@integrity-labs/agt-cli 0.28.464 → 0.28.465

package/dist/{claude-pair-runtime-VTW57E4U.js → claude-pair-runtime-63X4ERBM.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-HRVZVAIL.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-UYMZ2MEI.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-VTW57E4U.js.map
+//# sourceMappingURL=claude-pair-runtime-63X4ERBM.js.map

package/dist/lib/manager-worker.js

@@ -42,7 +42,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-Q5GHZOXL.js";
+} from "../chunk-2X7LDBRB.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -164,7 +164,7 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-QZUECTC7.js";
+} from "../chunk-GPSEUO2D.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -9976,7 +9976,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.464" : "dev";
+var agtCliVersion = true ? "0.28.465" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -11137,7 +11137,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-HRVZVAIL.js");
+      const { collectDiagnostics } = await import("../persistent-session-UYMZ2MEI.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -11244,7 +11244,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-HRVZVAIL.js");
+      const { collectDiagnostics } = await import("../persistent-session-UYMZ2MEI.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -11358,7 +11358,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-UUVXQIQ4.js");
+      } = await import("../responsiveness-probe-WXHKKJ7N.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11422,7 +11422,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-UUVXQIQ4.js");
+        } = await import("../responsiveness-probe-WXHKKJ7N.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -14861,7 +14861,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-HRVZVAIL.js");
+        const { collectDiagnostics } = await import("../persistent-session-UYMZ2MEI.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -14911,7 +14911,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-HRVZVAIL.js");
+      const { collectDiagnostics } = await import("../persistent-session-UYMZ2MEI.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -15369,7 +15369,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-VTW57E4U.js");
+  } = await import("../claude-pair-runtime-63X4ERBM.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/augmented-admin.js

@@ -21091,6 +21091,10 @@ var AdminDebugClient = class _AdminDebugClient {
   getAgent(agentId) {
     return this.get(`/admin/debug/agents/${encodeURIComponent(agentId)}`);
   }
+  /** The agent's effective integration set — agent + team + org, scope-attributed (ENG-8271). */
+  getAgentIntegrations(agentId) {
+    return this.get(`/admin/debug/agents/${encodeURIComponent(agentId)}/integrations`);
+  }
   searchHosts(args) {
     return this.get("/admin/debug/hosts", _AdminDebugClient.cleanQuery(args));
   }
@@ -21289,6 +21293,9 @@ var searchOrgsSchema = external_exports.object({
 var getAgentSchema = external_exports.object({
   agent_id: external_exports.string().min(1).max(64).describe("The agent UUID to fetch a composite diagnostic for.")
 });
+var getAgentIntegrationsSchema = external_exports.object({
+  agent_id: external_exports.string().min(1).max(64).describe("The agent UUID whose effective integration set to resolve.")
+});
 var searchHostsSchema = external_exports.object({
   q: external_exports.string().max(128).optional().describe("Case-insensitive substring match on host name."),
   status: external_exports.string().max(32).optional().describe("Filter by host status (active | decommissioned)."),
@@ -21529,7 +21536,7 @@ server.tool(
 );
 server.tool(
   "debug_get_agent",
-  'Fetch a composite diagnostic for ONE agent: the agent projection plus its host (heartbeat verdict, framework, EC2/auth status), its integrations (status + connectivity verdicts, never credentials), and recent alerts. The primary "why is this agent unhealthy?" read. Pass { agent_id }.',
+  'Fetch a composite diagnostic for ONE agent: the agent projection plus its host (heartbeat verdict, framework, EC2/auth status), its integrations, and recent alerts. The primary "why is this agent unhealthy?" read. Never returns credentials. Pass { agent_id }.\n\nThe payload carries TWO integration reads, and confusing them produces wrong root-cause (ENG-8271):\n  \u2022 `effective_integrations` \u2014 the COMPLETE set the agent runs with: agent + team + ORG scope, each entry carrying `scope` ("agent" | "team" | "org") and `source_id`. Read THIS to answer "does this agent have integration X?". `effective_count` equals the manager\'s `Integrations provisioned for \'<code_name>\' (N)`, so the two reconcile; `by_scope`, `inherited_definition_ids`, `scopes_skipped`, `excluded_control_plane_only`, `shadowed_by_more_specific` and `duplicate_merge_keys` attribute any row that did not make the count.\n  \u2022 `agent_integrations` \u2014 PER-AGENT rows only, kept for compatibility. Team- and org-scoped installs are ABSENT. Do NOT infer "not installed" from an absence here: an org-level install is genuinely missing from this array while being fully present on the agent. Same warning ships in-payload as `agent_integrations_note`.',
   getAgentSchema.shape,
   async (args) => {
     try {
@@ -21540,6 +21547,19 @@ server.tool(
     }
   }
 );
+server.tool(
+  "debug_get_agent_integrations",
+  'Resolve ONE agent\'s EFFECTIVE integration set \u2014 the focused read for "does this agent have integration X, and where is it installed from?" (ENG-8271). Same resolution as `debug_get_agent`\'s `effective_integrations`, without the host/alerts payload.\n\nReturns { agent_id, code_name, team_id, organization_id, effective_integrations: { effective_count, by_scope, inherited_definition_ids, excluded_control_plane_only, shadowed_by_more_specific, duplicate_merge_keys, scopes_queried, scopes_skipped, integrations[] } } - the same `effective_integrations` object `debug_get_agent` returns, so one shape covers both tools. Each entry: { definition_id, display_name, connection_key, scope ("agent" | "team" | "org"), source_id, status, status_message, auth_type, last_connectivity_check_at, last_connectivity_status, consecutive_connectivity_failures, wired_verdict, last_session_tool_bind_at }. Never credentials.\n\nPrefer this over reading `agent_integrations`: TEAM/ORG-scope installs are invisible to a per-agent read, so absence there is not evidence. `effective_count` reconciles against the manager\'s `Integrations provisioned for \'<code_name>\' (N)` or the tool-bind probe\'s `due=N`; docs/runbooks/admin-debug-dogfood.md lists the benign divergences to rule out before treating a mismatch as a bug. `wired_verdict` is the host\'s last session-tool-bind result (bound | missing | unreachable | unknown), the closest available answer to "is it in the agent\'s .mcp.json right now?"; `null` means never probed, which is NOT "not wired".\n\nFails closed (uniform not-found) for an unauthorized/unknown agent; a failed scope query returns an error rather than a smaller count. Audited as a cross-org access. Pass { agent_id }.',
+  getAgentIntegrationsSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.getAgentIntegrations(args.agent_id);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.tool(
   "debug_search_hosts",
   "Search managed hosts across authorized orgs. Returns a projection per host (name, org, status, framework version, last-seen verdict, EC2 + Claude auth status) \u2014 no api-key fingerprints or secrets. Filter with { q, status, limit }.",

package/dist/{persistent-session-HRVZVAIL.js → persistent-session-UYMZ2MEI.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-QZUECTC7.js";
+} from "./chunk-GPSEUO2D.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-HRVZVAIL.js.map
+//# sourceMappingURL=persistent-session-UYMZ2MEI.js.map

package/dist/{responsiveness-probe-UUVXQIQ4.js → responsiveness-probe-WXHKKJ7N.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-QZUECTC7.js";
+} from "./chunk-GPSEUO2D.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -596,4 +596,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-UUVXQIQ4.js.map
+//# sourceMappingURL=responsiveness-probe-WXHKKJ7N.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.464",
+  "version": "0.28.465",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {