agentic-assistant 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.5.2 - 2026-10-29
+
+No breaking changes. This is a patch release.
+
+Changed
+
+- The demo page sets `color-scheme: light dark`, so its system-color fallbacks follow the user's dark mode.
+- A test fails if a hard-coded hex color returns to the demo page style. This does not change the package.
+- An end-to-end test covers `mcp` with no model key, and the README documents that behavior. This does not change the package.
+
+Security
+
+- An npm `overrides` entry sets `zod` to `^4.6.7`, for GHSA-mrhx-c7xc-m3w5 (memory exhaustion while validating oversized constrained collections, fixed in 4.6.6 and later). The entry applies only to this repo. An install of `agentic-assistant` gets the zod that each dependency allows. The optional peer `agentic-design` 0.3.x can bring zod 3 into your project, so run `npm audit` after you upgrade.
+
+## 0.5.1
+
+Changed
+
+- The demo page reads its colors from agentic-design tokens, with system-color fallbacks. It has no hard-coded hex colors.
+- `agentic-assistant mcp` without `--tools` exits 2 and names `mcp` and `--tools` in its message.
+
 ## 0.5.0
 
 Added

package/README.md

@@ -141,6 +141,7 @@ The assistant prints its answer on stdout. The answer starts with `Assistant (ma
 - `--scope` is what the assistant may hold. `--tool-scope` is what each tool needs. Both are required, and the CLI guesses neither.
 - `--tool-risk` defaults to `risky`. A risky call needs approval. Approve one exact call ahead of time with `--approve-call '{"tool":"notes_write","input":{"id":"7","text":"hi"}}'`. The call must match the tool and the arguments, and each approval is used once. On a terminal, `--approve ask` asks you.
 - Keys come from the environment: `ANTHROPIC_API_KEY`, or the variable named by `--api-key-env`. There is no flag that takes a key.
+- With `ANTHROPIC_API_KEY`, or the variable named by `--api-key-env`, unset or empty, `mcp` prints one line on stderr that names the variable, writes nothing to stdout, and exits 2.
 - For an EU-hosted model, use `--provider openai-compatible --base-url https://models.example.eu/v1 --model <id> --api-key-env EU_KEY`. Add `--price-in` and `--price-out` to use the cost cap.
 - A message on stdin may be up to 1 MB.
 - Limits: `--max-turns`, `--max-tokens`, `--max-cost`, `--max-tool-calls`.

package/dist/{chunk-KSVH5NNA.js → chunk-4S24ZBA7.js}

@@ -5,7 +5,7 @@ import {
   AnthropicProvider,
   checkBaseUrl,
   isLoopback
-} from "./chunk-XSRGG7SB.js";
+} from "./chunk-PCHOZUAD.js";
 import {
   PrincipalError,
   ProviderError,
@@ -17,7 +17,7 @@ import {
   digestCall,
   printable,
   runAssistant
-} from "./chunk-RHGVOR6N.js";
+} from "./chunk-H5SLBFAJ.js";
 import {
   AssistantApiError,
   createClient

package/dist/{chunk-RHGVOR6N.js → chunk-H5SLBFAJ.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.5.0" : readPackageVersion();
+var VERSION = true ? "0.5.2" : readPackageVersion();
 
 // src/approvals.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-XSRGG7SB.js → chunk-PCHOZUAD.js}

@@ -1,6 +1,6 @@
 import {
   ProviderError
-} from "./chunk-RHGVOR6N.js";
+} from "./chunk-H5SLBFAJ.js";
 
 // src/providers/anthropic.ts
 import Anthropic from "@anthropic-ai/sdk";

package/dist/{chunk-PRQTL5VS.js → chunk-XBTQSYDI.js}

@@ -4,7 +4,7 @@ import {
   hasScope,
   parseScope,
   runAssistant
-} from "./chunk-RHGVOR6N.js";
+} from "./chunk-H5SLBFAJ.js";
 
 // src/api.ts
 import { PRINCIPAL_KINDS } from "agentic-identity";

package/dist/{chunk-Q3GGWNW5.js → chunk-Z5HBVB6E.js}

@@ -2,12 +2,12 @@ import {
   describeFailure,
   runChat,
   runRemote
-} from "./chunk-KSVH5NNA.js";
+} from "./chunk-4S24ZBA7.js";
 import {
   VERSION,
   provenanceLabel,
   provenanceMarker
-} from "./chunk-RHGVOR6N.js";
+} from "./chunk-H5SLBFAJ.js";
 
 // src/mcp-server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/cli.js

@@ -7,15 +7,15 @@ import {
   readTextFile,
   runChat,
   runRemote
-} from "./chunk-KSVH5NNA.js";
+} from "./chunk-4S24ZBA7.js";
 import "./chunk-HYT732TN.js";
-import "./chunk-XSRGG7SB.js";
+import "./chunk-PCHOZUAD.js";
 import {
   TOOL_RISKS,
   VERSION,
   printable,
   provenanceLabel
-} from "./chunk-RHGVOR6N.js";
+} from "./chunk-H5SLBFAJ.js";
 import "./chunk-QTIEDY3V.js";
 
 // src/cli.ts
@@ -148,7 +148,7 @@ function parseCli(argv) {
     const remoteCommand = command === "approve" ? { name: "approve", id, digest: values.digest } : command === "deny" ? { name: "deny", id, ...values.reason !== void 0 ? { reason: values.reason } : {} } : { name: command };
     return { command: "remote", remote, remoteCommand, json: values.json ?? false };
   }
-  if (!values.tools) throw new UsageError("--tools is required");
+  if (!values.tools) throw new UsageError(`--tools is required for ${command}: an https MCP URL, or a command that starts an MCP server on stdio`);
   if (!values["tool-scope"]) throw new UsageError("--tool-scope is required");
   const risk = values["tool-risk"] ?? "risky";
   if (!TOOL_RISKS.includes(risk)) throw new UsageError(`--tool-risk must be one of ${TOOL_RISKS.join(", ")}`);
@@ -327,7 +327,7 @@ async function runCli(argv, io = defaultIo()) {
     for (const skip of setup.skipped.slice(0, MAX_SKIPPED_LINES)) io.err(`skipped tool ${oneLine(skip.name, 100)}: ${oneLine(skip.reason, 200)}`);
     if (setup.skipped.length > MAX_SKIPPED_LINES) io.err(`skipped ${setup.skipped.length - MAX_SKIPPED_LINES} more tools`);
     if (parsed.command === "mcp") {
-      const { startAssistantMcp } = await import("./mcp-server-U3UQIB7H.js");
+      const { startAssistantMcp } = await import("./mcp-server-RPDNDBBJ.js");
       await startAssistantMcp(setup, remote, { approve: parsed.allowApprove ?? false });
       return 0;
     }

package/dist/demo.js

@@ -1,15 +1,15 @@
 import {
   createStaticTokenAuth,
   createWorker
-} from "./chunk-PRQTL5VS.js";
+} from "./chunk-XBTQSYDI.js";
 import {
   AnthropicProvider
-} from "./chunk-XSRGG7SB.js";
+} from "./chunk-PCHOZUAD.js";
 import {
   ToolRegistry,
   VERSION,
   hasScope
-} from "./chunk-RHGVOR6N.js";
+} from "./chunk-H5SLBFAJ.js";
 
 // src/demo-page.ts
 var DEMO_CSP = "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
@@ -20,13 +20,14 @@ var DEMO_PAGE = `<!doctype html>
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>agentic-assistant demo</title>
 <style>
-body{font:16px/1.5 system-ui,sans-serif;max-width:42rem;margin:2rem auto;padding:0 1rem;color:#1a1a1a;background:#fff}
+:root{color-scheme:light dark}
+body{font:16px/1.5 system-ui,sans-serif;max-width:42rem;margin:2rem auto;padding:0 1rem;color:var(--ad-color-text,CanvasText);background:var(--ad-color-surface,Canvas)}
 label{display:block;margin-top:1rem;font-weight:600}
 input,textarea,button{font:inherit;padding:.5rem;width:100%;box-sizing:border-box}
 button{width:auto;min-height:2.5rem;margin-top:1rem;cursor:pointer}
-:focus-visible{outline:3px solid #0b57d0;outline-offset:2px}
-#out{white-space:pre-wrap;border:1px solid #767676;padding:1rem;margin-top:1rem;min-height:4rem}
-.badge{display:inline-block;border:1px solid #1a1a1a;padding:0 .5rem;font-size:.875rem}
+:focus-visible{outline:3px solid var(--ad-color-focus,LinkText);outline-offset:2px}
+#out{white-space:pre-wrap;border:1px solid var(--ad-color-border-strong,CanvasText);padding:1rem;margin-top:1rem;min-height:4rem}
+.badge{display:inline-block;border:1px solid var(--ad-color-text,CanvasText);padding:0 .5rem;font-size:.875rem}
 </style>
 </head>
 <body>

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createAssistantMcpServer,
   startAssistantMcp
-} from "./chunk-Q3GGWNW5.js";
+} from "./chunk-Z5HBVB6E.js";
 import {
   ConfigError,
   FallbackProvider,
@@ -10,13 +10,13 @@ import {
   connectMcpTools,
   parseTarget,
   runChat
-} from "./chunk-KSVH5NNA.js";
+} from "./chunk-4S24ZBA7.js";
 import "./chunk-HYT732TN.js";
 import {
   AnthropicProvider,
   DEFAULT_ANTHROPIC_MODEL,
   PRICING_CHECKED_ON
-} from "./chunk-XSRGG7SB.js";
+} from "./chunk-PCHOZUAD.js";
 import {
   ACTIONS,
   DATA_NOTICE,
@@ -40,7 +40,7 @@ import {
   provenanceMarker,
   runAssistant,
   scopeCovers
-} from "./chunk-RHGVOR6N.js";
+} from "./chunk-H5SLBFAJ.js";
 import "./chunk-QTIEDY3V.js";
 export {
   ACTIONS,

package/dist/{mcp-server-U3UQIB7H.js → mcp-server-RPDNDBBJ.js}

@@ -1,11 +1,11 @@
 import {
   createAssistantMcpServer,
   startAssistantMcp
-} from "./chunk-Q3GGWNW5.js";
-import "./chunk-KSVH5NNA.js";
+} from "./chunk-Z5HBVB6E.js";
+import "./chunk-4S24ZBA7.js";
 import "./chunk-HYT732TN.js";
-import "./chunk-XSRGG7SB.js";
-import "./chunk-RHGVOR6N.js";
+import "./chunk-PCHOZUAD.js";
+import "./chunk-H5SLBFAJ.js";
 import "./chunk-QTIEDY3V.js";
 export {
   createAssistantMcpServer,

package/dist/worker.js

@@ -3,8 +3,8 @@ import {
   createAssistantApi,
   createStaticTokenAuth,
   createWorker
-} from "./chunk-PRQTL5VS.js";
-import "./chunk-RHGVOR6N.js";
+} from "./chunk-XBTQSYDI.js";
+import "./chunk-H5SLBFAJ.js";
 export {
   APPROVER_SCOPE,
   createAssistantApi,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-assistant",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "An AI assistant that acts inside your apps with the user's own permissions.",
   "keywords": [
     "assistant",
@@ -74,7 +74,7 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^1.3.0",
     "@modelcontextprotocol/sdk": "^1.32.2",
-    "agentic-identity": "^0.6.0",
+    "agentic-identity": "^0.7.0",
     "ajv": "^8.20.0"
   },
   "devDependencies": {
@@ -104,5 +104,8 @@
     "react": {
       "optional": true
     }
+  },
+  "overrides": {
+    "zod": "^4.6.7"
   }
 }