@mutagent/cli 0.2.132 → 0.2.133

package/dist/bin/cli.js

@@ -455,7 +455,7 @@ function sandboxScopedFailure(failure, commandPath) {
     return failure;
   const command = commandPath === "" ? "This command" : `\`mutagent ${commandPath}\``;
   const alternative = SANDBOX_ALTERNATIVES[commandPath.split(" ")[0] ?? ""];
-  return new MutagentError("SANDBOX_SCOPE", `${command} isn't available inside a cloud session: this session is signed in with its own session token, which covers the Factory, traces, pushing and updating reports, and this session.`, alternative === undefined ? "Inside this session use the Factory and traces commands, or reports push and reports update (mutagent --help lists them)." : `Run: ${alternative}`);
+  return new MutagentError("SANDBOX_SCOPE", `${command} isn't available inside a cloud session: this session is signed in with its own session token, which covers the Factory, traces, pushing, updating, listing and showing reports, and this session.`, alternative === undefined ? "Inside this session use the Factory and traces commands, or reports push, reports update, reports list or reports show (mutagent --help lists them)." : `Run: ${alternative}`);
 }
 var SANDBOX_TOKEN_VAR2 = "MUTAGENT_SANDBOX_TOKEN", SANDBOX_ALTERNATIVES;
 var init_sandbox_scope_error = __esm(() => {
@@ -21893,7 +21893,7 @@ skill never inlines flags. The active surface:
 | \`factory\` | Register entries from their agentspec; list, show, archive | [workflows/factory-register.md](./workflows/factory-register.md) |
 | \`factory spec\` | Spec versions: status, push, get, versions | [workflows/factory-spec-sync.md](./workflows/factory-spec-sync.md) |
 | \`factory stage\` | Stage runs: start, finish, record, list, show | [workflows/factory-stages.md](./workflows/factory-stages.md) |
-| \`reports\` | Push a run's report (with its stage run and build), update, review | [workflows/factory-stages.md](./workflows/factory-stages.md) |
+| \`reports\` | Push a run's report (with its stage run and build), update, list, show, review | [workflows/factory-stages.md](./workflows/factory-stages.md) |
 | \`traces\` | Read sessions, traces, logs and transcripts by session id | [workflows/traces.md](./workflows/traces.md) |
 
 ---
@@ -22067,6 +22067,9 @@ with no run id, and \`mutagent reports push <run-dir> --json\` with no
 \`--stage-run\`: the server attaches the report to the session's open run, with its
 entry, spec version and build (the checkout's HEAD). A report's run id comes from
 \`--run-id\`, else the report's own render input (its \`runId\`).
+The same token reads this workspace's reports: \`mutagent reports list --json\` and
+\`mutagent reports show <id> --json\` work in a sandbox with no key. Review and
+retract need a signed-in key and fail with \`SANDBOX_SCOPE\` in a sandbox.
 
 Locally none of this exists: pass the entry id, the run id and the build
 (\`--build-target\`, \`--build-rev\`) explicitly. A command that needs one and gets
@@ -34066,7 +34069,7 @@ init_sdk_debug();
 var SDK_TRANSPORT_ERRORS3 = new Set(["ConnectionError", "RequestTimeoutError", "RequestAbortedError", "UnexpectedClientError"]);
 var SDK_SCHEMA_ERRORS2 = new Set(["SDKValidationError", "ResponseValidationError"]);
 function notSignedIn(inBox) {
-  return inBox ? new MutagentError("SANDBOX_SCOPE", "Only `mutagent reports push` and `reports update` work with this session's token; reading reports isn't available inside a cloud session.", "Inside this session, write reports with mutagent reports push or mutagent reports update.") : new MutagentError("AUTH_REQUIRED", "Not signed in.", "Run: mutagent login");
+  return inBox ? new MutagentError("SANDBOX_SCOPE", "This session's token covers `mutagent reports push`, `update`, `list` and `show` only; this command isn't available inside a cloud session.", "Run: mutagent reports list") : new MutagentError("AUTH_REQUIRED", "Not signed in.", "Run: mutagent login");
 }
 function parseBody3(body) {
   try {
@@ -34261,13 +34264,15 @@ Examples:
   ${chalk53.dim("$")} mutagent reports list --cursor <nextCursor> --json
 
 Filters combine with AND. A page ends with nextCursor; pass it as --cursor for the next.
+Inside a sandbox with no API key, the sandbox's MUTAGENT_SANDBOX_TOKEN lists its own
+workspace's reports.
 
 AI Agent Directive:
   --json returns { reports, count, nextCursor }. nextCursor null is the last page.
   Reading is free: run it before any review or retract.
 `).action(async (options, command) => {
     await runReportsAction(command, async (isJson) => {
-      const conn = await connectReports({ sandboxBearer: false });
+      const conn = await connectReports({ sandboxBearer: true });
       const page = await conn.call((r) => r.listReports({
         ...options.subject === undefined ? {} : { subject: options.subject },
         ...options.kind === undefined ? {} : { kind: options.kind },
@@ -34296,6 +34301,8 @@ Examples:
   ${chalk53.dim("$")} mutagent reports show rep_123 --html report.html --json
 
 The HTML is never printed; it is served as a file under a sandboxing CSP.
+Inside a sandbox with no API key, the sandbox's MUTAGENT_SANDBOX_TOKEN reads reports of
+its own workspace; any other id is REPORT_NOT_FOUND.
 
 AI Agent Directive:
   --json returns { report, sessionRef, harnessSessionId, specVersion, buildRef, renderInput,
@@ -34303,7 +34310,7 @@ AI Agent Directive:
   Helix itself used (null when not known); sessionRef is the hs1_ reference. An unknown id is REPORT_NOT_FOUND, exit 1.
 `).action(async (id, options, command) => {
     await runReportsAction(command, async (isJson) => {
-      const conn = await connectReports({ sandboxBearer: false });
+      const conn = await connectReports({ sandboxBearer: true });
       const detail = await conn.call((r) => r.getReport({ id }));
       let htmlFile;
       if (options.html !== undefined) {
@@ -40620,4 +40627,4 @@ if (process.env.CLI_VERSION) {
 }
 runCli(process.argv.slice(2), cliVersion);
 
-//# debugId=8D7F27126F75763C64756E2164756E21
+//# debugId=CDD020584ED3A16264756E2164756E21

package/dist/index.js

@@ -454,7 +454,7 @@ function sandboxScopedFailure(failure, commandPath) {
     return failure;
   const command = commandPath === "" ? "This command" : `\`mutagent ${commandPath}\``;
   const alternative = SANDBOX_ALTERNATIVES[commandPath.split(" ")[0] ?? ""];
-  return new MutagentError("SANDBOX_SCOPE", `${command} isn't available inside a cloud session: this session is signed in with its own session token, which covers the Factory, traces, pushing and updating reports, and this session.`, alternative === undefined ? "Inside this session use the Factory and traces commands, or reports push and reports update (mutagent --help lists them)." : `Run: ${alternative}`);
+  return new MutagentError("SANDBOX_SCOPE", `${command} isn't available inside a cloud session: this session is signed in with its own session token, which covers the Factory, traces, pushing, updating, listing and showing reports, and this session.`, alternative === undefined ? "Inside this session use the Factory and traces commands, or reports push, reports update, reports list or reports show (mutagent --help lists them)." : `Run: ${alternative}`);
 }
 var SANDBOX_TOKEN_VAR2 = "MUTAGENT_SANDBOX_TOKEN", SANDBOX_ALTERNATIVES;
 var init_sandbox_scope_error = __esm(() => {
@@ -2088,4 +2088,4 @@ export {
   version
 };
 
-//# debugId=2497007B7285F9A164756E2164756E21
+//# debugId=844723769E2CA5CA64756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutagent/cli",
-  "version": "0.2.132",
+  "version": "0.2.133",
   "description": "Bun-native CLI for the MutagenT AI platform - auth, provider config, and lifecycle-tool installer for AI-native workflows",
   "type": "module",
   "bin": {