@datarails-ai/dr-cli 1.6.180 → 1.6.182

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.180",
+  "cliVersion": "1.6.182",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -4089,6 +4089,38 @@
         }
       ]
     },
+    "calcmodels agent ask": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "write"
+        }
+      ]
+    },
+    "calcmodels agent preview": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "read"
+        }
+      ]
+    },
+    "calcmodels agent save": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "write"
+        }
+      ]
+    },
+    "calcmodels agent approve": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "destructive"
+        }
+      ]
+    },
     "calc-vals list": {
       "requires": [
         {

package/dist/skills/dr-cli/SKILL.md

@@ -233,6 +233,7 @@ area's gotchas.
 
 **Calc models** → [reference/calcmodels.md](reference/calcmodels.md)
 - `calcmodels list|get|create|update|set-flow|recalculate|delete` (alias `calc-models`)
+- `calcmodels agent ask|preview|save|approve` — build an AGENT (allocation) model with the builder agent; `approve` is Tier A
 
 **Calculated values (per-table)** → [reference/calc-vals.md](reference/calc-vals.md)
 - `calc-vals list|get|create|update|delete` (alias `calcvals`) — `--table <id>` required on every subcommand

package/dist/skills/dr-cli/reference/calcmodels.md

@@ -69,6 +69,60 @@ names to integer IDs against the tenant — never ask the operator for IDs:
 For `update`: `dr calcmodels get <id> --server <S> --json` → splice the requested
 change → write to a tmpfile → `dr calcmodels update <id> --file <tmpfile> --server <S>`.
 
+## AGENT models (builder)
+
+An AGENT model is an allocation model that the calc model builder's agent writes
+from plain English. `dr calcmodels agent` uses the web builder's endpoints. The
+server allows it only for a Super Admin, on an org with the
+`calc_model_agent_builder` flag, inside a per-org cap on running turns. The CLI
+does not check these; it prints the server's 403 or 429. `create`/`update` above
+are for the three older types only.
+
+Flow:
+
+1. `dr calcmodels agent ask "<what to build>" --server <S>` — one turn. It
+   prints the operation id at once, then waits (3 s polls, default 900 s,
+   `--timeout <s>`). Ctrl-C or the timeout stop the wait only; read the turn
+   later with `dr calcmodels agent preview <operation_id> --server <S>`.
+2. Read the outcome by `status`:
+   - `NO_PROPOSAL` — the agent asks a question. Ask the operator. Do not answer
+     it yourself. Then `dr calcmodels agent ask "<reply>" --conversation <id> --server <S>`,
+     with the conversation id the answer printed.
+   - `SUCCEEDED` — a proposal and its preview: rows, coverage (allocated of
+     pool), balance groups, warnings. Show these to the operator. To change it,
+     reply in the same conversation. "preview: none ran" means it cannot be saved.
+   - `FAILED` — exits non-zero with the gate code, phase and suggestion.
+3. `dr calcmodels agent save <operation_id> [--name <n>] --server <S>` — saves a
+   DRAFT. The name defaults to the agent's proposed name. The new version
+   does not run until it is approved. `--model <id>` adds the turn as a new
+   version of that AGENT model; an active model keeps running its current
+   version until then.
+4. `dr calcmodels agent approve <id> --server <S>` — two-step. The plan prints
+   the version and its impact (rows the first run writes, allocated total,
+   pool total, coverage). Show it to the operator and stop. Run the printed
+   command (`--version-id <n> --confirm-token <t>`) only after the operator
+   gives a clear in-chat "yes" to that version and impact, on every server.
+   Approving activates the version and starts its first production run at once.
+
+Gotchas:
+
+- `approve` is Tier A (see safety.md). On a production server the token run
+  also opens a dialog or terminal prompt where the person types a word; with
+  no interactive channel the binary refuses. On a non-production server the
+  token alone activates, so the operator's in-chat "yes" is the only check.
+- `save` never activates, and `ask`/`save` write no rows to the destination
+  table. Only `approve` starts a run that does.
+- A newer version saved after the plan stops the token run before anything is
+  activated ("a newer version … was saved"). Re-run `approve` without the
+  token and show the new impact.
+- `CALC_PREVIEW_ALREADY_SAVED`: that turn is already model N. The error
+  prints the `save … --model N` command for a new version.
+- `CALC_TURN_RATE_LIMITED` (429): the org has too many running turns. Wait.
+  A 409 means a turn already runs on this conversation.
+- Only the user who started a turn can read or continue it (404 otherwise).
+- Out of scope: opening a saved model's definition for edit (no server read
+  endpoint), archiving AGENT models.
+
 ## Customer-facing docs (KB)
 
 Help Center → **"Getting Data into Datarails"** → Data Management. Find current articles with `dr kb search "calc model beginning balance"` (or

package/dist/skills/dr-cli/reference/safety.md

@@ -21,6 +21,7 @@ Gated commands include: `dashboards delete`, `datamappers delete`,
 `dynamic-ranges delete`, `extables delete`, `functions delete`, `lut delete`,
 `reports delete`, `storyboards delete`, `metrics delete`, `metrics categories
 delete`, `metrics dimensions delete`, `calcmodels delete|set-flow|recalculate`,
+`calcmodels agent approve`,
 `reconciliation filebox delete`, `integrations delete`, `integrations it
 delete`, `devices command-delete`, `validate onboarding session delete`,
 `widgets delete`, `cash rules delete|delete-all|reorder|update`,
@@ -67,6 +68,9 @@ organization at once);
 `agents pin` / `unpin` (decide which agent version customers get on a server; one
 run with `--production` covers every production server, so relay the plan's
 per-server lines — they are also the undo);
+`calcmodels agent approve` (activates an AGENT calc model and starts its first
+production run, which writes new rows; the token is bound to the version whose
+impact the plan printed);
 `error-enrichments import` (replaces every rule on the server, zeroes all
 hits/feedback counters, and reassigns every rule id); and
 `dashboards push --override` / `filebox push --override`. `import` is **not** an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.180",
+  "version": "1.6.182",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.57",
+    "@datarails-ai/dr-appspace-cli": "0.12.58",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",