@integrity-labs/agt-cli 0.27.129 → 0.27.131

package/dist/{chunk-A64MR5QP.js → chunk-AFDMWEXL.js}

@@ -9,7 +9,7 @@ import {
   parseDeliveryTarget,
   registerFramework,
   wrapScheduledTaskPrompt
-} from "./chunk-MH7HA6QV.js";
+} from "./chunk-74UWAA3V.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -49,7 +49,13 @@ var INTEGRATION_REGISTRY = [
       binary: "gh",
       env_key: "GITHUB_TOKEN",
       skill_id: "gh-cli",
-      installer: "brew"
+      // ENG-6206: `brew` never installs on the Linux fleet (root-on-AL2023,
+      // no Homebrew) — gh was permanently missing. Use an OS-detecting script
+      // that installs from GitHub's official repos: dnf (AL2023 / RHEL),
+      // apt (Debian / Ubuntu), and brew (macOS hosts). The catalog is the
+      // trust boundary — this string is source-controlled, never runtime data.
+      installer: "script",
+      script: 'if command -v dnf >/dev/null 2>&1; then curl -fsSL https://cli.github.com/packages/rpm/gh-cli.repo -o /etc/yum.repos.d/gh-cli.repo && dnf install -y gh; elif command -v apt-get >/dev/null 2>&1; then curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /usr/share/keyrings/githubcli-archive-keyring.gpg && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list && apt-get update && apt-get install -y gh; elif command -v brew >/dev/null 2>&1; then brew install gh; else echo "gh: no supported installer (need dnf, apt-get, or brew)" >&2; exit 1; fi'
     }
   },
   {
@@ -381,6 +387,24 @@ var INTEGRATION_REGISTRY = [
       }
     }
   },
+  {
+    // ENG-6195: admin-only debugging surface for Integrity Labs STAFF agents.
+    // Provisions the @integrity-labs/augmented-admin-mcp stdio broker, which
+    // reads end-user agent diagnostics cross-org via /admin/debug/*. `beta` so
+    // it is visible/enable-able only by admin-email-domain users; the API
+    // double-gates every call on the caller's owning org `is_internal = true`.
+    // auth `none` — no end-user OAuth; the host JWT (org_id claim) is the
+    // credential. NOT a customer integration; do not promote to `published`.
+    id: "augmented-admin",
+    name: "Augmented Admin Debug",
+    category: "infrastructure",
+    description: "Integrity Labs staff-only: cross-org agent/host/integration/alert diagnostics for troubleshooting managed agents.",
+    supported_auth_types: ["none"],
+    beta: true,
+    capabilities: [
+      { id: "augmented-admin:read-diagnostics", name: "Read Diagnostics", description: "Cross-org read of agent, host, integration, and alert diagnostics (projection only \u2014 never credentials or transcripts).", access: "read" }
+    ]
+  },
   {
     id: "custom",
     name: "Custom Integration",
@@ -5115,6 +5139,21 @@ function buildMcpJson(input) {
       }
     };
   }
+  const hasAdminDebug = input.integrations?.some((i) => i.definition_id === "augmented-admin") ?? false;
+  if (hasAdminDebug) {
+    mcpServers["augmented-admin"] = {
+      command: "npx",
+      args: ["-y", "@integrity-labs/augmented-admin-mcp@latest"],
+      env: {
+        AGT_HOST: "${AGT_HOST}",
+        AGT_AGENT_ID: input.agent.agent_id,
+        AGT_RUN_ID: "${AGT_RUN_ID}",
+        AGT_API_KEY: "${AGT_API_KEY}",
+        PATH: process.env["PATH"] ?? "",
+        HOME: process.env["HOME"] ?? ""
+      }
+    };
+  }
   return { mcpServers };
 }
 function parseIntervalMinutes(scheduleEvery) {
@@ -5956,15 +5995,30 @@ ${sections}`
     for (const integration of decryptedIntegrations) {
       const prefix = integration.definition_id.toUpperCase().replace(/[^A-Z0-9]/g, "_");
       const creds = integration.credentials;
+      const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+      let token;
       if (integration.auth_type === "oauth2") {
-        const accessToken = creds.access_token;
-        if (accessToken) {
-          envUpdates[`${prefix}_ACCESS_TOKEN`] = accessToken;
+        token = creds.access_token;
+        if (token) {
+          envUpdates[`${prefix}_ACCESS_TOKEN`] = token;
         }
       } else if (integration.auth_type === "api_key") {
-        const apiKey = creds.api_key;
-        if (apiKey) {
-          envUpdates[`${prefix}_API_KEY`] = apiKey;
+        token = creds.api_key;
+        if (token) {
+          envUpdates[`${prefix}_API_KEY`] = token;
+        }
+      }
+      if (def?.cli_tool) {
+        const { env_key, extra_env } = def.cli_tool;
+        if (env_key && token && !(env_key in envUpdates)) {
+          envUpdates[env_key] = token;
+        }
+        if (extra_env) {
+          for (const [k, v] of Object.entries(extra_env)) {
+            if (typeof v === "string" && v && !(k in envUpdates)) {
+              envUpdates[k] = v;
+            }
+          }
         }
       }
       if (integration.config) {
@@ -6084,6 +6138,21 @@ ${sections}`
         });
       }
     }
+    const hasAdminDebug = integrations.some((i) => i.definition_id === "augmented-admin");
+    if (hasAdminDebug) {
+      this.writeMcpServer(codeName, "augmented-admin", {
+        command: "npx",
+        args: ["-y", "@integrity-labs/augmented-admin-mcp@latest"],
+        env: {
+          AGT_HOST: "${AGT_HOST}",
+          AGT_AGENT_ID: resolveBrokerAgentId(codeName) ?? agentId ?? "",
+          AGT_RUN_ID: "${AGT_RUN_ID}",
+          AGT_API_KEY: "${AGT_API_KEY}",
+          PATH: process.env["PATH"] ?? "",
+          HOME: process.env["HOME"] ?? ""
+        }
+      });
+    }
     if (this.removeMcpServer) {
       const nativeMcpKeys = INTEGRATION_REGISTRY.filter((d) => d.nativeMcp !== void 0).map((d) => d.nativeMcp.key ?? d.id);
       const integrationDerivedKeys = /* @__PURE__ */ new Set([
@@ -6091,6 +6160,7 @@ ${sections}`
         "postiz",
         "cloud-broker",
         "xero-broker",
+        "augmented-admin",
         ...nativeMcpKeys,
         ...Object.entries(OAUTH_PROVIDERS).filter(([, provider]) => Boolean(provider.mcpUrl)).map(([id]) => id)
       ]);
@@ -6103,6 +6173,8 @@ ${sections}`
         expectedKeys.add("cloud-broker");
       if (hasXeroBroker)
         expectedKeys.add("xero-broker");
+      if (hasAdminDebug)
+        expectedKeys.add("augmented-admin");
       for (const integration of integrations) {
         const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
         if (def?.nativeMcp) {
@@ -7653,4 +7725,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-A64MR5QP.js.map
+//# sourceMappingURL=chunk-AFDMWEXL.js.map