@autohq/cli 0.1.367 → 0.1.369

package/dist/agent-bridge.js

@@ -23492,7 +23492,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.367",
+  version: "0.1.369",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -24196,6 +24196,7 @@ var AuthScopeSchema = external_exports.enum([
   "secrets:write",
   "secrets:use",
   "secret-values:read",
+  "webhook_endpoints:write",
   "github:mcp",
   "github:credentials",
   "mcp:connection",
@@ -27999,6 +28000,9 @@ var OrganizationIdentityPolicySchema = external_exports.object({
   allowAssertedForGit: external_exports.boolean()
 });
 var UpdateOrganizationIdentityPolicyRequestSchema = OrganizationIdentityPolicySchema.strict();
+var UpdateOrganizationSettingsRequestSchema = external_exports.object({
+  name: external_exports.string().trim().min(1)
+}).strict();
 
 // ../../packages/schemas/src/billing.ts
 var FEE_CARD_2026_07_06 = {
@@ -28175,8 +28179,12 @@ var ProjectDefaultAgentSchema = external_exports.object({
   source: ProjectDefaultAgentSourceSchema
 });
 var UpdateProjectSettingsRequestSchema = external_exports.object({
-  defaultAgentName: ResourceNameSchema.nullable()
-}).strict();
+  defaultAgentName: ResourceNameSchema.nullable().optional(),
+  name: external_exports.string().trim().min(1).optional()
+}).strict().refine(
+  (value2) => value2.defaultAgentName !== void 0 || value2.name !== void 0,
+  { message: "At least one settings field is required" }
+);
 
 // ../../packages/schemas/src/project-service-accounts.ts
 var ProjectServiceAccountSchema = external_exports.object({
@@ -28887,6 +28895,37 @@ var SetupOnboardingPullRequestStatusResponseSchema = external_exports.object({
   }),
   ready: external_exports.boolean()
 });
+var SetupOnboardingScopeSchema = external_exports.object({
+  organizationId: external_exports.string().trim().min(1),
+  projectId: external_exports.string().trim().min(1)
+});
+var SetupOnboardingPullRequestSnapshotSchema = external_exports.discriminatedUnion(
+  "mode",
+  [
+    external_exports.object({
+      mode: external_exports.literal("pull_request"),
+      scope: SetupOnboardingScopeSchema,
+      githubConnection: external_exports.string().trim().min(1),
+      slackConnection: external_exports.string().trim().min(1).optional(),
+      repo: GithubSyncRepositoryFullNameSchema,
+      pullRequest: SetupOnboardingPullRequestSchema
+    }),
+    external_exports.object({
+      mode: external_exports.literal("sync"),
+      scope: SetupOnboardingScopeSchema,
+      githubConnection: external_exports.string().trim().min(1),
+      slackConnection: external_exports.string().trim().min(1).optional(),
+      repo: GithubSyncRepositoryFullNameSchema,
+      sync: SetupOnboardingSyncSchema
+    })
+  ]
+);
+var SetupOnboardingStateSchema = external_exports.object({
+  introSeen: external_exports.boolean(),
+  completed: external_exports.boolean(),
+  skipped: external_exports.boolean(),
+  pullRequest: SetupOnboardingPullRequestSnapshotSchema.nullable()
+});
 
 // ../../packages/schemas/src/runtime-log.ts
 var RUNTIME_LOG_LEVELS = ["debug", "info", "warn", "error"];
@@ -34700,7 +34739,7 @@ triggers:
       files: [
         {
           path: "fragments/onboarding-quickstart.yaml",
-          content: "systemPrompt:\n  append: |\n    ---\n    This project was created from the Auto quickstart template repo, so it\n    arrived with a working fleet instead of an empty `.auto/` directory:\n\n    - `.auto/agents/pr-review.yaml` \u2014 reviews every pull request.\n    - `.auto/agents/handoff.yaml` \u2014 a coding agent that takes mentioned work\n      all the way to a merged PR.\n    - `.auto/agents/self-improvement.yaml` \u2014 a scheduled sweep over this\n      project's sessions and PR feedback that proposes concrete improvements.\n    - `site/` \u2014 a small animated site that `.github/workflows/publish.yml`\n      republishes to here.now on every merge to main, posting the fresh URL\n      as a comment on the merge commit. Anonymous mode: each deploy gets a\n      new 24-hour URL until the user opts into keyed publishing.\n    - `.auto/fragments/site-handoff-trigger.yaml` \u2014 a webhook trigger, not\n      yet enabled, that lets the published site's password bar hand feature\n      requests to the handoff agent.\n\n    Run the walkthrough as short beats, each one showing Auto doing something\n    real, and keep the momentum between them. Do not dump the whole plan up\n    front, and do NOT share the site URL yet \u2014 the reveal comes with the\n    request bar in beat 2. All user actions happen in the web UI; never point\n    the user at CLI commands.\n\n    Beat 1 \u2014 tour. In a few sentences: the agents above, and the loop that\n    powers everything (merge to main \u2192 Auto applies `.auto/` \u2192 the site\n    republishes).\n\n    Beat 2 \u2014 set up the site request bar. Do this immediately after the\n    pitch, without waiting for permission: the point is that their site is\n    being set up while you talk.\n    1. Generate a three-word passphrase in your sandbox with exactly this\n       command:\n\n       curl -s https://raw.githubusercontent.com/bitcoin/bips/master/bip-0039/english.txt |\n       awk -v seed=\"$(od -An -N4 -tu4 /dev/urandom | tr -d ' ')\" \\\n         'BEGIN{srand(seed)} {w[NR]=$0} END{print w[int(rand()*NR)+1], w[int(rand()*NR)+1], w[int(rand()*NR)+1]}'\n\n    2. Create the `site-request-password` secret yourself with the\n       `auto.secrets.create` tool, passing those three words\n       (space-separated) as the explicit value. Value mode is deliberate\n       here \u2014 the user has to be told the passphrase to use the bar \u2014 even\n       though generate mode is normally preferred.\n    3. Reserve the webhook endpoint with the `auto.webhooks.create`\n       tool: name `site-requests`, bearer auth with\n       `secretRef: site-request-password`. It returns the allocated slug and\n       ingest URL \u2014 always use the returned values; the slug can differ from\n       the name if the bare name is taken globally.\n    4. Open the wiring PR right away: (a) add\n       `../fragments/site-handoff-trigger.yaml` to the imports of\n       `.auto/agents/handoff.yaml` (the fragment already declares\n       `endpoint: site-requests` with the same auth, so the apply binds it to\n       your reservation), and (b) fill in `site/config.js`: `webhookUrl` with\n       the ingest URL the reservation returned, and `sessionsUrl` with this\n       project's sessions page URL so the site can point visitors at the\n       handoff agent's progress.\n    5. Now tell the user their passphrase, that it is saved as the\n       `site-request-password` project secret, and that they can rotate it\n       any time in Settings \u2192 Secrets. Ask them to review and merge the PR.\n    6. When that PR's merge event arrives in this session, the publish\n       workflow redeploys the site and posts the fresh URL as a comment on\n       the merge commit \u2014 give it a couple of minutes, fetch that comment,\n       and NOW share the site link as the reveal. Tell the user: unlock the\n       bar with the passphrase (the site remembers it after the first time),\n       describe something they want added, and send.\n\n    Beat 3 \u2014 watch the loop close. Their request spawns a handoff session,\n    and the site links them to the sessions page to follow along. When the\n    handoff agent's PR opens, point out that pr-review is already on it.\n    Have them merge it and watch the next deploy comment for their change,\n    live on the site.\n\n    Beat 4 \u2014 a permanent URL (optional, mention once, don't push).\n    Anonymous deploy URLs rotate and expire after 24 hours. If this repo is\n    private, each deploy comment also carries a claim link that keeps that\n    site on their here.now account. For a stable URL either way: create an\n    API key at here.now, add it as a `HERENOW_API_KEY` repository secret in\n    GitHub (repo Settings \u2192 Secrets and variables \u2192 Actions \u2014 the key must\n    never pass through this chat), and commit the desired slug to\n    `.auto/hosting-slug`; the same publish workflow switches to keyed\n    publishing on the next merge.\n\n    Beat 5 \u2014 show off introspection. Once the handoff loop has run, introduce\n    `self-improvement`: it sweeps this project's sessions and PR feedback on\n    a schedule and proposes concrete, evidence-backed upgrades. Offer to\n    start a session for it now \u2014 the sessions the user just generated give it\n    real material \u2014 and walk through its findings together when it reports.\n\n    Then keep going: this factory is theirs to grow. Offer two or three\n    concrete next automations grounded in their repo and what they showed\n    interest in, and build the first one they pick.\n"
+          content: "systemPrompt:\n  append: |\n    ---\n    This project was created from the Auto quickstart template repo, so it\n    arrived with a working fleet instead of an empty `.auto/` directory:\n\n    - `.auto/agents/pr-review.yaml` \u2014 reviews every pull request.\n    - `.auto/agents/handoff.yaml` \u2014 a coding agent that takes mentioned work\n      all the way to a merged PR.\n    - `.auto/agents/self-improvement.yaml` \u2014 a scheduled sweep over this\n      project's sessions and PR feedback that proposes concrete improvements.\n    - `site/` \u2014 a small animated site that `.github/workflows/publish.yml`\n      republishes to here.now on every merge to main, posting the fresh URL\n      as a comment on the merge commit. Anonymous mode: each deploy gets a\n      new 24-hour URL until the user opts into keyed publishing.\n    - `.auto/fragments/site-handoff-trigger.yaml` \u2014 a webhook trigger, not\n      yet enabled, that lets the published site's password bar hand feature\n      requests to the handoff agent.\n\n    Run the walkthrough as short beats, each one showing Auto doing something\n    real, and keep the momentum between them. Do not dump the whole plan up\n    front, and do NOT share the site URL yet \u2014 the reveal comes with the\n    request bar in beat 2. All user actions happen in the web UI; never point\n    the user at CLI commands.\n\n    Beat 1 \u2014 tour. In a few sentences: the agents above, and the loop that\n    powers everything (merge to main \u2192 Auto applies `.auto/` \u2192 the site\n    republishes).\n\n    Beat 2 \u2014 set up the site request bar. Do this immediately after the\n    pitch, without waiting for permission: the point is that their site is\n    being set up while you talk.\n    1. Generate a three-word passphrase in your sandbox with exactly this\n       command:\n\n       curl -s https://raw.githubusercontent.com/bitcoin/bips/master/bip-0039/english.txt |\n       awk -v seed=\"$(od -An -N4 -tu4 /dev/urandom | tr -d ' ')\" \\\n         'BEGIN{srand(seed)} {w[NR]=$0} END{print w[int(rand()*NR)+1], w[int(rand()*NR)+1], w[int(rand()*NR)+1]}'\n\n    2. Create the `site-request-password` secret yourself with the\n       `auto.secrets.create` tool, passing those three words\n       (space-separated) as the explicit value. Value mode is deliberate\n       here \u2014 the user has to be told the passphrase to use the bar \u2014 even\n       though generate mode is normally preferred.\n    3. Reserve the webhook endpoint with the `auto.webhooks.create`\n       tool: name `site-requests`, bearer auth with\n       `secretRef: site-request-password`. It returns the allocated slug and\n       ingest URL \u2014 always use the returned values; the slug can differ from\n       the name if the bare name is taken globally.\n    4. Open the wiring PR right away: (a) add\n       `../fragments/site-handoff-trigger.yaml` to the imports of\n       `.auto/agents/handoff.yaml` (the fragment already declares\n       `endpoint: site-requests` with the same auth, so the apply binds it to\n       your reservation), and (b) fill in `site/config.js`: `webhookUrl` with\n       the ingest URL the reservation returned, and `sessionsUrl` with this\n       project's sessions page URL so the site can point visitors at the\n       handoff agent's progress.\n    5. Now tell the user their passphrase, that it is saved as the\n       `site-request-password` project secret, and that they can rotate it\n       any time in Settings \u2192 Secrets. Ask them to review and merge the PR.\n    6. When that PR's merge event arrives in this session, the publish\n       workflow redeploys the site and posts the fresh URL as a comment on\n       the merge commit \u2014 give it a couple of minutes, fetch that comment,\n       and NOW share the site link as the reveal. Tell the user: unlock the\n       bar with the passphrase (the site remembers it after the first time),\n       describe something they want added, and send.\n\n    Beat 3 \u2014 watch the loop close. Their request spawns a handoff session,\n    and the site links them to the sessions page to follow along. When the\n    handoff agent's PR opens, point out that pr-review is already on it.\n    Have them merge it and watch the next deploy comment for their change,\n    live on the site.\n\n    Beat 4 \u2014 a permanent URL (optional, mention once, don't push).\n    Anonymous deploy URLs rotate and expire after 24 hours. Each deploy\n    comment also carries a claim link that keeps that site on their here.now\n    account. For a stable URL without claiming each deploy: create an\n    API key at here.now, add it as a `HERENOW_API_KEY` repository secret in\n    GitHub (repo Settings \u2192 Secrets and variables \u2192 Actions \u2014 the key must\n    never pass through this chat), and commit the desired slug to\n    `.auto/hosting-slug`; the same publish workflow switches to keyed\n    publishing on the next merge.\n\n    Beat 5 \u2014 show off introspection. Once the handoff loop has run, introduce\n    `self-improvement`: it sweeps this project's sessions and PR feedback on\n    a schedule and proposes concrete, evidence-backed upgrades. Offer to\n    start a session for it now \u2014 the sessions the user just generated give it\n    real material \u2014 and walk through its findings together when it reports.\n\n    Then keep going: this factory is theirs to grow. Offer two or three\n    concrete next automations grounded in their repo and what they showed\n    interest in, and build the first one they pick.\n"
         }
       ]
     }

package/dist/index.js

@@ -15430,6 +15430,7 @@ var init_auth = __esm({
       "secrets:write",
       "secrets:use",
       "secret-values:read",
+      "webhook_endpoints:write",
       "github:mcp",
       "github:credentials",
       "mcp:connection",
@@ -19613,7 +19614,7 @@ var init_mcp = __esm({
 });
 
 // ../../packages/schemas/src/organization-settings.ts
-var OrganizationIdentityPolicySchema, UpdateOrganizationIdentityPolicyRequestSchema;
+var OrganizationIdentityPolicySchema, UpdateOrganizationIdentityPolicyRequestSchema, UpdateOrganizationSettingsRequestSchema;
 var init_organization_settings = __esm({
   "../../packages/schemas/src/organization-settings.ts"() {
     "use strict";
@@ -19622,6 +19623,9 @@ var init_organization_settings = __esm({
       allowAssertedForGit: external_exports.boolean()
     });
     UpdateOrganizationIdentityPolicyRequestSchema = OrganizationIdentityPolicySchema.strict();
+    UpdateOrganizationSettingsRequestSchema = external_exports.object({
+      name: external_exports.string().trim().min(1)
+    }).strict();
   }
 });
 
@@ -19822,8 +19826,12 @@ var init_project_config = __esm({
       source: ProjectDefaultAgentSourceSchema
     });
     UpdateProjectSettingsRequestSchema = external_exports.object({
-      defaultAgentName: ResourceNameSchema.nullable()
-    }).strict();
+      defaultAgentName: ResourceNameSchema.nullable().optional(),
+      name: external_exports.string().trim().min(1).optional()
+    }).strict().refine(
+      (value) => value.defaultAgentName !== void 0 || value.name !== void 0,
+      { message: "At least one settings field is required" }
+    );
   }
 });
 
@@ -20570,7 +20578,7 @@ var init_session_turns = __esm({
 });
 
 // ../../packages/schemas/src/setup.ts
-var SetupOnboardingPullRequestCreateRequestSchema, SetupOnboardingPullRequestSchema, SetupOnboardingSyncSchema, SetupOnboardingPullRequestCreateResponseSchema, SetupOnboardingPullRequestStatusRequestSchema, SetupOnboardingPullRequestStatusResponseSchema;
+var SetupOnboardingPullRequestCreateRequestSchema, SetupOnboardingPullRequestSchema, SetupOnboardingSyncSchema, SetupOnboardingPullRequestCreateResponseSchema, SetupOnboardingPullRequestStatusRequestSchema, SetupOnboardingPullRequestStatusResponseSchema, SetupOnboardingScopeSchema, SetupOnboardingPullRequestSnapshotSchema, SetupOnboardingStateSchema;
 var init_setup = __esm({
   "../../packages/schemas/src/setup.ts"() {
     "use strict";
@@ -20620,6 +20628,37 @@ var init_setup = __esm({
       }),
       ready: external_exports.boolean()
     });
+    SetupOnboardingScopeSchema = external_exports.object({
+      organizationId: external_exports.string().trim().min(1),
+      projectId: external_exports.string().trim().min(1)
+    });
+    SetupOnboardingPullRequestSnapshotSchema = external_exports.discriminatedUnion(
+      "mode",
+      [
+        external_exports.object({
+          mode: external_exports.literal("pull_request"),
+          scope: SetupOnboardingScopeSchema,
+          githubConnection: external_exports.string().trim().min(1),
+          slackConnection: external_exports.string().trim().min(1).optional(),
+          repo: GithubSyncRepositoryFullNameSchema,
+          pullRequest: SetupOnboardingPullRequestSchema
+        }),
+        external_exports.object({
+          mode: external_exports.literal("sync"),
+          scope: SetupOnboardingScopeSchema,
+          githubConnection: external_exports.string().trim().min(1),
+          slackConnection: external_exports.string().trim().min(1).optional(),
+          repo: GithubSyncRepositoryFullNameSchema,
+          sync: SetupOnboardingSyncSchema
+        })
+      ]
+    );
+    SetupOnboardingStateSchema = external_exports.object({
+      introSeen: external_exports.boolean(),
+      completed: external_exports.boolean(),
+      skipped: external_exports.boolean(),
+      pullRequest: SetupOnboardingPullRequestSnapshotSchema.nullable()
+    });
   }
 });
 
@@ -26512,7 +26551,7 @@ triggers:
           files: [
             {
               path: "fragments/onboarding-quickstart.yaml",
-              content: "systemPrompt:\n  append: |\n    ---\n    This project was created from the Auto quickstart template repo, so it\n    arrived with a working fleet instead of an empty `.auto/` directory:\n\n    - `.auto/agents/pr-review.yaml` \u2014 reviews every pull request.\n    - `.auto/agents/handoff.yaml` \u2014 a coding agent that takes mentioned work\n      all the way to a merged PR.\n    - `.auto/agents/self-improvement.yaml` \u2014 a scheduled sweep over this\n      project's sessions and PR feedback that proposes concrete improvements.\n    - `site/` \u2014 a small animated site that `.github/workflows/publish.yml`\n      republishes to here.now on every merge to main, posting the fresh URL\n      as a comment on the merge commit. Anonymous mode: each deploy gets a\n      new 24-hour URL until the user opts into keyed publishing.\n    - `.auto/fragments/site-handoff-trigger.yaml` \u2014 a webhook trigger, not\n      yet enabled, that lets the published site's password bar hand feature\n      requests to the handoff agent.\n\n    Run the walkthrough as short beats, each one showing Auto doing something\n    real, and keep the momentum between them. Do not dump the whole plan up\n    front, and do NOT share the site URL yet \u2014 the reveal comes with the\n    request bar in beat 2. All user actions happen in the web UI; never point\n    the user at CLI commands.\n\n    Beat 1 \u2014 tour. In a few sentences: the agents above, and the loop that\n    powers everything (merge to main \u2192 Auto applies `.auto/` \u2192 the site\n    republishes).\n\n    Beat 2 \u2014 set up the site request bar. Do this immediately after the\n    pitch, without waiting for permission: the point is that their site is\n    being set up while you talk.\n    1. Generate a three-word passphrase in your sandbox with exactly this\n       command:\n\n       curl -s https://raw.githubusercontent.com/bitcoin/bips/master/bip-0039/english.txt |\n       awk -v seed=\"$(od -An -N4 -tu4 /dev/urandom | tr -d ' ')\" \\\n         'BEGIN{srand(seed)} {w[NR]=$0} END{print w[int(rand()*NR)+1], w[int(rand()*NR)+1], w[int(rand()*NR)+1]}'\n\n    2. Create the `site-request-password` secret yourself with the\n       `auto.secrets.create` tool, passing those three words\n       (space-separated) as the explicit value. Value mode is deliberate\n       here \u2014 the user has to be told the passphrase to use the bar \u2014 even\n       though generate mode is normally preferred.\n    3. Reserve the webhook endpoint with the `auto.webhooks.create`\n       tool: name `site-requests`, bearer auth with\n       `secretRef: site-request-password`. It returns the allocated slug and\n       ingest URL \u2014 always use the returned values; the slug can differ from\n       the name if the bare name is taken globally.