@integrity-labs/agt-cli 0.28.865 → 0.28.866

package/dist/assets/review/SWEEP.md

@@ -0,0 +1,169 @@
+---
+name: pr-review-sweep
+description: Find the pull requests in scope that have no review for their current head, and review them. Use when a recurring card asks you to sweep a repository's open PRs. Reviews via the pr-review skill; posts nothing.
+---
+
+# Sweeping a repository's open pull requests
+
+You are a Ninjafy agent (Ninjafy and Augmented Team are one platform, so you
+answer to the old name too). This skill is the loop that decides **which** pull
+requests get reviewed. The `pr-review` skill is what reviews one. Keep them
+separate: this one chooses, that one reads.
+
+**You post nothing, and neither does the review.** Every artefact this skill
+touches is a file under your own working directory.
+
+---
+
+## 1. Read your scope — and refuse without one
+
+The card that woke you must name a scope. One of:
+
+- `label:<name>` — open PRs carrying that label
+- `author:<login>` — open PRs opened by that account
+- `prs:<n>,<n>,<n>` — an explicit list
+
+**If the card names no scope, review nothing.** Write the sweep summary
+(section 5) with `"status": "refused"` and `"reason": "no_scope"`, say so, and
+stop.
+
+This is not caution, it is the point. An unscoped sweep is "review every open
+PR", which at this repository's volume is the most expensive thing you could be
+asked to do, and nobody would have asked for it — they would have forgotten to
+say. A missing scope is a missing instruction, so the safe reading is *nothing*,
+never *everything*.
+
+You also need the repository as `owner/name`. If the card does not name one,
+that is `"reason": "no_repo"` and the same refusal.
+
+## 2. List the candidates
+
+```bash
+gh pr list --repo OWNER/NAME --state open --limit 100 \
+  --json number,headRefOid,title,isDraft,author
+```
+
+Add `--label <name>` or `--author <login>` per the scope.
+
+For a `prs:` scope, read each one with `gh api repos/OWNER/NAME/pulls/NUMBER`
+instead. **That payload names the same things differently** — `head.sha`, not
+`headRefOid`; `draft`, not `isDraft` — and it does not filter by state, so check
+`state` is `open` yourself and skip anything else. A closed PR reached this way
+would otherwise enter the sweep, which the `--state open` above rules out for
+every other scope.
+
+**Skip drafts.** A draft moves under you by design, so a review of one is
+usually filed against a head nobody will ever see again.
+
+The head sha is `headRefOid` from the list, or `head.sha` from the API.
+Everything below keys on its first 12 characters.
+
+## 3. Decide what to review — read the artefact, not just its name
+
+For each candidate, the artefact is:
+
+```text
+.smithers/review/<pr>-<first 12 chars of head sha>.code.json
+```
+
+**A file existing is not a review having happened.** Read it and branch on
+`status`:
+
+- **No file** → review it.
+- **`"status": "reviewed"`** → skip. This head has been reviewed, whether it
+  found anything or not. Count it as `alreadyReviewed`.
+- **`"status": "incomplete"`** → this is a review that could not finish — an API
+  call failed, the diff was unreadable, the PR moved twice. Retry it, **up to 3
+  attempts total**. Read its `attempts` field and **remember the number** — you
+  will need it in section 4, and it is about to be overwritten. An absent field
+  means 1. At 3 or more, skip it and count it as `abandoned`.
+
+Treating `incomplete` as done is the failure this branch exists to prevent: one
+transient API error would park that head forever, and the sweep would report a
+clean pass over a PR nobody ever read. Treating it as never-attempted is the
+opposite failure — an unreadable diff retried every five minutes for a week.
+
+A force-push changes the head, so it changes the filename, so it gets a fresh
+review with a fresh attempt count. You do not need to do anything about that.
+
+## 4. Review, up to the cap
+
+Review the candidates in ascending PR number, invoking the **`pr-review`** skill
+for each. **Stop after 3 reviews in one sweep** unless the card names a
+different `cap:<n>`. Count the rest as `skippedByCap`; the next tick takes them.
+
+The cap is a cost guard, not a queue-management nicety. Each review is a full
+read of a diff and costs real money against a shared subscription, and a sweep
+that finds thirty unreviewed PRs is exactly when you least want to run thirty
+reviews back to back.
+
+**After a retry, record the attempt — from the number you remembered, not from
+the file.** If the artefact `pr-review` just wrote is `incomplete`, set its
+`attempts` to **one more than the value you read in section 3** (which was 1 if
+the field was absent), then move on.
+
+`pr-review` overwrites the artefact: same filename, fresh body, no `attempts`
+field. So "increment what is in the file" reads 1 every time, the count never
+reaches 3, and an unreadable diff is retried every tick forever — the cap looking
+like it works while being unreachable. The remembered number is the only one
+that carries.
+
+### Do not read what the other reviewers said
+
+Never read `/reviews`, `/comments`, `/issues/NUMBER/comments`, or any other
+reviewer's findings, on any PR, at any point in this sweep.
+
+Your review has to be worth comparing against another reviewer's on the same
+commit, and a review that has read the other one is not evidence of anything.
+This is easy to do by accident — the endpoints are one call away and they look
+like context.
+
+## 5. Write the sweep summary — this is how anyone knows you ran
+
+Every sweep writes a summary, including a sweep that reviewed nothing and a
+sweep that refused.
+
+Append one line to `.smithers/review/sweep-log.jsonl`, and overwrite
+`.smithers/review/sweep-latest.json` with the same object:
+
+```json
+{
+  "at": "2026-09-09T04:00:00Z",
+  "status": "swept",
+  "repo": "owner/name",
+  "scope": "label:obi-wan-review",
+  "cap": 3,
+  "open": 12,
+  "candidates": 4,
+  "alreadyReviewed": 2,
+  "reviewed": [{ "pr": 1234, "head": "abc123def456", "status": "reviewed", "findings": 2 }],
+  "abandoned": [],
+  "skippedByCap": 1,
+  "posted": 0
+}
+```
+
+`status` is `swept` or `refused`; a `refused` summary carries `reason` and omits
+the sweep counts — **but still carries `"posted": 0`**, which is not one of them.
+It is the field the whole phase is checked on, and a summary that may drop it is
+a guarantee with a hole exactly where a refusal happened.
+
+**Write it even when the answer is boring, and especially then.** A reviewer
+that has quietly stopped working — a credential gone, the skill missing, an
+account at its limit — posts nothing and files nothing, which is precisely what
+a working reviewer looks like on a quiet day. The difference between the two is
+that one of them wrote this file. `"reviewed": []` with `"candidates": 0` is a
+healthy sweep. **No summary at all is the alarm.**
+
+`posted` is always `0`. It is in the summary because a number that is always
+zero is checkable, and a promise in prose is not.
+
+## 6. Report, and stop
+
+Say which repo and scope you swept, how many PRs were in scope, how many you
+reviewed, how many were already done, and anything you abandoned or capped.
+Name the summary file.
+
+Then stop. Do not post the findings. Do not open a review. Do not comment on any
+PR. Reviews are published by a separate, gated step that reads these artefacts —
+not by you, and not in this phase.

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-RVXI7GZO.js";
+} from "../chunk-52JZN5RZ.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-PXDYKP5O.js";
+} from "../chunk-AFOW32B6.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-JG3EAFZO.js";
+} from "../chunk-ULLOPIPI.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.865" : "dev";
+var cliVersion = true ? "0.28.866" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.865" : "dev";
+var cliVersion2 = true ? "0.28.866" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-RVXI7GZO.js → chunk-52JZN5RZ.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-PXDYKP5O.js";
+} from "./chunk-AFOW32B6.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -76,7 +76,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-JG3EAFZO.js";
+} from "./chunk-ULLOPIPI.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -6728,7 +6728,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.865" : "dev";
+var agtCliVersion = true ? "0.28.866" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11338,4 +11338,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-RVXI7GZO.js.map
+//# sourceMappingURL=chunk-52JZN5RZ.js.map

package/dist/{chunk-PXDYKP5O.js → chunk-AFOW32B6.js}

@@ -18,7 +18,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-JG3EAFZO.js";
+} from "./chunk-ULLOPIPI.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -5431,4 +5431,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-PXDYKP5O.js.map
+//# sourceMappingURL=chunk-AFOW32B6.js.map

package/dist/{chunk-JG3EAFZO.js → chunk-ULLOPIPI.js}

@@ -10126,7 +10126,9 @@ var OAUTH_PROVIDERS = {
     publicClient: true,
     mcpUrl: "https://mcp.kajabi.com/mcp",
     // Curated surface (matches the catalog seed's defined_scopes[].tools). Kajabi's
-    // live MCP advertises ~111 tools; the agent only needs these 28.
+    // live MCP advertises ~111 tools; the agent only needs these 34.
+    // (Was written as 28 and left stale when the four pages/themes tools landed
+    // in ENG-7629's follow-up — recounted here rather than left to drift again.)
     // CS-1427: `enable_toolset` is included so an agent can activate its own
     // products/commerce + analytics toolsets on the connection (Kajabi gates those
     // tool groups behind a runtime toolset that returns "not active" until enabled).
@@ -10171,7 +10173,26 @@ var OAUTH_PROVIDERS = {
       "list_landing_pages",
       "get_landing_page",
       "update_landing_page",
-      "get_theme_content"
+      "get_theme_content",
+      // CS-1689: the write half of the two groups above. Every Kajabi write we
+      // curate stopped at the email-content boundary — an agent could
+      // create_sequence and get_theme_content but could not add an email to a
+      // sequence or apply a theme edit, so any change to an EXISTING email had
+      // to go back to the customer by hand.
+      //
+      // Both names are Kajabi's own, taken from the descriptions of tools we
+      // already advertise rather than guessed: `create_sequence` says "Add
+      // emails with add_sequence_email", and `create_broadcast` +
+      // `get_theme_content` both say to "pair with update_theme_content to
+      // apply changes". That sourcing matters here — a name the server does not
+      // advertise is logged and SKIPPED by the proxy, so a wrong guess would
+      // look applied and change nothing.
+      //
+      // No new catalog scope: these join the existing kajabi:emails and
+      // kajabi:pages scopes, so already-connected sites do not need to
+      // re-authorise to pick them up.
+      "add_sequence_email",
+      "update_theme_content"
     ],
     // CS-1446: Kajabi gates several tool groups behind a runtime `enable_toolset`
     // and does not advertise their tools in `tools/list` until the group is
@@ -14282,4 +14303,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-JG3EAFZO.js.map
+//# sourceMappingURL=chunk-ULLOPIPI.js.map