@datarails-ai/dr-cli 1.6.151 → 1.6.153

package/README.md

@@ -149,7 +149,14 @@ dr whoami --server US        # sanity-check identity
 
 Browser opens, you complete the OAuth device-code flow, and credentials
 are stored in the **OS keychain** — Windows Credential Manager on
-Windows, Keychain on macOS. Each session is keyed by
+Windows, Keychain on macOS, the kernel keyring or Secret Service on Linux.
+On a Linux host where that keyring cannot be reached — typically a process
+whose session keyring was revoked because the SSH login that started its
+IDE daemon or tmux server has ended — `dr` keeps the same entries as
+owner-only files under `~/.dr/keyring/` instead, and says so once per
+command. `DR_KEYRING_BACKEND=file` uses that directory without the notice;
+`DR_KEYRING_BACKEND=native` requires the keyring. The two stores do not
+share entries, so moving between them means logging in again. Each session is keyed by
 `(server, email)` so you can log in to multiple servers concurrently,
 and to multiple Datarails accounts on the same server.
 
@@ -449,6 +456,7 @@ dr skill print <name>     # print an embedded skill's SKILL.md
 | MEC Workflows v2     | `mec workflow list/get/create/update/activate/deactivate/archive/restore/delete/clone`, `mec workflow process list/get/delete`, `mec workflow step get/create/update/delete/reorder`, `mec workflow task list/get/add-file/add-checklist/update/update-one/delete/notify/approve/reject/sign-off` (file + checklist + `reconciliation_tags`), `mec workflow member list/check/add/update/remove/grant-bulk`, `mec workflow group list/add/update/remove/grant-bulk`, `mec workflow periods`, `mec workflow accounts tasks --date-tag <ts> --account-name <s> --account-group <s>`, `mec workflow accounts task-statuses --date-tag <ts>` (tenant must have `month_end_close`; type `"Month End Close"` enforced) |
 | Desk                 | `desk teams list`, `desk support-email set <team> <email>`, `desk smtp set/rotate/get/test <team>`, `desk sendgrid register <domain>/status/verify`, `desk ticket create <team> --title --requester-email [--attach <path> ...] [--no-thread]` (`<team>` is an id, support email, or team name. `ticket create` **emails the requester**, so it is confirm-gated and keeps the word gate on prod — see `docs/how-to-create-a-desk-ticket.md`)                                                                                                                                                                                                                                                                    |
 | Connectors           | `connectors publish <dataqueryFile>`, `connectors query repoint <queryId>`, `connectors binding get <fileboxUuid>` (drives the connectors control-plane over VPN)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Agent Studio         | `agents list/get/versions/test-link/refresh/pull/update/create/mcp-servers/cli-scopes/scope-registry`, `agents set-listed/set-global/set-visibility/archive` (two-step confirm), `agents models/catalog/system-entities`, `agents skills list/get/versions/bundle/pull/create/publish/delete` (`delete` two-step confirm). A CLI-exposed agent's `dr` sessions are capped by its CLI scopes (`resource:action`, default `*:read`): set with `update --cli-scopes <list>` / `--reset-cli-scopes [--cli-scopes-reason <text>]` or `create --expose-cli --cli-scopes <list>`, read with `cli-scopes`; the scope history and restore stay in the Backoffice (service-token only)                                     |
 | Skill                | `skill` — prints embedded `SKILL.md`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 ### Connectors: TLS over VPN
@@ -526,7 +534,7 @@ endpoints against its ceiling in `scopes-map.snapshot.json` is what DR-53487 may
   placeholder takes an integer.
 - **`service`.** Which service serves the path: `monolith`, `finance-os`,
   `spend-control`, `multi-product`, `desk`, `connectors`, `onboarding-validation`,
-  `business-calendar`. A consumer checking one service filters on it.
+  `business-calendar`, `ai-service`. A consumer checking one service filters on it.
 - **`command: "*"`.** A call any authenticated command may trigger (JWT mint/refresh,
   API-key and login-as re-exchange).
 - **Leaves with no record** are explained in `scripts/scopes-map.sources.json` under
@@ -604,6 +612,7 @@ The services `dr-cli` talks to:
 | Multi-Product              | `dr multi-product …` (`/api/multi-product/v1`) — separate microservice, monolith host                                                                                                                                                                                                                             | [`dr-multi-product`](https://github.com/Datarails/dr-multi-product)                       |
 | Desk                       | `dr desk …` (`/api/desk/v1/…`) — separate microservice, monolith host. One exception: `desk support-email set` writes to the MONOLITH's `/bo/teams/<id>/`, because that is where `support_email` lives                                                                                                            | [`dr-desk-ai`](https://github.com/Datarails/dr-desk-ai)                                   |
 | Connectors control-plane   | `dr connectors …` (reached over the corporate VPN)                                                                                                                                                                                                                                                                | [`dr-connectors-control-plane`](https://github.com/Datarails/dr-connectors-control-plane) |
+| AI service                 | `dr agents …` (`/ai-service/external/v1/ManagedAgents/…`) — dr-ai-service's Agent Studio API on the monolith host. It refuses the `dr` login JWT, so each call carries a token the monolith mints (`POST /api/ai-service/v1/Authentication/authenticate`)                                                         | [`dr-ai-service`](https://github.com/Datarails/dr-ai-service)                             |
 | Onboarding-validation      | `dr validate onboarding …` (its own host, `<env>-onboarding.datarails.com`)                                                                                                                                                                                                                                       | [`dr-onboarding-validation-re`](https://github.com/Datarails/dr-onboarding-validation-re) |
 
 > Not sure which service a command hits? Run it with `--json` and check the