fix(rapid7-insightidr): make list_alert_fields callable with no arguments (v1.1.1)

The bare call answered HTTP 400:

  root path with path depth greater than 1 is not supported for V2
  without a search filter

Sending neither path nor path_depth asks the V2 fields endpoint to walk the
whole hierarchy from the root, which it refuses. That is exactly the call an
operator makes first — open the command, run it, see what the tenant exposes —
so the one entry point into this API failed on its most obvious use.

Default path_depth to 1 when neither path nor search is given: the top-level
nodes come back, and `path` drills down from there. Also expose the `search`
query parameter, which was missing from the command entirely and which lifts
the depth restriction — it is the way to look through the whole tree at once
for a field whose branch you do not know yet (search=hostname).

Found by running the command against a live tenant. The 400 also settles the
open question from v1.1.0: the API answered a validation error rather than
403, so the Alert Triage API is reachable with this key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

integrations/rapid7-insightidr/scripts/list_alert_fields.py

@@ -45,9 +45,20 @@ def run():
     # /alerts/fields is deprecated in favour of /alerts/2/fields. Field ids are
     # dotted paths (process.cmd_line, …) and are what search_alerts and
     # get_alert accept in field_ids — this command is how you discover them.
+    path = inp.get("path")
+    search = inp.get("search")
+    depth = inp.get("path_depth")
+    if not depth and not path and not search:
+        # V2 refuses an unbounded walk of the whole tree: "root path with path
+        # depth greater than 1 is not supported for V2 without a search filter".
+        # So the bare call — the one an operator makes first, to see what exists
+        # — has to name a depth. 1 lists the top-level nodes, and `path` or
+        # `search` is how you go deeper from there.
+        depth = 1
     out = request("GET", AT + "alerts/2/fields", params={
-        "path": inp.get("path"),
-        "path_depth": inp.get("path_depth"),
+        "path": path,
+        "path_depth": depth,
+        "search": search,
         "index": inp.get("index") or "0",
         "size": inp.get("page_size") or inp.get("limit") or 200,
     })