@corvio/cli 0.1.0-beta.36 → 0.1.0-beta.37

package/README.md

@@ -38,8 +38,19 @@ require reauthorization.
 
 The CLI rejects unknown/duplicate options and malformed integer bounds before network access. Normal API calls have a bounded timeout (`CORVIO_REQUEST_TIMEOUT_MS`, maximum ten minutes); only reads, explicit idempotency contracts, revision guards, and other owner-declared safe operations retry automatically. Document commands accept both bare document IDs and canonical `workspace_id/document_id` handles; a canonical handle that disagrees with the selected Workspace fails before remote access, and successful reads return `canonical_id` for direct reuse. `docs read --mode auto` returns a complete small Page or a large-Page overview, then supports exact section, line-range, literal-search, and full projections. `docs patch` applies 1–20 exact non-overlapping L# replacements at the fetched revision and returns a compact readback instead of replaying untouched content. `docs get --output` keeps compatibility full-body download but omits the body from stdout; create/update request compact mutation receipts. Document updates preflight only a bounded overview for the current revision when `--expected-revision` is omitted. `docs table-read` returns a bounded stable-ID projection; `docs table-mutate` accepts a JSON payload for at most 50 cell updates or row appends and requires the fetched revision, while formulas, styles, structure, sorting, and semantic transformations remain `corvio ask --allow-actions` work. When the executing principal is a connected Agent, document and table mutations also require `--change-summary`, create a visible document-level comment after the guarded update, and return its receipt; a comment failure is reported as a partial effect rather than silent success. When a Corvio document or comment supplied the task, use `corvio agent closeout` to return the verified outcome, optionally resolve the thread, and read both document and thread back. Downloads, uploads, and Markdown pulls verify SHA-256 receipts before replacing local files; local writes are atomic, remote default filenames cannot escape the current directory, and Sync refuses symbolic-link traversal while checkpointing each successful push.
 
-For `corvio ask`, pass the user's natural goal, complete decision-relevant context, and explicit constraints. Unless the user chose them,
-do not invent taxonomy, titles, artifact counts, or Corvio's internal plan. Read the terminal Question receipt and use `artifact.url` or
+For `corvio ask`, keep the user's natural question unchanged, then append the smallest complete decision-relevant context or stable handles
+as a separate clause. A carried Project handle normally bounds a cross-branch question without enumerating all descendants. Handles are
+evidence addresses: do not invent a comparison rubric, prescribe reasoning steps, substitute another user objective, or turn current Tree
+labels into a detailed task plan. Unless the user chose them, do not invent taxonomy, titles, artifact counts, or Corvio's internal plan.
+In a bounded read-only continuation, use `corvio ask --workspace <workspace_id> --prompt "<unchanged question; Context: project handle>"
+--json --no-input` when a trusted current-task or prior receipt already
+proves this authenticated CLI and exact Workspace. Answer-only is
+the default: omit `--allow-actions`; the CLI has no `--mode` option. Start the command once; do not launch an identical Question concurrently
+or retry before terminal exit. The command returns the terminal Question without model-visible
+polling. Transport continuity does not prove a cheaper processing profile; leave profile selection on `auto` unless the unresolved semantic
+bottleneck independently justifies another profile. Do not install, probe, or switch to the CLI only for that optimization, and do not
+extend it to an unbound Workspace.
+Read the terminal Question receipt and use `artifact.url` or
 `links.primary_artifact` verbatim; `reader_output` artifacts are deliverables, `structure_container` artifacts are hierarchy, and
 `node_id` is never a document URL.
 

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
   agentCredentialPath,
 } from "./core.js";
 
-const VERSION = "0.1.0-beta.36";
+const VERSION = "0.1.0-beta.37";
 const DEFAULT_API_BASE = "https://api.corvio.ai/v1";
 const DEFAULT_APP_BASE = "https://corvio.ai";
 const USER_AGENT = `corvio-cli/${VERSION}`;
@@ -49,6 +49,7 @@ const MAX_MARKDOWN_CHARACTERS = 120_000;
 const DEFAULT_FILE_OPERATION_WAIT_TIMEOUT_SECONDS = 1_200;
 const MAX_FILE_OPERATION_WAIT_TIMEOUT_SECONDS = 7_200;
 const FILE_OPERATION_PENDING_STATUSES = new Set(["accepted", "pending", "prepared", "queued", "running"]);
+const READ_ONLY_LOCAL_STATE_ERROR_CODES = new Set(["EACCES", "EPERM", "EROFS"]);
 const CORVIO_SKILL_ARCHIVE = "https://corvio.ai/developers/skills/corvio-operate-workspace/corvio-operate-workspace.zip";
 const AGENT_SKILLS_INSTALLER_VERSION = "1.5.23";
 const GLOBAL_OPTIONS = Object.freeze([
@@ -63,6 +64,17 @@ const GLOBAL_OPTIONS = Object.freeze([
   "version",
 ]);
 
+function isReadOnlyLocalStateError(error) {
+  const visited = new Set();
+  let current = error;
+  while (current && typeof current === "object" && !visited.has(current)) {
+    visited.add(current);
+    if (READ_ONLY_LOCAL_STATE_ERROR_CODES.has(String(current.code || "").toUpperCase())) return true;
+    current = current.cause;
+  }
+  return false;
+}
+
 const COMMAND_OPTIONS = Object.freeze({
   "auth:login": ["force"],
   "auth:status": [],
@@ -185,7 +197,7 @@ const COMMAND_HELP = Object.freeze({
   workspaces: `Usage:\n  corvio workspaces list\n  corvio workspaces use <workspace-id>\n  corvio workspaces current\n  corvio workspaces create --name <name> [--kind personal|team]\n\nWorkspace status and blocked capability reasons are returned with each item.`,
   capabilities: `Usage: corvio capabilities [--json]\n\nShow live API resources, principal scopes, selected Workspace status, and CLI compatibility.`,
   collaboration: `Usage:\n  corvio collaboration status [--project <path>] [--provider codex|claude_code|copilot|workbuddy]\n\nCheck local Corvio prerequisites and every discoverable Corvio Skill copy. Current copies stay quiet; non-current receipts include one compact Agent notice and a source-aware next action. Standalone refresh commands pin the verified installer, select exactly one provider, and preserve project/global scope. WorkBuddy inspection is read-only and never changes ~/.workbuddy. The CLI cannot prove that the current host task loaded a particular copy, or whether remote MCP or host memory is active.`,
-  ask: `Usage: corvio ask --prompt <text> [--file <path>] [--asset-ids <id,id>] [--conversation-id <id>] [--sources workspace,web,memory] [--allow-actions] [--processing-profile auto|economy|standard|deep] [--max-processing-profile economy|standard|deep] [--scan-mode auto|always|off] [--skills-extraction-mode auto|always|off] [--caller-model <host-model>] [--context-file <json>] [--idempotency-key <key>]\n\nPass the user's natural goal, complete decision-relevant context, and explicit constraints. Unless the user chose them, do not invent taxonomy, titles, artifact count, or Corvio's internal plan; Corvio chooses the cognitive structure and carriers. --file retains the selected local file, verifies its hash, and attaches the finalized Asset to this exact question. --asset-ids attaches already-retained Corvio Assets. Use --allow-actions when Corvio should create the Page, Spreadsheet, Presentation, Code, HTML Artifact, Memory, or qualifying Project Skill that best serves the result. A continuation handle is subject evidence, not necessarily the durable write destination: for a reusable pattern or method, resolve the fitting same-scope Memory or Skill owner before admitting or merging it. Read the terminal Question receipt and use artifact.url or links.primary_artifact verbatim; reader_output artifacts are deliverables, structure_container artifacts are hierarchy, and node_id is never a document URL. Upload alone is not evidence of interpretation. Skill extraction mode always requires --allow-actions and an evidence-backed decision, not forced Skill creation; answer-only questions may use auto or off.`,
+  ask: `Usage: corvio ask --prompt <text> [--file <path>] [--asset-ids <id,id>] [--conversation-id <id>] [--sources workspace,web,memory] [--allow-actions] [--processing-profile auto|economy|standard|deep] [--max-processing-profile economy|standard|deep] [--scan-mode auto|always|off] [--skills-extraction-mode auto|always|off] [--caller-model <host-model>] [--context-file <json>] [--idempotency-key <key>]\n\nAnswer-only is the default: omit --allow-actions; there is no --mode option. Keep the user's natural question unchanged, then append the smallest complete decision-relevant context or stable handles as a separate clause. A carried Project handle normally bounds a cross-branch question without enumerating all descendants. Handles are evidence addresses: do not invent a comparison rubric, prescribe reasoning steps, substitute another user objective, or turn current Tree labels into a detailed task plan. Unless the user chose them, do not invent taxonomy, titles, artifact count, or Corvio's internal plan; Corvio chooses the cognitive structure and carriers. In a bounded read-only continuation, start this foreground command exactly once when a trusted current-task or prior receipt already proves this authenticated CLI and exact Workspace; do not launch an identical Question concurrently or retry before terminal exit. If the host shell yields a running-session handle, wait on that exact handle until the CLI exits instead of answering from prior context. It returns the terminal Question without model-visible polling. Transport continuity does not prove a cheaper processing profile; leave processing on auto unless the remaining transformation independently justifies another profile. Do not install, probe, or switch to the CLI only for that optimization, and do not extend it to an unbound Workspace. --file retains the selected local file, verifies its hash, and attaches the finalized Asset to this exact question. --asset-ids attaches already-retained Corvio Assets. Use --allow-actions when Corvio should create the Page, Spreadsheet, Presentation, Code, HTML Artifact, Memory, or qualifying Project Skill that best serves the result. A continuation handle is subject evidence, not necessarily the durable write destination: for a reusable pattern or method, resolve the fitting same-scope Memory or Skill owner before admitting or merging it. Read the terminal Question receipt and use artifact.url or links.primary_artifact verbatim; reader_output artifacts are deliverables, structure_container artifacts are hierarchy, and node_id is never a document URL. Upload alone is not evidence of interpretation. Skill extraction mode always requires --allow-actions and an evidence-backed decision, not forced Skill creation; answer-only questions may use auto or off.`,
   agents: `Usage:\n  corvio agents list\n  corvio agents connect [--provider codex|claude_code|copilot] [--project <path>] [--permission-profile read_only|workspace_write|danger_full_access] [--trigger-policy owner_only|workspace_members] [--display-name <name>] [--recover-credential] [--no-listen]\n  corvio agents create --handle <handle> --display-name <name> [--provider codex|claude_code|copilot|custom] [--permissions read,comment,edit]\n  corvio agents update <id> [--display-name <name>] [--status active|paused|revoked] [--permissions <list>]\n  corvio agents rotate <id>\n\n'connect' binds the current Git project (or --project path) to one stable personal Agent. Repeating it is idempotent; another project creates another Agent. It reports provider/CLI, listener, and local Skill prerequisites separately; run corvio collaboration status after installing or refreshing the Skill. The CLI cannot prove that the current host task loaded those surfaces. The default workspace_write profile is limited by the provider's native sandbox. owner_only is the safe trigger default. Secrets and absolute project paths stay local.`,
   agent: `Usage:\n  corvio agent claim [--worker-id <id>] [--wait-seconds <0-30>]\n  corvio agent renew <event-id> --lease-token <token> [--lease-seconds <30-900>]\n  corvio agent complete <event-id> --lease-token <token> [--result-file <json>]\n  corvio agent fail <event-id> --lease-token <token> --error <message>\n  corvio agent mentions --document-id <id> [--query <name>]\n  corvio agent comments --document-id <id>\n  corvio agent comment --document-id <id> --body <text> [--selection-file <json>] [--start-new-chain] [--idempotency-key <key>]\n  corvio agent reply <thread-id> --document-id <id> --body <text> [--source-event-id <id> --source-event-lease-token <token>|--start-new-chain] [--idempotency-key <key>]\n  corvio agent status <thread-id> --document-id <id> --status open|resolved\n  corvio agent closeout --document-id <id> [--thread-id <id>] --body <verified-result> [--status open|resolved] [--idempotency-key <key>]\n  corvio agent run [--provider codex|claude_code|copilot|custom] [--handler <executable>] [--agent <id>] [--once] [--processing-profile auto|economy|standard|deep] [--max-processing-profile economy|standard|deep] [--scan-mode auto|always|off] [--skills-extraction-mode auto|always|off] [--caller-model <host-model>]\n\nUse mentions before commenting when the target is uncertain; aliases resolve to stable user or Agent IDs and ambiguity fails closed. Use closeout when a Corvio document or comment owned the task: it returns the verified result to that surface and reads document/comments back. Agent-to-Agent comments require either a claimed source event or explicit --start-new-chain. The runner iteratively exchanges origin-scoped evidence with Corvio Query/Writer, then invokes the bound provider inside its local project. Local code changes use the recorded provider permission profile; complex Corvio document changes belong to Query/Writer. Provider children never receive Corvio credentials.`,
   questions: `Usage:\n  corvio questions list [--limit <n>] [--cursor <cursor>] [--conversation-id <id>]\n  corvio questions get <question-id>`,
@@ -1300,18 +1312,31 @@ async function ask(options, positionals) {
     throw error;
   }
   const conversationId = String(result?.conversation_id || result?.data?.conversation_id || "").trim();
+  let localContinuity = null;
   if (conversationId && execution.selection?.workspaceId) {
-    await storeConversationRoutingReceipt({
-      conversationId,
-      workspaceId: execution.selection.workspaceId,
-      agentId: execution.credential?.metadata?.agent_id || null,
-      apiBase: baseUrl(options),
-    });
+    try {
+      await storeConversationRoutingReceipt({
+        conversationId,
+        workspaceId: execution.selection.workspaceId,
+        agentId: execution.credential?.metadata?.agent_id || null,
+        apiBase: baseUrl(options),
+      });
+    } catch (error) {
+      if (!isReadOnlyLocalStateError(error)) throw error;
+      localContinuity = {
+        status: "not_persisted",
+        reason: "local_config_read_only",
+        error_code: String(error.code || "").toUpperCase(),
+        conversation_id: conversationId,
+        workspace_id: execution.selection.workspaceId,
+      };
+    }
   }
   writeResult(
     {
       ...result,
       ...(attachedAssets.length > 0 ? { attached_assets: attachedAssets } : {}),
+      ...(localContinuity ? { local_continuity: localContinuity } : {}),
       routing: execution.routing,
     },
     { json: options.json },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corvio/cli",
-  "version": "0.1.0-beta.36",
+  "version": "0.1.0-beta.37",
   "description": "Official Corvio Workspace CLI for questions, knowledge search, documents, and Agent workflows.",
   "type": "module",
   "bin": {