@calliopelabs/cli 3.7.0 → 3.8.0

package/docs/releases/3.8.0.md

@@ -0,0 +1,65 @@
+# Calliope CLI 3.8.0
+
+This release adds explicit subscription access, native task-bound delegation and
+reviewed feedback. It also tightens reviewed inference authority and reads
+Mimwell portable knowledge graphs.
+
+## Experimental subscription access
+
+`calliope auth chatgpt login` selects ChatGPT-plan access for the OpenAI provider.
+Account selection, private credential storage, refresh/revocation and live model
+discovery are separate from API-key access. Streamed Responses and tool calls use
+Calliope's existing permission loop. Expired sessions stop; quota exhaustion can
+use an explicitly configured paid API-key fallback. Subscription requests refuse output-token
+and USD enforcement that the service cannot provide; USD totals exclude this
+consumption. See [ChatGPT plan access](../chatgpt-plan.md).
+
+Quota and rate-limit circuits persist across processes. Opt-in API-key fallback
+reserves every paid request against a shared project ceiling, preserves public
+conversation/tool context and strips encrypted subscription state. Paid sessions
+stay on their selected model; partial output, cancellation, logout and reviewed
+execution stop automatic transitions. A depleted API account stops without
+retrying or switching back. Missing live/reviewed billing bounds refuse payment.
+
+`calliope claude -- <prompt>` delegates a complete session to the installed,
+authenticated official Claude Code CLI. `calliope claude status` checks that local
+setup. Claude owns permissions, tools, sessions and plan usage; Calliope's native
+sandbox and budgets do not govern the delegated session. See
+[local Claude plan delegation](../claude-plan.md).
+
+These integrations ship as opt-in experimental features. Tests use synthetic
+authentication and response fixtures; live account eligibility and subscription
+prompt/tool round trips remain unqualified. Complete the user-operated checks in
+the linked guides before relying on either route for unattended work.
+
+## Reviewed task authority and feedback
+
+Delegated headless and ACP execution can bind to an exact native task attempt,
+including its owner, output cap and original accounting across host restarts.
+Completed or mismatched attempts refuse new inference. Reviewed Smart routing
+pools and provider endpoints now constrain new reservations; an endpoint change
+requires new review, while prior admissions retain replay and settlement.
+See [delegation ledger](../delegation-ledger.md).
+
+Version-2 improvement host discovery exposes reviewed task feedback. Receipts bind
+an assessment to the exact observed completed attempt and retain private journal
+evidence. They neither mark a task accepted nor activate a learned policy. See
+[task feedback](../task-feedback.md). External placement and disposable remote
+parent/child acceptance remain tracked in #415; cross-run learned strategy
+selection remains tracked in #413.
+
+## Compatibility and runtime
+
+- `brain import` accepts `mimwell-kg/v1` alongside existing graph formats; exports
+  continue using `calliope-kg/v1`.
+- OpenAI SDK 7 stream capture handling now recognizes delivered completion events.
+  Runtime SDKs, Conf, Ink and supporting dependencies are updated; container builds
+  include the metadata builder.
+- Node 24 or later is required. The stable ACP wire protocol remains version 1.
+- Mistral/Hugging Face SDK 7 live qualification follow-up remains in #457; xAI is
+  explicitly deferred by the existing publication gate.
+
+Performance budgets from #210 remain enforced for cold start, keystroke rendering
+and retained-session heap growth. See [performance measurements](../performance.md).
+
+Refs: #474, #467, #468, #415, #455, #463, #457.

package/docs/reviewed-provider-metadata.md

@@ -0,0 +1,84 @@
+# Reviewed metadata for bounded provider calls
+
+Some providers discover model IDs without publishing capabilities, limits or
+prices through their models API. An operator can supply the missing evidence for
+bounded execution in a private billing file. This does not enable Smart routing,
+change a provider/model pin, or add models to discovery. The selected model and
+endpoint must still match recent live discovery.
+
+Use `~/.calliope-cli/billing.json` or `CALLIOPE_BILLING_FILE`, outside the worker
+project. Protect it with `chmod 600`. The existing reader rejects aliases,
+symlinks, hardlinks, group/world write access, files over 128 KiB and more than
+64 profiles. Profiles are operator authority; workers must never generate or
+install them from their outputs.
+
+```json
+{
+  "version": 2,
+  "profiles": [{
+    "version": 2,
+    "provider": "deepseek",
+    "model": "<exact live-discovered model ID>",
+    "target": "<configured providerTarget(provider).key digest>",
+    "checkedAt": 0,
+    "expiresAt": 0,
+    "sources": ["https://api-docs.deepseek.com/quick_start/pricing/"],
+    "prices": {"input": 0, "output": 0},
+    "capabilities": {"chat": true, "tools": true, "streaming": true},
+    "limits": {"contextLength": 0, "maxOutputTokens": 0},
+    "admission": "reviewed-full-context-v1"
+  }]
+}
+```
+
+The placeholders are intentionally invalid. Set positive token limits from
+current provider documentation and epoch-millisecond timestamps, with expiry at
+most seven days after review. Review the exact endpoint's billing terms: a
+gateway may charge differently from its upstream provider. Prices are USD per
+million tokens and must upper-bound applicable cache, reasoning and time/tier
+rates on the adapter path. URL presence alone does not verify metadata. Include
+no keys, private prompts or response content; source URLs must be HTTPS without
+credentials, queries or fragments. Every configured provider can use this schema;
+the CLI bundles no model or pricing catalogue.
+
+## Conservative admission
+
+Each request reserves the larger of reviewed and live input capacity, plus its
+requested maximum output. This is a full-capacity allowance, not a tokenizer
+estimate or consumed tokens. A tiny prompt to a large-context model may therefore
+need substantial token headroom before dispatch; do not reduce the reviewed
+capacity to make a budget fit. Successful usage reporting settles the reservation
+to reported usage at the reserved rates. Failures, cancellation and missing usage
+retain the reservation, and overruns stop subsequent requests.
+
+The output maximum is the smaller of the reviewed and live limits. Prices use
+the larger rate for each input/output direction. Reviewed capabilities fill only
+unknown live fields; a live rejection always vetoes the request. Unknown required
+capabilities in both sources fail closed. Live routing metadata remains unchanged,
+including unknown prices used by Smart ranking. This profile does not request
+Anthropic token counting, accept supplied input counts or admit multimodal input.
+
+The provider/model/endpoint binding, original run/agent/project budgets, policy,
+deadlines and cancellation checks still apply. The profile is re-read before
+reservation and before dispatch; deletion, edits or expiry revoke admission.
+Revocation after a durable reservation retains that reservation conservatively.
+No automatic paid probe or retry can replenish the original allowance.
+
+## Versioning and recovery
+
+Version-2 billing files can contain these profiles together with unchanged
+[legacy counted profiles](counted-admission.md). Version-1 files retain their
+original format and hashes; no file or historical journal is migrated.
+
+New quotes carry `quoteEvidence.version = 2`, including the reviewed profile and
+digest, quote time, live observations and required capabilities. Execution
+reservations carrying that proof use reservation event version 4, also supporting
+existing request attribution. Replay reconstructs the conservative bounds from
+the recorded proof and rejects inconsistent prices, limits or event versions.
+Historical replay checks validity at quote time, without fetching metadata or
+requiring a now-expired profile to be renewed.
+
+Ordinary project-capped turns include the same proof in their existing hash-linked
+policy audit event. Execution journals retain it with the reservation. Neither
+contains prompt bytes, tool arguments or credentials. The outer headless JSON
+envelope and existing ledger projections retain their versions.

package/docs/task-feedback.md

@@ -0,0 +1,77 @@
+# Reviewed task feedback
+
+Hosts discover this interface explicitly through
+`calliope improve host-capabilities --contract-version 2 --json` or the
+`taskFeedbackCapabilities()` library API. Default/version-1 host discovery and
+the existing execution capability contract retain their original shapes.
+
+`recordTaskFeedback` records one native-policy-reviewed assessment of an exact
+completed task attempt. It does not mark the task accepted, change a check,
+allocate execution, award a numeric reward or activate a learned policy. A host's
+claimed user/workflow identity is not independently authenticated by this API.
+The trust boundary is the operator-owned native permission decision and store.
+
+```ts
+import {randomUUID} from 'node:crypto';
+import {inspectTaskOutcome, recordTaskFeedback} from
+  '@calliopelabs/cli/dist/improvement/index.js';
+
+const selection = {taskId, attempt, executionRevision};
+const observation = await inspectTaskOutcome(cwd, runId, selection, options);
+const result = await recordTaskFeedback(cwd, runId, {
+  version: 1,
+  id: randomUUID(),
+  selection,
+  observationHash: observation.hash,
+  assessment: {decision: 'accepted', reason: 'Reviewed against the requested result.'},
+  references: [{kind: 'workflow', id: workflowId, revision: workflowHash}],
+}, options);
+```
+
+The caller first presents the native observation and assessment for review.
+The request binds its exact observation hash and execution revision. The shared
+permission resolver applies plan-mode denial, hooks, policy and mutation
+confirmation. Missing confirmation denies by default. An operator may explicitly
+provide the usual native noninteractive permission options; request data cannot
+set its own trust or approval. The writer checks current run approval, ownership,
+revision, retained artifact bytes and accounting again before commit.
+
+Requests accept only the versioned identity, assessment and optional declared
+workflow/skill/policy references. Each reference has a bounded ID and immutable
+revision hash. Unknown fields, including reward, cost, check results and trust
+flags, are rejected. The native configuration hash identifies the actual task,
+agent and applied strategy at that attempt, including prior strategy restoration
+after withdrawal. Declared external references are reviewed metadata; they do not
+prove the content of an external workflow or skill.
+
+## Persistence and inspection
+
+The receipt is a version-12 event in the existing private execution journal.
+Its source includes the native run, manifest, plan, approval, configuration,
+graph, task/start/session and attempt identities. Older journal readers that
+cannot read version 12 must refuse it. The previous journal versions are unchanged.
+At most 64 receipts can be retained in one run, inside the existing journal byte
+limits. Preserve the run when that limit is reached.
+
+Identical request IDs and payloads return the same receipt after rechecking
+native permission. Changed payloads cannot reuse an ID. A lost acknowledgement
+does not append another event, reset the original clock or alter reservations.
+
+`taskFeedbackHistory(cwd, runId, options)` returns recorded receipt history, with
+an explicit notice that its outcome evidence has not been revalidated.
+`inspectTaskFeedback(cwd, runId, feedbackId, options)` reuses `inspectTaskOutcome`
+to verify native evidence and derive current checks, duration and accounting.
+An active coordinator or altered artifact refuses inspection. A later native
+outcome change, including explicit task acceptance, marks the old assessment
+`stale`. Late billing settlement updates the observed accounting without
+rewriting the assessment or converting unknown costs to zero.
+
+Both inspection APIs return `{data, redacted}`. Known credentials are rejected
+on write. Read-time redaction also protects strings that later become configured
+credentials; redacted display data is not a byte-for-byte copy of the retained
+receipt. No raw worker prose, tool logs or artifact contents are imported into
+the assessment record.
+
+Cross-run learned strategy selection, training data admission, reward weighting,
+baseline/held-out evaluation and candidate activation/withdrawal remain separate
+work under #413. This receipt API does not claim those capabilities.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calliopelabs/cli",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "description": "The private-AI agent CLI - one terminal agent for any model backend, including the ones you run yourself",
   "keywords": [
     "ai",
@@ -34,14 +34,19 @@
   "files": [
     "dist",
     "README.md",
+    "docs/claude-plan.md",
     "scripts/verify-runlog.mjs",
     "docs/migration-*.md",
     "docs/migration-example-*.json",
     "docs/delegation-ledger.md",
     "docs/improvement-cycles.md",
+    "docs/task-feedback.md",
     "docs/acp.md",
     "docs/releases/3.7.0.md",
-    "docs/releases/3.6.0.md"
+    "docs/releases/3.6.0.md",
+    "docs/chatgpt-plan.md",
+    "docs/releases/3.8.0.md",
+    "docs/reviewed-provider-metadata.md"
   ],
   "scripts": {
     "build": "tsc && node scripts/build-metadata.mjs && chmod +x dist/bin.js",
@@ -66,21 +71,22 @@
     "capture:semantics": "npm run build && node scripts/conformance/capture-semantic.mjs"
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "2.0.2",
-    "@anthropic-ai/sdk": "0.135.0",
-    "@aws-sdk/credential-provider-ini": "3.973.19",
-    "@aws-sdk/credential-provider-node": "3.972.86",
+    "@agentclientprotocol/sdk": "2.2.0",
+    "@anthropic-ai/sdk": "1.3.0",
+    "@aws-sdk/credential-provider-ini": "3.973.24",
+    "@aws-sdk/credential-provider-node": "3.972.91",
     "@google/genai": "^2.22.0",
     "@inquirer/prompts": "^8.5.2",
-    "conf": "^15.1.0",
-    "ink": "^7.1.0",
-    "openai": "^6.46.0",
+    "conf": "16.0.0",
+    "ink": "8.0.0",
+    "jose": "6.2.15",
+    "openai": "7.43.0",
     "react": "^19.2.3",
-    "sql.js": "1.15.0",
+    "sql.js": "1.15.2",
     "string-width": "8.3.0",
     "ws": "8.22.0",
     "yaml": "^2.8.2",
-    "zod": "4.6.6"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",