@neta-art/cohub-cli 6.0.1 → 6.1.1

package/README.md

@@ -297,7 +297,7 @@ cohub works resolve <workSlug> --owner <username> --space-slug <spaceSlug>
 Use `--json` for machine-readable output. `works get`, `works stats`, and `works download` also accept `cohub://works/<username>/<space>/<work>` mention URIs. `works stats` reports total, 24-hour, 7-day, and 30-day views with a source breakdown. Download restores newly published file and directory artifacts directly from the CDN with checksum verification. HTML files with companion assets are restored as directory bundles; Board and port Works are not downloadable. The resolve command remains available for explicit slug-based lookup.
 
 Realtime rooms use a published Work's runtime identity, so they are available
-through `client.work.realtime` in the SDK rather than as CLI commands.
+through `client.app.realtime` in the SDK rather than as CLI commands.
 
 ## Drive the Cohub UI
 
@@ -305,12 +305,12 @@ Show a file or Work preview in the Cohub tab that started the current work, and
 methods the Work exposes.
 
 ```bash
-cohub ui preview <workId|url|cohub://works/...|username/space/work|file://path>
-cohub ui preview file://src/main.ts
-cohub ui preview work://alice/studio/launch
-cohub ui preview <work-or-file> --call selection.get
-cohub ui preview <work> --call board.focus --data '{"nodeId":"n1"}'
-cohub ui preview <work> --call report.build --input payload.json --json
+cohub desktop open <workId|url|cohub://works/...|username/space/work|file://path>
+cohub desktop open file://src/main.ts
+cohub desktop open work://alice/studio/launch
+cohub desktop open <work-or-file> --call selection.get
+cohub desktop open <work> --call board.focus --data '{"nodeId":"n1"}'
+cohub desktop open <work> --call report.build --input payload.json --json
 ```
 
 `ui preview` accepts `file://` Space-relative paths, `work://` Work references, and
@@ -323,7 +323,7 @@ and waits for the Work to complete the same UI command with `client.ui.reportRes
 Work authors decide what is callable by registering handlers inside the Work:
 
 ```ts
-client.work.surface.handle("image.open", async (input, { commandId }) => {
+client.app.surface.handle("image.open", async (input, { commandId }) => {
   openImageStudio(input, commandId);
 });
 ```

package/dist/commands/apps.js

@@ -267,8 +267,8 @@ export function registerApps(program) {
         .option("--disabled", "Create as disabled")
         .option("--status <status>", "App status: published, disabled")
         .option("--visibility <visibility>", "App visibility: public, space")
-        .option("--app-scope <scope>", "Scope granted to the app runtime (space.view, session.view, file.view, taskrun.view)", collectOption, [])
-        .option("--viewer-scope <scope>", "Scope viewers may request (taskrun.view, session.prompt.readonly, session.prompt.fullaccess, generation.create, user.space.list, user.session.list, user.usage.read)", collectOption, [])
+        .option("--app-scope <scope>", "Scope granted directly to the app runtime (space.view, session.view, file.view, file.edit, taskrun.view, session.prompt.readonly, session.prompt.fullaccess, command.execute)", collectOption, [])
+        .option("--viewer-scope <scope>", "Deprecated: viewer grants are no longer gated by the app configuration", collectOption, [])
         .option("--meta <json>", "App metadata as a JSON object")
         .option("--hide-cohub-bar", "Hide the Cohub footer bar on the public app page")
         .option("--show-cohub-bar", "Show the Cohub footer bar on the public app page")
@@ -346,8 +346,8 @@ export function registerApps(program) {
         .option("--disabled", "Set status to disabled")
         .option("--status <status>", "App status: published, disabled")
         .option("--visibility <visibility>", "App visibility: public, space")
-        .option("--app-scope <scope>", "Scope granted to the app runtime (space.view, session.view, file.view, taskrun.view)", collectOption, [])
-        .option("--viewer-scope <scope>", "Scope viewers may request (taskrun.view, session.prompt.readonly, session.prompt.fullaccess, generation.create, user.space.list, user.session.list, user.usage.read)", collectOption, [])
+        .option("--app-scope <scope>", "Scope granted directly to the app runtime (space.view, session.view, file.view, file.edit, taskrun.view, session.prompt.readonly, session.prompt.fullaccess, command.execute)", collectOption, [])
+        .option("--viewer-scope <scope>", "Deprecated: viewer grants are no longer gated by the app configuration", collectOption, [])
         .option("--clear-app-scopes", "Clear app runtime scopes")
         .option("--clear-viewer-scopes", "Clear viewer-requestable scopes")
         .option("--meta <json>", "App metadata as a JSON object")
@@ -548,6 +548,66 @@ export function registerApps(program) {
         }
     });
     registerAppCommerce(appsCmd);
+    // ── Viewer grants ─────────────────────────────────────────────────────────
+    appsCmd
+        .command("authorize <app>")
+        .description("Grant an app scopes as the current user")
+        .requiredOption("--scope <scope>", "Scope to grant (repeatable)", collectOption, [])
+        .option("--space <spaceId>", "Target space; defaults to the app's own space")
+        .option("--json", "Output as JSON")
+        .action(async (appRef, opts) => {
+        const client = createClient();
+        try {
+            const detail = await getAppByRef(client, appRef);
+            const result = await client.apps.authorize(detail.app.id, {
+                scopes: opts.scope,
+                ...(opts.space ? { spaceId: opts.space } : {}),
+            });
+            if (jsonRequested(opts))
+                return outJson(result);
+            ok(`Granted ${result.grant.scopes.join(", ")} on space ${result.grant.spaceId}`);
+        }
+        catch (e) {
+            handleHttp(e);
+        }
+    });
+    appsCmd
+        .command("grants <app>")
+        .description("List your grants for an app")
+        .option("--json", "Output as JSON")
+        .action(async (appRef, opts) => {
+        const client = createClient();
+        try {
+            const detail = await getAppByRef(client, appRef);
+            const result = await client.apps.listMyGrants(detail.app.id);
+            if (jsonRequested(opts))
+                return outJson(result);
+            table(result.grants, [
+                { key: "id", label: "ID" },
+                { key: "spaceId", label: "Space" },
+                { key: "scopes", label: "Scopes" },
+                { key: "expiresAt", label: "Expires" },
+                { key: "revokedAt", label: "Revoked" },
+            ]);
+        }
+        catch (e) {
+            handleHttp(e);
+        }
+    });
+    appsCmd
+        .command("revoke <app> <grantId>")
+        .description("Revoke one of your grants for an app")
+        .action(async (appRef, grantId) => {
+        const client = createClient();
+        try {
+            const detail = await getAppByRef(client, appRef);
+            await client.apps.revokeMyGrant(detail.app.id, grantId);
+            ok("Grant revoked");
+        }
+        catch (e) {
+            handleHttp(e);
+        }
+    });
     appsCmd
         .command("rm <id>")
         .alias("delete")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub-cli",
-  "version": "6.0.1",
+  "version": "6.1.1",
   "description": "CLI for Cohub — spaces, sessions, and agent collaboration.",
   "type": "module",
   "license": "Apache-2.0",
@@ -19,7 +19,7 @@
     "commander": "^15.0.0",
     "pixi.js": "^8.19.0",
     "sharp": "^0.35.3",
-    "@neta-art/cohub": "8.0.1"
+    "@neta-art/cohub": "8.2.0"
   },
   "publishConfig": {
     "access": "public"