@getmagical/cli 0.11.0 → 0.12.2

package/README.md

@@ -31,6 +31,34 @@ mgcl automations run-draft --draft-automation-id ... --agent-id ... --idempotenc
 mgcl automations publish --draft-automation-id ...   # non-production only: mgcl refuses against the production API, and the API rejects it too
 ```
 
+## Search automation runs
+
+```bash
+mgcl automation-runs list --search 'REF-123456' --automation-id <id> --json
+mgcl automation-runs list-page --search 'REF-123456' --limit 20 --page 0 --json
+```
+
+Both commands search on the server before pagination and combine `--search`
+with the existing automation, workflow, status, invocation-type, and date
+filters. Search ignores outer whitespace, matches case-insensitively, and
+looks for substrings in run IDs, automation names, run input/shared-input
+values, and current Data Store leaf values. Empty or whitespace-only search
+disables the search predicate while preserving the other filters. PostgreSQL `ILIKE` patterns apply:
+`%` matches any sequence, `_` matches one character, and backslash escapes
+pattern characters. NUL characters are rejected.
+
+Nested input values and Data Store leaves are searched in their JSON text
+representation, so escaped quotes or backslashes can cause misses. Prefer a
+simpler identifying fragment, then inspect the candidate's actual values.
+
+`list` returns an array. `list-page` returns `items`, `page`, `pageSize`,
+`hasMore`, `total`, and `isTotalTruncated`. Use `hasMore` to continue paging;
+when `isTotalTruncated` is true, `total` is only a lower bound. Searched pages
+avoid counting all matches: totals become exact on a nonempty terminal page
+or an empty first page. An empty page beyond the end cannot establish the
+exact total. Random ordering supports only page 0 and searched random samples
+always report a truncated total.
+
 ## Regression tests
 
 Choose how many historical baseline runs to test per pathway:
@@ -436,13 +464,24 @@ denied, including eval management, publishing and deletion, schedules, admin
 operations, raw credential values, browser sessions, interactive sessions, and
 key minting.
 
+`draft-runs:execute-sandbox` allows draft starts only with an explicitly valid
+network capture replay in `--config-json`, for example
+`{"networkTrafficCapture":{"replay":{"recordingId":"<recording UUID>"}}}`.
+Replay also requires `captures:read`; supplying `--initial-store-json` requires
+`store:write`. `runs:execute` continues to authorize these replay starts and is
+required for starts without replay, recording runs, and reruns. The sandbox
+grant does not authorize published or live execution paths.
+
 ### Operator rollout and rollback
 
 Deploy the backend before releasing the CLI flow. In WorkOS, create these
-permissions and grant the appropriate subset to member roles:
+permissions and grant the appropriate subset to member roles. Also enable
+`draft-runs:execute-sandbox` under Authorization > Configuration > API key
+permissions > Users before user API keys can include it:
 
 ```text
 automations:read automations:write runs:read runs:execute runs:control
+draft-runs:execute-sandbox
 store:read store:write skills:read skills:write credentials:read
 captures:read captures:write regressions:read regressions:run
 knowledge:read memory:read files:write