From 0fc7fe757f859eab7592d99694ecf0e7091c2ccf Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 25 Sep 2026 18:54:50 +0200
Subject: [PATCH] fix: a CLI push decides agent identity handling by the
 tracked file's type

An agent retyped into another resource by a push kept neither its value's `on_behalf_of` as the
file stated it nor clear of the old agent's identity. The file's type now decides, and only a
deployed agent's identity is claimed back.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cli/src/commands/resource/resource.ts         |  6 ++++--
 cli/test/resource_push_agent_obo_unit.test.ts | 14 ++++++++------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/cli/src/commands/resource/resource.ts b/cli/src/commands/resource/resource.ts
index f33ae00c98..ef967cd441 100644
--- a/cli/src/commands/resource/resource.ts
+++ b/cli/src/commands/resource/resource.ts
@@ -199,14 +199,16 @@ export function agentOnBehalfOf(
   localResource: ResourceFile,
   permissionedAsContext: PermissionedAsContext | undefined
 ): string | undefined {
-  if ((deployed?.resource_type ?? localResource.resource_type) !== "ai_agent") {
+  // What the push writes is the tracked file's type: an agent retyped into
+  // another resource keeps its value exactly as the file states it.
+  if (localResource.resource_type !== "ai_agent") {
     return undefined;
   }
   const local = localResource.value;
   if (local && typeof local === "object") {
     delete local.on_behalf_of;
   }
-  const value = deployed?.value;
+  const value = deployed?.resource_type === "ai_agent" ? deployed.value : undefined;
   const onBehalfOf =
     value && typeof value === "object" ? value.on_behalf_of : undefined;
   if (deployed && onBehalfOf !== undefined) {
diff --git a/cli/test/resource_push_agent_obo_unit.test.ts b/cli/test/resource_push_agent_obo_unit.test.ts
index ca129637ce..d9b8361c8a 100644
--- a/cli/test/resource_push_agent_obo_unit.test.ts
+++ b/cli/test/resource_push_agent_obo_unit.test.ts
@@ -46,10 +46,12 @@ test("anyone else claims nothing", () => {
   expect(local.value.on_behalf_of).toBeUndefined();
 });
 
-test("other resources are left alone", () => {
-  const deployed = { resource_type: "json", value: { on_behalf_of: "u/bob" } } as any;
-  const local = { resource_type: "json", value: { on_behalf_of: "u/x" } } as any;
-  expect(agentOnBehalfOf(deployed, local, ctx(true))).toBeUndefined();
-  expect(local.value.on_behalf_of).toBe("u/x");
-  expect(deployed.value.on_behalf_of).toBe("u/bob");
+test("other resources are left alone, an agent retyped into one included", () => {
+  for (const deployedType of ["json", "ai_agent"]) {
+    const deployed = { resource_type: deployedType, value: { on_behalf_of: "u/bob" } } as any;
+    const local = { resource_type: "json", value: { on_behalf_of: "u/x" } } as any;
+    expect(agentOnBehalfOf(deployed, local, ctx(true))).toBeUndefined();
+    expect(local.value.on_behalf_of).toBe("u/x");
+    expect(deployed.value.on_behalf_of).toBe("u/bob");
+  }
 });