@gonovus-ai/spec-flow-cli 0.5.0 → 0.6.0

package/README.md

@@ -22,7 +22,7 @@ accepts signed S3 and Azure BlockBlob reservations, including reservations from
 its URL out of logs. Uploading bytes alone does not attach an asset; complete the
 matching task or Screen finalization command separately.
 
-The current CLI contract is **0.5.0**, coordinated with the official Skill's exact
+The current CLI contract is **0.6.0**, coordinated with the official Skill's exact
 pin. It breaks 0.2.0 callers: Spec, Capability, Glossary, Proposal and
 authoring-history commands address shared knowledge with `--workspace-id` instead of
 `--project-id`, `project directory` is replaced by `spec list`, Session grants
@@ -36,7 +36,7 @@ seven-day Better Auth CLI Session. It supports the Node.js 24 runtime line;
 Node.js 22 and unverified future major versions are intentionally unsupported.
 
 ```bash
-npm install --global @gonovus-ai/spec-flow-cli@0.5.0
+npm install --global @gonovus-ai/spec-flow-cli@0.6.0
 specflow auth login
 specflow auth status
 specflow auth logout
@@ -673,33 +673,12 @@ whether to resubmit. Project Read Tokens may read comments and activity under
 `WorkItemRead`, and cannot mutate comments. Activities are produced by the
 server's actual task operations; there is no activity creation command.
 
-### Task time recording
+### Time recording removal (0.6.0)
 
-List entries oldest first with an opaque `nextCursor`, or retrieve one entry:
-
-```bash
-specflow work-item time-entry list --project-id PAY --work-item-id PAY-7 --limit 20
-specflow work-item time-entry get --project-id PAY --work-item-id PAY-7 --entry-id <uuid>
-specflow work-item time-entry create --project-id PAY --work-item-id PAY-7 \
-  --start-time '2026-07-01T10:00:00+08:00' --end-time '2026-07-01T11:00:00+08:00' \
-  --description 'Reviewed rollout' --idempotency-key <uuid>
-specflow work-item time-entry update --project-id PAY --work-item-id PAY-7 \
-  --entry-id <uuid> --start-time '2026-07-01T10:00:00+08:00' \
-  --end-time '2026-07-01T11:30:00+08:00' --expected-version '"1"' --idempotency-key <uuid>
-```
-
-Timestamps require an ISO 8601 offset. Omit `--end-time` on creation to record an
-unfinished entry; on update, omission preserves the existing end time. Omitted
-descriptions are preserved on update. The server computes whole duration seconds;
-unfinished entries have no duration and are excluded from `closedDurationSeconds`.
-The list returns that exact cumulative value as a decimal string plus `runningCount`.
-
-Writes require a CLI Session, current task update permission and a UUID command
-key. Only the author may update an entry, including when another Member is an
-Admin. Reuse the same key and inputs after an interrupted response. Updates require
-the read result's opaque `version`; a conflict requires a deliberate reread.
-Project Read Tokens can list and retrieve entries but cannot write. Archived
-Projects are read-only. There is no time-entry deletion command.
+Version 0.6.0 removes the deprecated `work-item time-entry` command hierarchy
+and its API operations. Scripts using those commands must stop invoking them;
+there is no transition command. The official Skill did not use these commands
+and now pins CLI 0.6.0. Historical activity and notifications remain readable.
 
 ### Personal notifications
 
@@ -957,3 +936,53 @@ specflow search-global --query 'payment' --limit 20 --cursor '<nextCursor>'
 The JSON response preserves object kind, ID, owning Workspace/Project, totalCount
 and nextCursor. Continue with the same query until nextCursor is null. The server
 has no type filter. `specflow spec search` retains its published-Spec semantics.
+
+## Work Item automation (ZTA-911, CLI 0.6.0)
+
+Existing commands keep full JSON by default. Use `--output summary` for Work Item
+create/read/update/assign/list and relation create/list to omit descriptions while
+retaining IDs, versions, permissions, cursors and replay receipts. Grouped pages
+are summarized too. Summary does not fetch further pages. `relation: null` remains
+null. Unsupported summary commands reject before sending a mutation.
+
+Work Item `url` is the server-authorized SpecFlow page URL; `githubIssue.url` remains
+the external GitHub URL. Do not construct links from the API origin. An older server
+that omits `url` still yields a successful business result with one stderr warning.
+
+```sh
+specflow auth whoami
+specflow work-item create --project-id PROJECT --title 'Prepare release' --assignee me --description-file ./release.md --output summary
+cat ./release.md | specflow work-item update --project-id PROJECT --work-item-id GON-78 --expected-version '"3"' --description-file - --output summary
+specflow work-item subtask link --project-id PROJECT --parent GON-78 --child GON-79 --child-project-id OTHER_PROJECT --idempotency-key KEY
+```
+
+`auth whoami` returns `{ user: { id }, credentialKind }` for the selected Session or
+User API Key (`session` or `api-key`). `--assignee me` on create/assign resolves that
+same credential once, without printing the intermediate identity. Read-only Tokens
+cannot resolve `me`; filters and bulk assignment accept User IDs only. Explicit
+credential failure never falls back to another credential. Older servers without
+the identity route require an upgrade or an explicit User ID.
+
+Descriptions accept exactly one of inline `--description`, `--description-file`
+(regular UTF-8 file, or `-` for explicit piped stdin), and update's
+`--clear-description` (null). Omission leaves update unchanged and preserves create's
+default. No shell expansion or Markdown parsing occurs. Empty/whitespace content,
+invalid UTF-8, nonregular files and input above 80,000 bytes are rejected locally;
+text must contain 1–20,000 UTF-16 code units after trimming. Interactive stdin is
+rejected: pipe the text or select a file.
+
+Subtask source is always parent and target is child. `subtask link` defaults to
+summary; `--project-id` owns the parent and `--child-project-id` defaults to it.
+The existing `relation create --type subtask` remains available:
+
+```sh
+specflow work-item relation create --project-id PROJECT --work-item-id GON-78 --target-project-id PROJECT --target-work-item-id GON-79 --type subtask --idempotency-key KEY
+```
+
+Retain the same relation key and body after an uncertain response; full/summary
+never change server intent. Create retains its automatically generated key within
+one invocation. Transport retries reuse that key and body once; version conflicts
+never fetch a newer version and overwrite automatically. Honor `retryAfter` on 429.
+`LOCAL_OUTPUT_FAILED` means local formatting/output failed after possible server
+success: read the resource before deliberately retrying. It never permits a blind
+write retry. Diagnostics stay on stderr and stdout remains business JSON.

package/dist/bin.js

@@ -1,52 +1,8 @@
 #!/usr/bin/env node
-import openBrowser from "open";
-import { formatResourceDiagnostic, runCli } from "./cli.js";
-import { createCredentialStore, } from "./credential-store.js";
-import { readServerFlag, unresolvedSpecFlowApiOrigin, } from "./http-origin.js";
-import { assertSupportedNodeVersion } from "./node-version.js";
-const arguments_ = process.argv.slice(2);
-const usesAuthenticationCli = arguments_.includes("auth") ||
-    arguments_.includes("--version") ||
-    arguments_.includes("-V");
-if (usesAuthenticationCli) {
-    const { runSpecFlowCli } = await import("./index.js");
-    process.exitCode = await runSpecFlowCli(process.argv);
-}
-else {
-    try {
-        assertSupportedNodeVersion(process.versions.node);
-        const credentialStores = new Map();
-        const getCredentialStore = (apiKeyId) => {
-            const slot = apiKeyId ?? "session";
-            const existing = credentialStores.get(slot);
-            if (existing !== undefined)
-                return existing;
-            const credentialStore = createCredentialStore({
-                ...(apiKeyId === undefined ? {} : { apiKeyId }),
-                allowFileFallback: arguments_.includes("--allow-file-fallback"),
-                serverOrigin: new URL(unresolvedSpecFlowApiOrigin(readServerFlag(arguments_), process.env.SPEC_FLOW_API_URL)).origin,
-                warning: (value) => process.stderr.write(formatResourceDiagnostic(value)),
-            });
-            credentialStores.set(slot, credentialStore);
-            return credentialStore;
-        };
-        process.exitCode = await runCli(arguments_, {
-            credentialStore: {
-                read: async () => (await getCredentialStore()).get(),
-                readApiKey: async (id) => (await getCredentialStore(id)).get(),
-                writeApiKey: async (id, credential) => (await getCredentialStore(id)).set(credential),
-                deleteApiKey: async (id) => (await getCredentialStore(id)).delete(),
-            },
-            environment: process.env,
-            fetch: globalThis.fetch,
-            open: openBrowser,
-            stderr: (value) => process.stderr.write(value),
-            stdout: (value) => process.stdout.write(value),
-        });
-    }
-    catch (error) {
-        process.stderr.write(`${error instanceof Error ? error.message : "SpecFlow CLI failed."}\n`);
-        process.exitCode = 1;
-    }
-}
+import { runSpecFlowCli } from "./index.js";
+process.stdout.on("error", () => {
+    process.exitCode = 4;
+    process.stderr.write(`${JSON.stringify({ error: { code: "LOCAL_OUTPUT_FAILED", message: "The output pipe failed; the server operation may have completed. Read the resource before retrying", reason: "Temporary Failure", retryable: false } })}\n`);
+});
+process.exitCode = await runSpecFlowCli(process.argv);
 //# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AAEA,OAAO,WAAW,MAAM,MAAM,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EACL,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzC,MAAM,qBAAqB,GACzB,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC3B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAE5B,IAAI,qBAAqB,EAAE,CAAC;IAC1B,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,OAAO,CAAC,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;KAAM,CAAC;IACN,IAAI,CAAC;QACH,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAoC,CAAC;QACrE,MAAM,kBAAkB,GAAG,CAAC,QAAiB,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAG,QAAQ,IAAI,SAAS,CAAC;YACnC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC;YAC5C,MAAM,eAAe,GAAG,qBAAqB,CAAC;gBAC5C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;gBAC/C,iBAAiB,EAAE,UAAU,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBAC/D,YAAY,EAAE,IAAI,GAAG,CACnB,2BAA2B,CACzB,cAAc,CAAC,UAAU,CAAC,EAC1B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAC9B,CACF,CAAC,MAAM;gBACR,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;aAC1E,CAAC,CAAC;YACH,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC5C,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE;YAC1C,eAAe,EAAE;gBACf,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE;gBACpD,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC9D,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;gBACrF,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;aACpE;YACD,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAC9C,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,IAAI,CACvE,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;IAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,oGAAoG,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AACxP,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -1,3 +1,5 @@
+import type { Command } from "commander";
+import type { AuthenticationCommandTopology } from "./authentication-command-topology.js";
 export interface ResourceCredentialStore {
     readonly read: () => Promise<string | null>;
     readonly readApiKey?: (apiKeyId: string) => Promise<string | null>;
@@ -5,6 +7,7 @@ export interface ResourceCredentialStore {
     readonly deleteApiKey?: (apiKeyId: string) => Promise<void>;
 }
 export interface CliDependencies {
+    readonly registerAuthentication?: (program: Command, authentication: AuthenticationCommandTopology) => void;
     readonly open?: (url: string) => Promise<unknown>;
     readonly credentialStore: ResourceCredentialStore;
     readonly environment: Readonly<Record<string, string | undefined>>;