@integrity-labs/agt-cli 0.28.237 → 0.28.239

package/dist/{chunk-DN4HSL6M.js → chunk-O3MVFYYC.js}

@@ -18,7 +18,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-PYVEJMY2.js";
+} from "./chunk-GO4VMK2P.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -2804,6 +2804,15 @@ function provisionStopHook(codeName) {
     "# recovery-outbox. OFF (default / unset) \u21D2 exactly today's behavior.",
     "BLOCK_TURN_END_ON=0",
     'case "${AGT_CHANNEL_BLOCK_TURN_END_ENABLED:-}" in true|1|TRUE|True) BLOCK_TURN_END_ON=1;; esac',
+    "# WS3 (ENG-7397): block-turn-end-all-markers. When ON (and channel-block-turn-end",
+    "# is also ON), the block scan covers EVERY pending marker across all sources, not",
+    "# just the last-tagged conversation, so an agent that owes replies to several",
+    "# threads at once is blocked until it answers all of them (with WS2 it answers",
+    "# each by inbound_id). Registry flag block-turn-end-all-markers; the env var is",
+    "# the operator/canary override the bash reads directly. OFF (default) leaves the",
+    "# single-marker last-tag behavior exactly as-is.",
+    "BLOCK_ALL_MARKERS_ON=0",
+    'case "${AGT_BLOCK_TURN_END_ALL_MARKERS_ENABLED:-}" in true|1|TRUE|True) BLOCK_ALL_MARKERS_ON=1;; esac',
     `STOP_ACTIVE=$(echo "$INPUT" | jq -r '.stop_hook_active // false' 2>/dev/null || echo false)`,
     'BLOCK_LEDGER_DIR="${AGENT_DIR}/.agt-block-turn-end-ledger"',
     "# GC stale ledger entries (>1 day) so the per-marker cap dir cannot grow unbounded.",
@@ -2852,11 +2861,76 @@ function provisionStopHook(codeName) {
     `  jq -cn --arg r "$reason" '{decision:"block", reason:$r}'`,
     "  return 0",
     "}",
+    "# WS3 (ENG-7397): the multi-marker generalization of emit_block_if_obligated.",
+    "# Enumerates EVERY pending marker across all three source dirs, drops the",
+    "# discretionary/undeliverable ones (same fail-safe defaults) and the ones already",
+    "# answered THIS turn (per-marker replied_this_conv_* on the marker's own coords),",
+    "# and - when 1+ obligated-and-unanswered markers survive and NONE was already",
+    "# blocked once - writes a ledger entry for each and emits ONE block enumerating",
+    "# every owed conversation by inbound_id + source + safe key (never content).",
+    "# Marker-semantics-neutral: arms/clears no markers, only decides WHEN to block.",
+    "# Returns 0 (after printing the block JSON) when it blocked; 1 otherwise.",
+    "emit_block_all_obligated() {",
+    '  if [ "$BLOCK_TURN_END_ON" != "1" ] || [ "$BLOCK_ALL_MARKERS_ON" != "1" ]; then return 1; fi',
+    '  if [ "$STOP_ACTIVE" = "true" ]; then return 1; fi',
+    "  local -a owed_paths=()",
+    '  local owed_lines="" owed_count=0 any_capped=0 entry src dir m d u replied ch th cid conv iid key led_name',
+    '  for entry in "slack:$SL_MARKER_DIR" "telegram:$TG_MARKER_DIR" "msteams:$MS_MARKER_DIR"; do',
+    '    src="${entry%%:*}"; dir="${entry#*:}"',
+    '    if [ ! -d "$dir" ]; then continue; fi',
+    "    shopt -s nullglob",
+    '    for m in "$dir"/*.json; do',
+    '      if [ ! -f "$m" ]; then continue; fi',
+    `      d=$(jq -r '.discretionary // false' "$m" 2>/dev/null || echo true)`,
+    `      u=$(jq -r '.undeliverable // false' "$m" 2>/dev/null || echo true)`,
+    '      if [ "$d" = "true" ] || [ "$u" = "true" ]; then continue; fi',
+    '      replied=no; ch=""; th=""; cid=""; conv=""',
+    '      case "$src" in',
+    `        slack) ch=$(jq -r '.channel // ""' "$m" 2>/dev/null || echo ""); th=$(jq -r '.thread_ts // ""' "$m" 2>/dev/null || echo ""); if replied_this_conv_slack "$ch" "$th"; then replied=yes; fi ;;`,
+    `        telegram) cid=$(jq -r '.chat_id // ""' "$m" 2>/dev/null || echo ""); if replied_this_conv_telegram "$cid"; then replied=yes; fi ;;`,
+    `        msteams) conv=$(jq -r '.conversation_id // ""' "$m" 2>/dev/null || echo ""); if replied_this_conv_teams "$conv"; then replied=yes; fi ;;`,
+    "      esac",
+    '      if [ "$replied" = "yes" ]; then continue; fi',
+    '      led_name="$(basename "$m")"',
+    '      if [ -f "${BLOCK_LEDGER_DIR}/${led_name}" ]; then any_capped=1; fi',
+    `      iid=$(jq -r '.inbound_id // ""' "$m" 2>/dev/null || echo "")`,
+    '      case "$src" in',
+    '        slack) key="thread=$(safe_id "$th")" ;;',
+    '        telegram) key="chat=$(safe_id "$cid")" ;;',
+    '        msteams) key="conv=$(safe_id "$conv")" ;;',
+    '        *) key="" ;;',
+    "      esac",
+    "      owed_count=$((owed_count + 1))",
+    '      if [ -n "$iid" ]; then owed_lines="${owed_lines}${owed_count}) source=${src} inbound_id=${iid} ${key}; "; else owed_lines="${owed_lines}${owed_count}) source=${src} ${key}; "; fi',
+    '      owed_paths+=("$m")',
+    "    done",
+    "  done",
+    '  if [ "$owed_count" = "0" ]; then return 1; fi',
+    "  # Block only when NONE of the owed markers was already blocked once - a capped",
+    "  # marker means the model already ignored a block for it, so fall through to the",
+    "  # per-source recovery instead of re-blocking.",
+    '  if [ "$any_capped" = "1" ]; then echo "agt-ghost-reply-hook: block-turn-end-all degraded (an owed marker already blocked) - falling through to recovery" >&2; return 1; fi',
+    '  if ! mkdir -p "$BLOCK_LEDGER_DIR" 2>/dev/null; then echo "agt-ghost-reply-hook: block-turn-end-all degraded (ledger dir create failed) - falling through" >&2; return 1; fi',
+    "  local p",
+    '  for p in "${owed_paths[@]}"; do',
+    '    if ! : > "${BLOCK_LEDGER_DIR}/$(basename "$p")" 2>/dev/null; then echo "agt-ghost-reply-hook: block-turn-end-all degraded (ledger write failed) - falling through" >&2; return 1; fi',
+    "  done",
+    '  echo "agt-ghost-reply-hook: block-turn-end-all FIRED count=${owed_count}" >&2',
+    '  local reason="You have ${owed_count} conversation(s) you did not answer this turn; the people are waiting and will see only silence. Reply to EACH now with its reply tool, passing its inbound_id so your answer lands in the right thread (never answer one conversation in a different thread). Owed: ${owed_lines}Actually send each answer via the tool; do not just summarize what you intended to say."',
+    `  jq -cn --arg r "$reason" '{decision:"block", reason:$r}'`,
+    "  return 0",
+    "}",
     "# Strict correlation: only recover if the last channel tag in the",
     "# transcript points at a channel/key that has an exact-match pending",
     "# marker. No tag found \u2192 skip; let timeout handle it. Block-turn-end (when",
     "# armed) runs FIRST per source; if it blocks we exit before recovery so the",
     "# two mechanisms never both fire on one Stop.",
+    "# WS3: when block-turn-end-all-markers is armed, try the multi-marker block",
+    "# FIRST - it covers every owed conversation, not just the last tag. It self-gates",
+    "# on both flags (returns 1 when off), so this call is a no-op unless armed. If it",
+    "# blocks we exit; otherwise fall through to the per-source single-marker path,",
+    "# which still handles the last-tagged conversation.",
+    "if emit_block_all_obligated; then exit 0; fi",
     'if [ "$TAG_SOURCE" = "telegram" ]; then',
