@datarails-ai/dr-cli 1.6.112 → 1.6.114

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.112",
+  "cliVersion": "1.6.114",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -1923,6 +1923,66 @@
         "until": "DR-53511"
       }
     },
+    "connectors poll enable": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll set": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll disable": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll get": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll run": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll resume": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll items": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll retry": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll skip": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll seed": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
     "filebox list": {
       "requires": [
         {
@@ -2055,6 +2115,14 @@
         }
       ]
     },
+    "filebox set-version-label": {
+      "requires": [
+        {
+          "resource": "fileboxes",
+          "action": "write"
+        }
+      ]
+    },
     "filebox set-version-workflow": {
       "requires": [
         {

package/dist/skills/dr-cli/SKILL.md

@@ -282,7 +282,7 @@ area's gotchas.
 
 **Fileboxes & documents** → [reference/filebox-documents.md](reference/filebox-documents.md)
 - `filebox list|get|versions|tags|sheets|preview|create|upload|upload-version|update|download` (alias `fileboxes`)
-- `filebox archive|archive-version|restore-version|set-version-include|set-version-date-tag|set-version-workflow|set-version-file-status|set-version-cycle`
+- `filebox archive|archive-version|restore-version|set-version-include|set-version-date-tag|set-version-label|set-version-workflow|set-version-file-status|set-version-cycle`
   - _archived versions (opt-in; defaults unchanged): `versions --archived|--all` to discover them; `archive-version`/`restore-version` also take `--doc` + `--version-number <n>` or `--latest-archived`/`--latest-active`_
   - _include in database: `versions --included` lists the versions whose `include_file` flag is on (intent, not delivered rows); `set-version-include <vid> --include on|off` writes the flag (two-step confirm both ways — off deletes the version's table rows, on queues an ETL scan). `--doc <id> --all-except-latest` is the bulk cleanup; it never targets the latest, and warns in the plan if the latest is itself excluded_
 - `filebox share|shares|set-option|set-tag-config|set-parent|lock|unlock|lock-date-tag|unlock-date-tag|locked-date-tags`

package/dist/skills/dr-cli/reference/admin.md

@@ -661,6 +661,29 @@ is `export delete`.
 - `devices request-logs <id>…`, `devices download-logs`,
   `devices command-delete <cmd_id>` (two-step confirm-token flow).
 
+**Clearing a backed-up sync-service queue: delete it as one batch, never one id
+at a time.** `devices command-delete` takes several ids
+(`command-delete 101 102 103`), or the machine's whole WAITING queue with
+`--machine <machine_id> --all-queued`. Add `--data-query <id>` to clear only one
+filebox's commands. Either way it is one plan, one token and, on prod, **one**
+word gate for the whole set (Tier A, `badge-command-batch|delete`). The plan
+lists every command (action, status, data query, update time), and that list is
+the blast-radius check. With explicit ids the token is bound to the exact id
+set. With `--all-queued` the plan saves the exact list it showed to a local
+plan file and prints its confirm command with `--plan <plan id>`. The token is
+bound to that plan, and the confirm deletes exactly those commands, never one
+the plan did not list. Commands queued after the plan are left alone, so a
+device that keeps queueing work does not block the confirm. Paste the printed
+confirm command as is, on the same computer and within the 10-minute token
+life; a confirm without `--plan` is refused, and a plan is spent once its
+confirm runs. Plans are kept in the per-user config directory, next to the
+confirm secret. Every planned command gets a DELETE; one the device has already
+run answers 404, is reported as "already gone" and does not fail the run.
+With explicit ids a 404 counts as a failure, because it may be a mistyped id.
+`--machine` with explicit ids only adds each command's details to the plan.
+`devices commands <machine_id>` lists the same WAITING backlog `--all-queued`
+targets.
+
 ## Feature flags (IT)
 
 - `features list`, `features groups list`, `features groups get`,

package/dist/skills/dr-cli/reference/filebox-documents.md

@@ -6,7 +6,9 @@
 `filebox sheets`, `filebox preview`, `filebox shares <doc_id>` (current user +
 group shares). Names are HTML-decoded before render.
 
-`filebox versions <doc_id>` lists **active** versions by default (unchanged).
+`filebox versions <doc_id>` lists **active** versions by default (unchanged);
+the table includes each version's `LABEL` (blank when unset; control characters
+show as escapes such as `\n`).
 To see archived (auto_save) versions, pass `--archived` (archived only) or
 `--all` (active + archived); both add an `ARCHIVED` column. This is the only
 way to discover an archived version's id from the CLI — archived rows are
@@ -33,7 +35,10 @@ set-version-include` (below).
 - `filebox upload-version <id>` — push a new version. Accepts `--date <date>
   --scenario <name>` to validate-then-tag at upload time in one call (planning
   fileboxes — same validation and read-back confirmation as
-  `set-version-cycle`).
+  `set-version-cycle`). `--label <text>` labels the new version after the upload
+  and any cycle tag (validated first, so a bad label uploads nothing). If the
+  label write fails the command exits non-zero naming the new version id, and
+  `--json` reports `label_error` instead of `label`.
 - `filebox download` — download document content.
 
 ## Filebox — update / config
@@ -114,6 +119,17 @@ set-version-include` (below).
 - `filebox set-version-date-tag <vid> --doc <id> --month|--quarter|--day|--year|--week …
   [--json]` — set the date tag on one version (resolves the tag id from the doc's
   config; other tags untouched).
+- `filebox set-version-label <vid> --label "<text>" | --clear [--json]` — set or
+  remove a version's free-text label; name, date and dimension tags are
+  untouched, and a locked date tag does not block it. No confirm step. Address it
+  like `archive-version` (global id, or `--doc <doc_id>` with `--version-number
+  <n>` / `--latest-active`; a tie on the highest number is refused — pass the
+  global id). The version is loaded first, so a bad id fails without writing,
+  and the label is read back after the write. `--json` returns `version_id`,
+  `doc_id`, `version`, `label` and `previous_label`. At most 256 characters, no
+  control characters, and not `auto-calculated` (reserved by the server for
+  versions it generates); pass the label as one quoted argument. Needs change
+  rights on the filebox or to be the version's uploader (HTTP 405 otherwise).
 - `filebox set-version-workflow <vid> --doc <id> --status <Not Started|In Progress|Pending|Approved|Rejected>`
   — set the workflow LIST-tag value (setting `Approved` requires `approve_workflow`).
 - `filebox set-version-file-status <vid> --doc <id> --status <Draft|Final> [--json]`

package/dist/skills/dr-cli/reference/safety.md

@@ -66,7 +66,10 @@ user names `import` and confirms the loss of hits/thumbs analytics and the id
 reassignment. Never reach for it on your own initiative. `error-enrichments
 delete` takes several ids at once and spends **one** word gate on the whole
 batch, so the plan output — which lists every targeted rule with its hits and
-feedback — is the blast-radius check; read it per-rule, not as a count. Batch
+feedback — is the blast-radius check; read it per-rule, not as a count.
+`devices command-delete` works the same way. It takes several ids, or
+`--machine <machine_id> --all-queued` for a device's whole WAITING queue, with
+one word gate for the whole set. The plan lists every command it will delete. Batch
 writes (`create`/`update`/`delete` with several targets) run sequentially and
 keep going after a per-item failure, then exit non-zero: the per-item summary
 table, not the exit code, is what says which ids actually landed. The two pushes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.112",
+  "version": "1.6.114",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {