@datarails-ai/dr-cli 1.6.186 → 1.6.188

package/README.md

@@ -332,9 +332,9 @@ are covered); a missing `--server`, or a missing `--account` in customer mode;
 `--user-id`); a host override (`--app-space-host`, `DR_APP_SPACE_HOST`,
 `--connectors-url`); in org mode, any command the scopes map does not prove
 read-only, plus the few read-scoped commands with side effects
-(`devices request-logs`, `desk smtp test`, `dashboards prepare`,
-`storyboards prepare`). A pin that is set but malformed refuses every command
-(`--help` and `--version` still print). A refusal exits 3, like a scope denial.
+(`devices request-logs`, `desk smtp test`, `dashboards prepare`). A pin that is
+set but malformed refuses every command (`--help` and `--version` still print).
+A refusal exits 3, like a scope denial.
 
 ### API keys (headless and CI)
 
@@ -465,6 +465,7 @@ dr skill print <name>     # print an embedded skill's SKILL.md
 | Connectors           | `connectors publish <dataqueryFile>`, `connectors query repoint <queryId>`, `connectors binding get <fileboxUuid>` (drives the connectors control-plane over VPN)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | Agent Studio         | `agents list/get/versions/test-link/refresh/pull/update/create/mcp-servers/cli-scopes/scope-registry`, `agents set-listed/set-global/set-visibility/archive` (two-step confirm), `agents models/catalog/system-entities`, `agents skills list/get/versions/bundle/pull/create/publish/delete` (`delete` two-step confirm). A CLI-exposed agent's `dr` sessions are capped by its CLI scopes (`resource:action`, default `*:read`): set with `update --cli-scopes <list>` / `--reset-cli-scopes [--cli-scopes-reason <text>]` or `create --expose-cli --cli-scopes <list>`, read with `cli-scopes`; the scope history and restore stay in the Backoffice (service-token only)                                     |
 | Agent release pins   | `agents served`, `agents pin/unpin` (two-step confirm): the version each deployment serves; `--server`, `--servers <keys>` or `--production`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| Agent schedules      | `agents schedules list/create/update/delete` (`delete` two-step confirm): ai-service cron runs of a managed agent, as the session user. `--agent-id` defaults to the token's `agent_id` claim. Like every `agents` command, an agent needs `managed-agents:write` in its CLI scopes (`managed-agents:destructive` for `delete`): `agents update --id <agentId> --cli-scopes '*:read,managed-agents:write,managed-agents:destructive'`                                                                                                                                                                                                                                                                            |
 | Skill                | `skill` — prints embedded `SKILL.md`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 ### Connectors: TLS over VPN

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.186",
+  version: "1.6.188",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.12.61",
+    "@datarails-ai/dr-appspace-cli": "0.12.62",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-11-02T07:19:02.800Z";
+var BUILD_TIME = "2026-11-02T15:33:34.634Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -4390,7 +4390,11 @@ var PROD_GATE_TIER_B = /* @__PURE__ */ new Set([
   "template-library|update",
   "template-library|unpublish",
   "template-library|archive",
-  "template-library|restore"
+  "template-library|restore",
+  // agent schedules (dr agents schedules delete). One org row; the plan prints its cron,
+  // timezone, agent, prompt and run-as user, and `dr agents schedules create` with them
+  // restores it (running as the re-creator: create cannot set the run-as user).
+  "managed-agent-schedule|delete"
 ]);
 var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // workflow / mec — soft-delete + cascade deletes. `archive` also covers the
@@ -5211,8 +5215,7 @@ var ORG_MODE_UNSCOPED_ALLOWED = /* @__PURE__ */ new Set([
 var ORG_MODE_READ_SCOPED_REFUSED = /* @__PURE__ */ new Set([
   "devices request-logs",
   "desk smtp test",
-  "dashboards prepare",
-  "storyboards prepare"
+  "dashboards prepare"
 ]);
 var LOCAL_COMMANDS_WITH_TARGET_FLAGS = /* @__PURE__ */ new Set([
   "app-space scaffold"
@@ -55679,9 +55682,9 @@ async function listTemplates(client, params, options) {
   );
   return out ?? [];
 }
-async function getTemplate(client, id, options) {
+async function getTemplate(client, id, options, params) {
   const out = await client.getJSON(
-    `/api/processes/v2/process_templates/${id}`,
+    `/api/processes/v2/process_templates/${id}${buildQueryString(params)}`,
     options
   );
   if (out === null) {
@@ -55700,9 +55703,9 @@ async function createTemplate(client, payload, options) {
   }
   return out;
 }
-async function updateTemplate(client, id, payload, options) {
+async function updateTemplate(client, id, payload, options, params) {
   const out = await client.putJSON(
-    `/api/processes/v2/process_templates/${id}`,
+    `/api/processes/v2/process_templates/${id}${buildQueryString(params)}`,
     payload,
     options
   );
@@ -57168,6 +57171,10 @@ function validateTagsArray2(raw2) {
 }
 
 // src/commands/mecWorkflow.ts
+var MEC_DETAIL = { only_mec: true };
+function getMecTemplate(client, id, signal, params = {}) {
+  return getTemplate(client, id, { signal }, { ...params, ...MEC_DETAIL });
+}
 function dash6(s) {
   if (s === null || s === void 0) return "-";
   if (typeof s === "number") return String(s);
@@ -57303,7 +57310,7 @@ function renderMecWorkflowList(out, rows) {
 }
 async function runMecWorkflowGet(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
-  const tmpl = await withMec(() => getTemplate(cfg.client, cfg.id, { signal: cfg.signal }));
+  const tmpl = await withMec(() => getMecTemplate(cfg.client, cfg.id, cfg.signal));
   if (cfg.asJson) {
     writeJSONIndented(cfg.out, tmpl);
     return;
@@ -57788,9 +57795,7 @@ async function runMecWorkflowUpdate(cfg) {
     server: cfg.serverFlag,
     confirmCmd: `dr mec workflow update ${cfg.id} --file ${cfg.payloadFile} --server ${cfg.serverFlag}`,
     describe: async () => {
-      const current = await withMec(
-        () => getTemplate(cfg.client, cfg.id, { signal: cfg.signal })
-      );
+      const current = await withMec(() => getMecTemplate(cfg.client, cfg.id, cfg.signal));
       const lines = [`current name: ${current.name}`];
       if (cfg.payload.config?.name !== void 0 && cfg.payload.config.name !== current.name) {
         lines.push(`new name: ${cfg.payload.config.name}`);
@@ -57805,9 +57810,7 @@ async function runMecWorkflowUpdate(cfg) {
     },
     execute: async () => {
       const updated = await withMec(
-        () => updateTemplate(cfg.client, cfg.id, cfg.payload, {
-          signal: cfg.signal
-        })
+        () => updateTemplate(cfg.client, cfg.id, cfg.payload, { signal: cfg.signal }, MEC_DETAIL)
       );
       if (cfg.asJson) {
         writeJSONIndented(cfg.out, updated);
@@ -57828,9 +57831,7 @@ async function runMecWorkflowState(cfg) {
   };
   await preflightConfirmToken(action, cfg.token);
   await requireMec(cfg.client, { signal: cfg.signal });
-  const current = await withMec(
-    () => getTemplate(cfg.client, cfg.id, { signal: cfg.signal })
-  );
+  const current = await withMec(() => getMecTemplate(cfg.client, cfg.id, cfg.signal));
   let cascadeWarning = [];
   if (cfg.active) {
     cascadeWarning = await collectMecActivationCascade(cfg.client, current, cfg.signal);
@@ -57880,8 +57881,8 @@ async function collectMecActivationCascade(client, template, signal) {
   const lines = [];
   const instancesAll = template.process_instances ?? [];
   if (instancesAll.length === 0) return lines;
-  const latest = instancesAll[instancesAll.length - 1];
-  if (latest === void 0) return lines;
+  const created = (p) => Date.parse(p.create_time ?? "") || 0;
+  const latest = instancesAll.reduce((a, b) => created(b) > created(a) ? b : a);
   let process2;
   try {
     process2 = await withMec(() => getProcess(client, latest.id, { signal }));
@@ -57910,7 +57911,9 @@ async function runMecWorkflowArchive(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
   let current = null;
   try {
-    current = await withMec(() => getTemplate(cfg.client, cfg.id, { signal: cfg.signal }));
+    current = await withMec(
+      () => getMecTemplate(cfg.client, cfg.id, cfg.signal, cfg.archive ? {} : { is_archive: true })
+    );
   } catch {
     current = null;
   }
@@ -57925,7 +57928,7 @@ async function runMecWorkflowArchive(cfg) {
         return [
           `id: ${cfg.id}`,
           `target archived: ${cfg.archive ? "yes" : "no"}`,
-          "(template not visible via active-list GET \u2014 likely already in the opposite state)"
+          `(template not visible via the ${cfg.archive ? "active" : "archived"}-template detail GET \u2014 likely already in the opposite state)`
         ];
       }
       return [
@@ -57961,9 +57964,7 @@ async function runMecWorkflowClone(cfg) {
     `cloning MEC workflow template ${cfg.templateId} (carries existing members forward)`
   );
   await requireMec(cfg.client, { signal: cfg.signal });
-  const current = await withMec(
-    () => getTemplate(cfg.client, cfg.templateId, { signal: cfg.signal })
-  );
+  const current = await withMec(() => getMecTemplate(cfg.client, cfg.templateId, cfg.signal));
   const dateConfig = resolveDateTagConfig(current);
   const source = resolveCopyFrom(current, cfg.copyFrom, dateConfig.id);
   const extraTags = resolveExtraTags(current, parseExtraTagFlags(cfg.tagFlags), dateConfig.id);
@@ -76572,6 +76573,9 @@ async function aiServicePost(client, path13, body, attribute, options) {
     const fresh = await tokenFor(client, signal, true);
     res = await sendOnce(url, fresh.token, payload, extra, signal);
   }
+  return parseResponse(rel, res);
+}
+async function parseResponse(rel, res) {
   const text2 = await res.text();
   if (!res.ok) {
     const envelope = parseErrorEnvelope(text2);
@@ -76678,6 +76682,26 @@ function listModels(client, options) {
 function getSystemEntities(client, options) {
   return read(client, "v1/ManagedAgents/getSystemEntities", {}, options);
 }
+async function writeSchedule(client, path13, body, options) {
+  const res = await write(client, path13, body, options);
+  const schedule = res !== null && typeof res === "object" ? res.schedule : void 0;
+  if (schedule === null || typeof schedule !== "object" || Array.isArray(schedule)) {
+    throw new Error(`POST /ai-service/external/${path13}: response has no schedule object`);
+  }
+  return res;
+}
+function listSchedules(client, body, options) {
+  return read(client, "v1/ManagedAgentSchedules/listSchedules", body, options);
+}
+function createSchedule(client, body, options) {
+  return writeSchedule(client, "v1/ManagedAgentSchedules/createSchedule", body, options);
+}
+function updateSchedule(client, body, options) {
+  return writeSchedule(client, "v1/ManagedAgentSchedules/updateSchedule", body, options);
+}
+function deleteSchedule(client, body, options) {
+  return write(client, "v1/ManagedAgentSchedules/deleteSchedule", body, options);
+}
 
 // src/commands/_agentCliScopes.ts
 var DEFAULT_CLI_SCOPES = ["*:read"];
@@ -77689,6 +77713,218 @@ function registerAgentPinCommands(agents) {
   withPinTargets(unpin);
 }
 
+// src/commands/agents_schedules.ts
+var SCHEDULE_ID = "<scheduleId>";
+function requirePrompt(prompt) {
+  if (prompt.trim() === "") {
+    throw new Error("--prompt must not be empty (omit it, or use update --clear-prompt)");
+  }
+  return prompt;
+}
+function tokenAgentId(client) {
+  try {
+    return firstString(decodeJwtClaims(client.session.jwtAccess ?? ""), "agent_id");
+  } catch {
+    return "";
+  }
+}
+function agentIdFor(flag, client) {
+  const id = (flag ?? "").trim();
+  return id !== "" ? id : tokenAgentId(client);
+}
+function scheduleLine(s) {
+  const state = s.enabled === void 0 ? "?" : s.enabled ? "enabled" : "disabled";
+  return [
+    s.id ?? "?",
+    state,
+    `cron "${s.crontab ?? "?"}" ${s.timezone ?? "UTC"}`,
+    `agent ${s.agentId ?? "?"}`,
+    `last ${s.lastRunStatus ?? "-"}`
+  ].join("  ");
+}
+function writeResult(cfg, verb, res) {
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, res);
+    return;
+  }
+  cfg.out.write(`${verb} ${scheduleLine(res.schedule)}
+`);
+}
+async function runSchedulesList(cfg) {
+  const agentId = agentIdFor(cfg.agentId, cfg.client);
+  const res = await listSchedules(cfg.client, agentId !== "" ? { agentId } : {}, {
+    signal: cfg.signal
+  });
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, res);
+    return;
+  }
+  const list29 = res.schedules ?? [];
+  if (list29.length === 0) {
+    cfg.out.write("(no schedules)\n");
+    return;
+  }
+  for (const s of list29) cfg.out.write(`${scheduleLine(s)}
+`);
+}
+async function runSchedulesCreate(cfg) {
+  const agentId = agentIdFor(cfg.agentId, cfg.client);
+  if (agentId === "") {
+    throw new Error(
+      "missing required option: --agent-id <agentId> (the session token names no agent)"
+    );
+  }
+  if (cfg.cron === void 0) throw new Error("missing required option: --cron <expr>");
+  const body = { agentId, crontab: parseCron(cfg.cron) };
+  if (cfg.tz !== void 0) body.timezone = cfg.tz;
+  if (cfg.prompt !== void 0) body.prompt = requirePrompt(cfg.prompt);
+  if (cfg.environmentId !== void 0) body.environmentId = cfg.environmentId;
+  if (cfg.enabled !== void 0) body.enabled = requireBool(cfg.enabled, "--enabled");
+  writeResult(cfg, "Created", await createSchedule(cfg.client, body, { signal: cfg.signal }));
+}
+async function runSchedulesUpdate(cfg) {
+  const id = requireId(cfg.id, SCHEDULE_ID);
+  if (cfg.prompt !== void 0 && cfg.clearPrompt === true) {
+    throw new Error("give --prompt or --clear-prompt, not both");
+  }
+  const body = { id };
+  if (cfg.cron !== void 0) body.crontab = parseCron(cfg.cron);
+  if (cfg.tz !== void 0) body.timezone = cfg.tz;
+  if (cfg.prompt !== void 0) body.prompt = requirePrompt(cfg.prompt);
+  if (cfg.clearPrompt === true) body.prompt = null;
+  if (cfg.environmentId !== void 0) body.environmentId = cfg.environmentId;
+  if (cfg.enabled !== void 0) body.enabled = requireBool(cfg.enabled, "--enabled");
+  if (Object.keys(body).length === 1) throw new Error("nothing to change: give at least one flag");
+  writeResult(cfg, "Updated", await updateSchedule(cfg.client, body, { signal: cfg.signal }));
+}
+async function runSchedulesDelete(cfg) {
+  const id = requireId(cfg.id, SCHEDULE_ID);
+  const serverKey = cfg.client.serverKey;
+  const action = {
+    resource: "managed-agent-schedule",
+    id: `${serverKey}:${id}`,
+    verb: "delete"
+  };
+  await preflightConfirmToken(action, cfg.token);
+  await twoStepConfirm({
+    out: proseStream(cfg),
+    action,
+    token: cfg.token,
+    server: serverKey,
+    confirmCmd: `dr agents schedules delete --id ${shellArg(id)} --server ${shellArg(serverKey)}`,
+    describe: async () => {
+      const agentId = tokenAgentId(cfg.client);
+      const res = await listSchedules(cfg.client, agentId !== "" ? { agentId } : {}, {
+        signal: cfg.signal
+      });
+      const s = (res.schedules ?? []).find((row) => row.id === id);
+      if (s === void 0) {
+        throw new Error(`no schedule ${id} in this org (see: dr agents schedules list)`);
+      }
+      return [
+        scheduleLine(s),
+        `prompt: ${JSON.stringify(s.prompt ?? null)}`,
+        `environment: ${s.environmentId ?? "(resolved per run)"}`,
+        // `create` cannot set this: a restored schedule runs as whoever re-creates it.
+        `runs as: user ${s.runAsUserId ?? "?"}`
+      ];
+    },
+    execute: async () => {
+      const res = await deleteSchedule(cfg.client, { id }, { signal: cfg.signal });
+      proseStream(cfg).write(`Deleted schedule ${id}.
+`);
+      if (cfg.asJson) writeJSONIndented(cfg.out, res);
+    }
+  });
+}
+var AGENT_ID_HELP = "Agent id (default: the session token's agent_id claim, which a managed agent's token carries).";
+function registerAgentSchedulesCommands(agents) {
+  const schedules = agents.command("schedules").description(
+    "Cron schedules that open a conversation with a managed agent, as the session user."
+  );
+  const list29 = schedules.command("list").description("List the org's schedules.").option(
+    "--agent-id <agentId>",
+    "Only this agent's (default: the session token's agent_id claim; without one, every agent's)."
+  ).option("--json", JSON_HELP).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runSchedulesList({
+        client: setup.client,
+        signal: setup.signal,
+        ...std(),
+        agentId: opts.agentId,
+        asJson: opts.json === true
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  withTarget(list29);
+  const create20 = schedules.command("create").description("Schedule an agent; its runs act as you.").option("--agent-id <agentId>", AGENT_ID_HELP).option(
+    "--cron <expr>",
+    'Five-field cron line, runs at least 5 minutes apart, e.g. "0 8 * * 1".'
+  ).option("--tz <iana>", "Timezone the cron line is read in (default UTC).").option("--prompt <text>", "What each run is asked (default: a bare trigger turn).").option(
+    "--environment-id <id>",
+    "Anthropic environment for the runs (default: resolved per run)."
+  ).option("--enabled <true|false>", "Create it enabled (default true).").option("--json", JSON_HELP).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runSchedulesCreate({
+        client: setup.client,
+        signal: setup.signal,
+        ...std(),
+        agentId: opts.agentId,
+        cron: opts.cron,
+        tz: opts.tz,
+        prompt: opts.prompt,
+        environmentId: opts.environmentId,
+        enabled: opts.enabled,
+        asJson: opts.json === true
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  withTarget(create20);
+  const update13 = schedules.command("update").description("Change a schedule (only the flags given change); its runs then act as you.").option("--id <scheduleId>", "Schedule id.").option("--cron <expr>", "New five-field cron line.").option("--tz <iana>", "New timezone.").option("--prompt <text>", "New prompt.").option("--clear-prompt", "Remove the prompt (runs get a bare trigger turn).").option("--environment-id <id>", "New Anthropic environment.").option("--enabled <true|false>", "Enable or disable it.").option("--json", JSON_HELP).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runSchedulesUpdate({
+        client: setup.client,
+        signal: setup.signal,
+        ...std(),
+        id: opts.id,
+        cron: opts.cron,
+        tz: opts.tz,
+        prompt: opts.prompt,
+        clearPrompt: opts.clearPrompt,
+        environmentId: opts.environmentId,
+        enabled: opts.enabled,
+        asJson: opts.json === true
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  withTarget(update13);
+  const del = schedules.command("delete").description("Delete a schedule. (two-step confirm)").option("--id <scheduleId>", "Schedule id.").option("--confirm-token <token>", CONFIRM_HELP).option("--json", JSON_HELP).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runSchedulesDelete({
+        client: setup.client,
+        signal: setup.signal,
+        ...std(),
+        id: opts.id,
+        token: opts.confirmToken,
+        asJson: opts.json === true
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  withTarget(del);
+}
+
 // src/commands/agents_skills.ts
 import { mkdir as mkdir4, writeFile as writeFile7 } from "fs/promises";
 import { dirname as dirname9, join as join17 } from "path";
@@ -79257,6 +79493,7 @@ function registerAgentsCommand(root) {
   registerAgentPinCommands(agents);
   registerAgentStudioCommands(agents);
   registerAgentSkillsCommand(agents);
+  registerAgentSchedulesCommands(agents);
 }
 
 // src/auth/versionCheck.ts

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.186",
+  "cliVersion": "1.6.188",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -695,7 +695,7 @@
       "requires": [
         {
           "resource": "tables",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -851,7 +851,7 @@
       "requires": [
         {
           "resource": "dashboards",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -1067,7 +1067,7 @@
       "requires": [
         {
           "resource": "tables",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -1075,7 +1075,7 @@
       "requires": [
         {
           "resource": "tables",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -1083,7 +1083,7 @@
       "requires": [
         {
           "resource": "tables",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -1863,7 +1863,7 @@
       "requires": [
         {
           "resource": "integrations",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -5220,6 +5220,38 @@
           "action": "destructive"
         }
       ]
+    },
+    "agents schedules list": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "read"
+        }
+      ]
+    },
+    "agents schedules create": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "write"
+        }
+      ]
+    },
+    "agents schedules update": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "write"
+        }
+      ]
+    },
+    "agents schedules delete": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "destructive"
+        }
+      ]
     }
   },
   "aliases": {

package/dist/skills/dr-cli/reference/safety.md

@@ -57,7 +57,9 @@ Reads never need confirmation. Gated **writes** fall into two tiers (full table:
   every server, because the agent and skill registry is shared by every
   environment (a write on DEV-1 changes production agents too).
 
-**Tier A is the smaller set:** every `delete` (across all resources), plus
+**Tier A is the smaller set:** every `delete` (across all resources, except
+`agents schedules delete`: one schedule row, which `create` restores, though
+the restored row runs as whoever re-creates it), plus
 `workflow`/`mec workflow` `archive` (and its `delete` alias), `process delete`,
 `step delete`, `task delete`; `forecast scenarios bulk-edit`; `cash rules
 delete-all`; `filebox archive` and `filebox data-query clear`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.186",
+  "version": "1.6.188",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.61",
+    "@datarails-ai/dr-appspace-cli": "0.12.62",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",