@gobi-ai/cli 2.0.1 → 2.0.3

package/.claude-plugin/marketplace.json

@@ -4,12 +4,12 @@
     "name": "gobi-ai"
   },
   "description": "Claude Code plugin for the Gobi collaborative knowledge platform CLI",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "plugins": [
     {
       "name": "gobi",
       "description": "Manage the Gobi collaborative knowledge platform from the command line. Publish vault profiles, create posts and replies, manage saved notes and posts, manage sessions, generate images and videos.",
-      "version": "2.0.1",
+      "version": "2.0.3",
       "author": {
         "name": "gobi-ai"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gobi",
   "description": "Manage the Gobi collaborative knowledge platform from the command line",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "author": {
     "name": "gobi-ai"
   },

package/README.md

@@ -238,19 +238,21 @@ Times are ISO 8601 UTC (e.g. `2026-03-20T00:00:00Z`).
 
 ### Drafts
 
-A *draft* is a unit of standing guidance authored by an agent. Each draft carries 0–3 AI-suggested action labels the user picks from. The top 5 pending drafts (lowest priority first) are injected into the agent's system prompt every turn — drafts turn agent suggestions into running context.
+A *draft* is a unit of standing guidance authored by an agent. Each draft carries 0–3 AI-suggested actions the user picks from. The top 5 pending drafts (lowest priority first) are injected into the agent's system prompt every turn — drafts turn agent suggestions into running context.
 
 When invoked from inside an agent run, the runtime exports `GOBI_SESSION_ID` so `gobi draft add` picks it up automatically; otherwise pass `--session <uuid>`.
 
+Each action is `{ label, message? }`: `label` is the short button text (1–80 chars) the user sees; `message` (optional, ≤2000 chars) is what the user is taken to be saying to the agent on click. When `message` is omitted, the client falls back to `label`. From the CLI, pass an action as `--action "Label::Message"` — the literal `::` separates the two. Without `::`, the whole value is the label.
+
 | Command | Description |
 |---------|-------------|
 | `gobi draft list [--limit N]` | List drafts (priority ASC, then newest first) |
 | `gobi draft get <id>` | Show one draft with its history and suggested actions |
-| `gobi draft add <title> <content> [--session <id>] [--priority N] [--action <label>]…` | Add a draft. Pass `--action` up to 3 times. `--session` falls back to `$GOBI_SESSION_ID`. Use `-` for content to read from stdin. |
+| `gobi draft add <title> <content> [--session <id>] [--priority N] [--action <label[::message]>]…` | Add a draft. Pass `--action` up to 3 times; each action is `Label` or `Label::Message`. `--session` falls back to `$GOBI_SESSION_ID`. Use `-` for content to read from stdin. |
 | `gobi draft delete <id>` | Delete a draft |
 | `gobi draft prioritize <id> <priority>` | Set priority (lower = higher) |
-| `gobi draft action <id> <index>` | Take one of the draft's suggested actions by 0-based index. Marks `actioned` and posts the synthesized message into the originating session. |
-| `gobi draft revise <id> <comment> [--title <t>] [--content <c>] [--action <label>]…` | Bump revision with a comment; optionally replace title / content / actions in the same call |
+| `gobi draft action <id> <index>` | Take one of the draft's suggested actions by 0-based index. Marks `actioned` and posts the action's `message` (or `label`, if no message) into the originating session. |
+| `gobi draft revise <id> <comment> [--title <t>] [--content <c>] [--action <label[::message]>]…` | Bump revision with a comment; optionally replace title / content / actions in the same call |
 
 ### Media generation
 

package/dist/commands/draft.js

@@ -16,7 +16,15 @@ function parseActionFlags(values) {
         .map((v) => v.trim())
         .filter(Boolean)
         .slice(0, 3)
-        .map((label) => ({ label }));
+        .map((entry) => {
+        const sep = entry.indexOf("::");
+        if (sep === -1)
+            return { label: entry };
+        const label = entry.slice(0, sep).trim();
+        const message = entry.slice(sep + 2).trim();
+        return message ? { label, message } : { label };
+    })
+        .filter((a) => a.label.length > 0);
 }
 function formatDraftLine(d) {
     const status = d.status === "pending" ? "·" : "✓";
@@ -76,7 +84,11 @@ export function registerDraftCommand(program) {
         if (d.actions.length) {
             console.log("");
             console.log("Suggested actions:");
-            d.actions.forEach((a, i) => console.log(`  [${i}] ${a.label}`));
+            d.actions.forEach((a, i) => {
+                console.log(`  [${i}] ${a.label}`);
+                if (a.message)
+                    console.log(`      → ${a.message}`);
+            });
         }
         if (d.history.length) {
             console.log("");
@@ -90,7 +102,9 @@ export function registerDraftCommand(program) {
                         console.log(`    content: ${snippet(h.content, 200)}`);
                     }
                     if (h.actions !== undefined && h.actions.length) {
-                        console.log(`    actions: ${h.actions.map((a) => a.label).join(" | ")}`);
+                        console.log(`    actions: ${h.actions
+                            .map((a) => (a.message ? `${a.label} :: ${a.message}` : a.label))
+                            .join(" | ")}`);
                     }
                     if (h.comment !== undefined)
                         console.log(`    comment: ${h.comment}`);
@@ -110,7 +124,7 @@ export function registerDraftCommand(program) {
         .description("Add a draft. Pass '-' for content to read from stdin. Pass --action up to 3 times to attach AI-suggested actions. Requires a chat session — the agent runtime exports GOBI_SESSION_ID automatically; outside that, pass --session.")
         .option("--session <sessionId>", "Originating chat session UUID. Falls back to $GOBI_SESSION_ID when set.")
         .option("--priority <number>", "Priority (lower = higher), default 100")
-        .option("--action <label>", "Suggested action label (repeatable, max 3). Each label is what the user sees on the button.", (value, prev = []) => [...prev, value], [])
+        .option("--action <label[::message]>", "Suggested action (repeatable, max 3). `label` is the button text; an optional `::message` suffix is what the user is taken to be saying to the agent on click. Without the suffix, the message falls back to the label.", (value, prev = []) => [...prev, value], [])
         .action(async (title, content, opts) => {
         const sessionId = opts.session || process.env.GOBI_SESSION_ID || "";
         if (!sessionId) {
@@ -189,7 +203,7 @@ export function registerDraftCommand(program) {
         .description("Bump the draft to a new revision. Comment is required. Pass --title, --content, and/or --action to update the draft in the same call (--action repeatable, max 3, replaces all). Pass '-' for any of comment/title/content to read from stdin.")
         .option("--title <title>", "Replacement title")
         .option("--content <content>", "Replacement content; pass '-' to read from stdin")
-        .option("--action <label>", "Replacement suggested action label (repeatable, max 3). When passed, replaces the entire actions array.", (value, prev = []) => [...prev, value], [])
+        .option("--action <label[::message]>", "Replacement suggested action (repeatable, max 3). Same `label[::message]` syntax as `draft add`. When passed, replaces the entire actions array.", (value, prev = []) => [...prev, value], [])
         .action(async (draftId, comment, opts) => {
         const body = {
             comment: readContent(comment),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gobi-ai/cli",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "description": "CLI client for the Gobi collaborative knowledge platform",
   "license": "MIT",
   "type": "module",

package/skills/gobi-core/SKILL.md

@@ -117,6 +117,14 @@ JSON responses have the shape `{ "success": true, "data": ... }` on success or `
 
 > File sync (`gobi vault sync`) lives in the **gobi-vault** skill.
 
+## Confirm before mutating
+
+`gobi session reply` posts a human-attributed message into a chat session — the message becomes part of the user's permanent chat history and triggers the agent to respond. Before running it, confirm with the user — show the exact session id and the message text. This applies even when running autonomously.
+
+`auth login` / `auth logout` and `init` are explicit user-driven commands; they prompt the user themselves and don't need an extra confirmation layer. `update` upgrades the CLI binary — fine to run without extra confirmation.
+
+Read-only commands (`auth status`, `session list`, `session get`, `space list`) run without confirmation.
+
 ## Reference Documentation
 
 - [gobi auth](references/auth.md)

package/skills/gobi-draft/SKILL.md

@@ -25,7 +25,9 @@ A draft is a unit of standing guidance authored by an agent (in-process during c
 
 - **title** — short headline (1–200 chars)
 - **content** — the draft text (markdown, 1–8000 chars)
-- **actions** — 0–3 AI-suggested action labels the user can pick from (e.g. "Accept", "Reject", "Schedule for later"). The agent generates these when authoring the draft.
+- **actions** — 0–3 AI-suggested actions. Each action is `{ label, message? }`:
+  - `label` — short button text (1–80 chars) the user sees, e.g. `"Apply"`, `"Skip"`.
+  - `message` — optional (≤2000 chars). What the user is taken to be saying to the agent when they click that button. Falls back to `label` when omitted. Use this whenever the click should send something more specific than the button text — e.g. label `"Punch it up"`, message `"Tighten the opening paragraph and shorten the CTA"`.
 - **sessionId** — required; the chat session that produced the draft
 - **priority** — lower number = higher priority; default `100`
 - **status** — `pending` until the user picks an action, then `actioned`
@@ -52,23 +54,46 @@ For programmatic/agent usage, always pass `--json` as a **global** option (befor
 
 ```bash
 gobi --json draft list --limit 20
-gobi --json draft add "Concise titles" "Prefer concise titles for personal posts." --action "Apply" --action "Skip" --priority 50
+gobi --json draft add "Concise titles" "Prefer concise titles for personal posts." \
+  --action "Apply::Yes, rewrite my last three posts with concise titles." \
+  --action "Skip" \
+  --priority 50
 gobi --json draft action <draftId> 0
 ```
 
 JSON mode wraps the response as `{"success": true, "data": <draft>}` (or `{"success": false, "error": "..."}`).
 
+## Action `label::message` syntax
+
+The `--action` flag (on both `add` and `revise`) accepts either form:
+
+- `--action "Apply"` — label only; message falls back to `"Apply"` on click.
+- `--action "Apply::Yes, rewrite my last three posts with concise titles."` — label is `Apply`, the click sends the full sentence as the user's next turn into the originating chat session.
+
+The literal `::` separator splits the two. Use `message` whenever the click should send something more specific than the button text — that's the whole point of the field. Keep `label` punchy (a few words); put the actual instruction in `message`.
+
+When the user picks an action via `gobi draft action <id> <index>`, the response includes the picked action's `message` (or `label` as fallback) in `data.actions[index]`, which the client then posts into the originating session.
+
 ## Available Commands
 
 - `gobi draft` — Drafts authored by your agent during chat. Each carries up to 3 AI-suggested actions. Top-5 pending feed the system prompt; picking an action posts a synthesized message into the originating session.
   - `gobi draft list` — List drafts (priority ASC, then newest first).
   - `gobi draft get` — Show one draft with its history and suggested actions.
-  - `gobi draft add` — Add a draft. Pass `--action <label>` up to 3 times to attach AI-suggested actions.
+  - `gobi draft add` — Add a draft. Pass `--action <label[::message]>` up to 3 times to attach AI-suggested actions.
   - `gobi draft delete` — Delete a draft.
   - `gobi draft prioritize` — Set priority (lower = higher). Top 5 feed the system prompt.
   - `gobi draft action` — Take one of the draft's suggested actions by 0-based index. Posts the synthesized message into the originating session.
   - `gobi draft revise` — Bump the draft to a new revision with a comment, optionally replacing title / content / actions.
 
+## Confirm before mutating
+
+Drafts are agent-authored proposals — `add` and `revise` are the agent's normal authoring path and run without extra confirmation. Two commands flip that:
+
+- `draft action <id> <index>` — picking an action is **a user decision**. Marks the draft `actioned` (terminal — the agent can't take it back) and posts the action's `message` into the originating session. Don't pick on the user's behalf; only run this when the user has explicitly told you which action to take.
+- `draft delete <id>` — irreversible. Confirm the target id with the user before running.
+
+`draft prioritize` is low-stakes (just reorders the prompt feed) — fine to run when the user asks.
+
 ## Reference Documentation
 
 - [gobi draft](references/draft.md)

package/skills/gobi-draft/references/draft.md

@@ -54,10 +54,11 @@ Add a draft. Pass '-' for content to read from stdin. Pass --action up to 3 time
 outside that, pass --session.
 
 Options:
-  --session <sessionId>  Originating chat session UUID. Falls back to $GOBI_SESSION_ID when set.
-  --priority <number>    Priority (lower = higher), default 100
-  --action <label>       Suggested action label (repeatable, max 3). Each label is what the user sees on the button. (default: [])
-  -h, --help             display help for command
+  --session <sessionId>        Originating chat session UUID. Falls back to $GOBI_SESSION_ID when set.
+  --priority <number>          Priority (lower = higher), default 100
+  --action <label[::message]>  Suggested action (repeatable, max 3). `label` is the button text; an optional `::message` suffix is what the user is taken to be saying to the agent on click. Without
+                               the suffix, the message falls back to the label. (default: [])
+  -h, --help                   display help for command
 ```
 
 ## delete
@@ -102,8 +103,8 @@ Bump the draft to a new revision. Comment is required. Pass --title, --content,
 comment/title/content to read from stdin.
 
 Options:
-  --title <title>      Replacement title
-  --content <content>  Replacement content; pass '-' to read from stdin
-  --action <label>     Replacement suggested action label (repeatable, max 3). When passed, replaces the entire actions array. (default: [])
-  -h, --help           display help for command
+  --title <title>              Replacement title
+  --content <content>          Replacement content; pass '-' to read from stdin
+  --action <label[::message]>  Replacement suggested action (repeatable, max 3). Same `label[::message]` syntax as `draft add`. When passed, replaces the entire actions array. (default: [])
+  -h, --help                   display help for command
 ```

package/skills/gobi-media/SKILL.md

@@ -171,6 +171,17 @@ Do NOT use markdown image/link syntax `![](...)` or `gobi://` URLs. Always use `
 - `gobi media image-download` — Download a generated image.
 - `gobi media image-status` — Check image generation job status.
 
+## Confirm before mutating
+
+Media generation jobs consume credits (real-world billable cost) and produce assets attached to the user's account. Videos and avatar work can take minutes per job. Before running any generation/upload command, confirm with the user — show the exact command and the prompt / script / source files / aspect ratio / duration. This applies even when running autonomously.
+
+- `image-generate`, `image-edit`, `image-inpaint` — quick but billable per job.
+- `video-create`, `cinematic-create` — slower and more expensive; confirm script, avatar/voice ids, and aspect ratio before submitting.
+- `avatar-design`, `avatar-confirm`, `avatar-from-selfie` — produce assets the user will see in their avatar list. Confirm the photo/prompt and that the user wants the variant locked in (`avatar-confirm` is the commit step).
+- `upload` — adds to the user's media. Low-stakes but still a write; mention the file before uploading.
+
+Read-only commands (`avatars`, `voices`, `image-status`, `video-status`, `video-list`, `video-get`, `avatar-job-status`) and downloads (`image-download`, `video-download`) run without confirmation.
+
 ## Reference Documentation
 
 - [gobi media](references/media.md)

package/skills/gobi-saved/SKILL.md

@@ -54,6 +54,16 @@ gobi --json saved note list --date 2026-04-27
 - `gobi saved post create --source <id>` — Save a post or reply by id. Records a snapshot in your saved-posts collection.
 - `gobi saved post delete <postId>` — Remove a post from your saved-posts collection.
 
+## Confirm before mutating
+
+Saved items are the user's private collection but they still persist server-side and deletes are irreversible. Before running any write, confirm with the user — show the command and the note content / target id. This applies even when running autonomously.
+
+- `note create`, `note edit` — confirm the content (or content delta on edit).
+- `post create` (snapshotting a feed post) — confirm the source id you're about to bookmark.
+- `note delete`, `post delete` — irreversible. Flag that explicitly and confirm the target id before running.
+
+Read-only commands (`note list`, `note get`, `post list`, `post get`) run without confirmation.
+
 ## Reference Documentation
 
 - [gobi saved](references/saved.md)

package/skills/gobi-space/SKILL.md

@@ -94,6 +94,16 @@ gobi --json space list-posts
 - `gobi global edit-reply <replyId>` — Edit a reply you authored.
 - `gobi global delete-reply <replyId>` — Delete a reply you authored.
 
+## Confirm before mutating
+
+Posts and replies are publicly visible — in a community space (`gobi space …`) or in the global feed (`gobi global …`). Before running any write, confirm with the user — show the exact command and the resolved title, content (or a short preview), and `authorVaultSlug` if `--vault-slug` / `--auto-attachments` is set. This applies even when running autonomously.
+
+- `create-post` / `create-reply` — content goes live on submission.
+- `edit-post` / `edit-reply` — confirm the *new* content; people who already saw the original may re-see it.
+- `delete-post` / `delete-reply` — irreversible. Flag that explicitly and confirm the target id before running.
+
+Read-only commands (`list-posts`, `get-post`, `feed`, `list-topics`, `list-topic-posts`, `get`) run without confirmation.
+
 ## Reference Documentation
 
 - [gobi space](references/space.md)

package/skills/gobi-vault/SKILL.md

@@ -34,6 +34,14 @@ gobi --json vault publish
 - `gobi vault unpublish` — Delete `PUBLISH.md` from the vault on webdrive.
 - `gobi vault sync` — Sync local vault files with Gobi Webdrive. Supports `--upload-only`, `--download-only`, `--conflict <ask|server|client|skip>`, `--dry-run`, `--full`, `--path <p>`, `--plan-file`, `--execute`.
 
+## Confirm before mutating
+
+Every command in this skill writes external state — webdrive files, the public vault profile, and a Discord notification on `publish`. Before running any of them, confirm with the user — show the exact command and the key changes (which `PUBLISH.md` fields, which paths will sync, which conflict policy). This applies even when running autonomously.
+
+- `vault publish` — public profile change + Discord ping. Always confirm.
+- `vault unpublish` — removes the live profile. Always confirm.
+- `vault sync` — can overwrite remote or local files. Run `--dry-run` first and show the user the plan before re-running without `--dry-run`. With `--conflict server` or `--conflict client`, name which side is going to be overwritten.
+
 ## PUBLISH.md Frontmatter Reference
 
 `PUBLISH.md` is the metadata file at the root of every vault. Its YAML frontmatter controls the vault's public profile, homepage, and AI agent behavior. Example: