@arbiterhq/cli 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.1.2 — 2026-07-08
+
+### Fixed
+
+- `arbiter --version` now reads the installed package version from `package.json` via `resolveCliPackageVersion()` instead of a hardcoded Commander string (0.1.1 published with a stale `0.1.0` in dist)
+
+## 0.1.1 — 2026-07-08
+
+### Changed
+
+- Scaffolded / discovered permissions in manifests use **`defaultDecision: hold`** instead of legacy posture `status`
+- Depends on `@arbiterhq/sdk@^0.2.1`
+
+### Compatibility
+
+- Manifest validation still accepts deprecated permission `status` posture aliases via the SDK
+
 ## 0.1.0 — 2026-06-28
 
 First public npm release under **`@arbiterhq/cli`**. The CLI binary remains **`arbiter`**; only the npm scope changed from the previously planned `@arbiter` org.
@@ -17,4 +34,4 @@ First public npm release under **`@arbiterhq/cli`**. The CLI binary remains **`a
 
 ### Dependencies
 
-- Requires `@arbiterhq/sdk@^0.2.0` (publish SDK before CLI)
+- Requires `@arbiterhq/sdk@^0.2.1` (publish SDK before CLI)

package/dist/index.js

@@ -109,6 +109,13 @@ var PERMISSION_STATUSES = [
   "denied",
   "approval_required"
 ];
+var PERMISSION_DEFAULT_DECISIONS = ["allow", "hold", "deny"];
+var LEGACY_STATUS_TO_DEFAULT_DECISION = {
+  pending_review: null,
+  allowed: "allow",
+  denied: "deny",
+  approval_required: "hold"
+};
 var AGENT_STATUSES = [
   "pending_review",
   "active",
@@ -172,7 +179,9 @@ var ManifestAgentSchema = z.object({
 var ManifestPermissionSchema = z.object({
   action: z.string().min(1).regex(SNAKE_CASE_ACTION, "Action must be snake_case"),
   description: z.string().optional(),
+  /** @deprecated Prefer defaultDecision. Legacy posture alias. */
   status: z.enum(PERMISSION_STATUSES).optional(),
+  defaultDecision: z.enum(PERMISSION_DEFAULT_DECISIONS).optional(),
   source: z.enum(RESOURCE_SOURCES).optional(),
   management: z.enum(RESOURCE_MANAGEMENTS).optional(),
   assignedAgents: z.array(z.string().min(1)).optional(),
@@ -181,6 +190,21 @@ var ManifestPermissionSchema = z.object({
   documentation: z.string().nullable().optional(),
   tags: z.array(z.string()).nullable().optional(),
   metadata: z.record(z.unknown()).nullable().optional()
+}).transform((permission) => {
+  if (permission.defaultDecision !== void 0) {
+    return permission;
+  }
+  if (permission.status === void 0) {
+    return permission;
+  }
+  const mapped = LEGACY_STATUS_TO_DEFAULT_DECISION[permission.status];
+  if (mapped === null) {
+    return permission;
+  }
+  return {
+    ...permission,
+    defaultDecision: mapped
+  };
 });
 var PolicyConditionSchema = z.object({
   field: z.string().min(1).max(256),
@@ -379,7 +403,7 @@ function starterManifestTemplate() {
       permissions: [
         {
           action: "send_payment",
-          status: "approval_required"
+          defaultDecision: "hold"
         }
       ],
       policies: [
@@ -727,7 +751,7 @@ function buildWorkspaceFromDrift(suggestions, records) {
     if (suggestion.type === "permission" && suggestion.action && !seenPermissions.has(suggestion.action)) {
       workspace.permissions.push({
         action: suggestion.action,
-        status: "pending_review"
+        defaultDecision: "hold"
       });
       seenPermissions.add(suggestion.action);
     }
@@ -754,7 +778,7 @@ function buildWorkspaceFromDrift(suggestions, records) {
     if (record.type === "permission" && record.action && !seenPermissions.has(record.action)) {
       workspace.permissions.push({
         action: record.action,
-        status: "pending_review"
+        defaultDecision: "hold"
       });
       seenPermissions.add(record.action);
     }
@@ -925,10 +949,35 @@ function runWhoami() {
   }
 }
 
+// src/version.ts
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+function resolveCliPackageVersion(fromUrl = import.meta.url) {
+  const startDir = dirname(fileURLToPath(fromUrl));
+  let dir = startDir;
+  for (let depth = 0; depth < 6; depth += 1) {
+    const candidate = join(dir, "package.json");
+    try {
+      const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+      if (parsed.name === "@arbiterhq/cli" && typeof parsed.version === "string" && parsed.version.length > 0) {
+        return parsed.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  throw new Error("Unable to resolve @arbiterhq/cli version from package.json");
+}
+
 // src/cli.ts
 function buildCli() {
   const program2 = new Command();
-  program2.name("arbiter").description("Arbiter governance control plane CLI").version("0.1.0");
+  program2.name("arbiter").description("Arbiter governance control plane CLI").version(resolveCliPackageVersion());
   program2.command("login").description("Store API credentials locally (no network validation)").option("--api-key <key>", "API key value").option("--workspace <name>", "Workspace label").option("--environment <name>", "Environment label").option("--base-url <url>", "API base URL").action(async (options) => {
     await runLogin({
       ...options.apiKey !== void 0 ? { apiKey: options.apiKey } : {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterhq/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Official Arbiter command line interface",
   "license": "MIT",
   "type": "module",
@@ -20,10 +20,11 @@
   "scripts": {
     "build": "tsup src/index.ts --format esm --dts --clean",
     "typecheck": "tsc --noEmit",
+    "test": "tsx --test 'src/**/*.test.ts'",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@arbiterhq/sdk": "^0.2.0",
+    "@arbiterhq/sdk": "^0.2.1",
     "commander": "^13.1.0",
     "yaml": "^2.8.0",
     "zod": "^3.25.76"
@@ -31,6 +32,7 @@
   "devDependencies": {
     "@types/node": "^22.15.21",
     "tsup": "^8.5.0",
+    "tsx": "^4.23.0",
     "typescript": "^5.8.3"
   },
   "keywords": [