@mosse-ai/cli 0.1.3 → 0.1.4

package/dist/index.js

@@ -48,6 +48,9 @@ var exact = {
   "/v1/my/scope-overview": ["GET"],
   "/v1/my/keychain/overview": ["GET"],
   "/v1/connections": ["GET", "POST"],
+  "/v1/github/app/install": ["POST"],
+  "/v1/github/app/bind/start": ["POST"],
+  "/v1/github/app/installations": ["GET"],
   "/v1/connections-maintained": ["GET"],
   "/v1/my/keychain/drops": ["POST"],
   "/v1/my/connectors/oauth/status": ["GET"],
@@ -189,6 +192,36 @@ var patterns = [
     methods: ["GET", "DELETE"],
     sample: "/v1/my/scope-skills/sk-1"
   },
+  {
+    pattern: /^\/v1\/github\/app\/installations\/[A-Za-z0-9_-]+$/,
+    methods: ["DELETE"],
+    sample: "/v1/github/app/installations/c-1"
+  },
+  {
+    pattern: /^\/v1\/github\/app\/repositories\/[A-Za-z0-9_-]+\/branches$/,
+    methods: ["GET"],
+    sample: "/v1/github/app/repositories/r-1/branches"
+  },
+  {
+    pattern: /^\/v1\/github\/app\/repositories\/[A-Za-z0-9_-]+\/policy$/,
+    methods: ["PUT"],
+    sample: "/v1/github/app/repositories/r-1/policy"
+  },
+  {
+    pattern: /^\/v1\/github\/app\/repositories\/[A-Za-z0-9_-]+\/grants$/,
+    methods: ["PUT"],
+    sample: "/v1/github/app/repositories/r-1/grants"
+  },
+  {
+    pattern: /^\/v1\/github\/app\/installations\/[A-Za-z0-9_-]+\/repositories$/,
+    methods: ["GET"],
+    sample: "/v1/github/app/installations/c-1/repositories"
+  },
+  {
+    pattern: /^\/v1\/github\/app\/installations\/[A-Za-z0-9_-]+\/refresh$/,
+    methods: ["POST"],
+    sample: "/v1/github/app/installations/c-1/refresh"
+  },
   {
     pattern: /^\/v1\/connections\/[A-Za-z0-9_-]+\/rotate$/,
     methods: ["POST"],
@@ -21264,7 +21297,7 @@ function actionOf(id) {
   return id.slice(id.indexOf(".") + 1);
 }
 function patScopeOf(spec) {
-  return `${domainOf(spec.id)}:${spec.effect === "read" ? "read" : "write"}`;
+  return spec.patScope ?? `${domainOf(spec.id)}:${spec.effect === "read" ? "read" : "write"}`;
 }
 function mcpToolNameOf(spec) {
   return spec.mcpName ?? spec.id.replace(".", "_");
@@ -21308,6 +21341,14 @@ function registryProblems(specs) {
     if (mcpNames.has(mcp))
       problems6.push(`${s.id}: duplicate MCP tool name ${mcp}`);
     mcpNames.add(mcp);
+    if (s.patScope) {
+      if (!s.patScope.startsWith(`${domainOf(s.id)}:`))
+        problems6.push(`${s.id}: patScope ${s.patScope} must stay in domain ${domainOf(s.id)}`);
+      if (!/^[a-z]+:(read|write|admin)$/.test(s.patScope))
+        problems6.push(`${s.id}: invalid patScope ${s.patScope}`);
+      if (s.effect === "read" && s.patScope !== `${domainOf(s.id)}:read`)
+        problems6.push(`${s.id}: read capabilities cannot use patScope ${s.patScope}`);
+    }
     if (s.principals && s.principals.length < 2 && !s.reason)
       problems6.push(`${s.id}: narrowed principals need a reason`);
     if (s.runScoped && (s.principals?.length !== 1 || s.principals[0] !== "agent"))
@@ -22390,6 +22431,7 @@ var KnowledgePurgeKb = defineCapability({
   summary: "Permanently delete an archived knowledge base with its documents and sharing. This cannot be undone. For in-product agents: this always asks the person you are talking with to confirm.",
   input: external_exports.strictObject({ kbId }),
   effect: "destructive",
+  patScope: "knowledge:admin",
   external: true,
   highRisk: "always"
 });
@@ -22398,6 +22440,7 @@ var KnowledgeGrantKb = defineCapability({
   summary: "Share a knowledge base with a person's personal scope or a channel, for reading or writing. Takes effect immediately; setting it again changes the permission.",
   input: external_exports.strictObject({ kbId, granteeScopeId: scopeId, permission: external_exports.enum(["read", "write"]) }),
   effect: "write",
+  patScope: "knowledge:admin",
   external: true,
   highRisk: "always",
   idempotent: true
@@ -22415,6 +22458,7 @@ var KnowledgeAddManager = defineCapability({
   summary: "Make a person a manager of a shared knowledge base you created. Managers can add files, share it and change its settings; only the creator can add or remove managers, archive or delete it. For in-product agents: this always asks the person you are talking with to confirm.",
   input: external_exports.strictObject({ kbId, userId: external_exports.uuid() }),
   effect: "write",
+  patScope: "knowledge:admin",
   external: true,
   highRisk: "always",
   idempotent: true
@@ -22424,6 +22468,7 @@ var KnowledgeRemoveManager = defineCapability({
   summary: "Stop a person managing a shared knowledge base you created. For in-product agents: this always asks the person you are talking with to confirm.",
   input: external_exports.strictObject({ kbId, userId: external_exports.uuid() }),
   effect: "write",
+  patScope: "knowledge:admin",
   external: true,
   highRisk: "always",
   idempotent: true
@@ -22433,6 +22478,7 @@ var KnowledgeRevokeKb = defineCapability({
   summary: "Stop sharing a knowledge base with a scope. The one it was shared with (yourself, or a channel you manage) can also use this to leave it.",
   input: external_exports.strictObject({ kbId, granteeScopeId: scopeId }),
   effect: "write",
+  patScope: "knowledge:admin",
   external: true,
   highRisk: "always",
   idempotent: true
@@ -22495,6 +22541,7 @@ var KnowledgeSetModels = defineCapability({
     confirmKeyHandoff: external_exports.boolean().optional()
   }),
   effect: "write",
+  patScope: "knowledge:admin",
   external: true,
   highRisk: "always",
   idempotent: true
@@ -23283,7 +23330,7 @@ function buildCommandTree(options = {}) {
 }
 
 // src/api.ts
-var CLI_VERSION = true ? "0.1.3" : "0.0.0";
+var CLI_VERSION = true ? "0.1.4" : "0.0.0";
 var CLI_USER_AGENT = `mosse-cli/${CLI_VERSION}`;
 async function callApi(request) {
   const headers = {
@@ -24154,7 +24201,13 @@ var HTTP_ERROR_HINTS = [
     /can't depend on itself/i,
     "dependsOn \u7528\u300C\u6279\u5185\u4E0B\u6807\u300D(0 = \u6279\u91CC\u7B2C\u4E00\u4E2A\u4EFB\u52A1),\u4E0D\u662F\u4EFB\u52A1 id;\u4E24\u4E2A\u5DF2\u6709\u4EFB\u52A1\u4E4B\u95F4\u7528 board task dependency-add\u3002"
   ],
-  [/invalid arguments/i, "\u5165\u53C2\u5F62\u72B6\u4E0D\u5BF9:\u770B\u8BE5\u547D\u4EE4\u7684 --help \u793A\u4F8B;\u6570\u7EC4/\u5BF9\u8C61\u53C2\u6570\u53EF\u4EE5\u5199\u6210 --tasks @file(\u6587\u4EF6\u91CC\u653E JSON)\u3002"]
+  [/invalid arguments/i, "\u5165\u53C2\u5F62\u72B6\u4E0D\u5BF9:\u770B\u8BE5\u547D\u4EE4\u7684 --help \u793A\u4F8B;\u6570\u7EC4/\u5BF9\u8C61\u53C2\u6570\u53EF\u4EE5\u5199\u6210 --tasks @file(\u6587\u4EF6\u91CC\u653E JSON)\u3002"],
+  [
+    /lacks the `?[a-z]+:(read|write|admin)`? permission/i,
+    "\u4EE4\u724C\u7F3A\u8FD9\u4E2A\u6743\u9650\u6863:\u53BB Settings \u2192 Agent access \u65B0\u5EFA\u4E00\u4E2A\u5E26\u8BE5\u6863\u7684\u4EE4\u724C(\u4EE4\u724C\u7684\u6863\u4F4D\u4E0D\u4F1A\u968F\u89D2\u8272\u53D8\u5316)\u3002"
+  ],
+  [/invalid, expired or revoked/i, "\u91CD\u65B0\u767B\u5F55:mosse auth login;\u6216\u6362\u4E00\u628A MOSSE_TOKEN\u3002"],
+  [/not a member of workspace/i, "\u4F60\u4E0D\u5728\u8FD9\u4E2A workspace(\u6216\u88AB\u79FB\u9664):\u8BA9\u7BA1\u7406\u5458\u52A0\u56DE,\u6216\u6362\u4E00\u4E2A --workspace\u3002"]
 ];
 function withHttpHint(message) {
   for (const [pattern, hint] of HTTP_ERROR_HINTS) if (pattern.test(message)) return `${message}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mosse-ai/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "bin": {
     "mosse": "./dist/index.js"
@@ -16,8 +16,8 @@
     "typescript": "^5.7.3",
     "esbuild": "^0.25.0",
     "get-east-asian-width": "1.7.0",
-    "@mosse/contract": "0.0.0",
-    "@mosse/tool-surface": "0.0.0"
+    "@mosse/tool-surface": "0.0.0",
+    "@mosse/contract": "0.0.0"
   },
   "description": "Mosse command-line client: boards, tasks, knowledge search, and agent-friendly device login.",
   "license": "UNLICENSED",