@integrity-labs/agt-cli 0.28.39 → 0.28.41

package/dist/mcp/augmented-admin.js

@@ -21097,6 +21097,12 @@ var AdminDebugClient = class _AdminDebugClient {
   listAlerts(args) {
     return this.get("/admin/debug/alerts", _AdminDebugClient.cleanQuery(args));
   }
+  hostVersions(args) {
+    return this.get("/admin/debug/host-versions", _AdminDebugClient.cleanQuery(args));
+  }
+  tailLogs(args) {
+    return this.get("/admin/debug/tail-logs", _AdminDebugClient.cleanQuery(args));
+  }
   queryAuditLog(args) {
     return this.get("/admin/debug/audit-log", _AdminDebugClient.cleanQuery(args));
   }
@@ -21195,6 +21201,23 @@ var searchHostsSchema = external_exports.object({
   status: external_exports.string().max(32).optional().describe("Filter by host status (active | decommissioned)."),
   limit: limitSchema
 });
+var hostVersionsSchema = external_exports.object({
+  q: external_exports.string().max(128).optional().describe("Case-insensitive substring match on host name."),
+  status: external_exports.string().max(32).optional().describe("Filter by host status (active | decommissioned)."),
+  since_hours: external_exports.number().int().min(1).max(720).optional().describe("Window for the restart count, in hours. Default 24."),
+  limit: limitSchema
+});
+var tailLogsSchema = external_exports.object({
+  agent_id: external_exports.string().min(1).max(64).describe(
+    "UUID of the agent whose host log to tail. Fails closed (uniform not-found) if you are not authorized for its org."
+  ),
+  log: external_exports.enum(["manager", "pane", "slack-stderr", "telegram-stderr", "manager-state"]).optional().describe(
+    `Which host log to read (default manager). manager = manager.log (lifecycle / respawn / wedge lines); pane = pane.log (the tmux pane \u2014 the agent's visible I/O, what it was "actually doing"); slack-stderr / telegram-stderr = that channel MCP's stderr (crash diagnosis); manager-state = manager-state.json (current per-agent state snapshot).`
+  ),
+  lines: external_exports.number().int().min(1).max(2e3).optional().describe(
+    "Trailing lines to return (default 200, max 2000). Output is also byte-capped (~20 KB, newest kept) to stay within SSM limits \u2014 `truncated` flags when it clipped."
+  )
+});
 var listAlertsSchema = external_exports.object({
   severity: external_exports.string().max(16).optional().describe("Filter by severity (critical | warning | info)."),
   open: external_exports.boolean().optional().describe("When true, only currently-open (unclosed) alerts."),
@@ -21225,8 +21248,15 @@ var checkActionStatusSchema = external_exports.object({
   request_id: external_exports.string().min(1).max(64).describe("The action request_id returned by request_action or request_config_update.")
 });
 var queryAuditLogSchema = external_exports.object({
-  agent_id: external_exports.string().min(1).max(64).describe("UUID of the agent whose audit events to read (required \u2014 the read is scoped to this agent's org)."),
-  action: external_exports.string().max(64).optional().describe('Audit action to filter by. Defaults to "agent.restart" (restart events). e.g. "agent.restart".'),
+  agent_id: external_exports.string().min(1).max(64).optional().describe(
+    "UUID of ONE agent whose audit events to read (the read is scoped to that agent's org). Omit for a CROSS-AGENT query across all authorized orgs (optionally narrowed with org_id)."
+  ),
+  org_id: external_exports.string().min(1).max(64).optional().describe(
+    "CROSS-AGENT mode only: narrow the sweep to a single org you are authorized for. Ignored when agent_id is set. Omit to read every authorized org."
+  ),
+  action: external_exports.string().max(64).optional().describe(
+    'Audit action to filter by. Defaults to "agent.restart" (restart events). Pass the sentinel "all" to drop the action filter and read every action (still bounded by limit + since_hours).'
+  ),
   since_hours: external_exports.number().int().min(1).max(720).optional().describe("Only events newer than this many hours. Omit for no time bound."),
   limit: limitSchema
 });
@@ -21352,9 +21382,35 @@ server.tool(
     }
   }
 );
+server.tool(
+  "debug_host_versions",
+  'Fleet-wide host health snapshot for triaging "which host is unhealthy?". Returns a projection per authorized host: { id, name, org, framework, framework_version (the Claude Code version the host runs), last_seen_verdict, agent_count, restart_count, restart_window_hours }. `restart_count` tallies `agent.restart` audit events across the host\'s agents within the window (default 24h) \u2014 a high count is the tell for a thrashing host. Use it to spot version skew (an old framework_version) or restart storms across the fleet at a glance. Filter with { q, status, since_hours, limit }.',
+  hostVersionsSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.hostVersions(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "debug_tail_logs",
+  "Live-tail an agent's HOST logs over SSM to ground-truth \"what was it actually doing?\" \u2014 the host-reaching read, used after debug_get_agent points at a sick agent. Resolves the agent's current host and returns the trailing lines of ONE allowlisted operational log: { agent_id, code_name, host, log, content (the tail), log_present, lines_requested, truncated, ssm_status }. Logs: `manager` (manager.log \u2014 respawn/wedge/lifecycle), `pane` (pane.log \u2014 the tmux pane, the agent's visible I/O, e.g. a stuck AskUserQuestion), `slack-stderr`/`telegram-stderr` (a channel MCP's crash output), `manager-state` (manager-state.json). Fails closed for an unauthorized org. Only operational logs are reachable \u2014 secret files (.mcp.json, .env.integrations) are NOT. Pass { agent_id, log?, lines? } (lines default 200, max 2000; output ~20 KB-capped, newest kept). Every call is audited as a cross-org host access.",
+  tailLogsSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.tailLogs(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.tool(
   "debug_query_audit_log",
-  'Read recent audit events for ONE agent \u2014 primarily restart events \u2014 to troubleshoot why/when it bounced. Defaults to the "agent.restart" action: each event returns { created_at, source, reason, actor_kind }, where `source` is the restart trigger (agent-self-request, channel-command, maintenance-window, stale-mcp, hot-reload-mcp, mcp-presence-reaper, day-rollover, auth-tuple-change, \u2026) and `reason` is the free-text rationale when one was given (e.g. the agent\'s own words for a request_restart). Use it when an agent went quiet or restarted unexpectedly and you want the recent restart history with reasons. Pass { agent_id, action?, since_hours?, limit? }; agent_id is required and the read is scoped to that agent\'s org (fails closed if you\'re not authorized for it). To read non-restart events pass a different `action` (e.g. "agent.auto_resumed").',
+  'Read recent audit events to troubleshoot why/when agents bounced \u2014 primarily restart events. Defaults to the "agent.restart" action: each event returns { created_at, source, reason, actor_kind, agent_id, code_name }, where `source` is the restart trigger (agent-self-request, channel-command, maintenance-window, stale-mcp, hot-reload-mcp, mcp-presence-reaper, day-rollover, auth-tuple-change, \u2026) and `reason` is the free-text rationale when one was given (e.g. the agent\'s own words for a request_restart). Two modes: (1) pass { agent_id } to scope to ONE agent (fails closed if you\'re not authorized for its org) \u2014 use when a specific agent went quiet. (2) OMIT agent_id for a CROSS-AGENT sweep across every org you\'re authorized for (optionally narrow with { org_id }) \u2014 use to spot fleet-wide restart storms or compare agents. Filter the action with `action` (pass "all" to drop the action filter and read every event type), and bound with { since_hours?, limit? }. Cross-agent results are org-walled in SQL; unauthorized orgs are invisible.',
   queryAuditLogSchema.shape,
   async (args) => {
     try {

package/dist/{persistent-session-CFELQZI7.js → persistent-session-PNY26VBX.js}

@@ -25,8 +25,8 @@ import {
   takeZombieDetection,
   writeDirectChatSessionState,
   writePersistentClaudeWrapper
-} from "./chunk-57MHPANB.js";
-import "./chunk-X5E2Q3W2.js";
+} from "./chunk-2BRF2FDJ.js";
+import "./chunk-SJUD2BWU.js";
 import "./chunk-XWVM4KPK.js";
 export {
   SEND_KEYS_ENTER_DELAY_MS,
@@ -56,4 +56,4 @@ export {
   writeDirectChatSessionState,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-CFELQZI7.js.map
+//# sourceMappingURL=persistent-session-PNY26VBX.js.map

package/dist/{responsiveness-probe-YOT3EKKN.js → responsiveness-probe-4YMZ6LXO.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-57MHPANB.js";
-import "./chunk-X5E2Q3W2.js";
+} from "./chunk-2BRF2FDJ.js";
+import "./chunk-SJUD2BWU.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -250,4 +250,4 @@ export {
   parkPendingInbound,
   readAndResetChannelDeflections
 };
-//# sourceMappingURL=responsiveness-probe-YOT3EKKN.js.map
+//# sourceMappingURL=responsiveness-probe-4YMZ6LXO.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.39",
+  "version": "0.28.41",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {