@kosuke-ai/kosuke 1.0.7 → 1.0.8

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.0.8
+
+- A command refuses `--<flag>` given together with `--<flag>-file`, and two file flags that both read stdin (`-`).
+- Hand-written commands end in a verb: `kosuke agent summary get`, `kosuke auth status get`, `kosuke integrations tools get` (was `integrations describe`), `kosuke sessions jobs watch` (was `sessions watch`) and `kosuke sessions skill-runs finish` (was `end`). The old names keep working, hidden, for one release. The raw `integrations tools` and `integrations execute` passthroughs move to hidden `integrations tools list` and `integrations tools call`, and the `workspaces sensei-*` and `workspaces lead-*` aliases are removed.
+- Every command now reads `kosuke <group> [<sub-noun> …] <verb>`: groups are plural (`deploys`, `providers`, `skills`, `plugins`), and the last word is a verb (`sessions start`, `sensei cards list`, `files set`, `mac files get`). Personal and workspace commands share one tree: pass `personal` where the workspace id goes (`kosuke crons get personal <cronId>`, `kosuke tasks list personal`), or leave it out for every workspace (`kosuke tasks list`, `kosuke sessions list`). The provider commands take `--provider` (`kosuke providers usage get <workspaceId> --provider codex`). Every old name still runs, hidden, for one release, with its old arguments and flags. `kosuke sessions needs-you` and its route are removed; use `kosuke sessions list --needs-you`. Personal Cron projects take `--project` (was `--project-ids`). MCP tools and toolsets follow the new names (`deploys_start`, `providers_usage_get`); the `deploy` and `personal-tasks` toolsets keep working for one release.
+- The README, the help texts and the messages the platform prints name each command by its new name, and the API reference summaries name commands as `kosuke <command>`.
+- Remove `crons projects resume`, `crons runs diagnostics`, `sessions qa clear` and `sessions title-generate`. Each removed endpoint answers 410 with what to run instead: `crons update --enabled`, `crons runs get`, `sessions qa set` or `sessions update`.
+- `kosuke sessions pull-request mark-ready` refuses while no check has reported on the head of a repository with workflow files, unless `--without-checks` is passed.
+- Add `kosuke prototypes create`: the platform renders a prototype from its configuration, styles and script, checks it and saves it to a Chat Session's artifacts or a workspace's Files.
+- QA and review commands check what they record: `kosuke sessions qa runs finish` clears a QA Passed its session's runs recorded at the same head when the run ends not passed, `qa runs fixes create` takes only a commit on HEAD after the run's start and at least one retest id, `kosuke sessions review set` refuses uncommitted tracked changes, a stopped Turn and a run past 2147483647, and `kosuke sessions pull-request mark-ready` re-reads the head before marking it ready.
+- Kosuke keeps QA Runs itself: `kosuke sessions qa runs start`, `results create`, `fixes create`, `stop` and `finish` record a session's run from its own sandbox and answer the checklist to write back, and `kosuke sessions qa runs get` reads a run as data. `finish` records QA Passed when the whole checklist passed at the sandbox's clean HEAD, and keeps the run's usage from `--usage-file`. A field that takes a file, such as the checklist or a result, also has a `--<flag>-file <path>` flag. An agent's `kosuke sessions qa set` now only repeats a pass `finish` recorded; a member's still sets it by hand. New: `kosuke sessions pull-request mark-ready` marks the session's draft pull request ready for review only when its head is the sandbox's clean HEAD, its CI is green and QA passed on it, and `kosuke sessions review set` records a review's verdict for the sandbox's HEAD.
+- Add `kosuke sensei delegates list --thread <id>`, which lists the delegates of one of your Sensei threads with their state, Model and Delegate Summary.
+- Your Memory has one command set, `kosuke sensei memory get` and `kosuke sensei memory set`. `kosuke user memory put` is removed, and `kosuke user memory list` runs `kosuke sensei memory get`, hidden, for one release. Only you and your Sensei, for a card you approved, can change Memory: a session or a Cron can read it but no longer save it.
+- A command refused for `personal` or a missing scope now names the id it takes, a project id or a workspace id, and the command that lists them.
+
 ## 1.0.7
 
 - Remove the hidden `workspaces sensei-*` and `workspaces lead-*` commands and stop reading `kosuke_lead_` tokens as Sensei tokens; use the `sensei` commands.

package/README.md

@@ -14,7 +14,7 @@ kosuke sessions create <projectId> --title "Fix the login form" \
 kosuke crons create <workspaceId> --project <projectId> --project <projectId> \
   --name "Daily ingest" --prompt "/sources" \
   --cron-expression "0 6 * * *"
-kosuke workspaces timezone-set <workspaceId> --timezone Europe/Zurich
+kosuke workspaces timezone set <workspaceId> --timezone Europe/Zurich
 ```
 
 Every API command prints the platform's JSON response as is, so it pipes into `jq`.
@@ -35,7 +35,7 @@ The main chat agent records Factory Skill boundaries with these commands:
 
 ```sh
 kosuke sessions skill-runs start kosuke:ship
-kosuke sessions skill-runs end kosuke:ship --result ready
+kosuke sessions skill-runs finish kosuke:ship --result ready
 ```
 
 The sandbox supplies the session identity and its Turn credential. The server selects the
@@ -50,14 +50,14 @@ prints `skill-markers-v1` without credentials, so an older CLI never receives an
 
 ## Watching a turn
 
-`kosuke sessions watch` follows one turn's job as it runs, so a script does not
+`kosuke sessions jobs watch` follows one turn's job as it runs, so a script does not
 have to poll `sessions jobs get`. Each frame the platform streams is one JSON
 line on stdout, so it pipes into `jq`, and everything meant for a person goes to
 stderr. The job id is the `chatJobId` that `sessions create` and `sessions send`
 return.
 
 ```sh
-kosuke sessions watch <projectId> <sessionId> <jobId> \
+kosuke sessions jobs watch <projectId> <sessionId> <jobId> \
   | jq -r 'select(.type == "message") | .data.text'
 ```
 
@@ -76,7 +76,7 @@ was refused, 4 when the project, session or job was not found, and 124 when
 `--timeout` passed first.
 
 `--type deploy` watches a deploy instead. The job id is then the
-`activeStreamId` that `kosuke deploy messages` returns, and the session id is
+`activeStreamId` that `kosuke deploys messages list` returns, and the session id is
 not read. The deploy's status describes its latest turn only, so when a later
 turn or Deploy takes over before the watch reads how this turn ended, it says
 so on stderr and exits 1.
@@ -87,7 +87,7 @@ document below cannot describe.
 ## Upgrading from 5.x
 
 A cron no longer has a timezone of its own: every cron of a workspace is read
-in the Workspace Timezone, which `kosuke workspaces timezone-set <workspaceId>
+in the Workspace Timezone, which `kosuke workspaces timezone set <workspaceId>
 --timezone Europe/Zurich` sets, as an owner or admin. `crons create` and `crons
 update` lose `--timezone`, and the API refuses a cron body that still sends one,
 which is what an older CLI does with `--timezone`. `crons get` still prints the
@@ -138,12 +138,12 @@ kosuke auth login --api-url https://app.stage.kosuke.ai
 kosuke projects list    # same shell, so it reads the stage key and URL
 ```
 
-A shell alias or direnv keeps the variable set; `kosuke auth status` prints
+A shell alias or direnv keeps the variable set; `kosuke auth status get` prints
 which URL, which key source and which credentials file won.
 
 ## A digest for an agent
 
-`kosuke agent summary` prints the sessions that need you and your oldest New
+`kosuke agent summary get` prints the sessions that need you and your oldest New
 Activity events across every workspace, one line each, and the name of every
 workspace it read, in about 1,500 tokens. It lists only as many events as the
 rest leaves room for, so fewer when you belong to many workspaces, and marks
@@ -163,7 +163,7 @@ connected to a workspace, and to you.
 ```sh
 kosuke integrations list --workspace <id>                    # a block per toolkit
 kosuke integrations list --workspace <id> --toolkit gmail    # that toolkit's tools
-kosuke integrations describe <tool> --workspace <id>         # one tool's input schema
+kosuke integrations tools get <tool> --workspace <id>         # one tool's input schema
 kosuke integrations call <tool> --workspace <id> --account notion-personal --args '{"query":"roadmap"}'
 ```
 
@@ -179,8 +179,8 @@ and exits 1 when the tool reports an error.
 With an API key, `--workspace` is required (you must belong to it), and `call`
 runs only your own personal connections. Inside an agent's turn the credential
 decides the workspace and the flag is optional. A Connector Token is refused.
-`kosuke integrations tools` and `execute` print the raw JSON of the same two
-routes. `kosuke agent summary` lists the same connections, one line each.
+The hidden `kosuke integrations tools list` and `kosuke integrations tools call`
+print the raw JSON of the same two routes. `kosuke agent summary get` lists the same connections, one line each.
 
 ## Generated from the API
 

package/dist/agent/summary.js

@@ -312,7 +312,7 @@ export function planSummary(options) {
         const shown = needing.slice(0, NEEDS_YOU_SHOWN);
         head.push(...shown.map(sessionLine));
         if (needTotal > shown.length) {
-            head.push(`(and ${needTotal - shown.length} more: kosuke sessions all --needs-you --owners me${scope})`);
+            head.push(`(and ${needTotal - shown.length} more: kosuke sessions list --needs-you --owners me${scope})`);
         }
     }
     head.push('');
@@ -401,7 +401,7 @@ export async function fetchSummary(options) {
         return renderSummary(plan, activity);
     }
     catch (error) {
-        return unavailable(reasonOf(error), 'kosuke auth status');
+        return unavailable(reasonOf(error), 'kosuke auth status get');
     }
 }
 function body(result) {

package/dist/commands/agent.js

@@ -1,9 +1,10 @@
 import { fetchSummary } from '../agent/summary.js';
+import { leafAt } from '../runtime/attach.js';
+import { HAND_WRITTEN } from './hand-written.js';
 export function attachAgentCommands(root, runtime, deps = {}) {
     const { fetch, now, stdout = (line) => process.stdout.write(line + '\n') } = deps;
-    const agent = root.command('agent').description('What an agent reads about your Kosuke.');
-    agent
-        .command('summary')
+    root.command('agent').description('What an agent reads about your Kosuke.');
+    leafAt(root, HAND_WRITTEN.agentSummaryGet.command)
         .description('Print what needs you and your oldest New Activity as a short digest for an agent to read. ' +
         'Marks seen only the events it prints, and none with --peek; the rest stay New.')
         .option('--workspace <id>', 'Only this workspace.')

package/dist/commands/auth.js

@@ -1,12 +1,13 @@
+import { leafAt } from '../runtime/attach.js';
 import { createApiClient } from '../runtime/client.js';
 import { credentialsPath, DEFAULT_API_URL, deleteCredentials, writeCredentials, } from '../runtime/config.js';
+import { HAND_WRITTEN } from './hand-written.js';
 export function attachAuthCommands(root, runtime, deps = {}) {
     const { env = process.env, fetch, prompt = promptHidden, stdout = (line) => process.stdout.write(line + '\n'), stderr = (line) => process.stderr.write(line + '\n'), exit = (code) => {
         process.exitCode = code;
     }, } = deps;
-    const auth = root.command('auth').description('Manage the API key this machine uses.');
-    auth
-        .command('login')
+    root.command('auth').description('Manage the API key this machine uses.');
+    leafAt(root, HAND_WRITTEN.authLogin.command)
         .description('Store an API key, after checking it works. Takes the global --api-key when ' +
         'given, and prompts otherwise. Create one in Settings.')
         .action(async () => {
@@ -32,8 +33,7 @@ export function attachAuthCommands(root, runtime, deps = {}) {
         const path = writeCredentials({ apiKey, ...(apiUrl !== DEFAULT_API_URL ? { apiUrl } : {}) }, env);
         stdout(`Logged in to ${apiUrl}; member of ${who.workspaces} workspace${who.workspaces === 1 ? '' : 's'}. API key saved to ${path}.`);
     });
-    auth
-        .command('status')
+    leafAt(root, HAND_WRITTEN.authStatusGet.command)
         .description('Show where the API key comes from and whether the platform accepts it.')
         .action(async () => {
         const { apiKey, apiKeySource, apiUrl, apiUrlSource } = runtime.credentials();
@@ -59,8 +59,7 @@ export function attachAuthCommands(root, runtime, deps = {}) {
         if (!result.accepted)
             exit(1);
     });
-    auth
-        .command('logout')
+    leafAt(root, HAND_WRITTEN.authLogout.command)
         .description('Delete the stored API key. A key from the environment or a flag is untouched.')
         .action(() => {
         const path = credentialsPath(env);

package/dist/commands/hand-written.js

@@ -0,0 +1,93 @@
+const SKILL_RUN_FLAGS = [
+    '--fix',
+    '--sync',
+    '--no-review',
+    '--restart',
+    '--ready',
+    '--draft',
+    '--target-branch',
+    '--reviewers',
+    '--evidence',
+];
+export const HAND_WRITTEN = {
+    authLogin: {
+        command: ['auth', 'login'],
+        positionals: [],
+        flags: [],
+        agents: 'all',
+        workspace: true,
+    },
+    authStatusGet: {
+        command: ['auth', 'status', 'get'],
+        positionals: [],
+        flags: [],
+        agents: 'all',
+        workspace: true,
+    },
+    authLogout: {
+        command: ['auth', 'logout'],
+        positionals: [],
+        flags: [],
+        agents: 'all',
+        workspace: true,
+    },
+    agentSummaryGet: {
+        command: ['agent', 'summary', 'get'],
+        positionals: [],
+        flags: ['--workspace', '--peek'],
+        agents: 'all',
+        workspace: false,
+    },
+    integrationsList: {
+        command: ['integrations', 'list'],
+        positionals: [],
+        flags: ['--toolkit', '--search', '--account', '--limit', '--workspace', '--json'],
+        agents: 'all',
+        workspace: true,
+    },
+    integrationsToolsGet: {
+        command: ['integrations', 'tools', 'get'],
+        positionals: ['name'],
+        flags: ['--account', '--workspace'],
+        agents: 'all',
+        workspace: true,
+    },
+    integrationsCall: {
+        command: ['integrations', 'call'],
+        positionals: ['name', 'stdin'],
+        flags: ['--account', '--args', '--args-file', '--workspace'],
+        agents: 'all',
+        workspace: true,
+    },
+    sessionsJobsWatch: {
+        command: ['sessions', 'jobs', 'watch'],
+        positionals: ['projectId', 'sessionId', 'jobId'],
+        flags: ['--type', '--timeout'],
+        agents: 'none',
+        workspace: false,
+    },
+    // lint-gate-exempt command-names: the capability probe ksb runs by fixed argv
+    // (skill-marker-capability.ts), so an older ksb finds markers on a newer CLI.
+    sessionsSkillRuns: {
+        command: ['sessions', 'skill-runs'],
+        positionals: [],
+        flags: ['--capabilities'],
+        agents: ['sandboxToken'],
+        workspace: true,
+    },
+    sessionsSkillRunsStart: {
+        command: ['sessions', 'skill-runs', 'start'],
+        positionals: ['name'],
+        flags: SKILL_RUN_FLAGS,
+        agents: ['sandboxToken'],
+        workspace: true,
+    },
+    sessionsSkillRunsFinish: {
+        command: ['sessions', 'skill-runs', 'finish'],
+        positionals: ['name'],
+        flags: [...SKILL_RUN_FLAGS, '--result'],
+        agents: ['sandboxToken'],
+        workspace: true,
+    },
+};
+export const HAND_WRITTEN_COMMANDS = Object.values(HAND_WRITTEN);

package/dist/commands/integrations.js

@@ -1,14 +1,15 @@
 import { readFile } from 'node:fs/promises';
 import { InvalidArgumentError } from 'commander';
-import { groupFor } from '../runtime/attach.js';
+import { leafAt } from '../runtime/attach.js';
+import { HAND_WRITTEN } from './hand-written.js';
 import { isTurnToken } from '../runtime/credentials.js';
 import { connectionOf, failureOf, isRow, oneLine, readOverview, rowsOf, TOOLS_PATH, transportFailure, } from '../integrations/api.js';
 import { choiceLines, renderOverview } from '../integrations/render.js';
 /**
- * `kosuke integrations list|describe|call`: the connected tools, listed and run
- * from a laptop or an agent's shell. Hand-written because the output is text
- * and the exit code says whether the tool worked, which the generated
- * `integrations tools` and `integrations execute` (raw JSON passthroughs, kept
+ * `kosuke integrations list|call` and `kosuke integrations tools get`: the connected tools,
+ * listed and run from a laptop or an agent's shell. Hand-written because the output is text
+ * and the exit code says whether the tool worked, which the generated, hidden
+ * `integrations tools list` and `integrations tools call` (raw JSON passthroughs, kept
  * beside these) cannot do.
  *
  * Tool descriptions, schemas and results come from third-party services: they
@@ -129,9 +130,7 @@ export function attachIntegrationsCommands(root, runtime, deps = {}) {
             fail(error.message, EXIT_USAGE);
         }
     };
-    const group = groupFor(root, ['integrations']);
-    group
-        .command('list')
+    leafAt(root, HAND_WRITTEN.integrationsList.command)
         .description('List the connected tools. With no filter, one block per toolkit: its connections (alias, ' +
         'scope, label, account, id) and how many read-only and write tools it has. --toolkit and ' +
         '--search list the matching tools. A cut list says "N of M" and how to narrow it.')
@@ -163,8 +162,7 @@ export function attachIntegrationsCommands(root, runtime, deps = {}) {
         }
         stdout(renderOverview(result.overview, Boolean(flags.toolkit || flags.search)));
     }));
-    group
-        .command('describe')
+    leafAt(root, HAND_WRITTEN.integrationsToolsGet.command)
         .description("Print one tool's input schema and annotations as JSON.")
         .argument('<name>', 'The tool, as `list` prints it.')
         .option('--account <account>', 'The connection whose schema you want: an alias, id or scope:label. Needed when several can run the tool.', accountText)
@@ -208,8 +206,7 @@ export function attachIntegrationsCommands(root, runtime, deps = {}) {
             fail(transportFailure(error, 'GET'));
         }
     }));
-    group
-        .command('call')
+    leafAt(root, HAND_WRITTEN.integrationsCall.command)
         .description('Run a tool with a JSON object of arguments and print its text result. The connection it ' +
         'ran on is named on stderr. A tool that reports an error exits 1.')
         .argument('<name>', 'The tool, as `list` prints it.')

package/dist/commands/skill-runs.js

@@ -2,6 +2,8 @@ import { randomUUID } from 'node:crypto';
 import { appendFile, lstat, readFile } from 'node:fs/promises';
 import { isAbsolute } from 'node:path';
 import { agentTokenOf } from '../runtime/agent-tokens.js';
+import { groupFor, leafAt } from '../runtime/attach.js';
+import { HAND_WRITTEN } from './hand-written.js';
 const FLAGS = new Set([
     '--fix',
     '--sync',
@@ -86,7 +88,8 @@ async function receiptData(response) {
 }
 /** Marker errors bypass Commander and the shared retrying client so they cannot stop agent work. */
 export async function runSkillMarkerCommand(args, options = {}) {
-    if (args[0] !== 'sessions' || args[1] !== 'skill-runs')
+    const [group, noun] = HAND_WRITTEN.sessionsSkillRuns.command;
+    if (args[0] !== group || args[1] !== noun)
         return false;
     const { env = process.env, fetch: request = globalThis.fetch, stdout = (text) => process.stdout.write(text), timeoutMs = DEADLINE_MS, } = options;
     if (args.length === 3 && args[2] === '--capabilities') {
@@ -94,10 +97,12 @@ export async function runSkillMarkerCommand(args, options = {}) {
         return true;
     }
     if (args.includes('--help') || args.includes('-h')) {
-        stdout('kosuke sessions skill-runs start <name> [--fix] [--sync] [--no-review]\nkosuke sessions skill-runs end <name> [--result <verdict>]\nBest effort: one request, 1.5-second deadline, always exits 0.\n');
+        stdout('kosuke sessions skill-runs start <name> [--fix] [--sync] [--no-review]\nkosuke sessions skill-runs finish <name> [--result <verdict>]\nBest effort: one request, 1.5-second deadline, always exits 0.\n');
         return true;
     }
-    const [, , action, rawName, ...rest] = args;
+    const [, , verb, rawName, ...rest] = args;
+    // Alias: `end`, the verb before the grammar, which older Factory Skills still run.
+    const action = verb === 'finish' || verb === 'end' ? 'end' : verb;
     if ((action !== 'start' && action !== 'end') ||
         !rawName ||
         !/^(?:kosuke:)?[a-z][a-z0-9-]{0,79}$/.test(rawName))
@@ -205,23 +210,21 @@ export async function runSkillMarkerCommand(args, options = {}) {
     return true;
 }
 export function attachSkillMarkerCommands(program, options = {}) {
-    const sessions = program.commands.find((command) => command.name() === 'sessions') ??
-        program.command('sessions');
-    const skills = sessions.commands.find((command) => command.name() === 'skill-runs') ??
-        sessions.command('skill-runs');
+    const skills = groupFor(program, HAND_WRITTEN.sessionsSkillRuns.command);
     skills
         .description('Record best-effort Factory Skill start and end markers.')
         .option('--capabilities', 'Print marker command capability.')
         .action(async () => {
         await runSkillMarkerCommand(['sessions', 'skill-runs', '--capabilities'], options);
     });
-    for (const action of ['start', 'end']) {
-        const command = skills
-            .command(`${action} <name>`)
-            .description(`${action === 'start' ? 'Start' : 'End'} a Factory Skill in this sandbox Turn.`);
+    for (const entry of [HAND_WRITTEN.sessionsSkillRunsStart, HAND_WRITTEN.sessionsSkillRunsFinish]) {
+        const action = entry.command[entry.command.length - 1];
+        const command = leafAt(program, entry.command)
+            .argument('<name>')
+            .description(`${action === 'start' ? 'Start' : 'Finish'} a Factory Skill in this sandbox Turn.`);
         for (const flag of FLAGS)
             command.option(flag);
-        if (action === 'end')
+        if (action === 'finish')
             command.option('--result <verdict>', 'A known result, such as passed, failed, blocked, or ready.');
         command.action(async (_name, _flags, cmd) => {
             await runSkillMarkerCommand(cmd.parent.parent.parent.args, options);

package/dist/commands/watch.js

@@ -1,8 +1,9 @@
 import { InvalidArgumentError, Option } from 'commander';
-import { groupFor } from '../runtime/attach.js';
+import { leafAt } from '../runtime/attach.js';
+import { HAND_WRITTEN } from './hand-written.js';
 import { JOB_TYPES, WATCH_EXIT, describe, isRecord, watchJob, } from '../runtime/job-watch.js';
 /**
- * `kosuke sessions watch`: a turn's frames as they happen, one JSON object per
+ * `kosuke sessions jobs watch`: a turn's frames as they happen, one JSON object per
  * line. Hand-written because they arrive over the `/ws/jobs` WebSocket, which
  * the OpenAPI document the rest of the tree is generated from cannot describe.
  */
@@ -112,14 +113,13 @@ export function attachWatchCommand(root, runtime, deps = {}) {
     const { connect = openWebSocket, stdout = (line) => process.stdout.write(line + '\n'), stderr = (line) => process.stderr.write(line + '\n'), exit = (code) => {
         process.exitCode = code;
     }, } = deps;
-    groupFor(root, ['sessions'])
-        .command('watch')
+    leafAt(root, HAND_WRITTEN.sessionsJobsWatch.command)
         .description("Stream a turn's frames as NDJSON until its job ends: one frame per line on stdout, " +
         'diagnostics on stderr. A dropped connection resumes after the last frame, and the ' +
         "job's status is read every 5 s, so a stream that goes quiet still ends.")
         .argument('<projectId>', 'Project id')
         .argument('<sessionId>', 'Session id. Not read for --type deploy, which is per project.')
-        .argument('<jobId>', "The turn's chat job id. For --type deploy, the activeStreamId `kosuke deploy messages` returns.")
+        .argument('<jobId>', "The turn's chat job id. For --type deploy, the activeStreamId `kosuke deploys messages list` returns.")
         .addOption(new Option('--type <type>', 'What the job is.').choices(JOB_TYPES).default('chat'))
         .option('--timeout <seconds>', 'Stop waiting after this many seconds and exit 124. Default: until the job ends.', seconds)
         .addHelpText('after', '\nFrames from the platform carry an id. Two more, without one, come from this command:\n' +

package/dist/generated/commands/{user/crons-artifacts-list.js → crons/artifacts-list--personal.js}

@@ -2,11 +2,13 @@ export const operation = {
     "method": "get",
     "path": "/api/user/crons/{cronId}/artifacts",
     "command": [
-        "user",
         "crons",
         "artifacts",
         "list"
     ],
+    "variant": {
+        "scope": "personal"
+    },
     "summary": "List the Artifacts a cron's runs published, across all of its runs, most recently changed first: each one's title, kind and version, with the run and the project it came from, and the total the filters keep. One row per Artifact: the same slug published by two runs is two rows. Rows only: a body or a file url comes from crons runs artifacts get, with the row's runId. The project and kind filters each take several values and keep an Artifact matching any of them.",
     "pathParams": [
         "cronId"

package/dist/generated/commands/{user/crons-create.js → crons/create--personal.js}

@@ -2,10 +2,12 @@ export const operation = {
     "method": "post",
     "path": "/api/user/crons",
     "command": [
-        "user",
         "crons",
         "create"
     ],
+    "variant": {
+        "scope": "personal"
+    },
     "summary": "Create a Personal Cron, enabled, with you as its owner. A Personal Cron belongs to you and no workspace: with Personal Repositories or Apps it runs in its own sandbox; without, in its Sensei Thread. Repository runs use your own Subscriptions; thread runs use your Subscriptions or Kosuke free when you hold none. Kosuke free cannot run a Cron with repositories yet. The crontab is read in the cron's own timezone, and may not fire more often than every 15 minutes. The model is an encoded id such as anthropic:opus__xhigh; repositories require an explicit Model from any released Provider on one of your Subscriptions. Changing to Free while you hold a Subscription, or to a personal Model without one, is refused. Without repositories, null or left out runs on the thread’s model. From your Sensei it is refused with 409 CRON_ALREADY_EXISTS when you have a Personal Cron by that name: update that one instead. From Sensei, create or change one only when the member asks. To move a workspace Cron here, read it and recreate it with its timezone (its model only when the member's own Subscription runs it); the member deletes the workspace one in the app.",
     "pathParams": [],
     "query": [],
@@ -13,7 +15,7 @@ export const operation = {
         "fields": [
             {
                 "name": "projectIds",
-                "flag": "project-ids",
+                "flag": "project",
                 "kind": "string",
                 "required": false,
                 "description": "Personal Repositories and Apps to clone in the run’s sandbox. With none, runs in its Sensei Thread.",

package/dist/generated/commands/crons/create.js

@@ -5,7 +5,7 @@ export const operation = {
         "crons",
         "create"
     ],
-    "summary": "Create a cron, enabled, with you as its creator, with zero or more of the workspace's projects: each fire is one Cron Run in its own sandbox, cloning only the selected repositories. Every run spends the workspace's Credentials, never a member's Subscription, so a workspace with no usable provider is refused. The model is an encoded id such as anthropic:opus__xhigh; null or left out uses the saved Workspace Default Model when its Provider has usable workspace Credentials, otherwise Kosuke's choice among usable workspace Credentials at run time. The crontab is read in the Workspace Timezone (workspaces timezone-set), and may not fire more often than every 15 minutes. A body that sends timezone is refused. From an agent (Sensei, a sandbox or a Cron Run) it is refused with 409 CRON_ALREADY_EXISTS when the workspace has a Cron by that name.",
+    "summary": "Create a cron, enabled, with you as its creator, with zero or more of the workspace's projects: each fire is one Cron Run in its own sandbox, cloning only the selected repositories. Every run spends the workspace's Credentials, never a member's Subscription, so a workspace with no usable provider is refused. The model is an encoded id such as anthropic:opus__xhigh; null or left out uses the saved Workspace Default Model when its Provider has usable workspace Credentials, otherwise Kosuke's choice among usable workspace Credentials at run time. The crontab is read in the Workspace Timezone (`kosuke workspaces timezone set`), and may not fire more often than every 15 minutes. A body that sends timezone is refused. From an agent (Sensei, a sandbox or a Cron Run) it is refused with 409 CRON_ALREADY_EXISTS when the workspace has a Cron by that name.",
     "pathParams": [
         "workspaceId"
     ],
@@ -38,14 +38,14 @@ export const operation = {
                 "flag": "cron-expression",
                 "kind": "string",
                 "required": true,
-                "description": "Five fields: minute, hour, day of month, month, day of week, read in the Workspace Timezone (kosuke workspaces timezone-set). At most one fire every 15 minutes."
+                "description": "Five fields: minute, hour, day of month, month, day of week, read in the Workspace Timezone (kosuke workspaces timezone set). At most one fire every 15 minutes."
             },
             {
                 "name": "reportTo",
                 "flag": "report-to",
                 "kind": "string",
                 "required": false,
-                "description": "Reports to: the members, by the id `kosuke workspaces members` prints, whose Sensei each message from a run of this cron goes to, at most 10. With one, every message goes to them; with several, the run chooses among them. Empty, or left out on create, lets the run choose any member. Left out on update, it stays as saved; an empty list clears it.",
+                "description": "Reports to: the members, by the id `kosuke workspaces members list` prints, whose Sensei each message from a run of this cron goes to, at most 10. With one, every message goes to them; with several, the run chooses among them. Empty, or left out on create, lets the run choose any member. Left out on update, it stays as saved; an empty list clears it.",
                 "repeated": true
             },
             {

package/dist/generated/commands/{user/crons-get.js → crons/get--personal.js}

@@ -2,10 +2,12 @@ export const operation = {
     "method": "get",
     "path": "/api/user/crons/{cronId}",
     "command": [
-        "user",
         "crons",
         "get"
     ],
+    "variant": {
+        "scope": "personal"
+    },
     "summary": "Read one of your Personal Crons: its prompt, schedule, timezone, model, when it runs next, its thread, its last run status, and how many runs in a row failed: five disable it. A Personal Cron belongs to you and no workspace: with Personal Repositories or Apps it runs in its own sandbox; without, in its Sensei Thread. Both use your own Subscription.",
     "pathParams": [
         "cronId"

package/dist/generated/commands/{user/crons-list.js → crons/list--personal.js}

@@ -2,10 +2,12 @@ export const operation = {
     "method": "get",
     "path": "/api/user/crons",
     "command": [
-        "user",
         "crons",
         "list"
     ],
+    "variant": {
+        "scope": "personal"
+    },
     "summary": "List your Personal Crons, newest first, with each one's thread and last run status. A Personal Cron belongs to you and no workspace: with Personal Repositories or Apps it runs in its own sandbox; without, in its Sensei Thread. Repository runs use your own Subscriptions; thread runs use your Subscriptions or Kosuke free when you hold none. Among agents, only your Sensei reaches them.",
     "pathParams": [],
     "query": [

package/dist/generated/commands/{user/crons-run.js → crons/run--personal.js}

@@ -2,10 +2,12 @@ export const operation = {
     "method": "post",
     "path": "/api/user/crons/{cronId}/run",
     "command": [
-        "user",
         "crons",
         "run"
     ],
+    "variant": {
+        "scope": "personal"
+    },
     "summary": "Fire one of your Personal Crons once now, on your own Subscription: with repositories it runs in its own sandbox; without, in its Sensei Thread. Resume a paused Cron first. Refused for No projects left until a save picks a repository. Answers with runs: [{ runId, status, projectIds, projectId }]. Status may be queued while the fire is pending.",
     "pathParams": [
         "cronId"

package/dist/generated/commands/{user/crons-runs-artifacts-get.js → crons/runs-artifacts-get--personal.js}

@@ -2,12 +2,14 @@ export const operation = {
     "method": "get",
     "path": "/api/user/crons/{cronId}/runs/{runId}/artifacts/{artifactId}",
     "command": [
-        "user",
         "crons",
         "runs",
         "artifacts",
         "get"
     ],
+    "variant": {
+        "scope": "personal"
+    },
     "summary": "Read one Artifact of a run of a cron, by its id or its slug: a markdown or html one carries its body, an image or a video a presigned url, its media type and its size.",
     "pathParams": [
         "cronId",

package/dist/generated/commands/{user/crons-runs-artifacts-list.js → crons/runs-artifacts-list--personal.js}

@@ -2,12 +2,14 @@ export const operation = {
     "method": "get",
     "path": "/api/user/crons/{cronId}/runs/{runId}/artifacts",
     "command": [
-        "user",
         "crons",
         "runs",
         "artifacts",
         "list"
     ],
+    "variant": {
+        "scope": "personal"
+    },
     "summary": "List the Artifacts a run of a cron published, most recently changed first. Rows only: a body or a file url comes from reading one.",
     "pathParams": [
         "cronId",

package/dist/generated/commands/{user/crons-runs-get.js → crons/runs-get--personal.js}

@@ -2,11 +2,13 @@ export const operation = {
     "method": "get",
     "path": "/api/user/crons/{cronId}/runs/{runId}",
     "command": [
-        "user",
         "crons",
         "runs",
         "get"
     ],
+    "variant": {
+        "scope": "personal"
+    },
     "summary": "Read one Personal Cron run: its kind, status, Model, report, repositories and filed sessions. A sandbox run has its Cron Agent transcript and Artifacts and threadId null. A thread run names the Sensei Thread holding its Turn.",
     "pathParams": [
         "cronId",

package/dist/generated/commands/{user/crons-runs-list.js → crons/runs-list--personal.js}

@@ -2,11 +2,13 @@ export const operation = {
     "method": "get",
     "path": "/api/user/crons/{cronId}/runs",
     "command": [
-        "user",
         "crons",
         "runs",
         "list"
     ],
+    "variant": {
+        "scope": "personal"
+    },
     "summary": "List the runs of one of your Personal Crons, newest first: each one's status, the first line of its report or its error, and whether it ran in a sandbox or Sensei Thread, with the total and failed counts of the runs the filter keeps. The status filter takes several values and keeps a run matching any of them.",
     "pathParams": [
         "cronId"

package/dist/generated/commands/crons/{runs-messages.js → runs-messages-list.js}

@@ -4,7 +4,8 @@ export const operation = {
     "command": [
         "crons",
         "runs",
-        "messages"
+        "messages",
+        "list"
     ],
     "summary": "Read the Cron Agent's transcript of one run of a cron: the prompt it was given, then everything it did, with the run's status.",
     "pathParams": [