@integrity-labs/agt-cli 0.28.67 → 0.28.69

package/dist/{chunk-4W57ZRW6.js → chunk-NAKDDR6O.js}

@@ -3,7 +3,7 @@ import {
   formatMissingVar,
   isClaudeFastMode,
   probeMcpEnvSubstitution
-} from "./chunk-CDMYI3G6.js";
+} from "./chunk-F7LALIIP.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -1395,4 +1395,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-4W57ZRW6.js.map
+//# sourceMappingURL=chunk-NAKDDR6O.js.map

package/dist/{chunk-M4PTVE27.js → chunk-RTQ42HVY.js}

@@ -22,7 +22,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-CDMYI3G6.js";
+} from "./chunk-F7LALIIP.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -7347,7 +7347,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.67" : "dev";
+var agtCliVersion = true ? "0.28.69" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8643,4 +8643,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-M4PTVE27.js.map
+//# sourceMappingURL=chunk-RTQ42HVY.js.map

package/dist/{claude-pair-runtime-ICHMWZPP.js → claude-pair-runtime-W6D56XZG.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-XVVQWPD6.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-37EAR7QR.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-ICHMWZPP.js.map
+//# sourceMappingURL=claude-pair-runtime-W6D56XZG.js.map

package/dist/lib/manager-worker.js

@@ -27,7 +27,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-M4PTVE27.js";
+} from "../chunk-RTQ42HVY.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -65,7 +65,7 @@ import {
   takeWatchdogGiveUpCount,
   takeZombieDetection,
   transcriptActivityAgeSeconds
-} from "../chunk-4W57ZRW6.js";
+} from "../chunk-NAKDDR6O.js";
 import {
   FLAGS_SCHEMA_VERSION,
   FLAG_REGISTRY,
@@ -96,7 +96,7 @@ import {
   resolveDmTarget,
   sumTranscriptUsageInWindow,
   wrapScheduledTaskPrompt
-} from "../chunk-CDMYI3G6.js";
+} from "../chunk-F7LALIIP.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -6734,7 +6734,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.67" : "dev";
+var agtCliVersion = true ? "0.28.69" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7842,7 +7842,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-XVVQWPD6.js");
+      const { collectDiagnostics } = await import("../persistent-session-37EAR7QR.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -7943,7 +7943,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-IRGV6O77.js");
+      } = await import("../responsiveness-probe-WI5X7C55.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -7975,7 +7975,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-IRGV6O77.js");
+        } = await import("../responsiveness-probe-WI5X7C55.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -11409,7 +11409,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-ICHMWZPP.js");
+  } = await import("../claude-pair-runtime-W6D56XZG.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/augmented-admin.js

@@ -21098,6 +21098,26 @@ var AdminDebugClient = class _AdminDebugClient {
   getHost(args) {
     return this.get("/admin/debug/get-host", _AdminDebugClient.cleanQuery(args));
   }
+  /** Effective feature flags WITH source attribution for an agent/host (ENG-6517). */
+  inspectFlags(args) {
+    return this.get("/admin/debug/inspect-flags", _AdminDebugClient.cleanQuery(args));
+  }
+  // ENG-6516: alert triage writes — a single triage route, three ergonomic verbs.
+  triageAlert(alertId, body) {
+    return this.post(`/admin/debug/alerts/${encodeURIComponent(alertId)}/triage`, body);
+  }
+  /** Acknowledge an open alert (ENG-6516). */
+  ackAlert(args) {
+    return this.triageAlert(args.alert_id, { action: "ack", reason: args.reason });
+  }
+  /** Snooze an open alert until 15m|1h|4h|until_tomorrow (ENG-6516). */
+  snoozeAlert(args) {
+    return this.triageAlert(args.alert_id, { action: "snooze", duration: args.duration, reason: args.reason });
+  }
+  /** Close an open alert (closed_reason=manual) (ENG-6516). */
+  closeAlert(args) {
+    return this.triageAlert(args.alert_id, { action: "close", reason: args.reason });
+  }
   /** List the orgs you're authorized to read, with tier + grant standing + rollups (ENG-6483). */
   searchOrgs(args) {
     return this.get("/admin/debug/orgs", _AdminDebugClient.cleanQuery(args));
@@ -21274,6 +21294,25 @@ var getHostSchema = external_exports.object({
   host: external_exports.string().min(1).max(128).describe("The host id (uuid) or its exact, case-insensitive name. Use the id if the name is ambiguous."),
   since_hours: external_exports.number().int().min(1).max(720).optional().describe("Window for the restart-count rollup, in hours. Default 24.")
 });
+var inspectFlagsSchema = external_exports.object({
+  host: external_exports.string().min(1).max(128).optional().describe("The host id (uuid) or its exact, case-insensitive name. Pass this OR agent_id."),
+  agent_id: external_exports.string().min(1).max(64).optional().describe("The agent UUID \u2014 flags are inspected on the agent's current host. Pass this OR host.")
+});
+var alertIdField = external_exports.string().min(1).max(64).describe("The alert id (uuid), from debug_list_alerts.");
+var triageReasonField = external_exports.string().max(2e3).optional().describe("Why \u2014 recorded on the cross-org audit trail. Be specific.");
+var ackAlertSchema = external_exports.object({
+  alert_id: alertIdField,
+  reason: triageReasonField
+});
+var snoozeAlertSchema = external_exports.object({
+  alert_id: alertIdField,
+  duration: external_exports.enum(["15m", "1h", "4h", "until_tomorrow"]).describe("How long to suppress paging: 15m | 1h | 4h | until_tomorrow (09:00 UTC next day)."),
+  reason: triageReasonField
+});
+var closeAlertSchema = external_exports.object({
+  alert_id: alertIdField,
+  reason: triageReasonField
+});
 var hostVersionsSchema = external_exports.object({
   q: external_exports.string().max(128).optional().describe("Case-insensitive substring match on host name."),
   status: external_exports.string().max(32).optional().describe("Filter by host status (active | decommissioned)."),
@@ -21515,6 +21554,27 @@ server.tool(
     }
   }
 );
+server.tool(
+  "debug_inspect_flags",
+  "Inspect an agent/host's EFFECTIVE feature flags WITH source attribution \u2014 the one-call answer to \"is an env override silently masking a flag?\" (the ENG-6478 / koda drift class), instead of grepping manager.log for WARN spam. For each registry flag it returns { effective, source, env_value, env_var, heartbeat_value, central_value, default_value, env_masks_heartbeat, host_stale, sensitive }. `source` mirrors how the host actually resolves a flag: env override > heartbeat-materialized (the value the control plane last sent the host) > compiled default. `env_masks_heartbeat:true` is the smoking gun for ENG-6478 (a host env gate overriding a different DB-resolved value); `host_stale:true` means the host hasn't picked up a central change. Host-side values come from the host's latest config snapshot (so snapshot:null \u21D2 the host hasn't reported one and attribution degrades to default + central). Top-level `drift_keys` lists the flags worth looking at. Pass exactly one of { host } (id or exact name) or { agent_id } (inspects its current host). Read-only; fails closed for an unauthorized/unknown target; audited as a cross-org access.",
+  inspectFlagsSchema.shape,
+  async (args) => {
+    try {
+      const hasHost = typeof args.host === "string" && args.host.length > 0;
+      const hasAgent = typeof args.agent_id === "string" && args.agent_id.length > 0;
+      if (hasHost === hasAgent) {
+        return {
+          content: [{ type: "text", text: "Pass exactly one of host or agent_id." }],
+          isError: true
+        };
+      }
+      const result = await client.inspectFlags(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.tool(
   "debug_list_alerts",
   "List recent platform alerts across authorized orgs (host-down, agent-stale, probe-timeout, auth-failed), including NULL-team host alerts. Returns a projection per alert (kind, severity, message, source, open/closed state). Filter with { severity, open, limit }.",
@@ -21528,6 +21588,45 @@ server.tool(
     }
   }
 );
+server.tool(
+  "debug_ack_alert",
+  "Acknowledge an open alert \u2014 close the triage loop here instead of bouncing to the webapp. Stops escalation/paging for it without closing it. Unlike the host-affecting remedial actions this is a low-risk, reversible control-plane write (it sets acknowledged_at/by on the alert row), so it applies directly \u2014 gated by the admin-debug write mode and authorized against the alert's org (a NULL-org infra alert is IL-internal-only). Returns { alert_id, action, write_mode, applied, alert }. `applied:false` means write mode is `shadow` (validated, not written). Get the alert id from debug_list_alerts. Pass { alert_id, reason? }. Every call is audited as a cross-org access.",
+  ackAlertSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.ackAlert(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "debug_snooze_alert",
+  "Snooze an open alert \u2014 suppress fresh pages for it until 15m | 1h | 4h | until_tomorrow (09:00 UTC next day), without closing it. Low-risk reversible control-plane write (sets snoozed_until); applies directly under the admin-debug write mode, authorized against the alert's org. Returns { alert_id, action, write_mode, applied, alert }; `applied:false` \u21D2 shadow mode. Pass { alert_id, duration, reason? }. Audited as a cross-org access.",
+  snoozeAlertSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.snoozeAlert(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "debug_close_alert",
+  "Close an open alert (closed_reason=manual) \u2014 resolve it from here when you've confirmed it's handled, instead of the webapp. Low-risk control-plane write (sets closed_at + closed_reason); applies directly under the admin-debug write mode, authorized against the alert's org. Only OPEN alerts can be closed (a 409 means it was already closed). Returns { alert_id, action, write_mode, applied, alert }; `applied:false` \u21D2 shadow mode. Pass { alert_id, reason? }. Audited as a cross-org access.",
+  closeAlertSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.closeAlert(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.tool(
   "debug_search_orgs",
   `List the ORGANIZATIONS you're authorized to read \u2014 the org-level entry point for triage and access decisions, so you don't have to infer orgs off agent/host rows or probe one org's tier with debug_request_access. Returns a projection per org: { organization_id, organization_slug, display_name, is_internal, management_mode (fully_managed | self_managed), standing_reason (internal | fully_managed | granted \u2014 WHY you can read it), has_active_grant (do you hold a live grant right now), host_count, agent_count, active_agent_count, open_alert_count, created_at }. Use it to (1) decide access in one read \u2014 see a self_managed org and its grant state before deciding to debug_request_access; (2) triage the fleet \u2014 "which orgs have open alerts" (open_alert_count includes stuck-restart alerts) without walking agents; (3) disambiguate a slug \u2192 id \u2192 tier without needing an agent/host to exist. Authorized = IL-owned (is_internal) + fully-managed orgs (standing) plus any self-managed org you hold an active grant for. Filter with { q (slug/name substring), management_mode, is_internal, limit }. Projection only \u2014 no secrets, no transcripts; org-walled in SQL and audited as a cross-org access.`,

package/dist/{persistent-session-XVVQWPD6.js → persistent-session-37EAR7QR.js}

@@ -25,8 +25,8 @@ import {
   takeZombieDetection,
   writeDirectChatSessionState,
   writePersistentClaudeWrapper
-} from "./chunk-4W57ZRW6.js";
-import "./chunk-CDMYI3G6.js";
+} from "./chunk-NAKDDR6O.js";
+import "./chunk-F7LALIIP.js";
 import "./chunk-XWVM4KPK.js";
 export {
   SEND_KEYS_ENTER_DELAY_MS,
@@ -56,4 +56,4 @@ export {
   writeDirectChatSessionState,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-XVVQWPD6.js.map
+//# sourceMappingURL=persistent-session-37EAR7QR.js.map

package/dist/{responsiveness-probe-IRGV6O77.js → responsiveness-probe-WI5X7C55.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-4W57ZRW6.js";
-import "./chunk-CDMYI3G6.js";
+} from "./chunk-NAKDDR6O.js";
+import "./chunk-F7LALIIP.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -250,4 +250,4 @@ export {
   parkPendingInbound,
   readAndResetChannelDeflections
 };
-//# sourceMappingURL=responsiveness-probe-IRGV6O77.js.map
+//# sourceMappingURL=responsiveness-probe-WI5X7C55.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.67",
+  "version": "0.28.69",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {