@integrity-labs/agt-cli 0.28.44 → 0.28.45

package/dist/bin/agt.js

@@ -37,7 +37,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-HQHLMAIW.js";
+} from "../chunk-YEAHEXU7.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -4777,7 +4777,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.44" : "dev";
+var cliVersion = true ? "0.28.45" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5787,7 +5787,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.44" : "dev";
+var cliVersion2 = true ? "0.28.45" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-HQHLMAIW.js → chunk-YEAHEXU7.js}

@@ -7259,7 +7259,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.44" : "dev";
+var agtCliVersion = true ? "0.28.45" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8540,4 +8540,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-HQHLMAIW.js.map
+//# sourceMappingURL=chunk-YEAHEXU7.js.map

package/dist/lib/manager-worker.js

@@ -27,7 +27,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-HQHLMAIW.js";
+} from "../chunk-YEAHEXU7.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -6626,7 +6626,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.44" : "dev";
+var agtCliVersion = true ? "0.28.45" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/augmented-admin.js

@@ -21182,6 +21182,19 @@ var AdminDebugClient = class _AdminDebugClient {
       run_id: this.runId
     });
   }
+  /** Request a HITL-gated, allowlisted diagnostic SSM run (ENG-6442). */
+  requestSsmRun(args) {
+    if (!this.agentId) {
+      throw makeError(400, "AdminDebugClient.requestSsmRun requires agentId (set AGT_AGENT_ID)");
+    }
+    return this.post("/admin/debug/actions/ssm-run", {
+      target_agent_id: args.target_agent_id,
+      command_key: args.command,
+      reason: args.reason,
+      agent_id: this.agentId,
+      run_id: this.runId
+    });
+  }
   /** Poll a remedial action's HITL decision. */
   getActionStatus(requestId) {
     return this.get(`/admin/debug/actions/${encodeURIComponent(requestId)}`);
@@ -21259,7 +21272,14 @@ var requestConfigUpdateSchema = external_exports.object({
   reason: external_exports.string().min(1).max(2e3).describe("Why this change is needed \u2014 shown verbatim to the human approver. Be specific.")
 });
 var checkActionStatusSchema = external_exports.object({
-  request_id: external_exports.string().min(1).max(64).describe("The action request_id returned by request_action or request_config_update.")
+  request_id: external_exports.string().min(1).max(64).describe("The action request_id returned by request_action, request_config_update, or request_ssm_run.")
+});
+var requestSsmRunSchema = external_exports.object({
+  target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent whose host to run the diagnostic on."),
+  command: external_exports.enum(["host_health", "manager_status", "manager_journal", "process_list", "agent_dir"]).describe(
+    "The allowlisted, READ-ONLY diagnostic to run (closed set \u2014 no free-form shell). host_health = uptime + df -h + free -m (is the box wedged / out of disk / out of memory?); manager_status = systemctl status agt-manager.service (is the manager daemon up?); manager_journal = journalctl -u agt-manager.service -n 200 (recent systemd-captured manager output); process_list = ps (pid/ppid/user/etime/rss/comm, no argv/env) filtered to claude + agt-manager; agent_dir = ls -la ~/.augmented/<code_name>/ (file NAMES only \u2014 stuck markers, state files; never contents). For file CONTENTS use debug_tail_logs (it covers manager.log/pane.log/channel-stderr/manager-state.json)."
+  ),
+  reason: external_exports.string().min(1).max(2e3).describe("Why this diagnostic is needed \u2014 shown verbatim to the human approver. Be specific.")
 });
 var queryAuditLogSchema = external_exports.object({
   agent_id: external_exports.string().min(1).max(64).optional().describe(
@@ -21498,9 +21518,26 @@ server.tool(
     }
   }
 );
+server.tool(
+  "request_ssm_run",
+  "Request a HITL-gated, ALLOWLISTED read-only DIAGNOSTIC command on a customer agent's host over SSM \u2014 the escape hatch for host/process/service facts the typed read tools (debug_get_agent, debug_tail_logs, debug_host_versions) don't cover. A HUMAN must approve the EXACT command in Slack before it runs, and only if writes are armed (shadow mode runs the approval but executes nothing). This is NOT a shell: `command` is a CLOSED enum \u2014 host_health (uptime/df/free), manager_status (systemctl status agt-manager), manager_journal (journalctl -n 200), process_list (ps comm-only, no argv/env), agent_dir (ls -la ~/.augmented/<code_name>/, names only). No free-form commands, no file-content reads (use debug_tail_logs for log contents). Async: returns { request_id, status, write_mode, command_key, resolved_command, notification_status }; after approval, poll check_action_status to read the command OUTPUT in result_payload. Pass { target_agent_id, command, reason }.",
+  requestSsmRunSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.requestSsmRun({
+        target_agent_id: args.target_agent_id,
+        command: args.command,
+        reason: args.reason
+      });
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.tool(
   "check_action_status",
-  "Poll the decision on a remedial action you requested (the approval result is also pushed to you via direct-chat). Returns { status, result_payload, denial_reason, resolved_at }. Pass { request_id }.",
+  "Poll the decision on a remedial action you requested (the approval result is also pushed to you via direct-chat). Returns { status, result_payload, denial_reason, resolved_at } \u2014 for an approved request_ssm_run, result_payload carries the command output. Pass { request_id }.",
   checkActionStatusSchema.shape,
   async (args) => {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.44",
+  "version": "0.28.45",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {