@integrity-labs/agt-cli 0.27.150 → 0.27.152

package/dist/mcp/augmented-admin.js

@@ -21097,6 +21097,22 @@ var AdminDebugClient = class _AdminDebugClient {
   listAlerts(args) {
     return this.get("/admin/debug/alerts", _AdminDebugClient.cleanQuery(args));
   }
+  // ─────────────────── request-scoped customer grant (ENG-6279) ───────────────────
+  /**
+   * Open scoped READ access to a SELF-MANAGED customer org so the read tools can
+   * reach it (ENG-6279). POSTs to /admin/debug/grants, which mints the short-TTL,
+   * logged, customer-revocable read grant; the read tools then return that org's
+   * data for the grant's lifetime. Reuses `post()` — same token + 401-re-exchange
+   * flow as the reads. For an already-standing org (is_internal / fully_managed)
+   * the API returns `{ already_authorized: true }` instead of minting a redundant
+   * grant — not an error.
+   */
+  requestAccess(args) {
+    return this.post("/admin/debug/grants", {
+      target_org_id: args.target_org_id,
+      reason: args.reason
+    });
+  }
   // ─────────────────────── remedial actions (ENG-6197) ───────────────────────
   async post(path, body, retried = false) {
     const token = await this.getValidToken();
@@ -21167,6 +21183,12 @@ var listAlertsSchema = external_exports.object({
   open: external_exports.boolean().optional().describe("When true, only currently-open (unclosed) alerts."),
   limit: limitSchema
 });
+var requestAccessSchema = external_exports.object({
+  target_org_id: external_exports.string().min(1).max(64).describe("UUID of the customer organization to open scoped read access to."),
+  reason: external_exports.string().min(1).max(2e3).describe(
+    "Why access is needed \u2014 recorded on the customer-visible access log and shown to the org when they review or revoke it. Be specific."
+  )
+});
 var requestActionSchema = external_exports.object({
   action: external_exports.enum(["restart", "clear_pending_inbound"]).describe(
     "The remedial action. restart = bounce the agent (reversible; backlog replays). clear_pending_inbound = move stuck pending-inbound markers aside (drops queued inbound messages; they are NOT reprocessed)."
@@ -21181,7 +21203,7 @@ var checkActionStatusSchema = external_exports.object({
 // package.json
 var package_default = {
   name: "@integrity-labs/augmented-admin-mcp",
-  version: "0.1.0",
+  version: "0.1.1",
   description: "Augmented Admin Debug \u2014 Integrity Labs staff-only MCP server for cross-org agent/host/integration/alert diagnostics. Thin client over the Augmented API's /admin/debug/* surface; authority + the diagnostic projection live server-side. ENG-6195.",
   type: "module",
   private: true,
@@ -21249,7 +21271,7 @@ function formatError2(err) {
 var server = new McpServer({ name: "augmented-admin-mcp", version: package_default.version });
 server.tool(
   "debug_search_agents",
-  "Search managed end-user agents across all orgs for troubleshooting. Returns a diagnostic projection per agent (code_name, status, environment, risk_tier, org, heartbeat verdict) \u2014 never credentials or transcripts. Filter with { q, status, environment, limit }.",
+  "Search managed end-user agents across authorized orgs for troubleshooting. Returns a diagnostic projection per agent (code_name, status, environment, risk_tier, org, heartbeat verdict) \u2014 never credentials or transcripts. Authorized = IL-owned + fully-managed orgs (standing) plus any self-managed org you hold an active grant for (see debug_request_access). Filter with { q, status, environment, limit }.",
   searchAgentsSchema.shape,
   async (args) => {
     try {
@@ -21275,7 +21297,7 @@ server.tool(
 );
 server.tool(
   "debug_search_hosts",
-  "Search managed hosts across all orgs. Returns a projection per host (name, org, status, framework version, last-seen verdict, EC2 + Claude auth status) \u2014 no api-key fingerprints or secrets. Filter with { q, status, limit }.",
+  "Search managed hosts across authorized orgs. Returns a projection per host (name, org, status, framework version, last-seen verdict, EC2 + Claude auth status) \u2014 no api-key fingerprints or secrets. Filter with { q, status, limit }.",
   searchHostsSchema.shape,
   async (args) => {
     try {
@@ -21288,7 +21310,7 @@ server.tool(
 );
 server.tool(
   "debug_list_alerts",
-  "List recent platform alerts across all orgs (host-down, agent-stale, probe-timeout, auth-failed), including NULL-team host alerts. Returns a projection per alert (kind, severity, message, source, open/closed state). Filter with { severity, open, limit }.",
+  "List recent platform alerts across authorized orgs (host-down, agent-stale, probe-timeout, auth-failed), including NULL-team host alerts. Returns a projection per alert (kind, severity, message, source, open/closed state). Filter with { severity, open, limit }.",
   listAlertsSchema.shape,
   async (args) => {
     try {
@@ -21299,6 +21321,22 @@ server.tool(
     }
   }
 );
+server.tool(
+  "debug_request_access",
+  "Open scoped READ access to a SELF-MANAGED customer org so the read tools (debug_search_agents / debug_get_agent / debug_search_hosts / debug_list_alerts) can reach it. Use this when a read returns nothing for an org you have a legitimate support reason to troubleshoot. It mints a short-TTL, logged, customer-revocable read grant \u2014 the customer sees the access in their Support-access console and can revoke it, and it auto-expires; it does NOT grant any write/remedial capability. For an already-authorized org (Integrity-Labs-internal or fully-managed) this returns { already_authorized: true } instead of minting a redundant grant \u2014 just use the read tools. Pass { target_org_id, reason }; the reason is recorded verbatim on the customer-visible access log, so be specific.",
+  requestAccessSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.requestAccess({
+        target_org_id: args.target_org_id,
+        reason: args.reason
+      });
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.tool(
   "request_action",
   `Request a HITL-gated remedial action on a customer agent: "restart" (bounce the agent \u2014 reversible, backlog replays) or "clear_pending_inbound" (move stuck pending-inbound markers aside \u2014 drops queued inbound messages, NOT reprocessed). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { action, target_agent_id, reason }.`,

package/dist/{persistent-session-ZLEK4KBF.js → persistent-session-THI6WSPJ.js}

@@ -25,8 +25,8 @@ import {
   takeAcpxExecFailureCount,
   takeZombieDetection,
   writePersistentClaudeWrapper
-} from "./chunk-JLS7NQFE.js";
-import "./chunk-A75AOK6E.js";
+} from "./chunk-FF37P4BH.js";
+import "./chunk-FZTGR2AQ.js";
 import "./chunk-XWVM4KPK.js";
 export {
   SEND_KEYS_ENTER_DELAY_MS,
@@ -56,4 +56,4 @@ export {
   takeZombieDetection,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-ZLEK4KBF.js.map
+//# sourceMappingURL=persistent-session-THI6WSPJ.js.map

package/dist/{responsiveness-probe-3EUNCJDU.js → responsiveness-probe-UFF2EBGZ.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-JLS7NQFE.js";
-import "./chunk-A75AOK6E.js";
+} from "./chunk-FF37P4BH.js";
+import "./chunk-FZTGR2AQ.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -154,4 +154,4 @@ export {
   livePendingInboundOldestAgeSeconds,
   oldestLivePendingInboundMtimeMs
 };
-//# sourceMappingURL=responsiveness-probe-3EUNCJDU.js.map
+//# sourceMappingURL=responsiveness-probe-UFF2EBGZ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.27.150",
+  "version": "0.27.152",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {