@junoflow/cli 0.13.0 → 0.15.0

package/README.md

@@ -165,9 +165,18 @@ The group's working-copy commands (`integration init`, `gen-types`,
 
 **`finding`**
 
-| Command            | Tool          | Positional | Effect |
-| ------------------ | ------------- | ---------- | ------ |
-| `juno finding get` | `get_finding` | `slug`     | read   |
+| Command                    | Tool                  | Positional | Effect |
+| -------------------------- | --------------------- | ---------- | ------ |
+| `juno finding list`        | `list_findings`       | —          | read   |
+| `juno finding get`         | `get_finding`         | `slug`     | read   |
+| `juno finding get-history` | `get_finding_history` | `slug`     | read   |
+| `juno finding dismiss`     | `dismiss_finding`     | `slug`     | act    |
+
+`finding list` shows open findings of every owner — flows, integrations,
+devices, states and tasks — each naming its source as `owner_kind`, `owner` and
+`owner_name`; `--status all` adds cleared ones, and `--owner-kind`, `--owner`
+and `--severity` (a floor) narrow it. `get-history` and `dismiss` take `--key`
+for a keyed finding; `get-history` also takes `--limit`.
 
 **`webhook`**
 
@@ -178,14 +187,22 @@ The group's working-copy commands (`integration init`, `gen-types`,
 | `juno webhook write`          | `write_webhook`          | `id`       | change |
 | `juno webhook fire`           | `fire_webhook`           | `id`       | act    |
 
-**`job`** (external jobs)
+**`task`** (tasks)
 
-| Command                              | Tool           | Positional | Effect |
-| ------------------------------------ | -------------- | ---------- | ------ |
-| `juno job list`                      | `list_jobs`    | —          | read   |
-| `juno job get-runs`                  | `get_job_runs` | `id`       | read   |
-| `juno job write`                     | `write_job`    | `id`       | change |
-| `juno job run [<url>] -- <command>…` | none           | ping URL   | act    |
+| Command                               | Tool            | Positional | Effect |
+| ------------------------------------- | --------------- | ---------- | ------ |
+| `juno task list`                      | `list_tasks`    | —          | read   |
+| `juno task get-runs`                  | `get_task_runs` | `id`       | read   |
+| `juno task write`                     | `write_task`    | `id`       | change |
+| `juno task delete`                    | `delete_task`   | `id`       | act    |
+| `juno task run [<url>] -- <command>…` | none            | ping URL   | act    |
+| `juno task ping [<url>]`              | none            | ping URL   | act    |
+
+**`series`**
+
+| Command           | Tool         | Positional | Effect |
+| ----------------- | ------------ | ---------- | ------ |
+| `juno series get` | `get_series` | `id`       | read   |
 
 **`credential`**
 
@@ -336,15 +353,15 @@ exits 1 without sending anything otherwise. Any other message sent to a session
 waiting for an approval denies it, and the assistant sees the message as the
 reason.
 
-### `juno job run`
+### `juno task run`
 
-Wraps a scheduled command so its runs are reported to an external job's ping URL
-(`juno job write` answers it as `url`):
+Wraps a scheduled command so its runs are reported to a task's ping URL
+(`juno task write` answers it as `url`):
 
 ```bash
-juno job run https://juno.example/ping/<token> -- ./backup.sh --full
-juno job run --url-file .secrets/juno-jobs/backup -- ./backup.sh --full
-JUNO_JOB_URL=https://juno.example/ping/<token> juno job run -- python3 check.py
+juno task run https://juno.example/ping/<token> -- ./backup.sh --full
+juno task run --url-file .secrets/juno-tasks/backup -- ./backup.sh --full
+JUNO_TASK_URL=https://juno.example/ping/<token> juno task run -- python3 check.py
 ```
 
 The command runs exactly as it would unwrapped: same stdin, the same stdout and
@@ -353,14 +370,33 @@ signal `N`; 127, or 126 for a file that is not executable, when it cannot be
 started). Everything after `--` is the command's, flags included. Juno gets a
 `start`, then the exit status with the last 64 KiB of stdout and stderr, paired
 by a run id. The URL comes from the argument, else `--url-file` (keeps the token
-out of `ps`), else `$JUNO_JOB_URL`; nothing else is read — no instance config,
+out of `ps`), else `$JUNO_TASK_URL`; nothing else is read — no instance config,
 no API key. A report that fails is retried once and then dropped silently
 (`--verbose` prints one line): Juno turns a run it never heard about into an
 overdue finding by itself. `SIGINT`, `SIGTERM` and `SIGHUP` are passed on to the
 command.
 
-See [External jobs](https://boivie.github.io/juno/external-jobs/) for creating
-the job, the ping protocol, and systemd and crontab examples.
+The wrapper never times a command out: a run that hangs stays open, and the task
+goes down once its start plus grace has passed. A wrapper killed outright leaves
+the run open the same way.
+
+### `juno task ping`
+
+Sends one report, for a task with no command to wrap:
+
+```bash
+juno task ping --url-file .secrets/juno-tasks/digest                 # success
+juno task ping --url-file .secrets/juno-tasks/digest --start --rid r1
+juno task ping --url-file .secrets/juno-tasks/digest --exit 3 --rid r1
+juno task ping --url-file .secrets/juno-tasks/digest --fail
+```
+
+The URL comes from the same three places as `juno task run`'s. `--log` sends a
+log report, and `--rid` pairs a start with its finish. A report that still fails
+after one retry exits 1 with the reason.
+
+See [Tasks](https://boivie.github.io/juno/tasks/) for creating the task, the
+ping protocol, and systemd and crontab examples.
 
 ### `juno credential set`
 

package/app-client.js

@@ -14,27 +14,36 @@
  *   rejects with an Error whose message is the handler's (or the host's).
  *
  * window.juno.values
- *   The app's bound states and controls, by binding name:
- *   {states: {<b>: value}, controls: {<b>: {value, active, expires_at}}}, or
- *   null until the first snapshot has arrived.
+ *   The app's bound states, controls and series, by binding name:
+ *   {states: {<b>: value}, controls: {<b>: {value, active, expires_at}},
+ *   series: {<b>: {published_at, issued_at, covered_until, intervals}}}, or
+ *   null until the first snapshot has arrived. A series moves on every
+ *   publish, changed or not.
  *
  * window.juno.watch(cb) → unwatch()
  *   Calls cb(values, changed) on every snapshot and update, where changed
- *   lists the keys that moved ("states.<b>", "controls.<b>"; every key on a
- *   snapshot). Registered after a snapshot, cb is called at once with every
- *   key.
+ *   lists the keys that moved ("states.<b>", "controls.<b>", "series.<b>";
+ *   every key on a snapshot). Registered after a snapshot, cb is called at
+ *   once with every key.
+ *
+ * window.juno.series.<binding>.get(range?) → Promise<read>
+ * window.juno.series.<binding>.view(spec) → Promise<result>
+ *   What a handler's series.<binding>.get / .view answer, with no handler:
+ *   GET _juno/series/<binding>?from=&to= and POST _juno/series/<binding>/view.
+ *   A Date bound is sent as its ISO string.
  *
  * window.juno.controls.<binding>.onPress(cb) → unwatch()
  *   Calls cb(at) on every press of that bound button control, at an RFC 3339
  *   timestamp.
  *
- * handlers and controls are proxies, not maps of what the manifest declares:
+ * handlers, controls and series are proxies, not maps of what the manifest declares:
  * the client is never told the names, so any name reaches the server, and an
  * unknown handler is a rejected call carrying the host's 404 — the same answer
  * a hand-typed name got before. A name some JavaScript protocol looks up on
  * every object (then, toJSON, toString, …) answers undefined instead, so
  * `await juno.handlers` or JSON.stringify(juno) never fires a call;
- * manifest.ValidateApp refuses those names for a handler or a control binding.
+ * manifest.ValidateApp refuses those names for a handler, a control binding or
+ * a series binding.
  *
  * The values arrive over one EventSource on _juno/stream, opened by the first
  * watch or onPress and never on page load: a page that does not watch holds no
@@ -147,6 +156,67 @@
     return body.result;
   }
 
+  // readJSON answers a series route: the body on success, its error thrown
+  // otherwise. Like a call, every answer names the version that served it.
+  async function readJSON(res) {
+    checkVersion(res);
+    var body;
+    try {
+      body = await res.json();
+    } catch (e) {
+      throw new Error('HTTP ' + res.status);
+    }
+    if (!res.ok) {
+      throw new Error(
+        body && typeof body.error === 'string'
+          ? body.error
+          : 'HTTP ' + res.status
+      );
+    }
+    return body;
+  }
+
+  function instant(v) {
+    // Duck-typed rather than instanceof, so a Date from another realm (an
+    // iframe) is still sent as its ISO string.
+    return v && typeof v.toISOString === 'function'
+      ? v.toISOString()
+      : String(v);
+  }
+
+  function seriesURL(binding) {
+    return base + '_juno/series/' + encodeURIComponent(binding);
+  }
+
+  async function seriesGet(binding, range) {
+    var q = [];
+    if (range && range.from !== undefined && range.from !== null) {
+      q.push('from=' + encodeURIComponent(instant(range.from)));
+    }
+    if (range && range.to !== undefined && range.to !== null) {
+      q.push('to=' + encodeURIComponent(instant(range.to)));
+    }
+    var res = await fetch(
+      seriesURL(binding) + (q.length ? '?' + q.join('&') : ''),
+      {
+        headers: { 'X-Juno-App-Version': String(version) },
+      }
+    );
+    return readJSON(res);
+  }
+
+  async function seriesView(binding, spec) {
+    var res = await fetch(seriesURL(binding) + '/view', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Juno-App-Version': String(version),
+      },
+      body: JSON.stringify(spec === undefined ? {} : spec),
+    });
+    return readJSON(res);
+  }
+
   // Live values. The stream is opened lazily and at most one is open.
   var values = null;
   var watchers = [];
@@ -190,6 +260,9 @@
     Object.keys(vals.controls || {}).forEach(function (b) {
       out.push('controls.' + b);
     });
+    Object.keys(vals.series || {}).forEach(function (b) {
+      out.push('series.' + b);
+    });
     return out;
   }
 
@@ -207,6 +280,7 @@
     values = {
       states: data.values.states || {},
       controls: data.values.controls || {},
+      series: data.values.series || {},
     };
     var changed = keys(values);
     watchers.slice().forEach(function (cb) {
@@ -214,7 +288,7 @@
     });
   }
 
-  // onUpdate merges per binding. An update carries both maps, the one that did
+  // onUpdate merges per binding. An update carries every map, the ones that did
   // not move empty, so the changed keys are exactly the bindings present.
   function onUpdate(ev) {
     var data = parse(ev);
@@ -222,10 +296,12 @@
     var moved = {
       states: data.values.states || {},
       controls: data.values.controls || {},
+      series: data.values.series || {},
     };
     values = {
       states: Object.assign({}, values.states, moved.states),
       controls: Object.assign({}, values.controls, moved.controls),
+      series: Object.assign({}, values.series, moved.series),
     };
     var changed = keys(moved);
     if (!changed.length) return;
@@ -298,6 +374,16 @@
         },
       });
     }),
+    series: namespace(function (binding) {
+      return Object.freeze({
+        get: function (range) {
+          return seriesGet(binding, range);
+        },
+        view: function (spec) {
+          return seriesView(binding, spec);
+        },
+      });
+    }),
     get values() {
       return values;
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@junoflow/cli",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Develop Juno flows, integrations and apps, and operate a Juno instance from the command line",
   "license": "MIT",
   "repository": {
@@ -40,7 +40,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@junoflow/eslint-plugin": "0.13.0",
+    "@junoflow/eslint-plugin": "0.15.0",
     "@typescript-eslint/parser": "^8.0.0"
   },
   "devDependencies": {

package/src/commands/{job-run.js → task-run.js}

@@ -6,9 +6,10 @@ import { resolve } from 'node:path';
 import { parseArgs } from 'node:util';
 
 import { UsageError } from '../errors.js';
+import { EXIT_FAILURE, EXIT_OK } from '../exit.js';
 
-export const JOB_RUN_USAGE =
-  'juno job run [<url>] [--url-file <path>] [--verbose] -- <command> [args…]';
+export const TASK_RUN_USAGE =
+  'juno task run [<url>] [--url-file <path>] [--verbose] -- <command> [args…]';
 
 /** The tail of each stream a run reports; Juno keeps the same. */
 export const TAIL_BYTES = 64 << 10;
@@ -23,7 +24,7 @@ const DEFAULT_TIMEOUTS = {
 };
 
 /**
- * `juno job run` runs a command and reports it to an external job's ping URL
+ * `juno task run` runs a command and reports it to a task's ping URL
  * (plan-external-jobs-2-wrapper-and-tools.md, Decisions 3–5). Its first rule
  * is transparency: the command gets the same stdin, and the wrapper's stdout,
  * stderr and exit status are the command's, byte for byte — a scheduler such
@@ -33,11 +34,11 @@ const DEFAULT_TIMEOUTS = {
  * on its own, so the wrapper never queues and never fails the command.
  *
  * It reads no Juno config and no API key; the URL is all it needs. argv is
- * everything after `job run`, `--` included. The exit code is returned, not
+ * everything after `task run`, `--` included. The exit code is returned, not
  * passed to process.exit, so stdout is flushed before the process ends.
  * deps is injectable for the tests; the default binds the real ones.
  */
-export async function jobRun(argv, io, deps = {}) {
+export async function taskRun(argv, io, deps = {}) {
   const {
     spawn = nodeSpawn,
     fetch = globalThis.fetch,
@@ -64,20 +65,26 @@ export async function jobRun(argv, io, deps = {}) {
     });
   } catch (err) {
     throw new UsageError(
-      `juno job run: ${err.message}\nusage: ${JOB_RUN_USAGE}`
+      `juno task run: ${err.message}\nusage: ${TASK_RUN_USAGE}`
     );
   }
   if (command.length === 0) {
     throw new UsageError(
-      `juno job run: missing -- <command>\nusage: ${JOB_RUN_USAGE}`
+      `juno task run: missing -- <command>\nusage: ${TASK_RUN_USAGE}`
     );
   }
   if (parsed.positionals.length > 1) {
     throw new UsageError(
-      `juno job run: one URL before --, got ${parsed.positionals.length} arguments\nusage: ${JOB_RUN_USAGE}`
+      `juno task run: one URL before --, got ${parsed.positionals.length} arguments\nusage: ${TASK_RUN_USAGE}`
     );
   }
-  const url = await pingURL(parsed, env, readFile, io.cwd);
+  const url = await pingURL('task run', TASK_RUN_USAGE, {
+    positional: parsed.positionals[0],
+    file: parsed.values['url-file'],
+    env,
+    readFile,
+    cwd: io.cwd,
+  });
   const verbose = parsed.values.verbose;
 
   const rid = randomUUID();
@@ -100,7 +107,11 @@ export async function jobRun(argv, io, deps = {}) {
   let suffix;
   let exitCode;
   if (outcome.startError) {
-    const line = `juno job run: ${command[0]}: ${outcome.startError.message}`;
+    // With no shell, `FOO=bar cmd` names an executable called "FOO=bar".
+    const line =
+      outcome.startError.code === 'ENOENT' && command[0].includes('=')
+        ? `juno task run: "${command[0]}" looks like an env assignment; write -- env ${command.join(' ')}`
+        : `juno task run: ${command[0]}: ${outcome.startError.message}`;
     io.error(line);
     err.push(Buffer.from(`${line}\n`));
     suffix = 'fail';
@@ -129,46 +140,55 @@ export async function jobRun(argv, io, deps = {}) {
     failure = await finish();
   }
   if (failure && verbose) {
-    io.error(`juno job run: could not report to Juno: ${failure}`);
+    io.error(`juno task run: could not report to Juno: ${failure}`);
   }
   return exitCode;
 }
 
 /**
  * pingURL is the URL from the first source that yields one: the positional,
- * then --url-file (its contents, trimmed), then $JUNO_JOB_URL. The two
+ * then --url-file (its contents, trimmed), then $JUNO_TASK_URL. The two
  * indirect sources keep the token off the command line, where `ps` and the
- * scheduler's job definition would show it.
+ * scheduler's job definition would show it. command and usage name the verb
+ * in its refusals.
  */
-async function pingURL(parsed, env, readFile, cwd = '.') {
-  const [positional] = parsed.positionals;
+async function pingURL(
+  command,
+  usage,
+  { positional, file, env, readFile, cwd = '.' }
+) {
   if (positional?.trim()) return positional.trim();
-  const file = parsed.values['url-file'];
   if (file !== undefined) {
     let text;
     try {
       text = await readFile(resolve(cwd, file), 'utf8');
     } catch (err) {
-      throw new UsageError(`juno job run: --url-file ${file}: ${err.message}`);
+      throw new UsageError(
+        `juno ${command}: --url-file ${file}: ${err.message}`
+      );
     }
     if (text.trim()) return text.trim();
   }
-  if (env.JUNO_JOB_URL?.trim()) return env.JUNO_JOB_URL.trim();
+  if (env.JUNO_TASK_URL?.trim()) return env.JUNO_TASK_URL.trim();
   throw new UsageError(
-    `juno job run: no ping URL — pass it, --url-file or JUNO_JOB_URL\nusage: ${JOB_RUN_USAGE}`
+    `juno ${command}: no ping URL — pass it, --url-file or JUNO_TASK_URL\nusage: ${usage}`
   );
 }
 
 /**
  * endpoint is `<url>/<suffix>?rid=<rid>`, used as given otherwise: no /ping/
- * check, so a Healthchecks URL works too. A query the URL already carries is
- * kept.
+ * check, so a Healthchecks URL works too. An empty suffix is a success, which
+ * is the bare URL. A query the URL already carries is kept; without a rid
+ * there is no `rid` parameter.
  */
 export function endpoint(url, suffix, rid) {
   const q = url.indexOf('?');
-  const path = (q === -1 ? url : url.slice(0, q)).replace(/\/+$/, '');
-  const query = q === -1 ? '' : `${url.slice(q + 1)}&`;
-  return `${path}/${suffix}?${query}rid=${encodeURIComponent(rid)}`;
+  const base = (q === -1 ? url : url.slice(0, q)).replace(/\/+$/, '');
+  const path = suffix ? `${base}/${suffix}` : base;
+  const params = [];
+  if (q !== -1 && q < url.length - 1) params.push(url.slice(q + 1));
+  if (rid) params.push(`rid=${encodeURIComponent(rid)}`);
+  return params.length ? `${path}?${params.join('&')}` : path;
 }
 
 /**
@@ -274,3 +294,75 @@ export class Tail {
     return Buffer.concat(this.#chunks, this.#size);
   }
 }
+
+export const TASK_PING_USAGE =
+  'juno task ping [<url>] [--url-file <path>] [--start | --fail | --exit <0-255> | --log] [--rid <id>]';
+
+const PING_KINDS = ['start', 'fail', 'exit', 'log'];
+
+/**
+ * `juno task ping` sends one report to a task's ping URL, for a task
+ * `task run` cannot wrap — one whose scheduler runs no command, or whose start
+ * and finish happen in different places. Without a flag it reports success;
+ * `--start`, `--fail`, `--exit <n>` and `--log` send the other reports, and
+ * `--rid` pairs a start with its finish. It sends no output.
+ *
+ * It finds the URL as `task run` does and, like it, reads no Juno config and no
+ * API key. Unlike `task run` it has nothing else to do, so a report that still
+ * fails after one retry is exit 1 with the reason, not silence: the caller
+ * asked for exactly this and can `|| true` it.
+ */
+export async function taskPing(args, io, deps = {}) {
+  const {
+    fetch = globalThis.fetch,
+    env = process.env,
+    readFile = nodeReadFile,
+    timeouts = DEFAULT_TIMEOUTS,
+  } = deps;
+  const usage = (msg) =>
+    new UsageError(`juno task ping: ${msg}\nusage: ${TASK_PING_USAGE}`);
+
+  if (args._.length > 1) {
+    throw usage(`one URL, got ${args._.length} arguments`);
+  }
+  const kinds = PING_KINDS.filter(
+    (k) => args[k] !== undefined && args[k] !== false
+  );
+  if (kinds.length > 1) {
+    throw usage(`--${kinds.join(' and --')} are different reports; pick one`);
+  }
+  // A success is the bare URL: the protocol has no /success suffix.
+  let suffix = '';
+  if (kinds[0] === 'exit') {
+    const n = args.exit.trim();
+    if (!/^\d{1,3}$/.test(n) || Number(n) > 255) {
+      throw usage(`--exit takes a status from 0 to 255, got "${args.exit}"`);
+    }
+    suffix = String(Number(n));
+  } else if (kinds[0]) {
+    suffix = kinds[0];
+  }
+  const url = await pingURL('task ping', TASK_PING_USAGE, {
+    positional: args._[0],
+    file: args['url-file'],
+    env,
+    readFile,
+    cwd: io.cwd,
+  });
+
+  const send = () =>
+    report(fetch, endpoint(url, suffix, args.rid), {
+      method: 'GET',
+      timeout: timeouts.finish,
+    });
+  let failure = await send();
+  if (failure) {
+    await new Promise((resolve) => setTimeout(resolve, timeouts.retryDelay));
+    failure = await send();
+  }
+  if (failure) {
+    io.error(`juno task ping: could not report to Juno: ${failure}`);
+    return EXIT_FAILURE;
+  }
+  return EXIT_OK;
+}

package/src/exit.js

@@ -13,7 +13,7 @@
  *   5  `juno ask` / `session approve`: the turn is still running (pending)
  *   6  `juno ask` / `session approve`: the assistant is awaiting input
  *
- * `juno job run` is the exception once its own arguments are accepted: it
+ * `juno task run` is the exception once its own arguments are accepted: it
  * exits with the wrapped command's status, as a shell would report it.
  */
 export const EXIT_OK = 0;

package/src/index.js

@@ -29,7 +29,12 @@ import { FLOW_INIT_USAGE, flowInit } from './commands/flow-init.js';
 import { FLOW_PULL_USAGE, flowPull } from './commands/flow-pull.js';
 import { GEN_TYPES_USAGE, genTypes } from './commands/gen-types.js';
 import { INIT_USAGE, init } from './commands/init.js';
-import { JOB_RUN_USAGE, jobRun } from './commands/job-run.js';
+import {
+  TASK_PING_USAGE,
+  TASK_RUN_USAGE,
+  taskPing,
+  taskRun,
+} from './commands/task-run.js';
 import { PULL_USAGE, pull } from './commands/pull.js';
 import { SKILL_USAGE, skill } from './commands/skill.js';
 import {
@@ -106,15 +111,29 @@ const NON_TOOL = {
   // raw: everything after `--` is the wrapped command's, verbatim, so the
   // argv goes to the handler unparsed (see runRow). No --url or --token: the
   // wrapper reads no Juno config, only the ping URL.
-  'job run': {
-    run: (argv, io) => jobRun(argv, io, { env: io.env }),
+  'task run': {
+    run: (argv, io) => taskRun(argv, io, { env: io.env }),
     options: {
       'url-file': { type: 'string' },
       verbose: { type: 'boolean', default: false },
     },
-    usage: JOB_RUN_USAGE,
+    usage: TASK_RUN_USAGE,
     raw: true,
   },
+  // No --url or --token either: one report to the ping URL, found as task run
+  // finds it.
+  'task ping': {
+    run: (args, io) => taskPing(args, io, { env: io.env }),
+    options: {
+      'url-file': { type: 'string' },
+      start: { type: 'boolean' },
+      fail: { type: 'boolean' },
+      exit: { type: 'string' },
+      log: { type: 'boolean' },
+      rid: { type: 'string' },
+    },
+    usage: TASK_PING_USAGE,
+  },
   'config set': { run: configSet, options: {}, usage: CONFIG_SET_USAGE },
   'agent-skill install': {
     run: agentSkillInstall,

package/verbs.json

@@ -212,7 +212,32 @@
       "working_copy": true,
       "summary": "Serve this app locally on mocked data"
     },
+    {
+      "command": "finding list",
+      "tool": "list_findings",
+      "flags": {
+        "status": { "field": "status", "type": "string" },
+        "owner-kind": { "field": "owner_kind", "type": "string" },
+        "owner": { "field": "owner", "type": "string" },
+        "severity": { "field": "severity", "type": "string" }
+      }
+    },
     { "command": "finding get", "tool": "get_finding", "id_field": "slug" },
+    {
+      "command": "finding get-history",
+      "tool": "get_finding_history",
+      "id_field": "slug",
+      "flags": {
+        "key": { "field": "key", "type": "string" },
+        "limit": { "field": "limit", "type": "integer" }
+      }
+    },
+    {
+      "command": "finding dismiss",
+      "tool": "dismiss_finding",
+      "id_field": "slug",
+      "flags": { "key": { "field": "key", "type": "string" } }
+    },
     { "command": "webhook list", "tool": "list_webhooks" },
     {
       "command": "webhook get-deliveries",
@@ -221,9 +246,12 @@
     },
     { "command": "webhook write", "tool": "write_webhook", "id_field": "id" },
     { "command": "webhook fire", "tool": "fire_webhook", "id_field": "id" },
-    { "command": "job list", "tool": "list_jobs" },
-    { "command": "job get-runs", "tool": "get_job_runs", "id_field": "id" },
-    { "command": "job write", "tool": "write_job", "id_field": "id" },
+    { "command": "task list", "tool": "list_tasks" },
+    { "command": "task get-runs", "tool": "get_task_runs", "id_field": "id" },
+    { "command": "task write", "tool": "write_task", "id_field": "id" },
+    { "command": "task delete", "tool": "delete_task", "id_field": "id" },
+    { "command": "task command", "tool": "command_task", "id_field": "id" },
+    { "command": "series get", "tool": "get_series", "id_field": "id" },
     { "command": "credential list", "tool": "list_credentials" },
     { "command": "person list", "tool": "list_people" },
     { "command": "person get", "tool": "get_person", "id_field": "id" },
@@ -239,6 +267,16 @@
       "id_field": "run_id",
       "flags": { "handle": { "field": "handle_id", "type": "string" } }
     },
+    {
+      "command": "question answer",
+      "tool": "answer_question",
+      "id_field": "run_id",
+      "flags": {
+        "handle": { "field": "handle_id", "type": "string" },
+        "answer": { "field": "answer", "type": "string" },
+        "for": { "field": "for", "type": "string" }
+      }
+    },
     {
       "command": "ha get-entity",
       "tool": "get_entity",
@@ -275,9 +313,14 @@
       "summary": "Approve the tool call an assistant session is waiting on"
     },
     {
-      "command": "job run",
+      "command": "task run",
+      "effect": "act",
+      "summary": "Run a command and report it to a task's ping URL"
+    },
+    {
+      "command": "task ping",
       "effect": "act",
-      "summary": "Run a command and report it to an external job's ping URL"
+      "summary": "Send one report (success, start, fail, an exit status or a log) to a task's ping URL"
     },
     {
       "command": "credential set",