@integrity-labs/agt-cli 0.28.471 → 0.28.473

package/dist/mcp/remote-oauth-proxy.js

@@ -39,14 +39,27 @@ function parsePreEnableToolsets(raw) {
   }
   return out;
 }
+var ACTIVATION_TOOL = "enable_toolset";
 function buildEnableToolsetRequest(toolset) {
   return JSON.stringify({
     jsonrpc: "2.0",
     id: `agt-preenable-${toolset}`,
     method: "tools/call",
-    params: { name: "enable_toolset", arguments: { name: toolset } }
+    params: { name: ACTIVATION_TOOL, arguments: { name: toolset } }
   });
 }
+function stripActivationTool(tools) {
+  return tools.filter((t) => toolName(t) !== ACTIVATION_TOOL);
+}
+function isManagedActivationCall(method, params) {
+  if (method !== "tools/call") return false;
+  const name = params && typeof params === "object" && typeof params.name === "string" ? params.name : "";
+  return name === ACTIVATION_TOOL;
+}
+function activationRefusalMessage(label2, managed) {
+  const groups = managed.length > 0 ? managed.join(", ") : "none";
+  return `${label2}: toolset activation is managed by this connection, not by the agent. This connection manages these toolsets, and their tools are already in this session's tool list: ${groups}. Calling ${ACTIVATION_TOOL} cannot add a callable tool \u2014 the tool list is fixed for the session, so anything it reported as "newly available" would still answer "No such tool available". Call the tool you need directly; if it is not in your tool list, it is not enabled for this integration.`;
+}
 function buildToolsListRequest() {
   return JSON.stringify({ jsonrpc: "2.0", id: "agt-union-list", method: "tools/list", params: {} });
 }
@@ -250,6 +263,10 @@ function ensureUnionManifest(token) {
   return unionOnce;
 }
 async function forward(line, id, isNotification, method, params) {
+  if (preEnableToolsets.length > 0 && isManagedActivationCall(method, params)) {
+    logErr(`refused agent-issued ${ACTIVATION_TOOL} (activation is proxy-managed)`);
+    return isNotification ? [] : [jsonRpcError(id, -32601, activationRefusalMessage(label, preEnableToolsets))];
+  }
   const token = readCurrentToken(tokenFile, tokenVar);
   if (!token) {
     logErr(`no token in ${tokenFile} (var ${tokenVar})`);
@@ -259,6 +276,7 @@ async function forward(line, id, isNotification, method, params) {
     await ensureUnionManifest(token);
     let tools = [...unionToolByName.values()];
     if (toolAllowlist.size > 0) tools = tools.filter((t) => toolAllowlist.has(toolName(t)));
+    tools = stripActivationTool(tools);
     return [JSON.stringify({ jsonrpc: "2.0", id: id ?? null, result: { tools } })];
   }
   if (method === "tools/call" && preEnableToolsets.length > 0) {
@@ -384,12 +402,16 @@ if (invokedDirectly) {
   void main();
 }
 export {
+  ACTIVATION_TOOL,
+  activationRefusalMessage,
   buildEnableToolsetRequest,
   buildForwardHeaders,
   buildToolsListRequest,
   extractJsonRpcMessages,
   extractToolsArray,
   filterToolsListMessage,
+  forward,
+  isManagedActivationCall,
   isToolCallBlocked,
   main,
   parseEnableToolsetResponse,
@@ -397,5 +419,6 @@ export {
   parsePreEnableToolsets,
   parseToolAllowlist,
   readCurrentToken,
+  stripActivationTool,
   toolName
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.471",
+  "version": "0.28.473",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {