@knowttl/mg-axi 0.1.1 → 0.1.3

package/inventory/operations.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/inventory/operations.json
-size: 75857800 bytes
-sha256: bf8b0cdd323b9f6fbdd2803f7964e15545bbcc4b779e8e8d6cc6068b11324d95
+size: 76161389 bytes
+sha256: 8168ba7deefe03b569ac77a440ea027380710f7ea2f5a031795ff373ce9199a9

package/inventory/schema.json

@@ -59,7 +59,7 @@
         "roles": {"$ref": "#/$defs/evidence"},
         "licences": {"$ref": "#/$defs/evidence"},
         "cloudAvailability": {"$ref": "#/$defs/evidence"},
-        "disposition": {"enum": ["named-command", "reviewed-raw-read", "scheduled", "intentionally-blocked", "deprecated", "unavailable", "excluded"]},
+        "disposition": {"enum": ["named-command", "reviewed-raw-read", "scheduled", "deferred", "intentionally-blocked", "deprecated", "unavailable", "excluded"]},
         "reason": {"$ref": "#/$defs/text"},
         "owningSlice": {"enum": [null, "READ-01", "READ-02", "READ-03", "READ-04", "READ-05", "READ-06", "READ-07", "READ-08", "READ-09", "READ-10", "EXT-01", "EXT-02", "EXT-02c", "EXT-03", "EXT-04", "WRITE-01", "WRITE-02", "WRITE-03", "WRITE-04", "WRITE-05", "WRITE-N"]}
       },

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@knowttl/mg-axi",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Agent-facing Microsoft Graph CLI, read-only by default",
   "type": "module",
   "bin": {
-    "mg-axi": "dist/bin/mg-axi.js"
+    "mg-axi": "dist/bin/mg-axi.js",
+    "mg-axi-hook": "dist/bin/mg-axi-hook.js"
   },
   "publishConfig": {
     "access": "public"
@@ -27,7 +28,7 @@
   "packageManager": "pnpm@10.34.6",
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "node --test test/*.test.mjs",
+    "test": "node --test --test-concurrency=4 test/*.test.mjs",
     "lint": "tsc --noEmit -p tsconfig.json",
     "docs:generate": "node tools/generate-docs.mjs",
     "docs:check": "node tools/generate-docs.mjs --check"

package/skills/mg-axi/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mg-axi
 description: >
-  Inspect Microsoft Entra users, authentication methods, groups, roles, devices, administrative units, organization and branding, domains and DNS records, certificate authentication, commercial subscriptions, on-premises synchronization, terms-of-use agreements and acceptances, directory objects, organizational contacts, group lifecycle policies, group setting templates, attribute sets and custom security attributes, partner contracts, delegated administration, multi-tenant organization, tenant information, sign-ins and audit logs, applications and consent grants, risk, Conditional Access, identity providers, federation configurations, deleted directory items, data policy operations, access reviews, entitlement catalogs and access packages, entitlement assignments and requests, lifecycle workflows, templates, task definitions, settings, runs, processing results and task reports, reviewed raw reads and run 5 gated writes (account enable/disable, session revocation, group-membership add, risky-user dismissal, CA policy update) through token-efficient TOON output.
+  Inspect Microsoft Entra users, authentication methods, groups, roles, devices, administrative units, organization and branding, domains and DNS records, certificate authentication, commercial subscriptions, on-premises synchronization, terms-of-use agreements and acceptances, directory objects, organizational contacts, group lifecycle policies, group setting templates, attribute sets and custom security attributes, partner contracts, delegated administration, multi-tenant organization, tenant information, sign-ins and audit logs, applications and consent grants, risk, Conditional Access, identity providers, federation configurations, deleted directory items, data policy operations, risk prevention, access reviews, entitlement catalogs and access packages, entitlement assignments and requests, lifecycle workflows, templates, task definitions, settings, runs, processing results and task reports, reviewed raw reads and run 5 gated writes (account enable/disable, session revocation, group-membership add, risky-user dismissal, CA policy update) through token-efficient TOON output.
 user-invocable: false
 ---
 
@@ -38,6 +38,7 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi profile show` | native | local |
 | `mg-axi login` | native | local |
 | `mg-axi setup` | native | local |
+| `mg-axi setup hooks` | native | local |
 | `mg-axi doctor` | native | read |
 | `mg-axi entra user list` | native | read |
 | `mg-axi entra user show` | native | read |
@@ -52,9 +53,26 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra group member add` | native | write |
 | `mg-axi entra directory-role list` | native | read |
 | `mg-axi entra directory-role show` | native | read |
+| `mg-axi entra directory-role-template list` | native | read |
+| `mg-axi entra directory-role-template show` | native | read |
+| `mg-axi entra directory-role member list` | native | read |
+| `mg-axi entra directory-role scoped-member list` | native | read |
+| `mg-axi entra directory-role scoped-member show` | native | read |
+| `mg-axi entra scoped-role-membership list` | native | read |
+| `mg-axi entra scoped-role-membership show` | native | read |
 | `mg-axi entra role-assignment list` | native | read |
 | `mg-axi entra pim eligible list` | native | read |
 | `mg-axi entra pim active list` | native | read |
+| `mg-axi entra pim group-assignment-schedule list` | native | read |
+| `mg-axi entra pim group-assignment-schedule show` | native | read |
+| `mg-axi entra pim group-assignment-instance list` | native | read |
+| `mg-axi entra pim group-assignment-instance show` | native | read |
+| `mg-axi entra pim group-eligibility-schedule list` | native | read |
+| `mg-axi entra pim group-eligibility-schedule show` | native | read |
+| `mg-axi entra pim group-eligibility-instance list` | native | read |
+| `mg-axi entra pim group-eligibility-instance show` | native | read |
+| `mg-axi entra pim group-eligibility-request list` | native | read |
+| `mg-axi entra pim group-eligibility-request show` | native | read |
 | `mg-axi entra device list` | native | read |
 | `mg-axi entra device show` | native | read |
 | `mg-axi entra administrative-unit list` | native | read |
@@ -133,6 +151,12 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra delegated-admin-relationship show-request` | native | read |
 | `mg-axi entra delegated-admin-customer list-service-management-details` | native | read |
 | `mg-axi entra delegated-admin-customer show-service-management-detail` | native | read |
+| `mg-axi entra delegated-admin-customer count` | native | read |
+| `mg-axi entra delegated-admin-customer count-service-management-details` | native | read |
+| `mg-axi entra delegated-admin-relationship count` | native | read |
+| `mg-axi entra delegated-admin-relationship count-access-assignments` | native | read |
+| `mg-axi entra delegated-admin-relationship count-operations` | native | read |
+| `mg-axi entra delegated-admin-relationship count-requests` | native | read |
 | `mg-axi entra multi-tenant-organization show` | native | read |
 | `mg-axi entra multi-tenant-organization join-request show` | native | read |
 | `mg-axi entra multi-tenant-organization tenant list` | native | read |
@@ -142,6 +166,8 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra sign-in show` | native | read |
 | `mg-axi entra directory-audit list` | native | read |
 | `mg-axi entra directory-audit show` | native | read |
+| `mg-axi entra provisioning list` | native | read |
+| `mg-axi entra provisioning show` | native | read |
 | `mg-axi entra application list` | native | read |
 | `mg-axi entra application show` | native | read |
 | `mg-axi entra service-principal list` | native | read |
@@ -150,16 +176,43 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra service-principal owner list` | native | read |
 | `mg-axi entra service-principal oauth2-grant list` | native | read |
 | `mg-axi entra service-principal app-role-assignment list` | native | read |
+| `mg-axi entra service-principal app-role-assignment show` | native | read |
+| `mg-axi entra service-principal app-role-assigned-to list` | native | read |
+| `mg-axi entra service-principal app-role-assigned-to show` | native | read |
+| `mg-axi entra application federated-credential list` | native | read |
+| `mg-axi entra application federated-credential show` | native | read |
+| `mg-axi entra service-principal federated-credential list` | native | read |
+| `mg-axi entra service-principal federated-credential show` | native | read |
 | `mg-axi entra risky-user list` | native | read |
 | `mg-axi entra risky-user show` | native | read |
 | `mg-axi entra risky-user dismiss` | native | write |
 | `mg-axi entra risk-detection list` | native | read |
 | `mg-axi entra risk-detection show` | native | read |
+| `mg-axi entra risky-service-principal list` | native | read |
+| `mg-axi entra risky-service-principal show` | native | read |
+| `mg-axi entra risky-service-principal history list` | native | read |
+| `mg-axi entra risky-service-principal history show` | native | read |
+| `mg-axi entra service-principal-risk-detection list` | native | read |
+| `mg-axi entra service-principal-risk-detection show` | native | read |
 | `mg-axi entra conditional-access policy list` | native | read |
 | `mg-axi entra conditional-access policy show` | native | read |
 | `mg-axi entra conditional-access policy update` | native | write |
 | `mg-axi entra conditional-access named-location list` | native | read |
 | `mg-axi entra conditional-access named-location show` | native | read |
+| `mg-axi entra conditional-access auth-strength-policy list` | native | read |
+| `mg-axi entra conditional-access auth-strength-policy show` | native | read |
+| `mg-axi entra conditional-access combination-configuration list` | native | read |
+| `mg-axi entra conditional-access combination-configuration show` | native | read |
+| `mg-axi entra conditional-access auth-method-mode list` | native | read |
+| `mg-axi entra conditional-access auth-method-mode show` | native | read |
+| `mg-axi entra conditional-access template list` | native | read |
+| `mg-axi entra conditional-access template show` | native | read |
+| `mg-axi entra conditional-access auth-context list` | native | read |
+| `mg-axi entra conditional-access auth-context show` | native | read |
+| `mg-axi entra conditional-access deleted-policy list` | native | read |
+| `mg-axi entra conditional-access deleted-policy show` | native | read |
+| `mg-axi entra conditional-access deleted-named-location list` | native | read |
+| `mg-axi entra conditional-access deleted-named-location show` | native | read |
 | `mg-axi entra identity-provider list` | native | read |
 | `mg-axi entra identity-provider show` | native | read |
 | `mg-axi entra identity-provider count` | native | read |
@@ -182,6 +235,16 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra data-policy-operation list` | native | read |
 | `mg-axi entra data-policy-operation show` | native | read |
 | `mg-axi entra data-policy-operation count` | native | read |
+| `mg-axi entra fraud-protection-provider list` | native | read |
+| `mg-axi entra fraud-protection-provider show` | native | read |
+| `mg-axi entra fraud-protection-provider count` | native | read |
+| `mg-axi entra web-application-firewall-provider list` | native | read |
+| `mg-axi entra web-application-firewall-provider show` | native | read |
+| `mg-axi entra web-application-firewall-provider count` | native | read |
+| `mg-axi entra web-application-firewall-verification list` | native | read |
+| `mg-axi entra web-application-firewall-verification show` | native | read |
+| `mg-axi entra web-application-firewall-verification count` | native | read |
+| `mg-axi entra web-application-firewall-verification provider show` | native | read |
 | `mg-axi entra access-review definition list` | native | read |
 | `mg-axi entra access-review definition show` | native | read |
 | `mg-axi entra access-review instance list` | native | read |
@@ -234,6 +297,15 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra lifecycle task-report count` | native | read |
 | `mg-axi entra lifecycle task-report task show` | native | read |
 | `mg-axi entra lifecycle task-report task-definition show` | native | read |
+| `mg-axi entra lifecycle run user-processing-result list` | native | read |
+| `mg-axi entra lifecycle run user-processing-result show` | native | read |
+| `mg-axi entra lifecycle run user-processing-result count` | native | read |
+| `mg-axi entra lifecycle run subject-processing-result list` | native | read |
+| `mg-axi entra lifecycle run subject-processing-result show` | native | read |
+| `mg-axi entra lifecycle run subject-processing-result count` | native | read |
+| `mg-axi entra lifecycle run task-processing-result list` | native | read |
+| `mg-axi entra lifecycle run task-processing-result show` | native | read |
+| `mg-axi entra lifecycle run task-processing-result count` | native | read |
 | `mg-axi api get` | native | read |
 <!-- command-registry:end -->
 
@@ -275,6 +347,19 @@ npx -y @knowttl/mg-axi entra user list --profile soc --limit 10
 Configuration defaults to `~/.mg-axi/config.json`; `MG_AXI_CONFIG` selects a separate file.
 `mg-axi setup` shows the selected path and writes nothing.
 
+Agent discovery has two install paths, and either suffices alone.
+For ambient context at every agent session start instead of the skill, install the CLI globally and opt into the session hook:
+
+```sh
+npm install --global @knowttl/mg-axi
+mg-axi setup hooks
+```
+
+This installs a `SessionStart` hook for Claude Code, Codex and OpenCode that prints a short local-only summary (configured profile names with tenant labels, auth-cache presence, write posture and version).
+The hook makes no network, Graph or sign-in call, and prints a short `not configured` record with exit 0 when unconfigured.
+Restart the agent session after running the installer.
+No other ordinary command installs hooks, plugins or configuration.
+
 ## Selecting a profile
 
 Read leaves accept `--profile <name>`.