@integrity-labs/agt-cli 0.28.1031 → 0.28.1033

package/dist/{claude-pair-runtime-NBF54YQD.js → claude-pair-runtime-Y35IP7YV.js}

@@ -266,7 +266,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-AMUXFQKY.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-AZQGN35Q.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -734,4 +734,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-NBF54YQD.js.map
+//# sourceMappingURL=claude-pair-runtime-Y35IP7YV.js.map

package/dist/lib/manager-worker.js

@@ -66,7 +66,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-HQSQLPHD.js";
+} from "../chunk-OOTJBM4Z.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -149,7 +149,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-XD5GMJGJ.js";
+} from "../chunk-X2YAGXVQ.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -254,7 +254,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-TFFXAGBJ.js";
+} from "../chunk-XP4TNPGF.js";
 import {
   classifyUnanswerablePane,
   paneRemedy
@@ -13927,7 +13927,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-73AXZT6D.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-GPKEUHXN.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14673,7 +14673,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1031" : "dev";
+var agtCliVersion = true ? "0.28.1033" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16308,7 +16308,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-AMUXFQKY.js");
+      const { collectDiagnostics } = await import("../persistent-session-AZQGN35Q.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -16450,7 +16450,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-AMUXFQKY.js");
+      const { collectDiagnostics } = await import("../persistent-session-AZQGN35Q.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -16626,7 +16626,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-73AXZT6D.js");
+      } = await import("../responsiveness-probe-GPKEUHXN.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16743,7 +16743,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-73AXZT6D.js");
+        } = await import("../responsiveness-probe-GPKEUHXN.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16899,7 +16899,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-VINCM3ZI.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-NLOUEO37.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -21442,7 +21442,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-73AXZT6D.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-GPKEUHXN.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -21485,7 +21485,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-AMUXFQKY.js");
+        const { collectDiagnostics } = await import("../persistent-session-AZQGN35Q.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -21536,7 +21536,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-AMUXFQKY.js");
+      const { collectDiagnostics } = await import("../persistent-session-AZQGN35Q.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22208,7 +22208,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-NBF54YQD.js");
+  } = await import("../claude-pair-runtime-Y35IP7YV.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -32945,7 +32945,17 @@ var OAUTH_PROVIDERS = {
       // do NOT revert to the broad `accounting.transactions` /
       // `accounting.contacts` scopes, Xero rejects the manifest).
       // The variant *without* `.read` is the read+write granular scope.
-      "accounting.settings.read",
+      // settings: write (CS-1829) enables the xero-broker to create and edit
+      // inventory ITEMS on approval. Xero files the Items endpoint under
+      // accounting.settings (per Xero's own OpenAPI spec, XeroAPI/Xero-OpenAPI
+      // xero_accounting.yaml: PUT/POST /Items require `accounting.settings`,
+      // GET accepts `.read`), and there is no narrower items scope. The same
+      // scope also covers accounts, tax rates and tracking categories; the
+      // vendor server's write tools for those stay stripped in broker mode
+      // (XERO_WRITES_VIA_BROKER), so the broker remains the only write path.
+      // An existing install must RECONNECT for its token to carry this, same as
+      // CS-1439's manualjournals.
+      "accounting.settings",
       // contacts: write enables agent-driven supplier/customer creation
       // (required for bill creation since a bill must reference a contact).
       "accounting.contacts",
@@ -37978,6 +37988,22 @@ var FLAG_REGISTRY = [
     public: true,
     defaultValue: false
   },
+  {
+    key: "ninja-lists",
+    description: 'Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Lists" nav item, the /lists pages AND the /ninja-sheets API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
+    flagType: "boolean",
+    // PUBLIC (ADR-0022 §2): the nav shells read it via usePublicBooleanFlag and
+    // the pages via getPublicBooleanFlagServer, so it is serialized to the
+    // client via GET /flags. The API evaluates it through getFlagClient() and
+    // fails CLOSED on a read error. No env override (UI rollout, not an
+    // operator gate). Ships dark (default false).
+    public: true,
+    defaultValue: false,
+    // Until ADR-0120's access control exists, any member of an enabled org
+    // reads every list in it, so an org admin must not be able to switch this
+    // on for their own org. Only a platform admin can (PR #6522 review).
+    platformAdminOnly: true
+  },
   {
     key: "platform-maintenance-mode",
     description: 'Platform-wide maintenance mode (ENG-6506): when on, every agent across every team/org auto-replies to admitted human inbound with a "we are offline for maintenance" notice instead of dispatching to the agent \u2014 for whole-platform downtime such as DB upgrades. Read host-side per inbound from the flags cache (no MCP restart). Boolean gate; ships dark \u2014 when off, channels behave exactly as today. (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',

package/dist/mcp/index.js

@@ -25527,7 +25527,17 @@ var OAUTH_PROVIDERS = {
       // do NOT revert to the broad `accounting.transactions` /
       // `accounting.contacts` scopes, Xero rejects the manifest).
       // The variant *without* `.read` is the read+write granular scope.
-      "accounting.settings.read",
+      // settings: write (CS-1829) enables the xero-broker to create and edit
+      // inventory ITEMS on approval. Xero files the Items endpoint under
+      // accounting.settings (per Xero's own OpenAPI spec, XeroAPI/Xero-OpenAPI
+      // xero_accounting.yaml: PUT/POST /Items require `accounting.settings`,
+      // GET accepts `.read`), and there is no narrower items scope. The same
+      // scope also covers accounts, tax rates and tracking categories; the
+      // vendor server's write tools for those stay stripped in broker mode
+      // (XERO_WRITES_VIA_BROKER), so the broker remains the only write path.
+      // An existing install must RECONNECT for its token to carry this, same as
+      // CS-1439's manualjournals.
+      "accounting.settings",
       // contacts: write enables agent-driven supplier/customer creation
       // (required for bill creation since a bill must reference a contact).
       "accounting.contacts",
@@ -30275,6 +30285,22 @@ var FLAG_REGISTRY = [
     public: true,
     defaultValue: false
   },
+  {
+    key: "ninja-lists",
+    description: 'Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Lists" nav item, the /lists pages AND the /ninja-sheets API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
+    flagType: "boolean",
+    // PUBLIC (ADR-0022 §2): the nav shells read it via usePublicBooleanFlag and
+    // the pages via getPublicBooleanFlagServer, so it is serialized to the
+    // client via GET /flags. The API evaluates it through getFlagClient() and
+    // fails CLOSED on a read error. No env override (UI rollout, not an
+    // operator gate). Ships dark (default false).
+    public: true,
+    defaultValue: false,
+    // Until ADR-0120's access control exists, any member of an enabled org
+    // reads every list in it, so an org admin must not be able to switch this
+    // on for their own org. Only a platform admin can (PR #6522 review).
+    platformAdminOnly: true
+  },
   {
     key: "platform-maintenance-mode",
     description: 'Platform-wide maintenance mode (ENG-6506): when on, every agent across every team/org auto-replies to admitted human inbound with a "we are offline for maintenance" notice instead of dispatching to the agent \u2014 for whole-platform downtime such as DB upgrades. Read host-side per inbound from the flags cache (no MCP restart). Boolean gate; ships dark \u2014 when off, channels behave exactly as today. (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',

package/dist/mcp/origami.js

@@ -39678,7 +39678,17 @@ var OAUTH_PROVIDERS = {
       // do NOT revert to the broad `accounting.transactions` /
       // `accounting.contacts` scopes, Xero rejects the manifest).
       // The variant *without* `.read` is the read+write granular scope.
-      "accounting.settings.read",
+      // settings: write (CS-1829) enables the xero-broker to create and edit
+      // inventory ITEMS on approval. Xero files the Items endpoint under
+      // accounting.settings (per Xero's own OpenAPI spec, XeroAPI/Xero-OpenAPI
+      // xero_accounting.yaml: PUT/POST /Items require `accounting.settings`,
+      // GET accepts `.read`), and there is no narrower items scope. The same
+      // scope also covers accounts, tax rates and tracking categories; the
+      // vendor server's write tools for those stay stripped in broker mode
+      // (XERO_WRITES_VIA_BROKER), so the broker remains the only write path.
+      // An existing install must RECONNECT for its token to carry this, same as
+      // CS-1439's manualjournals.
+      "accounting.settings",
       // contacts: write enables agent-driven supplier/customer creation
       // (required for bill creation since a bill must reference a contact).
       "accounting.contacts",
@@ -44223,6 +44233,22 @@ var FLAG_REGISTRY = [
     public: true,
     defaultValue: false
   },
+  {
+    key: "ninja-lists",
+    description: 'Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Lists" nav item, the /lists pages AND the /ninja-sheets API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
+    flagType: "boolean",
+    // PUBLIC (ADR-0022 §2): the nav shells read it via usePublicBooleanFlag and
+    // the pages via getPublicBooleanFlagServer, so it is serialized to the
+    // client via GET /flags. The API evaluates it through getFlagClient() and
+    // fails CLOSED on a read error. No env override (UI rollout, not an
+    // operator gate). Ships dark (default false).
+    public: true,
+    defaultValue: false,
+    // Until ADR-0120's access control exists, any member of an enabled org
+    // reads every list in it, so an org admin must not be able to switch this
+    // on for their own org. Only a platform admin can (PR #6522 review).
+    platformAdminOnly: true
+  },
   {
     key: "platform-maintenance-mode",
     description: 'Platform-wide maintenance mode (ENG-6506): when on, every agent across every team/org auto-replies to admitted human inbound with a "we are offline for maintenance" notice instead of dispatching to the agent \u2014 for whole-platform downtime such as DB upgrades. Read host-side per inbound from the flags cache (no MCP restart). Boolean gate; ships dark \u2014 when off, channels behave exactly as today. (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',

package/dist/mcp/slack-channel.js

@@ -33895,7 +33895,17 @@ var OAUTH_PROVIDERS = {
       // do NOT revert to the broad `accounting.transactions` /
       // `accounting.contacts` scopes, Xero rejects the manifest).
       // The variant *without* `.read` is the read+write granular scope.
-      "accounting.settings.read",
+      // settings: write (CS-1829) enables the xero-broker to create and edit
+      // inventory ITEMS on approval. Xero files the Items endpoint under
+      // accounting.settings (per Xero's own OpenAPI spec, XeroAPI/Xero-OpenAPI
+      // xero_accounting.yaml: PUT/POST /Items require `accounting.settings`,
+      // GET accepts `.read`), and there is no narrower items scope. The same
+      // scope also covers accounts, tax rates and tracking categories; the
+      // vendor server's write tools for those stay stripped in broker mode
+      // (XERO_WRITES_VIA_BROKER), so the broker remains the only write path.
+      // An existing install must RECONNECT for its token to carry this, same as
+      // CS-1439's manualjournals.
+      "accounting.settings",
       // contacts: write enables agent-driven supplier/customer creation
       // (required for bill creation since a bill must reference a contact).
       "accounting.contacts",
@@ -38862,6 +38872,22 @@ var FLAG_REGISTRY = [
     public: true,
     defaultValue: false
   },
+  {
+    key: "ninja-lists",
+    description: 'Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Lists" nav item, the /lists pages AND the /ninja-sheets API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
+    flagType: "boolean",
+    // PUBLIC (ADR-0022 §2): the nav shells read it via usePublicBooleanFlag and
+    // the pages via getPublicBooleanFlagServer, so it is serialized to the
+    // client via GET /flags. The API evaluates it through getFlagClient() and
+    // fails CLOSED on a read error. No env override (UI rollout, not an
+    // operator gate). Ships dark (default false).
+    public: true,
+    defaultValue: false,
+    // Until ADR-0120's access control exists, any member of an enabled org
+    // reads every list in it, so an org admin must not be able to switch this
+    // on for their own org. Only a platform admin can (PR #6522 review).
+    platformAdminOnly: true
+  },
   {
     key: "platform-maintenance-mode",
     description: 'Platform-wide maintenance mode (ENG-6506): when on, every agent across every team/org auto-replies to admitted human inbound with a "we are offline for maintenance" notice instead of dispatching to the agent \u2014 for whole-platform downtime such as DB upgrades. Read host-side per inbound from the flags cache (no MCP restart). Boolean gate; ships dark \u2014 when off, channels behave exactly as today. (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',

package/dist/mcp/telegram-channel.js

@@ -34007,7 +34007,17 @@ var OAUTH_PROVIDERS = {
       // do NOT revert to the broad `accounting.transactions` /
       // `accounting.contacts` scopes, Xero rejects the manifest).
       // The variant *without* `.read` is the read+write granular scope.
-      "accounting.settings.read",
+      // settings: write (CS-1829) enables the xero-broker to create and edit
+      // inventory ITEMS on approval. Xero files the Items endpoint under
+      // accounting.settings (per Xero's own OpenAPI spec, XeroAPI/Xero-OpenAPI
+      // xero_accounting.yaml: PUT/POST /Items require `accounting.settings`,
+      // GET accepts `.read`), and there is no narrower items scope. The same
+      // scope also covers accounts, tax rates and tracking categories; the
+      // vendor server's write tools for those stay stripped in broker mode
+      // (XERO_WRITES_VIA_BROKER), so the broker remains the only write path.
+      // An existing install must RECONNECT for its token to carry this, same as
+      // CS-1439's manualjournals.
+      "accounting.settings",
       // contacts: write enables agent-driven supplier/customer creation
       // (required for bill creation since a bill must reference a contact).
       "accounting.contacts",
@@ -38968,6 +38978,22 @@ var FLAG_REGISTRY = [
     public: true,
     defaultValue: false
   },
+  {
+    key: "ninja-lists",
+    description: 'Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Lists" nav item, the /lists pages AND the /ninja-sheets API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
+    flagType: "boolean",
+    // PUBLIC (ADR-0022 §2): the nav shells read it via usePublicBooleanFlag and
+    // the pages via getPublicBooleanFlagServer, so it is serialized to the
+    // client via GET /flags. The API evaluates it through getFlagClient() and
+    // fails CLOSED on a read error. No env override (UI rollout, not an
+    // operator gate). Ships dark (default false).
+    public: true,
+    defaultValue: false,
+    // Until ADR-0120's access control exists, any member of an enabled org
+    // reads every list in it, so an org admin must not be able to switch this
+    // on for their own org. Only a platform admin can (PR #6522 review).
+    platformAdminOnly: true
+  },
   {
     key: "platform-maintenance-mode",
     description: 'Platform-wide maintenance mode (ENG-6506): when on, every agent across every team/org auto-replies to admitted human inbound with a "we are offline for maintenance" notice instead of dispatching to the agent \u2014 for whole-platform downtime such as DB upgrades. Read host-side per inbound from the flags cache (no MCP restart). Boolean gate; ships dark \u2014 when off, channels behave exactly as today. (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',

package/dist/mcp/xero.js

@@ -117492,7 +117492,8 @@ var ListInvoicesTool = CreateXeroTool(
 var list_invoices_tool_default = ListInvoicesTool;
 
 // src/handlers/list-xero-items.handler.ts
-async function getItems(page) {
+var UNIT_DECIMAL_PLACES = 4;
+async function getItems() {
   await xeroClient.authenticate();
   const items = await xeroClient.accountingApi.getItems(
     xeroClient.tenantId,
@@ -117502,15 +117503,15 @@ async function getItems(page) {
     // where
     void 0,
     // order
-    page,
-    // page
+    UNIT_DECIMAL_PLACES,
+    // unitdp - NOT a page number; this endpoint does not paginate
     getClientHeaders()
   );
   return items.body.items ?? [];
 }
-async function listXeroItems(page = 1) {
+async function listXeroItems() {
   try {
-    const items = await getItems(page);
+    const items = await getItems();
     return {
       result: items,
       isError: false,
@@ -117528,12 +117529,14 @@ async function listXeroItems(page = 1) {
 // src/tools/list/list-items.tool.ts
 var ListItemsTool = CreateXeroTool(
   "list-items",
-  "Lists all items in Xero. Use this tool to get the item codes and descriptions to be used when creating invoices in Xero",
+  "Lists every item in the Xero catalogue in ONE call (Xero does not paginate items, so there is no page to request). Use it to get the item codes, descriptions and prices to use on invoice and bill lines. For items tracked as inventory it also returns Quantity On Hand and Total Cost Pool, so check Quantity On Hand before invoicing a tracked item. Note: Xero's API does not expose whether an item is archived, so an archived item can still appear here.",
   {
-    page: external_exports.number()
+    // Kept, and optional, so an agent that still sends `page` is not refused by
+    // the schema. It is IGNORED: Xero returns the whole catalogue regardless.
+    page: external_exports.number().optional().describe("Ignored. Xero returns the whole item catalogue in one response; there are no pages.")
   },
-  async ({ page }) => {
-    const response = await listXeroItems(page);
+  async () => {
+    const response = await listXeroItems();
     if (response.isError) {
       return {
         content: [
@@ -117564,6 +117567,14 @@ var ListItemsTool = CreateXeroTool(
             item.salesDetails?.accountCode ? `Sales Account: ${item.salesDetails.accountCode}` : null,
             item.purchaseDetails?.accountCode ? `Purchase Account: ${item.purchaseDetails.accountCode}` : null,
             item.isTrackedAsInventory !== void 0 ? `Tracked as Inventory: ${item.isTrackedAsInventory ? "Yes" : "No"}` : null,
+            // CS-1829: stock is only meaningful on a tracked item. Xero reports
+            // 0 rather than omitting the field on an untracked one, and
+            // "Quantity On Hand: 0" beside a service item reads as "out of
+            // stock", which is a different and wrong claim.
+            item.isTrackedAsInventory && item.quantityOnHand !== void 0 ? `Quantity On Hand: ${item.quantityOnHand}` : null,
+            item.isTrackedAsInventory && item.totalCostPool !== void 0 ? `Total Cost Pool: ${item.totalCostPool}` : null,
+            item.isTrackedAsInventory && item.inventoryAssetAccountCode ? `Inventory Asset Account: ${item.inventoryAssetAccountCode}` : null,
+            item.purchaseDetails?.cOGSAccountCode ? `COGS Account: ${item.purchaseDetails.cOGSAccountCode}` : null,
             item.isSold !== void 0 ? `Is Sold: ${item.isSold ? "Yes" : "No"}` : null,
             item.isPurchased !== void 0 ? `Is Purchased: ${item.isPurchased ? "Yes" : "No"}` : null,
             item.updatedDateUTC ? `Last Updated: ${item.updatedDateUTC}` : null,

package/dist/{persistent-session-AMUXFQKY.js → persistent-session-AZQGN35Q.js}

@@ -65,8 +65,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-XD5GMJGJ.js";
-import "./chunk-TFFXAGBJ.js";
+} from "./chunk-X2YAGXVQ.js";
+import "./chunk-XP4TNPGF.js";
 import "./chunk-TQDIIS3X.js";
 import "./chunk-XWVM4KPK.js";
 import "./chunk-EL5MWGGH.js";
@@ -139,4 +139,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-AMUXFQKY.js.map
+//# sourceMappingURL=persistent-session-AZQGN35Q.js.map

package/dist/{responsiveness-probe-73AXZT6D.js → responsiveness-probe-GPKEUHXN.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-XD5GMJGJ.js";
-import "./chunk-TFFXAGBJ.js";
+} from "./chunk-X2YAGXVQ.js";
+import "./chunk-XP4TNPGF.js";
 import "./chunk-TQDIIS3X.js";
 import "./chunk-XWVM4KPK.js";
 import "./chunk-EL5MWGGH.js";
@@ -802,4 +802,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-73AXZT6D.js.map
+//# sourceMappingURL=responsiveness-probe-GPKEUHXN.js.map

package/dist/{session-auth-dead-VINCM3ZI.js → session-auth-dead-NLOUEO37.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-TFFXAGBJ.js";
+} from "./chunk-XP4TNPGF.js";
 import "./chunk-DGUM43GV.js";
 
 // src/lib/session-auth-dead.ts
@@ -204,4 +204,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-VINCM3ZI.js.map
+//# sourceMappingURL=session-auth-dead-NLOUEO37.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.1031",
+  "version": "0.28.1033",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {