@lahat-group/cli 1.1.7 → 1.1.8

package/dist/index.js

@@ -9447,7 +9447,8 @@ var AGENT_SCOPES = {
   "orders:write": { he: "\u05DC\u05D4\u05DB\u05D9\u05DF \u05D8\u05D9\u05D5\u05D8\u05EA \u05D4\u05D6\u05DE\u05E0\u05D4 \u05DC\u05D0\u05D9\u05E9\u05D5\u05E8\u05DA", en: "Draft an order for you to confirm" },
   "orders:commit": { he: "\u05DC\u05D0\u05E9\u05E8 \u05D4\u05D6\u05DE\u05E0\u05D4 \u05D1\u05E9\u05DE\u05DA", en: "Confirm an order on your behalf" },
   "invitations:write": { he: "\u05DC\u05D4\u05D6\u05DE\u05D9\u05DF \u05D0\u05E0\u05E9\u05D9\u05DD \u05DC\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8\u05D9\u05DD \u05E9\u05DC\u05DA", en: "Invite people to your projects" },
-  "staff:read": { he: "\u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05E0\u05EA\u05D5\u05E0\u05D9\u05DD \u05E9\u05DC \u05DB\u05DC \u05D4\u05DE\u05E9\u05EA\u05DE\u05E9\u05D9\u05DD \u05D1\u05DE\u05E2\u05E8\u05DB\u05EA", en: "Read every user's data in the system" }
+  "staff:read": { he: "\u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05E0\u05EA\u05D5\u05E0\u05D9\u05DD \u05E9\u05DC \u05DB\u05DC \u05D4\u05DE\u05E9\u05EA\u05DE\u05E9\u05D9\u05DD \u05D1\u05DE\u05E2\u05E8\u05DB\u05EA", en: "Read every user's data in the system" },
+  "staff:write": { he: "\u05DC\u05E2\u05E8\u05D5\u05DA \u05D0\u05EA \u05D4\u05E0\u05EA\u05D5\u05E0\u05D9\u05DD \u05E9\u05DC \u05DB\u05DC \u05D4\u05DE\u05E9\u05EA\u05DE\u05E9\u05D9\u05DD \u05D1\u05DE\u05E2\u05E8\u05DB\u05EA", en: "Edit every user's data in the system" }
 };
 var ALL_AGENT_SCOPES = Object.keys(AGENT_SCOPES);
 
@@ -12104,7 +12105,7 @@ async function formatCliError(err, json) {
 
 // src/version.ts
 init_esm_shims();
-var CLI_VERSION = "1.1.7";
+var CLI_VERSION = "1.1.8";
 
 // src/index.ts
 program.name("wardrobe").description("Wardrobe configurator CLI").version(CLI_VERSION);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lahat-group/cli",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "description": "CLI + Claude Skill to build, validate, price, and save wardrobe designs.",
   "license": "UNLICENSED",
   "type": "module",

package/skill/SKILL.md

@@ -99,7 +99,10 @@ a data one. `wardrobe whoami --json` reports the truth under `agent.scopes` and
   to. A project belonging to someone else answers `403 Forbidden`, not `404`.
 - A key approved by an **admin or support** user *and* carrying **`staff:read`** sees
   **every** project, customer and order in the system. That scope is granted only to
-  staff, only for GETs, and is listed by name on the consent screen.
+  staff, only for GETs, and is listed by name on the consent screen. The same approver
+  also receives **`staff:write`**, which lets `designs create` / `designs update` land in
+  a project the admin does not own. A key logged in before 2026-09-05 lacks it — a `403
+  Forbidden` on a write to someone else's project means `wardrobe login` again.
 
 Never tell a user something does not exist when you only know your key cannot see it.
 Say which it is: `403 Forbidden` means the row is someone else's, `404` means it is gone.
@@ -138,7 +141,7 @@ Prefer generating the skeleton with `wardrobe init` rather than hand-writing it
 
 - **The CLI can read orders but never place one.** Its key carries `profile:read`,
   `projects:read`, `customers:read`, `designs:read`, `designs:write`, `orders:read`,
-  `price:read` (+ `staff:read` for staff) — **every write beyond designs is absent**,
+  `price:read` (+ `staff:read` and `staff:write` for staff) — **every write beyond designs is absent**,
   and so is every admin scope. `wardrobe orders list` and `orders pdf` work; creating
   or changing an order, a customer or a quotation answers `403 insufficient_scope`.
   Don't attempt it, and don't attempt admin/catalog operations.