agentic-assistant 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.5.2 - 2026-10-29
+
+No breaking changes. This is a patch release.
+
+Changed
+
+- The demo page sets `color-scheme: light dark`, so its system-color fallbacks follow the user's dark mode.
+- A test fails if a hard-coded hex color returns to the demo page style. This does not change the package.
+- An end-to-end test covers `mcp` with no model key, and the README documents that behavior. This does not change the package.
+
+Security
+
+- An npm `overrides` entry sets `zod` to `^4.6.7`, for GHSA-mrhx-c7xc-m3w5 (memory exhaustion while validating oversized constrained collections, fixed in 4.6.6 and later). The entry applies only to this repo. An install of `agentic-assistant` gets the zod that each dependency allows. The optional peer `agentic-design` 0.3.x can bring zod 3 into your project, so run `npm audit` after you upgrade.
+
 ## 0.5.1
 
 Changed

package/README.md

@@ -141,6 +141,7 @@ The assistant prints its answer on stdout. The answer starts with `Assistant (ma
 - `--scope` is what the assistant may hold. `--tool-scope` is what each tool needs. Both are required, and the CLI guesses neither.
 - `--tool-risk` defaults to `risky`. A risky call needs approval. Approve one exact call ahead of time with `--approve-call '{"tool":"notes_write","input":{"id":"7","text":"hi"}}'`. The call must match the tool and the arguments, and each approval is used once. On a terminal, `--approve ask` asks you.
 - Keys come from the environment: `ANTHROPIC_API_KEY`, or the variable named by `--api-key-env`. There is no flag that takes a key.
+- With `ANTHROPIC_API_KEY`, or the variable named by `--api-key-env`, unset or empty, `mcp` prints one line on stderr that names the variable, writes nothing to stdout, and exits 2.
 - For an EU-hosted model, use `--provider openai-compatible --base-url https://models.example.eu/v1 --model <id> --api-key-env EU_KEY`. Add `--price-in` and `--price-out` to use the cost cap.
 - A message on stdin may be up to 1 MB.
 - Limits: `--max-turns`, `--max-tokens`, `--max-cost`, `--max-tool-calls`.

package/dist/{chunk-5BZENFYL.js → chunk-4S24ZBA7.js}

@@ -5,7 +5,7 @@ import {
   AnthropicProvider,
   checkBaseUrl,
   isLoopback
-} from "./chunk-2RRM6OLC.js";
+} from "./chunk-PCHOZUAD.js";
 import {
   PrincipalError,
   ProviderError,
@@ -17,7 +17,7 @@ import {
   digestCall,
   printable,
   runAssistant
-} from "./chunk-JNZPVHNN.js";
+} from "./chunk-H5SLBFAJ.js";
 import {
   AssistantApiError,
   createClient

package/dist/{chunk-JNZPVHNN.js → chunk-H5SLBFAJ.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.5.1" : readPackageVersion();
+var VERSION = true ? "0.5.2" : readPackageVersion();
 
 // src/approvals.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-2RRM6OLC.js → chunk-PCHOZUAD.js}

@@ -1,6 +1,6 @@
 import {
   ProviderError
-} from "./chunk-JNZPVHNN.js";
+} from "./chunk-H5SLBFAJ.js";
 
 // src/providers/anthropic.ts
 import Anthropic from "@anthropic-ai/sdk";

package/dist/{chunk-TOQIHYDH.js → chunk-XBTQSYDI.js}

@@ -4,7 +4,7 @@ import {
   hasScope,
   parseScope,
   runAssistant
-} from "./chunk-JNZPVHNN.js";
+} from "./chunk-H5SLBFAJ.js";
 
 // src/api.ts
 import { PRINCIPAL_KINDS } from "agentic-identity";

package/dist/{chunk-E7TFMM2Z.js → chunk-Z5HBVB6E.js}

@@ -2,12 +2,12 @@ import {
   describeFailure,
   runChat,
   runRemote
-} from "./chunk-5BZENFYL.js";
+} from "./chunk-4S24ZBA7.js";
 import {
   VERSION,
   provenanceLabel,
   provenanceMarker
-} from "./chunk-JNZPVHNN.js";
+} from "./chunk-H5SLBFAJ.js";
 
 // src/mcp-server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/cli.js

@@ -7,15 +7,15 @@ import {
   readTextFile,
   runChat,
   runRemote
-} from "./chunk-5BZENFYL.js";
+} from "./chunk-4S24ZBA7.js";
 import "./chunk-HYT732TN.js";
-import "./chunk-2RRM6OLC.js";
+import "./chunk-PCHOZUAD.js";
 import {
   TOOL_RISKS,
   VERSION,
   printable,
   provenanceLabel
-} from "./chunk-JNZPVHNN.js";
+} from "./chunk-H5SLBFAJ.js";
 import "./chunk-QTIEDY3V.js";
 
 // src/cli.ts
@@ -327,7 +327,7 @@ async function runCli(argv, io = defaultIo()) {
     for (const skip of setup.skipped.slice(0, MAX_SKIPPED_LINES)) io.err(`skipped tool ${oneLine(skip.name, 100)}: ${oneLine(skip.reason, 200)}`);
     if (setup.skipped.length > MAX_SKIPPED_LINES) io.err(`skipped ${setup.skipped.length - MAX_SKIPPED_LINES} more tools`);
     if (parsed.command === "mcp") {
-      const { startAssistantMcp } = await import("./mcp-server-7R5WCSID.js");
+      const { startAssistantMcp } = await import("./mcp-server-RPDNDBBJ.js");
       await startAssistantMcp(setup, remote, { approve: parsed.allowApprove ?? false });
       return 0;
     }

package/dist/demo.js

@@ -1,15 +1,15 @@
 import {
   createStaticTokenAuth,
   createWorker
-} from "./chunk-TOQIHYDH.js";
+} from "./chunk-XBTQSYDI.js";
 import {
   AnthropicProvider
-} from "./chunk-2RRM6OLC.js";
+} from "./chunk-PCHOZUAD.js";
 import {
   ToolRegistry,
   VERSION,
   hasScope
-} from "./chunk-JNZPVHNN.js";
+} from "./chunk-H5SLBFAJ.js";
 
 // src/demo-page.ts
 var DEMO_CSP = "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
@@ -20,6 +20,7 @@ var DEMO_PAGE = `<!doctype html>
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>agentic-assistant demo</title>
 <style>
+:root{color-scheme:light dark}
 body{font:16px/1.5 system-ui,sans-serif;max-width:42rem;margin:2rem auto;padding:0 1rem;color:var(--ad-color-text,CanvasText);background:var(--ad-color-surface,Canvas)}
 label{display:block;margin-top:1rem;font-weight:600}
 input,textarea,button{font:inherit;padding:.5rem;width:100%;box-sizing:border-box}

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createAssistantMcpServer,
   startAssistantMcp
-} from "./chunk-E7TFMM2Z.js";
+} from "./chunk-Z5HBVB6E.js";
 import {
   ConfigError,
   FallbackProvider,
@@ -10,13 +10,13 @@ import {
   connectMcpTools,
   parseTarget,
   runChat
-} from "./chunk-5BZENFYL.js";
+} from "./chunk-4S24ZBA7.js";
 import "./chunk-HYT732TN.js";
 import {
   AnthropicProvider,
   DEFAULT_ANTHROPIC_MODEL,
   PRICING_CHECKED_ON
-} from "./chunk-2RRM6OLC.js";
+} from "./chunk-PCHOZUAD.js";
 import {
   ACTIONS,
   DATA_NOTICE,
@@ -40,7 +40,7 @@ import {
   provenanceMarker,
   runAssistant,
   scopeCovers
-} from "./chunk-JNZPVHNN.js";
+} from "./chunk-H5SLBFAJ.js";
 import "./chunk-QTIEDY3V.js";
 export {
   ACTIONS,

package/dist/{mcp-server-7R5WCSID.js → mcp-server-RPDNDBBJ.js}

@@ -1,11 +1,11 @@
 import {
   createAssistantMcpServer,
   startAssistantMcp
-} from "./chunk-E7TFMM2Z.js";
-import "./chunk-5BZENFYL.js";
+} from "./chunk-Z5HBVB6E.js";
+import "./chunk-4S24ZBA7.js";
 import "./chunk-HYT732TN.js";
-import "./chunk-2RRM6OLC.js";
-import "./chunk-JNZPVHNN.js";
+import "./chunk-PCHOZUAD.js";
+import "./chunk-H5SLBFAJ.js";
 import "./chunk-QTIEDY3V.js";
 export {
   createAssistantMcpServer,

package/dist/worker.js

@@ -3,8 +3,8 @@ import {
   createAssistantApi,
   createStaticTokenAuth,
   createWorker
-} from "./chunk-TOQIHYDH.js";
-import "./chunk-JNZPVHNN.js";
+} from "./chunk-XBTQSYDI.js";
+import "./chunk-H5SLBFAJ.js";
 export {
   APPROVER_SCOPE,
   createAssistantApi,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-assistant",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "An AI assistant that acts inside your apps with the user's own permissions.",
   "keywords": [
     "assistant",
@@ -104,5 +104,8 @@
     "react": {
       "optional": true
     }
+  },
+  "overrides": {
+    "zod": "^4.6.7"
   }
 }