@enter-pro/enter-cli 0.4.2 → 0.4.3

package/dist/commands/thread.js

@@ -7,7 +7,8 @@ import { pollUntil, TimeoutError } from "../poll.js";
 import { resolveLifecycleStatus } from "../lifecycle.js";
 import { ThreadEvents, isStateEvent } from "../thread-events.js";
 import { safeOutput } from "../safe-output.js";
-import { errorEnvelope } from "../errors.js";
+import { RequestError, errorEnvelope } from "../errors.js";
+import { workflowResult } from "../workflow.js";
 import { registerThreadTasks } from "./thread-tasks.js";
 export const threadCmd = new Command("thread").description("Manage project threads and chat");
 registerThreadTasks(threadCmd);
@@ -27,6 +28,8 @@ function normalizeAction(raw) {
         updated_at: String(raw.updated_at ?? raw.UpdatedAt ?? ""),
     };
 }
+// Single registry: adding a new tool only requires editing one row.
+const STRIPE_INPUT_INSTRUCTIONS = "Submit the Stripe key through --secret-value-stdin from an authorized input source. Reuse input already supplied for this task; otherwise offer an available secure input or local-file path. Do not echo the key or embed it in shell text or build prompts. Report connection errors without assuming their cause.";
 async function loadToolCallArgs(projectId, action, toolName, context = {}) {
     const turn = String(action.turn);
     const data = await (context.messages ??= client.get(`/v1/projects/${projectId}/thread/messages`, { start_turn: turn, end_turn: turn }, context.signal));
@@ -73,18 +76,22 @@ async function loadToolCallArgs(projectId, action, toolName, context = {}) {
     }
     return { kind: "not_found" };
 }
+const ANSWERS_FORMAT = 'Use the exact original question text as each key, not a host question ID. Each value must be {"selected_options":["exact option label"],"other_text":"optional free text"}. Use an empty selected_options array for free-text-only answers. See thread approve --help.';
 const TOOL_HANDLERS = {
     // ask_user_question: surface the questions array directly so callers don't
     // have to fetch + parse thread messages to know what to ask the user.
     ask_user_question: {
         kind: "questions",
-        approveSuffix: (pid, a) => `--answers '<json>' OR enter-cli thread approve ${pid} ${a.action_id} --skip-answers`,
-        instructions: "Questions are included in this action's `questions` field. Forward each question (with its options and multiSelect) to the user, collect answers, then run approve_command --answers '<json>' (or --skip-answers).",
+        approveSuffix: "--answers '<json>'",
+        instructions: `Forward questions, options and multiSelect to the user unchanged. Map their response back to the original question text. ${ANSWERS_FORMAT} After receiving the user response, run approve_command with that JSON. Use skip_command only if the user asks to skip.`,
         enrich: async (projectId, action, context) => {
             const args = await loadToolCallArgs(projectId, action, "ask_user_question", context);
             switch (args.kind) {
                 case "ok":
-                    return { questions: args.value.questions ?? [] };
+                    return {
+                        questions: args.value.questions ?? [],
+                        skip_command: `enter-cli thread approve ${projectId} ${action.action_id} --skip-answers`,
+                    };
                 case "parse_error":
                     return { questions: { raw_arguments: args.raw_arguments, parse_error: true } };
                 case "not_found":
@@ -94,31 +101,31 @@ const TOOL_HANDLERS = {
     },
     supabase_add_secret: {
         kind: "secret",
-        approveSuffix: () => `--secret-name <NAME> --secret-value-stdin`,
-        instructions: "Use a secure input surface for the secret name and value; direct CLI callers can use stdin. Never request or echo credentials in ordinary chat.",
+        approveSuffix: `--secret-name <NAME> --secret-value-stdin`,
+        instructions: "Submit the secret name and value through --secret-value-stdin from an authorized input source. Reuse input already supplied for this task; otherwise ask for the missing value through an available secure input or local-file path. Do not echo the value or embed it in shell text or build prompts.",
     },
     supabase_configure_auth_provider: {
         kind: "auth_provider",
-        approveSuffix: () => "",
-        instructions: "Configure the requested provider through Enter's secure form, then approve. For direct CLI use, --auth-config-stdin accepts provider configuration JSON through stdin. Never collect credentials in ordinary chat. Approval verifies saved configuration with the backend.",
-        enrich: async (projectId, action, context) => ({ provider: await authProviderFor(projectId, action, context) }),
+        approveSuffix: "",
+        instructions: "Configure this provider with --auth-config-stdin using an authorized input source, or use Enter's provider form. Reuse configuration already supplied for this task; ask only for missing fields. After form submission query status before approving again. Missing input is not build failure.",
+        enrich: async (projectId, action, context) => authProviderInput(await authProviderFor(projectId, action, context)),
     },
     stripe_enable: {
         kind: "secret",
-        approveSuffix: () => `--secret-value-stdin`,
-        instructions: "Use a secure input surface or direct CLI stdin for the Stripe key. Never request credentials in ordinary chat.",
+        approveSuffix: `--secret-value-stdin`,
+        instructions: STRIPE_INPUT_INSTRUCTIONS,
     },
     stripe_update_key_and_migrate: {
         kind: "secret",
-        approveSuffix: () => `--secret-value-stdin`,
-        instructions: "Product IDs come from the pending tool call. Supply the new Stripe key through a secure input surface or direct CLI stdin, never ordinary chat.",
+        approveSuffix: `--secret-value-stdin`,
+        instructions: `${STRIPE_INPUT_INSTRUCTIONS} Product IDs come from the pending tool call.`,
     },
     // confirm_plan_mode: surface the plan text directly on the action so callers
     // don't have to fetch + parse thread messages themselves.
     confirm_plan_mode: {
         kind: "none",
-        approveSuffix: () => "",
-        instructions: "Plan is included in this action's `plan` field. Show it to the user, then run approve_command.",
+        approveSuffix: "",
+        instructions: "Plan is included in this action's `plan` field. Present it for the user's approval and wait for their decision before running approve_command. Displaying the plan is not approval.",
         enrich: async (projectId, action, context) => {
             const args = await loadToolCallArgs(projectId, action, "confirm_plan_mode", context);
             switch (args.kind) {
@@ -141,7 +148,7 @@ const TOOL_HANDLERS = {
 };
 const DEFAULT_HANDLER = {
     kind: "none",
-    approveSuffix: () => "",
+    approveSuffix: "",
     instructions: "No additional input required. Approve only within the user-authorized scope; input_kind none does not itself grant authorization.",
 };
 const FEATURE_ENABLE_ROUTES = new Map([
@@ -156,6 +163,25 @@ const AUTH_PROVIDER_FIELDS = {
     alipay: ["enabled", "app_id", "private_key"],
     feishu: ["enabled", "app_id", "app_secret"],
 };
+// Input requirements are separate from optional provider settings. Never put
+// stored configuration values (including masked secrets) in action metadata.
+const AUTH_PROVIDER_INPUTS = {
+    google: ["client_ids", "client_secret"],
+    wechat: ["client_id", "client_secret"],
+    alipay: ["app_id", "private_key"],
+    feishu: ["app_id", "app_secret"],
+};
+function authProviderInput(provider) {
+    return {
+        provider,
+        configuration: {
+            input_surface: "enter_project_auth_form",
+            input_methods: ["auth_config_stdin", "enter_project_auth_form"],
+            fields: AUTH_PROVIDER_INPUTS[provider],
+            instructions: "Supply the listed fields as JSON through --auth-config-stdin from an authorized input source; Enter's provider form is an alternative, not a required detour. If input is missing, offer an available secure input or local-file path. Do not echo credentials or embed them in shell text or build prompts. Use the actual OAuth callback URL when configuring the provider. After saving through the form query status, since it may already have approved the action.",
+        },
+    };
+}
 async function authProviderFor(projectId, action, context = {}) {
     if (!action.tool_call_id)
         throw new Error("Auth provider action is missing its tool_call_id");
@@ -183,7 +209,7 @@ function handlerFor(toolName) {
 }
 function buildApproveCommand(projectId, action) {
     const base = `enter-cli thread approve ${projectId} ${action.action_id}`;
-    const suffix = handlerFor(action.tool_name).approveSuffix(projectId, action);
+    const suffix = handlerFor(action.tool_name).approveSuffix;
     return suffix ? `${base} ${suffix}` : base;
 }
 async function fetchPendingActions(projectId, actionIds = [], signal) {
@@ -217,8 +243,7 @@ threadCmd
         content = opts.message;
     }
     else {
-        console.error("Error: either -m <text> or --file <path> is required");
-        process.exit(1);
+        throw new Error("Provide non-empty input using --message, --file or --stdin");
     }
     if (!content.trim())
         throw new Error("Message must not be empty");
@@ -241,6 +266,7 @@ threadCmd
     .option("--end-turn <n>", "End turn number")
     .option("--turn <n>", "Get messages for a specific turn (shorthand for --start-turn N --end-turn N)")
     .option("--latest", "Get messages from the most recent turn (most common usage)")
+    .option("--text", "Return assistant text with turn numbers, without raw event envelopes")
     .option("--tail <n>", "Get messages from the last N turns")
     .option("--follow", "Stream NDJSON events over WebSocket; no automatic approval")
     .option("--cursor <id>", "Resume after a previously returned event ID")
@@ -249,6 +275,8 @@ threadCmd
     .option("--max-events <n>", "Stop --follow after N events")
     .action(async (id, opts, cmd) => {
     if (opts.follow) {
+        if (opts.text)
+            throw new Error("--text is not supported with --follow");
         await followThreadStream(id, opts);
         return;
     }
@@ -264,7 +292,7 @@ threadCmd
         const resp = turnsData;
         const turns = resp.turns || [];
         if (turns.length === 0) {
-            printMessage("No turns found.");
+            print(getFormat(cmd), { messages: [] });
             return;
         }
         if (opts.latest) {
@@ -283,15 +311,24 @@ threadCmd
         }
     }
     if (!startTurn) {
-        console.error("Error: specify --start-turn, --turn, --latest, --tail, or --follow");
-        process.exit(1);
+        throw new Error("Specify --start-turn, --turn, --latest, --tail, or --follow");
     }
     const params = {};
     params.start_turn = startTurn;
     if (endTurn)
         params.end_turn = endTurn;
     const data = await client.get(`/v1/projects/${id}/thread/messages`, params);
-    print(getFormat(cmd), data);
+    if (opts.text) {
+        const rows = Array.isArray(data) ? data : data.messages ?? [];
+        const messages = rows.flatMap((row) => {
+            const content = row?.detail?.assistant_content?.content;
+            return row?.message_type === "assistant_content" && typeof content === "string"
+                ? [{ turn: row.turn, text: content }] : [];
+        });
+        print(getFormat(cmd), safeOutput({ messages }));
+    }
+    else
+        print(getFormat(cmd), data);
 });
 async function followThreadStream(projectId, opts) {
     const timeout = positiveNumber(opts.timeout ?? "60", "--timeout") * 1000;
@@ -364,12 +401,13 @@ export function threadInteraction(id, { taskId, chatId, turn, requireBuild } = {
     const target = (taskId ? ` --task-id ${taskId}` : turn === undefined ? "" : ` --turn ${turn}`)
         + (chatId ? ` --chat-id ${chatId}` : "") + (requireBuild ? " --require-build" : "");
     return {
+        workflow: workflowResult({ status: "running", task_id: taskId, turn: { turn, chat_id: chatId } }),
         monitoring_required: true,
-        wait_command: `enter-cli --output json thread wait ${id}${target}`,
-        watch_command: `enter-cli thread watch ${id}${target}`,
-        status_command: `enter-cli --output json thread status ${id}${target}`,
+        wait_command: `enter-cli --output json thread wait ${id}${target} --timeout 10`,
+        watch_command: `enter-cli thread watch ${id}${target} --timeout 60`,
+        status_command: `enter-cli --output json thread status ${id}${target} --timeout 10`,
         follow_up_command: `enter-cli --output json thread chat ${id}${chatId ? ` --chat-id ${chatId}` : ""} --file <message-file>`,
-        instructions: "Accepted or timeout is not completion. Follow this task until blocked, failed or completed. Forward questions unchanged; approve only within existing authorization. Watching never approves or cancels remote work. Hosts own background scheduling.",
+        instructions: "Accepted or timeout is not completion. Follow this task until blocked, failed or completed. Forward questions unchanged; approve only within existing authorization. Use short foreground waits and handle new user messages before continuing observation. Use background watch only with non-blocking output collection and completion notifications; do not follow it with a long blocking job wait. Observation timeout is normal: keep the same task and bounded wait, rather than increasing timeouts. CLI observation timeout and host job-wait timeout are separate limits, not elapsed time. Watching never approves or cancels remote work.",
     };
 }
 function positiveNumber(value, option, integer = false) {
@@ -386,9 +424,10 @@ async function readThreadSnapshot(id, turnNumber, signal, taskId, chatId) {
         : turnNumber === undefined ? turns[0] : turns.find(t => Number(t.turn) === turnNumber);
     if (!selected && taskId) {
         const queue = await client.get(`/v1/projects/${id}/thread/tasks`, { simple: "true", ...(chatId ? { chat_id: chatId } : {}) }, signal);
-        return { status: queue.task_ids?.includes(taskId) ? "queued" : "unknown", project_id: id, turn: null,
-            reason: queue.task_ids?.includes(taskId) ? "task_queued" : "task_not_observed",
-            ...(!queue.task_ids?.includes(taskId) ? {
+        const queued = queue.task_ids?.includes(taskId);
+        return { status: queued ? "queued" : "unknown", project_id: id, turn: null,
+            reason: queued ? "task_queued" : "task_not_observed",
+            ...(!queued ? {
                 correlation: "unavailable",
                 project_activity: turns[0] ? pick(turns[0], ["id", "turn", "status", "chat_id", "commit_id"]) : null,
                 project_status_command: `enter-cli --output json thread status ${id}${chatId ? ` --chat-id ${chatId}` : ""}`,
@@ -435,18 +474,22 @@ async function readThreadSnapshot(id, turnNumber, signal, taskId, chatId) {
     return { ...base, status: "completed", project: { ...project, lifecycle_status: resolveLifecycleStatus(project) } };
 }
 function projectSnapshot(snapshot, compact = false) {
+    const workflow = workflowResult(snapshot);
     const result = { ...snapshot };
     if (compact && snapshot.turn)
         result.turn = pick(snapshot.turn, ["id", "turn", "status", "turn_name", "created_at", "updated_at", "commit_id", "chat_id"]);
+    if (snapshot.status === "completed" && snapshot.turn) {
+        result.messages_command = `enter-cli --output json thread messages ${snapshot.project_id} --turn ${snapshot.turn.turn} --text`;
+    }
     if (snapshot.project) {
         const p = snapshot.project;
         if (compact)
             result.project = pick(p, ["project_id", "name", "status", "lifecycle_status", "commit", "commit_turn", "preview_url", "publish_url", "build_status"]);
-        const build = p.build_status;
-        result.build_matches_turn = Boolean(snapshot.turn?.commit_id && build?.commit_id === snapshot.turn.commit_id);
+        result.build_matches_turn = workflow.build?.matches_task ?? false;
         const supabase = p.supabase;
         result.integrations = { cloud: supabase?.status ?? "unknown", ai: p.ai_connection_state ?? (p.ai_capability_enabled === true ? "enabled" : "unknown") };
     }
+    result.workflow = workflow;
     return result;
 }
 // Owns observation and lifetime only; callers choose JSON or NDJSON rendering.
@@ -491,7 +534,19 @@ async function observeThread(id, opts, wait, onSnapshot) {
                 throw stream.failure;
             const revision = stream?.revision ?? 0;
             querying = true;
-            last = await readThreadSnapshot(id, target, controller.signal, opts.taskId, opts.chatId);
+            try {
+                last = await readThreadSnapshot(id, target, controller.signal, opts.taskId, opts.chatId);
+            }
+            catch (error) {
+                // A read outage does not end remote work. Keep bounded observation alive;
+                // never retry writes or authentication/permission failures here.
+                if (!wait || controller.signal.aborted || !(error instanceof RequestError) || !error.retryable)
+                    throw error;
+                querying = false;
+                emit({ ...errorEnvelope(error), observation_retrying: true, last_observed: true });
+                await delay(1000, undefined, { signal: controller.signal });
+                continue;
+            }
             if (opts.requireBuild && last.status === "completed") {
                 const build = last.project?.build_status;
                 const matches = Boolean(last.turn?.commit_id && build?.commit_id === last.turn.commit_id);
@@ -600,7 +655,7 @@ threadCmd
         else {
             writeFileSync(path, JSON.stringify(data, null, 2));
         }
-        printMessage(`Diff written to ${path}`);
+        printResult(getFormat(cmd), { path }, `Diff written to ${path}`);
         return;
     }
     print(getFormat(cmd), data);
@@ -608,10 +663,11 @@ threadCmd
 threadCmd
     .command("cancel <project_id>")
     .description("Cancel the currently running turn. No-op if nothing is running.")
-    .action(async (id, _opts, cmd) => {
+    .option("--chat-id <id>", "Scope cancellation to this chat")
+    .action(async (id, opts, cmd) => {
     // Pre-check the latest turn — the server returns code 1000 even when
     // nothing is running, which is misleading. We want a clean idempotent no-op.
-    const turnsResp = await client.get(`/v1/projects/${id}/thread/turns`);
+    const turnsResp = await client.get(`/v1/projects/${id}/thread/turns`, opts.chatId ? { chat_id: opts.chatId } : undefined);
     const turns = turnsResp.turns ?? [];
     const latest = turns[0];
     const isRunning = latest && !TERMINAL_TURN_STATUSES.has(String(latest.status ?? ""));
@@ -622,11 +678,13 @@ threadCmd
             reason: "no_running_turn",
             latest_turn: latest?.turn ?? null,
             latest_status: latest?.status ?? null,
+            tasks_command: `enter-cli --output json thread tasks ${id}${opts.chatId ? ` --chat-id ${opts.chatId}` : ""}`,
         }, `Nothing to cancel (latest turn ${latest?.turn ?? "?"} status: ${latest?.status ?? "unknown"}).`);
         return;
     }
-    await client.post(`/v1/projects/${id}/thread/cancel`);
-    printResult(format, { cancelled: true, turn: latest.turn }, `Cancelled turn ${latest.turn}.`);
+    const chatId = opts.chatId ?? latest.chat_id;
+    await client.post(`/v1/projects/${id}/thread/cancel`, chatId ? { chat_id: chatId } : undefined);
+    printResult(format, { cancelled: true, turn: latest.turn, ...(chatId ? { chat_id: chatId } : {}) }, `Cancelled turn ${latest.turn}.`);
 });
 threadCmd
     .command("restore <project_id>")
@@ -756,7 +814,7 @@ threadCmd
     .option("--secret-value-stdin", "Read the secret value from stdin instead of process arguments")
     .option("--auth-config-stdin", "Read configuration JSON for the action's auth provider from stdin; credentials never go into the approval response")
     .option("--tool-result <result>", "Custom tool result string")
-    .option("--answers <json>", 'Answers for ask_user_question, JSON: \'{"Q text": {"selected_options": ["A"], "other_text": ""}}\'')
+    .option("--answers <json>", `Answers for ask_user_question. ${ANSWERS_FORMAT}`)
     .option("--skip-answers", "Skip all questions for ask_user_question (sets skipped: true)")
     .action(async (projectId, actionIdArg, opts, cmd) => {
     const format = getFormat(cmd);
@@ -792,7 +850,17 @@ threadCmd
         }
         const data = await client.get(configPath);
         if (data.config?.providers?.[provider]?.enabled !== true) {
-            throw new Error(`Auth provider ${provider} is not enabled. Configure it through Enter's secure form or --auth-config-stdin before approval.`);
+            print(format, {
+                status: "blocked", reason: "auth_provider_configuration_required",
+                project_id: projectId, approved: false,
+                actions: [{
+                        action_id: action.action_id, tool_name: action.tool_name, turn: action.turn,
+                        input_kind: "auth_provider", ...authProviderInput(provider),
+                        approve_command: buildApproveCommand(projectId, action),
+                    }],
+                next_step: "Provide the missing fields via --auth-config-stdin, or save them in Enter's provider form and query thread status. Continue with existing authorized input without asking the user to enter it again.",
+            });
+            return;
         }
         // The backend additionally verifies stored credentials and the card's
         // ExpectedProvider before claiming the action. Never send credentials here.
@@ -819,10 +887,10 @@ threadCmd
     if (answers) {
         for (const answer of Object.values(answers)) {
             if (!answer || typeof answer !== "object" || Array.isArray(answer))
-                throw new Error("Each answer must be an object");
+                throw new Error(`Invalid --answers: each answer must be an object. ${ANSWERS_FORMAT}`);
             const value = answer;
             if (!Array.isArray(value.selected_options) || !value.selected_options.every(item => typeof item === "string") || (value.other_text !== undefined && typeof value.other_text !== "string")) {
-                throw new Error("Each answer requires selected_options as a string array and optional other_text as a string");
+                throw new Error(`Invalid --answers: selected_options must be a string array and other_text an optional string. ${ANSWERS_FORMAT}`);
             }
         }
     }

package/dist/commands/whoami.js

@@ -6,7 +6,7 @@ export const whoamiCmd = new Command("whoami")
     .description("Show current user info")
     .action(async (_opts, cmd) => {
     if (!isAuthenticated()) {
-        throw new Error("Not authenticated. Run `enter login` or set ENTER_API_KEY environment variable.");
+        throw new Error("Not authenticated. Run `enter-cli login` or set ENTER_API_KEY environment variable.");
     }
     const data = await client.get("/v1/users/info");
     const format = cmd.optsWithGlobals().output || "json";

package/dist/commands/workspace.js

@@ -1,12 +1,9 @@
 import { Command } from "commander";
 import * as client from "../client.js";
-import { print, printMessage, printTable, pickList } from "../output.js";
+import { print, printResult, printTable, pickList, getFormat } from "../output.js";
 export const workspaceCmd = new Command("workspace")
     .alias("ws")
     .description("Manage workspaces");
-function getFormat(cmd) {
-    return cmd.optsWithGlobals().output || "json";
-}
 workspaceCmd
     .command("list")
     .description("List workspaces")
@@ -68,9 +65,9 @@ workspaceCmd
 workspaceCmd
     .command("delete <workspace_id>")
     .description("Delete a workspace")
-    .action(async (id) => {
+    .action(async (id, _opts, cmd) => {
     await client.del(`/v1/workspaces/${id}`);
-    printMessage("Workspace deleted successfully.");
+    printResult(getFormat(cmd), { deleted: true, workspace_id: id }, "Workspace deleted successfully.");
 });
 // Members subcommand group
 const membersCmd = new Command("members").description("Manage workspace members");
@@ -118,7 +115,7 @@ membersCmd
     .description("Remove a member from workspace")
     .option("--email <email>", "Member email")
     .option("--user-id <id>", "Member user ID")
-    .action(async (id, opts) => {
+    .action(async (id, opts, cmd) => {
     if (!opts.email && !opts.userId) {
         throw new Error("--email or --user-id is required");
     }
@@ -128,7 +125,7 @@ membersCmd
     if (opts.userId)
         body.user_id = Number(opts.userId);
     await client.post(`/v1/workspaces/${id}/members/remove`, body);
-    printMessage("Member removed successfully.");
+    printResult(getFormat(cmd), { removed: true, workspace_id: id }, "Member removed successfully.");
 });
 membersCmd
     .command("update-role <workspace_id>")
@@ -155,9 +152,9 @@ membersCmd
 membersCmd
     .command("leave <workspace_id>")
     .description("Leave a workspace")
-    .action(async (id) => {
+    .action(async (id, _opts, cmd) => {
     await client.post(`/v1/workspaces/${id}/leave`);
-    printMessage("Left workspace successfully.");
+    printResult(getFormat(cmd), { left: true, workspace_id: id }, "Left workspace successfully.");
 });
 workspaceCmd.addCommand(membersCmd);
 // Credits subcommand group

package/dist/config.d.ts

@@ -2,7 +2,6 @@ export interface Config {
     api_url: string;
     base_path: string;
     output: string;
-    default_workspace: string;
 }
 export declare function configDir(): string;
 export declare function loadConfig(): Config;

package/dist/config.js

@@ -8,7 +8,6 @@ const defaults = {
     api_url: "https://api.enter.pro",
     base_path: "/code/api",
     output: "json",
-    default_workspace: "",
 };
 function ensureConfigDir() {
     if (!existsSync(CONFIG_DIR)) {
@@ -32,8 +31,6 @@ function getEnvOverrides() {
         overrides.base_path = process.env.ENTER_BASE_PATH;
     if (process.env.ENTER_OUTPUT)
         overrides.output = process.env.ENTER_OUTPUT;
-    if (process.env.ENTER_DEFAULT_WORKSPACE)
-        overrides.default_workspace = process.env.ENTER_DEFAULT_WORKSPACE;
     return overrides;
 }
 export function configDir() {
@@ -42,15 +39,24 @@ export function configDir() {
 export function loadConfig() {
     const fileConfig = loadFromFile();
     const envOverrides = getEnvOverrides();
-    return { ...defaults, ...fileConfig, ...envOverrides };
+    const merged = { ...defaults, ...fileConfig, ...envOverrides };
+    return Object.fromEntries(Object.keys(defaults).map(key => [key, merged[key]]));
 }
 export function setConfig(key, value) {
+    validateKey(key);
+    if (key === "output" && !["json", "yaml", "table"].includes(value))
+        throw new Error("output must be json, yaml or table");
     ensureConfigDir();
     const current = loadFromFile();
     current[key] = value;
     writeFileSync(CONFIG_FILE, yaml.dump(current), "utf-8");
 }
+function validateKey(key) {
+    if (!Object.hasOwn(defaults, key))
+        throw new Error(`Unsupported setting "${key}". Supported settings: ${Object.keys(defaults).join(", ")}. Pass workspace IDs explicitly to project commands.`);
+}
 export function getConfig(key) {
+    validateKey(key);
     const cfg = loadConfig();
     return cfg[key] || "";
 }

package/dist/output.d.ts

@@ -6,21 +6,5 @@ export declare function printMessage(msg: string): void;
 export declare function printResult(format: string, structured: unknown, message: string): void;
 import type { Command } from "commander";
 export declare function getFormat(cmd: Command): string;
-export declare function printError(err: Error | string): void;
 export declare function pick<T extends Record<string, unknown>>(obj: T, keys: string[]): Record<string, unknown>;
 export declare function pickList(items: Record<string, unknown>[], keys: string[]): Record<string, unknown>[];
-export interface ListEnvelope {
-    items: unknown[];
-    total?: number;
-    page?: number;
-    page_size?: number;
-}
-export interface TableConfig {
-    headers: string[];
-    rowMapper: (item: Record<string, unknown>) => string[];
-}
-export declare function printList(format: string, data: ListEnvelope, tableConfig?: TableConfig): void;
-export declare function printSingle(format: string, data: unknown, tableConfig?: {
-    headers: string[];
-    rowMapper: (item: Record<string, unknown>) => string[];
-}): void;

package/dist/output.js

@@ -59,9 +59,6 @@ export function printResult(format, structured, message) {
 export function getFormat(cmd) {
     return cmd.optsWithGlobals().output || "json";
 }
-export function printError(err) {
-    console.error(`Error: ${typeof err === "string" ? err : err.message}`);
-}
 export function pick(obj, keys) {
     const result = {};
     for (const key of keys) {
@@ -72,18 +69,3 @@ export function pick(obj, keys) {
 export function pickList(items, keys) {
     return items.map((item) => pick(item, keys));
 }
-export function printList(format, data, tableConfig) {
-    if (format === "table" && tableConfig) {
-        const rows = data.items.map(tableConfig.rowMapper);
-        printTable(tableConfig.headers, rows);
-        return;
-    }
-    print(format, data);
-}
-export function printSingle(format, data, tableConfig) {
-    if (format === "table" && tableConfig) {
-        printTable(tableConfig.headers, [tableConfig.rowMapper(data)]);
-        return;
-    }
-    print(format, data);
-}

package/dist/poll.d.ts

@@ -2,6 +2,7 @@ export declare class TimeoutError extends Error {
     constructor(elapsedMs: number);
 }
 export interface PollOptions {
+    signal?: AbortSignal;
     intervalMs?: number;
     timeoutMs?: number;
     onTick?: (elapsed: number, data: unknown) => void;

package/dist/poll.js

@@ -1,3 +1,4 @@
+import { setTimeout as delay } from "node:timers/promises";
 export class TimeoutError extends Error {
     constructor(elapsedMs) {
         super(`Timed out after ${Math.round(elapsedMs / 1000)}s`);
@@ -10,6 +11,7 @@ export async function pollUntil(fetcher, predicate, options) {
     const onTick = options?.onTick;
     const start = Date.now();
     while (true) {
+        options?.signal?.throwIfAborted();
         const data = await fetcher();
         const elapsed = Date.now() - start;
         if (predicate(data)) {
@@ -19,6 +21,6 @@ export async function pollUntil(fetcher, predicate, options) {
             throw new TimeoutError(elapsed);
         }
         onTick?.(elapsed, data);
-        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        await delay(Math.min(intervalMs, Math.max(0, timeoutMs - elapsed)), undefined, { signal: options?.signal });
     }
 }

package/dist/thread-events.d.ts

@@ -30,6 +30,7 @@ export declare class ThreadEvents {
     private wake;
     private setMode;
     private connect;
+    private connectAuthenticated;
     wait(afterRevision: number, timeoutMs: number): Promise<void>;
     close(): void;
 }

package/dist/thread-events.js

@@ -2,7 +2,7 @@ import WebSocket from "ws";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import { getProxyForUrl } from "proxy-from-env";
 import { baseURL } from "./config.js";
-import { getToken } from "./auth.js";
+import { getValidToken } from "./auth.js";
 import { RequestError } from "./errors.js";
 export function streamURL(base, projectId, options) {
     const url = new URL(`${base.replace(/\/$/, "")}/v1/projects/${encodeURIComponent(projectId)}/thread/stream`);
@@ -77,10 +77,20 @@ export class ThreadEvents {
         this.wake();
     }
     connect() {
+        void this.connectAuthenticated().catch(error => {
+            if (this.stopped)
+                return;
+            this.failure = new RequestError("STREAM_SETUP_ERROR", error instanceof Error ? error.message : "Could not initialize Enter event stream.");
+            this.setMode("polling", "stream_setup_failed");
+        });
+    }
+    async connectAuthenticated() {
         if (this.stopped)
             return;
         const url = streamURL(baseURL(), this.projectId, { ...this.options, cursor: this.cursor });
-        const token = getToken();
+        const token = await getValidToken(this.options.signal);
+        if (this.stopped)
+            return;
         // proxy-from-env honors NO_PROXY, including loopback fixture servers.
         const proxy = process.env.NODE_USE_ENV_PROXY === "0" ? "" : getProxyForUrl(url.toString().replace(/^ws/, "http"));
         const socket = new WebSocket(url, {

package/dist/workflow.d.ts

@@ -0,0 +1,44 @@
+export type ThreadStatus = 'idle' | 'running' | 'queued' | 'pending' | 'blocked' | 'completed' | 'failed' | 'unknown';
+export type InputKind = 'none' | 'secret' | 'questions' | 'auth_provider';
+export interface WorkflowSnapshot {
+    status: ThreadStatus;
+    task_id?: unknown;
+    turn?: Record<string, unknown> | null;
+    actions?: Record<string, unknown>[];
+    project?: Record<string, unknown>;
+    reason?: string;
+    interrupted?: boolean;
+    wait_timed_out?: boolean;
+    observation_retrying?: boolean;
+    error?: {
+        retryable?: boolean;
+    };
+}
+/** Host-facing workflow decisions, independent of transport and backend phases. */
+export declare function workflowResult(snapshot: WorkflowSnapshot): {
+    actions?: {
+        id: unknown;
+        kind: unknown;
+        decision: string;
+        required_fields: {};
+        submit_command: unknown;
+    }[] | undefined;
+    build?: {
+        commit: {} | null;
+        matches_task: boolean;
+        success: {} | null;
+    } | undefined;
+    observation: {
+        timed_out: boolean;
+        retrying: boolean;
+        interrupted: boolean;
+    };
+    reason?: string | undefined;
+    state: string;
+    task: {
+        id: {} | null;
+        turn: {} | null;
+        chat_id: {} | null;
+    };
+    next_action: string;
+};