@datarails-ai/dr-cli 1.6.112 → 1.6.113

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.112",
+  "cliVersion": "1.6.113",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/dr-cli/reference/admin.md

@@ -661,6 +661,29 @@ is `export delete`.
 - `devices request-logs <id>…`, `devices download-logs`,
   `devices command-delete <cmd_id>` (two-step confirm-token flow).
 
+**Clearing a backed-up sync-service queue: delete it as one batch, never one id
+at a time.** `devices command-delete` takes several ids
+(`command-delete 101 102 103`), or the machine's whole WAITING queue with
+`--machine <machine_id> --all-queued`. Add `--data-query <id>` to clear only one
+filebox's commands. Either way it is one plan, one token and, on prod, **one**
+word gate for the whole set (Tier A, `badge-command-batch|delete`). The plan
+lists every command (action, status, data query, update time), and that list is
+the blast-radius check. With explicit ids the token is bound to the exact id
+set. With `--all-queued` the plan saves the exact list it showed to a local
+plan file and prints its confirm command with `--plan <plan id>`. The token is
+bound to that plan, and the confirm deletes exactly those commands, never one
+the plan did not list. Commands queued after the plan are left alone, so a
+device that keeps queueing work does not block the confirm. Paste the printed
+confirm command as is, on the same computer and within the 10-minute token
+life; a confirm without `--plan` is refused, and a plan is spent once its
+confirm runs. Plans are kept in the per-user config directory, next to the
+confirm secret. Every planned command gets a DELETE; one the device has already
+run answers 404, is reported as "already gone" and does not fail the run.
+With explicit ids a 404 counts as a failure, because it may be a mistyped id.
+`--machine` with explicit ids only adds each command's details to the plan.
+`devices commands <machine_id>` lists the same WAITING backlog `--all-queued`
+targets.
+
 ## Feature flags (IT)
 
 - `features list`, `features groups list`, `features groups get`,

package/dist/skills/dr-cli/reference/safety.md

@@ -66,7 +66,10 @@ user names `import` and confirms the loss of hits/thumbs analytics and the id
 reassignment. Never reach for it on your own initiative. `error-enrichments
 delete` takes several ids at once and spends **one** word gate on the whole
 batch, so the plan output — which lists every targeted rule with its hits and
-feedback — is the blast-radius check; read it per-rule, not as a count. Batch
+feedback — is the blast-radius check; read it per-rule, not as a count.
+`devices command-delete` works the same way. It takes several ids, or
+`--machine <machine_id> --all-queued` for a device's whole WAITING queue, with
+one word gate for the whole set. The plan lists every command it will delete. Batch
 writes (`create`/`update`/`delete` with several targets) run sequentially and
 keep going after a per-item failure, then exit non-zero: the per-item summary
 table, not the exit code, is what says which ids actually landed. The two pushes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.112",
+  "version": "1.6.113",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {