@enterpriseai/cli 3.19.2 → 3.19.4

package/resources/deploy/eai-app-template/.github/workflows/eai-app.yml

@@ -234,6 +234,7 @@ jobs:
             --target-tenant-id "$TARGET_TENANT_ID" \
             --operation-id "$OPERATION_ID" \
             --nonce "$NONCE" \
+            --ref "$GITHUB_REF" \
             --expected-config-hash "$CONFIG_HASH" \
             --environment "$DEPLOY_ENVIRONMENT" \
             --preferred-environment "$PREFERRED_DEPLOY_ENVIRONMENT" \
@@ -450,7 +451,7 @@ jobs:
         shell: bash
         run: |
           if [[ "$LOCAL_E2E_TUNNEL" == true ]]; then
-            [[ "$SOURCE_MODE" == eai-cli-generated && "$GITHUB_EVENT_NAME" == workflow_dispatch && "$REUSABLE_CALL" != true ]]
+            [[ ( "$SOURCE_MODE" == eai-cli-generated || "$SOURCE_MODE" == source-unknown ) && "$GITHUB_EVENT_NAME" == workflow_dispatch && "$REUSABLE_CALL" != true ]]
             [[ "$DEPLOY_ENVIRONMENT" == dev || "$DEPLOY_ENVIRONMENT" == preview ]]
             [[ "$EAI_BOUND_PUBLIC_API_URL" =~ ^https://[a-z0-9-]+-8000\.[a-z0-9-]+\.devtunnels\.ms$ ]]
           else
@@ -795,14 +796,33 @@ jobs:
             const local = evidence.localE2e;
             const repositoryId = process.env.GITHUB_REPOSITORY_ID;
             const expiresAt = process.env.LOCAL_E2E_EXPIRES_AT;
-            if (!local || Object.keys(local).sort().join(',') !== 'audience,expiresAt,mode,origin,templateCommitSha' ||
-                local.mode !== 'local-tunnel-v1' || local.origin !== process.env.EAI_BOUND_PUBLIC_API_URL ||
+            const sourceUnknownLocal = process.env.SOURCE_MODE === 'source-unknown';
+            const expectedKeys = sourceUnknownLocal
+              ? 'audience,expiresAt,mode,nonceDigest,origin'
+              : 'audience,expiresAt,mode,origin,templateCommitSha';
+            if (!local || Object.keys(local).sort().join(',') !== expectedKeys ||
+                local.mode !== (sourceUnknownLocal ? 'source-unknown-local-v1' : 'local-tunnel-v1') ||
+                local.origin !== process.env.EAI_BOUND_PUBLIC_API_URL ||
                 local.expiresAt !== expiresAt || !/^[1-9][0-9]*$/.test(repositoryId) ||
-                !/^[a-f0-9]{40}$/.test(local.templateCommitSha) || Date.parse(expiresAt) <= Date.now()) {
+                Date.parse(expiresAt) <= Date.now()) {
               throw new Error('Build evidence local endpoint binding changed.');
             }
-            const tuple = ['eai.cli-managed-local-e2e-aud.v1', local.origin, evidence.operationId, repositoryId, local.templateCommitSha, expiresAt];
-            const audience = 'api://enterprise-ai-publicapi/eai-cli-generated/local-v1/' + createHash('sha256').update(JSON.stringify(tuple)).digest('hex');
+            if (sourceUnknownLocal && local.nonceDigest !== 'sha256:' + createHash('sha256').update(evidence.nonce).digest('hex')) {
+              throw new Error('Build evidence local nonce binding changed.');
+            }
+            if (!sourceUnknownLocal && !/^[a-f0-9]{40}$/.test(local.templateCommitSha)) {
+              throw new Error('Build evidence local template binding changed.');
+            }
+            const tuple = sourceUnknownLocal
+              ? ['eai.source-unknown-local-e2e-aud.v1', local.origin, process.env.TENANT_ID,
+                  process.env.TARGET_TENANT_ID || process.env.TENANT_ID, process.env.APP_KEY, evidence.operationId,
+                  repositoryId, evidence.workflowPath, evidence.ref, evidence.commitSha,
+                  evidence.configHash, local.nonceDigest, expiresAt]
+              : ['eai.cli-managed-local-e2e-aud.v1', local.origin, evidence.operationId, repositoryId, local.templateCommitSha, expiresAt];
+            const prefix = sourceUnknownLocal
+              ? 'api://enterprise-ai-publicapi/source-unknown/local-v1/'
+              : 'api://enterprise-ai-publicapi/eai-cli-generated/local-v1/';
+            const audience = prefix + createHash('sha256').update(JSON.stringify(tuple)).digest('hex');
             if (local.audience !== audience) throw new Error('Build evidence local OIDC audience changed.');
           } else if (evidence.localE2e !== undefined) {
             throw new Error('Unexpected local endpoint binding in build evidence.');
@@ -1016,7 +1036,7 @@ jobs:
           set -euo pipefail
           validate_endpoint_and_audience() {
             if [[ "$LOCAL_E2E_TUNNEL" == true ]]; then
-              [[ "$SOURCE_MODE" == eai-cli-generated && "$GITHUB_EVENT_NAME" == workflow_dispatch && "$REUSABLE_CALL" != true ]]
+              [[ ( "$SOURCE_MODE" == eai-cli-generated || "$SOURCE_MODE" == source-unknown ) && "$GITHUB_EVENT_NAME" == workflow_dispatch && "$REUSABLE_CALL" != true ]]
               [[ "$DEPLOY_ENVIRONMENT" == dev || "$DEPLOY_ENVIRONMENT" == preview ]]
               [[ "$EAI_BOUND_PUBLIC_API_URL" =~ ^https://[a-z0-9-]+-8000\.[a-z0-9-]+\.devtunnels\.ms$ ]]
               node - <<'NODE'
@@ -1032,14 +1052,27 @@ jobs:
           const local = evidence.localE2e;
           const repoId = process.env.GITHUB_REPOSITORY_ID;
           const expiry = process.env.LOCAL_E2E_EXPIRES_AT;
-          if (!local || Object.keys(local).sort().join(',') !== 'audience,expiresAt,mode,origin,templateCommitSha' ||
-              local.mode !== 'local-tunnel-v1' || local.origin !== process.env.EAI_BOUND_PUBLIC_API_URL ||
+          const sourceUnknownLocal = process.env.SOURCE_MODE === 'source-unknown';
+          const expectedKeys = sourceUnknownLocal
+            ? 'audience,expiresAt,mode,nonceDigest,origin'
+            : 'audience,expiresAt,mode,origin,templateCommitSha';
+          if (!local || Object.keys(local).sort().join(',') !== expectedKeys ||
+              local.mode !== (sourceUnknownLocal ? 'source-unknown-local-v1' : 'local-tunnel-v1') ||
+              local.origin !== process.env.EAI_BOUND_PUBLIC_API_URL ||
               local.expiresAt !== expiry || !/^[1-9][0-9]*$/.test(repoId) ||
-              !/^cli-managed-[a-f0-9]{32}$/.test(evidence.operationId) ||
-              !/^[a-f0-9]{40}$/.test(local.templateCommitSha) ||
               !Number.isFinite(Date.parse(expiry)) || Date.parse(expiry) <= Date.now()) process.exit(1);
-          const tuple = ['eai.cli-managed-local-e2e-aud.v1', local.origin, evidence.operationId, repoId, local.templateCommitSha, expiry];
-          const audience = 'api://enterprise-ai-publicapi/eai-cli-generated/local-v1/' + createHash('sha256').update(JSON.stringify(tuple)).digest('hex');
+          const tuple = sourceUnknownLocal
+            ? ['eai.source-unknown-local-e2e-aud.v1', local.origin, process.env.TENANT_ID,
+                evidence.targetTenantId || process.env.TENANT_ID, process.env.APP_KEY, evidence.operationId, repoId,
+                evidence.workflowPath, evidence.ref, evidence.commitSha, evidence.configHash,
+                local.nonceDigest, expiry]
+            : ['eai.cli-managed-local-e2e-aud.v1', local.origin, evidence.operationId, repoId, local.templateCommitSha, expiry];
+          if (sourceUnknownLocal ? local.nonceDigest !== 'sha256:' + createHash('sha256').update(evidence.nonce).digest('hex')
+              : !/^[a-f0-9]{40}$/.test(local.templateCommitSha)) process.exit(1);
+          const prefix = sourceUnknownLocal
+            ? 'api://enterprise-ai-publicapi/source-unknown/local-v1/'
+            : 'api://enterprise-ai-publicapi/eai-cli-generated/local-v1/';
+          const audience = prefix + createHash('sha256').update(JSON.stringify(tuple)).digest('hex');
           if (local.audience !== audience) process.exit(1);
           process.stdout.write(audience);
           NODE

package/resources/deploy/eai-app-template/producer-pin.json

@@ -2,28 +2,28 @@
   "schemaVersion": "eai.managed-deploy-producer-pin.v1",
   "repository": "eai-support/eai-app-template",
   "candidate": {
-    "commit": "3a117e2cd12ef2375a80ebdc6031927b2da2be78",
+    "commit": "623c4430ba017b8da5b36e84e2fcafd819f79169",
     "workflow": {
       "path": ".github/workflows/eai-app.yml",
-      "sha256": "sha256:e672ee440a434b9d681a73bb00b15c3a2dbb5b0561825cfd7e6abaefd892a4cb"
+      "sha256": "sha256:bce4e34fe5c47377e6a679966a37257d944cd00ccf3c15b4ba437f144ed559ed"
     },
     "collector": {
       "path": "scripts/source-unknown-deployment-evidence.mjs",
-      "sha256": "sha256:ed320c87186579afb3a8a7c9f65b8aea0feadc415a8ec8a0329f741dc106b42f"
+      "sha256": "sha256:06e7f33bf1db1d7adbebb75a76d2756e46371318f36d2518c5cfbb58ad4f5e1c"
     },
     "evidenceTest": {
       "path": "tests/source-unknown-deployment-evidence.test.mjs",
-      "sha256": "sha256:6ca79ea86c03548696d4da6030be04f9dbc6bea60789a68b41b2aec5d115a9d2"
+      "sha256": "sha256:fe5f8381d882ac39656b67b30e1e18193cb676a8aba26a6776a88880a3bb5827"
     }
   },
   "releaseGate": {
     "status": "released",
-    "tag": "v1.0.10",
-    "commit": "3a117e2cd12ef2375a80ebdc6031927b2da2be78"
+    "tag": "v1.0.13",
+    "commit": "623c4430ba017b8da5b36e84e2fcafd819f79169"
   },
   "githubProducerIdentity": {
     "profile": "github-environment-v1",
-    "templateCommitSha": "3a117e2cd12ef2375a80ebdc6031927b2da2be78",
-    "workflowSha256": "sha256:e672ee440a434b9d681a73bb00b15c3a2dbb5b0561825cfd7e6abaefd892a4cb"
+    "templateCommitSha": "623c4430ba017b8da5b36e84e2fcafd819f79169",
+    "workflowSha256": "sha256:bce4e34fe5c47377e6a679966a37257d944cd00ccf3c15b4ba437f144ed559ed"
   }
 }

package/resources/deploy/eai-app-template/scripts/source-unknown-deployment-evidence.mjs

@@ -181,7 +181,7 @@ function localE2eBinding(options, mode, environment, root) {
   const operationId = option(options, 'operationId');
   const repositoryId = option(options, 'repositoryId');
   if (
-    mode !== 'eai-cli-generated' ||
+    !['eai-cli-generated', 'source-unknown'].includes(mode) ||
     !['preview', 'dev'].includes(environment) ||
     option(options, 'githubEventName') !== 'workflow_dispatch' ||
     option(options, 'reusableCall') === 'true' ||
@@ -189,7 +189,6 @@ function localE2eBinding(options, mode, environment, root) {
     !/^[1-9][0-9]*$/.test(repositoryId) ||
     !Number.isSafeInteger(Number(repositoryId)) ||
     String(Number(repositoryId)) !== repositoryId ||
-    !/^cli-managed-[a-f0-9]{32}$/.test(operationId) ||
     !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?\+00:00$/.test(expiresAt) ||
     !Number.isFinite(Date.parse(expiresAt)) ||
     Date.parse(expiresAt) <= Date.now() ||
@@ -197,6 +196,34 @@ function localE2eBinding(options, mode, environment, root) {
   ) {
     throw new Error('Local deployment requires an exact direct DEV/preview tunnel binding.');
   }
+  if (mode === 'source-unknown') {
+    const nonce = option(options, 'nonce');
+    const tenantId = option(options, 'tenantId');
+    const targetTenant = option(options, 'targetTenantId') || tenantId;
+    const appKey = option(options, 'appKey');
+    const workflowPath = option(options, 'workflow', '.github/workflows/eai-app.yml');
+    const ref = option(options, 'ref', process.env.GITHUB_REF || '');
+    const commitSha = option(options, 'commit', process.env.GITHUB_SHA || '');
+    const configHash = option(options, 'expectedConfigHash');
+    if (!/^source-unknown-[a-f0-9]{16}$/.test(operationId)
+      || !tenantId || !targetTenant || !appKey || !nonce
+      || workflowPath !== CANONICAL_WORKFLOW_PATH
+      || !/^refs\/heads\//.test(ref)
+      || !/^[a-f0-9]{40}$/.test(commitSha)
+      || !SHA256_DIGEST.test(configHash)) {
+      throw new Error('Local source-unknown operation binding is incomplete.');
+    }
+    const nonceDigest = `sha256:${createHash('sha256').update(nonce).digest('hex')}`;
+    const fields = ['eai.source-unknown-local-e2e-aud.v1', origin, tenantId,
+      targetTenant, appKey, operationId, repositoryId, workflowPath, ref,
+      commitSha, configHash, nonceDigest, expiresAt];
+    return { mode: 'source-unknown-local-v1', origin, expiresAt, nonceDigest,
+      audience: 'api://enterprise-ai-publicapi/source-unknown/local-v1/'
+        + createHash('sha256').update(JSON.stringify(fields)).digest('hex') };
+  }
+  if (!/^cli-managed-[a-f0-9]{32}$/.test(operationId)) {
+    throw new Error('Local CLI operation binding is invalid.');
+  }
   const binding = JSON.parse(readRegularFileNoFollow(root, '.eai/cli-managed-source-operation.json').toString('utf8'));
   if (
     binding.schemaVersion !== 'eai.cli_managed_source_operation.v1' ||

package/resources/deploy/eai-app-template/tests/source-unknown-deployment-evidence.test.mjs

@@ -25,12 +25,13 @@ import { tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import test from 'node:test';
+import { runInNewContext } from 'node:vm';
 import { gunzipSync } from 'node:zlib';
 
 const canonicalWorkflowRelativePath = '.github/workflows/eai-app.yml';
 const fixtureDirectory = 'tests/fixtures/source-unknown';
 const canonicalDigest =
-  'e672ee440a434b9d681a73bb00b15c3a2dbb5b0561825cfd7e6abaefd892a4cb';
+  'bce4e34fe5c47377e6a679966a37257d944cd00ccf3c15b4ba437f144ed559ed';
 const generatedDigest =
   '77d4951b3e6852ead73cef8b9e8901e3de774f9aca70f71cc0c932c13903ff32';
 const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
@@ -1747,6 +1748,103 @@ test('local CLI dispatch binds direct DEV tunnel, original template and numeric
   }
 });
 
+test('local customer-owned source uses its own exact direct-operation audience', () => {
+  const root = mkdtempSync(join(tmpdir(), 'eai-source-unknown-local-dispatch-'));
+  try {
+    writeFixtureApp(root);
+    execFileSync('git', ['init', '-q'], { cwd: root });
+    execFileSync('git', ['-c', 'user.name=Fixture', '-c', 'user.email=fixture@example.com',
+      'commit', '--allow-empty', '-m', 'fixture'], { cwd: root });
+    const commit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim();
+    const expiry = new Date(Date.now() + 30 * 60 * 1000).toISOString().replace('Z', '+00:00');
+    const args = ['validate-dispatch', '--root', root, '--source-mode', 'source-unknown',
+      '--app-key', 'rates-review', '--tenant-id', 'tenant-parent',
+      '--target-tenant-id', 'hosting-tenant', '--operation-id', `source-unknown-${'a'.repeat(16)}`,
+      '--nonce', 'one-time-source-nonce', '--ref', 'refs/heads/main',
+      '--environment', 'dev', '--expected-config-hash', configHash(root),
+      '--commit', commit, '--workflow-sha', commit,
+      '--public-api-url', 'https://careful-8000.eai.devtunnels.ms',
+      '--local-e2e-tunnel', 'true', '--local-e2e-expires-at', expiry,
+      '--github-event-name', 'workflow_dispatch', '--reusable-call', 'false',
+      '--repository-id', '12345'];
+    runEvidenceScript(args);
+    const withoutTarget = [...args];
+    withoutTarget.splice(withoutTarget.indexOf('--target-tenant-id'), 2);
+    runEvidenceScript(withoutTarget);
+    for (const [key, value] of [
+      ['--public-api-url', 'https://attacker.example'],
+      ['--operation-id', `cli-managed-${'a'.repeat(32)}`],
+      ['--ref', 'refs/pull/1/merge'],
+      ['--environment', 'prod'],
+      ['--local-e2e-expires-at', '2000-01-01T00:00:00+00:00'],
+      ['--repository-id', '0'],
+      ['--reusable-call', 'true'],
+    ]) {
+      const mutated = [...args];
+      mutated[mutated.indexOf(key) + 1] = value;
+      const result = spawnSync(process.execPath, [evidenceScript, ...mutated], { encoding: 'utf8' });
+      assert.equal(result.status, 1, `${key}=${value} must fail`);
+    }
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('direct local workflow checks the same audience with explicit and omitted target tenants', () => {
+  const workflow = readFileSync(workflowPath, 'utf8');
+  const marker = 'const tuple = sourceUnknownLocal';
+  const first = workflow.indexOf(marker);
+  const second = workflow.indexOf(marker, first + marker.length);
+  assert.ok(first >= 0 && second > first);
+  const snippets = [first, second].map((start) => {
+    const end = workflow.indexOf('if (local.audience !== audience)', start);
+    assert.ok(end > start);
+    return `${workflow.slice(start, end)}\naudience;`;
+  });
+  const origin = 'https://careful-8000.eai.devtunnels.ms';
+  const tenantId = 'tenant-parent';
+  const nonce = 'one-time-source-nonce';
+  const nonceDigest = `sha256:${digest(nonce)}`;
+  const expiry = '2026-10-11T02:00:00+00:00';
+  const evidence = {
+    nonce,
+    operationId: `source-unknown-${'a'.repeat(16)}`,
+    workflowPath: canonicalWorkflowRelativePath,
+    ref: 'refs/heads/main',
+    commitSha: 'b'.repeat(40),
+    configHash: `sha256:${'c'.repeat(64)}`,
+  };
+  const audienceFor = (snippet, targetInput, evidenceTarget) =>
+    runInNewContext(snippet, {
+      createHash,
+      process: { env: {
+        TENANT_ID: tenantId,
+        TARGET_TENANT_ID: targetInput,
+        APP_KEY: 'rates-review',
+      }, exit: () => { throw new Error('Unexpected workflow rejection.'); } },
+      sourceUnknownLocal: true,
+      local: { origin, nonceDigest },
+      evidence: { ...evidence, ...(evidenceTarget ? { targetTenantId: evidenceTarget } : {}) },
+      repositoryId: '12345',
+      repoId: '12345',
+      expiresAt: expiry,
+      expiry,
+    });
+  for (const target of ['', 'hosting-tenant']) {
+    const expectedTarget = target || tenantId;
+    const tuple = ['eai.source-unknown-local-e2e-aud.v1', origin, tenantId,
+      expectedTarget, 'rates-review', evidence.operationId, '12345',
+      evidence.workflowPath, evidence.ref, evidence.commitSha, evidence.configHash,
+      nonceDigest, expiry];
+    const expected = `api://enterprise-ai-publicapi/source-unknown/local-v1/${digest(JSON.stringify(tuple))}`;
+    for (const snippet of snippets) {
+      assert.equal(audienceFor(snippet, target, target), expected);
+    }
+  }
+  assert.notEqual(audienceFor(snippets[1], 'hosting-tenant', 'other-tenant'),
+    audienceFor(snippets[0], 'hosting-tenant', 'other-tenant'));
+});
+
 test('source commit is resolved before checkout for direct and reusable calls', () => {
   const workflow = readFileSync(workflowPath, 'utf8');
   const stepStart = workflow.indexOf('      - name: Validate workflow invocation');

package/resources/gofer/agents-skills/eai/SKILL.md

@@ -185,6 +185,24 @@ Confirm the sign-in method separately: EAI sign-in or client SSO through EAI. Ve
 7. After any `eai` error, run `eai errors explain <code-or-reason> --format json` when available before guessing remediation.
 8. Do not write tokens, secrets, private workspace IDs, Entra/CIAM authority tenant IDs, or local `.env` values into artifacts.
 
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
+
 ## Verified EAI CLI Command Contract
 
 Do not invent, guess, or complete EAI CLI commands from memory.
@@ -277,6 +295,8 @@ The EAI Platform supports every step with secure data, identity, multi-tenancy,
 
 I’ll walk you through the whole process and ask short questions as we go. Tell me what you want me to do, or ask **“What’s next?”**, **“What else can you help with?”**, or **“Show me the admin screen.”**
 
+If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+
 **First question:** What process would you like to improve, or what would you like the application to help people do?
 ```
 

package/resources/gofer/claude-commands/eai.md

@@ -175,6 +175,24 @@ Confirm the sign-in method separately: EAI sign-in or client SSO through EAI. Ve
 7. After any `eai` error, run `eai errors explain <code-or-reason> --format json` when available before guessing remediation.
 8. Do not write tokens, secrets, private workspace IDs, Entra/CIAM authority tenant IDs, or local `.env` values into artifacts.
 
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
+
 ## Verified EAI CLI Command Contract
 
 Do not invent, guess, or complete EAI CLI commands from memory.
@@ -267,6 +285,8 @@ The EAI Platform supports every step with secure data, identity, multi-tenancy,
 
 I’ll walk you through the whole process and ask short questions as we go. Tell me what you want me to do, or ask **“What’s next?”**, **“What else can you help with?”**, or **“Show me the admin screen.”**
 
+If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+
 **First question:** What process would you like to improve, or what would you like the application to help people do?
 ```
 

package/resources/gofer/claude-skills/eai/SKILL.md

@@ -185,6 +185,24 @@ Confirm the sign-in method separately: EAI sign-in or client SSO through EAI. Ve
 7. After any `eai` error, run `eai errors explain <code-or-reason> --format json` when available before guessing remediation.
 8. Do not write tokens, secrets, private workspace IDs, Entra/CIAM authority tenant IDs, or local `.env` values into artifacts.
 
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
+
 ## Verified EAI CLI Command Contract
 
 Do not invent, guess, or complete EAI CLI commands from memory.
@@ -277,6 +295,8 @@ The EAI Platform supports every step with secure data, identity, multi-tenancy,
 
 I’ll walk you through the whole process and ask short questions as we go. Tell me what you want me to do, or ask **“What’s next?”**, **“What else can you help with?”**, or **“Show me the admin screen.”**
 
+If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+
 **First question:** What process would you like to improve, or what would you like the application to help people do?
 ```
 

package/resources/gofer/commands/0_gofer_start.md

@@ -333,6 +333,24 @@ in `{FEATURE_DIR}/service-fit-matrix.md` as `unavailable without new platform
 work`, `operator_required`, or `upgrade_required`. Do not silently replace it
 with an unrelated non-EAI stack.
 
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
+
 ### EAI Preflight Checks
 
 1. **Classify the build path**

package/resources/gofer/commands/gofer_eai_first_run.md

@@ -340,6 +340,24 @@ Specifically note whether the installed CLI advertises the commands needed for:
 - AI-agent guidance via `eai agent guide`
 - error recovery guidance via `eai errors explain`
 
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
+
 ## Step 5: Login, Workspace, And Account Readiness
 
 Run:

package/resources/gofer/copilot-prompts/eai.prompt.md

@@ -187,6 +187,24 @@ Confirm the sign-in method separately: EAI sign-in or client SSO through EAI. Ve
 7. After any `eai` error, run `eai errors explain <code-or-reason> --format json` when available before guessing remediation.
 8. Do not write tokens, secrets, private workspace IDs, Entra/CIAM authority tenant IDs, or local `.env` values into artifacts.
 
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
+
 ## Verified EAI CLI Command Contract
 
 Do not invent, guess, or complete EAI CLI commands from memory.
@@ -279,6 +297,8 @@ The EAI Platform supports every step with secure data, identity, multi-tenancy,
 
 I’ll walk you through the whole process and ask short questions as we go. Tell me what you want me to do, or ask **“What’s next?”**, **“What else can you help with?”**, or **“Show me the admin screen.”**
 
+If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+
 **First question:** What process would you like to improve, or what would you like the application to help people do?
 ```
 

package/resources/gofer/gemini/commands/gofer/eai.md

@@ -177,6 +177,24 @@ Confirm the sign-in method separately: EAI sign-in or client SSO through EAI. Ve
 7. After any `eai` error, run `eai errors explain <code-or-reason> --format json` when available before guessing remediation.
 8. Do not write tokens, secrets, private workspace IDs, Entra/CIAM authority tenant IDs, or local `.env` values into artifacts.
 
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
+
 ## Verified EAI CLI Command Contract
 
 Do not invent, guess, or complete EAI CLI commands from memory.
@@ -269,6 +287,8 @@ The EAI Platform supports every step with secure data, identity, multi-tenancy,
 
 I’ll walk you through the whole process and ask short questions as we go. Tell me what you want me to do, or ask **“What’s next?”**, **“What else can you help with?”**, or **“Show me the admin screen.”**
 
+If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+
 **First question:** What process would you like to improve, or what would you like the application to help people do?
 ```
 

package/resources/gofer/github-skills/eai/SKILL.md

@@ -185,6 +185,24 @@ Confirm the sign-in method separately: EAI sign-in or client SSO through EAI. Ve
 7. After any `eai` error, run `eai errors explain <code-or-reason> --format json` when available before guessing remediation.
 8. Do not write tokens, secrets, private workspace IDs, Entra/CIAM authority tenant IDs, or local `.env` values into artifacts.
 
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
+
 ## Verified EAI CLI Command Contract
 
 Do not invent, guess, or complete EAI CLI commands from memory.
@@ -277,6 +295,8 @@ The EAI Platform supports every step with secure data, identity, multi-tenancy,
 
 I’ll walk you through the whole process and ask short questions as we go. Tell me what you want me to do, or ask **“What’s next?”**, **“What else can you help with?”**, or **“Show me the admin screen.”**
 
+If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+
 **First question:** What process would you like to improve, or what would you like the application to help people do?
 ```
 

package/resources/gofer/grok-skills/eai/SKILL.md

@@ -185,6 +185,24 @@ Confirm the sign-in method separately: EAI sign-in or client SSO through EAI. Ve
 7. After any `eai` error, run `eai errors explain <code-or-reason> --format json` when available before guessing remediation.
 8. Do not write tokens, secrets, private workspace IDs, Entra/CIAM authority tenant IDs, or local `.env` values into artifacts.
 
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
+
 ## Verified EAI CLI Command Contract
 
 Do not invent, guess, or complete EAI CLI commands from memory.
@@ -277,6 +295,8 @@ The EAI Platform supports every step with secure data, identity, multi-tenancy,
 
 I’ll walk you through the whole process and ask short questions as we go. Tell me what you want me to do, or ask **“What’s next?”**, **“What else can you help with?”**, or **“Show me the admin screen.”**
 
+If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+
 **First question:** What process would you like to improve, or what would you like the application to help people do?
 ```
 

package/resources/gofer/instruction-templates/base/agents-base.md

@@ -39,3 +39,21 @@ non-app work asks once before skipping EAI tenant/app setup. Artifacts in
   standards.
 - **Minimal Impact**: Changes should only touch what's necessary. Avoid
   introducing bugs.
+
+## Support after an unresolved EAI error
+
+After an `eai` command fails, run `eai errors explain <code-or-reason> --format json`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+`eai support --source harness --tool <current-tool> --format json`.
+Use `codex`, `claude`, `vscode`, `grok`, or `antigravity` for `<current-tool>`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with `--yes --no-open` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run `--yes` automatically.
+Keep secrets, tokens, raw logs, and local `.env` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type `eai support`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.