetectedBackend>;
 export declare function runReadinessChecks(timeoutSeconds: number, backend: DetectedBackend, onProgress?: ReadinessProgress): Promise<ReadinessCheckResult[]>;

package/dist/lib/readinessChecks.js

@@ -14,8 +14,13 @@ async function runKubectl(args, timeoutMs) {
         stderr: result.stderr ?? '',
     };
 }
+// A resource type the cluster does not serve at all. kubectl reports this
+// differently from a missing object, and it is just as final an answer — the
+// aggregated API server serves no arkconfigs, so this is the normal reply
+// there rather than something to retry.
+const UNSERVED_RESOURCE_PATTERN = /doesn't have a resource type|no matches for kind|the server could not find the requested resource/i;
 function classifyFailure(stderr) {
-    if (/not\s*found/i.test(stderr)) {
+    if (/not\s*found/i.test(stderr) || UNSERVED_RESOURCE_PATTERN.test(stderr)) {
         return 'not-found';
     }
     if (/forbidden|unauthorized/i.test(stderr)) {
@@ -32,7 +37,8 @@ function isAuthoritativeResult(result) {
     if (result.exitCode === 0) {
         return true;
     }
-    return /not\s*found|forbidden/i.test(result.stderr);
+    return (/not\s*found|forbidden/i.test(result.stderr) ||
+        UNSERVED_RESOURCE_PATTERN.test(result.stderr));
 }
 async function probeKubectl(args, timeoutMs, maxRetries = DETECT_MAX_RETRIES) {
     let result = await runKubectl(args, timeoutMs);
@@ -95,6 +101,236 @@ export async function describeStorageBackend() {
     }
     return unknownFrom(apiReason);
 }
+// The Memory name the broker chart creates, and the one NewMemoryForQuery
+// hardcodes when a Query carries no spec.memory. ArkConfig can name a
+// different one, but only as a candidate — see describeNamespaceMemory.
+const FALLBACK_MEMORY_NAME = 'default';
+// Either ConfigMap is a broker presence signal, and only when its data carries
+// enabled: "true" — the same test BrokerServiceRefFor applies before the
+// controller's default-Memory backstop will act on it.
+const BROKER_CONFIGMAP_NAMES = ['ark-config-broker', 'ark-config-streaming'];
+// The ConfigMaps are not the whole story: they are rendered only when
+// otelEndpoint.enabled / streaming.enabled are set, both of which default true
+// but are independently disablable. A broker installed purely for message and
+// session storage has neither, and reporting "no broker in this namespace"
+// there is a confident claim that happens to be false. The label is the
+// chart's rather than the release's, so a renamed release still matches. This
+// mirrors DefaultMemoryReconciler's own two-signal lookup.
+const BROKER_SERVICE_SELECTOR = 'app.kubernetes.io/name=ark-broker';
+const BROKER_ENABLED_JSONPATH = '{range .items[*]}{.data.enabled}{"\\n"}{end}';
+// kubectl reports a missing namespace and a missing object with the same
+// NotFound status, so the two are told apart by the message. Reporting on a
+// namespace that does not exist as "no broker here" would be a confident
+// answer drawn from nothing.
+function isMissingNamespace(stderr) {
+    return /namespaces?\s+"[^"]*"\s+not\s+found/i.test(stderr);
+}
+async function probeMemory(namespace, name) {
+    const result = await probeKubectl(['get', 'memory', name, '--namespace', namespace, '-o', 'json'], 10000);
+    if (result.exitCode !== 0) {
+        if (isMissingNamespace(result.stderr)) {
+            return {
+                outcome: 'undetermined',
+                detail: `namespace ${namespace} does not exist`,
+            };
+        }
+        const reason = classifyFailure(result.stderr);
+        if (reason === 'not-found') {
+            return { outcome: 'absent' };
+        }
+        return { outcome: 'undetermined', detail: reason };
+    }
+    let address = '';
+    let phase = '';
+    let statusMessage = '';
+    try {
+        const parsed = JSON.parse(result.stdout);
+        address = parsed?.status?.lastResolvedAddress || '';
+        phase = parsed?.status?.phase || '';
+        statusMessage = parsed?.status?.message || '';
+    }
+    catch {
+        return { outcome: 'undetermined', detail: 'unreadable kubectl output' };
+    }
+    if (address) {
+        return { outcome: 'resolved', address };
+    }
+    return {
+        outcome: 'unresolved',
+        detail: statusMessage || phase || 'no resolved address',
+    };
+}
+async function probeBrokerConfigMaps(namespace) {
+    const result = await probeKubectl([
+        'get',
+        'configmap',
+        ...BROKER_CONFIGMAP_NAMES,
+        '--namespace',
+        namespace,
+        '--ignore-not-found',
+        '-o',
+        `jsonpath=${BROKER_ENABLED_JSONPATH}`,
+    ], 10000);
+    if (result.exitCode !== 0) {
+        return 'undetermined';
+    }
+    const enabled = result.stdout
+        .split('\n')
+        .some((line) => line.trim() === 'true');
+    return enabled ? 'present' : 'absent';
+}
+async function probeBrokerService(namespace) {
+    const result = await probeKubectl([
+        'get',
+        'service',
+        '--namespace',
+        namespace,
+        '--selector',
+        BROKER_SERVICE_SELECTOR,
+        '-o',
+        'name',
+    ], 10000);
+    if (result.exitCode !== 0) {
+        return 'undetermined';
+    }
+    return result.stdout.trim() ? 'present' : 'absent';
+}
+async function probeBroker(namespace) {
+    const fromConfigMaps = await probeBrokerConfigMaps(namespace);
+    if (fromConfigMaps === 'present') {
+        return fromConfigMaps;
+    }
+    const fromService = await probeBrokerService(namespace);
+    if (fromService === 'present') {
+        return fromService;
+    }
+    // Neither signal found it. Say so only if both probes actually answered.
+    if (fromConfigMaps === 'undetermined' || fromService === 'undetermined') {
+        return 'undetermined';
+    }
+    return 'absent';
+}
+// ArkConfig is cluster-scoped and optional, and the aggregated API server does
+// not serve it at all — both of which classifyFailure reports as not-found, a
+// legitimate "there is no override". "Could not tell" is different: a
+// namespace-scoped user is forbidden from reading a cluster-scoped resource,
+// and would otherwise be judged against the wrong name.
+async function readDefaultMemoryOverride() {
+    const result = await probeKubectl([
+        'get',
+        'arkconfig',
+        'default',
+        '-o',
+        'jsonpath={.spec.defaultMemory.name}',
+    ], 10000);
+    if (result.exitCode === 0) {
+        const name = result.stdout.trim();
+        return name ? { kind: 'name', name } : { kind: 'none' };
+    }
+    if (classifyFailure(result.stderr) === 'not-found') {
+        return { kind: 'none' };
+    }
+    return { kind: 'undetermined' };
+}
+/**
+ * Report whether the namespace ends up with a Memory the executor can use.
+ *
+ * Existence is not the question: NewHTTPMemory errors when
+ * status.lastResolvedAddress is empty, so a Memory left unresolved by a
+ * missing broker Service fails every query in the namespace rather than
+ * degrading. A namespace with no broker is expected to have no Memory, so that
+ * is reported as unconfigured rather than broken.
+ *
+ * ArkConfig.defaultMemory only changes the answer when the Memory it names
+ * both exists and resolves: resolveInjectableMemory declines to inject
+ * otherwise, and NewMemoryForQuery then falls back to the hardcoded name
+ * `default`. So the override is a candidate, and `default` decides the verdict
+ * whenever that candidate is not usable.
+ */
+export async function describeNamespaceMemory(namespace) {
+    const override = await readDefaultMemoryOverride();
+    if (override.kind === 'name' && override.name !== FALLBACK_MEMORY_NAME) {
+        const probe = await probeMemory(namespace, override.name);
+        if (probe.outcome === 'resolved') {
+            return {
+                namespace,
+                memoryName: override.name,
+                status: 'ready',
+                message: probe.address,
+            };
+        }
+        if (probe.outcome === 'undetermined') {
+            return {
+                namespace,
+                memoryName: override.name,
+                status: 'undetermined',
+                message: `Could not read Memory "${override.name}" in namespace ${namespace} (${probe.detail}).`,
+            };
+        }
+    }
+    const unusedOverride = override.kind === 'name' && override.name !== FALLBACK_MEMORY_NAME
+        ? override.name
+        : undefined;
+    const check = await describeFallbackMemory(namespace, unusedOverride);
+    // The override read failed, so this verdict may be judging the wrong name.
+    // Only downgrade one that accuses the namespace of being broken.
+    if (override.kind === 'undetermined' &&
+        (check.status === 'missing' || check.status === 'unresolved')) {
+        return {
+            ...check,
+            status: 'undetermined',
+            message: `${check.message} ArkConfig could not be read, so a cluster-wide default memory name may apply instead.`,
+        };
+    }
+    return check;
+}
+async function describeFallbackMemory(namespace, unusedOverride) {
+    const base = { namespace, memoryName: FALLBACK_MEMORY_NAME };
+    // The operator asked for a different name and is not getting it. Without
+    // saying so, the remediation below reads as "create Memory/default", which
+    // is right for the executor and confusing next to their own ArkConfig.
+    const overrideNote = unusedOverride
+        ? ` ArkConfig names "${unusedOverride}", which is not usable here, so resolution falls back to "${FALLBACK_MEMORY_NAME}".`
+        : '';
+    const probe = await probeMemory(namespace, FALLBACK_MEMORY_NAME);
+    if (probe.outcome === 'resolved') {
+        return { ...base, status: 'ready', message: probe.address };
+    }
+    if (probe.outcome === 'undetermined') {
+        return {
+            ...base,
+            status: 'undetermined',
+            message: `Could not read Memory "${FALLBACK_MEMORY_NAME}" in namespace ${namespace} (${probe.detail}).`,
+        };
+    }
+    if (probe.outcome === 'unresolved') {
+        return {
+            ...base,
+            status: 'unresolved',
+            message: `Memory "${FALLBACK_MEMORY_NAME}" in namespace ${namespace} has not resolved an address (${probe.detail}); queries using it will fail.${overrideNote}`,
+        };
+    }
+    const broker = await probeBroker(namespace);
+    if (broker === 'undetermined') {
+        return {
+            ...base,
+            status: 'undetermined',
+            message: `Could not determine whether namespace ${namespace} has a broker, so a missing Memory cannot be judged.`,
+        };
+    }
+    if (broker === 'present') {
+        return {
+            ...base,
+            status: 'missing',
+            message: `Namespace ${namespace} has a broker but no Memory "${FALLBACK_MEMORY_NAME}"; chats there will silently lose conversation history.${overrideNote}`,
+        };
+    }
+    return {
+        ...base,
+        status: 'no-broker',
+        message: `No broker in namespace ${namespace}, so no conversation history is kept there.`,
+    };
+}
 export async function detectStorageBackend() {
     return (await describeStorageBackend()).backend;
 }

package/dist/types/arkService.d.ts

@@ -13,6 +13,8 @@ export interface ArkService {
     chartPath?: string;
     installArgs?: string[];
     prerequisiteUninstalls?: PrerequisiteUninstall[];
+    requires?: string[];
+    dependencyOverrideArgs?: string[];
     k8sServiceName?: string;
     k8sServicePort?: number;
     k8sPortForwardLocalPort?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-at-scale/ark",
-  "version": "0.1.69",
+  "version": "0.1.71",
   "description": "Ark CLI - Interactive terminal interface for ARK agents",
   "main": "dist/index.js",
   "type": "module",
@@ -43,8 +43,8 @@
   },
   "dependencies": {
     "@kubernetes/client-node": "^1.3.0",
-    "@modelcontextprotocol/sdk": "^1.27.1",
-    "axios": "^1.18.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
+    "axios": "^1.20.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",
     "debug": "^4.4.1",
@@ -85,7 +85,8 @@
     "node": ">=18.0.0"
   },
   "overrides": {
-    "brace-expansion": ">=5.0.9",
+    "vite": "^8.3.3",
+    "brace-expansion": "^5.0.12",
     "ip-address": "^10.3.1",
     "js-yaml": "^4.3.1",
     "minimatch": "^10.2.3",
@@ -99,6 +100,8 @@
     "ws": "^8.21.0",
     "esbuild": "^0.28.1",
     "form-data": "^4.0.6",
-    "postcss": "^8.5.18"
+    "postcss": "^8.5.18",
+    "proxy-addr": "^2.0.8",
+    "source-map-js": "^1.2.2"
   }
 }

package/templates/project/README.md

@@ -96,9 +96,9 @@ metadata:
   name: sample-query
 spec:
   input: 'Hello! Can you help me understand what you can do?'
-  targets:
-    - type: agent
-      name: sample-agent
+  target:
+    type: agent
+    name: sample-agent
 ```
 
 ## Prerequisites

package/templates/tool/agent.yaml

@@ -13,7 +13,7 @@ kind: Query
 metadata:
   name: sample-query
 spec:
-  targets:
-    - name: sample-agent
-      type: agent
+  target:
+    name: sample-agent
+    type: agent
   input: Calculate 3+2.

package/templates/tool/pyproject.toml

@@ -7,3 +7,8 @@ requires-python = ">=3.12"
 dependencies = [
     "fastmcp>=2.9.0",
 ]
+
+[tool.uv]
+# Security floor: authlib <=1.7.2 is affected by CVE-2026-104056 (XRAY-1104189).
+# authlib is pulled transitively via fastmcp; pin the minimum to the patched release.
+constraint-dependencies = ["authlib>=1.8.0"]

package/templates/tool/uv.lock

@@ -8,6 +8,9 @@ resolution-markers = [
     "python_full_version < '3.14' and sys_platform != 'win32'",
 ]
 
+[manifest]
+constraints = [{ name = "authlib", specifier = ">=1.8.0" }]
+
 [[package]]
 name = "aiofile"
 version = "3.9.0"
@@ -31,16 +34,15 @@ wheels = [
 
 [[package]]
 name = "anyio"
-version = "4.9.0"
+version = "4.14.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "idna" },
-    { name = "sniffio" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/95/7d/4c1bd541d4dffa1b52bd83fb8527089e097a106fc90b467a7313b105f840/anyio-4.9.0.tar.gz", hash = "sha256:673c0c244e15788651a4ff38710fea9675823028a6f08a5eda409e0c9840a028", size = 190949, upload-time = "2025-03-17T00:02:54.77Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a1/ee/48ca1a7c89ffec8b6a0c5d02b89c305671d5ffd8d3c94acf8b8c408575bb/anyio-4.9.0-py3-none-any.whl", hash = "sha256:9f76d541cad6e36af7beb62e978876f3b41e3e04f2c1fbf0884604c0a9c4d93c", size = 100916, upload-time = "2025-03-17T00:02:52.713Z" },
+    { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" },
 ]
 
 [[package]]
@@ -54,14 +56,15 @@ wheels = [
 
 [[package]]
 name = "authlib"
-version = "1.6.12"
+version = "1.8.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
+    { name = "joserfc" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d3/30/6691fdc63b35f54a5a65e04fa1e59d827f4d4e8f4a39678ba7d3088ce0c8/authlib-1.6.12.tar.gz", hash = "sha256:0656d8482f28fc8221929d5f35b2bde5d13e10555ebc06b4561b0d622e83b1bd", size = 165368, upload-time = "2026-05-04T08:11:31.826Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/51/bc1729d3cfdc214b4935f4e886e4dd443c3065fd8e1e66423fe84b490f81/authlib-1.8.0.tar.gz", hash = "sha256:f3ecd5f1da737262fb53bf1a4d95c4ea1ad9dd509316587a255c99ab1838a4f0", size = 177759, upload-time = "2026-08-30T12:12:34.833Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/cd/51/9b0b5cd4cf683a02db937a6f9bbebcdc9c56558a7bb3763ce7d3512103c3/authlib-1.6.12-py2.py3-none-any.whl", hash = "sha256:e9229ad7fde610b139dd12f5edbe97eab9ee78bfb85691247e767727850b99ab", size = 244473, upload-time = "2026-05-04T08:11:30.354Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/c6/6f124bcfbbfb20fba22c939b4e43a06dccfc0e1ca20e5634ca573cb1e271/authlib-1.8.0-py2.py3-none-any.whl", hash = "sha256:88aebbd9af6757e14e912d5dc007ae1dc1f3e27e3b2152ce7c552ee2c3b3c121", size = 260804, upload-time = "2026-08-30T12:12:33.162Z" },
 ]
 
 [[package]]
@@ -449,6 +452,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b2/a3/e137168c9c44d18eff0376253da9f1e9234d0239e0ee230d2fee6cea8e55/jeepney-0.9.0-py3-none-any.whl", hash = "sha256:97e5714520c16fc0a45695e5365a2e11b81ea79bba796e26f9f1d178cb182683", size = 49010, upload-time = "2025-02-27T18:51:00.104Z" },
 ]
 
+[[package]]
+name = "joserfc"
+version = "1.7.5"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/19/94/80fea1514b7c6d7d37804d3fe9ca81455f633347fc98731bd71ffe1faa17/joserfc-1.7.5.tar.gz", hash = "sha256:d5ff536e658e17664f8c1b1ab60dc4aa62aa973fcef1edd33cc44bda45d6f5ea", size = 234990, upload-time = "2026-08-29T13:05:42.057Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/67/c5/82addfd375e5ee6520644e0553e4aadde92d668c4fc99cc716d337fe7bb3/joserfc-1.7.5-py3-none-any.whl", hash = "sha256:add2c2c84e8373b084d526a8b53daba5d7a513a118cd2dcd9fc9f979d0922159", size = 71269, upload-time = "2026-08-29T13:05:40.718Z" },
+]
+
 [[package]]
 name = "jsonref"
 version = "1.1.0"
@@ -669,10 +684,10 @@ resolution-markers = [
     "python_full_version < '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "annotated-types" },
-    { name = "pydantic-core", version = "2.33.2", source = { registry = "https://pypi.org/simple" } },
-    { name = "typing-extensions" },
-    { name = "typing-inspection", version = "0.4.1", source = { registry = "https://pypi.org/simple" } },
+    { name = "annotated-types", marker = "python_full_version < '3.14'" },
+    { name = "pydantic-core", version = "2.33.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.14'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.14'" },
+    { name = "typing-inspection", version = "0.4.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/00/dd/4325abf92c39ba8623b5af936ddb36ffcfe0beae70405d456ab1fb2f5b8c/pydantic-2.11.7.tar.gz", hash = "sha256:d989c3c6cb79469287b1569f7447a17848c998458d49ebe294e975b9baf0f0db", size = 788350, upload-time = "2025-06-14T08:33:17.137Z" }
 wheels = [
@@ -681,7 +696,7 @@ wheels = [
 
 [package.optional-dependencies]
 email = [
-    { name = "email-validator" },
+    { name = "email-validator", marker = "python_full_version < '3.14'" },
 ]
 
 [[package]]
@@ -693,10 +708,10 @@ resolution-markers = [
     "python_full_version >= '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "annotated-types" },
-    { name = "pydantic-core", version = "2.46.4", source = { registry = "https://pypi.org/simple" } },
-    { name = "typing-extensions" },
-    { name = "typing-inspection", version = "0.4.2", source = { registry = "https://pypi.org/simple" } },
+    { name = "annotated-types", marker = "python_full_version >= '3.14'" },
+    { name = "pydantic-core", version = "2.46.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.14'" },
+    { name = "typing-extensions", marker = "python_full_version >= '3.14'" },
+    { name = "typing-inspection", version = "0.4.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/18/a5/b60d21ac674192f8ab0ba4e9fd860690f9b4a6e51ca5df118733b487d8d6/pydantic-2.13.4.tar.gz", hash = "sha256:c40756b57adaa8b1efeeced5c196f3f3b7c435f90e84ea7f443901bec8099ef6", size = 844775, upload-time = "2026-05-06T13:43:05.343Z" }
 wheels = [
@@ -705,7 +720,7 @@ wheels = [
 
 [package.optional-dependencies]
 email = [
-    { name = "email-validator" },
+    { name = "email-validator", marker = "python_full_version >= '3.14'" },
 ]
 
 [[package]]
@@ -717,7 +732,7 @@ resolution-markers = [
     "python_full_version < '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/ad/88/5f2260bdfae97aabf98f1778d43f69574390ad787afb646292a638c923d4/pydantic_core-2.33.2.tar.gz", hash = "sha256:7cb8bc3605c29176e1b105350d2e6474142d7c1bd1d9327c4a9bdb46bf827acc", size = 435195, upload-time = "2025-04-23T18:33:52.104Z" }
 wheels = [
@@ -763,7 +778,7 @@ resolution-markers = [
     "python_full_version >= '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version >= '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/9d/56/921726b776ace8d8f5db44c4ef961006580d91dc52b803c489fafd1aa249/pydantic_core-2.46.4.tar.gz", hash = "sha256:62f875393d7f270851f20523dd2e29f082bcc82292d66db2b64ea71f64b6e1c1", size = 471464, upload-time = "2026-05-06T13:37:06.98Z" }
 wheels = [
@@ -1096,23 +1111,14 @@ name = "secretstorage"
 version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "cryptography" },
-    { name = "jeepney" },
+    { name = "cryptography", marker = "sys_platform != 'win32'" },
+    { name = "jeepney", marker = "sys_platform != 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" }
 wheels = [
     { url = "https://files.pythonhosted.org/packages/b7/46/f5af3402b579fd5e11573ce652019a67074317e18c1935cc0b4ba9b35552/secretstorage-3.5.0-py3-none-any.whl", hash = "sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137", size = 15554, upload-time = "2025-11-23T19:02:51.545Z" },
 ]
 
-[[package]]
-name = "sniffio"
-version = "1.3.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a2/87/a6771e1546d97e7e041b6ae58d80074f81b7d5121207425c964ddf5cfdbd/sniffio-1.3.1.tar.gz", hash = "sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc", size = 20372, upload-time = "2024-02-25T23:20:04.057Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/e9/44/75a9c9421471a6c4805dbf2356f7c181a29c1879239abab1ea2cc8f38b40/sniffio-1.3.1-py3-none-any.whl", hash = "sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2", size = 10235, upload-time = "2024-02-25T23:20:01.196Z" },
-]
-
 [[package]]
 name = "sse-starlette"
 version = "2.3.6"
@@ -1167,7 +1173,7 @@ resolution-markers = [
     "python_full_version < '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/f8/b1/0c11f5058406b3af7609f121aaa6b609744687f1d158b3c3a5bf4cc94238/typing_inspection-0.4.1.tar.gz", hash = "sha256:6ae134cc0203c33377d43188d4064e9b357dba58cff3185f22924610e70a9d28", size = 75726, upload-time = "2025-05-21T18:55:23.885Z" }
 wheels = [
@@ -1183,7 +1189,7 @@ resolution-markers = [
     "python_full_version >= '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version >= '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/55/e3/70399cb7dd41c10ac53367ae42139cf4b1ca5f36bb3dc6c9d33acdb43655/typing_inspection-0.4.2.tar.gz", hash = "sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464", size = 75949, upload-time = "2025-10-01T02:14:41.687Z" }
 wheels = [