@levr-one/cli 0.11.9 → 0.12.0

package/dist/{appendHandler-KVsJMxpX.js → appendHandler-DtxLpPu6.js}

@@ -1,12 +1,12 @@
-import { appendActualResult } from "./sdk-client-DYv-0CfA.js";
-import "./env-CdwyPHGV.js";
-import "./token-refresh-DeusLK8H.js";
-import "./resolve-token-7xb7kG7h.js";
-import "./workspace-store-CnrxyYRB.js";
-import "./resolve-workspace-CStHisUb.js";
-import { connect } from "./connect-BgQmrL_0.js";
-import "./sleep-BpJ39Ypm.js";
-import { embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-BzLxue32.js";
+import { appendActualResult } from "./sdk-client-B4FMd_Fa.js";
+import "./env-CvjMSRd7.js";
+import "./token-refresh-CJB7Qlxy.js";
+import "./resolve-token-ByZq05Us.js";
+import "./workspace-store-Bmw104Qa.js";
+import "./resolve-workspace-BbK3uYQc.js";
+import { connect } from "./connect-DVjgyfls.js";
+import "./sleep-CGBHjsj5.js";
+import { embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-BvBSevIx.js";
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 

package/dist/{artifact-upload-BzLxue32.js → artifact-upload-BvBSevIx.js}

@@ -1,5 +1,5 @@
-import { uploadAttachment } from "./sdk-client-DYv-0CfA.js";
-import { sleep } from "./sleep-BpJ39Ypm.js";
+import { uploadAttachment } from "./sdk-client-B4FMd_Fa.js";
+import { sleep } from "./sleep-CGBHjsj5.js";
 import { constants, promises, readlinkSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";
 import process from "node:process";

package/dist/{attachHandler-DQpK_pVa.js → attachHandler-DXZi2ILT.js}

@@ -1,12 +1,12 @@
-import { appendActualResult, createComment } from "./sdk-client-DYv-0CfA.js";
-import "./env-CdwyPHGV.js";
-import "./token-refresh-DeusLK8H.js";
-import "./resolve-token-7xb7kG7h.js";
-import "./workspace-store-CnrxyYRB.js";
-import "./resolve-workspace-CStHisUb.js";
-import { connect } from "./connect-BgQmrL_0.js";
-import "./sleep-BpJ39Ypm.js";
-import { TargetParseError, embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-BzLxue32.js";
+import { appendActualResult, createComment } from "./sdk-client-B4FMd_Fa.js";
+import "./env-CvjMSRd7.js";
+import "./token-refresh-CJB7Qlxy.js";
+import "./resolve-token-ByZq05Us.js";
+import "./workspace-store-Bmw104Qa.js";
+import "./resolve-workspace-BbK3uYQc.js";
+import { connect } from "./connect-DVjgyfls.js";
+import "./sleep-CGBHjsj5.js";
+import { TargetParseError, embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-BvBSevIx.js";
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 

package/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { COMPLETION_SHELLS } from "./completionHandler-O2G_WZLf.js";
+import { gatesInspectCommand } from "./inspect-B8tG9g0q.js";
 import { buildApplication, buildCommand, buildRouteMap, proposeCompletions, run, text_en } from "@stricli/core";
 import chalk from "chalk";
 import { existsSync, readFileSync } from "node:fs";
@@ -106,8 +107,8 @@ const mcpAddCommand = buildCommand({
 	docs: {
 		brief: "Add the Levr MCP server to installed AI clients",
 		fullDescription: `Detect MCP-capable clients on this machine (Claude Desktop,
-Claude Code, Cursor, Windsurf, Zed, VS Code, Gemini CLI, Codex CLI,
-Grok Build, Antigravity) and write the Levr MCP server into each one's config. The entry is credential-free — the client opens a browser to
+Claude Code, Codex CLI, Grok Build, Antigravity, Gemini CLI, Cursor, Windsurf,
+Zed, VS Code) and write the Levr MCP server into each one's config. The entry is credential-free — the client opens a browser to
 authorize with Levr the first time it connects.
 
 --scope decides where the entry lands:
@@ -115,8 +116,8 @@ authorize with Levr the first time it connects.
   project  this repository, shared with everyone who checks it out
   local    this repository, only you (Claude Code only)
 
-Not every client supports every scope — Claude Desktop, Windsurf, Codex CLI
-and Antigravity are user-only. A client you name with --client fails if it cannot honor the
+Not every client supports every scope — Claude Desktop and Windsurf are user-only.
+A client you name with --client fails if it cannot honor the
 scope you asked for; one picked up by --all or interactively falls back to
 the scope it does support, and the report says so.
 
@@ -136,12 +137,21 @@ Interactive by default; non-interactive when --all/--client/--yes is passed
 or when not running in a terminal (CI). Config edits preserve existing
 servers and comments, and re-running is a no-op.
 
+Tool pre-approval (opt-in): for a client whose permission file has a
+documented per-tool allow key (Claude Code, Cursor, Zed), the installer can
+add entries that let your agent call Levr's non-destructive tools without
+asking each time. It prints the exact file and every entry first, and asks
+(default No). Non-interactively it writes them only with --preapprove-tools.
+With --dry-run it prints what it would add and writes nothing. If a write
+asked for with --preapprove-tools fails, the command exits 1.
+
 Examples:
   npx @levr-one/cli@latest mcp add     # detect clients and pick interactively
   levr mcp add --all                   # set up every detected client
   levr mcp add --client cursor --yes
   levr mcp add --scope project         # commit the config to this repo
   levr mcp add --dry-run               # preview without writing
+  levr mcp add --client claude-code --yes --preapprove-tools
   levr mcp add --workspace acme        # pin the entry to one workspace
   levr mcp add --workspace beta --replace          # switch it to another
   levr mcp add --workspace beta --name levr-beta   # add a second, side by side
@@ -204,12 +214,17 @@ Examples:
 				kind: "boolean",
 				optional: true,
 				brief: "Switch an existing entry of this name to the new URL"
+			},
+			"preapprove-tools": {
+				kind: "boolean",
+				optional: true,
+				brief: "Non-interactive: also pre-approve Levr's non-destructive tools in the client's permission file"
 			}
 		},
 		aliases: { y: "yes" }
 	},
 	loader: async () => {
-		const { mcpAddHandler } = await import("./addHandler-B_3UmMbj.js");
+		const { mcpAddHandler } = await import("./addHandler-BIKNXipz.js");
 		return mcpAddHandler;
 	}
 });
@@ -258,7 +273,7 @@ Examples:
 		aliases: { d: "device-code" }
 	},
 	loader: async () => {
-		const { loginHandler } = await import("./loginHandler-DE0L1ehF.js");
+		const { loginHandler } = await import("./loginHandler-C9Oi92IY.js");
 		return loginHandler;
 	}
 });
@@ -277,7 +292,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { logoutHandler } = await import("./logoutHandler-S4TFYFwz.js");
+		const { logoutHandler } = await import("./logoutHandler-Cf5aI1wq.js");
 		return logoutHandler;
 	}
 });
@@ -297,7 +312,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { statusHandler } = await import("./statusHandler-BNiWlC7e.js");
+		const { statusHandler } = await import("./statusHandler-BQXn93-r.js");
 		return statusHandler;
 	}
 });
@@ -426,7 +441,7 @@ levr attach --manifest or later uploads.`
 		}
 	},
 	loader: async () => {
-		const { pushHandler } = await import("./pushHandler-DdNyVQ5t.js");
+		const { pushHandler } = await import("./pushHandler-CXFZt3SO.js");
 		return pushHandler;
 	}
 });
@@ -546,7 +561,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { importHandler } = await import("./importHandler-zw5GKb-S.js");
+		const { importHandler } = await import("./importHandler-uFdalKtw.js");
 		return importHandler;
 	}
 });
@@ -567,7 +582,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { listHandler } = await import("./listHandler-YA-0RkwS.js");
+		const { listHandler } = await import("./listHandler-BW92JLCl.js");
 		return listHandler;
 	}
 });
@@ -605,7 +620,7 @@ Examples:
 		flags: {}
 	},
 	loader: async () => {
-		const { selectHandler } = await import("./selectHandler-Cejme5nY.js");
+		const { selectHandler } = await import("./selectHandler-D6cvq60S.js");
 		return selectHandler;
 	}
 });
@@ -622,7 +637,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { currentHandler } = await import("./currentHandler-u89l068v.js");
+		const { currentHandler } = await import("./currentHandler-QhCywr3S.js");
 		return currentHandler;
 	}
 });
@@ -632,14 +647,21 @@ Examples:
 const gatesRunCommand = buildCommand({
 	docs: {
 		brief: "Run a deliverable's gate commands and report the raw results",
-		fullDescription: `Verify a deliverable's gates, run every local command EXACTLY as the
-server returned it (/bin/bash -c, from the current directory — run it from the
-repo root), and report the raw exit code and output tails so the server can
-derive each verdict.
-
-Each command is printed before it runs; use --dry-run to read them first. The
-server validates every local command before handing it out: a command that
-fails its check comes back as a verification error, never as a command to run.
+		fullDescription: `Verify a deliverable's gates, run every local command from the current
+directory (run it from the repo root), and report the raw exit code and output
+tails so the server can derive each verdict.
+
+File checks (inspect ops, printed as \`npx @levr-one/cli gates inspect '…'\`)
+run inside this CLI and spawn nothing. Every other command runs EXACTLY as the
+server returned it, in /bin/bash -c (or sh).
+
+Each command is printed before it runs; use --dry-run to read them first. A
+dry run runs nothing locally and shows, per command, where it would run
+(\`runs\`) and the server's approval (\`approval\`). It still calls the
+server's verify, which records state there. A \`confirm\` approval is not
+prompted for yet: the command runs. The server validates every local command
+before handing it out: a command that fails its check comes back as a
+verification error, never as a command to run.
 
 Guided gates are listed, not run: perform them and report what you observed
 with report_gate_results step_results[].
@@ -683,6 +705,11 @@ Examples:
 				kind: "boolean",
 				default: false,
 				brief: "Show detailed output"
+			},
+			ci: {
+				kind: "boolean",
+				default: false,
+				brief: "Declare this run is CI. On GitHub Actions, attach an OIDC token (audience levr:<workspace_id>); without one the server records the run as unverified"
 			}
 		},
 		aliases: {
@@ -691,7 +718,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { gatesRunHandler } = await import("./runHandler-BFDjtxbt.js");
+		const { gatesRunHandler } = await import("./runHandler-itaAVn4U.js");
 		return gatesRunHandler;
 	}
 });
@@ -804,7 +831,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { attachHandler } = await import("./attachHandler-DQpK_pVa.js");
+		const { attachHandler } = await import("./attachHandler-DXZi2ILT.js");
 		return attachHandler;
 	}
 });
@@ -880,14 +907,14 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { resultAppendHandler } = await import("./appendHandler-KVsJMxpX.js");
+		const { resultAppendHandler } = await import("./appendHandler-DtxLpPu6.js");
 		return resultAppendHandler;
 	}
 });
 
 //#endregion
 //#region package.json
-var version = "0.11.9";
+var version = "0.12.0";
 
 //#endregion
 //#region src/app.ts
@@ -908,7 +935,10 @@ const workspaceRoutes = buildRouteMap({
 	docs: { brief: "Manage workspace selection" }
 });
 const gatesRoutes = buildRouteMap({
-	routes: { run: gatesRunCommand },
+	routes: {
+		inspect: gatesInspectCommand,
+		run: gatesRunCommand
+	},
 	docs: { brief: "Run a deliverable's gates and report the raw results" }
 });
 const resultRoutes = buildRouteMap({

package/dist/{connect-BgQmrL_0.js → connect-DVjgyfls.js}

@@ -1,6 +1,6 @@
-import { client, configureClient } from "./sdk-client-DYv-0CfA.js";
-import { resolveToken } from "./resolve-token-7xb7kG7h.js";
-import { resolveWorkspace } from "./resolve-workspace-CStHisUb.js";
+import { client, configureClient } from "./sdk-client-B4FMd_Fa.js";
+import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import { resolveWorkspace } from "./resolve-workspace-BbK3uYQc.js";
 
 //#region src/utils/connect.ts
 /**

package/dist/{currentHandler-u89l068v.js → currentHandler-QhCywr3S.js}

@@ -1,4 +1,4 @@
-import { loadWorkspace } from "./workspace-store-CnrxyYRB.js";
+import { loadWorkspace } from "./workspace-store-Bmw104Qa.js";
 
 //#region src/commands/workspace/currentHandler.ts
 function currentHandler() {

package/dist/{find-workspace-T4xuXwtS.js → find-workspace-Bl4rfr73.js}

@@ -1,4 +1,4 @@
-import { getApiUrl } from "./env-CdwyPHGV.js";
+import { getApiUrl } from "./env-CvjMSRd7.js";
 
 //#region src/mcp/url.ts
 const KNOWN_MCP_URLS = {

package/dist/{importHandler-zw5GKb-S.js → importHandler-uFdalKtw.js}

@@ -1,9 +1,9 @@
-import { authGetProfileV1, client, configureClient } from "./sdk-client-DYv-0CfA.js";
-import { getApiUrl, getTeamId } from "./env-CdwyPHGV.js";
-import "./token-refresh-DeusLK8H.js";
-import { resolveToken } from "./resolve-token-7xb7kG7h.js";
-import "./workspace-store-CnrxyYRB.js";
-import { resolveWorkspace } from "./resolve-workspace-CStHisUb.js";
+import { authGetProfileV1, client, configureClient } from "./sdk-client-B4FMd_Fa.js";
+import { getApiUrl, getTeamId } from "./env-CvjMSRd7.js";
+import "./token-refresh-CJB7Qlxy.js";
+import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import "./workspace-store-Bmw104Qa.js";
+import { resolveWorkspace } from "./resolve-workspace-BbK3uYQc.js";
 import chalk from "chalk";
 import { createReadStream } from "node:fs";
 import { basename } from "node:path";