@flowmind/cli 0.3.7 → 0.3.9

package/README.md

@@ -55,9 +55,9 @@ A link names the project by id and keeps its name as a label. `link` accepts an
 project name and checks it against the projects visible to agents. Commit `.flowmind.json` to share
 the link with other machines and agents.
 
-One product is one project on every machine. `projects add` refuses a name that an existing project
-already has (trimmed, ignoring case), names that project and its id, and suggests `flowmind link <id>`.
-It creates nothing in that case. `--allow-duplicate` creates the second project anyway.
+One product is one project on every machine. The API owns that rule: `projects add` sends one request, and the
+API refuses a name that an existing project already has. The CLI prints the API's message and suggests
+`--allow-duplicate` (which creates the second project anyway) or `flowmind link <project>` for the existing one.
 
 `link --ignore` writes `{"ignore": true, "reason": "..."}` as `.flowmind.json` for a third-party clone or
 a scratch folder. `link` then prints `Ignored for Flowmind`, the hooks stay silent there, and
@@ -113,7 +113,7 @@ details as indented bullets, and `--json` includes the API's details unchanged.
 The CLI reads the project from `.flowmind.json` and the session from `CODEX_THREAD_ID` or the one
 session with a turn in progress in the repository. The duration is the main agent's recorded turn
 time since the session's last staged proof, in whole minutes; the remaining seconds carry over to
-the next proof. Idle time between turns does not count, and neither does sleep: the hooks read the
+the next proof. A stop closes only its matching turn; an unfinished turn counts only through its last recorded activity. Idle time between turns does not count, and neither does sleep: the hooks read the
 awake clock that Codex uses for "Worked for". Subagent prompts never start a turn, because the main
 agent's turn already contains their work. Codex runs no prompt hook for a turn that another chat
 starts (`send_message_to_thread`, `create_thread`). For such a turn the CLI reads the start, the end
@@ -140,28 +140,56 @@ Staging adds no hours; approve in Activity individually or confirm **Approve all
 
 The retry key derives from the session id, project id, and start time, so each work unit in a
 session gets its own key. `agent capabilities`, `agent projects`, `agent routines`, `agent proposals`,
-and `agent cancel` accept `--json`. `auth status` shows the API URL and accepts `--json`.
+and `agent cancel` accept `--json`. `auth status` checks the credential with the API and accepts `--json`. A failed connection reports an error; a revoked key reports `authenticated: false`.
 
 ### Saved stages
 
-The CLI saves every stage on the machine before it sends it, so a crash, a timeout or a lost answer
+After login the CLI saves every stage for that API and account before it sends it, so a crash, a timeout or a lost answer
 never loses it. When Flowmind does not take the stage, because the API is unreachable, answers too
 slowly (30 seconds), fails, limits the request, or sends an answer the CLI cannot read, the stage
 stays saved and the command exits 0 with `"staged": false`, `"reason": "saved"`, the `error`, and a
 `pendingStageId`. The session counts its time as staged, so the next proof does not repeat it. A
-refused or missing credential, or an unexpected CLI error, keeps the stage saved but exits 1, because
+refused credential for a known account, or an unexpected CLI error, keeps the stage saved but exits 1, because
 someone must act. A stage that the API refuses for its content is removed, and its time stays unstaged
 for a corrected proof.
 
 Saved stages are sent with the same retry key and body. The API keeps one proof per account and
-retry key, also after its 24-hour receipt expires and under another credential, so a stage that
-reached the server before its answer was lost comes back as the same proposal. Saved stages go out after the next accepted stage
+retry key for the credential that sent it, also after its 24-hour receipt expires, so a stage that
+reached the server before its answer was lost comes back as the same proposal. After
+`flowmind auth login` replaces the stored key, the API answers a stage that the old key already delivered
+with `This stage key is already in use`. That key can hold a different body, so the CLI keeps the request,
+its original credential fingerprint (not the key itself), and its time in `conflict`. No hook or later stage
+sends it. Check Activity, then use `flowmind agent retry` with the original credential or explicitly
+discard it with `flowmind agent discard <id>`. Retry reports unresolved items in `conflicts`; only a
+returned proposal confirms delivery.
+Each saved file is checked before sending, including its name, key/body hash, timestamps, source, details and
+evidence. An unreadable reservation is kept. It blocks measured staging for this account until you repair
+and retry it, or discard it after checking Activity. Saved stages go out after the next accepted stage
 (`savedStagesSent` in the JSON output) and from the session hooks, which start `agent retry --due`
 in the background when one is due: 1, 2, 4 … minutes after each failed attempt, at most an hour.
 `agent pending` lists them and `agent retry` sends them now; both accept `--json`. A saved stage that
 the API later refuses for its content stays listed as `rejected` and is not sent again.
 If a process ends between saving a stage and marking its session, the next stage on the machine
-restores the mark first. One sender runs at a time per machine.
+restores the mark first. Only one process stages or sends for an account at a time. Returning to the same account after login restores its queue. Signing in to another account never adopts it.
+
+The CLI keeps each account's sign-in periods on this machine, including earlier periods after logout.
+A whole turn belongs to the account signed in then, even if its first hook in the session came later.
+A turn crossing a sign-in or sign-out counts only its part within that period, and only when the awake
+clock places the boundary within the turn. Without that evidence, the uncertain part counts nothing.
+On hosts without turn IDs, overlapping prompts count nothing until all their stops have arrived.
+An ordinary prompt and stop still count; a restart or a gap longer than 12 hours adds no unverified time.
+
+Upgrading from 0.3.7 needs no new sign-in. A never-bound profile asks the API which account owns its
+stored key (`GET /v1/me`, once). A previously bound key whose credential or origin no longer matches
+is refused locally. While a profile has only ever been signed in to one account, which is the normal case
+of one person on their own machine, the session time and saved proofs that 0.3.7 recorded become that
+account's on the first command or hook after the upgrade: an agent session that was running during the
+upgrade stages its whole time as before, and saved proofs are sent with the others. On a profile that has
+switched accounts, 0.3.7 proofs stay in their original location and the `unowned` list in `agent pending`
+shows only neutral metadata. Check Activity before adopting a proof that is yours with
+`flowmind agent adopt <id>`, or delete it unsent with `flowmind agent discard <id>`. A revoked key asks you to
+sign in; an unreachable API reports that the account could not be verified and changes nothing. On POSIX the
+config directory is 0700 and its credential file is 0600, including when repairing an older config.
 
 ## Momentum brief
 
@@ -225,9 +253,7 @@ A valid API rejection also exits with status 1.
 One diagnostic names the action, operation, schema location, and request ID when available.
 Diagnostics omit response values, credentials, query values, and server messages.
 
-A write with a transport failure, timeout, or contract failure is not confirmed.
-The client never retries it. Check Activity before submitting it again.
-Natural logging no longer offers a retry prompt after an uncertain save.
+A personal log with a transport failure, timeout, or unreadable response is not confirmed. The CLI does not retry it automatically. Run the same log command to replay its saved fields and key. A natural log reuses what you already reviewed. After the 24-hour receipt window the same command is refused, because the server may no longer recognize the key. Check Activity, then close the saved log with `flowmind pending-logs done <id>` when the entry is there, or `flowmind pending-logs discard <id>` to log the work again. `flowmind pending-logs` lists the saved logs; neither action posts anything. `--hours` takes hours or minutes: `1.5`, `1,5`, `2h`, `90m` or `1h30m`, rounded to the nearest minute. Anything else is refused before a request.
 Authentication stops immediately on a failed poll. Pending authorization continues polling.
 Expired authorization exits with status 1. No failed authorization saves a credential.
 Use `fm auth login --no-browser` to open the printed authorization URL yourself.

package/dist/flowmind/SKILL.md

@@ -42,7 +42,7 @@ One product is one Flowmind project on every machine. The same repository on ano
 
 Ask the user once when you are unsure which project a repository belongs to, or whether it counts at all. Do this before you finish the task.
 
-To find gaps across the user's folders, run `flowmind link --scan <dir...>`. It lists each repository as `linked`, `ignored`, `remote-linked`, or `unlinked`.
+To find gaps across the user's folders, run `flowmind link --scan <dir...>`. It lists each repository as `linked`, `ignored`, `remote-linked`, or `unlinked`. An `invalid` result includes the lookup error; resolve it before linking.
 
 ## Log agent work
 
@@ -52,7 +52,7 @@ In a linked repository, the session hooks record how long the main agent's turns
 flowmind agent stage --intention "<what you set out to do>" --outcome "<one line: what changed>" --detail "<proof or open item>" --artifact-url <commit, PR, or document URL> --json
 ```
 
-- The CLI reads the project from `.flowmind.json` and the time from the session record. The time is the main agent's turn time on the awake clock that Codex uses for "Worked for", so sleep does not count. It includes the time that subagents work during the turn.
+- The CLI reads the project from `.flowmind.json` and the time from the session record. The time is the main agent's turn time on the awake clock that Codex uses for "Worked for", so sleep does not count. A stop must match its turn. An unfinished turn counts only through its last recorded activity.
 - A turn that another chat starts, for example with `send_message_to_thread` or `create_thread`, counts like a typed turn. Codex runs no prompt hook for it, so the CLI reads its start from the Codex session file.
 - A stage covers the whole minutes since the session's last proof. The remaining seconds carry over to the next proof.
 - When several units of work finish together, stage them as one proof that names them all. A second stage right after the first has no new time.
@@ -60,7 +60,8 @@ flowmind agent stage --intention "<what you set out to do>" --outcome "<one line
 - `"staged": false` in the JSON output means that nothing was staged, and it is not an error. `reason` is `no-new-time` when the last proof (`lastProposalId`) already holds the session's time, or `subagent`. Tell the user which proof covers the work.
 - `"reason": "saved"` means that the server did not take the proof yet, for example because Flowmind was unreachable, a limit was reached, or its answer could not be read. The CLI saved it on this machine and sends it automatically: after the next accepted stage, or in the background from the session hooks. Its time already counts as staged. Do not stage it again, do not invent another `--idempotency-key`, and tell the user it waits to be sent.
 - A refused credential also keeps the proof saved, but exits with an error: the user must run `flowmind auth login`. A proof that the server refuses for its content (too long, unknown project) is not saved; fix it and stage again.
-- `flowmind agent pending --json` lists the proofs saved on this machine; `flowmind agent retry --json` sends them now.
+- A stage key conflict means delivery is unknown. The file and its time stay reserved. Tell the owner to check Activity, then retry with the original credential or discard the file with `flowmind agent discard <id>`. Do not stage the same work again. `agent retry --json` lists unresolved `conflicts`.
+- `flowmind agent pending --json` lists this signed-in account’s proofs saved on this machine; `flowmind agent retry --json` sends them now. Proofs and session time from CLI 0.3.7 join the account automatically on a machine that has only used one account. `unowned` appears only after an account switch: it lists neutral metadata for proofs saved by the older CLI; tell the user, who decides with `flowmind agent adopt <id>` or `flowmind agent discard <id>`.
 - After 20 minutes of unstaged agent time, each prompt in a linked repository carries a reminder with the unstaged minutes. Stage when the current unit of work is complete; a stage with explicit times also resets the count.
 - Add `--dry-run` to preview the project and minutes without staging.
 - Pass `--project`, `--minutes`, and `--started-at` only when no session record exists. Use observed times only. Never estimate time from tokens or tool calls.
@@ -121,4 +122,4 @@ Ask only for missing fields. A natural-language entry (`flowmind log "2h on the
 - "Several agent sessions have a turn in progress": pass `--session-id`.
 - "No project given": run `flowmind link <project>` in the repository, or pass `--project`.
 - "This repository is ignored for Flowmind": the repository has an ignore marker. Pass `--project` only if the user wants this work staged.
-- "A project named ... already exists": link to that project with `flowmind link <id>`. Use `--allow-duplicate` only when the user asks for a second project with the same name.
+- "A project already has this name": link to the existing project with `flowmind link <project>`. Use `--allow-duplicate` only when the user asks for a second project with the same name.