     '  CHAT_ID=$(extract_attr "$CHANNEL_TAG" "chat_id")',
     '  MSG_ID=$(extract_attr "$CHANNEL_TAG" "message_id")',
@@ -4129,6 +4203,21 @@ function buildMcpJson(input) {
       }
     };
   }
+  const origamiIntegration = input.integrations?.find((i) => i.definition_id === "origami");
+  if (origamiIntegration?.stdioMcp === true && origamiIntegration.id) {
+    const localOrigamiMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "origami.js");
+    mcpServers["origami"] = {
+      command: "node",
+      args: [localOrigamiMcpPath],
+      env: {
+        AGT_HOST: "${AGT_HOST}",
+        AGT_TOKEN: "${AGT_TOKEN}",
+        AGT_API_KEY: "${AGT_API_KEY}",
+        AGT_AGENT_ID: input.agent.agent_id,
+        AGT_INTEGRATION_ID: origamiIntegration.id
+      }
+    };
+  }
   return { mcpServers };
 }
 function parseIntervalMinutes(scheduleEvery) {
@@ -5268,6 +5357,23 @@ ${sections}`
         }
       });
     }
+    const origamiStdio = integrations.find((i) => i.definition_id === "origami");
+    const origamiStdioAgentId = resolveBrokerAgentId(codeName) ?? agentId;
+    const origamiStdioExpected = Boolean(origamiStdio?.stdioMcp === true && origamiStdio.id);
+    if (origamiStdioExpected && origamiStdioAgentId) {
+      const localOrigamiMcpPath = join2(getHomeDir(), ".augmented", "_mcp", "origami.js");
+      this.writeMcpServer(codeName, "origami", {
+        command: "node",
+        args: [localOrigamiMcpPath],
+        env: {
+          AGT_HOST: "${AGT_HOST}",
+          AGT_TOKEN: "${AGT_TOKEN}",
+          AGT_API_KEY: "${AGT_API_KEY}",
+          AGT_AGENT_ID: origamiStdioAgentId,
+          AGT_INTEGRATION_ID: origamiStdio.id
+        }
+      });
+    }
     if (this.removeMcpServer) {
       const nativeMcpKeys = INTEGRATION_REGISTRY.filter((d) => d.nativeMcp !== void 0).map((d) => d.nativeMcp.key ?? d.id);
       const integrationDerivedKeys = /* @__PURE__ */ new Set([
@@ -5277,6 +5383,10 @@ ${sections}`
         "xero-broker",
         "augmented-admin",
         "augmented-support",
+        // ENG-7358: the dedicated origami stdio server. In the universe so
+        // that removing the integration OR flipping the catalog stdio_mcp
+        // flag back (rollback) prunes the entry symmetrically.
+        "origami",
         ...nativeMcpKeys,
         ...Object.entries(OAUTH_PROVIDERS).filter(([, provider]) => Boolean(provider.mcpUrl)).map(([id]) => id)
       ]);
@@ -5293,6 +5403,8 @@ ${sections}`
         expectedKeys.add("augmented-admin");
       if (hasSupport)
         expectedKeys.add("augmented-support");
+      if (origamiStdioExpected)
+        expectedKeys.add("origami");
       for (const integration of integrations) {
         const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
         if (def?.nativeMcp) {
@@ -5720,7 +5832,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.237" : "dev";
+var agtCliVersion = true ? "0.28.239" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -6674,11 +6786,130 @@ function reapMissingMcpSessions(args) {
 import { join as join5 } from "path";
 import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
 
+// src/lib/mcp-stdio-probe.ts
+import { spawn } from "child_process";
+var DEFAULT_TIMEOUT_MS = 15e3;
+async function probeMcpStdio(config) {
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const child = spawn(config.command, config.args ?? [], {
+    // Faithful reproduction of the real spawn: the child inherits the manager's
+    // process env (PATH/HOME so `node`/`npx` resolve) with the entry's env
+    // overlaid, exactly as Claude Code spawns it.
+    env: { ...process.env, ...config.env ?? {} },
+    cwd: config.cwd,
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  let stdout = "";
+  let stderrTail = "";
+  const pending = /* @__PURE__ */ new Map();
+  return await new Promise((resolve) => {
+    let done = false;
+    const finish = (outcome) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      child.stdout.removeAllListeners();
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      resolve(outcome);
+    };
+    const timer = setTimeout(() => {
+      finish({ status: "transient_error", message: `MCP stdio handshake timed out after ${timeoutMs / 1e3}s` });
+    }, timeoutMs);
+    if (typeof timer.unref === "function") timer.unref();
+    child.on("error", (err) => {
+      finish({ status: "down", message: `MCP server failed to spawn: ${err.message}` });
+    });
+    child.on("exit", (code) => {
+      if (!done) {
+        finish({
+          status: "down",
+          message: `MCP server exited (code ${code ?? "null"})${stderrTail ? `: ${stderrTail.trim().slice(-200)}` : ""}`
+        });
+      }
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stderr.on("data", (d) => {
+      stderrTail = (stderrTail + d.toString()).slice(-500);
+    });
+    child.stdout.on("data", (d) => {
+      stdout += d.toString();
+      let nl;
+      while ((nl = stdout.indexOf("\n")) >= 0) {
+        const line = stdout.slice(0, nl).trim();
+        stdout = stdout.slice(nl + 1);
+        if (!line) continue;
+        let msg = null;
+        try {
+          msg = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        if (msg && typeof msg.id === "number" && pending.has(msg.id)) {
+          const cb = pending.get(msg.id);
+          pending.delete(msg.id);
+          cb(msg);
+        }
+      }
+    });
+    const send = (msg) => child.stdin.write(`${JSON.stringify(msg)}
+`);
+    const request = (id, method, params) => new Promise((res) => {
+      pending.set(id, res);
+      send({ jsonrpc: "2.0", id, method, ...params ? { params } : {} });
+    });
+    void (async () => {
+      const init = await request(1, "initialize", {
+        protocolVersion: "2025-03-26",
+        capabilities: {},
+        clientInfo: { name: "augmented-connectivity-probe", version: "1.0.0" }
+      });
+      if (done) return;
+      if (init.error) return finish({ status: "down", message: `MCP initialize error: ${init.error.message ?? "unknown"}` });
+      send({ jsonrpc: "2.0", method: "notifications/initialized" });
+      const list = await request(2, "tools/list");
+      if (done) return;
+      if (list.error) return finish({ status: "down", message: `MCP tools/list error: ${list.error.message ?? "unknown"}` });
+      const toolCount = Array.isArray(list.result?.tools) ? list.result.tools.length : void 0;
+      const testTool = config.connectivityTest?.tool;
+      if (testTool) {
+        const rawArgs = config.connectivityTest?.args;
+        if (Array.isArray(rawArgs)) {
+          return finish({
+            status: "down",
+            message: `connectivity_test.args for ${testTool} must be an object (got a string[])`
+          });
+        }
+        const toolArgs = rawArgs ?? {};
+        const call = await request(3, "tools/call", { name: testTool, arguments: toolArgs });
+        if (done) return;
+        if (call.error) return finish({ status: "down", message: `MCP tools/call ${testTool} error: ${call.error.message ?? "unknown"}` });
+        if (call.result?.isError === true) {
+          return finish({ status: "down", message: `MCP tool ${testTool} returned an error result` });
+        }
+        return finish({
+          status: "ok",
+          message: `${testTool} succeeded`,
+          details: { ...toolCount !== void 0 ? { toolCount } : {}, testTool }
+        });
+      }
+      finish({
+        status: "ok",
+        message: toolCount !== void 0 ? `${toolCount} tools` : "reachable",
+        ...toolCount !== void 0 ? { details: { toolCount } } : {}
+      });
+    })();
+  });
+}
+
 // src/lib/cli-probe.ts
 import { execFile as execFile2 } from "child_process";
-var DEFAULT_TIMEOUT_MS = 8e3;
+var DEFAULT_TIMEOUT_MS2 = 8e3;
 function runCliProbe(binary, args, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
   return new Promise((resolve) => {
     execFile2(
       binary,
@@ -6740,6 +6971,31 @@ function readMcpHttpServerConfig(projectDir, serverKey, env) {
     return null;
   }
 }
+function readMcpStdioServerConfig(projectDir, serverKey, env) {
+  try {
+    const raw = readFileSync6(join5(projectDir, ".mcp.json"), "utf-8");
+    const servers = JSON.parse(raw).mcpServers ?? {};
+    const entry = servers[serverKey];
+    if (!entry || typeof entry.command !== "string") return null;
+    const unresolved = /* @__PURE__ */ new Set();
+    const sub = (value) => {
+      if (!env) return value;
+      const r = expandTemplateVars(value, env);
+      for (const name of r.unresolved) unresolved.add(name);
+      return r.value;
+    };
+    const resolvedEnv = {};
+    for (const [k, v] of Object.entries(entry.env ?? {})) resolvedEnv[k] = sub(v);
+    return {
+      command: entry.command,
+      args: (entry.args ?? []).map(sub),
+      env: resolvedEnv,
+      unresolved: [...unresolved]
+    };
+  } catch {
+    return null;
+  }
+}
 function deriveMcpServerKey(input) {
   const kind = resolveConnectivityProbe({
     definitionId: input.definitionId,
@@ -6778,6 +7034,31 @@ function buildConnectivityProbeDeps(projectDir, probeEnv) {
       }
       return probeMcpHttp(cfg);
     },
+    // ENG-7405: local-STDIO MCP probe. Spawns the toolkit's bundled server with
+    // the agent's env (the exact command/args/env from `.mcp.json`), handshakes,
+    // and calls the read-only `connectivity_test` tool when the descriptor set
+    // one (threaded via target.toolName). An unresolvable `${VAR}` in the spawn
+    // env → skip as non-escalating, never spawn a doomed server. A missing
+    // server entry is a real `down` — the tools aren't wired.
+    mcpStdioProbe: async (target) => {
+      const cfg = readMcpStdioServerConfig(projectDir, target.serverKey, probeEnv);
+      if (!cfg) {
+        return { status: "down", message: `MCP stdio server '${target.serverKey}' not wired in .mcp.json` };
+      }
+      if (cfg.unresolved.length > 0) {
+        return {
+          status: "transient_error",
+          message: `MCP stdio '${target.serverKey}' env unresolved: ${cfg.unresolved.join(", ")}`
+        };
+      }
+      return probeMcpStdio({
+        command: cfg.command,
+        args: cfg.args,
+        env: cfg.env,
+        cwd: projectDir,
+        connectivityTest: target.toolName ? { tool: target.toolName, args: target.toolArgs ?? null } : null
+      });
+    },
     // ENG-6139: connected-account binding check for managed (Composio) toolkits.
     // The MCP handshake reads green on a dead/mis-bound account, so the managed
     // probe also verifies the account is ACTIVE + bound to the entity the agent
@@ -7073,12 +7354,12 @@ import chalk3 from "chalk";
 import { existsSync as existsSync8, realpathSync } from "fs";
 import { join as join8 } from "path";
 import { homedir as homedir4, userInfo } from "os";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 
 // src/lib/watchdog.ts
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, unlinkSync as unlinkSync3, existsSync as existsSync7, mkdirSync as mkdirSync5, openSync as openSync2, closeSync as closeSync2, chmodSync as chmodSync4 } from "fs";
 import { join as join7 } from "path";
-import { spawn, execFileSync as execFileSync3 } from "child_process";
+import { spawn as spawn2, execFileSync as execFileSync3 } from "child_process";
 var DEFAULT_CONFIG_DIR = join7(process.env["HOME"] ?? "/tmp", ".augmented");
 function getManagerPaths(configDir) {
   return {
@@ -7174,7 +7455,7 @@ function startWatchdog(opts) {
     } catch {
     }
     const intervalSec = String(Math.max(Math.floor(opts.intervalMs / 1e3), 5));
-    const child = spawn(
+    const child = spawn2(
       process.execPath,
       [process.argv[1], "manager", "start", "--interval", intervalSec, "--config-dir", configDir, "--supervise"],
       {
@@ -7375,7 +7656,7 @@ function runSupervisorLoop(intervalSec, configDir) {
   process.on("SIGINT", forwardOrExit("SIGINT"));
   const runOne = () => {
     respawnTimer = null;
-    currentChild = spawn2(
+    currentChild = spawn3(
       process.execPath,
       [process.argv[1], "manager", "start", "--interval", String(intervalSec), "--config-dir", configDir],
       { stdio: "inherit", env: process.env }
@@ -7736,6 +8017,14 @@ async function executeConnectivityProbe(target, deps = {}) {
         serverKey: target.mcpServerKey ?? target.definitionId,
         definitionId: target.definitionId
       });
+    case "mcp_stdio":
+      if (!deps.mcpStdioProbe) return null;
+      return deps.mcpStdioProbe({
+        serverKey: target.mcpServerKey ?? target.definitionId,
+        definitionId: target.definitionId,
+        toolName: descriptor.probeTool ?? null,
+        toolArgs: descriptor.probeArgs ?? null
+      });
     case "cli_command":
       if (!deps.runCli) return null;
       return deps.runCli(target.cliBinary ?? target.definitionId, descriptor.cliArgs ?? ["--version"]);
@@ -7813,4 +8102,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-DN4HSL6M.js.map
+//# sourceMappingURL=chunk-O3MVFYYC.js.map