@integrity-labs/agt-cli 0.28.641 → 0.28.642

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-HFPMTTNZ.js";
+} from "../chunk-ND3OFG2Z.js";
 import {
   readDirectChatSessionState
 } from "../chunk-HYLJPTKL.js";
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.641" : "dev";
+var cliVersion = true ? "0.28.642" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.641" : "dev";
+var cliVersion2 = true ? "0.28.642" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-HFPMTTNZ.js → chunk-ND3OFG2Z.js}

@@ -6073,7 +6073,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.641" : "dev";
+var agtCliVersion = true ? "0.28.642" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9814,4 +9814,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-HFPMTTNZ.js.map
+//# sourceMappingURL=chunk-ND3OFG2Z.js.map

package/dist/lib/manager-worker.js

@@ -55,7 +55,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-HFPMTTNZ.js";
+} from "../chunk-ND3OFG2Z.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -12154,7 +12154,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.641" : "dev";
+var agtCliVersion = true ? "0.28.642" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -14121,6 +14121,7 @@ async function pollCycleInner() {
     const fastRespawn = hostFlagStore().getBoolean("fast-mcp-restart-respawn");
     const processOrder = fastRespawn ? reorderRestartedFirst(agents, new Set(restartAcks.keys())) : agents;
     const managedToolkits = createManagedToolkitReader(agents.map((a) => a.agent_id));
+    managedPruneLedger = createManagedPruneLedger();
     for (const agent of processOrder) {
       if (restartInFlight.has(agent.agent_id)) {
         const existing = state7.agents.find((a) => a.agentId === agent.agent_id);
@@ -14160,6 +14161,8 @@ async function pollCycleInner() {
       }
     }
     void maybeReportActivityCache({ api, log });
+    const crossAgentPrune = managedPruneLedger.summarize();
+    if (crossAgentPrune) log(crossAgentPrune);
     const restartAckStateChanged = applyRestartAcks({
       agentStates,
       priorAgents: state7.agents,
@@ -14392,13 +14395,61 @@ async function getOrCacheRegisteredAgents(adapter, profile) {
   }
   return cached;
 }
+var UntrustworthyToolkitResponseError = class extends Error {
+  constructor(detail) {
+    super(`/host/managed-toolkits returned an untrustworthy body: ${detail}`);
+    this.name = "UntrustworthyToolkitResponseError";
+  }
+};
 async function fetchManagedToolkits(agentIds) {
   const data = await api.post(
     "/host/managed-toolkits",
     { agent_ids: [...agentIds] }
   );
-  return data.toolkits ?? [];
+  const toolkits = data?.toolkits;
+  if (toolkits === void 0 || toolkits === null) {
+    throw new UntrustworthyToolkitResponseError("`toolkits` field is missing");
+  }
+  if (!Array.isArray(toolkits)) {
+    throw new UntrustworthyToolkitResponseError(
+      `\`toolkits\` is ${typeof toolkits}, expected an array`
+    );
+  }
+  const covered = data?.covered_agent_ids;
+  let coveredAgentIds = null;
+  if (covered !== void 0 && covered !== null) {
+    if (!Array.isArray(covered) || covered.some((id) => typeof id !== "string")) {
+      throw new UntrustworthyToolkitResponseError(
+        "`covered_agent_ids` is present but is not an array of strings"
+      );
+    }
+    coveredAgentIds = covered;
+  }
+  return { toolkits, coveredAgentIds };
 }
+function coverageOf(result, requested) {
+  const covered = new Set(result.coveredAgentIds ?? []);
+  for (const tk of result.toolkits) covered.add(tk.agent_id);
+  const scoped = new Set([...covered].filter((id) => requested.includes(id)));
+  return { covered: scoped, assertedByServer: result.coveredAgentIds !== null };
+}
+function createManagedPruneLedger() {
+  const byAgent = /* @__PURE__ */ new Map();
+  return {
+    record(agentCodeName, serverKey) {
+      const list = byAgent.get(agentCodeName);
+      if (list) list.push(serverKey);
+      else byAgent.set(agentCodeName, [serverKey]);
+    },
+    summarize() {
+      if (byAgent.size < 2) return null;
+      const total = [...byAgent.values()].reduce((n, l) => n + l.length, 0);
+      const detail = [...byAgent.entries()].map(([codeName, keys]) => `${codeName}(${keys.join(",")})`).join(" ");
+      return `[managed-toolkit][WARN] cross-agent prune: ${total} MCP server(s) removed across ${byAgent.size} agents in ONE cycle \u2014 agents are configured independently, so a simultaneous revocation is unlikely and this may be an untrustworthy toolkit response rather than a real one (ENG-9140): ${detail}`;
+    }
+  };
+}
+var managedPruneLedger = createManagedPruneLedger();
 function createManagedToolkitReader(agentIds, fetchToolkits = fetchManagedToolkits) {
   const requested = [...new Set(agentIds)];
   let batch = null;
@@ -14406,11 +14457,18 @@ function createManagedToolkitReader(agentIds, fetchToolkits = fetchManagedToolki
     batch ??= (async () => {
       if (requested.length === 0) return /* @__PURE__ */ new Map();
       try {
-        const toolkits = await fetchToolkits(requested);
+        const result = await fetchToolkits(requested);
+        const { covered, assertedByServer } = coverageOf(result, requested);
         const byAgent = new Map(
-          requested.map((id) => [id, []])
+          [...covered].map((id) => [id, []])
         );
-        for (const tk of toolkits) byAgent.get(tk.agent_id)?.push(tk);
+        for (const tk of result.toolkits) byAgent.get(tk.agent_id)?.push(tk);
+        const uncovered = requested.length - covered.size;
+        if (uncovered > 0) {
+          log(
+            `[managed-toolkit] batch answered for ${covered.size}/${requested.length} agent(s)${assertedByServer ? "" : " (API build asserts no coverage)"} \u2014 the other ${uncovered} are UNKNOWN, not empty, and will be re-asked per agent rather than pruned (ENG-9140)`
+          );
+        }
         return byAgent;
       } catch (err) {
         log(
@@ -14426,7 +14484,14 @@ function createManagedToolkitReader(agentIds, fetchToolkits = fetchManagedToolki
       const byAgent = await loadBatch();
       const fromBatch = byAgent?.get(agentId);
       if (fromBatch) return fromBatch;
-      return (await fetchToolkits([agentId])).filter((tk) => tk.agent_id === agentId);
+      const single = await fetchToolkits([agentId]);
+      const { covered, assertedByServer } = coverageOf(single, [agentId]);
+      if (assertedByServer && !covered.has(agentId)) {
+        throw new UntrustworthyToolkitResponseError(
+          `per-agent fetch for '${agentId}' returned a response that does not cover it`
+        );
+      }
+      return single.toolkits.filter((tk) => tk.agent_id === agentId);
     }
   };
 }
@@ -15760,6 +15825,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
                 if (isManagedMcpServerKey(key) && !expectedServerIds.has(key)) {
                   frameworkAdapter.removeMcpServer(agent.code_name, key);
                   log(`[managed-toolkit] Removed stale MCP server '${key}' for '${agent.code_name}'`);
+                  managedPruneLedger.record(agent.code_name, key);
                 }
               }
             } catch {
@@ -19133,12 +19199,15 @@ export {
   DAY_ROLLOVER_FORCE_GRACE_MIN,
   DAY_ROLLOVER_INBOUND_DEFER_MAX_MIN,
   DAY_ROLLOVER_INBOUND_GRACE_SEC,
+  UntrustworthyToolkitResponseError,
   applyRestartAcks,
   cancelKanbanNoticeOnDrain,
   classifyLazyDayRolloverReset,
   claudeCodeUpgradeMarkerPath,
   claudeCodeUpgradeThrottled,
   claudeManagedSettingsPath,
+  coverageOf,
+  createManagedPruneLedger,
   createManagedToolkitReader,
   creditInboundHold,
   dashboardRestartBreakerReason,
@@ -19146,6 +19215,7 @@ export {
   ensureClaudeManagedSettings,
   extractCharterSlackPeers,
   extractCharterTelegramPeers,
+  fetchManagedToolkits,
   hasRevokedResiduals,
   inboundHoldMinutes,
   isOlderSemverTuple,