@corvio/cli 0.1.0-beta.27 → 0.1.0-beta.29

package/README.md

@@ -21,7 +21,7 @@ corvio sync init --dir ./knowledge --root-node-id <node_id> --json
 corvio update check --json
 ```
 
-When no environment key is configured, run `corvio auth login`. Login creates one user-level `cvu_` control-plane credential; it does not freeze the browser's current Workspace. Run `corvio agents connect --project .` from the project you want to expose. The command verifies the selected Codex, Claude Code, or Copilot host before server mutation, then idempotently creates or restores the Agent for that provider/device/project binding, grants current/future Workspace coverage under live membership/role and ACL limits, saves the one-time `cvg_` in a `0600` multi-binding registry, and starts that project's listener. `corvio collaboration status` then checks local foreground prerequisites and reports package freshness, contract compatibility, installation ownership, every discoverable copy, and the fact that host loading is not observable. A listener receives inbound `@Agent` work; it does not make an unrelated foreground coding session collaborate automatically. Another project gets another Agent. Ordinary data commands prefer the binding whose root contains the current directory, then a locally confirmed selection, the account selection, the personal default, or one authorized candidate. They ask only on real ambiguity. Use `corvio workspaces use`, `--workspace`, and `--agent` as explicit routing/reproducibility controls. Legacy Workspace-bound `cvk_`, `cvg_`, and version-1 credential files remain compatible and are never widened. Local sync stores only credential-free handles and revision/hash baselines in `.corvio/state.json`; Markdown lives below `corvio_docs/`, and conflicts require explicit resolution. Update checks compare npm's published `beta` tag with the API compatibility policy but never self-install. See [the Corvio CLI guide](https://corvio.ai/developers/cli) for the full command and receipt contract.
+When no environment key is configured, run `corvio auth login`. Login creates one user-level `cvu_` control-plane credential; it does not freeze the browser's current Workspace. Run `corvio agents connect --project .` from the project you want to expose. The command verifies the selected Codex, Claude Code, or Copilot host before server mutation, then idempotently creates or restores the Agent for that provider/device/project binding, grants current/future Workspace coverage under live membership/role and ACL limits, saves the one-time `cvg_` in a `0600` multi-binding registry, and starts that project's listener. `corvio collaboration status` then checks local foreground prerequisites and reports package freshness, contract compatibility, installation ownership, every discoverable copy, and the fact that host loading is not observable. A listener receives inbound `@Agent` work; it does not make an unrelated foreground coding session collaborate automatically. Another project gets another Agent. Ordinary data commands prefer the binding whose root contains the current directory, then a locally confirmed selection, the account selection, the personal default, or one authorized candidate. They ask only on real ambiguity. Use `corvio workspaces use`, `--workspace`, and `--agent` as explicit routing/reproducibility controls. Legacy Workspace-bound `cvk_`, `cvg_`, and version-1 credential files remain compatible and are never widened. Local sync stores only credential-free handles and revision/hash baselines in `.corvio/state.json`; Markdown lives below `corvio_docs/`, and conflicts require explicit resolution. `corvio capabilities` reads only Corvio API capability and compatibility facts, so discovery remains usable in hosts that deny npm registry access. `corvio update check` is the explicit registry-backed version check; it never self-installs. See [the Corvio CLI guide](https://corvio.ai/developers/cli) for the full command and receipt contract.
 
 CLI and Skill updates are independent. `corvio update check` checks the CLI package only. `corvio collaboration status` detects a missing,
 incompatible, compatible-but-not-current, or conflicting local Skill, but never mutates host directories. Use

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
   agentCredentialPath,
 } from "./core.js";
 
-const VERSION = "0.1.0-beta.27";
+const VERSION = "0.1.0-beta.29";
 const DEFAULT_API_BASE = "https://api.corvio.ai/v1";
 const DEFAULT_APP_BASE = "https://corvio.ai";
 const USER_AGENT = `corvio-cli/${VERSION}`;
@@ -180,7 +180,7 @@ const COMMAND_HELP = Object.freeze({
   questions: `Usage:\n  corvio questions list [--limit <n>] [--cursor <cursor>] [--conversation-id <id>]\n  corvio questions get <question-id>`,
   conversations: `Usage:\n  corvio conversations list [--limit <n>] [--cursor <cursor>]\n  corvio conversations get <conversation-id>`,
   search: `Usage: corvio search <query> [--limit <n>] [--page-id <id>] [--node-id <id>]`,
-  docs: `Usage:\n  corvio docs list [--limit <n>] [--cursor <cursor>] [--lifecycle active|archived]\n  corvio docs get <id> [--output <path>]\n  corvio docs table-read <id> [--table-id <id>] [--after-row-id <id>] [--limit <1-100>]\n  corvio docs table-mutate <id> --input <json> --yes [--operation-id <id>] [--change-summary <text>]\n  corvio docs create --title <title> [--file <path>|--markdown <text>] [--parent-node-id <id>] [--idempotency-key <key>]\n  corvio docs update <id> [--title <title>] [--file <path>|--markdown <text>] [--expected-revision <n>] [--change-summary <text>]\n  corvio docs move <id> --parent-node-id <id>\n  corvio docs archive <id> --yes\n  corvio docs restore <id> --yes\n  corvio docs share <id> --yes [--display-name <name>]\n  corvio docs open <id>\n\nA selected Markdown file is uploaded once as a provenance-preserving Asset, then its source_asset_id becomes an editable Page without resending the body; inspect the returned document ID, node ID, revision, and URL. Other formats or semantic restructuring belong to \`corvio files organize\` or \`corvio ask --allow-actions\`. \`docs update\` replaces the Page body: use it only when whole-body replacement is the smallest faithful change; delegate large localized semantic edits, reorder, splice, or formatting to \`corvio ask --allow-actions\` with the canonical document handle. Use table-read plus table-mutate for bounded stable-ID cell updates or row appends without round-tripping a whole document. \`docs move\` accepts a non-Project document and a Project destination; Projects stay at the Workspace root and cannot be nested. Use \`corvio files organize\` or \`corvio ask --allow-actions\` when deeper structure needs semantic branch Pages and leaves. Agent-authenticated document changes require --change-summary and create a visible document-level comment after the guarded update. When a document/comment is the task owner, use \`corvio agent closeout\` to return verified work to that same collaboration surface and read it back.`,
+  docs: `Usage:\n  corvio docs list [--limit <n>] [--cursor <cursor>] [--lifecycle active|archived]\n  corvio docs get <id> [--output <path>]\n  corvio docs table-read <id> [--table-id <id>] [--after-row-id <id>] [--limit <1-100>]\n  corvio docs table-mutate <id> --input <json> --yes [--operation-id <id>] [--change-summary <text>]\n  corvio docs create --title <title> [--file <path>|--markdown <text>] [--parent-node-id <id>] [--idempotency-key <key>]\n  corvio docs update <id> [--title <title>] [--file <path>|--markdown <text>] [--expected-revision <n>] [--change-summary <text>]\n  corvio docs move <id> --parent-node-id <id>\n  corvio docs archive <id> --yes\n  corvio docs restore <id> --yes\n  corvio docs share <id> --yes [--display-name <name>]\n  corvio docs open <id>\n\nA selected Markdown file is uploaded once as a provenance-preserving Asset, then its source_asset_id becomes an editable Page without resending the body; inspect the returned document ID, node ID, revision, and URL. Other formats or semantic restructuring belong to \`corvio files organize\` or \`corvio ask --allow-actions\`. \`docs update\` replaces a non-Project Page body: use it only when whole-body replacement is the smallest faithful change. A Project is a structure container, so direct body replacement returns \`project_structure_container_body_write_disabled\`; use \`files organize\` or \`ask --allow-actions\` for Work Model maintenance, or update a child Page. A title-only Project rename remains valid. Delegate large localized semantic edits, reorder, splice, or formatting to \`corvio ask --allow-actions\` with the canonical document handle. Use table-read plus table-mutate for bounded stable-ID cell updates or row appends without round-tripping a whole document. \`docs move\` accepts a non-Project document and a Project destination; Projects stay at the Workspace root and cannot be nested. Use \`corvio files organize\` or \`corvio ask --allow-actions\` when deeper structure needs semantic branch Pages and leaves. Agent-authenticated document changes require --change-summary and create a visible document-level comment after the guarded update. When a document/comment is the task owner, use \`corvio agent closeout\` to return verified work to that same collaboration surface and read it back.`,
   projects: `Usage:\n  corvio projects list [--limit <n>]\n  corvio projects create --title <title> [--idempotency-key <key>]\n\nProjects are durable root-level grouping owners in the Corvio Docs tree and cannot be nested under another Project. Reuse a matching Project instead of creating one ceremonial Project per file; use semantic branch Pages and leaves for deeper Work Models. 'corvio folders' is an alias.`,
   files: `Usage:\n  corvio files list [--limit <n>]\n  corvio files get <id> [--content]\n  corvio files download <id> [--output <path>]\n  corvio files upload --file <path> [--mime-type <type>] [--organize --instruction <text> --additional-asset-ids <id,id> --yes]\n  corvio files organize <id> --instruction <text> --yes [--additional-asset-ids <id,id>] [--processing-profile auto|economy|standard|deep] [--scan-mode auto|always|off] [--skills-extraction-mode auto|always|off]\n  corvio files operation <operation-id>\n  corvio files resume <operation-id> --yes\n  corvio files cancel <operation-id> --yes\n  corvio files open <id>\n\nUse --content only when source facts are needed. It returns one bounded AI-safe projection with hash, completeness, and truncation receipts; it does not rewrite or materialize the original. Upload alone preserves the exact original, provenance, hash, policy, and stable Asset ID. Organization is a separate asynchronous value step: one coherent source set can produce reader-facing structure, source reconciliation, Memory candidates, and qualifying Project Skills. Pass --instruction a weak natural goal plus explicit user constraints and only authority facts needed to prevent wrong identity or scope. Keep source-derived facts in the source; do not precompute an outline, edit checklist, taxonomy, titles, artifact count, or sole leaf target from current visibility. For a newly finalized Asset that should enter a Work Model or Skill evaluation, use organize directly instead of duplicate ask requests just to await processing. Use 'files operation' to reach terminal and inspect output_document plus skills_evaluation; always requires evaluation but may correctly return evaluated_no_qualifying_skill. Resume reuses the same durable operation after resolving its blocker; cancel is idempotent.`,
   sync: `Usage:\n  corvio sync init --root-node-id <id> [--dir <path>] [--name <name>]\n  corvio sync status|plan|pull [--dir <path>]\n  corvio sync push --yes [--dir <path>]\n  corvio sync resolve --conflict-id <id> --strategy use-remote|keep-local --yes [--dir <path>]`,
@@ -749,7 +749,10 @@ async function capabilities(options) {
     workspace_selection: selection,
     api: index,
     principal: identity,
-    update: await buildUpdateStatus(index, { allowRegistryFailure: true }),
+    update: await buildUpdateStatus(index, {
+      allowRegistryFailure: true,
+      checkRegistry: false,
+    }),
   }, { json: options.json });
 }
 
@@ -3124,7 +3127,10 @@ async function projects(options, action) {
   writeResult(result, { json: options.json });
 }
 
-async function buildUpdateStatus(index, { allowRegistryFailure = false } = {}) {
+async function buildUpdateStatus(
+  index,
+  { allowRegistryFailure = false, checkRegistry = true } = {},
+) {
   return resolveNpmUpdateStatus({
     currentVersion: VERSION,
     policy: index?.distribution?.workspace_cli || {
@@ -3133,6 +3139,7 @@ async function buildUpdateStatus(index, { allowRegistryFailure = false } = {}) {
     },
     userAgent: USER_AGENT,
     allowRegistryFailure,
+    checkRegistry,
   });
 }
 

package/dist/core.js

@@ -244,6 +244,7 @@ export async function resolveNpmUpdateStatus({
   policy,
   userAgent,
   allowRegistryFailure = false,
+  checkRegistry = true,
   fetchImpl = globalThis.fetch,
   registryBase = process.env.CORVIO_NPM_REGISTRY_BASE || "https://registry.npmjs.org",
 }) {
@@ -253,22 +254,24 @@ export async function resolveNpmUpdateStatus({
   const encoded = encodeURIComponent(packageName).replace("%40", "@");
   let latestVersion = null;
   let registryError = null;
-  try {
-    const registry = String(registryBase).replace(/\/+$/, "");
-    const response = await fetchImpl(`${registry}/${encoded}`, {
-      headers: { accept: "application/json", "user-agent": userAgent },
-      signal: AbortSignal.timeout(2500),
-    });
-    if (!response.ok) throw new Error(`npm registry returned ${response.status}`);
-    const metadata = await response.json();
-    latestVersion = String(metadata?.["dist-tags"]?.[distTag] || "").trim() || null;
-  } catch (error) {
-    registryError = error instanceof Error ? error.message : String(error);
-    if (!allowRegistryFailure) {
-      throw new CliError(`Unable to check npm for updates: ${registryError}`, {
-        code: "update_check_failed",
-        exitCode: EXIT.REMOTE,
+  if (checkRegistry) {
+    try {
+      const registry = String(registryBase).replace(/\/+$/, "");
+      const response = await fetchImpl(`${registry}/${encoded}`, {
+        headers: { accept: "application/json", "user-agent": userAgent },
+        signal: AbortSignal.timeout(2500),
       });
+      if (!response.ok) throw new Error(`npm registry returned ${response.status}`);
+      const metadata = await response.json();
+      latestVersion = String(metadata?.["dist-tags"]?.[distTag] || "").trim() || null;
+    } catch (error) {
+      registryError = error instanceof Error ? error.message : String(error);
+      if (!allowRegistryFailure) {
+        throw new CliError(`Unable to check npm for updates: ${registryError}`, {
+          code: "update_check_failed",
+          exitCode: EXIT.REMOTE,
+        });
+      }
     }
   }
   const minimum = String(policy.minimum_supported_version || "").trim() || null;
@@ -278,6 +281,7 @@ export async function resolveNpmUpdateStatus({
     dist_tag: distTag,
     current_version: currentVersion,
     latest_published_version: latestVersion,
+    registry_checked: checkRegistry,
     reviewed_version: String(policy.reviewed_version || "").trim() || null,
     minimum_supported_version: minimum,
     update_available: Boolean(latestVersion && compareVersions(latestVersion, currentVersion) > 0),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corvio/cli",
-  "version": "0.1.0-beta.27",
+  "version": "0.1.0-beta.29",
   "description": "Official Corvio Workspace CLI for questions, knowledge search, documents, and Agent workflows.",
   "type": "module",
   "bin": {