@integrity-labs/agt-cli 0.27.43 → 0.27.44

package/dist/bin/agt.js

@@ -27,7 +27,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-TGA6Y555.js";
+} from "../chunk-BUJVZFTK.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -56,8 +56,8 @@ import {
 } from "../chunk-GVM2KJOA.js";
 
 // src/bin/agt.ts
-import { join as join17 } from "path";
-import { homedir as homedir7 } from "os";
+import { join as join18 } from "path";
+import { homedir as homedir8 } from "os";
 import { Command } from "commander";
 
 // src/commands/whoami.ts
@@ -551,11 +551,11 @@ async function lintCommand(path) {
       process.exitCode = 1;
       return;
     }
-    const { readdirSync: readdirSync4, statSync: statSync3 } = await import("fs");
-    const entries = readdirSync4(augmentedDir);
+    const { readdirSync: readdirSync5, statSync: statSync4 } = await import("fs");
+    const entries = readdirSync5(augmentedDir);
     for (const entry of entries) {
       const entryPath = join2(augmentedDir, entry);
-      if (statSync3(entryPath).isDirectory()) {
+      if (statSync4(entryPath).isDirectory()) {
         dirs.push({ name: entry, dir: entryPath });
       }
     }
@@ -4687,7 +4687,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.27.43" : "dev";
+var cliVersion = true ? "0.27.44" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5059,6 +5059,111 @@ async function auditSubagentsCommand(options = {}) {
   }
 }
 
