@integrity-labs/agt-cli 0.28.961 → 0.28.963

package/dist/{chunk-INIVG34P.js → chunk-PE6Z3UMB.js}

@@ -14,7 +14,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-SQGW4VAW.js";
+} from "./chunk-TI3V27FS.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -74,7 +74,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-GSRUWWT6.js";
+} from "./chunk-4ZXFR64M.js";
 import {
   classifyUnanswerablePane,
   summarizeUnanswerablePane
@@ -6967,7 +6967,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.961" : "dev";
+var agtCliVersion = true ? "0.28.963" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11666,4 +11666,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-INIVG34P.js.map
+//# sourceMappingURL=chunk-PE6Z3UMB.js.map

package/dist/{chunk-SQGW4VAW.js → chunk-TI3V27FS.js}

@@ -20,7 +20,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-GSRUWWT6.js";
+} from "./chunk-4ZXFR64M.js";
 import {
   classifyUnanswerablePane,
   findUsageLimitResetHint,
@@ -5575,4 +5575,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-SQGW4VAW.js.map
+//# sourceMappingURL=chunk-TI3V27FS.js.map

package/dist/{claude-pair-runtime-W3NZZPKF.js → claude-pair-runtime-INNBV2E3.js}

@@ -236,7 +236,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-OD7M7K5C.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-C7QW6EZJ.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -558,4 +558,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-W3NZZPKF.js.map
+//# sourceMappingURL=claude-pair-runtime-INNBV2E3.js.map

package/dist/lib/manager-worker.js

@@ -63,7 +63,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-INIVG34P.js";
+} from "../chunk-PE6Z3UMB.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -140,7 +140,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-SQGW4VAW.js";
+} from "../chunk-TI3V27FS.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -236,7 +236,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-GSRUWWT6.js";
+} from "../chunk-4ZXFR64M.js";
 import "../chunk-DHWNVVX4.js";
 import {
   reapOrphanChannelMcps
@@ -13262,7 +13262,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-73TIJ6ZV.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-OVDIYW5R.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13947,7 +13947,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.961" : "dev";
+var agtCliVersion = true ? "0.28.963" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15549,7 +15549,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-OD7M7K5C.js");
+      const { collectDiagnostics } = await import("../persistent-session-C7QW6EZJ.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15691,7 +15691,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-OD7M7K5C.js");
+      const { collectDiagnostics } = await import("../persistent-session-C7QW6EZJ.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15867,7 +15867,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-73TIJ6ZV.js");
+      } = await import("../responsiveness-probe-OVDIYW5R.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -15984,7 +15984,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-73TIJ6ZV.js");
+        } = await import("../responsiveness-probe-OVDIYW5R.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16140,7 +16140,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-FGWPJVFS.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-BW6SDESD.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20416,7 +20416,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-73TIJ6ZV.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-OVDIYW5R.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20459,7 +20459,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-OD7M7K5C.js");
+        const { collectDiagnostics } = await import("../persistent-session-C7QW6EZJ.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20510,7 +20510,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-OD7M7K5C.js");
+      const { collectDiagnostics } = await import("../persistent-session-C7QW6EZJ.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -21152,7 +21152,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-W3NZZPKF.js");
+  } = await import("../claude-pair-runtime-INNBV2E3.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -34806,6 +34806,10 @@ var NOTICE_KIND_AUDIENCE = {
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",
+  // ADR-0104: the batch finished. Addressed to the agent, which reports the
+  // counts onward; the approver is told separately, on the surface they
+  // approved from.
+  integration_batch_resolved: "agent",
   integration_invoke_denied: "agent",
   // Support/recruit approvals — same shape, agent resumes the provisioning.
   recruit_resolved: "agent",

package/dist/mcp/index.js

@@ -27407,6 +27407,10 @@ var NOTICE_KIND_AUDIENCE = {
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",
+  // ADR-0104: the batch finished. Addressed to the agent, which reports the
+  // counts onward; the approver is told separately, on the surface they
+  // approved from.
+  integration_batch_resolved: "agent",
   integration_invoke_denied: "agent",
   // Support/recruit approvals — same shape, agent resumes the provisioning.
   recruit_resolved: "agent",

package/dist/mcp/origami.js

@@ -41558,6 +41558,10 @@ var NOTICE_KIND_AUDIENCE = {
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",
+  // ADR-0104: the batch finished. Addressed to the agent, which reports the
+  // counts onward; the approver is told separately, on the surface they
+  // approved from.
+  integration_batch_resolved: "agent",
   integration_invoke_denied: "agent",
   // Support/recruit approvals — same shape, agent resumes the provisioning.
   recruit_resolved: "agent",

package/dist/mcp/slack-channel.js

@@ -35784,6 +35784,10 @@ var NOTICE_KIND_AUDIENCE = {
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",
+  // ADR-0104: the batch finished. Addressed to the agent, which reports the
+  // counts onward; the approver is told separately, on the surface they
+  // approved from.
+  integration_batch_resolved: "agent",
   integration_invoke_denied: "agent",
   // Support/recruit approvals — same shape, agent resumes the provisioning.
   recruit_resolved: "agent",

package/dist/mcp/telegram-channel.js

@@ -35796,6 +35796,10 @@ var NOTICE_KIND_AUDIENCE = {
   // HITL tool-call approvals: "Do NOT call this tool again, do NOT claim the
   // action happened, and do NOT poll".
   integration_invoke_resolved: "agent",
+  // ADR-0104: the batch finished. Addressed to the agent, which reports the
+  // counts onward; the approver is told separately, on the surface they
+  // approved from.
+  integration_batch_resolved: "agent",
   integration_invoke_denied: "agent",
   // Support/recruit approvals — same shape, agent resumes the provisioning.
   recruit_resolved: "agent",

package/dist/mcp/xero.js

@@ -114353,6 +114353,16 @@ function pickTenantId(tenants, desired) {
   return desired;
 }
 
+// src/helpers/tenant-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var store = new AsyncLocalStorage();
+function runWithTenant(tenantId, fn) {
+  return store.run({ tenantId }, fn);
+}
+function currentCallTenant() {
+  return store.getStore()?.tenantId;
+}
+
 // src/clients/broker-credential-client.ts
 function makeError(status, message, needsReauth = false) {
   const err = new Error(message);
@@ -114437,7 +114447,11 @@ var BrokerCredentialClient = class {
           tenantId: res.data.tenant_id ?? null,
           expiresAt: res.data.expires_at ?? null,
           grantedScopes: res.data.granted_scopes ?? null,
-          effectiveScopes: res.data.effective_scopes ?? null
+          effectiveScopes: res.data.effective_scopes ?? null,
+          allowedTenants: Array.isArray(res.data.allowed_tenants) ? res.data.allowed_tenants.filter((t) => typeof t?.tenant_id === "string" && t.tenant_id.trim() !== "").map((t) => ({
+            tenantId: t.tenant_id.trim(),
+            tenantName: typeof t.tenant_name === "string" ? t.tenant_name : null
+          })) : null
         };
       } catch (err) {
         if (err.status !== void 0) throw err;
@@ -114512,12 +114526,44 @@ if (!broker_mode && !bearer_token && (!client_id || !client_secret)) {
   throw Error("Environment Variables not set - please check your .env file");
 }
 var MCPXeroClient = class extends import_xero_node.XeroClient {
-  tenantId;
-  shortCode;
+  pinnedTenantId = "";
+  // CS-1739: one short code per organisation, since a call can now target any
+  // allowed organisation and a deep link must point at the right one.
+  shortCodes = /* @__PURE__ */ new Map();
+  /** CS-1739: the organisations the platform allows for this login (broker mode). */
+  /**
+   * CS-1739: the operator's organisation list from the broker.
+   *   null = the platform sent none (older API, or a non-broker install), so
+   *          the single pinned tenant applies;
+   *   []   = an EXPLICIT empty list (nothing intersected), which must refuse
+   *          every call rather than fall back to the pin. CodeRabbit on #6188:
+   *          collapsing both to [] let a call run against the pinned tenant
+   *          despite the operator allowing nothing.
+   */
+  allowedTenants = null;
   constructor(config2) {
     super(config2);
-    this.tenantId = "";
-    this.shortCode = "";
+  }
+  /**
+   * The tenant for the CURRENT tool call when one was chosen (CS-1739), else
+   * the pinned tenant. Handlers keep reading `xeroClient.tenantId` unchanged.
+   */
+  get tenantId() {
+    return currentCallTenant() ?? this.pinnedTenantId;
+  }
+  set tenantId(value) {
+    this.pinnedTenantId = value;
+  }
+  /**
+   * CS-1739: the organisations a tool call may target. The broker's list when
+   * it sent one; otherwise the single pinned tenant (older API / non-broker).
+   */
+  async getAllowedTenants() {
+    await this.authenticate();
+    if (this.allowedTenants !== null) return this.allowedTenants;
+    if (!this.pinnedTenantId) return [];
+    const match = (this.tenants ?? []).find((t) => t?.tenantId === this.pinnedTenantId);
+    return [{ tenantId: this.pinnedTenantId, tenantName: match?.tenantName ?? null }];
   }
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   async updateTenants(fullOrgDetails) {
@@ -114537,10 +114583,11 @@ var MCPXeroClient = class extends import_xero_node.XeroClient {
     return organisation;
   }
   async getShortCode() {
-    if (!this.shortCode) {
+    const key = this.tenantId;
+    if (!this.shortCodes.has(key)) {
       try {
         const organisation = await this.getOrganisation();
-        this.shortCode = organisation.shortCode ?? "";
+        this.shortCodes.set(key, organisation.shortCode ?? "");
       } catch (error2) {
         const err = ensureError(error2);
         throw new Error(
@@ -114548,7 +114595,7 @@ var MCPXeroClient = class extends import_xero_node.XeroClient {
         );
       }
     }
-    return this.shortCode;
+    return this.shortCodes.get(key);
   }
 };
 var CustomConnectionsXeroClient = class extends MCPXeroClient {
@@ -114681,6 +114728,7 @@ var BrokerBearerTokenXeroClient = class extends MCPXeroClient {
     this.setTokenSet({
       access_token: cred.accessToken
     });
+    this.allowedTenants = cred.allowedTenants ?? null;
     if (cred.tenantId) {
       this.tenantId = cred.tenantId;
     } else {
@@ -120844,6 +120892,100 @@ var UpdateTools = [
   update_repeating_invoice_tool_default
 ];
 
+// src/tools/list/list-organisations.tool.ts
+var ListOrganisationsTool = CreateXeroTool(
+  "list-organisations",
+  "Lists the Xero organisations this agent is allowed to use, with each organisation's tenant_id. Pass one of these tenant_id values to any Xero tool to target that organisation. Read-only.",
+  {},
+  async () => {
+    try {
+      const allowed = await xeroClient.getAllowedTenants();
+      if (allowed.length === 0) {
+        return {
+          content: [{ type: "text", text: "No Xero organisation is selected for this agent. Ask an admin to choose one in the console." }],
+          isError: true
+        };
+      }
+      const lines = allowed.map(
+        (t, i) => `${i + 1}. ${t.tenantName ?? "(name unknown)"} - tenant_id: ${t.tenantId}${i === 0 ? " (default)" : ""}`
+      );
+      return {
+        content: [{ type: "text", text: `Xero organisations this agent may use:
+${lines.join("\n")}` }]
+      };
+    } catch (error2) {
+      return {
+        content: [{ type: "text", text: `Could not list Xero organisations: ${ensureError(error2).message}` }],
+        isError: true
+      };
+    }
+  }
+);
+var list_organisations_tool_default = ListOrganisationsTool;
+
+// src/helpers/resolve-call-tenant.ts
+function describe(allowed) {
+  return allowed.map((t) => t.tenantName ? `${t.tenantName} (${t.tenantId})` : t.tenantId).join(", ");
+}
+function resolveCallTenant(allowed, requested) {
+  const wanted = typeof requested === "string" ? requested.trim() : "";
+  if (allowed !== null && allowed.length === 0) {
+    return {
+      ok: false,
+      message: "This agent has no Xero organisations selected, so no Xero call can run. Ask an admin to choose the organisations for this integration."
+    };
+  }
+  if (allowed === null) {
+    if (wanted) {
+      return {
+        ok: false,
+        message: `tenant_id ${wanted} cannot be used: this Xero connection has no organisation list to check it against.`
+      };
+    }
+    return { ok: true, tenantId: void 0 };
+  }
+  if (wanted) {
+    if (allowed.some((t) => t.tenantId === wanted)) return { ok: true, tenantId: wanted };
+    return {
+      ok: false,
+      message: `tenant_id ${wanted} is not one of the Xero organisations this agent may use: ${describe(allowed)}.`
+    };
+  }
+  if (allowed.length === 1) return { ok: true, tenantId: allowed[0].tenantId };
+  return {
+    ok: false,
+    message: `This agent can use more than one Xero organisation, so pass tenant_id. Allowed: ${describe(allowed)}. Call list-organisations to see them.`
+  };
+}
+
+// src/tools/tenant-scope.ts
+var TENANT_ID_ARG_DESCRIPTION = "Optional. The Xero organisation id (tenant) to use. Needed only when this agent can use more than one Xero organisation; call list-organisations to see them. Defaults to the only allowed organisation.";
+function errorResult(text) {
+  return { content: [{ type: "text", text }], isError: true };
+}
+function withTenantScope(tool) {
+  const schema = tool.schema ?? {};
+  if ("tenant_id" in schema) return tool;
+  return {
+    ...tool,
+    schema: { ...schema, tenant_id: external_exports.string().optional().describe(TENANT_ID_ARG_DESCRIPTION) },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    handler: (async (args, extra) => {
+      const { tenant_id: requested, ...rest } = args ?? {};
+      let allowed;
+      try {
+        allowed = await xeroClient.getAllowedTenants();
+      } catch (error2) {
+        return errorResult(`Could not resolve the Xero organisations for this agent: ${ensureError(error2).message}`);
+      }
+      const choice = resolveCallTenant(allowed, typeof requested === "string" ? requested : void 0);
+      if (!choice.ok) return errorResult(choice.message);
+      const call = () => tool.handler(rest, extra);
+      return choice.tenantId === void 0 ? call() : runWithTenant(choice.tenantId, call);
+    })
+  };
+}
+
 // src/tools/tool-factory.ts
 function writesGoViaBroker() {
   const raw = (process.env.XERO_WRITES_VIA_BROKER ?? "").trim().toLowerCase();
@@ -120877,15 +121019,17 @@ function ToolFactory(server, effectiveScopes = null) {
       "xero-mcp-server: agent policy excludes payroll scopes \u2014 payroll tools not registered (ENG-7824)."
     );
   }
-  GetTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
-  ListTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
-  AttachmentTools.map((tool) => tool()).forEach(
+  const listOrganisations = list_organisations_tool_default();
+  server.tool(listOrganisations.name, listOrganisations.description, listOrganisations.schema, listOrganisations.handler);
+  GetTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  ListTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  AttachmentTools.map((tool) => tool()).map(withTenantScope).forEach(
     (tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler)
   );
   if (readOnly) return;
-  DeleteTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
-  CreateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
-  UpdateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  DeleteTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  CreateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
+  UpdateTools.map((tool) => tool()).filter((tool) => allow(tool.name)).map(withTenantScope).forEach((tool) => server.tool(tool.name, tool.description, tool.schema, tool.handler));
 }
 
 // src/index.ts

package/dist/{persistent-session-OD7M7K5C.js → persistent-session-C7QW6EZJ.js}

@@ -62,8 +62,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-SQGW4VAW.js";
-import "./chunk-GSRUWWT6.js";
+} from "./chunk-TI3V27FS.js";
+import "./chunk-4ZXFR64M.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 export {
@@ -131,4 +131,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-OD7M7K5C.js.map
+//# sourceMappingURL=persistent-session-C7QW6EZJ.js.map

package/dist/{responsiveness-probe-73TIJ6ZV.js → responsiveness-probe-OVDIYW5R.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-SQGW4VAW.js";
-import "./chunk-GSRUWWT6.js";
+} from "./chunk-TI3V27FS.js";
+import "./chunk-4ZXFR64M.js";
 import "./chunk-DHWNVVX4.js";
 import "./chunk-XWVM4KPK.js";
 
@@ -800,4 +800,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-73TIJ6ZV.js.map
+//# sourceMappingURL=responsiveness-probe-OVDIYW5R.js.map

package/dist/{session-auth-dead-FGWPJVFS.js → session-auth-dead-BW6SDESD.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-GSRUWWT6.js";
+} from "./chunk-4ZXFR64M.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-FGWPJVFS.js.map
+//# sourceMappingURL=session-auth-dead-BW6SDESD.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.961",
+  "version": "0.28.963",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {