@duvoai/cli 1.71.2 → 1.72.0

package/dist/bin/duvo.js

@@ -3952,6 +3952,11 @@ var versioningApiFields = {
   sandbox_id: z12.string().nullable().describe("E2B sandbox id that produced AI rows; null for user edits."),
   last_session_id: z12.string().nullable().describe("Claude SDK session id for artifact-chat follow-up reuse.")
 };
+var versionCreatorEmailApiField = {
+  user_email: z12.string().nullable().optional().describe(
+    "Email of the creator user, resolved from `user_id`; null when the user is unknown or was deleted."
+  )
+};
 var versionNumberApiField = {
   version_number: z12.number().int().positive().describe(
     "1-based position of this snapshot in the process's full chronological history for its kind, counted over every non-deleted row \u2014 not the row's index in the returned page."
@@ -4029,7 +4034,8 @@ var clarityCurrentProcessVersionApiSchema = z12.object({
   parent_current_process_id: z12.guid().nullable().describe("Parent current-process snapshot this draft forked from"),
   created_at: z12.string().describe("ISO 8601 creation timestamp"),
   ...versionNumberApiField,
-  ...versioningApiFields
+  ...versioningApiFields,
+  ...versionCreatorEmailApiField
 });
 var clarityTransformationProposalVersionApiSchema = z12.object({
   id: z12.guid().describe("Proposal id"),
@@ -4041,6 +4047,7 @@ var clarityTransformationProposalVersionApiSchema = z12.object({
   created_at: z12.string().describe("ISO 8601 creation timestamp"),
   ...versionNumberApiField,
   ...versioningApiFields,
+  ...versionCreatorEmailApiField,
   extra_capture_requests: z12.array(clarityProposalExtraCaptureRequestSchema).optional().describe(
     "Active extra-capture requests for this proposal. Populated only on the live proposal version row in the read-model endpoint so the FE can render assignment UI without a second round-trip; historic versions return an empty array. Other endpoints (e.g. admin snapshot views) may omit it entirely, in which case it is `undefined`. The standalone list endpoint stays the source of truth for paginated/admin views."
   )
@@ -4098,12 +4105,14 @@ var clarityProcessSnapshotVersionApiSchema = z12.discriminatedUnion(
     clarityProcessSnapshotBaseApiSchema.extend({
       kind: z12.literal("current_process"),
       source_snapshot_id: z12.null(),
-      ...versionNumberApiField
+      ...versionNumberApiField,
+      ...versionCreatorEmailApiField
     }).omit({ updated_at: true }),
     clarityProcessSnapshotBaseApiSchema.extend({
       kind: z12.literal("transformation_proposal"),
       source_snapshot_id: z12.guid(),
-      ...versionNumberApiField
+      ...versionNumberApiField,
+      ...versionCreatorEmailApiField
     }).omit({ updated_at: true })
   ]
 );
@@ -9921,6 +9930,11 @@ var BUILDER_RUN_STATUSES = [
   "waiting_for_input",
   "waiting_for_approve"
 ];
+var BUILDER_RUN_WARNING_CODES = ["connection_not_in_team_catalog"];
+var builderRunWarningSchema = z42.object({
+  code: z42.enum(BUILDER_RUN_WARNING_CODES),
+  detail: z42.string().describe("Human-readable specifics, e.g. the slugs that did not resolve")
+});
 var builderRunStatusSchema = z42.object({
   id: z42.string(),
   status: z42.enum(BUILDER_RUN_STATUSES),
@@ -9932,7 +9946,10 @@ var builderRunStatusSchema = z42.object({
   // to work.
   checkpoint_config: storedStepConfigValueSchema.nullable(),
   pending_user_questions: askUserQuestionInputSchema.nullable(),
-  schedule_suggested: z42.boolean().optional()
+  schedule_suggested: z42.boolean().optional(),
+  // Optional rather than nullable-required: an existing client polling this
+  // endpoint must keep parsing a response that predates the column.
+  warnings: z42.array(builderRunWarningSchema).nullable().optional()
 });
 var MAX_CASE_ATTACHMENT_BYTES = 50 * 1024 * 1024;
 var CASE_ATTACHMENT_STATUS = {
@@ -12642,7 +12659,12 @@ async function assertResponseOk(response, method, path) {
     );
   }
   if (response.status === 404) {
-    throw new CliError(`Not found: ${method} ${path}`, EXIT_CODE.NOT_FOUND);
+    const apiError = parseApiErrorDetail(await safeReadText(response));
+    const suffix = apiError.message ? `: ${apiError.message}` : "";
+    throw new CliError(
+      `Not found: ${method} ${path}${suffix}`,
+      EXIT_CODE.NOT_FOUND
+    );
   }
   if (!response.ok) {
     const detail = await safeReadText(response);
@@ -20551,6 +20573,11 @@ var clarityInterviewVoiceSpeedSchema = z282.union([
   z282.literal(1.25),
   z282.literal(1.5)
 ]);
+function normalizeAgentName(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+}
+__name(normalizeAgentName, "normalizeAgentName");
+__name3(normalizeAgentName, "normalizeAgentName");
 function isStartStep2(step) {
   return step.nodeType === "event" && step.nodeSubtype === "start";
 }
@@ -21964,6 +21991,11 @@ var versioningApiFields2 = {
   sandbox_id: z323.string().nullable().describe("E2B sandbox id that produced AI rows; null for user edits."),
   last_session_id: z323.string().nullable().describe("Claude SDK session id for artifact-chat follow-up reuse.")
 };
+var versionCreatorEmailApiField2 = {
+  user_email: z323.string().nullable().optional().describe(
+    "Email of the creator user, resolved from `user_id`; null when the user is unknown or was deleted."
+  )
+};
 var versionNumberApiField2 = {
   version_number: z323.number().int().positive().describe(
     "1-based position of this snapshot in the process's full chronological history for its kind, counted over every non-deleted row \u2014 not the row's index in the returned page."
@@ -22041,7 +22073,8 @@ var clarityCurrentProcessVersionApiSchema2 = z323.object({
   parent_current_process_id: z323.guid().nullable().describe("Parent current-process snapshot this draft forked from"),
   created_at: z323.string().describe("ISO 8601 creation timestamp"),
   ...versionNumberApiField2,
-  ...versioningApiFields2
+  ...versioningApiFields2,
+  ...versionCreatorEmailApiField2
 });
 var clarityTransformationProposalVersionApiSchema2 = z323.object({
   id: z323.guid().describe("Proposal id"),
@@ -22053,6 +22086,7 @@ var clarityTransformationProposalVersionApiSchema2 = z323.object({
   created_at: z323.string().describe("ISO 8601 creation timestamp"),
   ...versionNumberApiField2,
   ...versioningApiFields2,
+  ...versionCreatorEmailApiField2,
   extra_capture_requests: z323.array(clarityProposalExtraCaptureRequestSchema2).optional().describe(
     "Active extra-capture requests for this proposal. Populated only on the live proposal version row in the read-model endpoint so the FE can render assignment UI without a second round-trip; historic versions return an empty array. Other endpoints (e.g. admin snapshot views) may omit it entirely, in which case it is `undefined`. The standalone list endpoint stays the source of truth for paginated/admin views."
   )
@@ -22110,12 +22144,14 @@ var clarityProcessSnapshotVersionApiSchema2 = z323.discriminatedUnion(
     clarityProcessSnapshotBaseApiSchema2.extend({
       kind: z323.literal("current_process"),
       source_snapshot_id: z323.null(),
-      ...versionNumberApiField2
+      ...versionNumberApiField2,
+      ...versionCreatorEmailApiField2
     }).omit({ updated_at: true }),
     clarityProcessSnapshotBaseApiSchema2.extend({
       kind: z323.literal("transformation_proposal"),
       source_snapshot_id: z323.guid(),
-      ...versionNumberApiField2
+      ...versionNumberApiField2,
+      ...versionCreatorEmailApiField2
     }).omit({ updated_at: true })
   ]
 );
@@ -25180,6 +25216,7 @@ var ALLOWED_GET_PATTERNS = [
   // Org-wide agent inventory with last-run and schedule state — the
   // org-level sibling of the team `agents` list, same disclosure tier.
   new RegExp(`^organizations/${UUID}/agents$`),
+  new RegExp(`^organizations/${UUID}/runs$`),
   new RegExp(`^organizations/${UUID}/insights/metrics$`),
   new RegExp(`^organizations/${UUID}/insights/usage-chart$`),
   new RegExp(`^organizations/${UUID}/insights/headline$`),
@@ -30327,6 +30364,21 @@ var AGENT_CHAT_RUNTIME_FALLBACK_REASONS = [
   "opted_out",
   "cli_not_ready"
 ];
+var skillKeySchema = z722.string().trim().min(1).max(80);
+var agentChatSkillsSnapshotSchema = z722.object({
+  keys: z722.array(skillKeySchema).max(64),
+  source: z722.enum(["fresh", "reused", "restored"])
+});
+var legacySkillsSnapshotSchema = z722.object({
+  gated: z722.array(skillKeySchema).max(32),
+  always: z722.array(skillKeySchema).max(16),
+  source: z722.enum(["fresh", "reconcile"])
+}).transform(
+  ({ gated, always, source }) => ({
+    keys: [.../* @__PURE__ */ new Set([...gated, ...always])],
+    source: source === "reconcile" ? "reused" : source
+  })
+);
 var agentChatMessageMetadataSchema = z722.object({
   /**
    * The Duvo page the user was on when they sent the message. All structured
@@ -30375,22 +30427,18 @@ var agentChatMessageMetadataSchema = z722.object({
     source: z722.string().trim().min(1).max(120)
   }).optional(),
   /**
-   * Confirmed meta-agent companion skills on disk for THIS turn. Written at
-   * dispatch after seed/reconcile so Chat Debugger can show what Ask Duvo
-   * actually had after the sandbox is gone. Deliberately NOT in the response
-   * projection: admin transcript only, like `connections` and `synthetic`.
+   * Confirmed startup skills on disk for THIS turn. Written before dispatch
+   * after initial seeding, reuse, or restoration so Chat Debugger can show
+   * what Ask Duvo actually had after the sandbox is gone. Deliberately NOT in
+   * the response projection: admin transcript only, like `connections` and `synthetic`.
    */
-  skills: z722.object({
-    gated: z722.array(z722.string().trim().min(1).max(80)).max(32),
-    always: z722.array(z722.string().trim().min(1).max(80)).max(16),
-    source: z722.enum(["fresh", "reconcile"])
-  }).optional(),
+  skills: agentChatSkillsSnapshotSchema.or(legacySkillsSnapshotSchema).optional(),
   /**
    * Which tool transport THIS turn was dispatched with. `mcpServers` is the
    * key set of the exact map handed to cc-server: the SDK mounts nothing over
    * HTTP beyond that map, so the public `duvo` server's absence here is proof
    * it was not mounted for the turn, independent of whether any tool was
-   * called. A v2 chat that falls back to MCP names why in `fallbackReason`.
+   * called. Historical MCP fallbacks may name why in `fallbackReason`.
    * Admin transcript only, like `skills` — not in the response projection.
    */
   runtime: z722.object({
@@ -31707,6 +31755,11 @@ var BUILDER_RUN_STATUSES2 = [
   "waiting_for_input",
   "waiting_for_approve"
 ];
+var BUILDER_RUN_WARNING_CODES2 = ["connection_not_in_team_catalog"];
+var builderRunWarningSchema2 = z83.object({
+  code: z83.enum(BUILDER_RUN_WARNING_CODES2),
+  detail: z83.string().describe("Human-readable specifics, e.g. the slugs that did not resolve")
+});
 var builderRunStatusSchema2 = z83.object({
   id: z83.string(),
   status: z83.enum(BUILDER_RUN_STATUSES2),
@@ -31718,7 +31771,10 @@ var builderRunStatusSchema2 = z83.object({
   // to work.
   checkpoint_config: storedStepConfigValueSchema2.nullable(),
   pending_user_questions: askUserQuestionInputSchema2.nullable(),
-  schedule_suggested: z83.boolean().optional()
+  schedule_suggested: z83.boolean().optional(),
+  // Optional rather than nullable-required: an existing client polling this
+  // endpoint must keep parsing a response that predates the column.
+  warnings: z83.array(builderRunWarningSchema2).nullable().optional()
 });
 var MAX_CASE_ATTACHMENT_BYTES2 = 50 * 1024 * 1024;
 var CASE_ATTACHMENT_STATUS2 = {
@@ -32986,6 +33042,11 @@ var FEATURE_FLAG_CATALOGUE = {
     defaultValue: false,
     description: "Routes the Agent Builder prompt input through Ask Duvo instead of building the AOP inline: the welcome hero and the config-editor composer hand their prompt to a fresh Ask Duvo chat that continues the conversation, and the builder input hides itself once handed off. When off, both inputs keep generating and editing the AOP in place. Requires AGENT_CHAT \u2014 the handoff needs the chat surface to land in, so with AGENT_CHAT off this flag does nothing. Separate from AGENT_CHAT so the builder handoff can roll out independently of the rest of Ask Duvo. Off by default for staged rollout."
   },
+  BROWSING_RECORDING_SCREENSHOTS: {
+    key: "browsing_recording_screenshots",
+    defaultValue: false,
+    description: "Per-team opt-in for capturing a screenshot on each action during a browsing recording. When on, `begin-recording` opens a CDP connection to the Browserbase session for the recording's lifetime and writes a JPEG per action into the recording bucket, which completion then publishes with the skill. When off (default), no connection is opened and recordings complete exactly as they did before screenshots existed. This is the kill switch for the capture path: it runs against every page the user visits during a recording, so it must be possible to turn off without a deploy."
+  },
   AGENT_CHAT: {
     key: "agent_chat",
     defaultValue: false,
@@ -33276,6 +33337,11 @@ var FEATURE_FLAG_CATALOGUE = {
     defaultValue: false,
     description: "Master switch for Pulse live Connection data through the `window.duvo.mcp` view-time bridge. When ON, generation can author live sections for any backend-resolved Connection. Ingestion keeps tools that the Connection marks as read-only and that pass the server read-only name policy. The backend executor serves creator-only reads from the stored dashboard manifest. Connections with user-supplied URLs stay on the static build-time path until the backend has an SSRF-safe MCP transport. A validated live manifest makes the Pulse private, removes existing member shares, and blocks new sharing. When OFF (default), generation bakes Connection data into the HTML, ingestion clears stale manifest authority without contacting Connections, the canvas omits the bridge, and the executor refuses all calls. SECURITY: the bridge uses the opaque-origin sandbox postMessage broker (DUVO-6410 / PR #6884). The frame has no credentials. The backend resolves the artifact from the trusted proxy-stamped `X-Pulse-Artifact-Id` header and enforces the artifact manifest. Shared-viewer reads require a separate trust model."
   },
+  RECORDED_SKILL_DETAILS: {
+    key: "recorded_skill_details",
+    defaultValue: false,
+    description: "Enables the full-page detail experience for recorded skills and workflows, including revision history, recorded-step playback, screenshot review, and detail-page actions. When off, skill and workflow cards open the existing staging dialogs and direct detail URLs return to those dialogs. Off-by-default for staged rollout."
+  },
   SHARED_CONNECTIONS: {
     key: "shared_connections",
     defaultValue: false,
@@ -33502,6 +33568,7 @@ function readDesktopStepParams(step) {
     double: params.double === true,
     modifiers: strArray(params.modifiers),
     key: str(params, "key"),
+    typedText: str(params, "typedText"),
     textLength: num(params, "textLength"),
     scroll: readScroll(params),
     find: readFind(params),
@@ -33606,8 +33673,13 @@ var mcpStepSchema = z103.object({
   params: z103.record(z103.string(), z103.unknown()).describe("Tool-specific parameters"),
   fallbackSelectors: z103.array(z103.string()).optional().describe("Alternative CSS selectors if primary fails"),
   description: z103.string().optional().describe("Human-readable step description"),
-  screenshot: z103.string().optional().describe("Base64 screenshot at this step for visual context"),
+  screenshot: z103.string().optional().describe(
+    "Path to this step's captured frame, relative to the skill root (e.g. `assets/screenshots/12.jpg`). Never inline image data \u2014 the frame is a separate asset in the skill bundle."
+  ),
   snapshot: z103.string().optional().describe("DOM snapshot in accessibility tree format at this step"),
+  coordinates: z103.object({ x: z103.number(), y: z103.number() }).optional().describe(
+    "Where in the viewport the action happened, in CSS pixels relative to `viewport`. Presentation only \u2014 replay targets the element, never the point \u2014 so a player can mark the spot on this step's `screenshot`."
+  ),
   framePath: z103.array(z103.number()).optional().describe(
     "Index-based path to the target iframe (e.g., [0] for first child iframe, [1, 0] for nested)"
   ),
@@ -34327,6 +34399,43 @@ var computerUseElementTargetSchema = z109.object({
   /** Convenience flag: `matchCount === 1`. Absent on older recordings. */
   unique: z109.boolean().optional()
 });
+var EDITABLE_COMPUTER_USE_ROLES = /* @__PURE__ */ new Set([
+  "combobox",
+  "document",
+  "edit",
+  "entry",
+  "searchbox",
+  "search box",
+  "text",
+  "textbox"
+]);
+var SENSITIVE_COMPUTER_USE_FIELD_PATTERN = /\b(?:account number|address|api key|card number|credit card|cvc|cvv|date of birth|dob|e\s*mail|first name|full name|iban|last name|one time|otp|passcode|password|phone|pin|routing number|security code|secret|social security|ssn|token|user name|username|verification code)\b/i;
+function canCaptureComputerUseTypedText(target) {
+  const element = target?.element;
+  if (!element) {
+    return false;
+  }
+  const identity = [
+    target.selector,
+    element.role,
+    element.name,
+    element.automationId,
+    element.className
+  ].filter((value) => Boolean(value)).join(" ");
+  const normalizedIdentity = identity.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ");
+  if (!identity || SENSITIVE_COMPUTER_USE_FIELD_PATTERN.test(normalizedIdentity)) {
+    return false;
+  }
+  const role = element.role?.trim().toLowerCase();
+  const hasFieldIdentity = Boolean(
+    element.name?.trim() || element.automationId?.trim() || element.className?.trim()
+  );
+  return Boolean(
+    role && EDITABLE_COMPUTER_USE_ROLES.has(role) && hasFieldIdentity
+  );
+}
+__name(canCaptureComputerUseTypedText, "canCaptureComputerUseTypedText");
+__name3(canCaptureComputerUseTypedText, "canCaptureComputerUseTypedText");
 var computerUseElementResolutionSchema = z109.object({
   target: computerUseElementTargetSchema.nullable(),
   activeWindow: z109.string().nullable()
@@ -34372,11 +34481,11 @@ var computerUseScrollEventSchema = computerUseEventBaseSchema.extend({
 });
 var computerUseTypeEventSchema = computerUseEventBaseSchema.extend({
   type: z109.literal("type"),
-  /** Number of characters typed (redacted; no literal text). */
+  /** Number of characters typed. */
   textLength: z109.number().int().nonnegative(),
   /**
-   * @deprecated Never persisted. Literal typed text can contain secrets; the
-   * recorder sends `textLength` instead and the backend strips any `text`.
+   * Present only when the focused control is a known non-sensitive text field.
+   * Sensitive and unresolved controls keep only `textLength`.
    */
   text: z109.string().optional()
 });
@@ -44966,7 +45075,7 @@ var CLARITY_READ_TOOLS = [
         path: "/v2/clarity/processes/:processId/members"
       }
     ],
-    description: "List users with accepted access to a Clarity process."
+    description: "List users with accepted access to a Clarity process, plus the people invited who have not accepted."
   },
   {
     name: "listClarityFolders",
@@ -49652,10 +49761,18 @@ var processMemberSchema = z147.object({
   role: z147.string().nullable(),
   createdAt: z147.string()
 });
+var processPendingInviteSchema = z147.object({
+  id: z147.guid(),
+  email: z147.string(),
+  createdAt: z147.string()
+});
 var processMembersResponseSchema = z147.object({
   visibility: z147.enum(["team", "restricted"]),
   owner: processAccessUserSchema,
-  members: z147.array(processMemberSchema)
+  members: z147.array(processMemberSchema),
+  // Defaulted so a backend that predates the field still parses, and so the
+  // renderer never has to branch on undefined.
+  pending: z147.array(processPendingInviteSchema).default([])
 });
 var MEMBER_COLUMNS = [
   { header: "ID", cell: /* @__PURE__ */ __name((member) => member.id, "cell") },
@@ -49671,6 +49788,18 @@ var MEMBER_COLUMNS = [
   },
   { header: "ROLE", cell: /* @__PURE__ */ __name((member) => member.role ?? "", "cell") }
 ];
+var PENDING_COLUMNS = [
+  { header: "ID", cell: /* @__PURE__ */ __name((invite) => invite.id, "cell") },
+  {
+    header: "EMAIL",
+    cell: /* @__PURE__ */ __name((invite) => invite.email, "cell"),
+    maxWidth: 40
+  },
+  {
+    header: "INVITED",
+    cell: /* @__PURE__ */ __name((invite) => invite.createdAt, "cell")
+  }
+];
 function registerClarityProcessAdministration(clarity) {
   registerGuidance(clarity);
   registerSettings(clarity);
@@ -49709,8 +49838,10 @@ function registerSharing(clarity) {
 }
 __name(registerSharing, "registerSharing");
 function registerMembers(clarity) {
-  const members = clarity.command("members").description("Manage accepted access to a Clarity process");
-  members.command("list <process-id>").description("List accepted process members").option("--json", "output raw JSON from the API").action(listMembers);
+  const members = clarity.command("members").description(
+    "Manage a Clarity process's access: accepted members and pending invitations"
+  );
+  members.command("list <process-id>").description("List accepted process members and pending invitations").option("--json", "output raw JSON from the API").action(listMembers);
   members.command("remove <process-id> <member-id>").description("Remove a member's accepted process access").option("-y, --yes", "skip the confirmation prompt").option("--json", "output raw JSON from the API").action(removeMember);
 }
 __name(registerMembers, "registerMembers");
@@ -49844,16 +49975,21 @@ async function listMembers(rawProcessId, options) {
   });
   const response = parseClarityResponse(processMembersResponseSchema, raw);
   if (options.json) {
-    printJson(response);
+    printJson(raw);
     return;
   }
   const owner = response.owner.name ?? response.owner.email ?? response.owner.id;
   console.log(`Visibility: ${response.visibility}; owner: ${owner}`);
   if (response.members.length === 0) {
     console.log("No accepted process members found.");
-    return;
+  } else {
+    console.log(renderTable(MEMBER_COLUMNS, response.members));
+  }
+  if (response.pending.length > 0) {
+    console.log("");
+    console.log("Invited, not yet accepted:");
+    console.log(renderTable(PENDING_COLUMNS, response.pending));
   }
-  console.log(renderTable(MEMBER_COLUMNS, response.members));
 }
 __name(listMembers, "listMembers");
 async function removeMember(rawProcessId, rawMemberId, options) {
@@ -59894,7 +60030,7 @@ function registerRunsList(runs) {
     "filter by user ID (superadmins only; other callers always see their own runs)"
   ).option("--case-queue <id>", "filter by queue ID").option("--source <source>", "filter by source").option("--search <query>", "free-text search across runs").option(
     "--has-issues <true|false>",
-    `show only runs with (or without) issues (${HAS_ISSUES_VALUES.join("|")})`
+    "filter on the run's latest successful evaluation: true = only runs it flagged, false = only runs it did not. Only the latest counts \u2014 an older flag does not match \u2014 and a run whose latest evaluation errored, or that has none, counts as unflagged"
   ).option(
     "--since <iso>",
     "include runs completed at or after this ISO-8601 timestamp"
@@ -63256,21 +63392,237 @@ ${total_teams} teams${suffix} \xB7 ${org_member_count} org members`
 }
 __name(registerTeamsOrgMetrics, "registerTeamsOrgMetrics");
 
-// src/commands/teams/org-usage.ts
+// src/commands/teams/org-runs.ts
 import { z as z171 } from "zod";
+var DEFAULT_LIMIT25 = 20;
+var MIN_LIMIT27 = 1;
+var MAX_LIMIT25 = 500;
+var NAME_PREVIEW_WIDTH2 = 28;
+var ISSUE_SEVERITIES = ["critical", "medium", "low"];
+var RUN_STATUSES = [
+  ...AGENT_RUN_STATUSES2,
+  "stopped",
+  "needs_attention"
+];
+var HAS_ISSUES_VALUES2 = ["true", "false"];
+var orgRunSchema = z171.object({
+  id: z171.string(),
+  status: z171.string(),
+  source: z171.string().nullable(),
+  team_id: z171.string(),
+  team_name: z171.string().nullable(),
+  agent_id: z171.string(),
+  agent_name: z171.string(),
+  build_id: z171.string().nullable(),
+  automation_id: z171.string().nullable(),
+  automation_name: z171.string().nullable(),
+  user_id: z171.string().nullable(),
+  created_at: z171.string(),
+  updated_at: z171.string(),
+  started_at: z171.string().nullable(),
+  completed_at: z171.string().nullable()
+});
+var orgRunsResponseSchema = z171.object({
+  runs: z171.array(orgRunSchema),
+  total: z171.number().nullable(),
+  limit: z171.number(),
+  // Optional so the CLI keeps working against an API that predates them.
+  created_after: z171.string().nullable().optional(),
+  default_window_applied: z171.boolean().optional(),
+  has_more: z171.boolean().optional(),
+  next_cursor: z171.string().nullable().optional()
+});
+var DEFAULT_WINDOW_NOTE = "default window: last 7 days \u2014 pass --created-after (or any time bound) to widen";
+function buildOrgRunsQuery(options, limit) {
+  const query = new URLSearchParams({ limit: String(limit) });
+  if (options.cursor) {
+    query.set("cursor", options.cursor);
+  }
+  const filters = [
+    ["team_id", options.team],
+    ["agent_id", options.agent],
+    ["status", options.status],
+    ["source", options.source],
+    ["has_issues", options.hasIssues],
+    ["issue_severity", options.issueSeverity],
+    ["created_after", options.createdAfter],
+    ["created_before", options.createdBefore],
+    ["started_after", options.startedAfter],
+    ["started_before", options.startedBefore],
+    // `--since` / `--until` are the API's aliases for the completion window,
+    // kept because `duvo runs list` ships them. Send whichever the caller
+    // passed under its own name: the API rejects both at once, so forwarding
+    // both when both are set surfaces that rather than silently picking one.
+    ["completed_after", options.completedAfter],
+    ["completed_before", options.completedBefore],
+    ["since", options.since],
+    ["until", options.until],
+    ["count_only", options.countOnly ? "true" : void 0],
+    ["include_total", options.includeTotal ? "true" : void 0]
+  ];
+  for (const [param, value] of filters) {
+    if (value !== void 0) {
+      query.set(param, value);
+    }
+  }
+  return query;
+}
+__name(buildOrgRunsQuery, "buildOrgRunsQuery");
+function registerTeamsOrgRuns(teams) {
+  teams.command("org-runs <org-id>").description("List runs across every team in an organization").option("--team <team-id>", "only runs on this team").option("--agent <agent-id>", "only runs for this agent").option(
+    "--status <status>",
+    `only runs with this status (${RUN_STATUSES.join(" | ")})`
+  ).option("--source <source>", "only runs from this source").option(
+    "--has-issues <true|false>",
+    "filter on the run's latest successful evaluation: true = only runs it flagged, false = only runs it did not. Only the latest counts \u2014 an older flag does not match \u2014 and a run whose latest evaluation errored, or that has none, counts as unflagged"
+  ).option(
+    "--issue-severity <severity>",
+    `only runs flagged at this severity (${ISSUE_SEVERITIES.join(" | ")})`
+  ).option(
+    "--created-after <iso>",
+    "runs created at or after this ISO timestamp. Every run has a creation time, so this window returns all runs in a period whatever state they reached"
+  ).option(
+    "--created-before <iso>",
+    "runs created before this ISO timestamp (exclusive)"
+  ).option(
+    "--started-after <iso>",
+    "runs that started at or after this ISO timestamp. Runs that never started are excluded"
+  ).option(
+    "--started-before <iso>",
+    "runs that started before this ISO timestamp (use with --status running to find stuck runs, and with --started-after to bound the window)"
+  ).option(
+    "--completed-after <iso>",
+    "runs completed at or after this ISO timestamp. Runs that have not completed are excluded, including stuck ones"
+  ).option(
+    "--completed-before <iso>",
+    "runs completed before this ISO timestamp (exclusive)"
+  ).option(
+    "--since <iso>",
+    "alias of --completed-after, matching `duvo runs list`. Prefer --completed-after"
+  ).option(
+    "--until <iso>",
+    "alias of --completed-before. Prefer --completed-before"
+  ).option("--count-only", "print just the matching total").option(
+    "--include-total",
+    "also return the total matching count. Off by default: counting walks every match where the page stops at --limit, so it costs far more than the rows on a large organization"
+  ).option(
+    "--limit <n>",
+    `page size (${MIN_LIMIT27}-${MAX_LIMIT25}, default ${DEFAULT_LIMIT25})`
+  ).option(
+    "--cursor <cursor>",
+    "resume after a previous page: the value the previous page printed as Next page. The only way to page here \u2014 runs are created constantly, and a cursor cannot repeat or skip a run the way an offset can"
+  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function orgRunsAction(orgId, options) {
+    if (options.issueSeverity && !ISSUE_SEVERITIES.includes(options.issueSeverity)) {
+      throw new CliError(
+        `--issue-severity must be one of: ${ISSUE_SEVERITIES.join(", ")}`
+      );
+    }
+    if (options.status !== void 0 && !RUN_STATUSES.includes(options.status)) {
+      throw new CliError(
+        `--status must be one of: ${RUN_STATUSES.join(", ")}`
+      );
+    }
+    if (options.hasIssues && !HAS_ISSUES_VALUES2.includes(options.hasIssues)) {
+      throw new CliError(
+        `--has-issues must be one of: ${HAS_ISSUES_VALUES2.join(", ")}`
+      );
+    }
+    const { apiKey, apiBaseUrl } = await requireAuthenticatedConfig(this);
+    const limit = parseLimit(options.limit, {
+      defaultValue: DEFAULT_LIMIT25,
+      min: MIN_LIMIT27,
+      max: MAX_LIMIT25
+    });
+    const query = buildOrgRunsQuery(options, limit);
+    const raw = await httpRequest({
+      method: "GET",
+      path: `/v2/organizations/${encodeURIComponent(orgId)}/runs?${query.toString()}`,
+      apiKey,
+      apiBaseUrl
+    });
+    if (options.json) {
+      printJson(raw);
+      return;
+    }
+    const parsed = orgRunsResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        `Unexpected response from GET /v2/organizations/:orgId/runs: ${parsed.error.message}`
+      );
+    }
+    const { runs, total } = parsed.data;
+    const windowNote = parsed.data.default_window_applied ? ` (${DEFAULT_WINDOW_NOTE})` : "";
+    if (options.countOnly) {
+      if (total === null) {
+        throw new CliError(
+          "The API returned no total for a --count-only request."
+        );
+      }
+      console.log(`${total}${windowNote}`);
+      return;
+    }
+    if (runs.length === 0) {
+      console.log(`No runs matched.${windowNote}`);
+      return;
+    }
+    console.log(
+      renderTable(
+        [
+          { header: "ID", cell: /* @__PURE__ */ __name((r) => r.id, "cell") },
+          { header: "STATUS", cell: /* @__PURE__ */ __name((r) => r.status, "cell") },
+          {
+            header: "AGENT",
+            cell: /* @__PURE__ */ __name((r) => r.agent_name, "cell"),
+            maxWidth: NAME_PREVIEW_WIDTH2
+          },
+          {
+            header: "TEAM",
+            cell: /* @__PURE__ */ __name((r) => r.team_name ?? "-", "cell"),
+            maxWidth: NAME_PREVIEW_WIDTH2
+          },
+          { header: "SOURCE", cell: /* @__PURE__ */ __name((r) => r.source ?? "-", "cell") },
+          { header: "STARTED", cell: /* @__PURE__ */ __name((r) => r.started_at ?? "-", "cell") },
+          {
+            header: "COMPLETED",
+            cell: /* @__PURE__ */ __name((r) => r.completed_at ?? "-", "cell")
+          }
+        ],
+        runs
+      )
+    );
+    const { next_cursor: nextCursor } = parsed.data;
+    const nextPageHint = nextCursor ? ` Next page: --cursor '${nextCursor}'` : "";
+    if (total !== null) {
+      console.log(
+        `
+Showing ${runs.length} of ${total} runs${windowNote}.${nextPageHint}`
+      );
+      return;
+    }
+    console.log(
+      nextCursor ? `
+Showing ${runs.length} runs${windowNote}. More available.${nextPageHint}` : `
+Showing ${runs.length} runs${windowNote}; pass --include-total for the total`
+    );
+  }, "orgRunsAction"));
+}
+__name(registerTeamsOrgRuns, "registerTeamsOrgRuns");
+
+// src/commands/teams/org-usage.ts
+import { z as z173 } from "zod";
 var GRANULARITIES = ["day", "week", "month"];
 var DEFAULT_LOOKBACK_MS = 30 * 24 * 60 * 60 * 1e3;
-var bucketSchema = z171.object({
-  period: z171.string(),
-  total_runs: z171.number(),
-  scheduled_runs: z171.number(),
-  on_demand_runs: z171.number()
-});
-var usageChartResponseSchema = z171.object({
-  buckets: z171.array(bucketSchema),
-  granularity: z171.enum(GRANULARITIES),
-  truncated: z171.boolean(),
-  total_teams: z171.number()
+var bucketSchema = z173.object({
+  period: z173.string(),
+  total_runs: z173.number(),
+  scheduled_runs: z173.number(),
+  on_demand_runs: z173.number()
+});
+var usageChartResponseSchema = z173.object({
+  buckets: z173.array(bucketSchema),
+  granularity: z173.enum(GRANULARITIES),
+  truncated: z173.boolean(),
+  total_teams: z173.number()
 });
 function registerTeamsOrgUsage(teams) {
   teams.command("org-usage <org-id>").description("Show org-wide run volume over time (scheduled vs on-demand)").option("--start-date <date>", "window start (ISO 8601, default 30d ago)").option("--end-date <date>", "window end (ISO 8601, default now)").option(
@@ -63329,17 +63681,17 @@ function registerTeamsOrgUsage(teams) {
 __name(registerTeamsOrgUsage, "registerTeamsOrgUsage");
 
 // src/commands/teams/org.ts
-import { z as z173 } from "zod";
-var orgTeamSchema = z173.object({
-  id: z173.string(),
-  name: z173.string(),
-  userIsMember: z173.boolean(),
-  userRole: z173.string().nullable(),
-  memberCount: z173.number()
+import { z as z174 } from "zod";
+var orgTeamSchema = z174.object({
+  id: z174.string(),
+  name: z174.string(),
+  userIsMember: z174.boolean(),
+  userRole: z174.string().nullable(),
+  memberCount: z174.number()
 });
-var listOrgTeamsResponseSchema = z173.object({
-  teams: z173.array(orgTeamSchema),
-  total: z173.number()
+var listOrgTeamsResponseSchema = z174.object({
+  teams: z174.array(orgTeamSchema),
+  total: z174.number()
 });
 var SORT_BY_VALUES = ["createdAt", "name"];
 function registerTeamsOrg(teams) {
@@ -63400,17 +63752,17 @@ function registerTeamsOrg(teams) {
 __name(registerTeamsOrg, "registerTeamsOrg");
 
 // src/commands/teams/orgs.ts
-import { z as z174 } from "zod";
-var orgMembershipSchema = z174.object({
-  organization: z174.object({
-    id: z174.string(),
-    name: z174.string()
+import { z as z175 } from "zod";
+var orgMembershipSchema = z175.object({
+  organization: z175.object({
+    id: z175.string(),
+    name: z175.string()
   }),
-  role: z174.string(),
-  memberCount: z174.number()
+  role: z175.string(),
+  memberCount: z175.number()
 });
-var listMyOrganizationsResponseSchema = z174.object({
-  memberships: z174.array(orgMembershipSchema)
+var listMyOrganizationsResponseSchema = z175.object({
+  memberships: z175.array(orgMembershipSchema)
 });
 function registerTeamsOrgs(teams) {
   teams.command("orgs").description("List the organizations you belong to and your role in each").option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function orgsAction(options) {
@@ -63460,6 +63812,7 @@ function registerTeams(program) {
   registerTeamsOrgAgents(teams);
   registerTeamsOrgInsights(teams);
   registerTeamsOrgMetrics(teams);
+  registerTeamsOrgRuns(teams);
   registerTeamsOrgUsage(teams);
 }
 __name(registerTeams, "registerTeams");
@@ -63588,7 +63941,7 @@ __name(isStandaloneBinary, "isStandaloneBinary");
 import { createRequire } from "node:module";
 function getPackageMeta() {
   if (true) {
-    return { name: "@duvoai/cli", version: "1.71.2" };
+    return { name: "@duvoai/cli", version: "1.72.0" };
   }
   const require2 = createRequire(import.meta.url);
   const raw = require2("../../package.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@duvoai/cli",
-  "version": "1.71.2",
+  "version": "1.72.0",
   "description": "Command-line interface for the Duvo public API",
   "bin": {
     "duvo": "./dist/bin/duvo.js"