@divergeai/cli 0.1.26 → 0.1.27

package/README.md

@@ -157,8 +157,13 @@ The set is derived from the login, never chosen on the machine: who is
 signed in, where they may act, and what they can run there. A skill's
 identity is its organization and its name, so every organization's skills
 sit side by side in one folder, each under the organization's prefix — its
-short code, lowercased, or a slug of its name: `dvx-consultar-inventario`,
-`red-team-triage-cloud-run`. Each SKILL.md is rendered from the skill's
+handle, the same lowercase slug that prefixes its case numbers, or a slug of
+its name when it chose none: `acme-consultar-inventario`,
+`red-team-triage-cloud-run`. A folder longer than the 64 characters a
+harness accepts as a skill name is cut and ended with a short stable hash,
+and its SKILL.md names the skill; a served folder that is not a skill name is
+skipped with a warning naming it, and the folder that skill was installed
+under before stays. Each SKILL.md is rendered from the skill's
 record on every install, named after its folder, and opens with the
 organization its tools run in, so an agent passes `--organization-id` on
 every call instead of depending on the machine's default organization.
@@ -249,12 +254,17 @@ reaches it through your bridge binding. See
 
 ```bash
 diverge plugins validate manifest.json     # dry run: every problem the platform would refuse, at once
-diverge plugins publish  manifest.json     # forge_plugins:create in the login's organization
+diverge plugins publish  manifest.json     # forge_plugins:create in the login's organization; exits 3 when it waits on a decision
 diverge plugins list
 diverge plugins retire <pluginId>          # the descriptor and its tools go; installations stay
 ```
 
 Tools are pinned to the manifest: a change is a new version published again.
+A version that only reshapes or removes the tools already served is stored at
+once. Anything else changes authority and is stored only once a person decides
+it: `publish` raises it as `forge_publish_plugin`, prints the invocation and
+its Compass link, and exits 3; read the outcome with
+`diverge tools invocation <id>`.
 After publishing, enable the plugin with `forge_set_plugin_state` (or the
 Forge Routing page) and bind the runtime with a bridge binding whose
 `runtimeType` equals the manifest's `runtime.type`; declare `networkPolicy`

package/dist/diverge.mjs

@@ -7556,7 +7556,7 @@ function tokenSource(env, baseUrl) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.26" : "dev";
+var VERSION = true ? "0.1.27" : "dev";
 var USER_AGENT = `diverge/${VERSION}`;
 
 // src/http.ts
@@ -8361,8 +8361,16 @@ function describeToolExecution(env = process.env) {
 }
 
 // src/tools/client.ts
+var AUTHORITY_CHANGE_CODE = "REMOTE_PLUGIN_AUTHORITY_CHANGE";
 var INVOCATION_SET_TOOL = "functions_invocation_set";
 var PENDING_INVOCATION_STATUSES = ["pending", "approved", "executing"];
+function parseJson(text2) {
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return void 0;
+  }
+}
 function isPending(result) {
   return !!result && typeof result === "object" && result.status === "pending_approval";
 }
@@ -8451,7 +8459,7 @@ var ToolsClient = class {
           if (typeof parsed.error === "string" && parsed.error) message = parsed.error;
         } catch {
         }
-        if (response.status === 403 && /scope/i.test(message)) {
+        if (response.status === 403 && /^insufficient scope$/i.test(message.trim())) {
           throw new CliError(`${response.status}: ${message}
   The signed-in token is missing a required scope. Re-run:  ${LOGIN_HINT}`);
         }
@@ -8523,14 +8531,14 @@ var ToolsClient = class {
       this.descriptorsUrl(),
       { targetOrganizationId: this.settings.organizationId, manifest, dryRun: options.dryRun },
       (status2, text2) => {
-        if (status2 !== 400) return void 0;
-        try {
-          const parsed = JSON.parse(text2);
-          if (Array.isArray(parsed.details)) return { ok: false, details: parsed.details.map(String) };
-          return { ok: false, details: [parsed.error ?? text2] };
-        } catch {
-          return { ok: false, details: [text2] };
+        if (status2 === 403) {
+          const parsed2 = parseJson(text2);
+          return parsed2?.code === AUTHORITY_CHANGE_CODE && Array.isArray(parsed2.details) ? { ok: false, details: parsed2.details.map(String), authorityChange: true } : void 0;
         }
+        if (status2 !== 400) return void 0;
+        const parsed = parseJson(text2);
+        if (Array.isArray(parsed?.details)) return { ok: false, details: parsed.details.map(String) };
+        return { ok: false, details: [parsed?.error ?? text2] };
       }
     ).then((outcome) => "ok" in outcome ? outcome : { ok: true, result: outcome });
   }
@@ -8802,6 +8810,19 @@ function readSkillsManifest(root) {
 function few(names, limit = 6) {
   return names.length <= limit ? names.join(", ") : `${names.slice(0, limit).join(", ")} and ${names.length - limit} more`;
 }
+function isSkillFolder(folder) {
+  return /^[a-z0-9][a-z0-9-]{0,63}$/.test(folder);
+}
+function retainedFolders(manifest, set2) {
+  const retained = /* @__PURE__ */ new Map();
+  for (const organization of set2.organizations) {
+    const skipped = organization.skills.filter((skill) => !isSkillFolder(skill.folder));
+    const held = Object.keys(manifest?.organizations[organization.id]?.skills ?? {});
+    const kept = held.filter((folder) => skipped.some((skill) => folder.endsWith(`-${skill.name}`)));
+    if (kept.length) retained.set(organization.id, kept);
+  }
+  return retained;
+}
 function heldFolders(manifest) {
   const held = /* @__PURE__ */ new Map();
   for (const [folder, version] of Object.entries(manifest?.flat ?? {})) held.set(folder, version);
@@ -8811,9 +8832,10 @@ function heldFolders(manifest) {
 }
 function retirable(manifest, set2) {
   const refreshed = new Set(set2.organizations.map((organization) => organization.id));
+  const retained = new Set([...retainedFolders(manifest, set2).values()].flat());
   const folders = [...Object.keys(manifest?.flat ?? {}), ...Object.keys(manifest?.cli ?? {})];
   for (const [id, section] of Object.entries(manifest?.organizations ?? {})) {
-    if (set2.complete || refreshed.has(id)) folders.push(...Object.keys(section.skills));
+    if (set2.complete || refreshed.has(id)) folders.push(...Object.keys(section.skills).filter((folder) => !retained.has(folder)));
   }
   return folders;
 }
@@ -8823,21 +8845,28 @@ function installSkills(root, set2, source, now = () => /* @__PURE__ */ new Date(
   const written = [];
   const added = [];
   const updated = [];
+  const skipped = [];
   const counts = [];
   const write = (skill) => {
-    if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(skill.folder)) throw new Error(`skill folder ${JSON.stringify(skill.folder)} is not a folder name`);
+    if (!isSkillFolder(skill.folder)) {
+      skipped.push(skill.folder);
+      return;
+    }
     writeTextAtomic(path5.join(root, skill.folder, "SKILL.md"), skill.content, 420);
     written.push(skill.folder);
-    const before = held.get(skill.folder);
-    if (before === void 0) added.push(skill.folder);
-    else if (before !== skill.updatedAt) updated.push(skill.folder);
+    const before2 = held.get(skill.folder);
+    if (before2 === void 0) added.push(skill.folder);
+    else if (before2 !== skill.updatedAt) updated.push(skill.folder);
   };
   for (const organization of set2.organizations) {
+    const before2 = written.length;
     organization.skills.forEach(write);
-    counts.push({ label: organization.name, count: organization.skills.length });
+    counts.push({ label: organization.name, count: written.length - before2 });
   }
+  const before = written.length;
   set2.cli.forEach(write);
-  if (set2.cli.length) counts.push({ label: "CLI", count: set2.cli.length });
+  if (set2.cli.length) counts.push({ label: "CLI", count: written.length - before });
+  const retained = retainedFolders(previous, set2);
   const removed = [];
   const kept = new Set(written);
   for (const folder of retirable(previous, set2)) {
@@ -8855,7 +8884,10 @@ function installSkills(root, set2, source, now = () => /* @__PURE__ */ new Date(
     organizations[organization.id] = {
       name: organization.name,
       installedAt: stamp,
-      skills: Object.fromEntries(organization.skills.map((skill) => [skill.folder, skill.updatedAt]))
+      skills: Object.fromEntries([
+        ...(retained.get(organization.id) ?? []).map((folder) => [folder, previous.organizations[organization.id].skills[folder]]),
+        ...organization.skills.filter((skill) => isSkillFolder(skill.folder)).map((skill) => [skill.folder, skill.updatedAt])
+      ])
     };
   }
   const manifest = {
@@ -8865,7 +8897,7 @@ function installSkills(root, set2, source, now = () => /* @__PURE__ */ new Date(
     organizations
   };
   writeJsonAtomic(path5.join(root, SKILLS_MANIFEST), manifest, 420);
-  return { root, written, added, updated, removed, counts };
+  return { root, written, added, updated, removed, skipped, counts };
 }
 function skillsStatus(root, set2) {
   const manifest = readSkillsManifest(root);
@@ -8873,7 +8905,9 @@ function skillsStatus(root, set2) {
   const current = [];
   const behind = [];
   const missing = [];
-  const served = [...set2.organizations.flatMap((organization) => organization.skills), ...set2.cli];
+  const all = [...set2.organizations.flatMap((organization) => organization.skills), ...set2.cli];
+  const served = all.filter((skill) => isSkillFolder(skill.folder));
+  const skipped = all.filter((skill) => !isSkillFolder(skill.folder)).map((skill) => skill.folder);
   for (const skill of served) {
     const before = held.get(skill.folder);
     if (before === void 0 || !fs6.existsSync(path5.join(root, skill.folder, "SKILL.md"))) missing.push(skill.folder);
@@ -8882,7 +8916,7 @@ function skillsStatus(root, set2) {
   }
   const servedFolders = new Set(served.map((skill) => skill.folder));
   const retired = [...new Set(retirable(manifest, set2))].filter((folder) => !servedFolders.has(folder));
-  return { root, installedAt: manifest?.installedAt || null, current, behind, missing, retired };
+  return { root, installedAt: manifest?.installedAt || null, current, behind, missing, retired, skipped };
 }
 
 // src/skills/installable.ts
@@ -8940,8 +8974,11 @@ var skillsUsage = `diverge skills <list|install|refresh|status> [--organization-
 
 A skill is a procedure over the tools it names; you get the ones whose every
 tool you may run, in every organization the login can act in. Each lands as
-<organization prefix>-<name> \u2014 the organization's short code, or a slug of
-its name \u2014 and its SKILL.md opens with the organization its tools run in.
+<organization prefix>-<name> \u2014 the organization's handle, or a slug of
+its name; the platform shortens a longer one to the 64 characters a harness
+accepts \u2014 and its SKILL.md opens with the organization its tools run in.
+A folder that is not a skill name is skipped with a warning naming it, and
+the folder that skill was installed under before stays.
 --organization-id refreshes one organization and leaves the others as they
 are; without it the whole login is refreshed, and an organization the login
 no longer lists is retired. Without --harness, the harnesses present on this
@@ -8980,6 +9017,11 @@ function harnessesOf(flag, env) {
 function installSet(harness, skills) {
   return { cli: bundledSkills(harness), organizations: skills.organizations, complete: skills.complete };
 }
+var SKIPPED = "not installed, the folder is not a skill name (at most 64 lowercase letters, digits and hyphens)";
+function skippedNote(results) {
+  const skipped = [...new Set(results.flatMap((result) => result.skipped))];
+  return skipped.length ? [`${skipped.length} ${SKIPPED}: ${few(skipped)}`] : [];
+}
 function installReport(harness, result) {
   const holdings = result.counts.map((entry) => `${entry.label} ${entry.count}`).join(", ");
   const changes = [
@@ -9007,11 +9049,13 @@ async function refreshSkills(io, apiUrl, options = {}) {
     io.stderr(`warning: skills not refreshed (${error instanceof Error ? error.message : String(error)}); run: diverge skills install`);
     return;
   }
+  const results = [];
   for (const harness of harnesses) {
     const result = installSkills(skillsRoot(harness, io.env), installSet(harness, skills), apiUrl);
     if (!options.quiet || result.added.length || result.updated.length || result.removed.length) io.stdout(installReport(harness, result));
+    results.push(result);
   }
-  for (const note of skills.notes) io.stderr(`warning: ${note}`);
+  for (const note of [...skills.notes, ...skippedNote(results)]) io.stderr(`warning: ${note}`);
 }
 async function runSkills(args, io) {
   const [verb, ...rest] = args;
@@ -9033,8 +9077,8 @@ async function runSkills(args, io) {
       const skills = await loginSkillSet(apiUrl, io.env, organizationId);
       const harnesses = values.into ? [harnessesOf(values.harness ?? HARNESSES[0], io.env)[0]] : harnessesOf(values.harness, io.env);
       if (harnesses.length === 0) throw new CliError("No coding-agent harness on this machine yet (Claude Code, Codex or dsh); name one with --harness to write its folder anyway.");
-      for (const harness of harnesses) installForHarness(io, harness, skills, apiUrl, values.into);
-      for (const note of skills.notes) io.stderr(`warning: ${note}`);
+      const results = harnesses.map((harness) => installForHarness(io, harness, skills, apiUrl, values.into));
+      for (const note of [...skills.notes, ...skippedNote(results)]) io.stderr(`warning: ${note}`);
       return ExitCode.Ok;
     }
     case "refresh": {
@@ -9050,6 +9094,7 @@ async function runSkills(args, io) {
         if (status2.behind.length) parts.push(`${status2.behind.length} behind (${few(status2.behind)})`);
         if (status2.missing.length) parts.push(`${status2.missing.length} missing${status2.current.length || status2.behind.length ? ` (${few(status2.missing)})` : ""}`);
         if (status2.retired.length) parts.push(`${status2.retired.length} retired (${few(status2.retired)})`);
+        if (status2.skipped.length) parts.push(`${status2.skipped.length} ${SKIPPED} (${few(status2.skipped)})`);
         behind ||= status2.behind.length + status2.missing.length + status2.retired.length > 0;
         io.stdout(`${harness}: ${parts.join(", ")} in ${status2.root}${status2.installedAt ? ` (installed ${status2.installedAt})` : " (never installed)"}`);
       }
@@ -9587,7 +9632,7 @@ var STALLED_TICKS = 30;
 var CAPTURE_NOTICES = {
   off: "This organization does not record agent sessions (Forge installation config agentSessions.capture is off); nothing is sent.",
   metadata: "Recorded: metadata only \u2014 which tools ran and how many failed, tokens, models and timing; no prompt, reply, tool argument or result.",
-  conversation: "Recorded: the whole conversation \u2014 every prompt, reply, tool call and its result. Yours to read; anyone else in the organization needs the Agent conversations role, and every such read is recorded on the session."
+  conversation: "Recorded: the whole conversation \u2014 every prompt, reply, tool call and its result. Yours to read; anyone else in the organization needs the Agent Conversations role, and every such read is recorded on the session."
 };
 function eventBytes(event) {
   return Buffer.byteLength(JSON.stringify(event), "utf8");
@@ -9911,8 +9956,8 @@ function syncDivergentPreset(io, binary, home) {
 async function skillsFor(io, apiUrl, harness, organizationId) {
   try {
     const skills = await loginSkillSet(apiUrl, io.env, organizationId?.trim() || void 0);
-    installForHarness(io, harness, skills, apiUrl);
-    for (const note of skills.notes) io.stderr(`warning: ${note}`);
+    const result = installForHarness(io, harness, skills, apiUrl);
+    for (const note of [...skills.notes, ...skippedNote([result])]) io.stderr(`warning: ${note}`);
   } catch (error) {
     io.stderr(`warning: skills not installed (${error instanceof Error ? error.message : String(error)}); run: diverge skills install`);
   }
@@ -10903,13 +10948,19 @@ import { parseArgs as parseArgs7 } from "node:util";
 var pluginsUsage = `diverge plugins <validate|publish|list|retire> [--organization-id <id>] ...
 
   validate <manifest.json>            (dry run: the platform's full validation, nothing stored)
-  publish  <manifest.json> [--json]   (forge_plugins:create in the signed-in organization)
+  publish  <manifest.json> [--json]   (forge_plugins:create in the signed-in organization;
+                                       a version that changes authority waits on a decision)
   list     [--json]
   retire   <pluginId>
 
 Register a tenant plugin: a plugin whose code runs in your organization's own
 runtime and never inside the platform. The manifest lists the tools the
-platform registers, pinned; a change is a new version published again. Enable
+platform registers, pinned; a change is a new version published again.
+
+A version that only reshapes or removes the tools already served is stored at
+once. Anything else changes authority: publish raises it as
+forge_publish_plugin, prints the invocation, and exits 3; a person decides it
+in Compass, and diverge tools invocation <id> reads the outcome. Enable
 it with forge plugins (or forge_set_plugin_state) and bind the runtime with a
 Forge bridge binding whose runtimeType matches the manifest's runtime.type.`;
 var SCOPE_OPTIONS2 = { "organization-id": { type: "string" } };
@@ -10917,7 +10968,28 @@ async function client2(values, io) {
   const settings = loadToolsSettings({ organizationId: values["organization-id"] }, io.env);
   io.stderr(scopeLine(settings));
   io.stderr(await actingAsLine(settings, io.env));
-  return new ToolsClient(settings, io.env);
+  return { settings, tools: new ToolsClient(settings, io.env) };
+}
+function printProblems(details, io) {
+  io.stderr(`Invalid manifest (${details.length} problem${details.length === 1 ? "" : "s"}):`);
+  for (const detail of details) io.stderr(`  - ${detail}`);
+  return ExitCode.Failure;
+}
+async function raisePublish(manifest, authorityChanges, context, io) {
+  const { settings, tools, json } = context;
+  if (!json) {
+    io.stdout("This version changes authority, so it is stored only once it is decided:");
+    for (const change of authorityChanges) io.stdout(`  - ${change}`);
+  }
+  const outcome = await runOne({ tool: "forge_publish_plugin", args: { manifest } }, {
+    callTool: (name, args) => tools.callTool(name, args),
+    decideAt: (pending) => `${settings.apiUrl}${pending.approvalUrl ?? ""}`,
+    ...json ? {} : { onPending: (pending) => formatPending(pending, settings.apiUrl, settings.organizationId).forEach((line) => io.stdout(line)) }
+  });
+  if (json) io.stdout(JSON.stringify({ authorityChanges, ...outcome }, null, 2));
+  else if (outcome.status === "executed") io.stdout("Published.");
+  else if (outcome.status === "failed") throw new CliError(`forge_publish_plugin failed: ${outcome.error}`);
+  return worstExitCode([outcome]);
 }
 function readManifest(file) {
   if (!file) throw new CliError(`A manifest file is required.
@@ -10954,30 +11026,30 @@ async function runPlugins(args, io) {
     case "validate": {
       const { values, positionals } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
       const manifest = readManifest(positionals[0]);
-      const tools = await client2(values, io);
+      const { tools } = await client2(values, io);
       const outcome = await tools.publishPlugin(manifest, { dryRun: true });
-      if (!outcome.ok) {
-        io.stderr(`Invalid manifest (${outcome.details.length} problem${outcome.details.length === 1 ? "" : "s"}):`);
-        for (const detail of outcome.details) io.stderr(`  - ${detail}`);
-        return ExitCode.Failure;
-      }
+      if (!outcome.ok) return printProblems(outcome.details, io);
       if (values.json) io.stdout(JSON.stringify(outcome.result, null, 2));
       else {
         io.stdout(`Valid. ${outcome.result.changed ? "Publishing would register" : "Already published at this digest:"}`);
         for (const line of formatPlugin(outcome.result.plugin)) io.stdout(line);
+        const authority = outcome.result.authorityChanges ?? [];
+        if (authority.length) {
+          io.stdout("Publishing it changes authority, so it waits on a person's decision in Compass:");
+          for (const change of authority) io.stdout(`  - ${change}`);
+        }
       }
       return ExitCode.Ok;
     }
     case "publish": {
       const { values, positionals } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
       const manifest = readManifest(positionals[0]);
-      const tools = await client2(values, io);
+      const { settings, tools } = await client2(values, io);
       const outcome = await tools.publishPlugin(manifest, { dryRun: false });
-      if (!outcome.ok) {
-        io.stderr(`Invalid manifest (${outcome.details.length} problem${outcome.details.length === 1 ? "" : "s"}):`);
-        for (const detail of outcome.details) io.stderr(`  - ${detail}`);
-        return ExitCode.Failure;
+      if (!outcome.ok && outcome.authorityChange) {
+        return raisePublish(manifest, outcome.details, { settings, tools, json: values.json }, io);
       }
+      if (!outcome.ok) return printProblems(outcome.details, io);
       if (values.json) io.stdout(JSON.stringify(outcome.result, null, 2));
       else {
         io.stdout(outcome.result.changed ? "Published." : "Unchanged: this digest was already published.");
@@ -10988,7 +11060,7 @@ async function runPlugins(args, io) {
     }
     case "list": {
       const { values } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, strict: true });
-      const tools = await client2(values, io);
+      const { tools } = await client2(values, io);
       const plugins = await tools.listPlugins();
       if (values.json) io.stdout(JSON.stringify(plugins, null, 2));
       else if (!plugins.length) io.stdout("No tenant plugins published for this organization.");
@@ -11001,7 +11073,7 @@ async function runPlugins(args, io) {
       if (!pluginId) throw new CliError(`A plugin id is required.
 
 ${pluginsUsage}`);
-      const tools = await client2(values, io);
+      const { tools } = await client2(values, io);
       const plugin = await tools.retirePlugin(pluginId);
       io.stdout(`Retired ${plugin.pluginId}@${plugin.version}; its ${plugin.toolNames.length} tool(s) are gone. Installation records stay for a re-publish.`);
       return ExitCode.Ok;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@divergeai/cli",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Divergent platform CLI: sign in, wire coding agents to the inference gateway, call platform tools",
   "license": "UNLICENSED",
   "type": "module",