@integrity-labs/agt-cli 0.28.471 → 0.28.472

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-SJ7HNXKL.js";
+} from "../chunk-KCU4ZTE4.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4830,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.471" : "dev";
+var cliVersion = true ? "0.28.472" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6002,7 +6002,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.471" : "dev";
+var cliVersion2 = true ? "0.28.472" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-SJ7HNXKL.js → chunk-KCU4ZTE4.js}

@@ -4932,7 +4932,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.471" : "dev";
+var agtCliVersion = true ? "0.28.472" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -7661,4 +7661,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-SJ7HNXKL.js.map
+//# sourceMappingURL=chunk-KCU4ZTE4.js.map

package/dist/lib/manager-worker.js

@@ -44,7 +44,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-SJ7HNXKL.js";
+} from "../chunk-KCU4ZTE4.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -10038,7 +10038,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.471" : "dev";
+var agtCliVersion = true ? "0.28.472" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/remote-oauth-proxy.js

@@ -39,14 +39,27 @@ function parsePreEnableToolsets(raw) {
   }
   return out;
 }
+var ACTIVATION_TOOL = "enable_toolset";
 function buildEnableToolsetRequest(toolset) {
   return JSON.stringify({
     jsonrpc: "2.0",
     id: `agt-preenable-${toolset}`,
     method: "tools/call",
-    params: { name: "enable_toolset", arguments: { name: toolset } }
+    params: { name: ACTIVATION_TOOL, arguments: { name: toolset } }
   });
 }
+function stripActivationTool(tools) {
+  return tools.filter((t) => toolName(t) !== ACTIVATION_TOOL);
+}
+function isManagedActivationCall(method, params) {
+  if (method !== "tools/call") return false;
+  const name = params && typeof params === "object" && typeof params.name === "string" ? params.name : "";
+  return name === ACTIVATION_TOOL;
+}
+function activationRefusalMessage(label2, managed) {
+  const groups = managed.length > 0 ? managed.join(", ") : "none";
+  return `${label2}: toolset activation is managed by this connection, not by the agent. This connection manages these toolsets, and their tools are already in this session's tool list: ${groups}. Calling ${ACTIVATION_TOOL} cannot add a callable tool \u2014 the tool list is fixed for the session, so anything it reported as "newly available" would still answer "No such tool available". Call the tool you need directly; if it is not in your tool list, it is not enabled for this integration.`;
+}
 function buildToolsListRequest() {
   return JSON.stringify({ jsonrpc: "2.0", id: "agt-union-list", method: "tools/list", params: {} });
 }
@@ -250,6 +263,10 @@ function ensureUnionManifest(token) {
   return unionOnce;
 }
 async function forward(line, id, isNotification, method, params) {
+  if (preEnableToolsets.length > 0 && isManagedActivationCall(method, params)) {
+    logErr(`refused agent-issued ${ACTIVATION_TOOL} (activation is proxy-managed)`);
+    return isNotification ? [] : [jsonRpcError(id, -32601, activationRefusalMessage(label, preEnableToolsets))];
+  }
   const token = readCurrentToken(tokenFile, tokenVar);
   if (!token) {
     logErr(`no token in ${tokenFile} (var ${tokenVar})`);
@@ -259,6 +276,7 @@ async function forward(line, id, isNotification, method, params) {
     await ensureUnionManifest(token);
     let tools = [...unionToolByName.values()];
     if (toolAllowlist.size > 0) tools = tools.filter((t) => toolAllowlist.has(toolName(t)));
+    tools = stripActivationTool(tools);
     return [JSON.stringify({ jsonrpc: "2.0", id: id ?? null, result: { tools } })];
   }
   if (method === "tools/call" && preEnableToolsets.length > 0) {
@@ -384,12 +402,16 @@ if (invokedDirectly) {
   void main();
 }
 export {
+  ACTIVATION_TOOL,
+  activationRefusalMessage,
   buildEnableToolsetRequest,
   buildForwardHeaders,
   buildToolsListRequest,
   extractJsonRpcMessages,
   extractToolsArray,
   filterToolsListMessage,
+  forward,
+  isManagedActivationCall,
   isToolCallBlocked,
   main,
   parseEnableToolsetResponse,
@@ -397,5 +419,6 @@ export {
   parsePreEnableToolsets,
   parseToolAllowlist,
   readCurrentToken,
+  stripActivationTool,
   toolName
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.471",
+  "version": "0.28.472",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {