@catalyst-cloud/cli 0.16.19 → 0.16.21

package/skills/whats-happening/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Use for "what's happening?", "what machines do we have?", "how much capacity do we have?", "where are we?", "why is that stuck?", "what closed?", "what's next?", "how does this work?", "why did it do that?", "how does it prioritise?" and "what does this setting do, where is it set?" in Catalyst Cloud, or asks for something to be done rather than known. Reads the contract via catalyst CLI. Read-only: route work/decisions, never answer as the human.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.19 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.21 — written in this repository for customer accounts -->
 
 # What's happening
 

package/skills/whats-happening/references/coding-accounts.md

@@ -1,6 +1,6 @@
 # Coding accounts
 
-snapshot.mjs --accounts omits credentials/emails. An owner/admin enrols, pauses, removes or replaces credentials at `<their cloud>/settings/coding-accounts`; no command does these yet. `catalyst accounts` reads them.
+snapshot.mjs --accounts omits credentials/emails. An owner/admin enrols, pauses, removes or replaces credentials at `<their cloud>/settings/coding-accounts`; no command does these yet. `catalyst accounts` reads them. It leaves out removed accounts (revoked, or paid access that ended). They are kept for history, never take work again and take no new credential, so never suggest reviving one. `catalyst accounts --all` lists them.
 
 Slots identify credentials, not emails. Claude/GLM/Qwen use Claude CLI, Codex uses Codex; GLM/Qwen also use OpenCode. Routing names the model.
 

package/vendor/install-session-egress.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# Installs Catalyst's session egress service on a native Linux runner machine, from the files
+# that ship with this catalyst CLI. Setup prints the one command that runs it as root from a
+# checked root-owned copy, passing the CLI's vendor folder as $1. It copies the files into a
+# root-owned folder, checks their fingerprints there, and installs only checked bytes.
+set -eu
+if [ "$(id -u)" != 0 ]; then
+  echo "Run this with sudo: sudo sh '$0'" >&2
+  exit 1
+fi
+src="${1:-$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)}/self-host/linux-session-egress"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+for name in session-egress.py catalyst-session-egress.service catalyst-session-egress-attest.service catalyst-session-egress-attest.timer; do
+  cp "$src/$name" "$work/$name"
+done
+(cd "$work" && sha256sum -c --quiet -) <<'SUMS'
+a20cedfa1e883127ec461e4b7f9588d379fe1633b8244ecd703c81f589d3f142  session-egress.py
+703c150ab23ec87aea47cfc394f63e061b66c4b8c1454a88a9be879c161ce2a5  catalyst-session-egress.service
+94fa75ea0616f6a1172fc20ca637a5727c36456357e4a977d5bdd65f2fad2e8d  catalyst-session-egress-attest.service
+176622c11c835601b95f36e375ba3c2e993136976c67e5d49559f13a3454fef9  catalyst-session-egress-attest.timer
+SUMS
+install -D -o root -g root -m 755 "$work/session-egress.py" /usr/lib/catalyst/session-egress.py
+for unit in catalyst-session-egress.service catalyst-session-egress-attest.service catalyst-session-egress-attest.timer; do
+  install -o root -g root -m 644 "$work/$unit" "/etc/systemd/system/$unit"
+done
+systemctl daemon-reload
+systemctl enable --now catalyst-session-egress.service catalyst-session-egress-attest.timer
+/usr/bin/python3 /usr/lib/catalyst/session-egress.py attest
+echo "Session egress is installed. Run the same catalyst setup command again."