agenthub-multiagent-mcp 1.60.0 → 1.64.0

package/dist/lib/pending-items.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Pending-items cache for the MCP tool wrapper
+ * (fix-inbox-delivery-and-tool-wrapping §3.2).
+ *
+ * `wrapWithPendingItems` used to await two HTTP calls — the unread inbox and
+ * the pending-task list — on EVERY wrapped tool invocation, of which there are
+ * 58. Each carries the 45s DEFAULT_TIMEOUT_MS, so with a slow or restarting
+ * server a call to something as unrelated as `now` could sit for ~90s before
+ * doing its own work. `fix-mcp-connection-resilience` already records where
+ * that ends: a hang long enough for Claude Code to tear down the MCP subprocess
+ * loses the agent for the rest of the session.
+ *
+ * So the wrapper no longer waits. It reads whatever the cache holds and returns
+ * immediately, while a refresh runs in the background. This mirrors the 60s
+ * cache `server_time` has used in this same wrapper since add-time-aware-agents,
+ * rather than inventing a second mechanism.
+ *
+ * The trade, stated plainly: a pending message can be up to one TTL stale on a
+ * tool response, and the very first wrapped call of a session carries none at
+ * all. That is acceptable because this was never the primary delivery path —
+ * the WebSocket push and an explicit `check_inbox` are — and because latency
+ * high enough to kill the subprocess loses far more than one stale message.
+ */
+import type { ApiClient, Message } from "../client.js";
+/**
+ * Shorter than server_time's 60s: a teammate's message is more
+ * time-sensitive than the clock, and the refresh is off the hot path anyway.
+ */
+export declare const PENDING_ITEMS_TTL_MS = 15000;
+/** Messages fetched for the wrapper; small page — the wrapper is a nudge. */
+export declare const PENDING_ITEMS_FETCH_LIMIT = 10;
+export interface PendingTask {
+    id: string;
+    assigned_by: string;
+    assigned_by_name?: string;
+    task: string;
+    priority: string;
+    [key: string]: unknown;
+}
+export interface PendingItems {
+    messages: Message[];
+    tasks: PendingTask[];
+    /** True when nothing has been fetched yet, or the entry is past its TTL. */
+    stale: boolean;
+}
+export declare function clearPendingItemsCache(): void;
+/** Visible for tests: has a refresh for this agent settled? */
+export declare function pendingItemsRefreshInFlight(agentId: string): boolean;
+/**
+ * Read the cached pending items, scheduling a background refresh when stale.
+ *
+ * Never awaits the network: the returned value is whatever is already known,
+ * which on a cold cache is nothing. `stale` tells the caller which it got.
+ */
+export declare function getPendingItems(client: ApiClient, agentId: string): PendingItems;
+/**
+ * Await the next refresh for an agent, if one is in flight.
+ *
+ * For tests and for `check_inbox`-adjacent callers that genuinely want
+ * freshness. Production tool calls must not use this — waiting is the bug.
+ */
+export declare function awaitPendingItemsRefresh(agentId: string): Promise<void>;
+//# sourceMappingURL=pending-items.d.ts.map

package/dist/lib/pending-items.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-items.d.ts","sourceRoot":"","sources":["../../src/lib/pending-items.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;CAChB;AAYD,wBAAgB,sBAAsB,IAAI,IAAI,CAG7C;AAED,+DAA+D;AAC/D,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpE;AAwBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,GACd,YAAY,CAcd;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7E"}

package/dist/lib/pending-items.js

@@ -0,0 +1,96 @@
+/**
+ * Pending-items cache for the MCP tool wrapper
+ * (fix-inbox-delivery-and-tool-wrapping §3.2).
+ *
+ * `wrapWithPendingItems` used to await two HTTP calls — the unread inbox and
+ * the pending-task list — on EVERY wrapped tool invocation, of which there are
+ * 58. Each carries the 45s DEFAULT_TIMEOUT_MS, so with a slow or restarting
+ * server a call to something as unrelated as `now` could sit for ~90s before
+ * doing its own work. `fix-mcp-connection-resilience` already records where
+ * that ends: a hang long enough for Claude Code to tear down the MCP subprocess
+ * loses the agent for the rest of the session.
+ *
+ * So the wrapper no longer waits. It reads whatever the cache holds and returns
+ * immediately, while a refresh runs in the background. This mirrors the 60s
+ * cache `server_time` has used in this same wrapper since add-time-aware-agents,
+ * rather than inventing a second mechanism.
+ *
+ * The trade, stated plainly: a pending message can be up to one TTL stale on a
+ * tool response, and the very first wrapped call of a session carries none at
+ * all. That is acceptable because this was never the primary delivery path —
+ * the WebSocket push and an explicit `check_inbox` are — and because latency
+ * high enough to kill the subprocess loses far more than one stale message.
+ */
+/**
+ * Shorter than server_time's 60s: a teammate's message is more
+ * time-sensitive than the clock, and the refresh is off the hot path anyway.
+ */
+export const PENDING_ITEMS_TTL_MS = 15_000;
+/** Messages fetched for the wrapper; small page — the wrapper is a nudge. */
+export const PENDING_ITEMS_FETCH_LIMIT = 10;
+const cache = new Map();
+/** In-flight refreshes, so N tool calls in a burst cause one fetch, not N. */
+const inFlight = new Map();
+export function clearPendingItemsCache() {
+    cache.clear();
+    inFlight.clear();
+}
+/** Visible for tests: has a refresh for this agent settled? */
+export function pendingItemsRefreshInFlight(agentId) {
+    return inFlight.has(agentId);
+}
+async function refresh(client, agentId) {
+    try {
+        const [inbox, tasksResponse] = await Promise.all([
+            client.getInbox(agentId, true, PENDING_ITEMS_FETCH_LIMIT),
+            client.getPendingTasks(agentId),
+        ]);
+        cache.set(agentId, {
+            messages: inbox.messages ?? [],
+            tasks: (tasksResponse.tasks ?? []),
+            fetched_at_ms: Date.now(),
+        });
+    }
+    catch (err) {
+        // A failed refresh leaves the previous entry in place and is not
+        // propagated: the tool call that triggered it has already returned, and
+        // nothing about it should surface as that tool failing. The entry stays
+        // stale, so the next call tries again.
+        console.warn("[AgentHub] pending-items refresh failed:", err);
+    }
+    finally {
+        inFlight.delete(agentId);
+    }
+}
+/**
+ * Read the cached pending items, scheduling a background refresh when stale.
+ *
+ * Never awaits the network: the returned value is whatever is already known,
+ * which on a cold cache is nothing. `stale` tells the caller which it got.
+ */
+export function getPendingItems(client, agentId) {
+    const entry = cache.get(agentId);
+    const fresh = entry !== undefined && Date.now() - entry.fetched_at_ms < PENDING_ITEMS_TTL_MS;
+    if (!fresh && !inFlight.has(agentId)) {
+        // Fire and forget. The promise is tracked only to collapse a burst of
+        // tool calls into a single fetch; nothing awaits it.
+        const p = refresh(client, agentId);
+        inFlight.set(agentId, p);
+        void p;
+    }
+    if (!entry)
+        return { messages: [], tasks: [], stale: true };
+    return { messages: entry.messages, tasks: entry.tasks, stale: !fresh };
+}
+/**
+ * Await the next refresh for an agent, if one is in flight.
+ *
+ * For tests and for `check_inbox`-adjacent callers that genuinely want
+ * freshness. Production tool calls must not use this — waiting is the bug.
+ */
+export async function awaitPendingItemsRefresh(agentId) {
+    const p = inFlight.get(agentId);
+    if (p)
+        await p;
+}
+//# sourceMappingURL=pending-items.js.map

package/dist/lib/pending-items.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-items.js","sourceRoot":"","sources":["../../src/lib/pending-items.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAwB5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAC5C,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD,MAAM,UAAU,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAiB,EAAE,OAAe;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,yBAAyB,CAAC;YACzD,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;YACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;YAC9B,KAAK,EAAG,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAA8B;YAChE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iEAAiE;QACjE,wEAAwE;QACxE,wEAAwE;QACxE,uCAAuC;QACvC,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAiB,EACjB,OAAe;IAEf,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG,oBAAoB,CAAC;IAE7F,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzB,KAAK,CAAC,CAAC;IACT,CAAC;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAe;IAC5D,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC;QAAE,MAAM,CAAC,CAAC;AACjB,CAAC"}

package/dist/pinSweep.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Find and fix `agenthub-multiagent-mcp` version pins on a machine
+ * (add-machine-wide-mcp-update §1).
+ *
+ * THE PROBLEM THIS EXISTS FOR. `@latest` plus a restart is the whole update
+ * mechanism, and a pin silently defeats it. Swept on the reference machine
+ * 2026-10-17: `~/.claude.json` read `@latest` in all 52 of its agenthub
+ * entries, so the machine looked current, while five hard pins sat elsewhere —
+ * three project `.mcp.json` files at 1.52.0, one at 1.61.0, and the channel
+ * plugin's own manifest at 1.61.0. Restarting those agents forever would never
+ * have moved them, and nobody can act on what they cannot enumerate.
+ *
+ * The plugin manifest is the one that matters most and is hardest to see: it is
+ * a SINGLE SHARED FILE governing every channel process on the machine, so a
+ * survey that counts agents never finds it.
+ *
+ * Everything here is a pure function over file contents. The impure shell —
+ * walking directories, reading, backing up, writing — lives in the CLI, so the
+ * matching and rewriting are testable without a machine.
+ */
+export interface Pin {
+    /** The file the pin was found in. */
+    file: string;
+    /** The pinned version, e.g. "1.52.0". */
+    version: string;
+    /** Whether this file is the shared channel-plugin manifest. */
+    pluginManifest: boolean;
+}
+export interface ScanInput {
+    file: string;
+    content: string;
+}
+export interface Summary {
+    pins: Pin[];
+    /** How many pinned references were found, across all files. */
+    pinned: number;
+    /** How many `@latest` references were found. */
+    floating: number;
+}
+/**
+ * Whether a path is the channel plugin's manifest.
+ *
+ * Matched on the path rather than the contents because the contents look like
+ * any other MCP server entry. Deliberately narrow: a plugin manifest sits under
+ * a plugins directory AND is named `plugin.json`, so a project file that merely
+ * mentions a plugin is not caught.
+ */
+export declare function isPluginManifest(file: string): boolean;
+/** Every pinned reference in one file's contents. */
+export declare function findPins(file: string, content: string): Pin[];
+/**
+ * Scan several files.
+ *
+ * Reports floating references alongside pinned ones because "no pins found" and
+ * "this tool found nothing at all" are different answers, and a summary that
+ * cannot tell them apart is how a broken scanner reads as a clean machine.
+ */
+export declare function summarize(inputs: ScanInput[]): Summary;
+/**
+ * Replace every pinned version in `content` with `target`.
+ *
+ * A targeted string replacement rather than a JSON round-trip, on purpose:
+ * these files are hand-edited, several carry comments (which `JSON.parse` would
+ * reject and a reserialise would strip), and reformatting somebody's
+ * configuration to change one version string is not a trade worth making. An
+ * `@latest` reference is left exactly as it is.
+ */
+export declare function rewritePins(content: string, target: string): string;
+/**
+ * Which pins a rewrite should touch, given whether the plugin was named.
+ *
+ * The plugin manifest is held back by default and the reason is not timidity:
+ * floating that pin has caused `EBUSY` on a shared npx cache while another
+ * session held the native addon, so it wants a considered bump rather than
+ * being swept along with four project files.
+ */
+export declare function selectForRewrite(pins: Pin[], includePlugin: boolean): {
+    apply: Pin[];
+    heldBack: Pin[];
+};
+/** Whether a target string is an acceptable version to pin to. */
+export declare function validTarget(target: string): boolean;
+//# sourceMappingURL=pinSweep.d.ts.map

