@integrity-labs/agt-cli 0.28.625 → 0.28.626

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-WTNH3VCT.js";
+} from "../chunk-4NCEO44Q.js";
 import {
   readDirectChatSessionState
 } from "../chunk-7QNQRV3A.js";
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.625" : "dev";
+var cliVersion = true ? "0.28.626" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.625" : "dev";
+var cliVersion2 = true ? "0.28.626" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-WTNH3VCT.js → chunk-4NCEO44Q.js}

@@ -6069,7 +6069,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.625" : "dev";
+var agtCliVersion = true ? "0.28.626" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9589,4 +9589,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-WTNH3VCT.js.map
+//# sourceMappingURL=chunk-4NCEO44Q.js.map

package/dist/lib/manager-worker.js

@@ -54,7 +54,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-WTNH3VCT.js";
+} from "../chunk-4NCEO44Q.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -12033,7 +12033,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.625" : "dev";
+var agtCliVersion = true ? "0.28.626" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();

package/dist/mcp/augmented-admin.js

@@ -21333,64 +21333,67 @@ var AdminDebugClient = class _AdminDebugClient {
 };
 
 // src/tool-schemas.ts
+function strictObject(shape) {
+  return external_exports.object(shape).strict();
+}
 var limitSchema = external_exports.number().int().min(1).max(100).optional().describe("Max rows to return (default 25, server caps at 100).");
-var searchAgentsSchema = external_exports.object({
+var searchAgentsSchema = strictObject({
   q: external_exports.string().max(128).optional().describe("Case-insensitive substring match on code_name or display_name."),
   status: external_exports.string().max(32).optional().describe("Filter by agent status (draft | active | paused | revoked)."),
   environment: external_exports.string().max(32).optional().describe("Filter by environment (dev | stage | prod)."),
   limit: limitSchema
 });
-var searchOrgsSchema = external_exports.object({
+var searchOrgsSchema = strictObject({
   q: external_exports.string().max(128).optional().describe("Case-insensitive substring match on organization name or slug."),
   management_mode: external_exports.enum(["fully_managed", "self_managed"]).optional().describe("Filter by management mode (fully_managed | self_managed)."),
   is_internal: external_exports.boolean().optional().describe("Filter to Integrity-Labs-internal orgs (true) or customer orgs (false)."),
   limit: limitSchema
 });
-var getAgentSchema = external_exports.object({
+var getAgentSchema = strictObject({
   agent_id: external_exports.string().min(1).max(64).describe("The agent UUID to fetch a composite diagnostic for.")
 });
-var getAgentIntegrationsSchema = external_exports.object({
+var getAgentIntegrationsSchema = strictObject({
   agent_id: external_exports.string().min(1).max(64).describe("The agent UUID whose effective integration set to resolve.")
 });
-var searchHostsSchema = external_exports.object({
+var searchHostsSchema = strictObject({
   q: external_exports.string().max(128).optional().describe("Case-insensitive substring match on host name."),
   status: external_exports.string().max(32).optional().describe("Filter by host status (active | decommissioned)."),
   limit: limitSchema
 });
-var getHostSchema = external_exports.object({
+var getHostSchema = strictObject({
   host: external_exports.string().min(1).max(128).describe("The host id (uuid) or its exact, case-insensitive name. Use the id if the name is ambiguous."),
   since_hours: external_exports.number().int().min(1).max(720).optional().describe("Window for the restart-count rollup, in hours. Default 24.")
 });
-var inspectFlagsSchema = external_exports.object({
+var inspectFlagsSchema = strictObject({
   host: external_exports.string().min(1).max(128).optional().describe("The host id (uuid) or its exact, case-insensitive name. Pass this OR agent_id."),
   agent_id: external_exports.string().min(1).max(64).optional().describe("The agent UUID \u2014 flags are inspected on the agent's current host. Pass this OR host.")
 });
-var evalFailuresSchema = external_exports.object({
+var evalFailuresSchema = strictObject({
   period: external_exports.enum(["24h", "7d", "30d"]).optional().describe("Window to report over (24h | 7d | 30d). Default 7d."),
   agent_id: external_exports.string().min(1).max(64).optional().describe("Filter to one agent (UUID); omit for a fleet-wide breakdown across your authorized orgs.")
 });
 var alertIdField = external_exports.string().min(1).max(64).describe("The alert id (uuid), from debug_list_alerts.");
 var triageReasonField = external_exports.string().max(2e3).optional().describe("Why \u2014 recorded on the cross-org audit trail. Be specific.");
-var ackAlertSchema = external_exports.object({
+var ackAlertSchema = strictObject({
   alert_id: alertIdField,
   reason: triageReasonField
 });
-var snoozeAlertSchema = external_exports.object({
+var snoozeAlertSchema = strictObject({
   alert_id: alertIdField,
   duration: external_exports.enum(["15m", "1h", "4h", "until_tomorrow"]).describe("How long to suppress paging: 15m | 1h | 4h | until_tomorrow (09:00 UTC next day)."),
   reason: triageReasonField
 });
-var closeAlertSchema = external_exports.object({
+var closeAlertSchema = strictObject({
   alert_id: alertIdField,
   reason: triageReasonField
 });
-var hostVersionsSchema = external_exports.object({
+var hostVersionsSchema = strictObject({
   q: external_exports.string().max(128).optional().describe("Case-insensitive substring match on host name."),
   status: external_exports.string().max(32).optional().describe("Filter by host status (active | decommissioned)."),
   since_hours: external_exports.number().int().min(1).max(720).optional().describe("Window for the restart count, in hours. Default 24."),
   limit: limitSchema
 });
-var tailLogsSchema = external_exports.object({
+var tailLogsSchema = strictObject({
   agent_id: external_exports.string().min(1).max(64).describe(
     "UUID of the agent whose host log to tail. Fails closed (uniform not-found) if you are not authorized for its org."
   ),
@@ -21401,7 +21404,7 @@ var tailLogsSchema = external_exports.object({
     "Trailing lines to return (default 200, max 2000). Output is also byte-capped (~20 KB, newest kept) to stay within SSM limits \u2014 `truncated` flags when it clipped."
   )
 });
-var queryLogsSchema = external_exports.object({
+var queryLogsSchema = strictObject({
   agent_id: external_exports.string().min(1).max(64).describe(
     "UUID of the agent whose host log to query. Fails closed (uniform not-found) if you are not authorized for its org."
   ),
@@ -21418,7 +21421,7 @@ var queryLogsSchema = external_exports.object({
     "Max lines to return (default 1000, max 5000; newest kept). Output is also byte-capped (~20 KB, newest kept) to stay within SSM limits \u2014 `truncated` flags when it clipped. Narrow the window if truncated."
   )
 });
-var probeIntegrationSchema = external_exports.object({
+var probeIntegrationSchema = strictObject({
   agent_id: external_exports.string().min(1).max(64).describe(
     "UUID of the agent whose integration to probe. Fails closed (uniform not-found) if you are not authorized for its org."
   ),
@@ -21429,12 +21432,12 @@ var probeIntegrationSchema = external_exports.object({
     "The integration slug (its definition code_name, e.g. `gmail`, `slack`, `here-now`) to probe on that agent."
   )
 });
-var inspectDeadLettersSchema = external_exports.object({
+var inspectDeadLettersSchema = strictObject({
   agent_id: external_exports.string().min(1).max(64).describe(
     "UUID of the agent whose dead-lettered inbound to list. Fails closed (uniform not-found) if you are not authorized for its org."
   )
 });
-var replayDeadLetterSchema = external_exports.object({
+var replayDeadLetterSchema = strictObject({
   target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent whose dead letter to replay."),
   channel: external_exports.enum(["slack", "telegram"]).describe("Which inbound channel the dead letter belongs to (from the inspect result)."),
   store: external_exports.string().min(1).max(128).regex(
@@ -21444,39 +21447,39 @@ var replayDeadLetterSchema = external_exports.object({
   marker_name: external_exports.string().trim().min(1).max(256).describe("The exact `marker_name` from the inspect result identifying which parked message to re-inject."),
   reason: external_exports.string().min(1).max(2e3).describe("Why this message should be re-injected \u2014 shown verbatim to the human approver. Be specific.")
 });
-var inspectRestartRequestsSchema = external_exports.object({
+var inspectRestartRequestsSchema = strictObject({
   agent_id: external_exports.string().min(1).max(64).optional().describe(
     "Optional: narrow to ONE agent's restart request. Omit for a fleet-wide list across every authorized org. Fails closed (empty) for orgs you are not authorized for."
   ),
   limit: limitSchema
 });
-var clearRestartRequestSchema = external_exports.object({
+var clearRestartRequestSchema = strictObject({
   target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent whose stuck restart request to clear (from the inspect result)."),
   reason: external_exports.string().min(1).max(2e3).describe("Why this stuck restart request should be cleared \u2014 shown verbatim to the human approver. Be specific.")
 });
-var listAlertsSchema = external_exports.object({
+var listAlertsSchema = strictObject({
   severity: external_exports.string().max(16).optional().describe("Filter by severity (critical | warning | info)."),
   open: external_exports.boolean().optional().describe("When true, only currently-open (unclosed) alerts."),
   limit: limitSchema
 });
-var requestAccessSchema = external_exports.object({
+var requestAccessSchema = strictObject({
   target_org_id: external_exports.string().min(1).max(64).describe("UUID of the customer organization to open scoped read access to."),
   reason: external_exports.string().min(1).max(2e3).describe(
     "Why access is needed \u2014 recorded on the customer-visible access log and shown to the org when they review or revoke it. Be specific."
   )
 });
-var requestActionSchema = external_exports.object({
+var requestActionSchema = strictObject({
   action: external_exports.enum(["restart", "clear_pending_inbound"]).describe(
     "The remedial action. restart = bounce the agent (reversible; backlog replays). clear_pending_inbound = move stuck pending-inbound markers aside (drops queued inbound messages; they are NOT reprocessed)."
   ),
   target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent to act on."),
   reason: external_exports.string().min(1).max(2e3).describe("Why this action is needed \u2014 shown verbatim to the human approver. Be specific.")
 });
-var restartAgentSchema = external_exports.object({
+var restartAgentSchema = strictObject({
   target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent to restart."),
   reason: external_exports.string().min(1).max(2e3).describe("Why the restart is needed \u2014 shown verbatim to the human approver. Be specific.")
 });
-var requestConfigUpdateSchema = external_exports.object({
+var requestConfigUpdateSchema = strictObject({
   target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent whose config to change."),
   field: external_exports.enum(["primary_model", "secondary_model", "tertiary_model"]).describe("The agent-config field to change. Only the model tiers are settable."),
   new_value: external_exports.string().min(1).max(128).describe(
@@ -21484,17 +21487,17 @@ var requestConfigUpdateSchema = external_exports.object({
   ),
   reason: external_exports.string().min(1).max(2e3).describe("Why this change is needed \u2014 shown verbatim to the human approver. Be specific.")
 });
-var checkActionStatusSchema = external_exports.object({
+var checkActionStatusSchema = strictObject({
   request_id: external_exports.string().min(1).max(64).describe("The action request_id returned by request_action, request_config_update, or request_ssm_run.")
 });
-var requestSsmRunSchema = external_exports.object({
+var requestSsmRunSchema = strictObject({
   target_agent_id: external_exports.string().min(1).max(64).describe("UUID of the customer agent whose host to run the diagnostic on."),
   command: external_exports.enum(["host_health", "manager_status", "manager_journal", "process_list", "agent_dir"]).describe(
     "The allowlisted, READ-ONLY diagnostic to run (closed set \u2014 no free-form shell). host_health = uptime + df -h + free -m (is the box wedged / out of disk / out of memory?); manager_status = systemctl status agt-manager.service (is the manager daemon up?); manager_journal = journalctl -u agt-manager.service -n 200 (recent systemd-captured manager output); process_list = ps (pid/ppid/user/etime/rss/comm, no argv/env) filtered to claude + agt-manager; agent_dir = ls -la ~/.augmented/<code_name>/ (file NAMES only \u2014 stuck markers, state files; never contents). For file CONTENTS use debug_tail_logs (it covers manager.log/pane.log/channel-stderr/manager-state.json)."
   ),
   reason: external_exports.string().min(1).max(2e3).describe("Why this diagnostic is needed \u2014 shown verbatim to the human approver. Be specific.")
 });
-var queryAuditLogSchema = external_exports.object({
+var queryAuditLogSchema = strictObject({
   agent_id: external_exports.string().min(1).max(64).optional().describe(
     "UUID of ONE agent whose audit events to read (the read is scoped to that agent's org). Omit for a CROSS-AGENT query across all authorized orgs (optionally narrowed with org_id)."
   ),
@@ -21583,10 +21586,9 @@ var client = new AdminDebugClient({
   runId: AGT_RUN_ID || void 0
 });
 var server = new McpServer({ name: "augmented-admin-mcp", version: package_default.version });
-server.tool(
+server.registerTool(
   "debug_search_agents",
-  "Search managed end-user agents across authorized orgs for troubleshooting. Returns a diagnostic projection per agent (code_name, status, environment, risk_tier, org, heartbeat verdict) \u2014 never credentials or transcripts. Authorized = IL-owned + fully-managed orgs (standing) plus any self-managed org you hold an active grant for (see debug_request_access). Filter with { q, status, environment, limit }.",
-  searchAgentsSchema.shape,
+  { description: "Search managed end-user agents across authorized orgs for troubleshooting. Returns a diagnostic projection per agent (code_name, status, environment, risk_tier, org, heartbeat verdict) \u2014 never credentials or transcripts. Authorized = IL-owned + fully-managed orgs (standing) plus any self-managed org you hold an active grant for (see debug_request_access). Filter with { q, status, environment, limit }.", inputSchema: searchAgentsSchema },
   async (args) => {
     try {
       const result = await client.searchAgents(args);
@@ -21596,10 +21598,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_get_agent",
-  'Fetch a composite diagnostic for ONE agent: the agent projection plus its host (heartbeat verdict, framework, EC2/auth status), its integrations, and recent alerts. The primary "why is this agent unhealthy?" read. Never returns credentials. Pass { agent_id }.\n\nThe payload carries TWO integration reads, and confusing them produces wrong root-cause (ENG-8271):\n  \u2022 `effective_integrations` \u2014 the COMPLETE set the agent runs with: agent + team + ORG scope, each entry carrying `scope` ("agent" | "team" | "org") and `source_id`. Read THIS to answer "does this agent have integration X?". `effective_count` equals the manager\'s `Integrations provisioned for \'<code_name>\' (N)`, so the two reconcile; `by_scope`, `inherited_definition_ids`, `scopes_skipped`, `excluded_control_plane_only`, `shadowed_by_more_specific` and `duplicate_merge_keys` attribute any row that did not make the count.\n  \u2022 `agent_integrations` \u2014 PER-AGENT rows only, kept for compatibility. Team- and org-scoped installs are ABSENT. Do NOT infer "not installed" from an absence here: an org-level install is genuinely missing from this array while being fully present on the agent. Same warning ships in-payload as `agent_integrations_note`.',
-  getAgentSchema.shape,
+  { description: 'Fetch a composite diagnostic for ONE agent: the agent projection plus its host (heartbeat verdict, framework, EC2/auth status), its integrations, and recent alerts. The primary "why is this agent unhealthy?" read. Never returns credentials. Pass { agent_id }.\n\nThe payload carries TWO integration reads, and confusing them produces wrong root-cause (ENG-8271):\n  \u2022 `effective_integrations` \u2014 the COMPLETE set the agent runs with: agent + team + ORG scope, each entry carrying `scope` ("agent" | "team" | "org") and `source_id`. Read THIS to answer "does this agent have integration X?". `effective_count` equals the manager\'s `Integrations provisioned for \'<code_name>\' (N)`, so the two reconcile; `by_scope`, `inherited_definition_ids`, `scopes_skipped`, `excluded_control_plane_only`, `shadowed_by_more_specific` and `duplicate_merge_keys` attribute any row that did not make the count.\n  \u2022 `agent_integrations` \u2014 PER-AGENT rows only, kept for compatibility. Team- and org-scoped installs are ABSENT. Do NOT infer "not installed" from an absence here: an org-level install is genuinely missing from this array while being fully present on the agent. Same warning ships in-payload as `agent_integrations_note`.', inputSchema: getAgentSchema },
   async (args) => {
     try {
       const result = await client.getAgent(args.agent_id);
@@ -21609,10 +21610,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_get_agent_integrations",
-  'Resolve ONE agent\'s EFFECTIVE integration set \u2014 the focused read for "does this agent have integration X, and where is it installed from?" (ENG-8271). Same resolution as `debug_get_agent`\'s `effective_integrations`, without the host/alerts payload.\n\nReturns { agent_id, code_name, team_id, organization_id, effective_integrations: { effective_count, by_scope, inherited_definition_ids, excluded_control_plane_only, shadowed_by_more_specific, duplicate_merge_keys, scopes_queried, scopes_skipped, integrations[] } } - the same `effective_integrations` object `debug_get_agent` returns, so one shape covers both tools. Each entry: { definition_id, display_name, connection_key, scope ("agent" | "team" | "org"), source_id, status, status_message, auth_type, last_connectivity_check_at, last_connectivity_status, consecutive_connectivity_failures, wired_verdict, last_session_tool_bind_at }. Never credentials.\n\nPrefer this over reading `agent_integrations`: TEAM/ORG-scope installs are invisible to a per-agent read, so absence there is not evidence. `effective_count` reconciles against the manager\'s `Integrations provisioned for \'<code_name>\' (N)` or the tool-bind probe\'s `due=N`; docs/runbooks/admin-debug-dogfood.md lists the benign divergences to rule out before treating a mismatch as a bug. `wired_verdict` is the host\'s last session-tool-bind result (bound | missing | unreachable | unknown), the closest available answer to "is it in the agent\'s .mcp.json right now?"; `null` means never probed, which is NOT "not wired".\n\nFails closed (uniform not-found) for an unauthorized/unknown agent; a failed scope query returns an error rather than a smaller count. Audited as a cross-org access. Pass { agent_id }.',
-  getAgentIntegrationsSchema.shape,
+  { description: 'Resolve ONE agent\'s EFFECTIVE integration set \u2014 the focused read for "does this agent have integration X, and where is it installed from?" (ENG-8271). Same resolution as `debug_get_agent`\'s `effective_integrations`, without the host/alerts payload.\n\nReturns { agent_id, code_name, team_id, organization_id, effective_integrations: { effective_count, by_scope, inherited_definition_ids, excluded_control_plane_only, shadowed_by_more_specific, duplicate_merge_keys, scopes_queried, scopes_skipped, integrations[] } } - the same `effective_integrations` object `debug_get_agent` returns, so one shape covers both tools. Each entry: { definition_id, display_name, connection_key, scope ("agent" | "team" | "org"), source_id, status, status_message, auth_type, last_connectivity_check_at, last_connectivity_status, consecutive_connectivity_failures, wired_verdict, last_session_tool_bind_at }. Never credentials.\n\nPrefer this over reading `agent_integrations`: TEAM/ORG-scope installs are invisible to a per-agent read, so absence there is not evidence. `effective_count` reconciles against the manager\'s `Integrations provisioned for \'<code_name>\' (N)` or the tool-bind probe\'s `due=N`; docs/runbooks/admin-debug-dogfood.md lists the benign divergences to rule out before treating a mismatch as a bug. `wired_verdict` is the host\'s last session-tool-bind result (bound | missing | unreachable | unknown), the closest available answer to "is it in the agent\'s .mcp.json right now?"; `null` means never probed, which is NOT "not wired".\n\nFails closed (uniform not-found) for an unauthorized/unknown agent; a failed scope query returns an error rather than a smaller count. Audited as a cross-org access. Pass { agent_id }.', inputSchema: getAgentIntegrationsSchema },
   async (args) => {
     try {
       const result = await client.getAgentIntegrations(args.agent_id);
@@ -21622,10 +21622,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_search_hosts",
-  "Search managed hosts across authorized orgs. Returns a projection per host (name, org, status, framework version, last-seen verdict, EC2 + Claude auth status) \u2014 no api-key fingerprints or secrets. Filter with { q, status, limit }.",
-  searchHostsSchema.shape,
+  { description: "Search managed hosts across authorized orgs. Returns a projection per host (name, org, status, framework version, last-seen verdict, EC2 + Claude auth status) \u2014 no api-key fingerprints or secrets. Filter with { q, status, limit }.", inputSchema: searchHostsSchema },
   async (args) => {
     try {
       const result = await client.searchHosts(args);
@@ -21635,10 +21634,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_get_host",
-  "Fetch a host-centric composite for ONE host \u2014 the host equivalent of debug_get_agent, and the right entry point for host-WIDE incidents (e.g. an env drift or a bad deploy hitting every agent on a box). One read returns: the host projection (status, framework + CC version, last-seen verdict, EC2 + Claude auth), EVERY agent bound to the host (each with its own heartbeat verdict + org), a rollup of alerts (the host's own infra alerts \u2014 including NULL-team ones like host_down / probe_timeout \u2014 PLUS each bound agent's alerts), and a { agent_count, restart_count, restart_window_hours } rollup. Saves stitching debug_search_hosts + per-agent reads together. Resolve the host by its id (uuid) or its exact, case-insensitive name; an ambiguous name returns a 400 asking for the id. Returns { host: { \u2026, agents[], recent_alerts[], rollup } }. Fails closed (uniform not-found) for an unauthorized or unknown host; every call is audited as a cross-org access. Pass { host, since_hours? } (since_hours sets the restart-count window, default 24).",
-  getHostSchema.shape,
+  { description: "Fetch a host-centric composite for ONE host \u2014 the host equivalent of debug_get_agent, and the right entry point for host-WIDE incidents (e.g. an env drift or a bad deploy hitting every agent on a box). One read returns: the host projection (status, framework + CC version, last-seen verdict, EC2 + Claude auth), EVERY agent bound to the host (each with its own heartbeat verdict + org), a rollup of alerts (the host's own infra alerts \u2014 including NULL-team ones like host_down / probe_timeout \u2014 PLUS each bound agent's alerts), and a { agent_count, restart_count, restart_window_hours } rollup. Saves stitching debug_search_hosts + per-agent reads together. Resolve the host by its id (uuid) or its exact, case-insensitive name; an ambiguous name returns a 400 asking for the id. Returns { host: { \u2026, agents[], recent_alerts[], rollup } }. Fails closed (uniform not-found) for an unauthorized or unknown host; every call is audited as a cross-org access. Pass { host, since_hours? } (since_hours sets the restart-count window, default 24).", inputSchema: getHostSchema },
   async (args) => {
     try {
       const result = await client.getHost(args);
@@ -21648,10 +21646,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_inspect_flags",
-  "Inspect an agent/host's EFFECTIVE feature flags WITH source attribution \u2014 the one-call answer to \"is an env override silently masking a flag?\" (the ENG-6478 / koda drift class), instead of grepping manager.log for WARN spam. For each registry flag it returns { effective, source, env_value, env_var, heartbeat_value, central_value, default_value, env_masks_heartbeat, host_stale, sensitive }. `source` mirrors how the host actually resolves a flag: env override > heartbeat-materialized (the value the control plane last sent the host) > compiled default. `env_masks_heartbeat:true` is the smoking gun for ENG-6478 (a host env gate overriding a different DB-resolved value); `host_stale:true` means the host hasn't picked up a central change. Host-side values come from the host's latest config snapshot (so snapshot:null \u21D2 the host hasn't reported one and attribution degrades to default + central). Top-level `drift_keys` lists the flags worth looking at. Pass exactly one of { host } (id or exact name) or { agent_id } (inspects its current host). Read-only; fails closed for an unauthorized/unknown target; audited as a cross-org access.",
-  inspectFlagsSchema.shape,
+  { description: "Inspect an agent/host's EFFECTIVE feature flags WITH source attribution \u2014 the one-call answer to \"is an env override silently masking a flag?\" (the ENG-6478 / koda drift class), instead of grepping manager.log for WARN spam. For each registry flag it returns { effective, source, env_value, env_var, heartbeat_value, central_value, default_value, env_masks_heartbeat, host_stale, sensitive }. `source` mirrors how the host actually resolves a flag: env override > heartbeat-materialized (the value the control plane last sent the host) > compiled default. `env_masks_heartbeat:true` is the smoking gun for ENG-6478 (a host env gate overriding a different DB-resolved value); `host_stale:true` means the host hasn't picked up a central change. Host-side values come from the host's latest config snapshot (so snapshot:null \u21D2 the host hasn't reported one and attribution degrades to default + central). Top-level `drift_keys` lists the flags worth looking at. Pass exactly one of { host } (id or exact name) or { agent_id } (inspects its current host). Read-only; fails closed for an unauthorized/unknown target; audited as a cross-org access.", inputSchema: inspectFlagsSchema },
   async (args) => {
     try {
       const hasHost = typeof args.host === "string" && args.host.length > 0;
@@ -21669,10 +21666,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_list_alerts",
-  "List recent platform alerts across authorized orgs (host-down, agent-stale, probe-timeout, auth-failed), including NULL-team host alerts. Returns a projection per alert (kind, severity, message, source, open/closed state). Filter with { severity, open, limit }.",
-  listAlertsSchema.shape,
+  { description: "List recent platform alerts across authorized orgs (host-down, agent-stale, probe-timeout, auth-failed), including NULL-team host alerts. Returns a projection per alert (kind, severity, message, source, open/closed state). Filter with { severity, open, limit }.", inputSchema: listAlertsSchema },
   async (args) => {
     try {
       const result = await client.listAlerts(args);
@@ -21682,10 +21678,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_ack_alert",
-  "Acknowledge an open alert \u2014 close the triage loop here instead of bouncing to the webapp. Stops escalation/paging for it without closing it. Unlike the host-affecting remedial actions this is a low-risk, reversible control-plane write (it sets acknowledged_at/by on the alert row), so it applies directly \u2014 gated by the admin-debug write mode and authorized against the alert's org (a NULL-org infra alert is IL-internal-only). Returns { alert_id, action, write_mode, applied, alert }. `applied:false` means write mode is `shadow` (validated, not written). Get the alert id from debug_list_alerts. Pass { alert_id, reason? }. Every call is audited as a cross-org access.",
-  ackAlertSchema.shape,
+  { description: "Acknowledge an open alert \u2014 close the triage loop here instead of bouncing to the webapp. Stops escalation/paging for it without closing it. Unlike the host-affecting remedial actions this is a low-risk, reversible control-plane write (it sets acknowledged_at/by on the alert row), so it applies directly \u2014 gated by the admin-debug write mode and authorized against the alert's org (a NULL-org infra alert is IL-internal-only). Returns { alert_id, action, write_mode, applied, alert }. `applied:false` means write mode is `shadow` (validated, not written). Get the alert id from debug_list_alerts. Pass { alert_id, reason? }. Every call is audited as a cross-org access.", inputSchema: ackAlertSchema },
   async (args) => {
     try {
       const result = await client.ackAlert(args);
@@ -21695,10 +21690,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_snooze_alert",
-  "Snooze an open alert \u2014 suppress fresh pages for it until 15m | 1h | 4h | until_tomorrow (09:00 UTC next day), without closing it. Low-risk reversible control-plane write (sets snoozed_until); applies directly under the admin-debug write mode, authorized against the alert's org. Returns { alert_id, action, write_mode, applied, alert }; `applied:false` \u21D2 shadow mode. Pass { alert_id, duration, reason? }. Audited as a cross-org access.",
-  snoozeAlertSchema.shape,
+  { description: "Snooze an open alert \u2014 suppress fresh pages for it until 15m | 1h | 4h | until_tomorrow (09:00 UTC next day), without closing it. Low-risk reversible control-plane write (sets snoozed_until); applies directly under the admin-debug write mode, authorized against the alert's org. Returns { alert_id, action, write_mode, applied, alert }; `applied:false` \u21D2 shadow mode. Pass { alert_id, duration, reason? }. Audited as a cross-org access.", inputSchema: snoozeAlertSchema },
   async (args) => {
     try {
       const result = await client.snoozeAlert(args);
@@ -21708,10 +21702,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_close_alert",
-  "Close an open alert (closed_reason=manual) \u2014 resolve it from here when you've confirmed it's handled, instead of the webapp. Low-risk control-plane write (sets closed_at + closed_reason); applies directly under the admin-debug write mode, authorized against the alert's org. Only OPEN alerts can be closed (a 409 means it was already closed). Returns { alert_id, action, write_mode, applied, alert }; `applied:false` \u21D2 shadow mode. Pass { alert_id, reason? }. Audited as a cross-org access.",
-  closeAlertSchema.shape,
+  { description: "Close an open alert (closed_reason=manual) \u2014 resolve it from here when you've confirmed it's handled, instead of the webapp. Low-risk control-plane write (sets closed_at + closed_reason); applies directly under the admin-debug write mode, authorized against the alert's org. Only OPEN alerts can be closed (a 409 means it was already closed). Returns { alert_id, action, write_mode, applied, alert }; `applied:false` \u21D2 shadow mode. Pass { alert_id, reason? }. Audited as a cross-org access.", inputSchema: closeAlertSchema },
   async (args) => {
     try {
       const result = await client.closeAlert(args);
@@ -21721,10 +21714,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_search_orgs",
-  `List the ORGANIZATIONS you're authorized to read \u2014 the org-level entry point for triage and access decisions, so you don't have to infer orgs off agent/host rows or probe one org's tier with debug_request_access. Returns a projection per org: { organization_id, organization_slug, display_name, is_internal, management_mode (fully_managed | self_managed), standing_reason (internal | fully_managed | granted \u2014 WHY you can read it), has_active_grant (do you hold a live grant right now), host_count, agent_count, active_agent_count, open_alert_count, created_at }. Use it to (1) decide access in one read \u2014 see a self_managed org and its grant state before deciding to debug_request_access; (2) triage the fleet \u2014 "which orgs have open alerts" (open_alert_count includes stuck-restart alerts) without walking agents; (3) disambiguate a slug \u2192 id \u2192 tier without needing an agent/host to exist. Authorized = IL-owned (is_internal) + fully-managed orgs (standing) plus any self-managed org you hold an active grant for. Filter with { q (slug/name substring), management_mode, is_internal, limit }. Projection only \u2014 no secrets, no transcripts; org-walled in SQL and audited as a cross-org access.`,
-  searchOrgsSchema.shape,
+  { description: `List the ORGANIZATIONS you're authorized to read \u2014 the org-level entry point for triage and access decisions, so you don't have to infer orgs off agent/host rows or probe one org's tier with debug_request_access. Returns a projection per org: { organization_id, organization_slug, display_name, is_internal, management_mode (fully_managed | self_managed), standing_reason (internal | fully_managed | granted \u2014 WHY you can read it), has_active_grant (do you hold a live grant right now), host_count, agent_count, active_agent_count, open_alert_count, created_at }. Use it to (1) decide access in one read \u2014 see a self_managed org and its grant state before deciding to debug_request_access; (2) triage the fleet \u2014 "which orgs have open alerts" (open_alert_count includes stuck-restart alerts) without walking agents; (3) disambiguate a slug \u2192 id \u2192 tier without needing an agent/host to exist. Authorized = IL-owned (is_internal) + fully-managed orgs (standing) plus any self-managed org you hold an active grant for. Filter with { q (slug/name substring), management_mode, is_internal, limit }. Projection only \u2014 no secrets, no transcripts; org-walled in SQL and audited as a cross-org access.`, inputSchema: searchOrgsSchema },
   async (args) => {
     try {
       const result = await client.searchOrgs(args);
@@ -21734,10 +21726,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_host_versions",
-  'Fleet-wide host health snapshot for triaging "which host is unhealthy?". Returns a projection per authorized host: { id, name, org, framework, framework_version (the Claude Code version the host runs), last_seen_verdict, agent_count, restart_count, restart_window_hours }. `restart_count` tallies `agent.restart` audit events across the host\'s agents within the window (default 24h) \u2014 a high count is the tell for a thrashing host. Use it to spot version skew (an old framework_version) or restart storms across the fleet at a glance. Filter with { q, status, since_hours, limit }.',
-  hostVersionsSchema.shape,
+  { description: 'Fleet-wide host health snapshot for triaging "which host is unhealthy?". Returns a projection per authorized host: { id, name, org, framework, framework_version (the Claude Code version the host runs), last_seen_verdict, agent_count, restart_count, restart_window_hours }. `restart_count` tallies `agent.restart` audit events across the host\'s agents within the window (default 24h) \u2014 a high count is the tell for a thrashing host. Use it to spot version skew (an old framework_version) or restart storms across the fleet at a glance. Filter with { q, status, since_hours, limit }.', inputSchema: hostVersionsSchema },
   async (args) => {
     try {
       const result = await client.hostVersions(args);
@@ -21747,10 +21738,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_tail_logs",
-  "Live-tail an agent's HOST logs over SSM to ground-truth \"what was it actually doing?\" \u2014 the host-reaching read, used after debug_get_agent points at a sick agent. Resolves the agent's current host and returns the trailing lines of ONE allowlisted operational log: { agent_id, code_name, host, log, content (the tail), log_present, lines_requested, truncated, ssm_status }. Logs: `manager` (manager.log \u2014 respawn/wedge/lifecycle), `pane` (pane.log \u2014 the tmux pane, the agent's visible I/O, e.g. a stuck AskUserQuestion), `slack-stderr`/`telegram-stderr`/`direct-chat-stderr` (a channel MCP's crash output, e.g. attachment-download 400s), `manager-state` (manager-state.json). Fails closed for an unauthorized org. Only operational logs are reachable \u2014 secret files (.mcp.json, .env.integrations) are NOT. Pass { agent_id, log?, lines? } (lines default 200, max 2000; output ~20 KB-capped, newest kept). Every call is audited as a cross-org host access.",
-  tailLogsSchema.shape,
+  { description: "Live-tail an agent's HOST logs over SSM to ground-truth \"what was it actually doing?\" \u2014 the host-reaching read, used after debug_get_agent points at a sick agent. Resolves the agent's current host and returns the trailing lines of ONE allowlisted operational log: { agent_id, code_name, host, log, content (the tail), log_present, lines_requested, truncated, ssm_status }. Logs: `manager` (manager.log \u2014 respawn/wedge/lifecycle), `pane` (pane.log \u2014 the tmux pane, the agent's visible I/O, e.g. a stuck AskUserQuestion), `slack-stderr`/`telegram-stderr`/`direct-chat-stderr` (a channel MCP's crash output, e.g. attachment-download 400s), `manager-state` (manager-state.json). Fails closed for an unauthorized org. Only operational logs are reachable \u2014 secret files (.mcp.json, .env.integrations) are NOT. Pass { agent_id, log?, lines? } (lines default 200, max 2000; output ~20 KB-capped, newest kept). Every call is audited as a cross-org host access.", inputSchema: tailLogsSchema },
   async (args) => {
     try {
       const result = await client.tailLogs(args);
@@ -21760,10 +21750,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_query_logs",
-  'Read an agent\'s HOST logs OVER A TIME WINDOW, spanning rotated files \u2014 the historical counterpart to debug_tail_logs. Where tail only shows the live tail of the current file (minutes, and gone once it rotates), this reads the active log AND its logrotate siblings (manager.log-YYYYMMDD, manager.log-YYYYMMDD.gz, \u2026 7 days kept on-host) and filters lines to [since, until]. Windows older than 7 days return nothing: those rotations have been archived to S3, and hosts are write-only to that bucket by design, so an older window needs an operator S3 fetch rather than this tool (ENG-8330). Seven days is the ONE local-retention window for everything the host archives, Claude session transcripts included. This is the read path for "did it restart at 4pm YESTERDAY?" \u2014 use it when the answer is older than the live tail or spans a rotation. Returns { agent_id, code_name, host, log, since, until, time_filtered, content, log_present, lines_requested, truncated, ssm_status }. Time filtering applies to `manager` (its lines carry an ISO8601 prefix); `pane`/`slack-stderr`/`telegram-stderr`/`direct-chat-stderr`/`manager-state`/`channel-quarantine` return their byte-capped tail unfiltered (time_filtered:false \u2014 the last two are JSON, not line-oriented). Only operational logs are reachable \u2014 secret files (.mcp.json, .env.integrations) are NOT. Pass { agent_id, log?, since?, until?, lines? } (since/until ISO8601 UTC e.g. 2026-06-14T16:00:00Z, default unbounded; lines default 1000, max 5000; output ~20 KB-capped, newest kept \u2014 narrow the window if truncated). Fails closed for an unauthorized org; every call is audited as a cross-org host access.',
-  queryLogsSchema.shape,
+  { description: 'Read an agent\'s HOST logs OVER A TIME WINDOW, spanning rotated files \u2014 the historical counterpart to debug_tail_logs. Where tail only shows the live tail of the current file (minutes, and gone once it rotates), this reads the active log AND its logrotate siblings (manager.log-YYYYMMDD, manager.log-YYYYMMDD.gz, \u2026 7 days kept on-host) and filters lines to [since, until]. Windows older than 7 days return nothing: those rotations have been archived to S3, and hosts are write-only to that bucket by design, so an older window needs an operator S3 fetch rather than this tool (ENG-8330). Seven days is the ONE local-retention window for everything the host archives, Claude session transcripts included. This is the read path for "did it restart at 4pm YESTERDAY?" \u2014 use it when the answer is older than the live tail or spans a rotation. Returns { agent_id, code_name, host, log, since, until, time_filtered, content, log_present, lines_requested, truncated, ssm_status }. Time filtering applies to `manager` (its lines carry an ISO8601 prefix); `pane`/`slack-stderr`/`telegram-stderr`/`direct-chat-stderr`/`manager-state`/`channel-quarantine` return their byte-capped tail unfiltered (time_filtered:false \u2014 the last two are JSON, not line-oriented). Only operational logs are reachable \u2014 secret files (.mcp.json, .env.integrations) are NOT. Pass { agent_id, log?, since?, until?, lines? } (since/until ISO8601 UTC e.g. 2026-06-14T16:00:00Z, default unbounded; lines default 1000, max 5000; output ~20 KB-capped, newest kept \u2014 narrow the window if truncated). Fails closed for an unauthorized org; every call is audited as a cross-org host access.', inputSchema: queryLogsSchema },
   async (args) => {
     try {
       const result = await client.queryLogs(args);
@@ -21773,10 +21762,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_eval_failures",
-  'Report WHY conversations could not be scored by the host-side success evaluator: the failure counterpart to the "conversation success" trend, which only ever shows EVALUATED conversations (so an agent whose conversations all fail to reconstruct silently vanishes from it). Use when conversation scores look thin/absent for an agent, or to audit eval coverage fleet-wide. Returns { scope, period, scanned, truncated, report, recent }. `report` is the aggregate: { total, gaveUp (subset that hit the retry cap, will never be scored), byReason[] (org-wide count + gaveUp per reason), perAgent[] (worst-first standing) }. The three reasons are data-shaped: `no_transcript` (the host had no local transcript at all), `not_reconstructable` (transcripts exist but none carry the conversation\'s channel ref), `empty_transcript` (turns reconstructed but rendered to nothing). `recent` is the newest failing conversations (boundary + reason only, NEVER transcript content). NOTE: transient/misconfigured EVAL BACKEND failures are NOT here; those show on the host (hosts.eval_backend_*), check debug_get_host. Pass { period? (24h|7d|30d, default 7d), agent_id? (omit for fleet-wide) }. Org-walled in SQL; every call is audited as a cross-org access.',
-  evalFailuresSchema.shape,
+  { description: 'Report WHY conversations could not be scored by the host-side success evaluator: the failure counterpart to the "conversation success" trend, which only ever shows EVALUATED conversations (so an agent whose conversations all fail to reconstruct silently vanishes from it). Use when conversation scores look thin/absent for an agent, or to audit eval coverage fleet-wide. Returns { scope, period, scanned, truncated, report, recent }. `report` is the aggregate: { total, gaveUp (subset that hit the retry cap, will never be scored), byReason[] (org-wide count + gaveUp per reason), perAgent[] (worst-first standing) }. The three reasons are data-shaped: `no_transcript` (the host had no local transcript at all), `not_reconstructable` (transcripts exist but none carry the conversation\'s channel ref), `empty_transcript` (turns reconstructed but rendered to nothing). `recent` is the newest failing conversations (boundary + reason only, NEVER transcript content). NOTE: transient/misconfigured EVAL BACKEND failures are NOT here; those show on the host (hosts.eval_backend_*), check debug_get_host. Pass { period? (24h|7d|30d, default 7d), agent_id? (omit for fleet-wide) }. Org-walled in SQL; every call is audited as a cross-org access.', inputSchema: evalFailuresSchema },
   async (args) => {
     try {
       const result = await client.evalFailures(args);
@@ -21786,10 +21774,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_probe_integration",
-  "Force a FRESH host-side connectivity probe for ONE of an agent's integrations and return the LIVE verdict \u2014 use when a user reports an integration \"isn't working\" but the console shows it connected, or to confirm a fix landed. Unlike the cached status the dashboard shows, this SSH-less SSM-invokes the agent's host to run the probe against its actual wired `.mcp.json` + credentials, so it can't disagree with reality. Returns { agent_id, code_name, slug, host, verdict, message, probed_at, ssm_status }. `verdict` is the live result: `ok` | `degraded` | `transient_error` (retryable) | `down` | `not_probeable` (no probe wired for this kind) \u2014 or a central degrade: `unreachable` (agent has no host), `not_installed` (integration not on this agent), `host_cli_too_old` (the host predates the probe \u2014 update its agt-cli), `probe_error`. Pass { agent_id, slug } where slug is the integration's definition code_name (e.g. `gmail`, `slack`, `here-now`). Fails closed for an unauthorized org; every call is audited as a cross-org host access.",
-  probeIntegrationSchema.shape,
+  { description: "Force a FRESH host-side connectivity probe for ONE of an agent's integrations and return the LIVE verdict \u2014 use when a user reports an integration \"isn't working\" but the console shows it connected, or to confirm a fix landed. Unlike the cached status the dashboard shows, this SSH-less SSM-invokes the agent's host to run the probe against its actual wired `.mcp.json` + credentials, so it can't disagree with reality. Returns { agent_id, code_name, slug, host, verdict, message, probed_at, ssm_status }. `verdict` is the live result: `ok` | `degraded` | `transient_error` (retryable) | `down` | `not_probeable` (no probe wired for this kind) \u2014 or a central degrade: `unreachable` (agent has no host), `not_installed` (integration not on this agent), `host_cli_too_old` (the host predates the probe \u2014 update its agt-cli), `probe_error`. Pass { agent_id, slug } where slug is the integration's definition code_name (e.g. `gmail`, `slack`, `here-now`). Fails closed for an unauthorized org; every call is audited as a cross-org host access.", inputSchema: probeIntegrationSchema },
   async (args) => {
     try {
       const result = await client.probeIntegration(args);
@@ -21799,10 +21786,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_inspect_dead_letters",
-  "List an agent's DEAD-LETTERED / quarantined inbound \u2014 customer messages that were parked on the host instead of delivered (so the agent never saw them), rather than silently lost. Use when a user says \"the agent never replied\" but nothing shows in the normal flow, or to audit what fell into the dead-letter path. Resolves the agent's current host and reads two on-disk stores over SSM: `stale` (markers moved aside on a wedge-respawn because the agent couldn't receive) and `cleared:<stamp>` (markers the clear_pending_inbound remedial action moved aside). Returns { agent_id, code_name, host, markers[], total, ssm_status } where each marker is { index, store, channel (slack|telegram), marker_name, received_at, undeliverable, discretionary, replay_count, conversation, message_ref } \u2014 routing metadata only, NEVER the message body. To re-inject one, pass its exact { channel, store, marker_name } to debug_replay_dead_letter. Fails closed for an unauthorized org; every call is audited as a cross-org host access. Pass { agent_id }.",
-  inspectDeadLettersSchema.shape,
+  { description: "List an agent's DEAD-LETTERED / quarantined inbound \u2014 customer messages that were parked on the host instead of delivered (so the agent never saw them), rather than silently lost. Use when a user says \"the agent never replied\" but nothing shows in the normal flow, or to audit what fell into the dead-letter path. Resolves the agent's current host and reads two on-disk stores over SSM: `stale` (markers moved aside on a wedge-respawn because the agent couldn't receive) and `cleared:<stamp>` (markers the clear_pending_inbound remedial action moved aside). Returns { agent_id, code_name, host, markers[], total, ssm_status } where each marker is { index, store, channel (slack|telegram), marker_name, received_at, undeliverable, discretionary, replay_count, conversation, message_ref } \u2014 routing metadata only, NEVER the message body. To re-inject one, pass its exact { channel, store, marker_name } to debug_replay_dead_letter. Fails closed for an unauthorized org; every call is audited as a cross-org host access. Pass { agent_id }.", inputSchema: inspectDeadLettersSchema },
   async (args) => {
     try {
       const result = await client.inspectDeadLetters(args);
@@ -21812,10 +21798,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_inspect_restart_requests",
-  'List STUCK / pending agent restart requests across authorized orgs \u2014 the agent_restart_stuck class. A restart request is "stuck" when the manager never acked it (e.g. one sat open on an agent for ~27 days). Use this when an agent went quiet and you suspect a restart that never landed, or to audit the fleet for unacked restarts. Returns { requests[], count } where each request is { agent_id, code_name, organization_id, host, restart_requested_at, stuck_seconds, is_stuck, incident, alert } \u2014 `is_stuck` flags age past the alert threshold (15 min); `incident`/`alert` carry the open ledger row + paged alert when the cron has escalated it. Routing metadata only, never message content. To cancel one, pass its agent_id to request_clear_restart_request. Pass { agent_id? (narrow to one), limit? }; fleet-wide when agent_id is omitted. Org-walled in SQL; every call is audited as a cross-org access.',
-  inspectRestartRequestsSchema.shape,
+  { description: 'List STUCK / pending agent restart requests across authorized orgs \u2014 the agent_restart_stuck class. A restart request is "stuck" when the manager never acked it (e.g. one sat open on an agent for ~27 days). Use this when an agent went quiet and you suspect a restart that never landed, or to audit the fleet for unacked restarts. Returns { requests[], count } where each request is { agent_id, code_name, organization_id, host, restart_requested_at, stuck_seconds, is_stuck, incident, alert } \u2014 `is_stuck` flags age past the alert threshold (15 min); `incident`/`alert` carry the open ledger row + paged alert when the cron has escalated it. Routing metadata only, never message content. To cancel one, pass its agent_id to request_clear_restart_request. Pass { agent_id? (narrow to one), limit? }; fleet-wide when agent_id is omitted. Org-walled in SQL; every call is audited as a cross-org access.', inputSchema: inspectRestartRequestsSchema },
   async (args) => {
     try {
       const result = await client.inspectRestartRequests(args);
@@ -21825,10 +21810,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "request_clear_restart_request",
-  "Request a HITL-gated CLEAR of a STUCK restart request \u2014 cancel a restart the manager never acked (listed by debug_inspect_restart_requests) and resolve its agent_restart_stuck alert. Use it to clear a restart signal wedged open for hours/days/weeks. This is NOT a restart and NOT a host action: it nulls the agent's `restart_requested_at` signal in the central DB and closes the alert/incident; the agent keeps running as-is, no in-flight work is destroyed. Reversible \u2014 request a fresh restart afterwards if one is still needed. A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). Async: returns { request_id, status, write_mode, notification_status }; after approval, poll check_action_status (result_payload carries { cleared_bindings, alert_closed }). Pass { target_agent_id, reason }.",
-  clearRestartRequestSchema.shape,
+  { description: "Request a HITL-gated CLEAR of a STUCK restart request \u2014 cancel a restart the manager never acked (listed by debug_inspect_restart_requests) and resolve its agent_restart_stuck alert. Use it to clear a restart signal wedged open for hours/days/weeks. This is NOT a restart and NOT a host action: it nulls the agent's `restart_requested_at` signal in the central DB and closes the alert/incident; the agent keeps running as-is, no in-flight work is destroyed. Reversible \u2014 request a fresh restart afterwards if one is still needed. A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). Async: returns { request_id, status, write_mode, notification_status }; after approval, poll check_action_status (result_payload carries { cleared_bindings, alert_closed }). Pass { target_agent_id, reason }.", inputSchema: clearRestartRequestSchema },
   async (args) => {
     try {
       const result = await client.requestClearRestartRequest({
@@ -21841,10 +21825,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_query_audit_log",
-  'Read recent audit events to troubleshoot why/when agents bounced \u2014 primarily restart events. Defaults to the "agent.restart" action: each event returns { created_at, source, reason, detail, actor_kind, agent_id, code_name }, where `source` is the restart trigger (agent-self-request, channel-command, maintenance-window, stale-mcp, hot-reload-mcp, mcp-presence-reaper, day-rollover, auth-tuple-change, \u2026) and `reason` is the free-text rationale when one was given (e.g. the agent\'s own words for a request_restart). `detail` (ENG-8293) is the structured "what changed?" payload, null for sources that don\'t emit one. For `auth-tuple-change` it is { auth_tuple: { changed[], unchanged[], components[] } } naming WHICH credential/identity component moved and its before/after fingerprint \u2014 the auth tuple is deliberately NOT keyed on the rotating access token, so an auth-tuple-change is always a genuine credential or identity change, and `detail.auth_tuple.changed` is how you tell which one. Comparing `components[].to` across agents answers whether a restart WAVE was one control-plane push (same new value everywhere) or coincidental per-agent rotations. Two modes: (1) pass { agent_id } to scope to ONE agent (fails closed if you\'re not authorized for its org) \u2014 use when a specific agent went quiet. (2) OMIT agent_id for a CROSS-AGENT sweep across every org you\'re authorized for (optionally narrow with { org_id }) \u2014 use to spot fleet-wide restart storms or compare agents. Filter the action with `action` (pass "all" to drop the action filter and read every event type), and bound with { since_hours?, limit? }. Cross-agent results are org-walled in SQL; unauthorized orgs are invisible.',
-  queryAuditLogSchema.shape,
+  { description: 'Read recent audit events to troubleshoot why/when agents bounced \u2014 primarily restart events. Defaults to the "agent.restart" action: each event returns { created_at, source, reason, detail, actor_kind, agent_id, code_name }, where `source` is the restart trigger (agent-self-request, channel-command, maintenance-window, stale-mcp, hot-reload-mcp, mcp-presence-reaper, day-rollover, auth-tuple-change, \u2026) and `reason` is the free-text rationale when one was given (e.g. the agent\'s own words for a request_restart). `detail` (ENG-8293) is the structured "what changed?" payload, null for sources that don\'t emit one. For `auth-tuple-change` it is { auth_tuple: { changed[], unchanged[], components[] } } naming WHICH credential/identity component moved and its before/after fingerprint \u2014 the auth tuple is deliberately NOT keyed on the rotating access token, so an auth-tuple-change is always a genuine credential or identity change, and `detail.auth_tuple.changed` is how you tell which one. Comparing `components[].to` across agents answers whether a restart WAVE was one control-plane push (same new value everywhere) or coincidental per-agent rotations. Two modes: (1) pass { agent_id } to scope to ONE agent (fails closed if you\'re not authorized for its org) \u2014 use when a specific agent went quiet. (2) OMIT agent_id for a CROSS-AGENT sweep across every org you\'re authorized for (optionally narrow with { org_id }) \u2014 use to spot fleet-wide restart storms or compare agents. Filter the action with `action` (pass "all" to drop the action filter and read every event type), and bound with { since_hours?, limit? }. Cross-agent results are org-walled in SQL; unauthorized orgs are invisible.', inputSchema: queryAuditLogSchema },
   async (args) => {
     try {
       const result = await client.queryAuditLog(args);
@@ -21854,10 +21837,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_request_access",
-  "Open scoped READ access to a SELF-MANAGED customer org so the read tools (debug_search_agents / debug_get_agent / debug_search_hosts / debug_list_alerts) can reach it. Use this when a read returns nothing for an org you have a legitimate support reason to troubleshoot. It mints a short-TTL, logged, customer-revocable read grant \u2014 the customer sees the access in their Support-access console and can revoke it, and it auto-expires; it does NOT grant any write/remedial capability. For an already-authorized org (Integrity-Labs-internal or fully-managed) this returns { already_authorized: true } instead of minting a redundant grant \u2014 just use the read tools. Pass { target_org_id, reason }; the reason is recorded verbatim on the customer-visible access log, so be specific.",
-  requestAccessSchema.shape,
+  { description: "Open scoped READ access to a SELF-MANAGED customer org so the read tools (debug_search_agents / debug_get_agent / debug_search_hosts / debug_list_alerts) can reach it. Use this when a read returns nothing for an org you have a legitimate support reason to troubleshoot. It mints a short-TTL, logged, customer-revocable read grant \u2014 the customer sees the access in their Support-access console and can revoke it, and it auto-expires; it does NOT grant any write/remedial capability. For an already-authorized org (Integrity-Labs-internal or fully-managed) this returns { already_authorized: true } instead of minting a redundant grant \u2014 just use the read tools. Pass { target_org_id, reason }; the reason is recorded verbatim on the customer-visible access log, so be specific.", inputSchema: requestAccessSchema },
   async (args) => {
     try {
       const result = await client.requestAccess({
@@ -21870,10 +21852,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "request_action",
-  `Request a HITL-gated remedial action on a customer agent: "restart" (bounce the agent \u2014 reversible, backlog replays) or "clear_pending_inbound" (move stuck pending-inbound markers aside \u2014 drops queued inbound messages, NOT reprocessed). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { action, target_agent_id, reason }.`,
-  requestActionSchema.shape,
+  { description: `Request a HITL-gated remedial action on a customer agent: "restart" (bounce the agent \u2014 reversible, backlog replays) or "clear_pending_inbound" (move stuck pending-inbound markers aside \u2014 drops queued inbound messages, NOT reprocessed). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { action, target_agent_id, reason }.`, inputSchema: requestActionSchema },
   async (args) => {
     try {
       const result = await client.requestAction(args.action, {
@@ -21886,10 +21867,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_restart_agent",
-  `Request a HITL-gated RESTART of a customer agent \u2014 bounce its session so the manager respawns it on the next poll (reversible; the inbound backlog replays). Use this to recover a wedged agent or to make it pick up a newly-bound integration/config change. A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Org-agnostic: keyed on the agent's host assignment, so it works cross-org without an active-org dependency. This is the same path as request_action({ action: "restart" }), exposed as a dedicated tool for discoverability. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { target_agent_id, reason }.`,
-  restartAgentSchema.shape,
+  { description: `Request a HITL-gated RESTART of a customer agent \u2014 bounce its session so the manager respawns it on the next poll (reversible; the inbound backlog replays). Use this to recover a wedged agent or to make it pick up a newly-bound integration/config change. A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage; in shadow mode the approval runs but nothing executes. Org-agnostic: keyed on the agent's host assignment, so it works cross-org without an active-org dependency. This is the same path as request_action({ action: "restart" }), exposed as a dedicated tool for discoverability. Returns { request_id, status, write_mode, notification_status }. Surface a brief, jargon-free note to the user (e.g. "I've asked an admin to approve restarting that agent"). Pass { target_agent_id, reason }.`, inputSchema: restartAgentSchema },
   async (args) => {
     try {
       const result = await client.requestAction("restart", {
@@ -21902,10 +21882,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "request_config_update",
-  "Request a HITL-gated change to a customer agent's model config (primary/secondary/tertiary_model). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). The change is reversible and applies at the agent's NEXT session launch after /host/refresh \u2014 it does not restart the agent. The new value is validated against the agent before approval is requested: Claude Code (subscription) agents take a family alias (fable/opus/opus[fast]/sonnet/haiku); routed agents take a full stored model id (e.g. openrouter/anthropic/claude-opus-4-6). Use this to fix a misconfigured model (e.g. an agent wedged on a model its auth can't access). Returns { request_id, status, write_mode, notification_status }. Pass { target_agent_id, field, new_value, reason }.",
-  requestConfigUpdateSchema.shape,
+  { description: "Request a HITL-gated change to a customer agent's model config (primary/secondary/tertiary_model). A HUMAN must approve in Slack before anything happens, and only if writes are armed for this stage (shadow mode runs the approval but executes nothing). The change is reversible and applies at the agent's NEXT session launch after /host/refresh \u2014 it does not restart the agent. The new value is validated against the agent before approval is requested: Claude Code (subscription) agents take a family alias (fable/opus/opus[fast]/sonnet/haiku); routed agents take a full stored model id (e.g. openrouter/anthropic/claude-opus-4-6). Use this to fix a misconfigured model (e.g. an agent wedged on a model its auth can't access). Returns { request_id, status, write_mode, notification_status }. Pass { target_agent_id, field, new_value, reason }.", inputSchema: requestConfigUpdateSchema },
   async (args) => {
     try {
       const result = await client.requestConfigUpdate({
@@ -21920,10 +21899,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "request_ssm_run",
-  "Request a HITL-gated, ALLOWLISTED read-only DIAGNOSTIC command on a customer agent's host over SSM \u2014 the escape hatch for host/process/service facts the typed read tools (debug_get_agent, debug_tail_logs, debug_host_versions) don't cover. A HUMAN must approve the EXACT command in Slack before it runs, and only if writes are armed (shadow mode runs the approval but executes nothing). This is NOT a shell: `command` is a CLOSED enum \u2014 host_health (uptime/df/free), manager_status (systemctl status agt-manager), manager_journal (journalctl -n 200), process_list (ps comm-only, no argv/env), agent_dir (ls -la ~/.augmented/<code_name>/, names only). No free-form commands, no file-content reads (use debug_tail_logs for log contents). Async: returns { request_id, status, write_mode, command_key, resolved_command, notification_status }; after approval, poll check_action_status to read the command OUTPUT in result_payload. Pass { target_agent_id, command, reason }.",
-  requestSsmRunSchema.shape,
+  { description: "Request a HITL-gated, ALLOWLISTED read-only DIAGNOSTIC command on a customer agent's host over SSM \u2014 the escape hatch for host/process/service facts the typed read tools (debug_get_agent, debug_tail_logs, debug_host_versions) don't cover. A HUMAN must approve the EXACT command in Slack before it runs, and only if writes are armed (shadow mode runs the approval but executes nothing). This is NOT a shell: `command` is a CLOSED enum \u2014 host_health (uptime/df/free), manager_status (systemctl status agt-manager), manager_journal (journalctl -n 200), process_list (ps comm-only, no argv/env), agent_dir (ls -la ~/.augmented/<code_name>/, names only). No free-form commands, no file-content reads (use debug_tail_logs for log contents). Async: returns { request_id, status, write_mode, command_key, resolved_command, notification_status }; after approval, poll check_action_status to read the command OUTPUT in result_payload. Pass { target_agent_id, command, reason }.", inputSchema: requestSsmRunSchema },
   async (args) => {
     try {
       const result = await client.requestSsmRun({
@@ -21937,10 +21915,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "debug_replay_dead_letter",
-  "Request a HITL-gated REPLAY of ONE dead-lettered inbound \u2014 re-inject a customer message that was parked on the host (listed by debug_inspect_dead_letters) back into the agent's live inbound so it is reprocessed. This is the inverse of clear_pending_inbound: use it to recover a message a wedged agent missed. A HUMAN must approve in Slack before anything happens, and only if writes are armed (shadow mode runs the approval but executes nothing). The marker is matched on the host by the exact (channel, store, marker_name) you pass \u2014 copy them verbatim from the inspect result \u2014 so a stale or wrong selector safely no-ops (`replayed:false, reason:not_found`) rather than moving the wrong message. Async: returns { request_id, status, write_mode, notification_status }; after approval, poll check_action_status (result_payload carries { replayed, moved_to }). Pass { target_agent_id, channel, store, marker_name, reason }.",
-  replayDeadLetterSchema.shape,
+  { description: "Request a HITL-gated REPLAY of ONE dead-lettered inbound \u2014 re-inject a customer message that was parked on the host (listed by debug_inspect_dead_letters) back into the agent's live inbound so it is reprocessed. This is the inverse of clear_pending_inbound: use it to recover a message a wedged agent missed. A HUMAN must approve in Slack before anything happens, and only if writes are armed (shadow mode runs the approval but executes nothing). The marker is matched on the host by the exact (channel, store, marker_name) you pass \u2014 copy them verbatim from the inspect result \u2014 so a stale or wrong selector safely no-ops (`replayed:false, reason:not_found`) rather than moving the wrong message. Async: returns { request_id, status, write_mode, notification_status }; after approval, poll check_action_status (result_payload carries { replayed, moved_to }). Pass { target_agent_id, channel, store, marker_name, reason }.", inputSchema: replayDeadLetterSchema },
   async (args) => {
     try {
       const result = await client.requestReplayDeadLetter({
@@ -21956,10 +21933,9 @@ server.tool(
     }
   }
 );
-server.tool(
+server.registerTool(
   "check_action_status",
-  "Poll the decision on a remedial action you requested (the approval result is also pushed to you via direct-chat). Returns { status, result_payload, denial_reason, resolved_at } \u2014 for an approved request_ssm_run, result_payload carries the command output; for debug_replay_dead_letter, result_payload carries { replayed, moved_to }. Pass { request_id }.",
-  checkActionStatusSchema.shape,
+  { description: "Poll the decision on a remedial action you requested (the approval result is also pushed to you via direct-chat). Returns { status, result_payload, denial_reason, resolved_at } \u2014 for an approved request_ssm_run, result_payload carries the command output; for debug_replay_dead_letter, result_payload carries { replayed, moved_to }. Pass { request_id }.", inputSchema: checkActionStatusSchema },
   async (args) => {
     try {
       const result = await client.getActionStatus(args.request_id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.625",
+  "version": "0.28.626",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {