@integrity-labs/agt-cli 0.10.8 → 0.10.10

package/dist/bin/agt.js

@@ -32,7 +32,7 @@ import {
   resolveChannels,
   serializeManifestForSlackCli,
   setActiveTeam
-} from "../chunk-VDUA5FEW.js";
+} from "../chunk-PZG4XPJV.js";
 
 // src/bin/agt.ts
 import { join as join11 } from "path";
@@ -107,7 +107,7 @@ async function whoamiCommand() {
       jsonOutput({
         ok: true,
         api_key_prefix: apiKey.slice(0, 8) + "****",
-        host: getHost() ?? null,
+        host: getHost(),
         host_id: exchange.hostId,
         team: exchange.teamSlug,
         team_id: exchange.teamId,
@@ -117,7 +117,7 @@ async function whoamiCommand() {
     }
     success("Authenticated via API key");
     info(`API Key:    ${chalk3.bold(apiKey.slice(0, 8) + "****")}`);
-    info(`Host:       ${chalk3.bold(getHost() ?? "not set")}`);
+    info(`Host:       ${chalk3.bold(getHost())}`);
     info(`Host ID:    ${exchange.hostId}`);
     info(`Team:       ${chalk3.bold(exchange.teamSlug ?? exchange.teamId)}`);
     info(`User:       ${chalk3.bold(exchange.userEmail ?? "unknown")}`);
@@ -2053,8 +2053,160 @@ async function hostDecommissionCommand(hostName) {
   }
 }
 
-// src/commands/manager.ts
+// src/commands/host-pair.ts
+import { spawn, spawnSync } from "child_process";
 import chalk14 from "chalk";
+async function hostPairCommand(name, opts) {
+  const teamSlug = requireTeam();
+  if (!teamSlug) return;
+  const json = isJsonMode();
+  const localPort = Number(opts.port ?? "54545");
+  if (!Number.isInteger(localPort) || localPort < 1024 || localPort > 65535) {
+    error("--port must be an integer between 1024 and 65535");
+    process.exitCode = 1;
+    return;
+  }
+  let host2;
+  try {
+    const data = await api.get(`/hosts/${encodeURIComponent(name)}`);
+    host2 = data.host;
+  } catch (err) {
+    if (json) jsonOutput({ ok: false, error: err.message });
+    else error(`Failed to look up host: ${err.message}`);
+    process.exitCode = 1;
+    return;
+  }
+  if (host2.provision_source !== "augmented-ec2") {
+    const msg = `Host "${name}" is ${host2.provision_source ?? "self"}-provisioned, not an Augmented-managed EC2. agt host pair is only for EC2 hosts provisioned through the Augmented API.`;
+    if (json) jsonOutput({ ok: false, error: msg });
+    else error(msg);
+    process.exitCode = 1;
+    return;
+  }
+  if (!host2.ec2_instance_id) {
+    const msg = `Host "${name}" has no EC2 instance ID yet. Provision it first with \`agt host provision\`.`;
+    if (json) jsonOutput({ ok: false, error: msg });
+    else error(msg);
+    process.exitCode = 1;
+    return;
+  }
+  const region = host2.ec2_region ?? process.env.AWS_REGION ?? "us-east-2";
+  const instanceId = host2.ec2_instance_id;
+  const preflightErr = preflightAws();
+  if (preflightErr) {
+    if (json) jsonOutput({ ok: false, error: preflightErr });
+    else error(preflightErr);
+    process.exitCode = 1;
+    return;
+  }
+  if (json) {
+    jsonOutput({
+      ok: true,
+      host: { name: host2.name, id: host2.id, instance_id: instanceId, region },
+      port_forward: {
+        command: "aws",
+        args: [
+          "ssm",
+          "start-session",
+          "--region",
+          region,
+          "--target",
+          instanceId,
+          "--document-name",
+          "AWS-StartPortForwardingSession",
+          "--parameters",
+          JSON.stringify({ portNumber: [String(localPort)], localPortNumber: [String(localPort)] })
+        ]
+      },
+      shell: {
+        command: "aws",
+        args: ["ssm", "start-session", "--region", region, "--target", instanceId]
+      }
+    });
+    return;
+  }
+  info(`Pairing Claude Code on ${chalk14.bold(name)} (${instanceId}, ${region})`);
+  info(`Local port ${chalk14.cyan(String(localPort))} will be forwarded to the host.`);
+  console.log();
+  console.log(chalk14.dim("In the shell that opens, run:"));
+  console.log(`  ${chalk14.cyan(`CLAUDE_CODE_OAUTH_PORT=${localPort} claude /login`)}`);
+  console.log(chalk14.dim("Then click the printed URL on this machine. The OAuth callback"));
+  console.log(chalk14.dim(`will reach Claude Code via the port-forward tunnel.`));
+  console.log();
+  console.log(chalk14.dim("Exit the shell (Ctrl+D) when Claude Code reports successful login."));
+  console.log();
+  const tunnel = spawn(
+    "aws",
+    [
+      "ssm",
+      "start-session",
+      "--region",
+      region,
+      "--target",
+      instanceId,
+      "--document-name",
+      "AWS-StartPortForwardingSession",
+      "--parameters",
+      JSON.stringify({ portNumber: [String(localPort)], localPortNumber: [String(localPort)] })
+    ],
+    { stdio: ["ignore", "pipe", "pipe"] }
+  );
+  tunnel.stderr?.on("data", (buf) => {
+    const line = buf.toString().trim();
+    if (line.startsWith("An error occurred")) {
+      console.error(chalk14.red(`[tunnel] ${line}`));
+    }
+  });
+  await new Promise((r) => setTimeout(r, 1500));
+  if (tunnel.exitCode !== null) {
+    error("Port-forward tunnel failed to start. Check AWS credentials and session-manager-plugin.");
+    process.exitCode = 1;
+    return;
+  }
+  if (opts.noShell) {
+    console.log(chalk14.dim("--no-shell set; tunnel is running. Press Ctrl+C to exit."));
+    await new Promise((resolve2) => {
+      const onSignal = () => {
+        terminate(tunnel);
+        resolve2();
+      };
+      process.once("SIGINT", onSignal);
+      process.once("SIGTERM", onSignal);
+    });
+  } else {
+    await runInteractive("aws", ["ssm", "start-session", "--region", region, "--target", instanceId]);
+    terminate(tunnel);
+  }
+  success("Pair session ended.");
+}
+function preflightAws() {
+  const aws = spawnSync("aws", ["--version"], { stdio: "ignore" });
+  if (aws.status !== 0) {
+    return "AWS CLI not found. Install: https://aws.amazon.com/cli/";
+  }
+  const plugin2 = spawnSync("session-manager-plugin", [], { stdio: "ignore" });
+  if (plugin2.error) {
+    return "session-manager-plugin not found. Install: brew install --cask session-manager-plugin";
+  }
+  return null;
+}
+function runInteractive(cmd, args) {
+  return new Promise((resolve2) => {
+    const child = spawn(cmd, args, { stdio: "inherit" });
+    child.on("exit", (code) => resolve2(code ?? 0));
+    child.on("error", () => resolve2(1));
+  });
+}
+function terminate(child) {
+  if (child.exitCode !== null) return;
+  try {
+    child.kill("SIGTERM");
+  } catch {
+  }
+}
+
+// src/commands/manager.ts
+import chalk15 from "chalk";
 import { join as join8 } from "path";
 import { homedir } from "os";
 
@@ -2172,16 +2324,6 @@ function getManagerStatus() {
 // src/commands/manager.ts
 function managerStartCommand(opts) {
   const json = isJsonMode();
-  if (!getHost()) {
-    const msg = "AGT_HOST is not set. Export it to point at the Augmented API (e.g. export AGT_HOST=https://your-api.example.com)";
-    if (json) {
-      jsonOutput({ ok: false, error: msg });
-    } else {
-      error(msg);
-    }
-    process.exitCode = 1;
-    return;
-  }
   const apiKey = getApiKey();
   if (!apiKey) {
     const msg = "AGT_API_KEY is not set. Export it with your host API key (tlk_...)";
@@ -2267,10 +2409,10 @@ function managerStatusCommand() {
     jsonOutput({ ok: true, running: true, ...status });
     return;
   }
-  console.log(chalk14.bold("\nManager Status\n"));
+  console.log(chalk15.bold("\nManager Status\n"));
   info(`PID:        ${status.pid}`);
   info(`Started:    ${status.startedAt}`);
-  info(`Last poll:  ${status.lastPollAt ?? chalk14.dim("none")}`);
+  info(`Last poll:  ${status.lastPollAt ?? chalk15.dim("none")}`);
   info(`Polls:      ${status.pollCount}`);
   info(`Errors:     ${status.errorCount}`);
   console.log();
@@ -2279,19 +2421,19 @@ function managerStatusCommand() {
     return;
   }
   const rows = status.agents.map((a) => {
-    let gwStatus = chalk14.dim("\u2014");
+    let gwStatus = chalk15.dim("\u2014");
     if (a.gatewayRunning) {
-      gwStatus = chalk14.green(`:${a.gatewayPort} (PID ${a.gatewayPid})`);
+      gwStatus = chalk15.green(`:${a.gatewayPort} (PID ${a.gatewayPid})`);
     } else if (a.gatewayPort) {
-      gwStatus = chalk14.red(`:${a.gatewayPort} (down)`);
+      gwStatus = chalk15.red(`:${a.gatewayPort} (down)`);
     }
     return [
       a.codeName,
-      a.status === "active" ? chalk14.green(a.status) : a.status === "paused" ? chalk14.yellow(a.status) : chalk14.dim(a.status ?? "\u2014"),
-      a.charterVersion || chalk14.dim("\u2014"),
+      a.status === "active" ? chalk15.green(a.status) : a.status === "paused" ? chalk15.yellow(a.status) : chalk15.dim(a.status ?? "\u2014"),
+      a.charterVersion || chalk15.dim("\u2014"),
       gwStatus,
-      a.lastProvisionAt ? new Date(a.lastProvisionAt).toLocaleTimeString() : chalk14.dim("\u2014"),
-      a.lastDriftCheckAt ? new Date(a.lastDriftCheckAt).toLocaleTimeString() : chalk14.dim("\u2014")
+      a.lastProvisionAt ? new Date(a.lastProvisionAt).toLocaleTimeString() : chalk15.dim("\u2014"),
+      a.lastDriftCheckAt ? new Date(a.lastDriftCheckAt).toLocaleTimeString() : chalk15.dim("\u2014")
     ];
   });
   table(
@@ -2300,13 +2442,13 @@ function managerStatusCommand() {
   );
   const acpAgents = status.agents.filter((a) => a.acpSessions && a.acpSessions.length > 0);
   if (acpAgents.length > 0) {
-    console.log(chalk14.bold("\nACP Sessions\n"));
+    console.log(chalk15.bold("\nACP Sessions\n"));
     const acpRows = acpAgents.flatMap(
       (a) => a.acpSessions.map((s) => [
         a.codeName,
         s.agentCommand,
-        s.sessionName ?? chalk14.dim("default"),
-        s.queueState === "running" ? chalk14.green(s.queueState) : s.queueState === "queued" ? chalk14.yellow(s.queueState) : chalk14.dim(s.queueState),
+        s.sessionName ?? chalk15.dim("default"),
+        s.queueState === "running" ? chalk15.green(s.queueState) : s.queueState === "queued" ? chalk15.yellow(s.queueState) : chalk15.dim(s.queueState),
         String(s.turnCount),
         new Date(s.startedAt).toLocaleTimeString()
       ])
@@ -2319,7 +2461,7 @@ function managerStatusCommand() {
 }
 
 // src/commands/agent.ts
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 import JSON52 from "json5";
 import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
 import { join as join9 } from "path";
@@ -2453,7 +2595,7 @@ async function agentShowCommand(codeName, opts) {
     return;
   }
   const displayName = apiAgent?.display_name ?? charter?.display_name ?? codeName;
-  console.log(chalk15.bold(`
+  console.log(chalk16.bold(`
 Agent: ${codeName}`) + (displayName !== codeName ? ` (${displayName})` : "") + "\n");
   if (charter || apiAgent) {
     const agentId = apiAgent?.agent_id ?? charter?.agent_id;
@@ -2485,7 +2627,7 @@ Agent: ${codeName}`) + (displayName !== codeName ? ` (${displayName})` : "") + "
     info("No agent metadata available");
   }
   const filtered = opts.allChannels ? channelRows : channelRows.filter((c) => c.enabled);
-  console.log(chalk15.bold("\nChannels:"));
+  console.log(chalk16.bold("\nChannels:"));
   if (filtered.length === 0) {
     info("(none enabled)");
   } else {
@@ -2501,7 +2643,7 @@ Agent: ${codeName}`) + (displayName !== codeName ? ` (${displayName})` : "") + "
     );
   }
   if (tools) {
-    console.log(chalk15.bold("\nTools:"));
+    console.log(chalk16.bold("\nTools:"));
     if (tools.tools.length === 0) {
       info("(none configured)");
     } else {
@@ -2512,7 +2654,7 @@ Agent: ${codeName}`) + (displayName !== codeName ? ` (${displayName})` : "") + "
     }
     if (tools.global_controls) {
       const gc = tools.global_controls;
-      console.log(chalk15.bold("\nGlobal Controls:"));
+      console.log(chalk16.bold("\nGlobal Controls:"));
       info(`Network:   ${gc.default_network_policy === "deny" ? "deny-by-default" : "allow-by-default"}`);
       info(`Timeout:   ${gc.default_timeout_ms}ms`);
       info(`Rate:      ${gc.default_rate_limit_rpm} rpm`);
@@ -2528,7 +2670,7 @@ function formatTimestamp(iso) {
 }
 
 // src/commands/kanban-recurring.ts
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import ora12 from "ora";
 async function resolveAgentId(codeName) {
   try {
@@ -2540,10 +2682,10 @@ async function resolveAgentId(codeName) {
   }
 }
 function priorityLabel(p) {
-  return p === 1 ? chalk16.red("HIGH") : p === 3 ? chalk16.dim("LOW") : chalk16.yellow("MED");
+  return p === 1 ? chalk17.red("HIGH") : p === 3 ? chalk17.dim("LOW") : chalk17.yellow("MED");
 }
 function formatSpawnTime(isoDate, timezone) {
-  if (!isoDate) return chalk16.dim("\u2014");
+  if (!isoDate) return chalk17.dim("\u2014");
   try {
     return new Intl.DateTimeFormat("en-AU", {
       dateStyle: "medium",
@@ -2608,8 +2750,8 @@ async function kanbanRecurringAddCommand(title, opts) {
       jsonOutput({ ok: true, template: data.template });
       return;
     }
-    success(`Recurring task created: ${chalk16.bold(title)}`);
-    info(`Schedule:   ${chalk16.cyan(data.template.natural_language ?? data.template.expression ?? data.template.every_interval ?? "")}`);
+    success(`Recurring task created: ${chalk17.bold(title)}`);
+    info(`Schedule:   ${chalk17.cyan(data.template.natural_language ?? data.template.expression ?? data.template.every_interval ?? "")}`);
     info(`Next spawn: ${formatSpawnTime(data.template.next_spawn_at, data.template.timezone)}`);
     info(`Timezone:   ${data.template.timezone}`);
   } catch (err) {
@@ -2652,7 +2794,7 @@ async function kanbanRecurringListCommand(opts) {
       t.title,
       t.natural_language ?? t.expression ?? t.every_interval ?? "\u2014",
       priorityLabel(t.priority),
-      t.enabled ? chalk16.green("Active") : chalk16.dim("Disabled"),
+      t.enabled ? chalk17.green("Active") : chalk17.dim("Disabled"),
       formatSpawnTime(t.next_spawn_at, t.timezone),
       String(t.spawn_count)
     ]);
@@ -2709,7 +2851,7 @@ async function kanbanRecurringDisableCommand(titleOrId, opts) {
     if (json) {
       jsonOutput({ ok: true, id: match.id, title: match.title, enabled: false });
     } else {
-      success(`Disabled: ${chalk16.bold(match.title)}`);
+      success(`Disabled: ${chalk17.bold(match.title)}`);
     }
   } catch (err) {
     spinner.fail("Failed to disable recurring template");
@@ -2726,7 +2868,7 @@ async function kanbanRecurringDisableCommand(titleOrId, opts) {
 import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5 } from "fs";
 import { join as join10, dirname } from "path";
 import { homedir as homedir2 } from "os";
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 import ora13 from "ora";
 function detectShellProfile() {
   const shell = process.env["SHELL"] ?? "";
@@ -2779,7 +2921,7 @@ async function setupCommand(token) {
   if (!apiUrl) {
     apiUrl = "https://api.augmented.team";
     if (!json) {
-      info(`No AGT_HOST set \u2014 using default: ${chalk17.bold(apiUrl)}`);
+      info(`No AGT_HOST set \u2014 using default: ${chalk18.bold(apiUrl)}`);
     }
   }
   const spinner = ora13({ text: "Exchanging provisioning token\u2026", isSilent: json });
@@ -2816,11 +2958,11 @@ async function setupCommand(token) {
     const exchange = await exchangeApiKey(setupResult.api_key);
     verifySpinner.succeed("Connection verified");
     if (!json) {
-      info(`Host:       ${chalk17.bold(setupResult.host_name)}`);
+      info(`Host:       ${chalk18.bold(setupResult.host_name)}`);
       info(`Host ID:    ${exchange.hostId}`);
-      info(`Team:       ${chalk17.bold(exchange.teamSlug ?? setupResult.team_slug ?? "unknown")}`);
+      info(`Team:       ${chalk18.bold(exchange.teamSlug ?? setupResult.team_slug ?? "unknown")}`);
       if (exchange.userEmail) {
-        info(`User:       ${chalk17.bold(exchange.userEmail)}`);
+        info(`User:       ${chalk18.bold(exchange.userEmail)}`);
       }
     }
   } catch (err) {
@@ -2859,7 +3001,7 @@ async function setupCommand(token) {
   writeFileSync5(profilePath, updated.endsWith("\n") ? updated : `${updated}
 `);
   if (!json) {
-    success(`Environment variables written to ${chalk17.bold(profilePath)}`);
+    success(`Environment variables written to ${chalk18.bold(profilePath)}`);
   }
   const managerSpinner = ora13({ text: "Starting manager daemon\u2026", isSilent: json });
   managerSpinner.start();
@@ -2881,25 +3023,30 @@ async function setupCommand(token) {
       host_id: setupResult.host_id,
       team_slug: setupResult.team_slug,
       api_url: finalApiUrl,
+      // Host API key — exposed only in JSON mode so bootstrap/automation can
+      // persist it system-wide. The token the caller just supplied grants
+      // access to this key anyway; re-emitting it here just saves the caller
+      // from having to parse the shell profile we wrote.
+      api_key: setupResult.api_key,
       agents: setupResult.agents,
       profile: profilePath
     });
   } else {
     console.log();
-    console.log(chalk17.green.bold("  Setup complete!"));
+    console.log(chalk18.green.bold("  Setup complete!"));
     console.log();
     if (setupResult.agents.length > 0) {
-      info(`Agents:     ${setupResult.agents.map((a) => chalk17.cyan(a)).join(", ")}`);
+      info(`Agents:     ${setupResult.agents.map((a) => chalk18.cyan(a)).join(", ")}`);
     } else {
       info("No agents assigned yet. Assign agents in the dashboard or with: agt host assign");
     }
     console.log();
-    info(`Restart your shell or run: ${chalk17.bold(`source ${profilePath}`)}`);
+    info(`Restart your shell or run: ${chalk18.bold(`source ${profilePath}`)}`);
   }
 }
 
 // src/commands/kanban.ts
-import chalk18 from "chalk";
+import chalk19 from "chalk";
 import ora14 from "ora";
 async function resolveAgentId2(codeName) {
   try {
@@ -2910,14 +3057,14 @@ async function resolveAgentId2(codeName) {
   }
 }
 function priorityLabel2(p) {
-  return p === 1 ? chalk18.red("HIGH") : p === 3 ? chalk18.dim("LOW") : chalk18.yellow("MED");
+  return p === 1 ? chalk19.red("HIGH") : p === 3 ? chalk19.dim("LOW") : chalk19.yellow("MED");
 }
 function statusLabel(s) {
   const map = {
-    in_progress: chalk18.blue("In Progress"),
-    today: chalk18.green("Today"),
-    backlog: chalk18.dim("Backlog"),
-    done: chalk18.gray("Done")
+    in_progress: chalk19.blue("In Progress"),
+    today: chalk19.green("Today"),
+    backlog: chalk19.dim("Backlog"),
+    done: chalk19.gray("Done")
   };
   return map[s] ?? s;
 }
@@ -2953,7 +3100,7 @@ async function kanbanListCommand(opts) {
       item.estimated_minutes ? `~${item.estimated_minutes}min` : "",
       item.id.slice(0, 8)
     ]);
-    console.log(chalk18.bold(`
+    console.log(chalk19.bold(`
 Kanban: ${opts.agent}
 `));
     table(["Pri", "Status", "Title", "Est", "ID"], rows);
@@ -3193,7 +3340,7 @@ function getAcpAgent(name) {
 }
 
 // ../../packages/core/dist/acp/client.js
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 function resolveAgentCommand(agentName) {
   const adapter = getAcpAgent(agentName);
   if (adapter) {
@@ -3209,7 +3356,7 @@ function resolveAgentCommand(agentName) {
 }
 async function runAcpx(args, options = {}) {
   return new Promise((resolve2) => {
-    const child = spawn("acpx", args, {
+    const child = spawn2("acpx", args, {
       cwd: options.cwd,
       stdio: ["pipe", "pipe", "pipe"],
       env: { ...process.env }
@@ -3409,9 +3556,9 @@ async function acpxCloseCommand(agent2, _opts, cmd) {
 
 // src/commands/update.ts
 import { execSync } from "child_process";
-import chalk19 from "chalk";
+import chalk20 from "chalk";
 import ora15 from "ora";
-var cliVersion = true ? "0.10.8" : "dev";
+var cliVersion = true ? "0.10.10" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -3490,13 +3637,13 @@ async function updateCommand(opts = {}) {
     if (json) {
       jsonOutput({ ok: true, current: cliVersion, latest: versionInfo.latest, update_available: false });
     } else {
-      success(`You're on the latest version (${chalk19.bold(cliVersion)})`);
+      success(`You're on the latest version (${chalk20.bold(cliVersion)})`);
     }
     return;
   }
   spinner.stop();
   if (!json) {
-    info(`Update available: ${chalk19.dim(cliVersion)} \u2192 ${chalk19.bold.green(versionInfo.latest)}`);
+    info(`Update available: ${chalk20.dim(cliVersion)} \u2192 ${chalk20.bold.green(versionInfo.latest)}`);
     if (versionInfo.changelog_url) {
       info(`Changelog: ${versionInfo.changelog_url}`);
     }
@@ -3507,16 +3654,16 @@ async function updateCommand(opts = {}) {
       if (!json) {
         warn("Active processes detected:");
         if (managerPid) {
-          console.error(chalk19.yellow(`  \u2022 Manager process running (PID ${managerPid})`));
+          console.error(chalk20.yellow(`  \u2022 Manager process running (PID ${managerPid})`));
         }
         if (tmuxSessions.length > 0) {
-          console.error(chalk19.yellow(`  \u2022 ${tmuxSessions.length} active agent session(s): ${tmuxSessions.join(", ")}`));
+          console.error(chalk20.yellow(`  \u2022 ${tmuxSessions.length} active agent session(s): ${tmuxSessions.join(", ")}`));
         }
         console.error();
         warn("Updating while the manager is running will leave it on the old version until restarted.");
         warn("Active agent sessions will continue with stale MCP servers.");
         console.error();
-        info(`Run ${chalk19.bold("agt update --force")} to update anyway, then restart the manager.`);
+        info(`Run ${chalk20.bold("agt update --force")} to update anyway, then restart the manager.`);
       } else {
         jsonOutput({
           ok: false,
@@ -3548,8 +3695,8 @@ async function updateCommand(opts = {}) {
         updated: true
       });
     } else {
-      success(`Updated to ${chalk19.bold(versionInfo.latest)}`);
-      info(`If you have a running manager, restart it: ${chalk19.bold("agt manager stop && agt manager start")}`);
+      success(`Updated to ${chalk20.bold(versionInfo.latest)}`);
+      info(`If you have a running manager, restart it: ${chalk20.bold("agt manager stop && agt manager start")}`);
     }
   } catch (err) {
     updateSpinner.fail("Update failed");
@@ -3575,8 +3722,8 @@ async function checkForUpdateOnStartup() {
     if (!versionInfo) return;
     if (isNewerVersion(cliVersion, versionInfo.latest)) {
       console.error(
-        chalk19.yellow(`
-  Update available: ${cliVersion} \u2192 ${versionInfo.latest}. Run ${chalk19.bold("agt update")} to install.`) + chalk19.dim("\n  Note: Restart the manager after updating.\n")
+        chalk20.yellow(`
+  Update available: ${cliVersion} \u2192 ${versionInfo.latest}. Run ${chalk20.bold("agt update")} to install.`) + chalk20.dim("\n  Note: Restart the manager after updating.\n")
       );
     }
   } catch {
@@ -3584,7 +3731,7 @@ async function checkForUpdateOnStartup() {
 }
 
 // src/commands/plugin.ts
-import chalk20 from "chalk";
+import chalk21 from "chalk";
 import ora16 from "ora";
 async function pluginListCommand() {
   const json = isJsonMode();
@@ -3600,11 +3747,11 @@ async function pluginListCommand() {
       info("No plugins found for this team.");
       return;
     }
-    console.log(chalk20.bold("\nAvailable Plugins:\n"));
+    console.log(chalk21.bold("\nAvailable Plugins:\n"));
     for (const p of data) {
-      const statusColor = p.status === "published" ? chalk20.green : p.status === "archived" ? chalk20.gray : chalk20.yellow;
+      const statusColor = p.status === "published" ? chalk21.green : p.status === "archived" ? chalk21.gray : chalk21.yellow;
       console.log(
-        `  ${chalk20.bold(p.name)} ${chalk20.dim(`(${p.slug})`)}  ${statusColor(p.status)} v${p.version}  ${chalk20.dim(`${p.skills?.length ?? 0} skills, ${p.defined_scopes?.length ?? 0} scopes`)}`
+        `  ${chalk21.bold(p.name)} ${chalk21.dim(`(${p.slug})`)}  ${statusColor(p.status)} v${p.version}  ${chalk21.dim(`${p.skills?.length ?? 0} skills, ${p.defined_scopes?.length ?? 0} scopes`)}`
       );
     }
     console.log();
@@ -3631,21 +3778,21 @@ async function pluginShowCommand(slug) {
       jsonOutput({ plugin: plugin2, scopes });
       return;
     }
-    console.log(chalk20.bold(`
-${plugin2.name}`), chalk20.dim(`(${plugin2.slug})`));
-    if (plugin2.description) console.log(chalk20.dim(plugin2.description));
+    console.log(chalk21.bold(`
+${plugin2.name}`), chalk21.dim(`(${plugin2.slug})`));
+    if (plugin2.description) console.log(chalk21.dim(plugin2.description));
     console.log();
     console.log(`  Status:    ${plugin2.status} v${plugin2.version}`);
     console.log(`  Category:  ${plugin2.category}`);
     console.log(`  Toolkits:  ${plugin2.required_toolkits.join(", ") || "none"}`);
     console.log(`  Skills:    ${plugin2.skills?.length ?? 0}`);
     if (scopes.length > 0) {
-      console.log(chalk20.bold("\n  Permission Scopes:\n"));
+      console.log(chalk21.bold("\n  Permission Scopes:\n"));
       for (const s of scopes) {
-        const roleColor = s.can_grant ? chalk20.green : chalk20.red;
-        const overrideTag = s.is_overridden ? chalk20.cyan(" [team override]") : "";
+        const roleColor = s.can_grant ? chalk21.green : chalk21.red;
+        const overrideTag = s.is_overridden ? chalk21.cyan(" [team override]") : "";
         console.log(
-          `    ${chalk20.bold(s.id)}  ${s.name}  min: ${roleColor(s.effective_min_role)}${overrideTag}  ${s.can_grant ? chalk20.green("\u2713 grantable") : chalk20.red("\u2717 needs approval")}`
+          `    ${chalk21.bold(s.id)}  ${s.name}  min: ${roleColor(s.effective_min_role)}${overrideTag}  ${s.can_grant ? chalk21.green("\u2713 grantable") : chalk21.red("\u2717 needs approval")}`
         );
       }
     }
@@ -3696,7 +3843,7 @@ async function pluginInstallCommand(slug, options) {
       const needsApproval = err.body["needs_approval"];
       error("Some scopes exceed your role ceiling:");
       for (const s of needsApproval) {
-        console.log(chalk20.yellow(`  - ${s}`));
+        console.log(chalk21.yellow(`  - ${s}`));
       }
       info("To request elevated scopes, use the web dashboard or contact your team admin.");
       process.exitCode = 1;
@@ -3750,10 +3897,10 @@ async function pluginRequestsCommand() {
       info("No pending scope requests.");
       return;
     }
-    console.log(chalk20.bold("\nPending Scope Requests:\n"));
+    console.log(chalk21.bold("\nPending Scope Requests:\n"));
     for (const r of requests) {
-      console.log(`  ${chalk20.bold(r.id)}  scopes: ${r.requested_scopes.join(", ")}`);
-      if (r.reason) console.log(`    reason: ${chalk20.dim(r.reason)}`);
+      console.log(`  ${chalk21.bold(r.id)}  scopes: ${r.requested_scopes.join(", ")}`);
+      if (r.reason) console.log(`    reason: ${chalk21.dim(r.reason)}`);
       console.log(`    status: ${r.status}  requested: ${r.created_at}`);
       console.log();
     }
@@ -3810,7 +3957,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.10.8" : "dev";
+var cliVersion2 = true ? "0.10.10" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", (thisCommand) => {
@@ -3850,6 +3997,12 @@ host.command("unassign <host-name> <agent-code-names...>").description("Unassign
 host.command("agents [host-name]").description("List agents assigned to a host (omit name to auto-resolve from AGT_API_KEY)").action(hostAgentsCommand);
 host.command("rotate-key <host-name>").description("Rotate the API key for a host (revokes the old key)").action(hostRotateKeyCommand);
 host.command("decommission <host-name>").description("Decommission a host (revokes key, marks inactive)").action(hostDecommissionCommand);
+host.command("pair <host-name>").description("Start an SSM port-forward + shell to re-authenticate Claude Code on an EC2 host").option("--port <port>", "Local port to forward for the OAuth callback", "54545").option("--no-shell", "Start the tunnel only; do not open an interactive shell").action(
+  (hostName, opts) => hostPairCommand(hostName, {
+    port: opts.port,
+    noShell: opts.shell === false
+  })
+);
 var manager = program.command("manager").description("Host config sync daemon \u2014 keeps local agent files in sync with API");
 manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join11(homedir3(), ".augmented")).action(managerStartCommand);
 manager.command("stop").description("Stop the running manager daemon").action(managerStopCommand);