\n    4. Open the wiring PR right away: (a) add\n       `../fragments/site-handoff-trigger.yaml` to the imports of\n       `.auto/agents/handoff.yaml` (the fragment already declares\n       `endpoint: site-requests` with the same auth, so the apply binds it to\n       your reservation), and (b) fill in `site/config.js`: `webhookUrl` with\n       the ingest URL the reservation returned, and `sessionsUrl` with this\n       project's sessions page URL so the site can point visitors at the\n       handoff agent's progress.\n    5. Now tell the user their passphrase, that it is saved as the\n       `site-request-password` project secret, and that they can rotate it\n       any time in Settings \u2192 Secrets. Ask them to review and merge the PR.\n    6. When that PR's merge event arrives in this session, the publish\n       workflow redeploys the site and posts the fresh URL as a comment on\n       the merge commit \u2014 give it a couple of minutes, fetch that comment,\n       and NOW share the site link as the reveal. Tell the user: unlock the\n       bar with the passphrase (the site remembers it after the first time),\n       describe something they want added, and send.\n\n    Beat 3 \u2014 watch the loop close. Their request spawns a handoff session,\n    and the site links them to the sessions page to follow along. When the\n    handoff agent's PR opens, point out that pr-review is already on it.\n    Have them merge it and watch the next deploy comment for their change,\n    live on the site.\n\n    Beat 4 \u2014 a permanent URL (optional, mention once, don't push).\n    Anonymous deploy URLs rotate and expire after 24 hours. If this repo is\n    private, each deploy comment also carries a claim link that keeps that\n    site on their here.now account. For a stable URL either way: create an\n    API key at here.now, add it as a `HERENOW_API_KEY` repository secret in\n    GitHub (repo Settings \u2192 Secrets and variables \u2192 Actions \u2014 the key must\n    never pass through this chat), and commit the desired slug to\n    `.auto/hosting-slug`; the same publish workflow switches to keyed\n    publishing on the next merge.\n\n    Beat 5 \u2014 show off introspection. Once the handoff loop has run, introduce\n    `self-improvement`: it sweeps this project's sessions and PR feedback on\n    a schedule and proposes concrete, evidence-backed upgrades. Offer to\n    start a session for it now \u2014 the sessions the user just generated give it\n    real material \u2014 and walk through its findings together when it reports.\n\n    Then keep going: this factory is theirs to grow. Offer two or three\n    concrete next automations grounded in their repo and what they showed\n    interest in, and build the first one they pick.\n"
+              content: "systemPrompt:\n  append: |\n    ---\n    This project was created from the Auto quickstart template repo, so it\n    arrived with a working fleet instead of an empty `.auto/` directory:\n\n    - `.auto/agents/pr-review.yaml` \u2014 reviews every pull request.\n    - `.auto/agents/handoff.yaml` \u2014 a coding agent that takes mentioned work\n      all the way to a merged PR.\n    - `.auto/agents/self-improvement.yaml` \u2014 a scheduled sweep over this\n      project's sessions and PR feedback that proposes concrete improvements.\n    - `site/` \u2014 a small animated site that `.github/workflows/publish.yml`\n      republishes to here.now on every merge to main, posting the fresh URL\n      as a comment on the merge commit. Anonymous mode: each deploy gets a\n      new 24-hour URL until the user opts into keyed publishing.\n    - `.auto/fragments/site-handoff-trigger.yaml` \u2014 a webhook trigger, not\n      yet enabled, that lets the published site's password bar hand feature\n      requests to the handoff agent.\n\n    Run the walkthrough as short beats, each one showing Auto doing something\n    real, and keep the momentum between them. Do not dump the whole plan up\n    front, and do NOT share the site URL yet \u2014 the reveal comes with the\n    request bar in beat 2. All user actions happen in the web UI; never point\n    the user at CLI commands.\n\n    Beat 1 \u2014 tour. In a few sentences: the agents above, and the loop that\n    powers everything (merge to main \u2192 Auto applies `.auto/` \u2192 the site\n    republishes).\n\n    Beat 2 \u2014 set up the site request bar. Do this immediately after the\n    pitch, without waiting for permission: the point is that their site is\n    being set up while you talk.\n    1. Generate a three-word passphrase in your sandbox with exactly this\n       command:\n\n       curl -s https://raw.githubusercontent.com/bitcoin/bips/master/bip-0039/english.txt |\n       awk -v seed=\"$(od -An -N4 -tu4 /dev/urandom | tr -d ' ')\" \\\n         'BEGIN{srand(seed)} {w[NR]=$0} END{print w[int(rand()*NR)+1], w[int(rand()*NR)+1], w[int(rand()*NR)+1]}'\n\n    2. Create the `site-request-password` secret yourself with the\n       `auto.secrets.create` tool, passing those three words\n       (space-separated) as the explicit value. Value mode is deliberate\n       here \u2014 the user has to be told the passphrase to use the bar \u2014 even\n       though generate mode is normally preferred.\n    3. Reserve the webhook endpoint with the `auto.webhooks.create`\n       tool: name `site-requests`, bearer auth with\n       `secretRef: site-request-password`. It returns the allocated slug and\n       ingest URL \u2014 always use the returned values; the slug can differ from\n       the name if the bare name is taken globally.\n    4. Open the wiring PR right away: (a) add\n       `../fragments/site-handoff-trigger.yaml` to the imports of\n       `.auto/agents/handoff.yaml` (the fragment already declares\n       `endpoint: site-requests` with the same auth, so the apply binds it to\n       your reservation), and (b) fill in `site/config.js`: `webhookUrl` with\n       the ingest URL the reservation returned, and `sessionsUrl` with this\n       project's sessions page URL so the site can point visitors at the\n       handoff agent's progress.\n    5. Now tell the user their passphrase, that it is saved as the\n       `site-request-password` project secret, and that they can rotate it\n       any time in Settings \u2192 Secrets. Ask them to review and merge the PR.\n    6. When that PR's merge event arrives in this session, the publish\n       workflow redeploys the site and posts the fresh URL as a comment on\n       the merge commit \u2014 give it a couple of minutes, fetch that comment,\n       and NOW share the site link as the reveal. Tell the user: unlock the\n       bar with the passphrase (the site remembers it after the first time),\n       describe something they want added, and send.\n\n    Beat 3 \u2014 watch the loop close. Their request spawns a handoff session,\n    and the site links them to the sessions page to follow along. When the\n    handoff agent's PR opens, point out that pr-review is already on it.\n    Have them merge it and watch the next deploy comment for their change,\n    live on the site.\n\n    Beat 4 \u2014 a permanent URL (optional, mention once, don't push).\n    Anonymous deploy URLs rotate and expire after 24 hours. Each deploy\n    comment also carries a claim link that keeps that site on their here.now\n    account. For a stable URL without claiming each deploy: create an\n    API key at here.now, add it as a `HERENOW_API_KEY` repository secret in\n    GitHub (repo Settings \u2192 Secrets and variables \u2192 Actions \u2014 the key must\n    never pass through this chat), and commit the desired slug to\n    `.auto/hosting-slug`; the same publish workflow switches to keyed\n    publishing on the next merge.\n\n    Beat 5 \u2014 show off introspection. Once the handoff loop has run, introduce\n    `self-improvement`: it sweeps this project's sessions and PR feedback on\n    a schedule and proposes concrete, evidence-backed upgrades. Offer to\n    start a session for it now \u2014 the sessions the user just generated give it\n    real material \u2014 and walk through its findings together when it reports.\n\n    Then keep going: this factory is theirs to grow. Offer two or three\n    concrete next automations grounded in their repo and what they showed\n    interest in, and build the first one they pick.\n"
             }
           ]
         }
@@ -31676,7 +31715,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.367",
+      version: "0.1.369",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.367",
+  "version": "0.1.369",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"