@integrity-labs/agt-cli 0.28.336 → 0.28.338

package/dist/bin/agt.js

@@ -20,6 +20,7 @@ import {
   getManagerPaths,
   info,
   isJsonMode,
+  isValidPinVersion,
   jsonOutput,
   managerInstallCommand,
   managerInstallSystemUnitCommand,
@@ -28,6 +29,7 @@ import {
   managerStopCommand,
   managerUninstallCommand,
   managerUninstallSystemUnitCommand,
+  normalizePinVersion,
   provision,
   readFlagsCache,
   resolveAllFlags,
@@ -38,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-VIYSMPXD.js";
+} from "../chunk-S2JJ532Q.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -68,7 +70,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-J2WYEOBH.js";
+} from "../chunk-O4V3TMUI.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4827,7 +4829,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.336" : "dev";
+var cliVersion = true ? "0.28.338" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -4939,86 +4941,53 @@ function detectBrewOwner() {
   }
   return null;
 }
-async function updateCommand(opts = {}) {
-  const json = isJsonMode();
-  const spinner = ora16({ text: "Checking for updates\u2026", isSilent: json });
-  spinner.start();
-  const versionInfo = await fetchLatestVersion();
-  if (!versionInfo) {
-    spinner.stop();
-    if (json) {
-      jsonOutput({ ok: false, error: "Could not reach API to check for updates" });
-    } else {
-      warn("Could not reach the API to check for updates. Check AGT_HOST is set and the API is reachable.");
-    }
-    process.exitCode = 1;
-    return;
-  }
-  const updateAvailable = isNewerVersion(cliVersion, versionInfo.latest);
-  if (!updateAvailable) {
-    spinner.stop();
-    if (json) {
-      jsonOutput({ ok: true, current: cliVersion, latest: versionInfo.latest, update_available: false });
-    } else {
-      success(`You're on the latest version (${chalk18.bold(cliVersion)})`);
-    }
-    return;
-  }
-  spinner.stop();
+function reportActiveSessionsBlocked(json, current, target) {
+  const { managerPid, tmuxSessions } = detectActiveSessions();
+  if (!managerPid && tmuxSessions.length === 0) return false;
   if (!json) {
-    info(`Update available: ${chalk18.dim(cliVersion)} \u2192 ${chalk18.bold.green(versionInfo.latest)}`);
-    if (versionInfo.changelog_url) {
-      info(`Changelog: ${versionInfo.changelog_url}`);
-    }
-  }
-  if (!opts.force) {
-    const { managerPid, tmuxSessions } = detectActiveSessions();
-    if (managerPid || tmuxSessions.length > 0) {
-      if (!json) {
-        warn("Active processes detected:");
-        if (managerPid) {
-          console.error(chalk18.yellow(`  \u2022 Manager process running (PID ${managerPid})`));
-        }
-        if (tmuxSessions.length > 0) {
-          console.error(chalk18.yellow(`  \u2022 ${tmuxSessions.length} active agent session(s): ${tmuxSessions.join(", ")}`));
-        }
-        console.error();
-        warn("Updating while the manager is running will leave it on the old version until restarted.");
-        warn("Active agent sessions will continue with stale MCP servers.");
-        console.error();
-        info(`Run ${chalk18.bold("agt update --force")} to update anyway, then restart the manager.`);
-      } else {
-        jsonOutput({
-          ok: false,
-          current: cliVersion,
-          latest: versionInfo.latest,
-          update_available: true,
-          updated: false,
-          blocked: true,
-          manager_running: !!managerPid,
-          active_sessions: tmuxSessions,
-          error: "Active manager or agent sessions detected. Use --force to override."
-        });
-      }
-      process.exitCode = 1;
-      return;
-    }
+    warn("Active processes detected:");
+    if (managerPid) {
+      console.error(chalk18.yellow(`  \u2022 Manager process running (PID ${managerPid})`));
+    }
+    if (tmuxSessions.length > 0) {
+      console.error(chalk18.yellow(`  \u2022 ${tmuxSessions.length} active agent session(s): ${tmuxSessions.join(", ")}`));
+    }
+    console.error();
+    warn("Updating while the manager is running will leave it on the old version until restarted.");
+    warn("Active agent sessions will continue with stale MCP servers.");
+    console.error();
+    info(`Run ${chalk18.bold("agt update --force")} to update anyway, then restart the manager.`);
+  } else {
+    jsonOutput({
+      ok: false,
+      current,
+      latest: target,
+      update_available: true,
+      updated: false,
+      blocked: true,
+      manager_running: !!managerPid,
+      active_sessions: tmuxSessions,
+      error: "Active manager or agent sessions detected. Use --force to override."
+    });
   }
+  return true;
+}
+function runInstall(target, json, current) {
   const updateSpinner = ora16({ text: "Installing update\u2026", isSilent: json });
   updateSpinner.start();
   try {
-    performUpdate(versionInfo.latest);
+    performUpdate(target);
     updateSpinner.stop();
     if (json) {
       jsonOutput({
         ok: true,
-        current: cliVersion,
-        latest: versionInfo.latest,
+        current,
+        latest: target,
         update_available: true,
         updated: true
       });
     } else {
-      success(`Updated to ${chalk18.bold(versionInfo.latest)}`);
+      success(`Updated to ${chalk18.bold(target)}`);
       info(`If you have a running manager, restart it: ${chalk18.bold("agt manager stop && agt manager start")}`);
     }
   } catch (err) {
@@ -5026,8 +4995,8 @@ async function updateCommand(opts = {}) {
     if (json) {
       jsonOutput({
         ok: false,
-        current: cliVersion,
-        latest: versionInfo.latest,
+        current,
+        latest: target,
         update_available: true,
         updated: false,
         error: err.message
@@ -5038,12 +5007,113 @@ async function updateCommand(opts = {}) {
       if (source === "brew") {
         info(`You can manually update with: brew upgrade integrity-labs/tap/agt`);
       } else {
-        info(`You can manually update with: sudo npm install -g @integrity-labs/agt-cli@${versionInfo.latest}`);
+        info(`You can manually update with: sudo npm install -g @integrity-labs/agt-cli@${target}`);
       }
     }
     process.exitCode = 1;
   }
 }
+async function updateCommand(opts = {}) {
+  const json = isJsonMode();
+  const pinned = normalizePinVersion(process.env.AGT_CLI_PIN_VERSION);
+  if (opts.version) {
+    const target = opts.version.trim().replace(/^v/, "");
+    if (!isValidPinVersion(target)) {
+      if (json) {
+        jsonOutput({ ok: false, error: `Invalid --version "${opts.version}" (expected a concrete version like 0.28.330)` });
+      } else {
+        error(`Invalid --version "${opts.version}". Expected a concrete version like 0.28.330.`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+    if (target === cliVersion) {
+      if (json) {
+        jsonOutput({ ok: true, current: cliVersion, latest: target, update_available: false });
+      } else {
+        success(`Already on ${chalk18.bold(cliVersion)}.`);
+      }
+      return;
+    }
+    if (detectInstallSource() === "brew") {
+      if (json) {
+        jsonOutput({
+          ok: false,
+          current: cliVersion,
+          error: "agt update --version is not supported on a Homebrew install (brew upgrades only to the latest formula). Use the npm-global install to pin an exact version."
+        });
+      } else {
+        error("`agt update --version` is not supported on a Homebrew install.");
+        info("Homebrew can only upgrade to the tap's latest formula. Use the npm-global install to pin an exact version.");
+      }
+      process.exitCode = 1;
+      return;
+    }
+    if (!json) {
+      info(`Installing ${chalk18.bold(target)} (was ${chalk18.dim(cliVersion)}).`);
+      if (pinned && pinned !== target) {
+        warn(`This host is pinned to ${pinned} via AGT_CLI_PIN_VERSION; the manager will reconcile back to the pin on its next poll unless you also update the pin.`);
+      }
+    }
+    if (!opts.force && reportActiveSessionsBlocked(json, cliVersion, target)) {
+      process.exitCode = 1;
+      return;
+    }
+    runInstall(target, json, cliVersion);
+    return;
+  }
+  if (pinned && !opts.force) {
+    if (json) {
+      jsonOutput({
+        ok: true,
+        current: cliVersion,
+        pinned,
+        update_available: false,
+        blocked: true,
+        error: "Host is pinned via AGT_CLI_PIN_VERSION. Use `agt update --version <v>` to change it, or `agt update --force` to update to latest."
+      });
+    } else {
+      warn(`This host is pinned to ${chalk18.bold(pinned)} via AGT_CLI_PIN_VERSION.`);
+      info(`To change it deliberately, run ${chalk18.bold("agt update --version <version>")}; to update to latest anyway, run ${chalk18.bold("agt update --force")}.`);
+    }
+    return;
+  }
+  const spinner = ora16({ text: "Checking for updates\u2026", isSilent: json });
+  spinner.start();
+  const versionInfo = await fetchLatestVersion();
+  if (!versionInfo) {
+    spinner.stop();
+    if (json) {
+      jsonOutput({ ok: false, error: "Could not reach API to check for updates" });
+    } else {
+      warn("Could not reach the API to check for updates. Check AGT_HOST is set and the API is reachable.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const updateAvailable = isNewerVersion(cliVersion, versionInfo.latest);
+  if (!updateAvailable) {
+    spinner.stop();
+    if (json) {
+      jsonOutput({ ok: true, current: cliVersion, latest: versionInfo.latest, update_available: false });
+    } else {
+      success(`You're on the latest version (${chalk18.bold(cliVersion)})`);
+    }
+    return;
+  }
+  spinner.stop();
+  if (!json) {
+    info(`Update available: ${chalk18.dim(cliVersion)} \u2192 ${chalk18.bold.green(versionInfo.latest)}`);
+    if (versionInfo.changelog_url) {
+      info(`Changelog: ${versionInfo.changelog_url}`);
+    }
+  }
+  if (!opts.force && reportActiveSessionsBlocked(json, cliVersion, versionInfo.latest)) {
+    process.exitCode = 1;
+    return;
+  }
+  runInstall(versionInfo.latest, json, cliVersion);
+}
 async function checkForUpdateOnStartup() {
   try {
     const versionInfo = await fetchLatestVersion();
@@ -5931,7 +6001,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.336" : "dev";
+var cliVersion2 = true ? "0.28.338" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {
@@ -6065,7 +6135,7 @@ integration.command("requests").description("List pending scope approval request
 integration.command("approve <request-id>").description("Approve a scope request").option("--notes <text>", "Review notes").action(integrationApproveCommand);
 integration.command("deny <request-id>").description("Deny a scope request").option("--reason <text>", "Denial reason").action(integrationDenyCommand);
 integration.command("enrol").description("Enrol an integration with an API key or webhook secret (no OAuth flow)").requiredOption("--def <code-name>", "Integration definition code_name (e.g. resend, xero)").requiredOption("--scope <org|team|agent>", "Install scope").option("--api-key <value>", "API key (sets auth_type=api_key)").option("--access-token <value>", "Bearer access token (sets auth_type=oauth2)").option("--webhook-secret <value>", "Webhook signing secret (sets auth_type=webhook)").option("--display-name <name>", "Override display name (defaults to the definition\u2019s display_name)").option("--agent <code-name>", "Agent code name (required for agent scope)").action(integrationEnrolCommand);
-program.command("update").description("Check for and install CLI updates").option("--force", "Update even if manager or agent sessions are running").action(updateCommand);
+program.command("update").description("Check for and install CLI updates").option("--force", "Update even if manager or agent sessions are running (also overrides a version pin)").option("--version <version>", "Install an exact version (may be a downgrade), bypassing the latest check").action(updateCommand);
 var audit = program.command("audit").description("Operator audits \u2014 sub-agent MCP bindings, etc.");
 audit.command("subagents").description("Find sub-agents whose tools allowlist would block mcp__* calls on dispatch (ENG-5897)").option("--strict", "Exit with code 2 if any findings (suitable for CI gating)").option("--json", "Emit findings as JSON to stdout").action(auditSubagentsCommand);
 audit.command("mcp-render").description("Find managed agents whose subagent .md tools allowlist is stale vs .mcp.json (ENG-5922)").option("--strict", "Exit with code 2 if any findings (suitable for CI gating)").option("--json", "Emit findings as JSON to stdout").action(auditMcpRenderCommand);