@dam-agents/cli 0.2.7-rc1 → 0.2.8-rc1

package/dist/bin.js

@@ -26799,6 +26799,18 @@ var skillListInputSchema = external_exports.object({
   sourceId: external_exports.string().min(1),
   agentId: external_exports.string().min(1).optional()
 });
+var skillGetContentInputSchema = external_exports.object({
+  sourceId: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  agentId: external_exports.string().min(1).optional()
+});
+var skillContentSchema = external_exports.object({
+  content: external_exports.string(),
+  /** Source-relative directory the SKILL.md was found in, when resolvable —
+   *  lets the UI build an accurate blob link instead of guessing the dir from
+   *  the (frontmatter) skill name. */
+  dir: external_exports.string().optional()
+});
 var skillInstallInputSchema = external_exports.object({
   agentId: external_exports.string().min(1),
   source: external_exports.string().url(),
@@ -26892,6 +26904,38 @@ var repoSchema = external_exports.object({
   compatibleTemplates: external_exports.array(external_exports.string()).default([])
 });
 
+// ../api-server-api/src/modules/invocations/schemas.ts
+var DEFAULT_INVOCATION_TTL_MS = 60 * 60 * 1e3;
+var MIN_INVOCATION_TTL_MS = 60 * 1e3;
+var MAX_INVOCATION_TTL_MS = 6 * 60 * 60 * 1e3;
+var spawnInvocationRequestSchema = external_exports.object({
+  image: external_exports.string().min(1).optional(),
+  templateId: external_exports.string().min(1).optional(),
+  connections: external_exports.array(external_exports.string().min(1)).optional(),
+  prompt: external_exports.string().min(1),
+  // The result JSON Schema — arbitrary JSON, validated structurally by ajv
+  // when the target reports (a malformed schema is rejected at spawn).
+  schema: external_exports.unknown(),
+  // Optional liveness deadline for this target, in ms. Bounded server-side; a
+  // shorter value fails a wedged/misconfigured target fast, a longer one lets
+  // a heavy target run past the default hour.
+  ttlMs: external_exports.number().int().min(MIN_INVOCATION_TTL_MS).max(MAX_INVOCATION_TTL_MS).optional(),
+  // Optional resource limits. A heavy Make (clone + install + build)
+  // OOM-kills at the template's small default memory, so let the driver raise
+  // it. Same grammar and floors as the agent size knob.
+  memory: external_exports.string().regex(/^\d+(Mi|Gi)$/, "memory must look like '512Mi' or '4Gi'").optional(),
+  cpu: external_exports.string().regex(/^\d+(\.\d+)?m?$/, "cpu must look like '2', '0.5' or '500m'").optional()
+}).refine((d2) => d2.image !== void 0 || d2.templateId !== void 0, {
+  message: "either image or templateId is required"
+});
+var spawnInvocationResponseSchema = external_exports.object({
+  id: external_exports.string().min(1)
+});
+var invocationViewSchema = external_exports.object({
+  status: external_exports.enum(["running", "done", "failed"]),
+  result: external_exports.unknown()
+});
+
 // ../agent-runtime-api/src/modules/files/schemas.ts
 var pathSchema = external_exports.string().min(1);
 var fileListDirsInputSchema = external_exports.object({
@@ -27209,6 +27253,10 @@ var harnessConfigSettledSchema = external_exports.object({
 
 // ../api-server-api/src/modules/egress-rules/schemas.ts
 var ruleVerdictSchema = external_exports.enum(["allow", "deny"]);
+var HOSTNAME = /^(\*\.)?[a-zA-Z0-9]([-a-zA-Z0-9]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([-a-zA-Z0-9]{0,61}[a-zA-Z0-9])?)*$/;
+var egressHostSchema = external_exports.string().min(1).max(253).refine((h2) => h2 === "*" || HOSTNAME.test(h2), {
+  message: "host must be a DNS hostname, a *.wildcard, or bare *"
+});
 var egressPresetSchema = external_exports.enum(["none", "trusted", "all"]);
 var egressRuleListForAgentInputSchema = external_exports.object({
   agentId: external_exports.string().min(1)
@@ -27218,7 +27266,7 @@ var egressRuleCurrentPresetInputSchema = external_exports.object({
 });
 var egressRuleCreateInputSchema = external_exports.object({
   agentId: external_exports.string().min(1),
-  host: external_exports.string().min(1),
+  host: egressHostSchema,
   // Upstream port; omit for 443. Promotes the host onto the L7 chain.
   port: external_exports.number().int().min(1).max(65535).optional(),
   method: external_exports.string().min(1).default("*"),
@@ -27257,6 +27305,9 @@ var agentSizeSchema = external_exports.object({
   cpu: cpuQuantitySchema.optional(),
   memory: memoryQuantitySchema.optional()
 });
+var agentUpgradeInputSchema = idSchema.extend({
+  expectedToImage: external_exports.string().min(1).optional()
+});
 var agentCreateInputSchema = external_exports.object({
   name: external_exports.string().min(1).refine((n) => !n.startsWith("agent-"), {
     message: "agent name cannot start with 'agent-' (reserved for IDs)"
@@ -27290,7 +27341,15 @@ var agentCreateInputSchema = external_exports.object({
   // dimensions inherit the template's limits, else the chart default.
   // Requests are derived server-side — never a user concept. Floors match
   // the chart's derivation floors; the budget gate is the only ceiling.
-  size: agentSizeSchema.optional()
+  size: agentSizeSchema.optional(),
+  // Sweepable (#2816): mark this agent for automatic deletion by the Agent
+  // Sweep once it hibernates. Set on ephemeral agents (Invocation targets);
+  // durable owned agents omit it. Stamped as an annotation at create.
+  sweepable: external_exports.boolean().optional(),
+  // Agent Lifetime (#2816): optional grace in ms a Sweepable agent may stay
+  // hibernated before the Sweep deletes it. Default zero — deleted as soon
+  // as it hibernates. Ignored unless `sweepable`.
+  lifetimeMs: external_exports.number().int().min(0).optional()
 }).refine((d2) => d2.templateId !== void 0 || d2.image !== void 0, {
   message: "Either templateId or image is required"
 });
@@ -27310,11 +27369,32 @@ var agentUpdateInputSchema = external_exports.object({
 });
 var agentConnectSlackInputSchema = external_exports.object({
   id: external_exports.string().min(1),
-  slackChannelId: external_exports.string().min(1)
+  slackChannelId: external_exports.string().min(1),
+  // Access mode; absent = person-scoped.
+  mode: external_exports.enum(["shared", "person-scoped"]).optional(),
+  // Ambient mode; absent = off. Unlike mode it is mutable: re-connecting
+  // with the same mode updates it in place.
+  ambient: external_exports.boolean().optional()
+}).refine((v2) => !v2.ambient || v2.mode === "shared", {
+  message: "Ambient mode requires a shared binding",
+  path: ["ambient"]
+});
+var agentListTelegramChatsInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1)
 });
-var agentConnectTelegramInputSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  botToken: external_exports.string().min(1)
+var agentUnbindTelegramChatInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  conversationId: external_exports.string().min(1)
+});
+var agentBindTelegramChatInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  // Opaque bind-flow id minted by the Telegram OAuth callback.
+  flowId: external_exports.string().min(1)
+});
+var agentBindSlackChannelInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  // Opaque bind-flow id minted by the Slack in-chat bind OAuth callback.
+  flowId: external_exports.string().min(1)
 });
 
 // ../api-server-api/src/modules/schedules/schemas.ts
@@ -27417,6 +27497,83 @@ var experimentAddArmInputSchema = external_exports.object({
   armVariation: armVariationSchema.default("")
 });
 
+// ../api-server-api/src/modules/artifact-library/schemas.ts
+var artifactKindSchema = external_exports.enum([
+  "html",
+  "jsx",
+  "markdown",
+  "code",
+  "text",
+  "binary"
+]);
+var artifactVisibilitySchema = external_exports.enum(["private", "public"]);
+var titleSchema = external_exports.string().trim().min(1, "title is required").max(300);
+var fileNameSchema = external_exports.string().trim().min(1).max(255);
+var expiresInHoursSchema = external_exports.number().int().positive().max(24 * 365 * 10);
+var artifactIdInputSchema = external_exports.object({ id: external_exports.string().min(1) });
+var artifactListInputSchema = external_exports.object({
+  folderId: external_exports.string().min(1).nullish(),
+  agentId: external_exports.string().min(1).optional(),
+  search: external_exports.string().trim().max(200).optional()
+});
+var artifactContentInputSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  version: external_exports.number().int().positive().optional()
+});
+var INLINE_CONTENT_MAX_BYTES = 2 * 1024 * 1024;
+var contentOrUploadRef = {
+  content: external_exports.string().max(INLINE_CONTENT_MAX_BYTES).optional(),
+  uploadRef: external_exports.string().min(1).max(1024).optional()
+};
+var artifactCreateInputSchema = external_exports.object({
+  title: titleSchema,
+  ...contentOrUploadRef,
+  fileName: fileNameSchema.optional(),
+  kind: artifactKindSchema.optional(),
+  contentType: external_exports.string().trim().min(1).max(200).optional(),
+  folderId: external_exports.string().min(1).optional(),
+  visibility: artifactVisibilitySchema.optional(),
+  expiresInHours: expiresInHoursSchema.nullish()
+}).refine((v2) => v2.content == null !== (v2.uploadRef == null), {
+  message: "provide exactly one of content or uploadRef",
+  path: ["content"]
+});
+var artifactUpdateInputSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  title: titleSchema.optional(),
+  folderId: external_exports.string().min(1).nullish(),
+  ...contentOrUploadRef,
+  fileName: fileNameSchema.optional(),
+  kind: artifactKindSchema.optional(),
+  contentType: external_exports.string().trim().min(1).max(200).optional()
+}).refine((v2) => !(v2.content != null && v2.uploadRef != null), {
+  message: "provide at most one of content or uploadRef",
+  path: ["content"]
+});
+var artifactSharingInputSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  visibility: artifactVisibilitySchema.optional(),
+  expiresInHours: expiresInHoursSchema.nullish()
+});
+var artifactUploadUrlInputSchema = external_exports.object({
+  fileName: fileNameSchema
+});
+var folderCreateInputSchema = external_exports.object({
+  name: external_exports.string().trim().min(1, "name is required").max(200)
+});
+var folderUpdateInputSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  name: external_exports.string().trim().min(1).max(200).optional()
+});
+var folderIdInputSchema = external_exports.object({ id: external_exports.string().min(1) });
+
+// ../api-server-api/src/modules/features/schemas.ts
+var featureIdSchema = external_exports.enum(["advanced-connections", "experiments"]);
+var featureSetFlagInputSchema = external_exports.object({
+  feature: featureIdSchema,
+  enabled: external_exports.boolean()
+});
+
 // ../../node_modules/.pnpm/rrule@2.8.1/node_modules/rrule/dist/esm/index.js
 var esm_exports = {};
 __export(esm_exports, {
@@ -30648,6 +30805,17 @@ var clientCredentialsAuth = external_exports.object({
   tokenEndpointAcceptJson: external_exports.boolean().optional(),
   host: external_exports.string().min(1).optional()
 });
+var githubAppAuth = external_exports.object({
+  kind: external_exports.literal("github-app"),
+  appId: external_exports.string().min(1),
+  installationId: external_exports.string().min(1),
+  privateKeyRef: secretRef,
+  accessTokenRef: secretRef,
+  apiBaseUrl: external_exports.string().url(),
+  expiresAt: external_exports.number().int().optional(),
+  connectedAt: external_exports.number().int().optional(),
+  host: external_exports.string().min(1).optional()
+});
 var headerAuth = external_exports.object({
   kind: external_exports.literal("header"),
   valueRef: secretRef,
@@ -30660,6 +30828,7 @@ var noneAuth = external_exports.object({
 var authConfig = external_exports.discriminatedUnion("kind", [
   oauthAuth,
   clientCredentialsAuth,
+  githubAppAuth,
   headerAuth,
   noneAuth
 ]);
@@ -30681,6 +30850,7 @@ var connectionStatus = external_exports.enum([
 var authKind = external_exports.enum([
   "oauth",
   "client-credentials",
+  "github-app",
   "header",
   "none"
 ]);
@@ -30708,6 +30878,8 @@ var templateInput = external_exports.object({
   state: templateInputState,
   presetValue: external_exports.string().optional(),
   secret: external_exports.boolean().optional(),
+  // Renders as a multi-line textarea rather than a single-line input (e.g. a PEM private key).
+  multiline: external_exports.boolean().optional(),
   // Marks a config input the form packs into `configInputs` rather than the typed auth fields.
   configInput: external_exports.boolean().optional(),
   label: external_exports.string().optional(),
@@ -30823,14 +30995,26 @@ var clientCredentialsCreateInput = external_exports.object({
     "env var name must be letters, digits, and underscores (not starting with a digit)"
   ).optional()
 });
+var githubAppCreateInput = external_exports.object({
+  ...commonFields,
+  authKind: external_exports.literal("github-app"),
+  appId: external_exports.string().min(1),
+  installationId: external_exports.string().min(1),
+  privateKey: external_exports.string().min(1)
+});
 var noneCreateInput = external_exports.object({
   ...commonFields,
   authKind: external_exports.literal("none"),
-  url: external_exports.string().url().optional()
+  url: external_exports.string().url().optional(),
+  // Optional header credential (API key) for MCP servers guarded by a
+  // static header — injected at the gateway, never written to harness config.
+  headerName: external_exports.string().min(1).optional(),
+  value: external_exports.string().min(1).optional()
 });
 var connectionCreateInputSchema = external_exports.discriminatedUnion("authKind", [
   oauthCreateInput,
   clientCredentialsCreateInput,
+  githubAppCreateInput,
   headerCreateInput,
   noneCreateInput
 ]);
@@ -31078,7 +31262,9 @@ var slackFireMentionInputSchema = external_exports.object({
   channel: external_exports.string().min(1),
   ts: external_exports.string().min(1),
   threadTs: external_exports.string().optional(),
-  text: external_exports.string()
+  text: external_exports.string(),
+  /** Workspace id; present so the fake exercises the live-streaming path. */
+  teamId: external_exports.string().optional()
 }).strict();
 var slackFireCommandInputSchema = external_exports.object({
   text: external_exports.string(),
@@ -31110,6 +31296,33 @@ var slackOutboundRecordSchema = external_exports.discriminatedUnion("kind", [
     kind: external_exports.literal("upload"),
     channelId: external_exports.string(),
     filename: external_exports.string()
+  }).strict(),
+  external_exports.object({
+    kind: external_exports.literal("stream_start"),
+    channel: external_exports.string(),
+    threadTs: external_exports.string(),
+    ts: external_exports.string(),
+    text: external_exports.string(),
+    recipientTeamId: external_exports.string().optional(),
+    recipientUserId: external_exports.string().optional()
+  }).strict(),
+  external_exports.object({
+    kind: external_exports.literal("stream_append"),
+    channel: external_exports.string(),
+    ts: external_exports.string(),
+    text: external_exports.string()
+  }).strict(),
+  external_exports.object({
+    kind: external_exports.literal("stream_stop"),
+    channel: external_exports.string(),
+    ts: external_exports.string(),
+    text: external_exports.string().optional()
+  }).strict(),
+  external_exports.object({
+    kind: external_exports.literal("status"),
+    channel: external_exports.string(),
+    threadTs: external_exports.string(),
+    status: external_exports.string()
   }).strict()
 ]);
 var slackReadOutboundResultSchema = external_exports.object({ records: external_exports.array(slackOutboundRecordSchema) }).strict();
@@ -31436,6 +31649,7 @@ var EXIT_RULE_NOT_FOUND = 6;
 var EXIT_AGENT_NOT_REACHABLE = 7;
 var EXIT_APPROVAL_NOT_ACTIONABLE = 8;
 var EXIT_SCHEDULE_NOT_FOUND = 9;
+var EXIT_TERMS_NOT_ACCEPTED = 10;
 var EXIT_SIGINT = 130;
 
 // src/modules/agent/commands/create.ts
@@ -37247,11 +37461,16 @@ function buildDisallowCommand(deps) {
 // src/modules/channel/commands/list.ts
 function renderHuman(channels, allowedUserEmails) {
   const channelsBlock = channels.length === 0 ? "No channels connected.\n" : renderTable([
-    ["TYPE", "IDENTIFIER"],
+    ["TYPE", "IDENTIFIER", "MODE"],
     ...channels.map(
       (c2) => (
         // Telegram has no readable identifier — the bot token is write-only.
-        c2.type === "slack" /* Slack */ ? ["slack", c2.slackChannelId] : ["telegram", "\u2014"]
+        // Telegram is structurally shared-only.
+        c2.type === "slack" /* Slack */ ? [
+          "slack",
+          c2.slackChannelId,
+          c2.ambient ? "shared (ambient)" : c2.mode ?? "person-scoped"
+        ] : ["telegram", "\u2014", "shared"]
       )
     )
   ]);
@@ -37305,7 +37524,7 @@ function buildListCommand3(deps) {
 // src/modules/channel/commands/precheck.ts
 var UNAVAILABLE_MESSAGE = {
   ["slack" /* Slack */]: "Slack app token not configured",
-  ["telegram" /* Telegram */]: "Telegram channel not enabled"
+  ["telegram" /* Telegram */]: "Telegram bot not configured"
 };
 async function ensureProviderAvailable(svc, provider, host) {
   const res = await svc.available();
@@ -37323,11 +37542,17 @@ async function ensureProviderAvailable(svc, provider, host) {
 // src/modules/channel/commands/slack-connect.ts
 function buildSlackConnectCommand(deps) {
   return new Command("connect").description("Bind a Slack channel to an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").requiredOption("--channel-id <id>", "Slack channel id (e.g. C0123ABCD)").option(
+    "--mode <mode>",
+    "access mode: 'person-scoped' (default) or 'shared'"
+  ).option(
+    "--ambient",
+    "ambient mode (shared only): the agent reads along and may chime in without being mentioned"
+  ).option(
     "--server <url>",
     "override the configured server URL for this call"
   ).option("--json", "emit the updated ChannelConfig[] as JSON").addHelpText(
     "after",
-    "\nExamples:\n  dam channel slack connect my-agent --channel-id C0123ABCD\n"
+    "\nExamples:\n  dam channel slack connect my-agent --channel-id C0123ABCD\n  dam channel slack connect my-agent --channel-id C0123ABCD --mode shared\n  dam channel slack connect my-agent --channel-id C0123ABCD --mode shared --ambient\n"
   ).action(
     async (ref, opts) => {
       const channelId = opts.channelId.trim();
@@ -37335,6 +37560,17 @@ function buildSlackConnectCommand(deps) {
         process.stderr.write("error: --channel-id must not be empty\n");
         process.exit(EXIT_INVALID_INPUT);
       }
+      if (opts.mode !== void 0 && opts.mode !== "shared" && opts.mode !== "person-scoped") {
+        process.stderr.write(
+          "error: --mode must be 'shared' or 'person-scoped'\n"
+        );
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const mode = opts.mode;
+      if (opts.ambient && mode !== "shared") {
+        process.stderr.write("error: --ambient requires --mode shared\n");
+        process.exit(EXIT_INVALID_INPUT);
+      }
       const host = await resolveActiveHost(deps, {
         flag: opts.server ? { server: opts.server } : void 0,
         exitCodes: {
@@ -37352,7 +37588,12 @@ function buildSlackConnectCommand(deps) {
       }
       const svc = deps.createChannelService(host);
       await ensureProviderAvailable(svc, "slack" /* Slack */, host);
-      const res = await svc.connectSlack(resolved.value.id, channelId);
+      const res = await svc.connectSlack(
+        resolved.value.id,
+        channelId,
+        mode,
+        opts.ambient
+      );
       if (!res.ok) {
         if (res.error.kind === "channel-conflict") {
           process.stderr.write(
@@ -37368,17 +37609,54 @@ function buildSlackConnectCommand(deps) {
         printServiceError(res.error, host);
         process.exit(EXIT_RUNTIME_FAILURE);
       }
+      if (mode === "shared") {
+        const slackCh = res.value.find((c2) => c2.type === "slack" /* Slack */);
+        if (!slackCh || slackCh.mode !== "shared") {
+          const rolledBack = await svc.disconnectSlack(resolved.value.id);
+          if (rolledBack.ok) {
+            process.stderr.write(
+              "error: this server does not support shared access mode \u2014 binding rolled back\n"
+            );
+          } else {
+            process.stderr.write(
+              "error: this server does not support shared access mode, and rolling the binding back failed \u2014 the channel is still bound in person-scoped mode; disconnect it manually\n"
+            );
+            printServiceError(rolledBack.error, host);
+          }
+          process.exit(EXIT_RUNTIME_FAILURE);
+        }
+      }
+      if (opts.ambient) {
+        const slackCh = res.value.find((c2) => c2.type === "slack" /* Slack */);
+        if (slackCh?.type === "slack" /* Slack */ && !slackCh.ambient) {
+          process.stderr.write(
+            "error: this server does not support ambient mode \u2014 the channel is connected in shared mode without it\n"
+          );
+          process.exit(EXIT_RUNTIME_FAILURE);
+        }
+      }
       if (opts.json) {
         process.stdout.write(`${JSON.stringify(res.value)}
 `);
       } else {
         process.stdout.write(
-          `\u2713 Slack channel ${channelId} connected to ${resolved.value.name}.
+          `\u2713 Slack channel ${channelId} connected to ${resolved.value.name}${mode === "shared" ? opts.ambient ? " in shared mode with ambient on" : " in shared mode" : ""}.
 `
         );
-        process.stderr.write(
-          "hint: users must run `/platform login` inside Slack before they can drive this agent\n"
-        );
+        if (opts.ambient) {
+          process.stderr.write(
+            "note: the agent reads along in this channel and may chime in without being mentioned; the channel gets a visible notice\n"
+          );
+        }
+        if (mode === "shared") {
+          process.stderr.write(
+            "note: everyone in the channel drives this agent under its credentials; your Terms-of-Use acceptance covers every turn\n"
+          );
+        } else {
+          process.stderr.write(
+            "hint: users must run `/platform login` inside Slack before they can drive this agent\n"
+          );
+        }
       }
       process.exit(EXIT_SUCCESS);
     }
@@ -37430,131 +37708,19 @@ function buildSlackDisconnectCommand(deps) {
   });
 }
 
-// src/modules/channel/commands/telegram-connect.ts
-function buildTelegramConnectCommand(deps) {
-  return new Command("connect").description("Bind a Telegram bot to an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
-    "--bot-token <token>",
-    "bot token from @BotFather (prompted, masked, if omitted on a TTY)"
-  ).option(
-    "--server <url>",
-    "override the configured server URL for this call"
-  ).option("--json", "emit the updated ChannelConfig[] as JSON").addHelpText(
-    "after",
-    "\nExamples:\n  dam channel telegram connect my-agent\n  dam channel telegram connect my-agent --bot-token 123:ABC\n"
-  ).action(
-    async (ref, opts) => {
-      const host = await resolveActiveHost(deps, {
-        flag: opts.server ? { server: opts.server } : void 0,
-        exitCodes: {
-          runtimeFailure: EXIT_RUNTIME_FAILURE,
-          belowFloor: EXIT_BELOW_FLOOR
-        }
-      });
-      const resolver = createAgentResolver({
-        agentService: deps.createAgentService(host)
-      });
-      const resolved = await resolver.resolve(ref);
-      if (!resolved.ok) {
-        printResolveError(resolved.error, host);
-        process.exit(exitCodeForResolveError(resolved.error));
-      }
-      const token = await resolveToken(opts);
-      const svc = deps.createChannelService(host);
-      await ensureProviderAvailable(svc, "telegram" /* Telegram */, host);
-      const res = await svc.connectTelegram(resolved.value.id, token);
-      if (!res.ok) {
-        if (res.error.kind === "channel-precondition" || res.error.kind === "invalid-input") {
-          process.stderr.write(`error: ${res.error.message}
-`);
-          process.exit(EXIT_INVALID_INPUT);
-        }
-        printServiceError(res.error, host);
-        process.exit(EXIT_RUNTIME_FAILURE);
-      }
-      if (opts.json) {
-        process.stdout.write(`${JSON.stringify(res.value)}
-`);
-      } else {
-        process.stdout.write(
-          `\u2713 Telegram bot connected to ${resolved.value.name}.
-`
-        );
-      }
-      process.exit(EXIT_SUCCESS);
-    }
-  );
-}
-async function resolveToken(opts) {
-  const flag = opts.botToken?.trim();
-  if (flag) return flag;
-  if (!process.stdin.isTTY) {
-    process.stderr.write("error: --bot-token is required on a non-TTY\n");
-    process.exit(EXIT_INVALID_INPUT);
-  }
-  const answer = await Ce({
-    message: "Telegram bot token (from @BotFather)",
-    validate: (v2) => v2 && v2.trim().length > 0 ? void 0 : "Required"
-  });
-  if (q(answer)) exitCancelled({ json: opts.json });
-  return String(answer).trim();
-}
-
-// src/modules/channel/commands/telegram-disconnect.ts
-function buildTelegramDisconnectCommand(deps) {
-  return new Command("disconnect").description(
-    "Unbind an Agent's Telegram bot (deletes its k8s Secret). Idempotent \u2014 a not-connected agent exits 0."
-  ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
-    "--server <url>",
-    "override the configured server URL for this call"
-  ).option("--json", "emit the updated ChannelConfig[] as JSON").addHelpText(
-    "after",
-    "\nExamples:\n  dam channel telegram disconnect my-agent\n"
-  ).action(async (ref, opts) => {
-    const host = await resolveActiveHost(deps, {
-      flag: opts.server ? { server: opts.server } : void 0,
-      exitCodes: {
-        runtimeFailure: EXIT_RUNTIME_FAILURE,
-        belowFloor: EXIT_BELOW_FLOOR
-      }
-    });
-    const resolver = createAgentResolver({
-      agentService: deps.createAgentService(host)
-    });
-    const resolved = await resolver.resolve(ref);
-    if (!resolved.ok) {
-      printResolveError(resolved.error, host);
-      process.exit(exitCodeForResolveError(resolved.error));
-    }
-    const svc = deps.createChannelService(host);
-    const res = await svc.disconnectTelegram(resolved.value.id);
-    if (!res.ok) {
-      printServiceError(res.error, host);
-      process.exit(EXIT_RUNTIME_FAILURE);
-    }
-    if (opts.json) {
-      process.stdout.write(`${JSON.stringify(res.value)}
-`);
-    } else {
-      process.stdout.write(
-        `\u2713 Telegram disconnected from ${resolved.value.name}.
-`
-      );
-    }
-    process.exit(EXIT_SUCCESS);
-  });
-}
-
 // src/modules/channel/services/channel-service.ts
 function createChannelService(deps) {
   return {
     async available() {
       return trpcCall(() => deps.trpc.channels.available.query());
     },
-    async connectSlack(id, slackChannelId) {
+    async connectSlack(id, slackChannelId, mode, ambient) {
       try {
         const agent = await deps.trpc.agents.connectSlack.mutate({
           id,
-          slackChannelId
+          slackChannelId,
+          ...mode ? { mode } : {},
+          ...ambient ? { ambient: true } : {}
         });
         return ok2(agent.channels);
       } catch (e2) {
@@ -37574,29 +37740,6 @@ function createChannelService(deps) {
         const agent = await deps.trpc.agents.disconnectSlack.mutate({ id });
         return agent.channels;
       });
-    },
-    async connectTelegram(id, botToken) {
-      try {
-        const agent = await deps.trpc.agents.connectTelegram.mutate({
-          id,
-          botToken
-        });
-        return ok2(agent.channels);
-      } catch (e2) {
-        const code = e2?.data?.code;
-        const message = e2 instanceof Error ? e2.message : String(e2);
-        if (code === "PRECONDITION_FAILED")
-          return err2({ kind: "channel-precondition", message });
-        if (code === "BAD_REQUEST")
-          return err2({ kind: "invalid-input", message });
-        return classifyTrpcError(e2);
-      }
-    },
-    async disconnectTelegram(id) {
-      return trpcCall(async () => {
-        const agent = await deps.trpc.agents.disconnectTelegram.mutate({ id });
-        return agent.channels;
-      });
     }
   };
 }
@@ -37612,7 +37755,7 @@ function composeChannelModule(opts) {
     createChannelService: createService
   };
   const parent = new Command("channel").description(
-    "Manage messenger channel bindings (Slack, Telegram)"
+    "Manage messenger channel bindings (Telegram chats bind in-chat via /login)"
   );
   parent.addCommand(
     buildAvailableCommand({
@@ -37634,12 +37777,6 @@ function composeChannelModule(opts) {
   slack.addCommand(buildSlackConnectCommand(agentScoped));
   slack.addCommand(buildSlackDisconnectCommand(agentScoped));
   parent.addCommand(slack);
-  const telegram = new Command("telegram").description(
-    "Bind or unbind an Agent's Telegram bot"
-  );
-  telegram.addCommand(buildTelegramConnectCommand(agentScoped));
-  telegram.addCommand(buildTelegramDisconnectCommand(agentScoped));
-  parent.addCommand(telegram);
   const allowScoped = {
     compatService: opts.compatService,
     configService: opts.configService,
@@ -40174,7 +40311,7 @@ function createProcessEnvReader() {
 
 // src/modules/cli/infrastructure/package-version.ts
 function readPackageVersion() {
-  return true ? "0.2.7-rc1" : DEV_VERSION;
+  return true ? "0.2.8-rc1" : DEV_VERSION;
 }
 
 // src/modules/cli/infrastructure/version-probe.ts
@@ -40410,7 +40547,13 @@ function buildConnectCommand(deps) {
   ).option(
     "--audience <audience>",
     "input: OAuth audience (client credentials)"
-  ).option("--app-slug <slug>", "input: GitHub App slug").option("--header-name <name>", "input: header name").option("--value-format <format>", "input: header value format").option(
+  ).option("--app-slug <slug>", "input: GitHub App slug").option("--app-id <id>", "input: GitHub App ID (GitHub App installation)").option(
+    "--installation-id <id>",
+    "input: GitHub App installation ID (GitHub App installation)"
+  ).option(
+    "--private-key <pem>",
+    'input: GitHub App private key \u2014 PEM or base64; use --private-key "$(cat app.pem)" (GitHub App installation)'
+  ).option("--header-name <name>", "input: header name").option("--value-format <format>", "input: header value format").option(
     "--env-name <name>",
     "input: expose the credential to the agent as this env var (custom header credentials)"
   ).option("--value <value>", "input: header secret value").option(
@@ -40433,7 +40576,7 @@ function buildConnectCommand(deps) {
     String(DEFAULT_TIMEOUT_SECONDS3)
   ).addHelpText(
     "after",
-    "\nExamples:\n  dam connection connect github\n  dam connection connect github --client-id Iv1.\u2026 --client-secret \u2026  # use your own OAuth app\n  dam connection connect github --no-browser\n  dam connection connect my-api --header-name X-API-Key --value sk-\u2026\n  dam connection connect custom-client-credentials --host api.example.com \\\n      --issuer-url https://auth.example.com/realms/main --client-id \u2026 --client-secret \u2026\n  dam connection connect bob --value sk-\u2026 --config model=premium-shell --config chatMode=code\n  dam connection connect https://mcp.example.com\n  dam connection connect https://mcp.example.com --auth none\n"
+    '\nExamples:\n  dam connection connect github\n  dam connection connect github --client-id Iv1.\u2026 --client-secret \u2026  # use your own OAuth app\n  dam connection connect github --no-browser\n  dam connection connect my-api --header-name X-API-Key --value sk-\u2026\n  dam connection connect custom-client-credentials --host api.example.com \\\n      --issuer-url https://auth.example.com/realms/main --client-id \u2026 --client-secret \u2026\n  dam connection connect github-app --app-id 123456 --installation-id 987654 \\\n      --private-key "$(cat app.pem)"\n  dam connection connect bob --value sk-\u2026 --config model=premium-shell --config chatMode=code\n  dam connection connect https://mcp.example.com\n  dam connection connect https://mcp.example.com --auth none\n'
   ).action(async (providerOrUrl, opts) => {
     const json2 = opts.json ?? false;
     const timeoutSeconds = parseTimeout2(opts.timeout);
@@ -40655,8 +40798,9 @@ async function collectInputs(template, opts, json2) {
   }
   for (const input of missing) {
     const prompt = input.secret ? Ce : Re;
+    const label = input.label ?? labelFor(input.name);
     const answer = await prompt({
-      message: labelFor(input.name),
+      message: input.hint ? `${label} \u2014 ${input.hint}` : label,
       validate: (v2) => v2 && v2.trim().length > 0 ? void 0 : "Required"
     });
     if (q(answer)) exitCancelled({ json: json2 });
@@ -40695,6 +40839,25 @@ function buildPayload(template, name, values) {
         ...v2("valueFormat") ? { valueFormat: v2("valueFormat") } : {},
         ...v2("envName") ? { envName: v2("envName") } : {}
       };
+    case "github-app": {
+      const appId = v2("appId");
+      const installationId = v2("installationId");
+      const privateKey = v2("privateKey");
+      if (!appId) return { error: "the App ID is required (--app-id)" };
+      if (!installationId) {
+        return { error: "the installation ID is required (--installation-id)" };
+      }
+      if (!privateKey) {
+        return { error: "the private key is required (--private-key)" };
+      }
+      return {
+        ...common2,
+        authKind: "github-app",
+        appId,
+        installationId,
+        privateKey
+      };
+    }
     case "header": {
       const value = v2("value");
       if (!value) return { error: "the secret value is required (--value)" };
@@ -40817,6 +40980,9 @@ var FIELD_LABELS = {
   scopes: "Scopes (space-separated)",
   audience: "Audience",
   appSlug: "GitHub App slug",
+  appId: "GitHub App ID",
+  installationId: "GitHub App installation ID",
+  privateKey: "GitHub App private key (PEM)",
   envName: "Env var name",
   caData: "Cluster CA certificate"
 };
@@ -44230,6 +44396,12 @@ function createSkillsService(deps) {
           const message = e2.message.replace(/\nplatform-cta:\S+/, "").trim();
           return err2({ kind: "source-needs-connection", message, cta });
         }
+        if (e2?.data?.code === "FORBIDDEN") {
+          return err2({
+            kind: "source-needs-connection",
+            message: e2 instanceof Error ? e2.message : String(e2)
+          });
+        }
         return classifyWakeError(e2);
       }
     },
@@ -45159,6 +45331,248 @@ function composeTemplateModule(opts) {
   };
 }
 
+// src/modules/terms/commands/accept.ts
+function buildAcceptCommand(deps) {
+  return new Command("accept").description(
+    "Accept the current Terms of Use \u2014 interactive on a TTY, use --yes for CI/headless"
+  ).option(
+    "--yes",
+    "accept without the interactive confirmation (required on a non-TTY)"
+  ).option(
+    "--expect-version <version>",
+    "assert the version you reviewed; fails if it differs from the server's current version (not named --version, which is reserved for the CLI's own version)"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the acceptance result as JSON").action(
+    async (opts) => {
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      if (!opts.yes && !process.stdin.isTTY) {
+        process.stderr.write(
+          "error: refusing to accept the Terms of Use non-interactively without --yes\nhint: re-run with --yes to accept in a script or CI\n"
+        );
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      const service = deps.createTermsService(host);
+      const doc = await service.document();
+      if (!doc.ok) {
+        printServiceError(doc.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      const currentVersion = doc.value.version;
+      if (opts.expectVersion && opts.expectVersion !== currentVersion) {
+        process.stderr.write(
+          `error: reviewed version ${opts.expectVersion} does not match the server's current version ${currentVersion}; re-review before accepting
+`
+        );
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (!opts.yes) {
+        process.stderr.write(
+          `Terms of Use \u2014 version ${currentVersion}
+
+${doc.value.text}
+
+`
+        );
+        if (!await confirm("Accept the Terms of Use?", {
+          timeoutMs: 15 * 6e4
+        }))
+          exitCancelled({ json: opts.json });
+      }
+      const accepted = await service.accept(currentVersion);
+      if (!accepted.ok) {
+        if (accepted.error.kind === "transport" && accepted.error.serverCode === "PRECONDITION_FAILED") {
+          process.stderr.write(
+            "error: the Terms of Use changed while you were reviewing; re-run `dam terms accept` to review the current version\n"
+          );
+        } else {
+          printServiceError(accepted.error, host);
+        }
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (opts.json) {
+        return writeStdoutAndExit(
+          `${JSON.stringify({ accepted: true, version: currentVersion })}
+`,
+          EXIT_SUCCESS
+        );
+      }
+      return writeStdoutAndExit(
+        `Accepted Terms of Use ${currentVersion}.
+`,
+        EXIT_SUCCESS
+      );
+    }
+  );
+}
+
+// src/modules/terms/commands/show.ts
+function buildShowCommand(deps) {
+  return new Command("show").description(
+    "Print the current Terms of Use text, version, and your acceptance state"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the raw Terms of Use document as JSON").action(async (opts) => {
+    const host = await resolveActiveHost(deps, {
+      flag: opts.server ? { server: opts.server } : void 0,
+      exitCodes: {
+        runtimeFailure: EXIT_RUNTIME_FAILURE,
+        belowFloor: EXIT_BELOW_FLOOR
+      }
+    });
+    const service = deps.createTermsService(host);
+    const [doc, latest] = await Promise.all([
+      service.document(),
+      service.latestAcceptance()
+    ]);
+    if (!doc.ok) {
+      printServiceError(doc.error, host);
+      process.exit(EXIT_RUNTIME_FAILURE);
+    }
+    if (!latest.ok) {
+      printServiceError(latest.error, host);
+      process.exit(EXIT_RUNTIME_FAILURE);
+    }
+    if (opts.json) {
+      return writeStdoutAndExit(
+        `${JSON.stringify(doc.value)}
+`,
+        EXIT_SUCCESS
+      );
+    }
+    const acceptState = !latest.value ? "Not accepted." : latest.value.version === doc.value.version ? `Accepted on ${new Date(latest.value.acceptedAt).toISOString()}.` : `You accepted version ${latest.value.version}; version ${doc.value.version} is current and not yet accepted.`;
+    return writeStdoutAndExit(
+      `Terms of Use \u2014 version ${doc.value.version}
+${acceptState}
+
+${doc.value.text}
+`,
+      EXIT_SUCCESS
+    );
+  });
+}
+
+// src/modules/terms/commands/status.ts
+function buildStatusCommand2(deps) {
+  return new Command("status").description(
+    "Check whether you've accepted the current Terms of Use \u2014 no text dump; exits non-zero when not accepted, so it works as a CI gate"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the acceptance state as JSON").action(async (opts) => {
+    const host = await resolveActiveHost(deps, {
+      flag: opts.server ? { server: opts.server } : void 0,
+      exitCodes: {
+        runtimeFailure: EXIT_RUNTIME_FAILURE,
+        belowFloor: EXIT_BELOW_FLOOR
+      }
+    });
+    const service = deps.createTermsService(host);
+    const [current, latest] = await Promise.all([
+      service.current(),
+      service.latestAcceptance()
+    ]);
+    if (!current.ok) {
+      printServiceError(current.error, host);
+      process.exit(EXIT_RUNTIME_FAILURE);
+    }
+    if (!latest.ok) {
+      printServiceError(latest.error, host);
+      process.exit(EXIT_RUNTIME_FAILURE);
+    }
+    const acceptedVersion = latest.value?.version ?? null;
+    const accepted = acceptedVersion === current.value.version;
+    const exitCode = accepted ? EXIT_SUCCESS : EXIT_TERMS_NOT_ACCEPTED;
+    if (opts.json) {
+      return writeStdoutAndExit(
+        `${JSON.stringify({ currentVersion: current.value.version, acceptedVersion, accepted })}
+`,
+        exitCode
+      );
+    }
+    const line = accepted ? `Terms of Use ${current.value.version}: accepted.` : acceptedVersion ? `Terms of Use ${current.value.version}: NOT accepted (you accepted ${acceptedVersion}).` : `Terms of Use ${current.value.version}: NOT accepted (no acceptance on record).`;
+    return writeStdoutAndExit(`${line}
+`, exitCode);
+  });
+}
+
+// src/modules/terms/services/terms-service.ts
+function createTermsService(deps) {
+  const doFetch = deps.fetch ?? fetch;
+  const base = deps.host.replace(/\/+$/, "");
+  return {
+    async document() {
+      let res;
+      try {
+        res = await doFetch(`${base}/api/terms`);
+      } catch (e2) {
+        return err2({
+          kind: "transport",
+          reason: e2 instanceof Error ? e2.message : "cannot reach server"
+        });
+      }
+      if (!res.ok)
+        return err2({
+          kind: "transport",
+          reason: `GET /api/terms returned ${res.status}`
+        });
+      let body;
+      try {
+        body = await res.json();
+      } catch {
+        return err2({
+          kind: "transport",
+          reason: "malformed Terms of Use document from server"
+        });
+      }
+      const parsed = termsDocumentSchema.safeParse(body);
+      if (!parsed.success)
+        return err2({
+          kind: "transport",
+          reason: "malformed Terms of Use document from server"
+        });
+      return ok2(parsed.data);
+    },
+    async current() {
+      return trpcCall(() => deps.trpc.terms.current.query());
+    },
+    async latestAcceptance() {
+      return trpcCall(() => deps.trpc.terms.latestAcceptance.query());
+    },
+    async accept(version2) {
+      return trpcCall(() => deps.trpc.terms.accept.mutate({ version: version2 }));
+    }
+  };
+}
+
+// src/modules/terms/compose.ts
+function composeTermsModule(opts) {
+  const createService = (host) => createTermsService({
+    trpc: createTrpcClient({ host, tokenProvider: opts.tokenProvider }),
+    host
+  });
+  const scoped = {
+    compatService: opts.compatService,
+    configService: opts.configService,
+    createTermsService: createService
+  };
+  const parent = new Command("terms").description(
+    "View and accept the deployment's Terms of Use"
+  );
+  parent.addCommand(buildShowCommand(scoped));
+  parent.addCommand(buildStatusCommand2(scoped));
+  parent.addCommand(buildAcceptCommand(scoped));
+  return { commands: [parent] };
+}
+
 // src/compose.ts
 function compose(opts = {}) {
   const cli = composeCliModule({ configPath: opts.configPath });
@@ -45251,6 +45665,11 @@ function compose(opts = {}) {
     compatService: cli.services.compatService,
     createAgentService: agent.exports.createService
   });
+  const terms = composeTermsModule({
+    tokenProvider: auth.exports.tokenProvider,
+    configService: cli.services.configService,
+    compatService: cli.services.compatService
+  });
   const program3 = new Command();
   program3.name("dam").description("Command-line client for a Platform deployment").version(cli.cliVersion);
   for (const command of cli.commands) program3.addCommand(command);
@@ -45268,6 +45687,7 @@ function compose(opts = {}) {
   for (const command of ssh.commands) program3.addCommand(command);
   for (const command of channel.commands) program3.addCommand(command);
   for (const command of metrics.commands) program3.addCommand(command);
+  for (const command of terms.commands) program3.addCommand(command);
   return program3;
 }
 
@@ -45278,9 +45698,7 @@ try {
 } catch (err3) {
   if (err3 instanceof TermsStaleAtTransportError) {
     process.stderr.write(
-      `error: Terms of Use acceptance required
-hint: open ${err3.host} to accept
-`
+      "error: Terms of Use acceptance required\nhint: run `dam terms accept` to review and accept\n"
     );
     process.exit(1);
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dam-agents/cli",
   "author": "IBM Corp.",
-  "version": "0.2.7-rc1",
+  "version": "0.2.8-rc1",
   "type": "module",
   "license": "Apache-2.0",
   "homepage": "https://github.com/dam-agents/dam/tree/main/packages/cli#readme",
@@ -43,8 +43,8 @@
     "vitest": "^4.1.3",
     "ws": "^8.20.0",
     "zod": "^4.4.3",
-    "agent-runtime-api": "0.0.1",
+    "api-server-api": "0.0.1",
     "dev-config": "0.0.1",
-    "api-server-api": "0.0.1"
+    "agent-runtime-api": "0.0.1"
   }
 }