@ekanos/cli 0.15.0 → 0.17.0

package/templates/skills/ekanos-platform/SKILL.md

@@ -54,6 +54,7 @@ npx @ekanos/cli teams members invite bank-a raj@bank-a.com --role admin   # defa
 npx @ekanos/cli teams members list bank-a                     # members and pending invitations
 npx @ekanos/cli teams members role bank-a raj@bank-a.com member
 npx @ekanos/cli teams members remove bank-a raj@bank-a.com --yes
+npx @ekanos/cli teams members resend bank-a lee@bank-a.com    # resend, or renew an expired invitation
 npx @ekanos/cli teams connect bank-a zendesk                  # connect it for the team (asks, signs in, waits)
 npx @ekanos/cli teams connect bank-a linear --as raj@bank-a.com   # a sign-in link for raj
 npx @ekanos/cli sources products                             # what the Source has enabled (super-admin enables)
@@ -68,10 +69,13 @@ npx @ekanos/cli sources products                             # what the Source h
 - Roles are the team roles (owner / admin / member, or the Source's own
   customized ones). Pick a reviewer for agents by the role holding
   `agents.review` in `teams roles list`. The primary owner's role cannot be
-  changed here; ownership moves in the app.
+  changed here; ownership moves in the app. The Source's custom roles
+  themselves are `sources roles` (`create|update|delete`; owner, admin and
+  member are fixed).
 - `teams connect <team> <product>` does the connect: it asks a form's fields
-  at the user's terminal (hidden for secrets — so the user runs it, never you
-  with values), runs the team-app prompts first when needed (Zendesk), or
+  at the user's terminal (hidden for secrets) or, run by you with
+  `--browser`, in a one-time form in the user's browser — never with values
+  from you — runs the team-app prompts first when needed (Zendesk), or
   opens a one-time sign-in link and waits. The person who signs in is a team
   member (owner/admin for a team-wide connection): the user when they are
   one, else `--as <email>` prints a link to send that member. `--no-wait`,
@@ -81,6 +85,17 @@ npx @ekanos/cli sources products                             # what the Source h
   what it has. Enabling one is a super-admin grant (`sources products enable`)
   that an `ekanos login` session cannot make — the super-admin does it in
   /admin.
+- The rest of a team's life: `teams leave <team> --yes` (the user's own
+  membership), `teams groups list|create|update|delete|members` (groups
+  narrow what their members see to `--products a,b`), `teams health <team>
+  [<product>] [--run]` (each connected integration's health; `--run` checks
+  one now; `<product> --mine` the user's own personal connection),
+  `teams workspace list|default <team> [<workspace>]`, and
+  `sources people` (everyone on the Source and their teams). Each one that
+  takes something away needs `--yes` when you run it, which you pass only
+  after the user says so. Transferring a team's ownership and deleting a team
+  are not in the CLI: the primary owner does them in the app, confirmed by a
+  code emailed to them.
 
 ## Products: integrations and experiences
 
@@ -136,8 +151,8 @@ connect (`setupSteps` step `provider-app`). It is the Source's own app — for a
 white-label Source, under its product name and company — and its admin
 creates it once in the provider's console. The integration ships the steps
 (the catalog's `instructions`, with the Source's exact callback URLs filled
-in); `ekanos apps set <product>`, run by the admin at their own terminal,
-takes the client ID and secret. The `build-agent` skill walks through it
+in); `ekanos apps set <product>` takes the client ID and secret — at the
+admin's own terminal, or in a browser form when you run it with `--browser`. The `build-agent` skill walks through it
 (`references/app-setup.md`). Integrations whose teams each bring their own
 app (Zendesk) have no Source app; each team follows that app's steps.
 
@@ -158,8 +173,13 @@ changed through the CLI or the app, with no deploy.
   (links) and which calls wait for approval, and — per area, with
   `teamOverrides` — whether a team may change them. The template wins unless
   an area is opened to teams.
-- **A team's own** — built by a team in the app (Agents → New). Only that team
-  has it, and the Source cannot update it.
+- **A team's own** — built for one team, in the app (Agents → New) or with
+  `ekanos teams agents create <team> --from <dir>` from the same `agent.json`.
+  Only that team has it, and the Source cannot update it.
+- **A personal agent** — one member's own (`--personal`, or "Just you" in the
+  app). It acts for its creator, with their own connections, on every trigger,
+  so only they change it, run it, decide its approvals or cancel its runs —
+  not a team manager and not the Source admin.
 
 Skills are folders (`SKILL.md` + references) an agent loads when needed.
 A Source admin pushes them with `ekanos skills push <dir>`: at Source level
@@ -183,11 +203,23 @@ always `ekanos teams <area> <verb> <team> …`:
 
 - `ekanos teams agents list <team>` — provided agents, on or off, the version
   each runs (pinned or following), triggers, links, the team's MCP servers,
-  and what each still needs connected.
+  and what each still needs connected; then the team's own and personal
+  agents and whose each is.
+- `ekanos teams agents create <team> --from <dir> [--personal]` /
+  `apply <team> <dir> [--base-version <n>]` — the team's own agent, or your
+  own, from an `agent.json` (+ `AGENT.md`, + `skills/<slug>/`). You become
+  its creator, so you must be an active member of the team. It starts as a
+  draft; `enable` turns it on.
 - `ekanos teams agents enable <team> <key> [--as <member-email>]
   [--confirm-access]` / `disable <team> <key>` — the app's "Turn on" /
   "Turn off". The agent runs as a team member who manages agents (the
-  team's owner by default); `--confirm-access` also confirms it, as you.
+  team's owner by default): that member is its creator, whose personal
+  connections it uses. Who it runs as is chosen once, when it is turned
+  on; to change it, archive it and turn it on again with `--as`.
+  `--confirm-access` also confirms it, as you.
+- `ekanos teams agents archive <team> <key> [--yes]` / `unarchive <team>
+  <key>` — the app's Archive: off the team's list, nothing starts it, its
+  runs and setup kept; `unarchive` brings it back paused, for `enable`.
 - `ekanos teams agents confirm <team> <key>` — you confirm, as yourself,
   that the agent may use its connections (the person it runs as's) in runs
   no one watches; the output says which products' connections that covers.
@@ -208,6 +240,9 @@ always `ekanos teams <area> <verb> <team> …`:
   skills the agent reads; attach a team skill (pushed with
   `skills push --team`) or a Source one. A provided agent takes them only
   when its template's `teamCustomization.skills` is on; its own stay.
+- `ekanos teams agents tags <team> <key> [add|remove <tag>]` — labels that
+  organize the team's agents and grant nothing; `add` makes a tag the team
+  does not have yet.
 - `ekanos teams triggers list|add|remove <team> <key> …` — manual, schedule
   (`--cron`, `--timezone`), webhook (the token goes to a file only the
   user can read, never the output) and
@@ -216,12 +251,25 @@ always `ekanos teams <area> <verb> <team> …`:
   --filter '{"labels":["feedback"]}'`), plus `slack --channel '#name' [--dms]
   --yes` and `linear [--label <name>]` once the team has installed Slack or
   Ekanos's Linear app with `ekanos teams connect <team> slack|linear-app`.
+- `ekanos teams triggers enable|disable <team> <key> <trigger-id|key>` and
+  `edit <team> <key> <trigger-id|key> [--prompt …] [--cron … --timezone …]
+  [--filter …] [--channel …] [--dms] [--label …]` — turn a trigger off
+  without removing it, or change it in place: a webhook keeps its URL and
+  token (only `rotate` makes a new one).
 - `ekanos teams links list|add|remove <team> <from-key> [<to-key>] --kind
   talk|delegate [--mode await|handoff]`.
 - `ekanos teams mcp list|add|status|token|effect <team> [<server-key> …]` — a
   team's own MCP server (`--url`, `--auth none|token|oauth`); a token is typed
-  at the admin's terminal with hidden input, never in chat or arguments; OAuth
-  prints a link for a team member to open.
+  at the admin's terminal with hidden input, or in the `--browser` form, never
+  in chat or arguments; OAuth prints a link for a team member to open.
+  `ekanos teams mcp attach|detach <team> <server-key> <agent-key>` gives one
+  agent a team server, or takes it away (where its template allows), and
+  `refresh <team> <server-key>` (or `--agent <key>`) lists its tools again.
+- `ekanos teams llm-key show|set|remove <team>` — the team's own Anthropic
+  key, which its agents and assistant then use instead of the Source's.
+  `show` gives only whether one is saved and its last four characters; `set`
+  takes it like any secret (`--browser`, or `--secret-env <NAME>` /
+  `--secret-file <path>` the user prepared); `remove` needs `--yes`.
 
 Triggers, links and the policy of a provided agent follow its template by
 default; when the template has not turned on team overrides for that area,
@@ -263,19 +311,23 @@ is refused (`USER_NOT_IN_SOURCE`): `ekanos teams list` shows the teams.
 | Agents provided for every team | A Source admin, with `ekanos agents` (`agents archive <key>` retires one once no team has it on) |
 | Testing an unpublished agent version on one team | A Source admin: `ekanos teams agents enable\|pin <team> <key> --draft`, then `ekanos agents test <key> --team <slug>` |
 | Running a team's agent, reading its runs (transcript, tool calls) | A team's agent manager in the app, or a Source admin with `ekanos runs` |
-| Deciding what an agent run waits on (approve, reject, edit & send a reply) | A team's agent manager in the app, or a Source admin with `ekanos approvals` (for a team's own agent, only a Source admin who manages that team's agents) |
+| Deciding what an agent run waits on (approve, reject, edit & send a reply) | A team's agent manager in the app, or with `ekanos approvals`: a Source admin (for a team's own agent, only one who manages that team's agents), or any seat holder with that authority themselves — a member who manages (or, for reply drafts, reviews) the team's agents, a named reviewer, a personal agent's creator |
+| A team's workflows: saving one, turning it on, running it, deciding its approval gates | A team member who configures integrations, in the app's editor; or a Source admin with `ekanos workflows apply\|enable\|run\|approvals --team <slug>` (Workflows must be on for the Source; a member's personal workflow is theirs alone). Custom Code that writes or reaches a host is approved by whoever turns the workflow on: `ekanos workflows enable <workflow> --team <slug> --confirm-access` |
 | Skills (SKILL.md folders) for every team, or one team's own | A Source admin, with `ekanos skills push` (`--team <slug>` for one team); `ekanos skills archive` retires one nothing uses |
 | Knowledge articles for every team (General), or one team's own | A Source admin, with `ekanos knowledge push` (`--team <slug>` for one team); a team's members in the app |
 | Who decides agent drafts that wait for a person | A Source admin, with `ekanos reviewers` |
-| An integration's app for the whole Source (client ID and secret) | A Source admin, with `ekanos apps set` at their own terminal |
+| An integration's app for the whole Source (client ID and secret) | A Source admin, with `ekanos apps set` (at their own terminal, or its `--browser` form) |
 | One connection for the whole Source, used by provided agents in every team | A Source admin, with `ekanos apps connect` (status: `ekanos apps show`), or **Shared integrations › Connections** in the Source admin area |
 | Which team gets which events on that connection (Zendesk organization → team) | A Source admin, with `ekanos routes` (`webhook`, `options`, `set`, `list`, `remove`, `unrouted`, `replay`), or **Shared integrations › Routing** in the Source admin area |
 | A team's own app for an integration (client ID, secrets, webhook URL) | The team in the app, or a Source admin with `ekanos teams` |
 | A provided agent's triggers, links and approvals | A Source admin, in the template (`ekanos agents triggers / links / policy / overrides`); teams change them only where `teamOverrides` allows |
 | Creating a team, inviting its members, changing their roles | A Source admin, with `ekanos teams create` / `ekanos teams members` (or the team's owner in the app) |
+| A team's groups and default workspace | A Source admin, with `ekanos teams groups` / `ekanos teams workspace default`, or the team's owner in the app |
+| Transferring a team's ownership, deleting a team | The team's primary owner in the app (a code emailed to them confirms it), or a super-admin under /admin |
+| The Source's custom roles and their permissions | A Source admin, with `ekanos sources roles`; owner, admin and member are fixed |
 | Connecting an integration for a team (signing in) | A team member in the app, or a Source admin with `ekanos teams connect <team> <product>` (`--as <member-email>` when the connection is a person's own) |
 | Turning on a provided agent for a team, pinning its version, its triggers, links, MCP servers and approval policy | Each team in the app, or a Source admin with `ekanos teams agents\|triggers\|links\|mcp` |
 | Which products a team sees in the app (product scopes) | A Source admin: `ekanos sources scopes` (and `add`/`remove <scope> <product>`), `ekanos teams scope show\|set <team>`; creating a scope is in /admin |
 | Is a team's agent live, and if not, what is the next step | A Source admin, with `ekanos teams agents show <team> <key>`; the whole team on one screen with `ekanos teams show <team>` |
-| Disconnecting a team's integration, removing a team's MCP server | A Source admin, with `ekanos teams disconnect <team> <product> --yes` / `ekanos teams mcp remove <team> <server-key> --yes`, or the team in the app |
+| Disconnecting a team's integration, removing a team's MCP server | A Source admin, with `ekanos teams disconnect <team> <product> --yes` / `ekanos teams mcp remove <team> <server-key> --yes`, or the team in the app. A personal connection: only its owner, `ekanos teams disconnect <team> <product> --mine --yes` |
 | Confirming an agent may use its connections | Whoever sets it up, as themselves: the Source admin with `ekanos teams agents confirm <team> <key>` (or `enable --confirm-access`, `agents publish --confirm-access`), or a team manager with **Confirm access** in the app — never a plain member. A publish is the confirmation for following teams: no team is held on an earlier version |

package/templates/skills/polish-widgets/references/patterns.md

@@ -184,7 +184,7 @@ is not information-rich; it is unreadable.
 <div className="space-y-1 p-2">
   {events.map((e) => (
     <div key={e.id} className="flex gap-1 text-xs">
-      <Icon name="fa-light fa-bolt" className="h-3 w-3" />
+      <Icon name="fa-bolt" className="h-3 w-3" />
       <span>{e.title}</span>
     </div>
   ))}
@@ -268,7 +268,7 @@ import {
     <DropdownMenuTrigger
       render={<Button variant="ghost" size="icon" className="h-8 w-8" />}
     >
-      <Icon name="fa-light fa-ellipsis-vertical" className="h-4 w-4" />
+      <Icon name="fa-ellipsis-vertical" className="h-4 w-4" />
     </DropdownMenuTrigger>
     <DropdownMenuContent align="end">
       <DropdownMenuItem>View details</DropdownMenuItem>
@@ -293,7 +293,7 @@ said, and it matches every other widget on the board:
 ```tsx
 // AFTER — the SDK's empty state, one sentence of what appears here
 <Widget.Empty
-  icon="fa-light fa-inbox"
+  icon="fa-inbox"
   title="No invoices yet"
   description="Invoices appear here as soon as your first one is issued."
 />