feat(bitdefender): complete Network module (build-out 3/N)

- Completed Network module for bitdefender skill (GravityZone Public API)
- Added getEndpointTags (read), setEndpointLabel (gated), createReconfigureClientTask/reconfigure (gated)
- Confirmed createUninstallTask, getEndpointsByPolicy, getManagedEndpointDetailsByIp, createScanTaskByMailboxes not found under /network
- Fixed endpoint-tags renderer to handle list result (previously crashing _print_kv)
- raw gates setEndpointLabel; reconfigure already gated
- selftest 55 -> 60 passing

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/bitdefender/scripts/gz.py

@@ -510,6 +510,38 @@ def cmd_move(client, args):
           args.json, _print_kv)
 
 
+def _print_tags(tags) -> None:
+    items = tags if isinstance(tags, list) else (tags or {}).get("items", [])
+    print(f"Endpoint tags: {len(items)}")
+    for t in items:
+        print(f"  {t}")
+
+
+def cmd_endpoint_tags(client, args):
+    _emit(client.get_endpoint_tags(), args.json, _print_tags)
+
+
+def cmd_set_label(client, args):
+    if not _gated(f"label endpoint {args.endpoint} = '{args.label}'", args.confirm):
+        return 3
+    result = client.set_endpoint_label(args.endpoint, args.label)
+    _emit({"labeled": args.endpoint, "label": args.label, "result": result},
+          args.json, _print_kv)
+    return 0
+
+
+def cmd_reconfigure(client, args):
+    extra, rc = _load_json_arg(args.extra_json, "extra-json")
+    if rc:
+        return rc
+    if not _gated(f"reconfigure {len(args.targets)} agent(s): {','.join(args.targets)}",
+                  args.confirm):
+        return 3
+    result = client.reconfigure_client(args.targets, extra=extra or None)
+    _emit({"reconfigured": args.targets, "result": result}, args.json, _print_kv)
+    return 0
+
+
 def cmd_make_group(client, args):
     result = client.create_custom_group(args.name, args.parent)
     _emit({"createdGroup": args.name, "result": result}, args.json, _print_kv)
@@ -524,7 +556,7 @@ DESTRUCTIVE_RAW_PATTERNS = ("delete", "createuninstall", "createremove",
                             "removefromblocklist", "assignpolicy",
                             "setpushevent", "createaccount", "updateaccount",
                             "configurenotif", "createcompany", "suspendcompany",
-                            "activatecompany")
+                            "activatecompany", "setendpointlabel")
 
 
 def _is_destructive_method(method: str) -> bool:
@@ -770,6 +802,21 @@ def build_parser() -> argparse.ArgumentParser:
     sp.add_argument("--name", required=True)
     sp.add_argument("--parent")
 
+    sub.add_parser("endpoint-tags", help="List endpoint tags.", parents=[common])
+
+    sp = sub.add_parser("set-label", help="Set an endpoint's label (gated).",
+                        parents=[common])
+    sp.add_argument("--endpoint", required=True, help="endpointId.")
+    sp.add_argument("--label", required=True)
+    sp.add_argument("--confirm", action="store_true")
+
+    sp = sub.add_parser("reconfigure",
+                        help="Reconfigure installed agents (gated).", parents=[common])
+    sp.add_argument("--targets", nargs="+", required=True, help="Endpoint ids.")
+    sp.add_argument("--extra-json",
+                    help="JSON reconfigure body (modules/roles/scanMode).")
+    sp.add_argument("--confirm", action="store_true")
+
     sp = sub.add_parser("raw", help="Call any method directly (power use).",
                         parents=[common])
     sp.add_argument("--module", required=True)
@@ -928,6 +975,9 @@ HANDLERS = {
     "scan": cmd_scan,
     "move": cmd_move,
     "make-group": cmd_make_group,
+    "endpoint-tags": cmd_endpoint_tags,
+    "set-label": cmd_set_label,
+    "reconfigure": cmd_reconfigure,
     "raw": cmd_raw,
     "delete-endpoint": cmd_delete_endpoint,
     "delete-package": cmd_delete_package,

.claude/skills/bitdefender/scripts/gz_client.py

@@ -721,6 +721,33 @@ class GravityZoneClient:
             params["status"] = status
         return self._jsonrpc_request("network", "getScanTasksList", params) or {}
 
+    def get_endpoint_tags(self) -> Any:
+        """List endpoint tags defined in the tenant (network.getEndpointTags). Read."""
+        return self._jsonrpc_request("network", "getEndpointTags", {})
+
+    def set_endpoint_label(self, endpoint_id: str, label: str) -> Any:
+        """Set an endpoint's label (network.setEndpointLabel). STATE-CHANGING.
+        Requires `endpointId` and `label` (both verified). Gate at the call site."""
+        return self._jsonrpc_request(
+            "network", "setEndpointLabel",
+            {"endpointId": endpoint_id, "label": label},
+        )
+
+    def reconfigure_client(
+        self, target_ids: list[str], extra: Optional[dict] = None
+    ) -> Any:
+        """Reconfigure installed agents (network.createReconfigureClientTask).
+        STATE-CHANGING. Requires `targetIds` (verified); the reconfigure body
+        (which modules/roles/scanMode to change) is documented and passed via
+        `extra`. Gate at the call site behind --confirm.
+        """
+        params: dict = {"targetIds": target_ids}
+        if extra:
+            params.update(extra)
+        return self._jsonrpc_request(
+            "network", "createReconfigureClientTask", params
+        )
+
     # ======================================================================
     # REPORTS (module `/reports`) — VERIFIED LIVE
     # ======================================================================

.claude/skills/bitdefender/scripts/selftest.py

@@ -105,6 +105,13 @@ check("push-set no confirm -> rc3", ["push-set", "--status", "1", "--url", "http
 check("push-set enable no url -> rc2", ["push-set", "--status", "1", "--confirm"], want_rc=2)
 check("raw assignPolicy no confirm -> rc3", ["raw", "--module", "network", "--method", "assignPolicy", "--params", "{}"], want_rc=3)
 
+# --- network completion ---
+check("endpoint-tags", ["endpoint-tags"], want_rc=0)
+check("set-label no confirm -> rc3", ["set-label", "--endpoint", "x", "--label", "y"], want_rc=3)
+check("reconfigure no confirm -> rc3", ["reconfigure", "--targets", "x"], want_rc=3)
+check("raw reconfigure no confirm -> rc3", ["raw", "--module", "network", "--method", "createReconfigureClientTask", "--params", "{}"], want_rc=3)
+check("raw setEndpointLabel no confirm -> rc3", ["raw", "--module", "network", "--method", "setEndpointLabel", "--params", "{}"], want_rc=3)
+
 # --- companies module ---
 check("company (own, no id)", ["company"], want_rc=0)
 check("company-create no confirm -> rc3", ["company-create", "--type", "1", "--name", "Test Co"], want_rc=3, out_has="Would")