package/dist/pinSweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinSweep.d.ts","sourceRoot":"","sources":["../src/pinSweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAkBH,MAAM,WAAW,GAAG;IAClB,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED,qDAAqD;AACrD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,EAAE,CAM7D;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAQtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,GAAG,EAAE,EACX,aAAa,EAAE,OAAO,GACrB;IAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAAC,QAAQ,EAAE,GAAG,EAAE,CAAA;CAAE,CAQnC;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/pinSweep.js

@@ -0,0 +1,105 @@
+/**
+ * Find and fix `agenthub-multiagent-mcp` version pins on a machine
+ * (add-machine-wide-mcp-update §1).
+ *
+ * THE PROBLEM THIS EXISTS FOR. `@latest` plus a restart is the whole update
+ * mechanism, and a pin silently defeats it. Swept on the reference machine
+ * 2026-10-17: `~/.claude.json` read `@latest` in all 52 of its agenthub
+ * entries, so the machine looked current, while five hard pins sat elsewhere —
+ * three project `.mcp.json` files at 1.52.0, one at 1.61.0, and the channel
+ * plugin's own manifest at 1.61.0. Restarting those agents forever would never
+ * have moved them, and nobody can act on what they cannot enumerate.
+ *
+ * The plugin manifest is the one that matters most and is hardest to see: it is
+ * a SINGLE SHARED FILE governing every channel process on the machine, so a
+ * survey that counts agents never finds it.
+ *
+ * Everything here is a pure function over file contents. The impure shell —
+ * walking directories, reading, backing up, writing — lives in the CLI, so the
+ * matching and rewriting are testable without a machine.
+ */
+/** The package whose pins we care about. */
+const PKG = "agenthub-multiagent-mcp";
+/**
+ * A pinned reference, i.e. `<pkg>@<semver>`.
+ *
+ * The negative lookahead on the package name is load-bearing: without it,
+ * `agenthub-multiagent-mcp-extras@1.2.3` matches and a different package's
+ * version gets rewritten. The `(?![\w.-])` after the version stops a longer
+ * version string being truncated mid-number.
+ */
+const PIN_RE = new RegExp(`${PKG}(?![\\w-])@(\\d+\\.\\d+\\.\\d+)(?![\\w.-])`, "g");
+/** A floating reference. Counted, never rewritten — it is already correct. */
+const FLOAT_RE = new RegExp(`${PKG}(?![\\w-])@latest(?![\\w.-])`, "g");
+/**
+ * Whether a path is the channel plugin's manifest.
+ *
+ * Matched on the path rather than the contents because the contents look like
+ * any other MCP server entry. Deliberately narrow: a plugin manifest sits under
+ * a plugins directory AND is named `plugin.json`, so a project file that merely
+ * mentions a plugin is not caught.
+ */
+export function isPluginManifest(file) {
+    const p = file.replace(/\\/g, "/").toLowerCase();
+    return p.includes("/plugins/") && p.endsWith("plugin.json");
+}
+/** Every pinned reference in one file's contents. */
+export function findPins(file, content) {
+    const out = [];
+    for (const m of content.matchAll(PIN_RE)) {
+        out.push({ file, version: m[1], pluginManifest: isPluginManifest(file) });
+    }
+    return out;
+}
+/**
+ * Scan several files.
+ *
+ * Reports floating references alongside pinned ones because "no pins found" and
+ * "this tool found nothing at all" are different answers, and a summary that
+ * cannot tell them apart is how a broken scanner reads as a clean machine.
+ */
+export function summarize(inputs) {
+    const pins = [];
+    let floating = 0;
+    for (const { file, content } of inputs) {
+        pins.push(...findPins(file, content));
+        floating += [...content.matchAll(FLOAT_RE)].length;
+    }
+    return { pins, pinned: pins.length, floating };
+}
+/**
+ * Replace every pinned version in `content` with `target`.
+ *
+ * A targeted string replacement rather than a JSON round-trip, on purpose:
+ * these files are hand-edited, several carry comments (which `JSON.parse` would
+ * reject and a reserialise would strip), and reformatting somebody's
+ * configuration to change one version string is not a trade worth making. An
+ * `@latest` reference is left exactly as it is.
+ */
+export function rewritePins(content, target) {
+    return content.replace(PIN_RE, `${PKG}@${target}`);
+}
+/**
+ * Which pins a rewrite should touch, given whether the plugin was named.
+ *
+ * The plugin manifest is held back by default and the reason is not timidity:
+ * floating that pin has caused `EBUSY` on a shared npx cache while another
+ * session held the native addon, so it wants a considered bump rather than
+ * being swept along with four project files.
+ */
+export function selectForRewrite(pins, includePlugin) {
+    const apply = [];
+    const heldBack = [];
+    for (const p of pins) {
+        if (p.pluginManifest && !includePlugin)
+            heldBack.push(p);
+        else
+            apply.push(p);
+    }
+    return { apply, heldBack };
+}
+/** Whether a target string is an acceptable version to pin to. */
+export function validTarget(target) {
+    return target === "latest" || /^\d+\.\d+\.\d+$/.test(target);
+}
+//# sourceMappingURL=pinSweep.js.map

package/dist/pinSweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinSweep.js","sourceRoot":"","sources":["../src/pinSweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,4CAA4C;AAC5C,MAAM,GAAG,GAAG,yBAAyB,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,4CAA4C,EAAE,GAAG,CAAC,CAAC;AAEnF,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,8BAA8B,EAAE,GAAG,CAAC,CAAC;AAwBvE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AAC9D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAe;IACpD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,MAAmB;IAC3C,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACtC,QAAQ,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACzD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAW,EACX,aAAsB;IAEtB,MAAM,KAAK,GAAU,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAU,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,aAAa;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YACpD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,MAAM,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC"}

package/dist/pinSweep.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * add-machine-wide-mcp-update §1 — find every MCP version pin on a machine.
+ *
+ * Why this exists: `~/.claude.json` on the reference machine reads `@latest` in
+ * all 52 of its agenthub entries, so the machine LOOKS current. Five hard pins
+ * live elsewhere — three project `.mcp.json` files at 1.52.0, one at 1.61.0, and
+ * the channel plugin's own manifest at 1.61.0 — and no number of restarts moves
+ * them. The last one is a single shared file governing every channel process on
+ * the machine, which is precisely the one a survey that counts agents misses.
+ */
+export {};
+//# sourceMappingURL=pinSweep.test.d.ts.map

package/dist/pinSweep.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinSweep.test.d.ts","sourceRoot":"","sources":["../src/pinSweep.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/pinSweep.test.js

@@ -0,0 +1,110 @@
+/**
+ * add-machine-wide-mcp-update §1 — find every MCP version pin on a machine.
+ *
+ * Why this exists: `~/.claude.json` on the reference machine reads `@latest` in
+ * all 52 of its agenthub entries, so the machine LOOKS current. Five hard pins
+ * live elsewhere — three project `.mcp.json` files at 1.52.0, one at 1.61.0, and
+ * the channel plugin's own manifest at 1.61.0 — and no number of restarts moves
+ * them. The last one is a single shared file governing every channel process on
+ * the machine, which is precisely the one a survey that counts agents misses.
+ */
+import { describe, it, expect } from "vitest";
+import { findPins, isPluginManifest, rewritePins, summarize } from "./pinSweep.js";
+describe("pin scanning", () => {
+    it("reports a project pin with its version", () => {
+        const content = JSON.stringify({
+            mcpServers: {
+                agenthub: {
+                    command: "npx",
+                    args: ["-y", "agenthub-multiagent-mcp@1.52.0"],
+                },
+            },
+        });
+        const pins = findPins("D:/proj/.mcp.json", content);
+        expect(pins).toHaveLength(1);
+        expect(pins[0]).toMatchObject({
+            file: "D:/proj/.mcp.json",
+            version: "1.52.0",
+        });
+    });
+    it("does NOT report @latest as a pin", () => {
+        const content = JSON.stringify({
+            mcpServers: {
+                agenthub: { args: ["-y", "agenthub-multiagent-mcp@latest"] },
+            },
+        });
+        expect(findPins("D:/proj/.mcp.json", content)).toEqual([]);
+    });
+    it("finds a pin in a plugin manifest and in the -p form", () => {
+        // The channel plugin is invoked as `-p <pkg>@<ver> agenthub-channel`, a
+        // different shape from the bare package argument.
+        const content = `{"mcpServers":{"agenthub-channel":{"args":["-y","-p","agenthub-multiagent-mcp@1.61.0","agenthub-channel"]}}}`;
+        const pins = findPins("/c/plugins/agenthub-channel/0.1.0/.claude-plugin/plugin.json", content);
+        expect(pins).toHaveLength(1);
+        expect(pins[0].version).toBe("1.61.0");
+    });
+    it("reports several pins in one file separately", () => {
+        const content = `{"a":"agenthub-multiagent-mcp@1.52.0","b":"agenthub-multiagent-mcp@1.61.0"}`;
+        const pins = findPins("x", content);
+        expect(pins.map((p) => p.version).sort()).toEqual(["1.52.0", "1.61.0"]);
+    });
+    it("ignores a different package that merely shares a prefix", () => {
+        const content = `{"a":"agenthub-multiagent-mcp-extras@1.2.3"}`;
+        expect(findPins("x", content)).toEqual([]);
+    });
+    it("counts floating entries separately from pinned ones", () => {
+        const content = `{
+      "a":"agenthub-multiagent-mcp@latest",
+      "b":"agenthub-multiagent-mcp@latest",
+      "c":"agenthub-multiagent-mcp@1.52.0"
+    }`;
+        const s = summarize([{ file: "x", content }]);
+        expect(s.pinned).toBe(1);
+        expect(s.floating).toBe(2);
+    });
+    it("reports nothing pinned when everything floats", () => {
+        const s = summarize([
+            { file: "x", content: `{"a":"agenthub-multiagent-mcp@latest"}` },
+        ]);
+        expect(s.pinned).toBe(0);
+        expect(s.pins).toEqual([]);
+    });
+});
+describe("the plugin manifest is recognised", () => {
+    it("matches a plugin manifest path", () => {
+        expect(isPluginManifest("/c/Users/x/.claude/plugins/cache/contetial/agenthub-channel/0.1.0/.claude-plugin/plugin.json")).toBe(true);
+    });
+    it("does not match a project .mcp.json", () => {
+        expect(isPluginManifest("D:/Krishi_AI/Krishi-Dev/.mcp.json")).toBe(false);
+    });
+    it("does not match the user configuration", () => {
+        expect(isPluginManifest("/c/Users/x/.claude.json")).toBe(false);
+    });
+});
+describe("rewriting", () => {
+    it("replaces a pinned version with the target", () => {
+        const before = `{"args":["-y","agenthub-multiagent-mcp@1.52.0"]}`;
+        const after = rewritePins(before, "latest");
+        expect(after).toContain("agenthub-multiagent-mcp@latest");
+        expect(after).not.toContain("1.52.0");
+    });
+    it("replaces every pin in the file, leaving @latest alone", () => {
+        const before = `{"a":"agenthub-multiagent-mcp@1.52.0","b":"agenthub-multiagent-mcp@latest","c":"agenthub-multiagent-mcp@1.61.0"}`;
+        const after = rewritePins(before, "1.64.0");
+        expect(after.match(/agenthub-multiagent-mcp@1\.64\.0/g)).toHaveLength(2);
+        expect(after).toContain("agenthub-multiagent-mcp@latest");
+    });
+    it("changes nothing when there is no pin", () => {
+        const before = `{"a":"agenthub-multiagent-mcp@latest"}`;
+        expect(rewritePins(before, "1.64.0")).toBe(before);
+    });
+    it("leaves the rest of the file byte-identical", () => {
+        // These files are hand-edited and carry comments and formatting the tool has
+        // no business reformatting. A targeted string replacement, not a JSON
+        // round-trip.
+        const before = `{\n  // keep me\n  "args": ["-y", "agenthub-multiagent-mcp@1.52.0"]\n}\n`;
+        const after = rewritePins(before, "latest");
+        expect(after).toBe(`{\n  // keep me\n  "args": ["-y", "agenthub-multiagent-mcp@latest"]\n}\n`);
+    });
+});
+//# sourceMappingURL=pinSweep.test.js.map

package/dist/pinSweep.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinSweep.test.js","sourceRoot":"","sources":["../src/pinSweep.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAEnF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,CAAC,IAAI,EAAE,gCAAgC,CAAC;iBAC/C;aACF;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC5B,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,gCAAgC,CAAC,EAAE;aAC7D;SACF,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,OAAO,GAAG,8GAA8G,CAAC;QAC/H,MAAM,IAAI,GAAG,QAAQ,CAAC,8DAA8D,EAAE,OAAO,CAAC,CAAC;QAC/F,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,OAAO,GAAG,6EAA6E,CAAC;QAC9F,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,OAAO,GAAG,8CAA8C,CAAC;QAC/D,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,OAAO,GAAG;;;;MAId,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,SAAS,CAAC;YAClB,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,wCAAwC,EAAE;SACjE,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CACJ,gBAAgB,CAAC,8FAA8F,CAAC,CACjH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,gBAAgB,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,kDAAkD,CAAC;QAClE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,kHAAkH,CAAC;QAClI,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,wCAAwC,CAAC;QACxD,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,6EAA6E;QAC7E,sEAAsE;QACtE,cAAc;QACd,MAAM,MAAM,GAAG,0EAA0E,CAAC;QAC1F,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pinSweepCli.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `agenthub-setup --pins` — the impure shell around pinSweep.ts
+ * (add-machine-wide-mcp-update §1).
+ *
+ * Reports every `agenthub-multiagent-mcp` version pin on this machine and, when
+ * asked, rewrites them. Reporting is the default: a tool that edits
+ * configuration the moment you run it is a tool people stop running.
+ *
+ * WHERE IT LOOKS, and why not a disk walk. Claude Code's own configuration
+ * carries a `projects` map keyed by project path — 83 entries on the reference
+ * machine — which is the authoritative list of projects on the box. Scanning
+ * those plus the plugins directory finds what actually loads, instead of
+ * trawling drives and hoping. A project Claude Code has never opened cannot be
+ * running an agent — but a project it has never OPENED can still hold a pin,
+ * which is why --root exists. See scanCaveat.
+ */
+import { isPluginManifest } from "./pinSweep.js";
+export declare function runPinsSubcommand(argv: string[]): number;
+export { isPluginManifest };
+//# sourceMappingURL=pinSweepCli.d.ts.map

package/dist/pinSweepCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinSweepCli.d.ts","sourceRoot":"","sources":["../src/pinSweepCli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAEL,gBAAgB,EAOjB,MAAM,eAAe,CAAC;AAsKvB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAoGxD;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}