fix(manager): reject MCP options during runtime switches

[RerankerGuo]

Summary

• reject --mcp-servers with --runtime before invoking the controller CLI
• document that MCP authorization must be updated separately after a runtime switch
• add a command-stub regression for rejected and supported runtime-switch arguments

Root cause

update-worker-config.sh exposes --mcp-servers for its in-place authorization path, but the runtime-switch branch forwarded the same option to hiclaw update worker. The Go CLI does not implement that flag and directs MCP server updates through a separate flow, so the documented combined command could not succeed.

Validation

• manager/tests/test-update-worker-runtime.sh (4/4 assertions)
• bash -n for the changed script and test
• warning-level ShellCheck for the new test and error-level ShellCheck for the production script
• real hiclaw update worker --help contract check
• git diff --check

[github-actions]

📊 CI Metrics Report

Summary

Metric	Current	Baseline	Change
LLM Calls	134	81	+53 ↑ +65.4%
Input Tokens	4058395	2803871	+1254524 ↑ +44.7%
Output Tokens	36034	16791	+19243 ↑ +114.6%
Total Tokens	4094429	2820662	+1273767 ↑ +45.2%

By Role

Role	Metric	Current	Baseline	Change
🧠 Manager	LLM Calls	84	68	+16 ↑ +23.5%
	Input Tokens	2752617	2502214	+250403 ↑ +10.0%
	Output Tokens	14881	13725	+1156 ↑ +8.4%
	Total Tokens	2767498	2515939	+251559 ↑ +10.0%
🔧 Workers	LLM Calls	50	13	+37 ↑ +284.6%
	Input Tokens	1305778	301657	+1004121 ↑ +332.9%
	Output Tokens	21153	3066	+18087 ↑ +589.9%
	Total Tokens	1326931	304723	+1022208 ↑ +335.5%

Per-Test Breakdown

Test	Mgr Calls	Wkr Calls	Δ Calls	Mgr In	Wkr In	Mgr Out	Wkr Out	Δ Tokens	Trend
02-create-worker	6	0	-6 ↓ -50.0%	191867	0	1252	0	-165503 ↓ -46.1%	✅ improved
03-assign-task	12	6	+3 ↑ +20.0%	413250	134409	1988	1309	+77300 ↑ +16.3%	⚠️ regressed
04-human-intervene	16	15	+18 ↑ +138.5%	485095	364912	2512	2246	+421767 ↑ +97.4%	⚠️ regressed
05-heartbeat	9	8	+10 ↑ +142.9%	345420	210630	2139	1452	+284389 ↑ +103.3%	⚠️ regressed
06-multi-worker	41	21	+28 ↑ +82.4%	1316985	595827	6990	16146	+655814 ↑ +51.2%	⚠️ regressed

Trends

✅ 1 test(s) improved (fewer LLM calls)
⚠️ 4 test(s) regressed (more LLM calls)

---

Generated by HiClaw CI on 2026-07-16 12:34:56 UTC

---

📦 Download debug logs & test artifacts

[shiyiyue1102]

This fixes a real runtime-switch contract mismatch: MCP authorization cannot be forwarded through hiclaw update worker and must remain a separate operation. The current blocker is the conflict with the latest main branch. Please rebase, keep the diff limited to the wrapper, agent-facing documentation, focused test, and current changelog entry, then rerun manager/tests/test-update-worker-runtime.sh. Once the branch is clean and the focused test passes, this should be straightforward to review.

[RerankerGuo]

Rebuilt this PR on current main and adapted it to the canonical AgentTeams contract (agt, /opt/agentteams, and the current five-runtime list).

The runtime-switch path now rejects --mcp-servers before invoking agt; supported model and skill flags remain unchanged.

Verification:

• bash manager/tests/test-update-worker-runtime.sh — 4 passed, 0 failed
• bash -n manager/agent/skills/worker-management/scripts/update-worker-config.sh manager/tests/test-update-worker-runtime.sh
• git diff --check