@agents-at-scale/ark 0.1.70 → 0.1.72

package/dist/commands/status/index.js

@@ -19,6 +19,7 @@ function enrichServiceDetails(service) {
         warning: { icon: '⚠', text: 'warning', color: 'yellow' },
         'not ready': { icon: '○', text: 'not ready', color: 'yellow' },
         'not installed': { icon: '?', text: 'not installed', color: 'yellow' },
+        'no access': { icon: '⊘', text: 'no access', color: 'yellow' },
     };
     const statusInfo = statusMap[service.status] || {
         icon: '?',

package/dist/components/statusChecker.js

@@ -52,8 +52,22 @@ export const getKindVersion = () => ({
         return match ? match[1] : output.trim();
     },
 });
-function createErrorServiceStatus(name, url, error, defaultStatus = 'unhealthy', defaultDetails) {
+function isForbiddenError(error) {
+    return error instanceof Error && /forbidden/i.test(error.message);
+}
+function createErrorServiceStatus(name, url, error, defaultStatus = 'unhealthy', defaultDetails, namespace) {
     const errorMessage = error instanceof Error ? error.message : 'Unknown error occurred';
+    if (isForbiddenError(error)) {
+        return {
+            name,
+            status: 'no access',
+            url,
+            details: namespace
+                ? `No permission to read namespace '${namespace}'`
+                : 'No permission to read this resource',
+            namespace,
+        };
+    }
     return {
         name,
         status: defaultStatus,
@@ -246,7 +260,7 @@ export class StatusChecker {
                     namespace,
                 };
             }
-            return createErrorServiceStatus(serviceName, '', error, 'unhealthy', `Failed to check deployment: ${errorMessage}`);
+            return createErrorServiceStatus(serviceName, '', error, 'unhealthy', `Failed to check deployment: ${errorMessage}`, namespace);
         }
     }
     /**
@@ -288,7 +302,7 @@ export class StatusChecker {
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-            return createErrorServiceStatus(serviceName, '', error, 'unhealthy', `Failed to check helm status: ${errorMessage}`);
+            return createErrorServiceStatus(serviceName, '', error, 'unhealthy', `Failed to check helm status: ${errorMessage}`, namespace);
         }
     }
     /**

package/dist/lib/cluster.js

@@ -1,4 +1,5 @@
 import { execa } from 'execa';
+import { classifyFailure } from './readinessChecks.js';
 export async function detectClusterType() {
     try {
         const { stdout } = await execa('kubectl', ['config', 'current-context']);
@@ -31,7 +32,59 @@ export async function detectClusterType() {
         };
     }
 }
+const NODE_INTERNAL_IP_JSONPATH = 'jsonpath={.items[0].status.addresses[?(@.type=="InternalIP")].address}';
+const NODE_EXTERNAL_IP_JSONPATH = 'jsonpath={.items[0].status.addresses[?(@.type=="ExternalIP")].address}';
+async function getNodeIp(jsonpath) {
+    const { stdout } = await execa('kubectl', ['get', 'nodes', '-o', jsonpath]);
+    return stdout.trim();
+}
+async function getIstioGatewayAddress(field) {
+    const { stdout } = await execa('kubectl', [
+        'get',
+        'svc',
+        '-n',
+        'istio-system',
+        'istio-ingressgateway',
+        '-o',
+        `jsonpath={.status.loadBalancer.ingress[0].${field}}`,
+    ]);
+    return stdout.trim();
+}
+async function resolveClusterIp(type) {
+    switch (type) {
+        case 'minikube':
+            try {
+                const { stdout } = await execa('minikube', ['ip']);
+                return stdout.trim();
+            }
+            catch {
+                return getNodeIp(NODE_INTERNAL_IP_JSONPATH);
+            }
+        case 'docker-desktop':
+            return 'localhost';
+        case 'cloud':
+            try {
+                const ip = await getIstioGatewayAddress('ip');
+                return ip || (await getIstioGatewayAddress('hostname'));
+            }
+            catch {
+                return getNodeIp(NODE_EXTERNAL_IP_JSONPATH);
+            }
+        default:
+            return getNodeIp(NODE_INTERNAL_IP_JSONPATH);
+    }
+}
+function isForbiddenError(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    const stderr = error.stderr;
+    const text = typeof stderr === 'string' && stderr ? stderr : error.message;
+    return classifyFailure(text) === 'forbidden';
+}
 export async function getClusterInfo(context) {
+    let resolvedContext;
+    let resolvedNamespace;
     try {
         // If context is provided, use it
         const contextArgs = context ? ['--context', context] : [];
@@ -48,6 +101,8 @@ export async function getClusterInfo(context) {
         const currentContext = config['current-context'] || '';
         const contextData = config.contexts?.find((c) => c.name === currentContext);
         const namespace = contextData?.context?.namespace || 'default';
+        resolvedContext = currentContext;
+        resolvedNamespace = namespace;
         // Detect cluster type from context name
         const clusterInfo = await detectClusterType();
         clusterInfo.context = currentContext;
@@ -56,99 +111,22 @@ export async function getClusterInfo(context) {
             return clusterInfo;
         }
         let ip;
-        switch (clusterInfo.type) {
-            case 'minikube':
-                try {
-                    const { stdout } = await execa('minikube', ['ip']);
-                    ip = stdout.trim();
-                }
-                catch {
-                    // Fallback to kubectl if minikube command fails
-                    const { stdout } = await execa('kubectl', [
-                        'get',
-                        'nodes',
-                        '-o',
-                        'jsonpath={.items[0].status.addresses[?(@.type=="InternalIP")].address}',
-                    ]);
-                    ip = stdout.trim();
-                }
-                break;
-            case 'kind': {
-                const { stdout: kindOutput } = await execa('kubectl', [
-                    'get',
-                    'nodes',
-                    '-o',
-                    'jsonpath={.items[0].status.addresses[?(@.type=="InternalIP")].address}',
-                ]);
-                ip = kindOutput.trim();
-                break;
-            }
-            case 'docker-desktop':
-                ip = 'localhost';
-                break;
-            case 'k3s': {
-                const { stdout: k3sOutput } = await execa('kubectl', [
-                    'get',
-                    'nodes',
-                    '-o',
-                    'jsonpath={.items[0].status.addresses[?(@.type=="InternalIP")].address}',
-                ]);
-                ip = k3sOutput.trim();
-                break;
-            }
-            case 'cloud':
-                // For cloud clusters, try to get the external IP or load balancer IP
-                try {
-                    const { stdout: lbOutput } = await execa('kubectl', [
-                        'get',
-                        'svc',
-                        '-n',
-                        'istio-system',
-                        'istio-ingressgateway',
-                        '-o',
-                        'jsonpath={.status.loadBalancer.ingress[0].ip}',
-                    ]);
-                    ip = lbOutput.trim();
-                    if (!ip) {
-                        const { stdout: hostnameOutput } = await execa('kubectl', [
-                            'get',
-                            'svc',
-                            '-n',
-                            'istio-system',
-                            'istio-ingressgateway',
-                            '-o',
-                            'jsonpath={.status.loadBalancer.ingress[0].hostname}',
-                        ]);
-                        ip = hostnameOutput.trim();
-                    }
-                }
-                catch {
-                    // Fallback to node IP
-                    const { stdout: nodeOutput } = await execa('kubectl', [
-                        'get',
-                        'nodes',
-                        '-o',
-                        'jsonpath={.items[0].status.addresses[?(@.type=="ExternalIP")].address}',
-                    ]);
-                    ip = nodeOutput.trim();
-                }
-                break;
-            default: {
-                const { stdout: defaultOutput } = await execa('kubectl', [
-                    'get',
-                    'nodes',
-                    '-o',
-                    'jsonpath={.items[0].status.addresses[?(@.type=="InternalIP")].address}',
-                ]);
-                ip = defaultOutput.trim();
-                break;
+        try {
+            ip = await resolveClusterIp(clusterInfo.type);
+        }
+        catch (error) {
+            if (!isForbiddenError(error)) {
+                throw error;
             }
+            ip = undefined;
         }
         return { ...clusterInfo, ip };
     }
     catch (error) {
         return {
             type: 'unknown',
+            ...(resolvedContext !== undefined && { context: resolvedContext }),
+            ...(resolvedNamespace !== undefined && { namespace: resolvedNamespace }),
             error: error instanceof Error ? error.message : 'Unknown error',
         };
     }

package/dist/lib/readinessChecks.d.ts

@@ -20,6 +20,8 @@ export interface NamespaceMemoryCheck {
     message: string;
 }
 export type ReadinessProgress = (result: ReadinessCheckResult) => void;
+type FailureReason = 'not-found' | 'forbidden' | 'unreachable' | 'undetermined';
+export declare function classifyFailure(stderr: string): FailureReason;
 export declare function describeStorageBackend(): Promise<BackendDetection>;
 /**
  * Report whether the namespace ends up with a Memory the executor can use.
@@ -39,3 +41,4 @@ export declare function describeStorageBackend(): Promise<BackendDetection>;
 export declare function describeNamespaceMemory(namespace: string): Promise<NamespaceMemoryCheck>;
 export declare function detectStorageBackend(): Promise<DetectedBackend>;
 export declare function runReadinessChecks(timeoutSeconds: number, backend: DetectedBackend, onProgress?: ReadinessProgress): Promise<ReadinessCheckResult[]>;
+export {};

package/dist/lib/readinessChecks.js

@@ -19,7 +19,7 @@ async function runKubectl(args, timeoutMs) {
 // aggregated API server serves no arkconfigs, so this is the normal reply
 // there rather than something to retry.
 const UNSERVED_RESOURCE_PATTERN = /doesn't have a resource type|no matches for kind|the server could not find the requested resource/i;
-function classifyFailure(stderr) {
+export function classifyFailure(stderr) {
     if (/not\s*found/i.test(stderr) || UNSERVED_RESOURCE_PATTERN.test(stderr)) {
         return 'not-found';
     }

package/dist/lib/types.d.ts

@@ -16,7 +16,7 @@ export interface KubernetesConfig {
 export type DeploymentStatus = 'available' | 'progressing' | 'replicafailure' | 'failed' | 'not found' | 'unknown';
 export type ServiceStatus = {
     name: string;
-    status: 'healthy' | 'warning' | 'unhealthy' | 'not installed' | 'not ready';
+    status: 'healthy' | 'warning' | 'unhealthy' | 'not installed' | 'not ready' | 'no access';
     deploymentStatus?: DeploymentStatus;
     url?: string;
     version?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-at-scale/ark",
-  "version": "0.1.70",
+  "version": "0.1.72",
   "description": "Ark CLI - Interactive terminal interface for ARK agents",
   "main": "dist/index.js",
   "type": "module",
@@ -85,6 +85,7 @@
     "node": ">=18.0.0"
   },
   "overrides": {
+    "vite": "^8.3.3",
     "brace-expansion": "^5.0.12",
     "ip-address": "^10.3.1",
     "js-yaml": "^4.3.1",
@@ -101,6 +102,7 @@
     "form-data": "^4.0.6",
     "postcss": "^8.5.18",
     "proxy-addr": "^2.0.8",
-    "source-map-js": "^1.2.2"
+    "source-map-js": "^1.2.2",
+    "follow-redirects": "^1.16.1"
   }
 }

package/templates/mcp-server/Dockerfile

@@ -63,7 +63,7 @@ ENTRYPOINT [ "/bin/bash", "-c", "mcp-proxy --debug --port 8080 --host 0.0.0.0 --
 {{- end }}
 
 {{- else if eq .Values.technology "go" }}
-FROM golang:1.26.6-alpine AS go-builder
+FROM golang:1.26.9-alpine AS go-builder
 {{- if .Values.packageSource }}
 {{- if eq .Values.packageSource "go-install" }}
 RUN go install {{ .Values.packageName }}@latest

package/templates/project/README.md

@@ -96,9 +96,9 @@ metadata:
   name: sample-query
 spec:
   input: 'Hello! Can you help me understand what you can do?'
-  targets:
-    - type: agent
-      name: sample-agent
+  target:
+    type: agent
+    name: sample-agent
 ```
 
 ## Prerequisites

package/templates/tool/agent.yaml

@@ -13,7 +13,7 @@ kind: Query
 metadata:
   name: sample-query
 spec:
-  targets:
-    - name: sample-agent
-      type: agent
+  target:
+    name: sample-agent
+    type: agent
   input: Calculate 3+2.

package/templates/tool/pyproject.toml

@@ -7,3 +7,8 @@ requires-python = ">=3.12"
 dependencies = [
     "fastmcp>=2.9.0",
 ]
+
+[tool.uv]
+# Security floor: authlib <=1.7.2 is affected by CVE-2026-104056 (XRAY-1104189).
+# authlib is pulled transitively via fastmcp; pin the minimum to the patched release.
+constraint-dependencies = ["authlib>=1.8.0"]

package/templates/tool/uv.lock

@@ -8,6 +8,9 @@ resolution-markers = [
     "python_full_version < '3.14' and sys_platform != 'win32'",
 ]
 
+[manifest]
+constraints = [{ name = "authlib", specifier = ">=1.8.0" }]
+
 [[package]]
 name = "aiofile"
 version = "3.9.0"
@@ -53,14 +56,15 @@ wheels = [
 
 [[package]]
 name = "authlib"
-version = "1.6.12"
+version = "1.8.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
+    { name = "joserfc" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d3/30/6691fdc63b35f54a5a65e04fa1e59d827f4d4e8f4a39678ba7d3088ce0c8/authlib-1.6.12.tar.gz", hash = "sha256:0656d8482f28fc8221929d5f35b2bde5d13e10555ebc06b4561b0d622e83b1bd", size = 165368, upload-time = "2026-05-04T08:11:31.826Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/51/bc1729d3cfdc214b4935f4e886e4dd443c3065fd8e1e66423fe84b490f81/authlib-1.8.0.tar.gz", hash = "sha256:f3ecd5f1da737262fb53bf1a4d95c4ea1ad9dd509316587a255c99ab1838a4f0", size = 177759, upload-time = "2026-08-30T12:12:34.833Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/cd/51/9b0b5cd4cf683a02db937a6f9bbebcdc9c56558a7bb3763ce7d3512103c3/authlib-1.6.12-py2.py3-none-any.whl", hash = "sha256:e9229ad7fde610b139dd12f5edbe97eab9ee78bfb85691247e767727850b99ab", size = 244473, upload-time = "2026-05-04T08:11:30.354Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/c6/6f124bcfbbfb20fba22c939b4e43a06dccfc0e1ca20e5634ca573cb1e271/authlib-1.8.0-py2.py3-none-any.whl", hash = "sha256:88aebbd9af6757e14e912d5dc007ae1dc1f3e27e3b2152ce7c552ee2c3b3c121", size = 260804, upload-time = "2026-08-30T12:12:33.162Z" },
 ]
 
 [[package]]
@@ -448,6 +452,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b2/a3/e137168c9c44d18eff0376253da9f1e9234d0239e0ee230d2fee6cea8e55/jeepney-0.9.0-py3-none-any.whl", hash = "sha256:97e5714520c16fc0a45695e5365a2e11b81ea79bba796e26f9f1d178cb182683", size = 49010, upload-time = "2025-02-27T18:51:00.104Z" },
 ]
 
+[[package]]
+name = "joserfc"
+version = "1.7.5"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/19/94/80fea1514b7c6d7d37804d3fe9ca81455f633347fc98731bd71ffe1faa17/joserfc-1.7.5.tar.gz", hash = "sha256:d5ff536e658e17664f8c1b1ab60dc4aa62aa973fcef1edd33cc44bda45d6f5ea", size = 234990, upload-time = "2026-08-29T13:05:42.057Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/67/c5/82addfd375e5ee6520644e0553e4aadde92d668c4fc99cc716d337fe7bb3/joserfc-1.7.5-py3-none-any.whl", hash = "sha256:add2c2c84e8373b084d526a8b53daba5d7a513a118cd2dcd9fc9f979d0922159", size = 71269, upload-time = "2026-08-29T13:05:40.718Z" },
+]
+
 [[package]]
 name = "jsonref"
 version = "1.1.0"
@@ -668,10 +684,10 @@ resolution-markers = [
     "python_full_version < '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "annotated-types" },
-    { name = "pydantic-core", version = "2.33.2", source = { registry = "https://pypi.org/simple" } },
-    { name = "typing-extensions" },
-    { name = "typing-inspection", version = "0.4.1", source = { registry = "https://pypi.org/simple" } },
+    { name = "annotated-types", marker = "python_full_version < '3.14'" },
+    { name = "pydantic-core", version = "2.33.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.14'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.14'" },
+    { name = "typing-inspection", version = "0.4.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/00/dd/4325abf92c39ba8623b5af936ddb36ffcfe0beae70405d456ab1fb2f5b8c/pydantic-2.11.7.tar.gz", hash = "sha256:d989c3c6cb79469287b1569f7447a17848c998458d49ebe294e975b9baf0f0db", size = 788350, upload-time = "2025-06-14T08:33:17.137Z" }
 wheels = [
@@ -680,7 +696,7 @@ wheels = [
 
 [package.optional-dependencies]
 email = [
-    { name = "email-validator" },
+    { name = "email-validator", marker = "python_full_version < '3.14'" },
 ]
 
 [[package]]
@@ -692,10 +708,10 @@ resolution-markers = [
     "python_full_version >= '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "annotated-types" },
-    { name = "pydantic-core", version = "2.46.4", source = { registry = "https://pypi.org/simple" } },
-    { name = "typing-extensions" },
-    { name = "typing-inspection", version = "0.4.2", source = { registry = "https://pypi.org/simple" } },
+    { name = "annotated-types", marker = "python_full_version >= '3.14'" },
+    { name = "pydantic-core", version = "2.46.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.14'" },
+    { name = "typing-extensions", marker = "python_full_version >= '3.14'" },
+    { name = "typing-inspection", version = "0.4.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/18/a5/b60d21ac674192f8ab0ba4e9fd860690f9b4a6e51ca5df118733b487d8d6/pydantic-2.13.4.tar.gz", hash = "sha256:c40756b57adaa8b1efeeced5c196f3f3b7c435f90e84ea7f443901bec8099ef6", size = 844775, upload-time = "2026-05-06T13:43:05.343Z" }
 wheels = [
@@ -704,7 +720,7 @@ wheels = [
 
 [package.optional-dependencies]
 email = [
-    { name = "email-validator" },
+    { name = "email-validator", marker = "python_full_version >= '3.14'" },
 ]
 
 [[package]]
@@ -716,7 +732,7 @@ resolution-markers = [
     "python_full_version < '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/ad/88/5f2260bdfae97aabf98f1778d43f69574390ad787afb646292a638c923d4/pydantic_core-2.33.2.tar.gz", hash = "sha256:7cb8bc3605c29176e1b105350d2e6474142d7c1bd1d9327c4a9bdb46bf827acc", size = 435195, upload-time = "2025-04-23T18:33:52.104Z" }
 wheels = [
@@ -762,7 +778,7 @@ resolution-markers = [
     "python_full_version >= '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version >= '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/9d/56/921726b776ace8d8f5db44c4ef961006580d91dc52b803c489fafd1aa249/pydantic_core-2.46.4.tar.gz", hash = "sha256:62f875393d7f270851f20523dd2e29f082bcc82292d66db2b64ea71f64b6e1c1", size = 471464, upload-time = "2026-05-06T13:37:06.98Z" }
 wheels = [
@@ -1095,8 +1111,8 @@ name = "secretstorage"
 version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "cryptography" },
-    { name = "jeepney" },
+    { name = "cryptography", marker = "sys_platform != 'win32'" },
+    { name = "jeepney", marker = "sys_platform != 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" }
 wheels = [
@@ -1157,7 +1173,7 @@ resolution-markers = [
     "python_full_version < '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/f8/b1/0c11f5058406b3af7609f121aaa6b609744687f1d158b3c3a5bf4cc94238/typing_inspection-0.4.1.tar.gz", hash = "sha256:6ae134cc0203c33377d43188d4064e9b357dba58cff3185f22924610e70a9d28", size = 75726, upload-time = "2025-05-21T18:55:23.885Z" }
 wheels = [
@@ -1173,7 +1189,7 @@ resolution-markers = [
     "python_full_version >= '3.14' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version >= '3.14'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/55/e3/70399cb7dd41c10ac53367ae42139cf4b1ca5f36bb3dc6c9d33acdb43655/typing_inspection-0.4.2.tar.gz", hash = "sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464", size = 75949, upload-time = "2025-10-01T02:14:41.687Z" }
 wheels = [