@ekanos/cli 0.14.0 → 0.16.0

package/dist/commands/team-agents-agents.js

@@ -1,22 +1,28 @@
-import { AgentRunListSchema, TeamAgentChangeResultSchema, TeamAgentListSchema, TeamAgentPolicySchema, TeamAgentSkillsSchema, } from '@ekanos/integration-schema';
+import { AgentRunListSchema, TeamAgentChangeResultSchema, TeamAgentListSchema, TeamAgentPolicySchema, TeamAgentSkillsSchema, TeamAgentTagsSchema, } from '@ekanos/integration-schema';
 import { invalidStateError, notFoundError, usageError } from '../errors.js';
+import { cli } from '../invocation.js';
 import { call, listTeamEvents } from '../teams-api.js';
-import { REASON_WORDS, agentReadiness, channelFix, describeAgentReadiness, describeHold, fixLine, liveLine, reachedVia, requirementFix, } from './team-agent-readiness.js';
+import { REASON_WORDS, agentReadiness, channelFix, describeAgentReadiness, fixLine, liveLine, reachedVia, requirementFix, } from './team-agent-readiness.js';
 import { requireOperand, usageFor } from './team-agents.js';
+import { runTeamAgentDefine } from './team-agents-define.js';
+import { confirmChange } from './teams-lifecycle.js';
 /**
- * `ekanos teams agents list|show|enable|confirm|disable|pin|unpin|policy|skills` —
+ * `ekanos teams agents list|show|create|apply|enable|confirm|disable|archive|unarchive|pin|unpin|policy|skills|tags` —
  * a team's provided agents, turned on, versioned, given an approval policy
- * and skills by the Source admin. `enable|pin … --draft` puts one team on
+ * and skills by the Source admin; and the team's own and personal agents,
+ * made and changed from an agent.json with `create|apply`
+ * (team-agents-define.ts), turned on with `enable`. A personal agent is
+ * listed and shown to everyone, and changed by its creator alone. `enable|pin … --draft` puts one team on
  * the template's latest, unpublished version to test it there before
- * publishing. `confirm` (and `--confirm-access`) is the one thing only the
- * person the agent runs as can do: consent, as themselves, that it may use
- * their connections in runs no one watches.
+ * publishing. `confirm` (and `--confirm-access`) records the caller's own
+ * confirmation that it may use its connections in runs no one watches:
+ * whoever sets an agent up confirms it (plan 247.2), never a member.
  * `show` answers "is this agent live, and if not, why?" for one agent; `list`
  * ends each agent with the same verdict.
  */
 export async function runTeamAgentsArea(ctx, run) {
     var _a, _b, _c;
-    var _d, _e, _f;
+    var _d, _e, _f, _g, _h;
     const team = requireOperand(run.operands[0], 'team slug', 'agents');
     const base = `/api/partner/teams/${encodeURIComponent(team)}/agents`;
     if (run.verb === 'list') {
@@ -27,14 +33,22 @@ export async function runTeamAgentsArea(ctx, run) {
             source: run.source,
         }));
         const target = { team: list.team.slug, source: run.source };
+        const own = (_d = list.ownAgents) !== null && _d !== void 0 ? _d : [];
         return ctx.succeed(Object.assign(Object.assign({ host: run.host }, list), { agents: list.agents.map((entry) => (Object.assign(Object.assign({}, entry), { readiness: agentReadiness(entry, target) }))) }), [
             ctx.ui.result({
-                title: list.agents.length === 0
+                title: list.agents.length === 0 && own.length === 0
                     ? `No agents are provided for ${list.team.slug}`
                     : `Agents for ${list.team.slug}`,
-                tone: list.agents.length === 0 ? 'warn' : 'ok',
+                tone: list.agents.length === 0 && own.length === 0 ? 'warn' : 'ok',
             }),
             ...list.agents.map((entry) => describeEntry(entry, list.team.slug, run.source)),
+            ...(own.length > 0
+                ? [
+                    `
+The team's own and personal agents:`,
+                    ...own.map((agent) => describeOwnAgent(agent, list.team.slug, run.source)),
+                ]
+                : []),
             list.mcpServers.length > 0
                 ? `\nMCP servers: ${list.mcpServers.map((server) => `${server.key} (${server.status})`).join(', ')}`
                 : '',
@@ -42,6 +56,9 @@ export async function runTeamAgentsArea(ctx, run) {
             .filter(Boolean)
             .join('\n'));
     }
+    if (run.verb === 'create' || run.verb === 'apply') {
+        return runTeamAgentDefine(ctx, run, run.verb);
+    }
     const key = requireOperand(run.operands[1], 'agent key', 'agents');
     const path = `${base}/${encodeURIComponent(key)}`;
     switch (run.verb) {
@@ -57,8 +74,8 @@ export async function runTeamAgentsArea(ctx, run) {
             if (draft)
                 requireDraftHost(result, 'enabled');
             return ctx.succeed(Object.assign({ host: run.host }, result), describeChange(result, `${draft
-                ? `Testing draft v${(_d = result.version) !== null && _d !== void 0 ? _d : '?'} of ${result.slug} on ${result.team.slug}`
-                : `Turned on ${result.slug} for ${result.team.slug}`}${confirmAccess && result.accessConfirmed ? ', and you confirmed it may use your connections' : ''}`, run.source, { confirmRequested: confirmAccess }));
+                ? `Testing draft v${(_e = result.version) !== null && _e !== void 0 ? _e : '?'} of ${result.slug} on ${result.team.slug}`
+                : `Turned on ${result.slug} for ${result.team.slug}`}${confirmAccess && result.accessConfirmed ? ', and you confirmed what it may use' : ''}`, run.source, { confirmRequested: confirmAccess }));
         }
         case 'confirm': {
             expectOperands(run, 2);
@@ -66,9 +83,7 @@ export async function runTeamAgentsArea(ctx, run) {
             // the host refuses if the version moved (AGENT_VERSION_CHANGED).
             const shown = await shownVersion(ctx, run, base, key);
             const result = await change(run, `${path}/confirm`, 'POST', shown === null ? {} : { expectedVersion: shown });
-            return ctx.succeed(Object.assign({ host: run.host }, result), describeChange(result, result.advanced
-                ? `You confirmed the update: ${result.slug} on ${result.team.slug} moved from v${result.advanced.from} to v${result.advanced.to}`
-                : `You confirmed ${result.slug} on ${result.team.slug} may use your connections`, run.source, { confirmRequested: true }));
+            return ctx.succeed(Object.assign({ host: run.host }, result), describeChange(result, `You confirmed what ${result.slug} on ${result.team.slug} may use`, run.source, { confirmRequested: true }));
         }
         case 'disable': {
             expectOperands(run, 2);
@@ -86,7 +101,7 @@ export async function runTeamAgentsArea(ctx, run) {
                     draft: true,
                 });
                 requireDraftHost(result, 'pinned');
-                return ctx.succeed(Object.assign({ host: run.host }, result), describeChange(result, `Testing draft v${(_e = result.version) !== null && _e !== void 0 ? _e : '?'} of ${result.slug} on ${result.team.slug}`, run.source));
+                return ctx.succeed(Object.assign({ host: run.host }, result), describeChange(result, `Testing draft v${(_f = result.version) !== null && _f !== void 0 ? _f : '?'} of ${result.slug} on ${result.team.slug}`, run.source));
             }
             expectOperands(run, 3);
             const version = Number(run.operands[2]);
@@ -96,13 +111,40 @@ export async function runTeamAgentsArea(ctx, run) {
                     : 'Name the version to pin.', `e.g. "ekanos teams agents pin ${team} ${key} 3", or "--draft" to test the unpublished draft. "ekanos agents show ${key}" lists its versions.`);
             }
             const result = await change(run, `${path}/pin`, 'PUT', { version });
-            return ctx.succeed(Object.assign({ host: run.host }, result), describeChange(result, `${result.team.slug} stays on v${(_f = result.version) !== null && _f !== void 0 ? _f : version} of ${result.slug}`, run.source));
+            return ctx.succeed(Object.assign({ host: run.host }, result), describeChange(result, `${result.team.slug} stays on v${(_g = result.version) !== null && _g !== void 0 ? _g : version} of ${result.slug}`, run.source));
         }
         case 'unpin': {
             expectOperands(run, 2);
             const result = await change(run, `${path}/pin`, 'PUT', { version: null });
             return ctx.succeed(Object.assign({ host: run.host }, result), describeChange(result, `${result.team.slug} follows each published version of ${result.slug}`, run.source));
         }
+        case 'archive': {
+            expectOperands(run, 2);
+            // Asked before any request: a script or an agent run passes --yes.
+            if (!run.args.yes) {
+                await confirmChange(ctx, run.args, {
+                    what: `Archiving ${key} on ${team} takes it off the team's list: nothing starts it until it is unarchived and turned on again. Its runs, approvals and setup are kept.`,
+                    command: `${cli()} teams agents archive ${team} ${key} --yes`,
+                    question: `Archive ${key} on ${team}? [y/N]`,
+                });
+            }
+            const result = await change(run, `${path}/archive`, 'POST', {});
+            return ctx.succeed(Object.assign({ host: run.host }, result), [
+                `✓ Archived ${result.slug} on ${result.team.slug}`,
+                `  Bring it back, paused: ${cli()} teams agents unarchive ${result.team.slug} ${result.slug} --source ${run.source}`,
+            ].join('\n'));
+        }
+        case 'unarchive': {
+            expectOperands(run, 2);
+            const result = await change(run, `${path}/unarchive`, 'POST', {});
+            return ctx.succeed(Object.assign({ host: run.host }, result), [
+                `✓ Unarchived ${result.slug} on ${result.team.slug}: it is paused`,
+                `  runs as ${(_h = result.runsAs) !== null && _h !== void 0 ? _h : 'nobody'}`,
+                `  Next: ${cli()} teams agents enable ${result.team.slug} ${result.slug} --source ${run.source}`,
+            ].join('\n'));
+        }
+        case 'tags':
+            return tags(ctx, run, team, key, `${path}/tags`);
         case 'policy':
             return policy(ctx, run, team, key, `${path}/policy`);
         case 'skills':
@@ -119,13 +161,22 @@ export async function runTeamAgentsArea(ctx, run) {
  * activity reads still answers the rest.
  */
 async function show(ctx, run, base, key) {
-    var _a, _b, _c;
+    var _a;
+    var _b, _c, _d;
     const list = await run.client.call((token) => call(run.host, token, TeamAgentListSchema, {
         method: 'GET',
         path: base,
         source: run.source,
     }));
     const entry = list.agents.find((candidate) => candidate.key === key);
+    // The host finds an agent by its own slug first, as here: a team agent
+    // named like a template that is not turned on is the team agent.
+    const own = (entry === null || entry === void 0 ? void 0 : entry.agent)
+        ? undefined
+        : (_a = list.ownAgents) === null || _a === void 0 ? void 0 : _a.find((candidate) => candidate.slug === key);
+    if (own) {
+        return ctx.succeed({ host: run.host, team: list.team, ownAgent: own }, describeOwnAgent(own, list.team.slug, run.source).trimStart());
+    }
     if (!entry) {
         throw notFoundError(`No agent "${key}" is provided for ${list.team.slug}.`, `"ekanos teams agents list ${list.team.slug}" lists the agents provided for it.`);
     }
@@ -148,13 +199,13 @@ async function show(ctx, run, base, key) {
         team: list.team,
         agent: entry,
         readiness,
-        lastRun: (_a = runs === null || runs === void 0 ? void 0 : runs.runs[0]) !== null && _a !== void 0 ? _a : null,
+        lastRun: (_b = runs === null || runs === void 0 ? void 0 : runs.runs[0]) !== null && _b !== void 0 ? _b : null,
         recentEvents: events
             ? events.events.filter((event) => { var _a; return (_a = entry.agent) === null || _a === void 0 ? void 0 : _a.triggers.some((trigger) => trigger.eventId === event.eventId); })
             : null,
     }, describeAgentReadiness(entry, target, readiness, {
-        runs: (_b = runs === null || runs === void 0 ? void 0 : runs.runs) !== null && _b !== void 0 ? _b : null,
-        events: (_c = events === null || events === void 0 ? void 0 : events.events) !== null && _c !== void 0 ? _c : null,
+        runs: (_c = runs === null || runs === void 0 ? void 0 : runs.runs) !== null && _c !== void 0 ? _c : null,
+        events: (_d = events === null || events === void 0 ? void 0 : events.events) !== null && _d !== void 0 ? _d : null,
     }, list.scope));
 }
 /** A read `show` can do without: on failure, say so and carry on. */
@@ -226,6 +277,57 @@ async function skills(ctx, run, team, key, path) {
     const result = await run.client.call((token) => call(run.host, token, TeamAgentSkillsSchema, Object.assign({ method: change ? 'PUT' : 'GET', path, source: run.source }, (change ? { body: change } : {}))));
     return ctx.succeed(Object.assign({ host: run.host }, result), describeSkills(ctx, result, change));
 }
+/**
+ * `teams agents tags <team> <key> [add|remove <tag>]` — the labels that
+ * organize the team's agents; they grant nothing. A tag the team does not
+ * have yet is made when it is added, as the app's New tag makes it.
+ */
+async function tags(ctx, run, team, key, path) {
+    const [action, tag, extra] = run.operands.slice(2);
+    if (extra !== undefined) {
+        throw usageError(`Unexpected argument "${extra}".`, 'Quote a tag name with spaces, e.g. "Customer support".');
+    }
+    let change = null;
+    if (action === 'add' || action === 'remove') {
+        if (!(tag === null || tag === void 0 ? void 0 : tag.trim())) {
+            throw usageError(`tags ${action} needs a tag.`, `e.g. ${cli()} teams agents tags ${team} ${key} ${action} "Customer support"`);
+        }
+        change = { [action]: tag.trim() };
+    }
+    else if (action !== undefined) {
+        throw usageError(`Unknown tags action "${action}".`, usageFor('agents'));
+    }
+    const result = await run.client.call((token) => call(run.host, token, TeamAgentTagsSchema, Object.assign({ method: change ? 'PUT' : 'GET', path, source: run.source }, (change ? { body: change } : {}))));
+    const title = (change === null || change === void 0 ? void 0 : change.add)
+        ? `Tagged ${result.slug} on ${result.team.slug} "${change.add}"`
+        : (change === null || change === void 0 ? void 0 : change.remove)
+            ? `Took the tag "${change.remove}" off ${result.slug} on ${result.team.slug}`
+            : `Tags of ${result.slug} on ${result.team.slug}`;
+    const lines = [
+        ctx.ui.result({
+            title,
+            tone: 'ok',
+            rows: [
+                [
+                    'tags',
+                    result.tags.length === 0
+                        ? 'none'
+                        : result.tags.map((item) => item.name).join(', '),
+                ],
+            ],
+            notes: result.createdTag
+                ? [
+                    `${result.team.slug} had no tag "${result.createdTag.name}": it was made.`,
+                ]
+                : [],
+        }),
+    ];
+    const others = result.teamTags.filter((item) => !result.tags.some((on) => on.slug === item.slug));
+    if (!change && others.length > 0) {
+        lines.push(`\nThe team's other tags: ${others.map((item) => item.name).join(', ')}`);
+    }
+    return ctx.succeed(Object.assign({ host: run.host }, result), lines.join('\n'));
+}
 function describeSkills(ctx, result, change) {
     const [verb, slug] = (change === null || change === void 0 ? void 0 : change.add)
         ? ['Attached', change.add[0]]
@@ -254,7 +356,6 @@ function describeSkills(ctx, result, change) {
     ]))}`;
 }
 function describePolicy(ctx, policy, changed, source) {
-    var _a;
     // Absent from an older host: say nothing rather than guess.
     const unconfirmed = policy.accessConfirmed === false;
     const head = ctx.ui.result({
@@ -271,7 +372,7 @@ function describePolicy(ctx, policy, changed, source) {
             ...(policy.lockedReason ? [policy.lockedReason] : []),
             ...(unconfirmed
                 ? [
-                    `Not confirmed: until ${(_a = policy.runsAs) !== null && _a !== void 0 ? _a : 'the person it runs as'} confirms it may use their connections, it uses only what needs no confirmation (a looser policy drops a confirmation). They run: ${confirmCommand(policy.team.slug, policy.key, source)} — or, for the team's own agent, confirm on its page in the app`,
+                    `Not confirmed: until you or one of the team's agent managers confirms what it may use, it uses only what needs no confirmation (a looser policy drops a confirmation). Confirm it as yourself with --confirm-access on the change, or for a provided agent ${confirmCommand(policy.team.slug, policy.key, source)}; a team manager can also confirm on its page in the app`,
                 ]
                 : []),
         ],
@@ -287,28 +388,27 @@ function describePolicy(ctx, policy, changed, source) {
     ]))}`;
 }
 /**
- * The version `confirm` is about to approve — the one waiting on a held
- * agent, else the one it runs — printed before it is sent, so the person
- * confirms what they saw. Null when the team's agent has no version to name.
+ * The version `confirm` is about to approve — the one it runs — printed
+ * before it is sent, so the person confirms what they saw. Null when the
+ * team's agent has no version to name.
  */
 async function shownVersion(ctx, run, base, key) {
-    var _a;
-    var _b;
+    var _a, _b;
+    var _c;
     const list = await run.client.call((token) => call(run.host, token, TeamAgentListSchema, {
         method: 'GET',
         path: base,
         source: run.source,
     }));
-    const agent = (_a = list.agents.find((entry) => entry.key === key)) === null || _a === void 0 ? void 0 : _a.agent;
-    if (!agent)
-        return null;
-    if (agent.held) {
-        ctx.log(`Confirming v${agent.held.waiting} of ${key} on ${list.team.slug}: ${describeHold(agent.held)}. It runs v${(_b = agent.version) !== null && _b !== void 0 ? _b : '?'} until then.`);
-        return agent.held.waiting;
+    const own = (_a = list.ownAgents) === null || _a === void 0 ? void 0 : _a.find((entry) => entry.slug === key);
+    if (own) {
+        ctx.log(`Confirming what ${key} v${own.version} on ${list.team.slug} may use (it runs as ${(_c = own.createdBy) !== null && _c !== void 0 ? _c : 'nobody'}).`);
+        return own.version;
     }
-    if (agent.version === null)
+    const agent = (_b = list.agents.find((entry) => entry.key === key)) === null || _b === void 0 ? void 0 : _b.agent;
+    if (!agent || agent.version === null)
         return null;
-    ctx.log(`Confirming ${key} v${agent.version} on ${list.team.slug} may use your connections.`);
+    ctx.log(`Confirming what ${key} v${agent.version} on ${list.team.slug} may use${agent.runsAs ? ` (it runs as ${agent.runsAs})` : ''}.`);
     return agent.version;
 }
 function change(run, path, method, body) {
@@ -320,7 +420,7 @@ function change(run, path, method, body) {
     }));
 }
 function describeEntry(entry, team, source) {
-    var _a, _b, _c, _d, _e, _f, _g;
+    var _a, _b, _c;
     const readiness = agentReadiness(entry, { team, source });
     if (!entry.agent) {
         return `\n${entry.key} — ${entry.name}\n  off · v${(_a = entry.publishedVersion) !== null && _a !== void 0 ? _a : '?'} published\n  ${liveLine(readiness)} · Next: ${readiness.next}`;
@@ -329,29 +429,49 @@ function describeEntry(entry, team, source) {
     const version = versionLabel(agent);
     const lines = [
         `\n${entry.key} — ${entry.name}`,
-        `  ${agent.status} · ${version} · runs as ${(_b = agent.runsAs) !== null && _b !== void 0 ? _b : 'nobody'}${agent.accessConfirmed ? '' : ` · access not confirmed (${(_c = agent.runsAs) !== null && _c !== void 0 ? _c : 'they'}: ekanos teams agents confirm ${team} ${entry.key})`}`,
-        ...(agent.held
-            ? [
-                `  ! held on v${(_d = agent.version) !== null && _d !== void 0 ? _d : '?'}: v${agent.held.waiting} ${describeHold(agent.held)}. It keeps running v${(_e = agent.version) !== null && _e !== void 0 ? _e : '?'} until ${(_f = agent.runsAs) !== null && _f !== void 0 ? _f : 'the person it runs as'} confirms: ${confirmCommand(team, entry.key, source)}`,
-            ]
-            : []),
+        `  ${agent.status} · ${version} · runs as ${(_b = agent.runsAs) !== null && _b !== void 0 ? _b : 'nobody'}${agent.accessConfirmed ? '' : ` · access not confirmed (${confirmCommand(team, entry.key, source)})`}`,
         `  triggers: ${agent.triggers.length === 0 ? 'none' : agent.triggers.map((trigger) => `${trigger.type}${trigger.enabled ? '' : ' (off)'}`).join(', ')}`,
         `  links: ${agent.links.length === 0 ? 'none' : agent.links.map((link) => `${link.kind}${link.mode ? `/${link.mode}` : ''} → ${link.to}`).join(', ')}`,
     ];
     lines.push(...requirementLines(agent.requirements, agent.missing, team, source));
     if (agent.draft)
         lines.push(...draftLines(team, entry.key));
-    lines.push(...channelLines((_g = agent.channels) !== null && _g !== void 0 ? _g : [], team, source));
-    lines.push(`  ${liveLine(readiness, agent)}${readiness.next ? ` · Next: ${readiness.next}` : ''}`);
+    lines.push(...channelLines((_c = agent.channels) !== null && _c !== void 0 ? _c : [], team, source));
+    lines.push(`  ${liveLine(readiness)}${readiness.next ? ` · Next: ${readiness.next}` : ''}`);
+    return lines.join('\n');
+}
+/**
+ * One of the team's own agents, or a personal one: whose it is, its version
+ * (what `apply --base-version` names), its triggers, and the next step.
+ */
+function describeOwnAgent(agent, team, source) {
+    var _a, _b;
+    const personal = agent.ownership === 'personal';
+    const whose = personal
+        ? `personal agent of ${agent.yours ? 'yours' : ((_a = agent.createdBy) !== null && _a !== void 0 ? _a : 'a former member')}`
+        : `team agent · runs as ${(_b = agent.createdBy) !== null && _b !== void 0 ? _b : 'nobody'}`;
+    const lines = [
+        `
+${agent.slug} — ${agent.name}`,
+        `  ${agent.status} · v${agent.version} · ${whose}${agent.accessConfirmed ? '' : ' · access not confirmed'}`,
+        `  triggers: ${agent.triggers.length === 0 ? 'none' : agent.triggers.map((trigger) => `${trigger.type}${trigger.enabled ? '' : ' (off)'}`).join(', ')}`,
+    ];
+    if (personal && !agent.yours) {
+        lines.push('  Only its creator changes it, runs it, decides its approvals or reads its runs.');
+    }
+    else if (agent.status !== 'active') {
+        lines.push(`  Next: ekanos teams agents enable ${team} ${agent.slug} --source ${source}`);
+    }
+    else if (!agent.accessConfirmed) {
+        lines.push(`  Next: ${confirmCommand(team, agent.slug, source)}`);
+    }
     return lines.join('\n');
 }
 function versionLabel(agent) {
-    var _a, _b, _c;
+    var _a, _b;
     if (agent.draft)
         return `draft v${(_a = agent.version) !== null && _a !== void 0 ? _a : '?'} (testing, unpublished)`;
-    if (agent.held)
-        return `v${(_b = agent.version) !== null && _b !== void 0 ? _b : '?'} (held, v${agent.held.waiting} waiting for confirmation)`;
-    return `v${(_c = agent.version) !== null && _c !== void 0 ? _c : '?'} ${agent.pinned ? '(pinned)' : '(following)'}`;
+    return `v${(_b = agent.version) !== null && _b !== void 0 ? _b : '?'} ${agent.pinned ? '(pinned)' : '(following)'}`;
 }
 /** What testing a draft on a team means, and the next step. */
 function draftLines(team, key) {
@@ -416,7 +536,7 @@ export function channelLines(channels, team, source) {
         ]; });
 }
 function describeChange(result, title, source, options = {}) {
-    var _a, _b, _c, _d, _e, _f;
+    var _a, _b;
     const covers = result.access ? describeAccess(result.access) : null;
     const lines = [
         `${options.confirmRequested && !result.accessConfirmed ? '!' : '✓'} ${title}`,
@@ -424,12 +544,7 @@ function describeChange(result, title, source, options = {}) {
     ];
     if (result.accessConfirmed) {
         if (covers) {
-            lines.push(result.advanced
-                ? `  Now allowed: in runs no one watches it may use ${result.runsAs ? `${result.runsAs}'s` : 'their'} connections to ${covers}.`
-                : `  Confirmed: in runs no one watches it may use ${result.runsAs ? `${result.runsAs}'s` : 'their'} connections to ${covers}.`);
-        }
-        if (result.held) {
-            lines.push(`  Held on v${(_b = result.version) !== null && _b !== void 0 ? _b : '?'}: v${result.held.waiting} ${describeHold(result.held)}. ${(_c = result.runsAs) !== null && _c !== void 0 ? _c : 'The person it runs as'} moves it by confirming: ${confirmCommand(result.team.slug, result.key, source)}`);
+            lines.push(`  Confirmed: in runs no one watches it may use ${result.runsAs ? `${result.runsAs}'s` : 'their'} connections to ${covers}.`);
         }
     }
     else {
@@ -437,12 +552,12 @@ function describeChange(result, title, source, options = {}) {
             // An older host ignores confirmAccess rather than refusing it.
             lines.push('  This host did not record the confirmation: it may not support confirming from the CLI yet.');
         }
-        lines.push(`  Not confirmed: until ${(_d = result.runsAs) !== null && _d !== void 0 ? _d : 'the person it runs as'} confirms it may use their connections${covers ? ` (to ${covers})` : ''}, it uses only what needs no confirmation.`, `  → ${(_e = result.runsAs) !== null && _e !== void 0 ? _e : 'They'}, as themselves: ${confirmCommand(result.team.slug, result.key, source)}`);
+        lines.push(`  Not confirmed: until you or one of the team's agent managers confirms what it may use${covers ? ` (${result.runsAs ? `${result.runsAs}'s` : 'its'} connections, to ${covers})` : ''}, it uses only what needs no confirmation.`, `  → ${confirmCommand(result.team.slug, result.key, source)}`);
     }
     lines.push(...requirementLines([], result.missing, result.team.slug, source));
     if (result.draft)
         lines.push(...draftLines(result.team.slug, result.key));
-    lines.push(...channelLines((_f = result.channels) !== null && _f !== void 0 ? _f : [], result.team.slug, source));
+    lines.push(...channelLines((_b = result.channels) !== null && _b !== void 0 ? _b : [], result.team.slug, source));
     return lines.join('\n');
 }
 /** What a confirmation covers, in words: whose connections, to what. */