@corvio/cli 0.1.0-beta.17 → 0.1.0-beta.19

package/README.md

@@ -1,6 +1,7 @@
 # Corvio Workspace CLI
 
-Official CLI for a user's Corvio Workspace. It supports an existing `CORVIO_API_KEY` and a browser device-link login.
+Official CLI for a user's Corvio Workspace. It supports an existing `CORVIO_API_KEY` and a browser device-link login. In a connected
+host, use the accompanying `corvio-operate-workspace` Skill so every non-trivial task begins with a lightweight Corvio grounding check.
 
 ```bash
 npm install --global @corvio/cli@beta
@@ -16,7 +17,13 @@ corvio sync init --dir ./knowledge --root-node-id <node_id> --json
 corvio update check --json
 ```
 
-When no environment key is configured, run `corvio auth login`. Login creates one user-level `cvu_` control-plane credential; it does not freeze the browser's current Workspace. Run `corvio agents connect --project .` from the project you want to expose. The command verifies the selected Codex, Claude Code, or Copilot host before server mutation, then idempotently creates or restores the Agent for that provider/device/project binding, grants current/future Workspace coverage under live membership/role and ACL limits, saves the one-time `cvg_` in a `0600` multi-binding registry, and starts that project's listener. `corvio collaboration status` then checks a separate foreground requirement: the current host must also discover the official Skill at the live server contract version. A listener receives inbound `@Agent` work; it does not make an unrelated foreground coding session collaborate automatically. Another project gets another Agent. Ordinary data commands prefer the binding whose root contains the current directory. Use `corvio workspaces use`, `--workspace`, and `--agent` as explicit routing/reproducibility controls. Legacy Workspace-bound `cvk_`, `cvg_`, and version-1 credential files remain compatible and are never widened. Local sync stores only credential-free handles and revision/hash baselines in `.corvio/state.json`; Markdown lives below `corvio_docs/`, and conflicts require explicit resolution. Update checks compare npm's published `beta` tag with the API compatibility policy but never self-install. See [the Corvio CLI guide](https://corvio.ai/developers/cli) for the full command and receipt contract.
+When no environment key is configured, run `corvio auth login`. Login creates one user-level `cvu_` control-plane credential; it does not freeze the browser's current Workspace. Run `corvio agents connect --project .` from the project you want to expose. The command verifies the selected Codex, Claude Code, or Copilot host before server mutation, then idempotently creates or restores the Agent for that provider/device/project binding, grants current/future Workspace coverage under live membership/role and ACL limits, saves the one-time `cvg_` in a `0600` multi-binding registry, and starts that project's listener. `corvio collaboration status` then checks a separate foreground requirement: the current host must also discover the official Skill at the live server contract version. A listener receives inbound `@Agent` work; it does not make an unrelated foreground coding session collaborate automatically. Another project gets another Agent. Ordinary data commands prefer the binding whose root contains the current directory, then a locally confirmed selection, the account selection, the personal default, or one authorized candidate. They ask only on real ambiguity. Use `corvio workspaces use`, `--workspace`, and `--agent` as explicit routing/reproducibility controls. Legacy Workspace-bound `cvk_`, `cvg_`, and version-1 credential files remain compatible and are never widened. Local sync stores only credential-free handles and revision/hash baselines in `.corvio/state.json`; Markdown lives below `corvio_docs/`, and conflicts require explicit resolution. Update checks compare npm's published `beta` tag with the API compatibility policy but never self-install. See [the Corvio CLI guide](https://corvio.ai/developers/cli) for the full command and receipt contract.
+
+CLI and Skill updates are independent. `corvio update check` checks the CLI package only. `corvio collaboration status` detects a missing
+official Skill or a shared-contract mismatch, but not every content-only package revision. The canonical website zip is a static local
+copy and is not currently update-tracked by `npx skills update`; rerun its official `npx skills add` command in the same project/global
+scope for exact freshness, start a new host session, then rerun `corvio collaboration status`. Remote MCP changes are server-delivered and
+normally need only a refreshed host session unless new OAuth scopes require reauthorization.
 
 The CLI rejects unknown/duplicate options and malformed integer bounds before network access. Normal API calls have a bounded timeout (`CORVIO_REQUEST_TIMEOUT_MS`, maximum ten minutes); only reads, explicit idempotency contracts, revision guards, and other owner-declared safe operations retry automatically. Document updates preflight the current revision when `--expected-revision` is omitted. When the executing principal is a connected Agent, `docs update` also requires `--change-summary`, creates a visible document-level comment after the guarded write, and returns its receipt; a comment failure is reported as a partial effect rather than silent success. When a Corvio document or comment supplied the task, use `corvio agent closeout` to return the verified outcome, optionally resolve the thread, and read both document and thread back. Downloads, uploads, and Markdown pulls verify SHA-256 receipts before replacing local files; local writes are atomic, remote default filenames cannot escape the current directory, and Sync refuses symbolic-link traversal while checkpointing each successful push.
 

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
   agentCredentialPath,
 } from "./core.js";
 
-const VERSION = "0.1.0-beta.17";
+const VERSION = "0.1.0-beta.19";
 const DEFAULT_API_BASE = "https://api.corvio.ai/v1";
 const DEFAULT_APP_BASE = "https://corvio.ai";
 const USER_AGENT = `corvio-cli/${VERSION}`;
@@ -380,7 +380,14 @@ function routingReceipt(selection, { continuity = false } = {}) {
       : preference?.provenance || selection?.source || "runtime",
     confidence: Number.isFinite(Number(preference?.confidence))
       ? Number(preference.confidence)
-      : ["option", "environment", "legacy_credential", "single_candidate"].includes(selection?.source)
+      : [
+          "option",
+          "environment",
+          "legacy_credential",
+          "account_selection",
+          "personal_default",
+          "single_candidate",
+        ].includes(selection?.source)
         ? 1
         : 0.9,
     scope: preference?.scope || (continuity ? "conversation" : "operation"),
@@ -467,7 +474,24 @@ async function executionClient(options, { semanticText = "", continuityId = null
     });
     const response = await discovery.request("/workspaces");
     const workspaces = Array.isArray(response?.data) ? response.data : [];
-    if (workspaces.length === 1) {
+    const accountSelectedId = `${response?.selected_workspace_id || ""}`.trim();
+    const selectedCandidates = workspaces.filter(
+      (workspace) => workspace.is_selected === true || (accountSelectedId && workspace.id === accountSelectedId),
+    );
+    const defaultCandidates = workspaces.filter((workspace) => workspace.is_default === true);
+    if (selectedCandidates.length === 1) {
+      selection = {
+        workspaceId: selectedCandidates[0].id,
+        workspaceName: selectedCandidates[0].name,
+        source: "account_selection",
+      };
+    } else if (defaultCandidates.length === 1) {
+      selection = {
+        workspaceId: defaultCandidates[0].id,
+        workspaceName: defaultCandidates[0].name,
+        source: "personal_default",
+      };
+    } else if (workspaces.length === 1) {
       selection = { workspaceId: workspaces[0].id, workspaceName: workspaces[0].name, source: "single_candidate" };
     } else if (workspaces.length > 1 && semanticText.trim()) {
       const normalized = semanticText.toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corvio/cli",
-  "version": "0.1.0-beta.17",
+  "version": "0.1.0-beta.19",
   "description": "Official Corvio Workspace CLI for questions, knowledge search, documents, and Agent workflows.",
   "type": "module",
   "bin": {