@dam-agents/cli 0.2.12 → 0.2.13-rc1

package/dist/bin.js

@@ -13,7 +13,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e2) {
+    throw mod = 0, e2;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -26749,7 +26753,33 @@ var skillSchema = external_exports.object({
   name: external_exports.string(),
   description: external_exports.string(),
   version: external_exports.string(),
-  contentHash: external_exports.string()
+  contentHash: external_exports.string(),
+  /** Repo-relative directory the skill was found in, whichever Source Root it
+   *  came from — what a raw-file URL needs. Distinct from `skillSourceSchema.path`,
+   *  which is the source's optional subdir; `dir` is this one skill's actual
+   *  location under it. Optional: the agent-runtime clone scan (private /
+   *  non-GitHub sources) doesn't report it. */
+  dir: external_exports.string().optional()
+});
+var skillListResultSchema = external_exports.object({
+  skills: external_exports.array(skillSchema),
+  /** ISO 8601 time the source's skill list was last read from upstream. A
+   *  cache hit reports the original read, not the moment of the hit. */
+  scannedAt: external_exports.string().datetime()
+});
+var scanFailureCodes = [
+  "needs_github_connection",
+  "needs_sandbox",
+  "repo_unreachable",
+  "agent_unreachable",
+  "other"
+];
+var scanFailureSchema = external_exports.object({
+  code: external_exports.enum(scanFailureCodes),
+  /** Single line naming the cause. */
+  title: external_exports.string(),
+  /** Single line naming the fix. */
+  detail: external_exports.string()
 });
 var skillRefSchema = external_exports.object({
   source: external_exports.string(),
@@ -26771,7 +26801,11 @@ var localSkillSchema = external_exports.object({
   /** Provenance vs. the image's pristine copy: shipped untouched, shipped
    *  but diverged, or created at runtime. Absent on pre-provenance pods —
    *  treat as `user`. */
-  origin: external_exports.enum(["system", "system-modified", "user"]).optional()
+  origin: external_exports.enum(["system", "system-modified", "user"]).optional(),
+  /** Deterministic SHA-256 of the skill directory, comparable with a scanned
+   *  skill's `contentHash`. Present only for skills the server asked the pod to
+   *  hash, and absent on pods predating this field (#3019). */
+  contentHash: external_exports.string().optional()
 });
 var skillPublishRecordSchema = external_exports.object({
   skillName: external_exports.string(),
@@ -26780,12 +26814,27 @@ var skillPublishRecordSchema = external_exports.object({
   sourceGitUrl: external_exports.string(),
   prUrl: external_exports.string(),
   /** ISO 8601 timestamp. */
-  publishedAt: external_exports.string()
+  publishedAt: external_exports.string(),
+  /** Resolved outcome of `prUrl`, or null when it has never been
+   *  resolved — the source is private, the read was rate-limited, the
+   *  pull request is gone. `merged` and `closed` are terminal and are
+   *  never re-read (#3019). */
+  prState: external_exports.enum(["draft", "open", "merged", "closed"]).nullable(),
+  /** ISO 8601 timestamp of the last resolution *attempt*, which is not
+   *  the same as the last success: an attempt that resolved nothing
+   *  still stamps it, because it doubles as the backoff clock. Null
+   *  until the first attempt. */
+  prStateCheckedAt: external_exports.string().nullable()
 });
 var skillStateOutputSchema = external_exports.object({
   installed: external_exports.array(skillRefSchema),
   standalone: external_exports.array(localSkillSchema),
-  instancePublishes: external_exports.array(skillPublishRecordSchema)
+  instancePublishes: external_exports.array(skillPublishRecordSchema),
+  /** Present only when `standalone` came from a recorded snapshot rather than a
+   *  live pod read — the sandbox is stopped. Absent while running, which is what
+   *  lets a reader tell live truth from a snapshot without a second field for
+   *  the running case. */
+  standaloneSnapshot: external_exports.object({ capturedAt: external_exports.string().datetime() }).optional()
 });
 var skillListSourcesInputSchema = external_exports.object({ agentId: external_exports.string().min(1).optional() }).optional();
 var skillCreateSourceInputSchema = external_exports.object({
@@ -27036,9 +27085,28 @@ var skillPublishInputSchema2 = external_exports.object({
   // subdir source's own scan finds what was published back to it.
   path: external_exports.string().optional()
 });
+var skillListLocalInputSchema2 = external_exports.object({
+  /** Names to compute `contentHash` for. Hashing walks the whole skill dir on
+   *  an NFS-backed PVC and this runs on every state poll, so the caller asks
+   *  only for the few skills it needs it for (#3019). */
+  hashNames: external_exports.array(external_exports.string()).optional()
+});
 var skillReadLocalInputSchema2 = external_exports.object({
   name: external_exports.string().min(1)
 });
+var skillReadPullRequestInputSchema = external_exports.object({
+  owner: external_exports.string().min(1),
+  repo: external_exports.string().min(1),
+  number: external_exports.number().int().positive()
+});
+var skillReadSkillFileInputSchema = external_exports.object({
+  source: external_exports.string().min(1),
+  /** Commit SHA the scan pinned — the preview renders the revision the
+   *  catalog listed. */
+  version: external_exports.string().min(1),
+  /** Repo-relative skill directory from the scan; `SKILL.md` is read inside it. */
+  dir: external_exports.string().min(1)
+});
 var skillDeleteLocalInputSchema2 = external_exports.object({
   name: external_exports.string().min(1)
 });
@@ -27058,6 +27126,21 @@ var sshAuthorizeKeyInputSchema = external_exports.object({
   publicKey: external_exports.string().min(1).max(8192).refine((s) => !/[\r\n]/.test(s), "must be a single line")
 });
 
+// ../agent-runtime-api/src/modules/background-work/schemas.ts
+var advisory = (max) => external_exports.string().transform((text) => text.slice(0, max)).optional();
+var backgroundWorkItemSchema = external_exports.object({
+  id: external_exports.string().min(1).transform((id) => id.slice(0, 128)),
+  description: advisory(200),
+  command: advisory(500)
+});
+var backgroundWorkReportSchema = external_exports.object({
+  // Also truncated rather than capped, for the same reason: a hold is per
+  // session, so one surviving item holds it, whereas rejecting an over-long list
+  // would hold nothing at all. Excess entries cost only detail in the status
+  // payload.
+  items: external_exports.array(backgroundWorkItemSchema).transform((items) => items.slice(0, 64))
+});
+
 // ../agent-runtime-api/src/modules/import/types.ts
 var importBundleResultSchema = external_exports.object({
   filesWritten: external_exports.number().int().nonnegative(),
@@ -27246,6 +27329,12 @@ var harnessConfigCatalog = external_exports.object({
   // all allowed; empty array = group hidden for that model (e.g. Haiku effort).
   modelConstraints: external_exports.record(external_exports.string().min(1), external_exports.record(external_exports.string().min(1), external_exports.array(external_exports.string()))).optional()
 });
+var harnessConfigCurrent = external_exports.object({
+  model: external_exports.string().nullable(),
+  mode: external_exports.string().nullable(),
+  configOptions: external_exports.record(external_exports.string().min(1), external_exports.string()),
+  availableModels: external_exports.array(harnessConfigChoice).nullable().optional()
+});
 var capabilities = external_exports.object({
   contributions: external_exports.array(contributionKind),
   events: external_exports.array(eventKind),
@@ -27276,13 +27365,17 @@ var applyStateResult = external_exports.discriminatedUnion("status", [
     appliedHash: external_exports.string().min(1).nullable(),
     // null until the first clean settle
     failures: external_exports.array(driverFailure).default([]),
-    settledEvents: external_exports.array(external_exports.string()).default([])
+    settledEvents: external_exports.array(external_exports.string()).default([]),
+    // Absent from a pod predating this, or one whose manifest declares no
+    // harness-config driver — the server then keeps whatever it holds.
+    harnessConfigCurrent: harnessConfigCurrent.optional()
   }),
   // Contributions already at ≥ the requested version; worker reconciles. Events still apply (own version) — settledEvents reports which.
   external_exports.object({
     status: external_exports.literal("stale"),
     appliedVersion: external_exports.number().int().nonnegative(),
-    settledEvents: external_exports.array(external_exports.string()).default([])
+    settledEvents: external_exports.array(external_exports.string()).default([]),
+    harnessConfigCurrent: harnessConfigCurrent.optional()
   })
 ]);
 var helloInput = external_exports.object({
@@ -27290,7 +27383,12 @@ var helloInput = external_exports.object({
   lastAppliedHash: external_exports.string().optional(),
   protocolVersion: external_exports.literal("v1"),
   agentRuntimeVersion: external_exports.string(),
-  capabilities
+  capabilities,
+  // The config file as it stands at boot, with no discovered model list: `hello`
+  // is what delivers capabilities, and the worker won't dispatch an apply until
+  // they land, so waiting on the provider here delays the first apply after
+  // every boot and wake. The apply reply carries the list instead.
+  harnessConfigCurrent: harnessConfigCurrent.optional()
 });
 var helloResult = external_exports.object({
   version: external_exports.number().int().positive().optional(),
@@ -27317,6 +27415,29 @@ var harnessConfigStatusSchema = external_exports.object({
 var harnessConfigSettledSchema = external_exports.object({
   settled: external_exports.boolean()
 });
+var harnessConfigSnapshotSchema = external_exports.object({
+  model: external_exports.string().nullable(),
+  mode: external_exports.string().nullable(),
+  configOptions: agentConfigOptionsSchema,
+  /** Models the provider offered when it was last successfully asked; null when
+   *  the harness declares no discovery source. A failed attempt leaves this
+   *  alone, so it can be older than the rest of the snapshot. */
+  availableModels: external_exports.array(harnessConfigChoice).nullable(),
+  capturedAt: external_exports.string().datetime(),
+  /** The model that was in effect when `availableModels` was observed. Comparing
+   *  the two is only meaningful while this still equals `model`: a model changed
+   *  since the list was read proves nothing about whether the provider offers it.
+   *  Absent on rows written before this field existed — treat as unpaired. */
+  modelAtDiscovery: external_exports.string().nullable().optional(),
+  /** False while the only source is an apply the pod has not reported back. */
+  confirmed: external_exports.boolean()
+});
+var harnessConfigSnapshotResultSchema = external_exports.object({
+  /** The agent has sent `hello` at least once, so a snapshot is possible.
+   *  False means "never run" — genuinely nothing to show, not a miss. */
+  hasRun: external_exports.boolean(),
+  snapshot: harnessConfigSnapshotSchema.nullable()
+});
 
 // ../api-server-api/src/modules/egress-rules/schemas.ts
 var ruleVerdictSchema = external_exports.enum(["allow", "deny"]);
@@ -27359,8 +27480,8 @@ var idSchema = external_exports.object({ id: external_exports.string().min(1) })
 var cpuQuantitySchema = external_exports.string().regex(/^\d+(\.\d+)?m?$/, "CPU must look like '2', '0.5' or '500m'").refine((v2) => toCpuMilli(v2) >= 100, {
   message: "CPU must be at least 100m"
 });
-var memoryQuantitySchema = external_exports.string().regex(/^\d+(Mi|Gi)$/, "memory must look like '512Mi' or '2Gi'").refine((v2) => toMemoryMi(v2) >= 128, {
-  message: "memory must be at least 128Mi"
+var memoryQuantitySchema = external_exports.string().regex(/^\d+(Mi|Gi)$/, "memory must look like '512Mi' or '2Gi'").refine((v2) => toMemoryMi(v2) >= 384, {
+  message: "memory must be at least 384Mi"
 });
 function toCpuMilli(v2) {
   return v2.endsWith("m") ? Number(v2.slice(0, -1)) : Number(v2) * 1e3;
@@ -27375,6 +27496,9 @@ var agentSizeSchema = external_exports.object({
 var agentUpgradeInputSchema = idSchema.extend({
   expectedToImage: external_exports.string().min(1).optional()
 });
+var agentDisconnectSlackInputSchema = idSchema.extend({
+  slackChannelId: external_exports.string().min(1).optional()
+});
 var agentKindSchema = external_exports.enum(["knowledge-base", "experiment"]);
 var agentCreateInputSchema = external_exports.object({
   name: external_exports.string().min(1).refine((n) => !n.startsWith("agent-"), {
@@ -27727,7 +27851,6 @@ var artifactUpdateInputSchema = external_exports.object({
   folderId: external_exports.string().min(1).nullish(),
   ...contentOrUploadRef,
   fileName: fileNameSchema.optional(),
-  kind: artifactKindSchema.optional(),
   contentType: external_exports.string().trim().min(1).max(200).optional()
 }).refine((v2) => !(v2.content != null && v2.uploadRef != null), {
   message: "provide at most one of content or uploadRef",
@@ -27751,7 +27874,11 @@ var folderUpdateInputSchema = external_exports.object({
 var folderIdInputSchema = external_exports.object({ id: external_exports.string().min(1) });
 
 // ../api-server-api/src/modules/features/schemas.ts
-var featureIdSchema = external_exports.enum(["advanced-connections", "vm-sandboxes"]);
+var featureIdSchema = external_exports.enum([
+  "advanced-connections",
+  "vm-sandboxes",
+  "session-costs"
+]);
 var featureSetFlagInputSchema = external_exports.object({
   feature: featureIdSchema,
   enabled: external_exports.boolean()
@@ -30958,6 +31085,11 @@ var secretRef = external_exports.object({
 
 // ../api-server-api/src/modules/connections/types.ts
 var connectionCategory = external_exports.enum(["app", "mcp", "other"]);
+var refreshBackoff = external_exports.object({
+  failures: external_exports.number().int(),
+  /** Epoch seconds; ticks before this skip the connection. */
+  nextAttempt: external_exports.number().int()
+});
 var oauthAuth = external_exports.object({
   kind: external_exports.literal("oauth"),
   clientId: external_exports.string(),
@@ -30969,6 +31101,10 @@ var oauthAuth = external_exports.object({
   clientSecretRef: secretRef.optional(),
   expiresAt: external_exports.number().int().optional(),
   connectedAt: external_exports.number().int().optional(),
+  // Epoch seconds, set only on a *permanent* token rejection: derives
+  // `expired` and parks the connection. Any successful token write clears it.
+  refreshFailedAt: external_exports.number().int().optional(),
+  refreshBackoff: refreshBackoff.optional(),
   tokenEndpointAcceptJson: external_exports.boolean().optional(),
   extraAuthParams: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   host: external_exports.string().min(1).optional(),
@@ -30985,6 +31121,8 @@ var clientCredentialsAuth = external_exports.object({
   audience: external_exports.string().min(1).optional(),
   expiresAt: external_exports.number().int().optional(),
   connectedAt: external_exports.number().int().optional(),
+  refreshFailedAt: external_exports.number().int().optional(),
+  refreshBackoff: refreshBackoff.optional(),
   tokenEndpointAcceptJson: external_exports.boolean().optional(),
   host: external_exports.string().min(1).optional()
 });
@@ -30997,7 +31135,21 @@ var githubAppAuth = external_exports.object({
   apiBaseUrl: external_exports.string().url(),
   expiresAt: external_exports.number().int().optional(),
   connectedAt: external_exports.number().int().optional(),
-  host: external_exports.string().min(1).optional()
+  refreshFailedAt: external_exports.number().int().optional(),
+  refreshBackoff: refreshBackoff.optional(),
+  host: external_exports.string().min(1).optional(),
+  // Optional narrowing of the minted token, stored because every re-mint must
+  // ask for the same subset — a scope kept only on the create input would widen
+  // back to the whole installation at the first renewal. Absent means the
+  // installation's full authority, which is what every connection made before
+  // this field existed carries.
+  repositories: external_exports.array(external_exports.string().min(1)).nonempty().optional(),
+  permissions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  // Repositories named by GitHub's numeric id rather than by name — what the
+  // picker records, since an id survives a rename where a name would start
+  // failing at the next renewal. Only one of the two reaches GitHub; ids win
+  // when both are set, and connections predating the picker carry names only.
+  repositoryIds: external_exports.array(external_exports.number().int()).nonempty().optional()
 });
 var headerAuth = external_exports.object({
   kind: external_exports.literal("header"),
@@ -31049,7 +31201,19 @@ var connectionView = external_exports.object({
   connectedAt: external_exports.string().optional(),
   hosts: external_exports.array(external_exports.string()),
   host: external_exports.string().min(1).optional(),
-  appSlug: external_exports.string().min(1).optional()
+  appSlug: external_exports.string().min(1).optional(),
+  // Only for an OAuth connection storing its own client secret — an
+  // operator-supplied one is deploy config, not replaceable per connection.
+  hasClientSecret: external_exports.boolean().optional(),
+  // The narrowing a github-app connection currently mints against, so it can
+  // be shown and edited rather than only set once at create. Absent means the
+  // installation's full authority. Carries no secret — names, ids, and levels
+  // are all things the user chose.
+  githubAppScope: external_exports.object({
+    repositories: external_exports.array(external_exports.string()).optional(),
+    repositoryIds: external_exports.array(external_exports.number().int()).optional(),
+    permissions: external_exports.record(external_exports.string(), external_exports.string()).optional()
+  }).optional()
 });
 var templateInputState = external_exports.enum([
   "required",
@@ -31184,7 +31348,32 @@ var githubAppCreateInput = external_exports.object({
   host: external_exports.string().min(1).optional(),
   appId: external_exports.string().min(1),
   installationId: external_exports.string().min(1),
-  privateKey: external_exports.string().min(1)
+  privateKey: external_exports.string().min(1),
+  // Optional narrowing of the minted token. Space- or comma-separated; the
+  // server parses both. Single strings keep the schema-driven forms all-string,
+  // as client-credentials `scopes` does. Blank leaves the token with the
+  // installation's full authority.
+  repositories: external_exports.string().optional(),
+  permissions: external_exports.string().optional(),
+  // Repository ids, as picked from the installation. Same all-string shape as
+  // the sibling fields; ids take precedence over names when both arrive.
+  repositoryIds: external_exports.string().optional()
+});
+var connectionProbeGitHubAppInputSchema = external_exports.object({
+  templateId: external_exports.string().min(1),
+  appId: external_exports.string().min(1),
+  installationId: external_exports.string().min(1),
+  privateKey: external_exports.string().min(1),
+  host: external_exports.string().min(1).optional()
+});
+var connectionProbeGitHubAppForConnectionInputSchema = external_exports.object({
+  connectionId: external_exports.string().min(1)
+});
+var connectionUpdateGitHubAppScopeInputSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  repositories: external_exports.string().optional(),
+  repositoryIds: external_exports.string().optional(),
+  permissions: external_exports.string().optional()
 });
 var noneCreateInput = external_exports.object({
   ...commonFields,
@@ -31348,6 +31537,26 @@ var platformTurnEndedNotificationSchema = external_exports.object({
   method: external_exports.literal("platform/turnEnded"),
   params: platformTurnEndedParamsSchema
 });
+var platformPromptAcceptedParamsSchema = external_exports.object({
+  sessionId: external_exports.string().min(1),
+  promptId: external_exports.string().min(1),
+  /** True when the prompt was parked behind an in-flight turn. */
+  queued: external_exports.boolean()
+});
+var platformPromptAcceptedNotificationSchema = external_exports.object({
+  jsonrpc: external_exports.literal("2.0"),
+  method: external_exports.literal("platform/promptAccepted"),
+  params: platformPromptAcceptedParamsSchema
+});
+var platformPromptStartedParamsSchema = external_exports.object({
+  sessionId: external_exports.string().min(1),
+  promptId: external_exports.string().min(1)
+});
+var platformPromptStartedNotificationSchema = external_exports.object({
+  jsonrpc: external_exports.literal("2.0"),
+  method: external_exports.literal("platform/promptStarted"),
+  params: platformPromptStartedParamsSchema
+});
 
 // ../api-server-api/src/modules/brand/types.ts
 var brandSchema = external_exports.object({
@@ -37573,7 +37782,9 @@ function buildSlackConnectCommand(deps) {
         process.exit(EXIT_RUNTIME_FAILURE);
       }
       if (opts.ambient) {
-        const slackCh = res.value.find((c2) => c2.type === "slack" /* Slack */);
+        const slackCh = res.value.find(
+          (c2) => c2.type === "slack" /* Slack */ && c2.slackChannelId === channelId
+        );
         if (!slackCh?.ambient) {
           process.stderr.write(
             "error: this server does not support ambient mode \u2014 the channel is connected without it\n"
@@ -37606,46 +37817,67 @@ function buildSlackConnectCommand(deps) {
 // src/modules/channel/commands/slack-disconnect.ts
 function buildSlackDisconnectCommand(deps) {
   return new Command("disconnect").description(
-    "Unbind an Agent's Slack channel. Idempotent \u2014 a not-connected agent exits 0."
+    "Unbind a Slack channel from an Agent. Idempotent \u2014 a not-connected agent exits 0."
   ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
+    "--channel-id <id>",
+    "Slack channel id to disconnect; required when the Agent has more than one connected"
+  ).option(
     "--server <url>",
     "override the configured server URL for this call"
   ).option("--json", "emit the updated ChannelConfig[] as JSON").addHelpText(
     "after",
-    "\nExamples:\n  dam channel slack disconnect my-agent\n"
-  ).action(async (ref, opts) => {
-    const host = await resolveActiveHost(deps, {
-      flag: opts.server ? { server: opts.server } : void 0,
-      exitCodes: {
-        runtimeFailure: EXIT_RUNTIME_FAILURE,
-        belowFloor: EXIT_BELOW_FLOOR
+    "\nExamples:\n  dam channel slack disconnect my-agent\n  dam channel slack disconnect my-agent --channel-id C0123ABCD\n"
+  ).action(
+    async (ref, opts) => {
+      const channelId = opts.channelId?.trim();
+      if (opts.channelId !== void 0 && !channelId) {
+        process.stderr.write("error: --channel-id must not be empty\n");
+        process.exit(EXIT_INVALID_INPUT);
       }
-    });
-    const resolver = createAgentResolver({
-      agentService: deps.createAgentService(host)
-    });
-    const resolved = await resolver.resolve(ref);
-    if (!resolved.ok) {
-      printResolveError(resolved.error, host);
-      process.exit(exitCodeForResolveError(resolved.error));
-    }
-    const svc = deps.createChannelService(host);
-    const res = await svc.disconnectSlack(resolved.value.id);
-    if (!res.ok) {
-      printServiceError(res.error, host);
-      process.exit(EXIT_RUNTIME_FAILURE);
-    }
-    if (opts.json) {
-      process.stdout.write(`${JSON.stringify(res.value)}
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const resolver = createAgentResolver({
+        agentService: deps.createAgentService(host)
+      });
+      const resolved = await resolver.resolve(ref);
+      if (!resolved.ok) {
+        printResolveError(resolved.error, host);
+        process.exit(exitCodeForResolveError(resolved.error));
+      }
+      const bound = resolved.value.channels.filter(
+        (c2) => c2.type === "slack" /* Slack */
+      );
+      if (!channelId && bound.length > 1) {
+        process.stderr.write(
+          `error: ${resolved.value.name} has ${bound.length} Slack channels connected (${bound.map((c2) => c2.slackChannelId).join(", ")}) \u2014 pass --channel-id to say which one
+`
+        );
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const svc = deps.createChannelService(host);
+      const res = await svc.disconnectSlack(resolved.value.id, channelId);
+      if (!res.ok) {
+        printServiceError(res.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(res.value)}
 `);
-    } else {
-      process.stdout.write(
-        `\u2713 Slack disconnected from ${resolved.value.name}.
+      } else {
+        process.stdout.write(
+          channelId ? `\u2713 Slack channel ${channelId} disconnected from ${resolved.value.name}.
+` : `\u2713 Slack disconnected from ${resolved.value.name}.
 `
-      );
+        );
+      }
+      process.exit(EXIT_SUCCESS);
     }
-    process.exit(EXIT_SUCCESS);
-  });
+  );
 }
 
 // src/modules/channel/services/channel-service.ts
@@ -37674,9 +37906,12 @@ function createChannelService(deps) {
         return classifyTrpcError(e2);
       }
     },
-    async disconnectSlack(id) {
+    async disconnectSlack(id, slackChannelId) {
       return trpcCall(async () => {
-        const agent = await deps.trpc.agents.disconnectSlack.mutate({ id });
+        const agent = await deps.trpc.agents.disconnectSlack.mutate({
+          id,
+          ...slackChannelId ? { slackChannelId } : {}
+        });
         return agent.channels;
       });
     }
@@ -40245,7 +40480,7 @@ function createProcessEnvReader() {
 
 // src/modules/cli/infrastructure/package-version.ts
 function readPackageVersion() {
-  return true ? "0.2.12" : DEV_VERSION;
+  return true ? "0.2.13-rc1" : DEV_VERSION;
 }
 
 // src/modules/cli/infrastructure/version-probe.ts
@@ -40487,6 +40722,15 @@ function buildConnectCommand(deps) {
   ).option(
     "--private-key <pem>",
     'input: GitHub App private key \u2014 PEM or base64; use --private-key "$(cat app.pem)" (GitHub App installation)'
+  ).option(
+    "--repositories <names>",
+    "input: limit the minted token to these repository names, space- or comma-separated (GitHub App installation)"
+  ).option(
+    "--repository-ids <ids>",
+    "input: limit the minted token to these numeric repository ids; takes precedence over --repositories (GitHub App installation)"
+  ).option(
+    "--permissions <pairs>",
+    "input: limit the minted token to these name:level permissions, e.g. contents:read (GitHub App installation)"
   ).option("--header-name <name>", "input: header name").option("--value-format <format>", "input: header value format").option(
     "--env-name <name>",
     "input: expose the credential to the agent as this env var (custom header credentials)"
@@ -40649,6 +40893,19 @@ async function resolveSlugTemplate(args) {
     );
     process.exit(EXIT_INVALID_INPUT);
   }
+  for (const flag of [
+    "repositories",
+    "repositoryIds",
+    "permissions"
+  ]) {
+    if (opts[flag] && !template.inputs.some((i) => i.name === flag)) {
+      process.stderr.write(
+        `error: this server does not support --${camelToKebab(flag)} for '${template.id}' \u2014 the token would carry the installation's full authority
+`
+      );
+      process.exit(EXIT_INVALID_INPUT);
+    }
+  }
   const name = (opts.name ?? slugifyTemplateName(template.name)).trim();
   validateName(name);
   const { values, presetsApplied } = await collectInputs(template, opts, json2);
@@ -40790,7 +41047,10 @@ function buildPayload(template, name, values) {
         ...v2("host") ? { host: v2("host") } : {},
         appId,
         installationId,
-        privateKey
+        privateKey,
+        ...v2("repositories") ? { repositories: v2("repositories") } : {},
+        ...v2("repositoryIds") ? { repositoryIds: v2("repositoryIds") } : {},
+        ...v2("permissions") ? { permissions: v2("permissions") } : {}
       };
     }
     case "header": {
@@ -41204,6 +41464,137 @@ function buildListCommand4(deps) {
   );
 }
 
+// src/modules/connection/commands/reauth.ts
+var POLL_INTERVAL_MS3 = 2e3;
+var DEFAULT_TIMEOUT_SECONDS4 = 300;
+function buildReauthCommand(deps) {
+  return new Command("reauth").description("Re-run login and consent for an existing OAuth connection").argument(
+    "<id-or-name>",
+    "Connection id ('conn-\u2026') or unique name (from `dam connection list`)"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit { ok, id, name } as JSON").option("--no-browser", "print the authorize URL instead of opening it").option(
+    "--timeout <seconds>",
+    "how long to wait for authorization",
+    String(DEFAULT_TIMEOUT_SECONDS4)
+  ).addHelpText(
+    "after",
+    "\nRe-authentication keeps the connection's identity and every sandbox\ngrant; only its tokens are replaced. Use it when a connection shows\nexpired, or to re-consent after its template gained scopes.\n\nExamples:\n  dam connection reauth github\n  dam connection reauth conn-61cc7b9137b0 --no-browser\n\nConnections that store their own secret take a new one instead:\n  dam connection update <id-or-name>\n"
+  ).action(
+    async (ref, opts) => {
+      const json2 = opts.json ?? false;
+      const timeoutSeconds = parseTimeout3(opts.timeout);
+      if (timeoutSeconds === null) {
+        process.stderr.write("error: --timeout must be a positive integer\n");
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const svc = deps.createConnectionService(host);
+      const listed = await svc.list();
+      if (!listed.ok) {
+        printServiceError(listed.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      const match = resolveConnectionRef(listed.value, ref);
+      if (!match) {
+        process.stderr.write(
+          `error: no connection with id or name '${ref}'
+`
+        );
+        process.stderr.write(
+          "hint: run `dam connection list` to see ids and names\n"
+        );
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      if (match.authKind !== "oauth") {
+        process.stderr.write(
+          `error: '${match.name}' uses ${match.authKind} auth, which has no login flow
+`
+        );
+        process.stderr.write(
+          `hint: replace its stored credential with \`dam connection update ${match.name}\`
+`
+        );
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const connectedAtBefore = match.connectedAt;
+      const started = await svc.startOAuth(match.id);
+      if (!started.ok) {
+        printServiceError(started.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      const { authUrl } = started.value;
+      const noBrowser = opts.browser === false;
+      if (noBrowser) {
+        process.stderr.write(`Open this URL to authorize:
+  ${authUrl}
+`);
+      } else {
+        const opened = await deps.browserOpener.open(authUrl);
+        if (!opened.ok) {
+          process.stderr.write(
+            `Couldn't open a browser. Open this URL to authorize:
+  ${authUrl}
+`
+          );
+        }
+      }
+      process.stderr.write("Waiting for authorization\u2026\n");
+      const landed = await pollUntilReconnected(
+        svc,
+        match.id,
+        connectedAtBefore,
+        timeoutSeconds
+      );
+      if (!landed) {
+        process.stderr.write(
+          `error: couldn't confirm the re-authentication finished within ${timeoutSeconds}s; it may still complete \u2014 check \`dam connection list\`
+`
+        );
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (json2) {
+        process.stdout.write(
+          `${JSON.stringify({ ok: true, id: match.id, name: match.name })}
+`
+        );
+      } else {
+        process.stdout.write(
+          `\u2713 Re-authenticated ${match.name} (${match.id}).
+`
+        );
+      }
+      process.exit(EXIT_SUCCESS);
+    }
+  );
+}
+async function pollUntilReconnected(svc, id, connectedAtBefore, timeoutSeconds) {
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  while (true) {
+    const res = await svc.getConnection(id);
+    if (res.ok && res.value && res.value.connectedAt !== connectedAtBefore) {
+      return true;
+    }
+    if (Date.now() + POLL_INTERVAL_MS3 >= deadline) return false;
+    await sleep5(POLL_INTERVAL_MS3);
+  }
+}
+function parseTimeout3(raw) {
+  if (raw === void 0) return DEFAULT_TIMEOUT_SECONDS4;
+  const n = Number(raw);
+  return Number.isInteger(n) && n > 0 ? n : null;
+}
+function sleep5(ms) {
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
+}
+
 // src/modules/connection/commands/revoke.ts
 var collect2 = (v2, acc) => [...acc, v2];
 function buildRevokeCommand(deps) {
@@ -41351,19 +41742,39 @@ function buildTemplatesCommand(deps) {
 }
 
 // src/modules/connection/commands/update.ts
+var SECRET_LABELS = {
+  header: "New credential value",
+  "client-credentials": "New client secret",
+  "github-app": "New private key (PEM)",
+  // Its own client secret, not its tokens — those come from `reauth`. Only
+  // connections carrying their own qualify; the server rejects the rest.
+  oauth: "New OAuth client secret"
+};
 function buildUpdateCommand(deps) {
-  return new Command("update").description("Replace a connection's stored credential value").argument(
+  return new Command("update").description("Replace a connection's stored credential").argument(
     "<id-or-name>",
     "Connection id ('conn-\u2026') or unique name (from `dam connection list`)"
   ).option(
     "--value <value>",
-    "the new credential value (prompts securely if omitted)"
+    "the new secret \u2014 the injected value, client secret, or private key, depending on the connection's auth kind (prompts securely if omitted)"
   ).option(
     "--server <url>",
     "override the configured server URL for this call"
   ).option("--json", "emit { ok, id, name } as JSON").addHelpText(
     "after",
-    "\nExamples:\n  dam connection update conn-61cc7b9137b0 --value sk-ant-...\n  dam connection update anthropic   # prompts for the value\n"
+    `
+Examples:
+  dam connection update conn-61cc7b9137b0 --value sk-ant-...
+  dam connection update anthropic   # prompts for the value
+  dam connection update my-github-app --value "$(cat app.pem)"
+
+A multi-line secret (a PEM private key) can't be typed at the
+prompt \u2014 pass it with --value, as in the last example.
+
+On an OAuth connection this rotates its *client secret* (only when the
+connection carries its own). To replace expired tokens, re-consent:
+  dam connection reauth <id-or-name>
+`
   ).action(
     async (ref, opts) => {
       const host = await resolveActiveHost(deps, {
@@ -41390,9 +41801,9 @@ function buildUpdateCommand(deps) {
         );
         process.exit(EXIT_INVALID_INPUT);
       }
-      if (match.authKind !== "header") {
+      if (match.authKind === "none") {
         process.stderr.write(
-          `error: only header-credential connections can be updated; '${match.name}' uses ${match.authKind} auth
+          `error: '${match.name}' stores no credential to update
 `
         );
         process.exit(EXIT_INVALID_INPUT);
@@ -41405,9 +41816,14 @@ function buildUpdateCommand(deps) {
           );
           process.exit(EXIT_INVALID_INPUT);
         }
-        const entered = await promptSecret(
-          `New credential value for ${match.name}`
-        );
+        if (match.authKind === "github-app") {
+          process.stderr.write(
+            `note: a PEM key can't be typed at the prompt \u2014 pass --value "$(cat app.pem)" instead
+`
+          );
+        }
+        const label = SECRET_LABELS[match.authKind];
+        const entered = await promptSecret(`${label} for ${match.name}`);
         if (q(entered)) {
           me("Cancelled");
           process.exit(EXIT_SUCCESS);
@@ -41476,6 +41892,14 @@ function composeConnectionModule(opts) {
       createConnectionService: createService
     })
   );
+  parent.addCommand(
+    buildReauthCommand({
+      compatService: opts.compatService,
+      configService: opts.configService,
+      createConnectionService: createService,
+      browserOpener: opts.browserOpener
+    })
+  );
   parent.addCommand(buildGrantCommand(agentScoped));
   parent.addCommand(buildRevokeCommand(agentScoped));
   return { commands: [parent], exports: { createService } };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dam-agents/cli",
   "author": "IBM Corp.",
-  "version": "0.2.12",
+  "version": "0.2.13-rc1",
   "type": "module",
   "license": "Apache-2.0",
   "homepage": "https://github.com/dam-agents/dam/tree/main/packages/cli#readme",
@@ -43,8 +43,8 @@
     "vitest": "^4.1.3",
     "ws": "^8.20.0",
     "zod": "^4.4.3",
+    "api-server-api": "0.0.1",
     "agent-runtime-api": "0.0.1",
-    "dev-config": "0.0.1",
-    "api-server-api": "0.0.1"
+    "dev-config": "0.0.1"
   }
 }