@integrity-labs/agt-cli 0.28.66 → 0.28.68

package/dist/{chunk-MYAMDJGD.js → chunk-I2UIKFQ7.js}

@@ -22,7 +22,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-XKAJW4EX.js";
+} from "./chunk-BBD64HBH.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -7347,7 +7347,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.66" : "dev";
+var agtCliVersion = true ? "0.28.68" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8643,4 +8643,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-MYAMDJGD.js.map
+//# sourceMappingURL=chunk-I2UIKFQ7.js.map

package/dist/{chunk-4P7HUXWI.js → chunk-SS56LU6L.js}

@@ -3,7 +3,7 @@ import {
   formatMissingVar,
   isClaudeFastMode,
   probeMcpEnvSubstitution
-} from "./chunk-XKAJW4EX.js";
+} from "./chunk-BBD64HBH.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -1395,4 +1395,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-4P7HUXWI.js.map
+//# sourceMappingURL=chunk-SS56LU6L.js.map

package/dist/{claude-pair-runtime-SPP3CUBA.js → claude-pair-runtime-YW5A7RTN.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-WJBIN6WM.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-666YVY2K.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-SPP3CUBA.js.map
+//# sourceMappingURL=claude-pair-runtime-YW5A7RTN.js.map

package/dist/lib/manager-worker.js

@@ -27,7 +27,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-MYAMDJGD.js";
+} from "../chunk-I2UIKFQ7.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -65,7 +65,7 @@ import {
   takeWatchdogGiveUpCount,
   takeZombieDetection,
   transcriptActivityAgeSeconds
-} from "../chunk-4P7HUXWI.js";
+} from "../chunk-SS56LU6L.js";
 import {
   FLAGS_SCHEMA_VERSION,
   FLAG_REGISTRY,
@@ -96,7 +96,7 @@ import {
   resolveDmTarget,
   sumTranscriptUsageInWindow,
   wrapScheduledTaskPrompt
-} from "../chunk-XKAJW4EX.js";
+} from "../chunk-BBD64HBH.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -6734,7 +6734,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.66" : "dev";
+var agtCliVersion = true ? "0.28.68" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7842,7 +7842,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-WJBIN6WM.js");
+      const { collectDiagnostics } = await import("../persistent-session-666YVY2K.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -7943,7 +7943,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-XVWLBSSH.js");
+      } = await import("../responsiveness-probe-ERMYT2UH.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -7975,7 +7975,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-XVWLBSSH.js");
+        } = await import("../responsiveness-probe-ERMYT2UH.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -11409,7 +11409,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-SPP3CUBA.js");
+  } = await import("../claude-pair-runtime-YW5A7RTN.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/augmented-admin.js

@@ -21094,6 +21094,14 @@ var AdminDebugClient = class _AdminDebugClient {
   searchHosts(args) {
     return this.get("/admin/debug/hosts", _AdminDebugClient.cleanQuery(args));
   }
+  /** Host-centric composite: host + agents + rollup alerts + versions (ENG-6518). */
+  getHost(args) {
+    return this.get("/admin/debug/get-host", _AdminDebugClient.cleanQuery(args));
+  }
+  /** Effective feature flags WITH source attribution for an agent/host (ENG-6517). */
+  inspectFlags(args) {
+    return this.get("/admin/debug/inspect-flags", _AdminDebugClient.cleanQuery(args));
+  }
   /** List the orgs you're authorized to read, with tier + grant standing + rollups (ENG-6483). */
   searchOrgs(args) {
     return this.get("/admin/debug/orgs", _AdminDebugClient.cleanQuery(args));
@@ -21266,6 +21274,14 @@ var searchHostsSchema = external_exports.object({
   status: external_exports.string().max(32).optional().describe("Filter by host status (active | decommissioned)."),
   limit: limitSchema
 });
+var getHostSchema = external_exports.object({
+  host: external_exports.string().min(1).max(128).describe("The host id (uuid) or its exact, case-insensitive name. Use the id if the name is ambiguous."),
+  since_hours: external_exports.number().int().min(1).max(720).optional().describe("Window for the restart-count rollup, in hours. Default 24.")
+});
+var inspectFlagsSchema = external_exports.object({
+  host: external_exports.string().min(1).max(128).optional().describe("The host id (uuid) or its exact, case-insensitive name. Pass this OR agent_id."),
+  agent_id: external_exports.string().min(1).max(64).optional().describe("The agent UUID \u2014 flags are inspected on the agent's current host. Pass this OR host.")
+});
 var hostVersionsSchema = external_exports.object({
   q: external_exports.string().max(128).optional().describe("Case-insensitive substring match on host name."),
   status: external_exports.string().max(32).optional().describe("Filter by host status (active | decommissioned)."),
@@ -21494,6 +21510,40 @@ server.tool(
     }
   }
 );
+server.tool(
+  "debug_get_host",
+  "Fetch a host-centric composite for ONE host \u2014 the host equivalent of debug_get_agent, and the right entry point for host-WIDE incidents (e.g. an env drift or a bad deploy hitting every agent on a box). One read returns: the host projection (status, framework + CC version, last-seen verdict, EC2 + Claude auth), EVERY agent bound to the host (each with its own heartbeat verdict + org), a rollup of alerts (the host's own infra alerts \u2014 including NULL-team ones like host_down / probe_timeout \u2014 PLUS each bound agent's alerts), and a { agent_count, restart_count, restart_window_hours } rollup. Saves stitching debug_search_hosts + per-agent reads together. Resolve the host by its id (uuid) or its exact, case-insensitive name; an ambiguous name returns a 400 asking for the id. Returns { host: { \u2026, agents[], recent_alerts[], rollup } }. Fails closed (uniform not-found) for an unauthorized or unknown host; every call is audited as a cross-org access. Pass { host, since_hours? } (since_hours sets the restart-count window, default 24).",
+  getHostSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.getHost(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "debug_inspect_flags",
+  "Inspect an agent/host's EFFECTIVE feature flags WITH source attribution \u2014 the one-call answer to \"is an env override silently masking a flag?\" (the ENG-6478 / koda drift class), instead of grepping manager.log for WARN spam. For each registry flag it returns { effective, source, env_value, env_var, heartbeat_value, central_value, default_value, env_masks_heartbeat, host_stale, sensitive }. `source` mirrors how the host actually resolves a flag: env override > heartbeat-materialized (the value the control plane last sent the host) > compiled default. `env_masks_heartbeat:true` is the smoking gun for ENG-6478 (a host env gate overriding a different DB-resolved value); `host_stale:true` means the host hasn't picked up a central change. Host-side values come from the host's latest config snapshot (so snapshot:null \u21D2 the host hasn't reported one and attribution degrades to default + central). Top-level `drift_keys` lists the flags worth looking at. Pass exactly one of { host } (id or exact name) or { agent_id } (inspects its current host). Read-only; fails closed for an unauthorized/unknown target; audited as a cross-org access.",
+  inspectFlagsSchema.shape,
+  async (args) => {
+    try {
+      const hasHost = typeof args.host === "string" && args.host.length > 0;
+      const hasAgent = typeof args.agent_id === "string" && args.agent_id.length > 0;
+      if (hasHost === hasAgent) {
+        return {
+          content: [{ type: "text", text: "Pass exactly one of host or agent_id." }],
+          isError: true
+        };
+      }
+      const result = await client.inspectFlags(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.tool(
   "debug_list_alerts",
   "List recent platform alerts across authorized orgs (host-down, agent-stale, probe-timeout, auth-failed), including NULL-team host alerts. Returns a projection per alert (kind, severity, message, source, open/closed state). Filter with { severity, open, limit }.",

package/dist/{persistent-session-WJBIN6WM.js → persistent-session-666YVY2K.js}

@@ -25,8 +25,8 @@ import {
   takeZombieDetection,
   writeDirectChatSessionState,
   writePersistentClaudeWrapper
-} from "./chunk-4P7HUXWI.js";
-import "./chunk-XKAJW4EX.js";
+} from "./chunk-SS56LU6L.js";
+import "./chunk-BBD64HBH.js";
 import "./chunk-XWVM4KPK.js";
 export {
   SEND_KEYS_ENTER_DELAY_MS,
@@ -56,4 +56,4 @@ export {
   writeDirectChatSessionState,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-WJBIN6WM.js.map
+//# sourceMappingURL=persistent-session-666YVY2K.js.map

package/dist/{responsiveness-probe-XVWLBSSH.js → responsiveness-probe-ERMYT2UH.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-4P7HUXWI.js";
-import "./chunk-XKAJW4EX.js";
+} from "./chunk-SS56LU6L.js";
+import "./chunk-BBD64HBH.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -250,4 +250,4 @@ export {
   parkPendingInbound,
   readAndResetChannelDeflections
 };
-//# sourceMappingURL=responsiveness-probe-XVWLBSSH.js.map
+//# sourceMappingURL=responsiveness-probe-ERMYT2UH.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.66",
+  "version": "0.28.68",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {