@integrity-labs/agt-cli 0.28.68 → 0.28.70

package/dist/mcp/augmented-admin.js

@@ -21102,6 +21102,22 @@ var AdminDebugClient = class _AdminDebugClient {
   inspectFlags(args) {
     return this.get("/admin/debug/inspect-flags", _AdminDebugClient.cleanQuery(args));
   }
+  // ENG-6516: alert triage writes — a single triage route, three ergonomic verbs.
+  triageAlert(alertId, body) {
+    return this.post(`/admin/debug/alerts/${encodeURIComponent(alertId)}/triage`, body);
+  }
+  /** Acknowledge an open alert (ENG-6516). */
+  ackAlert(args) {
+    return this.triageAlert(args.alert_id, { action: "ack", reason: args.reason });
+  }
+  /** Snooze an open alert until 15m|1h|4h|until_tomorrow (ENG-6516). */
+  snoozeAlert(args) {
+    return this.triageAlert(args.alert_id, { action: "snooze", duration: args.duration, reason: args.reason });
+  }
+  /** Close an open alert (closed_reason=manual) (ENG-6516). */
+  closeAlert(args) {
+    return this.triageAlert(args.alert_id, { action: "close", reason: args.reason });
+  }
   /** List the orgs you're authorized to read, with tier + grant standing + rollups (ENG-6483). */
   searchOrgs(args) {
     return this.get("/admin/debug/orgs", _AdminDebugClient.cleanQuery(args));
@@ -21282,6 +21298,21 @@ var inspectFlagsSchema = external_exports.object({
   host: external_exports.string().min(1).max(128).optional().describe("The host id (uuid) or its exact, case-insensitive name. Pass this OR agent_id."),
   agent_id: external_exports.string().min(1).max(64).optional().describe("The agent UUID \u2014 flags are inspected on the agent's current host. Pass this OR host.")
 });
+var alertIdField = external_exports.string().min(1).max(64).describe("The alert id (uuid), from debug_list_alerts.");
+var triageReasonField = external_exports.string().max(2e3).optional().describe("Why \u2014 recorded on the cross-org audit trail. Be specific.");
+var ackAlertSchema = external_exports.object({
+  alert_id: alertIdField,
+  reason: triageReasonField
+});
+var snoozeAlertSchema = external_exports.object({
+  alert_id: alertIdField,
+  duration: external_exports.enum(["15m", "1h", "4h", "until_tomorrow"]).describe("How long to suppress paging: 15m | 1h | 4h | until_tomorrow (09:00 UTC next day)."),
+  reason: triageReasonField
+});
+var closeAlertSchema = external_exports.object({
+  alert_id: alertIdField,
+  reason: triageReasonField
+});
 var hostVersionsSchema = external_exports.object({
   q: external_exports.string().max(128).optional().describe("Case-insensitive substring match on host name."),
   status: external_exports.string().max(32).optional().describe("Filter by host status (active | decommissioned)."),
@@ -21557,6 +21588,45 @@ server.tool(
     }
   }
 );
+server.tool(
+  "debug_ack_alert",
+  "Acknowledge an open alert \u2014 close the triage loop here instead of bouncing to the webapp. Stops escalation/paging for it without closing it. Unlike the host-affecting remedial actions this is a low-risk, reversible control-plane write (it sets acknowledged_at/by on the alert row), so it applies directly \u2014 gated by the admin-debug write mode and authorized against the alert's org (a NULL-org infra alert is IL-internal-only). Returns { alert_id, action, write_mode, applied, alert }. `applied:false` means write mode is `shadow` (validated, not written). Get the alert id from debug_list_alerts. Pass { alert_id, reason? }. Every call is audited as a cross-org access.",
+  ackAlertSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.ackAlert(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "debug_snooze_alert",
+  "Snooze an open alert \u2014 suppress fresh pages for it until 15m | 1h | 4h | until_tomorrow (09:00 UTC next day), without closing it. Low-risk reversible control-plane write (sets snoozed_until); applies directly under the admin-debug write mode, authorized against the alert's org. Returns { alert_id, action, write_mode, applied, alert }; `applied:false` \u21D2 shadow mode. Pass { alert_id, duration, reason? }. Audited as a cross-org access.",
+  snoozeAlertSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.snoozeAlert(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "debug_close_alert",
+  "Close an open alert (closed_reason=manual) \u2014 resolve it from here when you've confirmed it's handled, instead of the webapp. Low-risk control-plane write (sets closed_at + closed_reason); applies directly under the admin-debug write mode, authorized against the alert's org. Only OPEN alerts can be closed (a 409 means it was already closed). Returns { alert_id, action, write_mode, applied, alert }; `applied:false` \u21D2 shadow mode. Pass { alert_id, reason? }. Audited as a cross-org access.",
+  closeAlertSchema.shape,
+  async (args) => {
+    try {
+      const result = await client.closeAlert(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatError2(err) }], isError: true };
+    }
+  }
+);
 server.tool(
   "debug_search_orgs",
   `List the ORGANIZATIONS you're authorized to read \u2014 the org-level entry point for triage and access decisions, so you don't have to infer orgs off agent/host rows or probe one org's tier with debug_request_access. Returns a projection per org: { organization_id, organization_slug, display_name, is_internal, management_mode (fully_managed | self_managed), standing_reason (internal | fully_managed | granted \u2014 WHY you can read it), has_active_grant (do you hold a live grant right now), host_count, agent_count, active_agent_count, open_alert_count, created_at }. Use it to (1) decide access in one read \u2014 see a self_managed org and its grant state before deciding to debug_request_access; (2) triage the fleet \u2014 "which orgs have open alerts" (open_alert_count includes stuck-restart alerts) without walking agents; (3) disambiguate a slug \u2192 id \u2192 tier without needing an agent/host to exist. Authorized = IL-owned (is_internal) + fully-managed orgs (standing) plus any self-managed org you hold an active grant for. Filter with { q (slug/name substring), management_mode, is_internal, limit }. Projection only \u2014 no secrets, no transcripts; org-walled in SQL and audited as a cross-org access.`,

package/dist/{persistent-session-666YVY2K.js → persistent-session-Y7WG66VC.js}

@@ -25,8 +25,8 @@ import {
   takeZombieDetection,
   writeDirectChatSessionState,
   writePersistentClaudeWrapper
-} from "./chunk-SS56LU6L.js";
-import "./chunk-BBD64HBH.js";
+} from "./chunk-CVKQDF5V.js";
+import "./chunk-OM27L4X2.js";
 import "./chunk-XWVM4KPK.js";
 export {
   SEND_KEYS_ENTER_DELAY_MS,
@@ -56,4 +56,4 @@ export {
   writeDirectChatSessionState,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-666YVY2K.js.map
+//# sourceMappingURL=persistent-session-Y7WG66VC.js.map

package/dist/{responsiveness-probe-ERMYT2UH.js → responsiveness-probe-UK2AFQRX.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-SS56LU6L.js";
-import "./chunk-BBD64HBH.js";
+} from "./chunk-CVKQDF5V.js";
+import "./chunk-OM27L4X2.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -250,4 +250,4 @@ export {
   parkPendingInbound,
   readAndResetChannelDeflections
 };
-//# sourceMappingURL=responsiveness-probe-ERMYT2UH.js.map
+//# sourceMappingURL=responsiveness-probe-UK2AFQRX.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.68",
+  "version": "0.28.70",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {