@alter-ai/cli 0.7.0 → 0.8.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alter AI, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -14,8 +14,11 @@ alter --version
 ## Sign in
 
 ```bash
-alter auth login                          # interactive browser flow
-ALTER_PAT=alter_pat_... alter apps list   # headless / CI
+alter auth login                # interactive browser flow
+alter auth login --token-stdin  # pre-minted PAT; prompts, input hidden
+
+# CI: configure a masked ALTER_PAT secret in the provider, then run normally
+alter apps list
 ```
 
 ## Commands
@@ -24,16 +27,17 @@ ALTER_PAT=alter_pat_... alter apps list   # headless / CI
 auth                login | status | logout
 apps                list | create | show | update | archive | unarchive | delete
 keys                list | statistics | mint | show | rotate | revoke | rename
-agents              list | create | show | update | revoke | audit |
+agents              list | create | show | update | suspend | resume | revoke | audit |
                     registry-list | registry-show |
                     (+ mint-key, list-keys, revoke-key, deprecate-key, undeprecate-key)
 providers           list | list-catalog | create | show | update | delete
+                    spec {list, status} | operations {list, get}
 identity-providers  create | discover | webhook {enable, disable, rotate, status}
 managed-secrets     list | show | create | rotate | delete | templates | access |
                     set-delegation-policy | set-allowed-hosts | users |
                     grants {list, list-for-agent, create, update, revoke} |
                     groups {list, show}
-policy              show-app | rules {create, list, get, update, delete}
+policy              show-app | simulate | rules {create, list, get, update, delete}
 audit               list | show | explain | portal-actions | grant-events | traces |
                     threads | thread | agents | agent | integrity-check
 grants              list | revoke
@@ -41,17 +45,38 @@ analytics           summary | dashboard | api-calls | by-provider | by-app |
                     policy | latency | errors
 end-users           list | show
 branding            get | set | reset
-approvals           defaults
+approvals           defaults | list | show
 pats                whoami
 link / unlink       pin an app to the current directory
 design / verify     design-doc gate | code + runtime verification
 init / doctor       project scaffolding | environment diagnosis
 completion          install | print
 self-update         --to <v>
-sdk-passthrough     request <grant-id> --url <url>
+sdk-passthrough     request <grant-id> --url <url> | resolve-identity
+```
+
+Data-returning commands expose `--output=json|table|jsonl`. For single-object
+reports (including `design`, `verify`, and `doctor`), `jsonl` falls back to
+pretty-printed JSON. `--fields a,b,c` is global but only affects JSON / JSONL
+emitted through the shared output formatter; it is inert for table output and
+commands that print confirmation text. See
+[scripting](https://docs.alterauth.com/reference/cli/scripting) for exit codes
+and CI patterns, and
+[authentication](https://docs.alterauth.com/reference/cli/authentication) for
+token storage details.
+
+Agent scope updates use optimistic concurrency because `--scopes` replaces the
+complete provider allowlist. Read the current `version`, then include it in the
+update so a concurrent operator change is rejected instead of overwritten:
+
+```bash
+alter agents show --app "$APP_ID" --agent "$AGENT_ID" --output=json
+alter agents update --app "$APP_ID" --agent "$AGENT_ID" \
+  --scopes '{"github":["read:user"]}' --expected-version 7
 ```
 
-All commands accept `--output=json|table|jsonl` and `--fields a,b,c`. See [scripting](https://docs.alterauth.com/reference/cli/scripting) for exit codes and CI patterns, and [authentication](https://docs.alterauth.com/reference/cli/authentication) for token storage details.
+A concurrent change exits with code `5` and a safe conflict message. Fetch the
+agent again, reconcile the desired scopes, and retry with its new `version`.
 
 ## License
 

package/THIRD_PARTY_NOTICES

@@ -0,0 +1,11 @@
+Third-Party Notices
+
+This distribution may include:
+
+- Commander.js, Copyright (c) 2011 TJ Holowaychuk, MIT License.
+- PostHog Node SDK, Copyright PostHog, Inc., MIT License.
+- node-keytar, Copyright (c) 2013 GitHub, Inc., MIT License.
+- @alter-ai/alter-sdk, Copyright (c) 2026 Alter AI, MIT License.
+
+The complete corresponding license texts are available in the installed package metadata and
+the upstream projects. These notices do not modify the Alter CLI's MIT License.

package/dist/cli.d.ts

@@ -62,11 +62,20 @@
  *
  * Scope: this pre-parser ONLY touches argv when the ``self-update``
  * subcommand is present. Every other subcommand sees argv verbatim.
- * The rewrite handles both ``--version <value>`` (space form) and
- * ``--version=<value>`` (equals form). A bare ``--version`` without a
- * follow-up value is LEFT ALONE — that's the legitimate "print CLI
- * version" invocation, and rewriting it to ``--to`` (which requires a
- * value) would surface a confusing error.
+ * The rewrite handles every form the legacy flag was typed in:
+ * ``--version <value>`` (space), ``--version=<value>`` (equals), and
+ * bare ``--version`` with no value.
+ *
+ * The bare form used to be left alone so Commander's program-wide
+ * ``-V/--version`` would service it as a "print CLI version" request.
+ * It no longer can: ``buildProgram`` confines each command's option
+ * scan to its own argv, so a flag typed after ``self-update`` belongs
+ * to ``self-update`` — which is what ``gh``, ``git``, ``docker``, and
+ * ``kubectl`` all do with a post-subcommand ``--version``. Rewriting
+ * the bare form keeps the deprecation path pointing operators at
+ * ``--to`` (``option '--to <version>' argument missing``) instead of
+ * dead-ending them on ``unknown option '--version'``. The CLI's own
+ * version stays one token away, at ``alter --version``.
  *
  * Returns the (possibly rewritten) argv array. Pure function modulo
  * the stderr write on rewrite; safe to call on every CLI startup.