+// src/lib/mcp-render-allowlist-audit.ts
+import { readdirSync as readdirSync4, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join17 } from "path";
+function expectedWildcard(serverKey) {
+  return `mcp__${serverKey.replace(/-/g, "_")}__*`;
+}
+function parseMcpWildcardsFromToolsLine(content) {
+  const toolsLine = content.split("\n").find((l) => l.startsWith("tools:"));
+  if (!toolsLine) return null;
+  const value = toolsLine.replace(/^tools:\s*/, "").trim();
+  if (value.length === 0) return [];
+  return value.split(/\s*,\s*/).map((t) => t.trim()).filter((t) => t.startsWith("mcp__"));
+}
+function readMcpServerKeys(mcpJsonPath) {
+  try {
+    const config = JSON.parse(readFileSync10(mcpJsonPath, "utf-8"));
+    return Object.keys(config.mcpServers ?? {});
+  } catch {
+    return null;
+  }
+}
+function auditMcpRenderAllowlist(rootDir = join17(homedir7(), ".augmented")) {
+  const findings = [];
+  let entries;
+  try {
+    entries = readdirSync4(rootDir);
+  } catch {
+    return findings;
+  }
+  for (const entry of entries) {
+    const agentDir = join17(rootDir, entry);
+    let s;
+    try {
+      s = statSync3(agentDir);
+    } catch {
+      continue;
+    }
+    if (!s.isDirectory() || entry.startsWith("_") || entry.startsWith(".")) continue;
+    for (const scope of ["provision", "project"]) {
+      const mcpJsonPath = scope === "provision" ? join17(agentDir, "provision", ".mcp.json") : join17(agentDir, "project", ".mcp.json");
+      const keys = readMcpServerKeys(mcpJsonPath);
+      if (keys === null || keys.length === 0) continue;
+      const expected = new Set(keys.map(expectedWildcard));
+      for (const subagent of ["channel-message-handler", "augmented-worker"]) {
+        const mdPath = scope === "provision" ? join17(agentDir, ".claude", "agents", `${subagent}.md`) : join17(agentDir, "project", ".claude", "agents", `${subagent}.md`);
+        let content;
+        try {
+          content = readFileSync10(mdPath, "utf-8");
+        } catch {
+          continue;
+        }
+        const declared = parseMcpWildcardsFromToolsLine(content);
+        if (declared === null) continue;
+        const declaredSet = new Set(declared);
+        const missing = [...expected].filter((w) => !declaredSet.has(w));
+        if (missing.length > 0) {
+          findings.push({ agent: entry, subagent, scope, missing, file: mdPath });
+        }
+      }
+    }
+  }
+  return findings;
+}
+function formatRenderDriftFinding(f) {
+  return `[manager-worker] [mcp-render-drift] agent=${f.agent} subagent=${f.subagent} scope=${f.scope} missing=${JSON.stringify(f.missing)} file=${f.file}`;
+}
+
+// src/commands/audit-mcp-render.ts
+async function auditMcpRenderCommand(options = {}) {
+  const findings = auditMcpRenderAllowlist();
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify({ findings }, null, 2)}
+`);
+  } else if (findings.length === 0) {
+    process.stdout.write(
+      "No render drift found. Every managed agent's sub-agent .md `tools:` allowlist covers every server in its `.mcp.json`.\n"
+    );
+  } else {
+    process.stdout.write(
+      `Found ${findings.length} sub-agent .md file${findings.length === 1 ? "" : "s"} with a stale tools allowlist:
+
+`
+    );
+    for (const f of findings) {
+      process.stdout.write(`  \u2022 ${f.agent}/${f.scope}/${f.subagent}.md
+`);
+      process.stdout.write(`    missing: ${f.missing.join(", ")}
+`);
+      process.stdout.write(`    file:    ${f.file}
+`);
+    }
+    process.stdout.write(
+      '\nA missing wildcard means the sub-agent will get "No such tool available." on any call to that MCP server. The fix is to force a re-render (e.g. by adding/removing any MCP server, which routes through syncMcpToProject), OR restart the manager so the next poll picks up the live `.mcp.json` state. The root-cause write path that bypassed the render chokepoint is tracked in ENG-5922.\n'
+    );
+    for (const f of findings) {
+      process.stderr.write(`${formatRenderDriftFinding(f)}
+`);
+    }
+  }
+  if (options.strict && findings.length > 0) {
+    process.exit(2);
+  }
+}
+
 // src/commands/integration.ts
 import chalk19 from "chalk";
 import ora17 from "ora";
@@ -5360,7 +5465,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.27.43" : "dev";
+var cliVersion2 = true ? "0.27.44" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {
@@ -5448,16 +5553,16 @@ host.command("pair <host-name>").description("Start an SSM port-forward + shell
   })
 );
 var manager = program.command("manager").description("Host config sync daemon \u2014 keeps local agent files in sync with API");
-manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join17(homedir7(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
-manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join17(homedir7(), ".augmented")).action(managerStopCommand);
-manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join17(homedir7(), ".augmented")).action(managerStatusCommand);
-manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join17(homedir7(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
-manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join17(homedir7(), ".augmented")).action(managerInstallCommand);
+manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
+manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).action(managerStopCommand);
+manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).action(managerStatusCommand);
+manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
+manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join18(homedir8(), ".augmented")).action(managerInstallCommand);
 manager.command("uninstall").description("Remove the OS-level supervisor (launchctl unload + delete plist on macOS). Idempotent.").action(managerUninstallCommand);
 manager.command("install-system-unit").description("Install a system-level systemd unit (Linux, root) so the manager auto-starts on every boot. For headless EC2 hosts \u2014 survives reboot without `loginctl enable-linger`. (ENG-4706)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files (defaults to /root/.augmented or /home/<user>/.augmented)").option("--user <name>", "Unix user the manager runs as", "root").action(managerInstallSystemUnitCommand);
 manager.command("uninstall-system-unit").description("Remove the system-level systemd unit (Linux, root). Idempotent. (ENG-4706)").action(managerUninstallSystemUnitCommand);
 var agent = program.command("agent").description("Inspect and manage agents");
-agent.command("show <code-name>").description("Display an agent's provisioned OpenClaw configuration").option("--config-dir <dir>", "Config directory", join17(homedir7(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
+agent.command("show <code-name>").description("Display an agent's provisioned OpenClaw configuration").option("--config-dir <dir>", "Config directory", join18(homedir8(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
 var kanban = program.command("kanban").description("Manage agent kanban boards");
 kanban.command("list").description("List kanban board items for an agent").requiredOption("--agent <code-name>", "Agent code name").action(kanbanListCommand);
 kanban.command("add <title>").description("Add a new item to an agent kanban board").requiredOption("--agent <code-name>", "Agent code name").option("--priority <1|2|3>", "Priority: 1=high, 2=medium, 3=low", "2").option("--status <status>", "Initial status: backlog | todo | in_progress", "todo").option("--description <text>", "Item description").option("--estimate <minutes>", "Estimated time in minutes").option("--deliverable <text>", "Expected output/deliverable").action(kanbanAddCommand);
@@ -5487,6 +5592,7 @@ integration.command("enrol").description("Enrol an integration with an API key o
 program.command("update").description("Check for and install CLI updates").option("--force", "Update even if manager or agent sessions are running").action(updateCommand);
 var audit = program.command("audit").description("Operator audits \u2014 sub-agent MCP bindings, etc.");
 audit.command("subagents").description("Find sub-agents whose tools allowlist would block mcp__* calls on dispatch (ENG-5897)").option("--strict", "Exit with code 2 if any findings (suitable for CI gating)").option("--json", "Emit findings as JSON to stdout").action(auditSubagentsCommand);
+audit.command("mcp-render").description("Find managed agents whose subagent .md tools allowlist is stale vs .mcp.json (ENG-5922)").option("--strict", "Exit with code 2 if any findings (suitable for CI gating)").option("--json", "Emit findings as JSON to stdout").action(auditMcpRenderCommand);
 var skipUpdateCheck = process.argv.includes("--skip-update-check") || process.argv.includes("--json") || process.argv[2] === "update";
 if (!skipUpdateCheck) {
   checkForUpdateOnStartup().catch(() => {