@go-labs-sg/bb 1.14.0 → 1.16.0

package/README.md

@@ -6,6 +6,8 @@ For AI agents: bills and claims are stored as the same underlying bill records.
 
 For AI agents using this CLI: always check whether a newer `@go-labs-sg/bb` version is available before running Budget Builder commands, then update the CLI if needed so command flags and API behavior stay current.
 
+For AI agents using this CLI: do not execute approval decisions, approval requests, status updates, `mark-budget-won`, `submit-quotation`, or supplier approval request side effects until the user explicitly confirms the exact entity, target state, and side effects. Inspect the entity first, summarize what will change and whether emails/integrations will run, then wait for a clear confirmation from the user. These sensitive workflow commands also require an interactive `CONFIRM` prompt at runtime and abort in non-interactive shells.
+
 **Registry:** [`@go-labs-sg/bb`](https://www.npmjs.com/package/@go-labs-sg/bb)
 
 ## Requirements
@@ -56,6 +58,10 @@ Global options and flags use `--key=value` or `--key value` (see `bb help`).
 
 **Budget status automation:** Setting a budget to `ESTIMATE_ACCEPTED` requires a confirmed win-proof attachment. If the parent project is `PITCH` or `LOST`, the API now marks it `WON` automatically and, when the `asana-tasks` feature flag is enabled, creates the Asana project/section/tasks automatically. When rejecting the only accepted/closed budget on a commercial project, pass `--projectStatusOnCommercialRejection PITCH|LOST`.
 
+**Sensitive workflow changes:** Approval decisions/requests, entity status updates, `mark-budget-won`, `submit-quotation`, and supplier approval request side effects require an interactive `CONFIRM` prompt. Non-interactive runs abort before the guarded workflow mutation. Agents must get user confirmation in chat before attempting the command; the prompt is a final runtime guard, not a replacement for user approval.
+
+**Locked estimate budget changes:** Budget-changing CLI commands require an interactive `yes` confirmation when the current budget status is `ESTIMATE_CREATED`, `ESTIMATE_SENT`, `ESTIMATE_ACCEPTED`, `ESTIMATE_REJECTED`, or `ESTIMATE_CLOSED`. There is no force/override flag; non-interactive runs abort before mutating locked budgets.
+
 **Mutations with `--payload`:** Commands such as `create-budget`, `create-bill`, `update-supplier`, etc. take a single JSON object (`--payload '<json>'`) matching the corresponding tRPC procedure input. Use ISO strings for date/datetime fields; the CLI coerces them where needed. The API still validates the full shape. Plain `description` fields for item create/update are converted to `descriptionRichText`; pass `descriptionRichText` directly when formatted Tiptap JSON is required. For **`update-project`**, the project window is `dateRange.from` and `dateRange.to` (optional end); there are no separate event-date fields on the project payload. **`create-budget` / `update-budget`** do not accept `asanaTaskId`; configure the deal card on the project (`update-project` / project settings).
 
 ### Command overview
@@ -66,7 +72,7 @@ Global options and flags use `--key=value` or `--key value` (see `bb help`).
 | **Bills / claims** | `list-bills` (`--isClaimable false` for bills, `--isClaimable true` for claims, omit for both), `list-claims` (claims only), `create-bill` (`--payload`; set `isClaimable=false` for a bill or `isClaimable=true` for a claim; non-legacy supplier bills from 1 Jul 2026 00:00 SGT require approved quotation coverage), `update-bill` (`--payload`), `delete-bill`, `create-bill-approval` (also sends approval request emails), `update-bill-status`, `patch-bill-payment` (PAID bills: `--paymentTrackingUrl`, `--paymentReference`, `--quickbooksBillId`, `--paymentDate` ISO; clear with `--clearPaymentTrackingUrl` / `--clearPaymentReference` / `--clearQuickbooksBillId` / `--clearPaymentDate` `true`), `patch-bill-invoice-number`, `get-bill-attachments`, `upload-bill-attachment` (`<billId>` + local path), `get-bill-details` |
 | **Quotations** | `list-quotations`, `get-quotation`, `upload-quotation-attachment` (`<projectId>` + local PDF path; returns attachment JSON for payload use), `create-quotation` (`--payload` for `quotation.createDraft`), `submit-quotation`, `approve-quotation`, `reject-quotation`, `download-quotation-pdf` (`original`, `staff`, or `final`) |
 | **Approvals** | `list-approvals` / `get-pending-approvals` (`--type budget\|supplier\|bill\|quotation\|all`), `approve-bill` / `reject-bill` (send reply email), `approve-budget` / `reject-budget` (send reply email), `approve-supplier` / `reject-supplier` (send reply email), `approve-quotation` / `reject-quotation` |
-| **Companies & projects** | `list-companies`, `get-company`, `create-company`, `update-company` (`--payload`), `delete-company`, `list-projects`, `get-project`, `create-project` (required: `--name`, `--companyId`, `--contactPersonId`, `--insideSalesId`, `--businessDevelopmentId`, `--venue`, `--asanaTaskId`, `--slackChannelId`, `--slackChannelUrl`, `--slackChannelName`, `--startDate` as ISO datetime for project/window start; optional `--pax`; optional `--endDate`; optional `--description`; optional `--requestQboAccountantNotification false` to skip QBO accountant emails), `update-project` (`--payload` with `dateRange.from` / `dateRange.to` for the project window; optional `requestQboAccountantNotification` in JSON), `delete-project`, `update-project-status` (`<id>` `<status>`: `PITCH` \| `WON` \| `COMPLETED` \| `LOST`; for `PITCH` → `WON` also pass `--projectManagerId` or `--projectManagerName`; when marking `WON` without an accepted/closed budget or proof, pass `--wonOverrideReason`) |
+| **Companies & projects** | `list-companies`, `get-company`, `create-company`, `update-company` (`--payload`), `delete-company`, `list-projects`, `get-project`, `create-project` (required: `--name`, `--companyId`, `--contactPersonId`, `--insideSalesId`, `--businessDevelopmentId`, `--venue`, `--startDate` as ISO datetime for project/window start; when `--asanaTaskId` is omitted, the CLI searches open Asana lead tasks in the Deals project, prompts for one of the top five matches, and resolves Slack channel fields from the selected deal card; optional `--asanaSearch`, `--pax`, `--endDate`, `--description`; always requests QBO project import like the web app), `update-project` (`--payload` with `dateRange.from` / `dateRange.to` for the project window; optional `requestQboAccountantNotification` in JSON), `delete-project`, `update-project-status` (`<id>` `<status>`: `PITCH` \| `WON` \| `COMPLETED` \| `LOST`; for `PITCH` → `WON` also pass `--projectManagerId` or `--projectManagerName`; when marking `WON` without an accepted/closed budget or proof, pass `--wonOverrideReason`) |
 | **Contacts** | `list-contacts`, `create-contact-person` (`--payload`), `update-contact-person` (`--payload`) |
 | **Suppliers & items** | `list-suppliers` (defaults to active suppliers, `--perPage 10`, sorted by `createdAt` desc; supports `--name`, `--sortBy` for scalar supplier fields, `--sortDir`, `--createdBy`, `--gstRegistered`, `--status`, `--supplierTags`, `--active false` for archived suppliers), `create-supplier` (`--payload`; when supplier status is `PENDING_APPROVAL`, also runs `supplier.createSupplierApproval` and `email.sendSupplierApprovalRequestEmail`), `update-supplier` (`--payload`; when supplier status is `PENDING_APPROVAL`, also runs `supplier.createSupplierApproval` and `email.sendSupplierApprovalRequestEmail`), `delete-suppliers` (`--ids` CSV; admin; archives/deactivates related items), `reactivate-suppliers` (`--ids` CSV; admin; reactivates related items), `create-certification` / `create-payment-method` / `create-supplier-role` / `create-supplier-tag` (`--name`), `get-supplier-details` (includes `supplierApprovalSummary` for pending approvers, superseded approvers, and the actual responder/respondedAt metadata), `get-supplier-analytics`, `list-items`, `create-item` (`--payload`), `update-item` (`--payload`), `delete-item`, `get-item`, `list-item-categories`, `create-item-category`, `update-item-category`, `delete-item-categories` (`--ids` CSV; admin) |
 | **Dashboard & users** | `list-users`, `get-user-performance`, `get-dashboard`, `get-monthly-metrics`, `get-system-overview`, `get-estimate-performance`, `get-financial-overview` |

package/dist/commands.js

@@ -1,32 +1,293 @@
 import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { basename } from "node:path";
+import { createInterface } from "node:readline/promises";
 import { contentType } from "mime-types";
 import { api } from "./api-client.js";
 import { BudgetRole, Deals, ExtendedApprovalStatus, ExtendedApprovalType, ExtendedBudgetStatus, TimeFrame, } from "./filter-enums.js";
 import { billStatusesForApi, } from "./parse-cli-enums.js";
 import { parseBudgetDiscountPayload, parseCompanyUpdatePayload, parseContactCreatePayload, parseContactUpdatePayload, parseCreateBillPayload, parseCreateBudgetPayload, parseItemCreatePayload, parseItemUpdatePayload, parseSupplierCreatePayload, parseSupplierUpdatePayload, parseUpdateBillPayload, parseUpdateBudgetCommissionPayload, parseUpdateBudgetPayload, parseUpdateProjectPayload, } from "./parse-mutation-payload.js";
+import { BudgetStatus, } from "./prisma-enums.js";
 import { createRichTextFromPlainText } from "./rich-text.js";
 const BUDGET = "BUDGET";
 const BILL = "BILL";
 const SUPPLIER = "SUPPLIER";
 const QUOTATION = "QUOTATION";
+const ASANA_WON_LOST_SECTION_GIDS = new Set([
+    "1211678338364908",
+    "1211678338364907",
+]);
+const MAX_ASANA_LEAD_CANDIDATES = 5;
+const ASANA_SEARCH_DETAIL_LIMIT = 15;
 function isPendingRequest(n) {
     return n.notificationType === "request" && n.status === "PENDING_APPROVAL";
 }
 const out = (data) => {
     console.log(JSON.stringify(data, null, 2));
 };
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const stringField = (record, key) => {
+    const value = record[key];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+};
+const asanaSectionsForTask = (task) => {
+    if (!isRecord(task) || !Array.isArray(task.memberships))
+        return [];
+    return task.memberships.flatMap((membership) => {
+        if (!isRecord(membership) || !isRecord(membership.section))
+            return [];
+        return [
+            {
+                gid: stringField(membership.section, "gid"),
+                name: stringField(membership.section, "name"),
+            },
+        ];
+    });
+};
+const isWonOrLostAsanaTask = (task) => asanaSectionsForTask(task).some((section) => {
+    if (section.gid && ASANA_WON_LOST_SECTION_GIDS.has(section.gid)) {
+        return true;
+    }
+    const name = section.name?.trim().toLowerCase();
+    return Boolean(name && /\b(won|lost)\b/.test(name));
+});
+const asanaCandidateFromTask = (task, details) => {
+    const source = details ?? task;
+    const sourceRecord = isRecord(source) ? source : undefined;
+    const gid = (sourceRecord ? stringField(sourceRecord, "gid") : undefined) ?? task.gid;
+    const name = (sourceRecord ? stringField(sourceRecord, "name") : undefined) ??
+        task.name ??
+        gid;
+    if (!gid || isWonOrLostAsanaTask(source))
+        return null;
+    return {
+        gid,
+        name,
+        modifiedAt: (sourceRecord ? stringField(sourceRecord, "modified_at") : undefined) ??
+            task.modified_at,
+        createdAt: (sourceRecord ? stringField(sourceRecord, "created_at") : undefined) ??
+            task.created_at,
+        sections: asanaSectionsForTask(source),
+    };
+};
+const uniqueSearchQueries = (...queries) => {
+    const seen = new Set();
+    const unique = [];
+    for (const query of queries) {
+        const normalized = query?.trim() ?? "";
+        if (!normalized)
+            continue;
+        const key = normalized.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        unique.push(normalized);
+    }
+    return unique;
+};
+const searchOpenAsanaLeadCandidates = async ({ projectName, searchQuery, }) => {
+    const queries = uniqueSearchQueries(projectName, searchQuery);
+    const candidates = [];
+    const seenTaskIds = new Set();
+    for (const query of queries) {
+        const results = await api.asana.searchTasks.query({ query });
+        const tasks = results.data.slice(0, ASANA_SEARCH_DETAIL_LIMIT);
+        const detailsByTaskId = new Map();
+        await Promise.all(tasks.map(async (task) => {
+            if (!task.gid)
+                return;
+            try {
+                const details = await api.asana.getTaskById.query({ id: task.gid });
+                detailsByTaskId.set(task.gid, details.data);
+            }
+            catch {
+                // Keep the compact search result if detail lookup fails for one task.
+            }
+        }));
+        for (const task of tasks) {
+            if (!task.gid || seenTaskIds.has(task.gid))
+                continue;
+            const candidate = asanaCandidateFromTask(task, detailsByTaskId.get(task.gid));
+            if (!candidate)
+                continue;
+            seenTaskIds.add(candidate.gid);
+            candidates.push(candidate);
+            if (candidates.length >= MAX_ASANA_LEAD_CANDIDATES)
+                return candidates;
+        }
+    }
+    return candidates;
+};
+const formatAsanaCandidateMetadata = (candidate) => {
+    const sectionText = candidate.sections
+        .map((section) => section.name ?? section.gid)
+        .filter(Boolean)
+        .join(", ") || "stage unavailable";
+    const dateText = candidate.modifiedAt
+        ? `modified ${new Date(candidate.modifiedAt).toISOString()}`
+        : candidate.createdAt
+            ? `created ${new Date(candidate.createdAt).toISOString()}`
+            : "date unavailable";
+    return `${sectionText}; ${dateText}; ${candidate.gid}`;
+};
+const promptForAsanaLeadCandidate = async (candidates) => {
+    if (candidates.length === 0) {
+        throw new Error("No open Asana lead tasks were found in the Deals project. Pass --asanaTaskId explicitly or update the Deals project first.");
+    }
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new Error("create-project requires --asanaTaskId in non-interactive runs. Interactive runs can omit it to choose from the top Asana lead task matches.");
+    }
+    console.error("Select the Asana lead task to link to this project:");
+    candidates.forEach((candidate, index) => {
+        console.error(`${index + 1}. ${candidate.name} (${formatAsanaCandidateMetadata(candidate)})`);
+    });
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stderr,
+    });
+    try {
+        while (true) {
+            const answer = await rl.question(`Choose 1-${candidates.length}, or q to abort: `);
+            const trimmed = answer.trim().toLowerCase();
+            if (trimmed === "q" || trimmed === "quit") {
+                throw new Error("Aborted.");
+            }
+            const selected = Number.parseInt(trimmed, 10);
+            if (Number.isInteger(selected) &&
+                selected >= 1 &&
+                selected <= candidates.length) {
+                const candidate = candidates[selected - 1];
+                if (candidate)
+                    return candidate;
+            }
+            console.error(`Enter a number from 1 to ${candidates.length}.`);
+        }
+    }
+    finally {
+        rl.close();
+    }
+};
+const resolveAsanaDealSlackChannel = async (asanaTaskId) => {
+    const result = await api.asana.getDealSlackChannel.query({ id: asanaTaskId });
+    if (result.status !== "resolved") {
+        throw new Error(result.message);
+    }
+    console.error(`Resolved Slack channel from Asana deal: #${result.channel.slackChannelName} (${result.channel.slackChannelId})`);
+    return result.channel;
+};
+const resolveCreateProjectLinks = async (opts) => {
+    const asanaTaskId = opts.asanaTaskId?.trim() ||
+        (await promptForAsanaLeadCandidate(await searchOpenAsanaLeadCandidates({
+            projectName: opts.name,
+            searchQuery: opts.asanaSearch,
+        }))).gid;
+    const hasCompleteManualSlackChannel = Boolean(opts.slackChannelId && opts.slackChannelUrl && opts.slackChannelName);
+    if (hasCompleteManualSlackChannel) {
+        return {
+            asanaTaskId,
+            slackChannelId: opts.slackChannelId,
+            slackChannelUrl: opts.slackChannelUrl,
+            slackChannelName: opts.slackChannelName,
+        };
+    }
+    const slackChannel = await resolveAsanaDealSlackChannel(asanaTaskId);
+    return {
+        asanaTaskId,
+        ...slackChannel,
+    };
+};
 const combineDateAndTime = (day, time) => {
     const d = new Date(day);
     d.setHours(time.getHours(), time.getMinutes(), time.getSeconds(), 0);
     return d;
 };
+const formatOptionalProjectPaxInput = (pax) => {
+    if (typeof pax !== "number" || !Number.isFinite(pax) || pax <= 0) {
+        return "";
+    }
+    return String(pax);
+};
 /** Extension-based MIME, like browser `File.type` when the OS provides it */
 const contentTypeHeaderForFileName = (fileName) => {
     const ct = contentType(fileName);
     return typeof ct === "string" ? ct : "application/octet-stream";
 };
+const LOCKED_BUDGET_STATUSES_REQUIRING_CONFIRMATION = new Set([
+    BudgetStatus.ESTIMATE_CREATED,
+    BudgetStatus.ESTIMATE_SENT,
+    BudgetStatus.ESTIMATE_ACCEPTED,
+    BudgetStatus.ESTIMATE_REJECTED,
+    BudgetStatus.ESTIMATE_CLOSED,
+]);
+const lockedBudgetStatusLabels = {
+    ESTIMATE_CREATED: "Estimate Created",
+    ESTIMATE_SENT: "Estimate Sent",
+    ESTIMATE_ACCEPTED: "Estimate Accepted",
+    ESTIMATE_REJECTED: "Estimate Rejected",
+    ESTIMATE_CLOSED: "Estimate Closed",
+};
+const lockedBudgetStatusLabel = (status) => status in lockedBudgetStatusLabels
+    ? lockedBudgetStatusLabels[status]
+    : status;
+const assertSensitiveWorkflowConfirmed = async ({ action, entity, details, }) => {
+    const expected = "CONFIRM";
+    const detailText = details ? ` ${details}` : "";
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new Error(`${action} on ${entity}${detailText} is a sensitive Budget Builder workflow change. Run this command in an interactive terminal after the user explicitly confirms the exact action, then type "${expected}" to continue.`);
+    }
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stderr,
+    });
+    try {
+        const answer = await rl.question(`${action} on ${entity}${detailText} may change workflow status, approvals, or send notification emails. Confirm the user explicitly approved this exact action, then type "${expected}" to continue: `);
+        if (answer.trim() !== expected) {
+            throw new Error("Aborted.");
+        }
+    }
+    finally {
+        rl.close();
+    }
+};
+const assertLockedBudgetChangeConfirmed = async ({ budget, action, }) => {
+    if (!LOCKED_BUDGET_STATUSES_REQUIRING_CONFIRMATION.has(budget.status)) {
+        return;
+    }
+    const statusLabel = lockedBudgetStatusLabel(budget.status);
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new Error(`${action} would change locked budget "${budget.name}" (${budget.id}) with status ${statusLabel}. Run this command in an interactive terminal and type "yes" to confirm.`);
+    }
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stderr,
+    });
+    try {
+        const answer = await rl.question(`${action} will change locked budget "${budget.name}" (${budget.id}) with status ${statusLabel}. Type "yes" to continue: `);
+        if (answer.trim().toLowerCase() !== "yes") {
+            throw new Error("Aborted.");
+        }
+    }
+    finally {
+        rl.close();
+    }
+};
+const confirmLockedBudgetChangeByBudgetId = async (budgetId, action) => {
+    const budget = await api.budget.getBudget.query({ id: budgetId });
+    await assertLockedBudgetChangeConfirmed({
+        budget: {
+            id: budget.id,
+            name: budget.name,
+            status: budget.status,
+        },
+        action,
+    });
+};
+const confirmLockedBudgetChangeByBudgetItemId = async (budgetItemId, action) => {
+    const { budget } = await api.budgetItem.getBudgetItemContext.query({
+        budgetItemId,
+    });
+    await assertLockedBudgetChangeConfirmed({ budget, action });
+};
 export async function listBudgets(opts) {
     const input = {
         projectId: opts.projectId,
@@ -52,9 +313,18 @@ export async function getBudget(id) {
     out({ budget, items });
 }
 export async function updateBudgetStatus(budgetId, status, opts) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Update budget status",
+        entity: `budget ${budgetId}`,
+        details: `to ${status}`,
+    });
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Update budget status");
     const result = await api.budget.updateBudgetStatus.mutate({
         id: budgetId,
         status,
+        ...(opts?.projectManagerId !== undefined && {
+            projectManagerId: opts.projectManagerId,
+        }),
         ...(opts?.markProjectWon !== undefined && {
             markProjectWon: opts.markProjectWon,
         }),
@@ -116,7 +386,7 @@ const runBudgetPreflight = async (budgetId, preflight) => {
             insideSalesId: project.insideSalesId ?? "",
             businessDevelopmentId: project.businessDevelopmentId ?? "",
             venue: project.venue ?? "",
-            pax: String(project.pax ?? ""),
+            pax: formatOptionalProjectPaxInput(project.pax),
             ...(project.slackChannelId &&
                 project.slackChannelUrl &&
                 project.slackChannelName
@@ -149,6 +419,11 @@ export async function listBills(opts) {
     out(result);
 }
 export async function approveBill(billId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Approve bill",
+        entity: `bill ${billId}`,
+        details: "and send requester reply email",
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => isPendingRequest(n) &&
         n.type === BILL &&
@@ -240,6 +515,11 @@ export async function listSuppliers(opts) {
 }
 // --- Bills (MCP parity) ---
 export async function createBillApproval(billId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Create bill approval request",
+        entity: `bill ${billId}`,
+        details: "and send approval request emails",
+    });
     const result = await api.bill.createApproval.mutate({ billId });
     const approvalIds = (result.results ?? []).map((item) => ({ id: item.id }));
     let email;
@@ -265,6 +545,11 @@ export async function createBillApproval(billId) {
     });
 }
 export async function updateBillStatus(opts) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Update bill status",
+        entity: `bill ${opts.id}`,
+        details: `to ${opts.status}`,
+    });
     const result = await api.bill.updateStatus.mutate({
         id: opts.id,
         status: opts.status,
@@ -357,6 +642,7 @@ export async function uploadQuotationAttachmentFromPath(projectId, filePath) {
     });
 }
 export async function uploadBudgetAttachmentFromPath(budgetId, filePath) {
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Upload budget attachment");
     const buf = await readFile(filePath);
     const fileName = basename(filePath);
     const size = buf.byteLength;
@@ -382,6 +668,12 @@ export async function uploadBudgetAttachmentFromPath(budgetId, filePath) {
     out(confirmed);
 }
 export async function uploadBudgetWinProofFromPath(budgetId, filePath, opts) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Mark budget won",
+        entity: `budget ${budgetId}`,
+        details: "by uploading proof and setting status to ESTIMATE_ACCEPTED",
+    });
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Mark budget won");
     const buf = await readFile(filePath);
     const fileName = basename(filePath);
     const size = buf.byteLength;
@@ -407,6 +699,9 @@ export async function uploadBudgetWinProofFromPath(budgetId, filePath, opts) {
     const result = await api.budget.updateBudgetStatus.mutate({
         id: budgetId,
         status: "ESTIMATE_ACCEPTED",
+        ...(opts?.projectManagerId !== undefined && {
+            projectManagerId: opts.projectManagerId,
+        }),
         ...(opts?.markProjectWon !== undefined && {
             markProjectWon: opts.markProjectWon,
         }),
@@ -426,10 +721,12 @@ export async function getBudgetItemsOnly(budgetId) {
     out(items);
 }
 export async function addBudgetItems(opts) {
+    await confirmLockedBudgetChangeByBudgetId(opts.budgetId, "Add budget items");
     const result = await api.budgetItem.addBudgetItems.mutate(opts);
     out(result);
 }
 export async function updateBudgetItem(input) {
+    await confirmLockedBudgetChangeByBudgetItemId(input.id, "Update budget item");
     const result = await api.budgetItem.updateBudgetItem.mutate({
         ...input,
         ...(input.description !== undefined &&
@@ -444,6 +741,7 @@ export async function updateBudgetItem(input) {
     out(result);
 }
 export async function removeBudgetItem(budgetItemId) {
+    await confirmLockedBudgetChangeByBudgetItemId(budgetItemId, "Remove budget item");
     const result = await api.budgetItem.removeBudgetItem.mutate({
         budgetItemId,
     });
@@ -460,6 +758,12 @@ export async function getBudgetVersions(budgetId) {
     out(versions);
 }
 export async function createBudgetApproval(budgetId, preflight) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Create budget approval request",
+        entity: `budget ${budgetId}`,
+        details: "and send approval request emails",
+    });
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Create budget approval");
     await runBudgetPreflight(budgetId, preflight);
     await assertBudgetActionReadiness({
         budgetId,
@@ -491,6 +795,7 @@ export async function createBudgetApproval(budgetId, preflight) {
     });
 }
 export async function createEstimate(budgetId, preflight) {
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Create estimate");
     await runBudgetPreflight(budgetId, preflight);
     await assertBudgetActionReadiness({
         budgetId,
@@ -511,10 +816,12 @@ export async function createBudgetFromPayload(raw) {
 }
 export async function updateBudgetFromPayload(raw) {
     const input = parseUpdateBudgetPayload(raw);
+    await confirmLockedBudgetChangeByBudgetId(input.id, "Update budget");
     const result = await api.budget.updateBudget.mutate(input);
     out(result);
 }
 export async function deleteBudgetById(budgetId) {
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Delete budget");
     const result = await api.budget.deleteBudget.mutate({ id: budgetId });
     out(result);
 }
@@ -527,10 +834,12 @@ export async function deleteCompanyById(companyId) {
     out(result);
 }
 export async function reorderBudgetItemsCli(opts) {
+    await confirmLockedBudgetChangeByBudgetId(opts.budgetId, "Reorder budget items");
     const result = await api.budgetItem.reorderBudgetItems.mutate(opts);
     out(result);
 }
 export async function updateBudgetItemSupplierCli(opts) {
+    await confirmLockedBudgetChangeByBudgetItemId(opts.budgetItemId, "Update budget item supplier");
     const result = await api.budgetItem.updateBudgetItemSupplier.mutate(opts);
     out(result);
 }
@@ -548,11 +857,13 @@ export async function deleteBudgetCategory(id) {
 }
 export async function updateBudgetCommissionFromPayload(raw) {
     const input = parseUpdateBudgetCommissionPayload(raw);
+    await confirmLockedBudgetChangeByBudgetId(input.budgetId, "Update budget commission");
     const result = await api.budget.updateBudgetCommission.mutate(input);
     out(result);
 }
 export async function updateBudgetDiscountFromPayload(raw) {
     const input = parseBudgetDiscountPayload(raw);
+    await confirmLockedBudgetChangeByBudgetId(input.budgetId, "Update budget discount");
     const result = await api.budget.updateBudgetDiscount.mutate(input);
     out(result);
 }
@@ -614,6 +925,10 @@ export async function createQuotationFromPayload(raw) {
     out(result);
 }
 export async function submitQuotation(id) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Submit quotation for approval",
+        entity: `quotation ${id}`,
+    });
     const result = await api.quotation.submitForApproval.mutate({ id });
     out(result);
 }
@@ -641,6 +956,11 @@ export async function createSupplierFromPayload(raw) {
         out(created);
         return;
     }
+    await assertSensitiveWorkflowConfirmed({
+        action: "Create supplier approval request",
+        entity: `supplier ${supplier.id}`,
+        details: "and send approval request emails",
+    });
     const approval = await api.supplier.createSupplierApproval.mutate({
         supplierId: supplier.id,
     });
@@ -679,6 +999,11 @@ export async function updateSupplierFromPayload(raw) {
         out(updated);
         return;
     }
+    await assertSensitiveWorkflowConfirmed({
+        action: "Create supplier approval request",
+        entity: `supplier ${supplier.id}`,
+        details: "and send approval request emails",
+    });
     let approvalResult;
     try {
         const approval = await api.supplier.createSupplierApproval.mutate({
@@ -759,6 +1084,11 @@ export async function updateCompanyFromPayload(raw) {
 }
 // --- Approvals: budgets / suppliers / bills (MCP parity) ---
 export async function approveBudget(budgetId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Approve budget",
+        entity: `budget ${budgetId}`,
+        details: "and send requester reply email",
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -790,6 +1120,11 @@ export async function approveBudget(budgetId) {
     });
 }
 export async function rejectBudget(budgetId, reason) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Reject budget",
+        entity: `budget ${budgetId}`,
+        details: `with reason "${reason}" and send requester reply email`,
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -883,6 +1218,11 @@ export async function getSupplierDetails(supplierId) {
     });
 }
 export async function approveSupplier(supplierId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Approve supplier",
+        entity: `supplier ${supplierId}`,
+        details: "and send requester reply email",
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -916,6 +1256,11 @@ export async function approveSupplier(supplierId) {
     });
 }
 export async function rejectSupplier(supplierId, reason) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Reject supplier",
+        entity: `supplier ${supplierId}`,
+        details: `with reason "${reason}" and send requester reply email`,
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -950,6 +1295,11 @@ export async function rejectSupplier(supplierId, reason) {
     });
 }
 export async function rejectBill(billId, reason) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Reject bill",
+        entity: `bill ${billId}`,
+        details: `with reason "${reason}" and send requester reply email`,
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -981,6 +1331,10 @@ export async function rejectBill(billId, reason) {
     });
 }
 export async function approveQuotation(quotationId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Approve quotation",
+        entity: `quotation ${quotationId}`,
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => isPendingRequest(n) &&
         n.type === QUOTATION &&
@@ -996,6 +1350,11 @@ export async function approveQuotation(quotationId) {
     out(result);
 }
 export async function rejectQuotation(quotationId, reason) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Reject quotation",
+        entity: `quotation ${quotationId}`,
+        details: `with reason "${reason}"`,
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => isPendingRequest(n) &&
         n.type === QUOTATION &&
@@ -1050,6 +1409,14 @@ export async function getProject(id) {
     out({ project, budgetsOverview, billsOverview });
 }
 export async function createProject(opts) {
+    const links = await resolveCreateProjectLinks({
+        name: opts.name,
+        asanaTaskId: opts.asanaTaskId,
+        asanaSearch: opts.asanaSearch,
+        slackChannelId: opts.slackChannelId,
+        slackChannelUrl: opts.slackChannelUrl,
+        slackChannelName: opts.slackChannelName,
+    });
     const result = await api.project.createProject.mutate({
         name: opts.name,
         description: opts.description,
@@ -1059,21 +1426,23 @@ export async function createProject(opts) {
         businessDevelopmentId: opts.businessDevelopmentId,
         venue: opts.venue,
         pax: opts.pax,
-        asanaTaskId: opts.asanaTaskId,
-        slackChannelId: opts.slackChannelId,
-        slackChannelUrl: opts.slackChannelUrl,
-        slackChannelName: opts.slackChannelName,
+        asanaTaskId: links.asanaTaskId,
+        slackChannelId: links.slackChannelId,
+        slackChannelUrl: links.slackChannelUrl,
+        slackChannelName: links.slackChannelName,
         dateRange: {
             from: new Date(opts.startDate),
             to: opts.endDate ? new Date(opts.endDate) : undefined,
         },
-        ...(opts.requestQboAccountantNotification !== undefined && {
-            requestQboAccountantNotification: opts.requestQboAccountantNotification,
-        }),
     });
     out(result);
 }
 export async function updateProjectStatus(id, status, opts) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Update project status",
+        entity: `project ${id}`,
+        details: `to ${status}`,
+    });
     const result = await api.project.updateProjectStatus.mutate({
         id,
         status,

package/dist/index.js

@@ -119,6 +119,13 @@ Global: --quiet | -q | BB_CLI_QUIET=1 — hide action logs (default: log command
 
 Auth: Set BB_API_KEY in the environment (same API key as MCP / Goracle).
 
+Sensitive workflow changes: approval decisions/requests, entity status updates,
+mark-budget-won, submit-quotation, and supplier approval request side effects
+require an interactive CONFIRM prompt and abort in non-interactive shells.
+AI agents must inspect the entity first, summarize the exact entity, target
+state, and side effects, then wait for explicit user confirmation before running
+the sensitive command.
+
 Budgets
   list-budgets              [--projectId] [--name] [--status CSV] [--createdBy] [--dateFrom] [--dateTo] [--sortBy] [--sortDir] [--page] [--perPage] [--summary]
   get-budget <id>            Budget + line items
@@ -126,11 +133,12 @@ Budgets
   get-budget-details <id>    Full detail (margins, suppliers, etc.)
   get-budget-categories
   get-budget-versions <budgetId>
-  update-budget-status <id> <status> [--markProjectWon true|false] [--projectStatusOnCommercialRejection PITCH|LOST]
-    ESTIMATE_ACCEPTED requires win proof, auto-marks PITCH or LOST projects WON, and auto-creates the Asana project/section when enabled.
+  update-budget-status <id> <status> [--projectManagerId <id>] [--markProjectWon true|false] [--projectStatusOnCommercialRejection PITCH|LOST]
+    Budget-changing commands require interactive "yes" confirmation when the current budget is ESTIMATE_CREATED, ESTIMATE_SENT, ESTIMATE_ACCEPTED, ESTIMATE_REJECTED, or ESTIMATE_CLOSED.
+    ESTIMATE_ACCEPTED requires win proof, auto-marks PITCH or LOST projects WON, requires --projectManagerId when the project has no PM, and auto-creates the Asana project/section when enabled.
     ESTIMATE_REJECTED requires --projectStatusOnCommercialRejection when rejecting the only accepted/closed budget on a commercial project.
     status: ${budgetStatusesForHelp.join(", ")}
-  mark-budget-won <budgetId> <filePath> [--markProjectWon true|false]   Upload signed quote/PO proof and set status to ESTIMATE_ACCEPTED; PITCH or LOST projects become WON automatically
+  mark-budget-won <budgetId> <filePath> [--projectManagerId <id>] [--markProjectWon true|false]   Upload signed quote/PO proof and set status to ESTIMATE_ACCEPTED; PITCH or LOST projects become WON automatically and require PM when none is assigned
   create-budget              --payload '<json>'  (budget.createBudget; Asana deal card is on the project)
   update-budget              --payload '<json>'  (budget.updateBudget; must include id)
   delete-budget <budgetId>
@@ -195,7 +203,7 @@ Companies & projects
   list-projects              [--companyId] [--name] [--status] [--active true|false] [--page] [--perPage]
     Omit --active to include both active and inactive projects.
   get-project <id>
-  create-project             --name --companyId --contactPersonId --insideSalesId --businessDevelopmentId --venue --asanaTaskId --slackChannelId --slackChannelUrl --slackChannelName --startDate <ISO> [--pax] [--endDate <ISO>] [--description] [--requestQboAccountantNotification false]
+  create-project             --name --companyId --contactPersonId --insideSalesId --businessDevelopmentId --venue --startDate <ISO> [--asanaTaskId] [--asanaSearch <text>] [--slackChannelId --slackChannelUrl --slackChannelName] [--pax] [--endDate <ISO>] [--description]
   update-project             --payload '<json>'  (project.updateProject; optional requestQboAccountantNotification; default notify like web)
   delete-project <id>
   update-project-status <id> <status> [--projectManagerId <id>] [--projectManagerName <name>] [--wonOverrideReason <text>]
@@ -328,6 +336,9 @@ async function main() {
                     throw new Error("mark-budget-won requires <budgetId> <filePath>");
                 }
                 await markBudgetWonWithProof(budgetId, filePath, {
+                    projectManagerId: getFlag(flags, "projectManagerId") !== undefined
+                        ? String(getFlag(flags, "projectManagerId"))
+                        : undefined,
                     markProjectWon: parseOptionalBoolFlag(flags, "markProjectWon"),
                 });
                 break;
@@ -366,6 +377,9 @@ async function main() {
                     throw new Error(`Invalid status. Use one of: ${budgetStatusesForHelp.join(", ")}`);
                 }
                 await updateBudgetStatus(id, status, {
+                    projectManagerId: getFlag(flags, "projectManagerId") !== undefined
+                        ? String(getFlag(flags, "projectManagerId"))
+                        : undefined,
                     markProjectWon: parseOptionalBoolFlag(flags, "markProjectWon"),
                     projectStatusOnCommercialRejection: parseCommercialRejectionProjectStatus(flags),
                 });
@@ -900,22 +914,22 @@ async function main() {
                 const venue = getFlag(flags, "venue");
                 const pax = getFlag(flags, "pax");
                 const asanaTaskId = getFlag(flags, "asanaTaskId");
+                const asanaSearch = getFlag(flags, "asanaSearch");
                 const slackChannelId = getFlag(flags, "slackChannelId");
                 const slackChannelUrl = getFlag(flags, "slackChannelUrl");
                 const slackChannelName = getFlag(flags, "slackChannelName");
                 const startDate = getFlag(flags, "startDate");
+                if (getFlag(flags, "requestQboAccountantNotification") !== undefined) {
+                    throw new Error("create-project does not allow --requestQboAccountantNotification; CLI project creation always requests the QuickBooks project import like the web app.");
+                }
                 if (!name ||
                     !companyId ||
                     !contactPersonId ||
                     !insideSalesId ||
                     !businessDevelopmentId ||
                     !venue ||
-                    !asanaTaskId ||
-                    !slackChannelId ||
-                    !slackChannelUrl ||
-                    !slackChannelName ||
                     !startDate) {
-                    throw new Error("create-project requires --name --companyId --contactPersonId --insideSalesId --businessDevelopmentId --venue --asanaTaskId --slackChannelId --slackChannelUrl --slackChannelName --startDate (ISO/datetime flags as appropriate); optional --pax and --endDate");
+                    throw new Error("create-project requires --name --companyId --contactPersonId --insideSalesId --businessDevelopmentId --venue --startDate (ISO/datetime flags as appropriate); optional --asanaTaskId, --asanaSearch, --pax and --endDate");
                 }
                 await createProject({
                     name,
@@ -926,13 +940,13 @@ async function main() {
                     venue,
                     pax,
                     asanaTaskId,
+                    asanaSearch,
                     slackChannelId,
                     slackChannelUrl,
                     slackChannelName,
                     startDate,
                     endDate: getFlag(flags, "endDate"),
                     description: getFlag(flags, "description"),
-                    requestQboAccountantNotification: parseOptionalBoolFlag(flags, "requestQboAccountantNotification"),
                 });
                 break;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/bb",
-  "version": "1.14.0",
+  "version": "1.16.0",
   "description": "Budget Builder CLI for AI agents — manage budgets, bills, and claims; bill records use isClaimable=false for bills and isClaimable=true for claims.",
   "type": "module",
   "main": "./dist/index.js",