@nexusclawhq/cli 0.2.4 → 0.3.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.3.2 - 2026-07-25
+
+- Refresh vendored `@nexusclaw/shared` runtime dependency to pick up new locale keys (`assistantIdentityBanner`, `independentIdentityBanner`, `assistantIdentityEditorHint`, `assistantPermissionNotice`, `assistantAccessNotice`, `assistantAudienceNotice`) added by the agent identity-kind (独立员工 vs 助理) UI work. No CLI source changes; the CLI never reads these keys — they are a transitive artifact of vendoring the latest shared dist. CLI runtime behavior is unchanged. Rebuild produces a new content hash for the vendored bundle.
+
+## 0.3.1 - 2026-07-24
+
+- Fix `nexus workforce test-case results`, `nexus workforce observe executions list/detail/steps/tool-calls`, and the `dispatchAgentTask`/`testAgentRun` mutations: their GraphQL queries drifted from the backend's emitted schema and failed with `GRAPHQL_VALIDATION_FAILED` on every call. Aligned field selections and variable types with the current schema — `AgentTestResult` (`score`→`scores`, `latencyMs`→`durationMs`, `errorMessage`→`failureReason`; added `output`/`assertionResults`/`executionId` so assertion-level failure detail is readable), `AgentExecution` (dropped non-selectable `traceId`/`correlationId`/`actorType`/`actorId`/`intentSummary`/`errorMessage`; fixed `$workspaceId: ID!` and `$actorId: String`; selects real `intent`/`outputSummary`/`durationMs`/`cost`/`tokens`), `ReactStep` (`stepType`→`actionType`, `thought`→`thoughtReasoning`/`Plan`/`Confidence`, `observation`→`observationSuccess`/`Output`/`Error`), and `ToolCallRecord` (`arguments`→`input`, `result`→`output`). No behavior change; all command handlers are field-agnostic pass-throughs.
+
+## 0.3.0 - 2026-07-24
+
+- Add `nexus workforce *` — a full AI-workforce training/governance command plane (18 sub-groups, 111 commands) that drives the digital-employee lifecycle from the CLI without the UI: learning loops (A + B), cognition mutate, config writes (constitution / prompt / guardrail / knowledge / provider / permission), eval, ops, orchestration, and observation. Every command is a thin authenticated GraphQL client over existing backend mutations; no write path bypasses the release gate or `BehaviorLearningCaptureService`.
+- Add transparent step-up (MFA) bootstrap: step-up-gated mutations (provider CUD, etc.) auto-extract the `STEP_UP_REQUIRED` challenge, complete `POST /mfa/step-up/verify`, and retry with the `x-step-up-token` header. New `nexus org step-up` command lists factors and issues a token explicitly.
+- Add `getCurrentUser` GraphQL wrapper so `dispatchAgentTask` resolves the caller's own userId (backend enforces `userId === caller`).
+- Register all 111 workforce commands in the machine-contract registry with four new permission profiles (`WORKFORCE_READ` / `WORKFORCE_EXECUTE` / `WORKFORCE_WRITE` / `WORKFORCE_PUBLISH`), exempt from `requiresCanDevelop` since they are a training/governance plane, not a code-authoring surface. Requires `@nexusclaw/shared` ≥ 0.1.1.
+
 ## 0.2.4 - 2026-07-22
 
 - Keep the active `org login-web` callback listener alive when a stale browser tab, favicon, empty callback, missing state, or mismatched state reaches `localhost:1717`; all such requests remain fail-closed and cannot exchange a code or save credentials.

package/README.md

@@ -11,3 +11,8 @@ nexus org login-web --instance-url https://your-nexusclaw.example --alias dev
 Remote DX commands resolve one fail-closed target from `--workspace-id`, `--target-org`, the selected environment descriptor, and the authenticated org credential. `defaultOrg` is always an org alias and is never sent as a workspace ID.
 
 Node.js 18 or newer is required. Credentials are encrypted under `~/.nexusclaw` by default; set `NEXUS_CLI_HOME` to use an isolated credential directory in CI.
+
+## AI workforce training & governance (`workforce`)
+
+`nexus workforce *` drives the full digital-employee lifecycle from the CLI without the UI — learning loops, cognition, config writes, eval, ops, orchestration, and observation. See [`docs/workforce-cli.md`](./docs/workforce-cli.md) for the command reference, the step-up (MFA) bootstrap, known non-implemented items (skills / distill-run), and the governance-contract registration gap.
+

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "packageName": "@nexusclawhq/cli",
-  "version": "0.2.4",
-  "gitSha": "da1cda290e8b0eba66ca67e7bbbb8c3ed9c65459",
-  "ciRunId": "29906105167",
-  "contentDigest": "sha256:d1c318cccd80df10d66492226e67fcccddd47a929c735f1df005d49f3e88ec5a",
-  "generatedAt": "2026-07-22T09:05:05.770Z"
+  "version": "0.3.2",
+  "gitSha": "99bf77ed985fb215f9868c11870abeb474941b26",
+  "ciRunId": null,
+  "contentDigest": "sha256:6bc1c3e5c93d4070ff5a9c391e059242c226882425f0cc10283e467394ef0fb6",
+  "generatedAt": "2026-07-25T03:54:35.498Z"
 }

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/cli-contract.types.d.ts

@@ -42,7 +42,7 @@ export interface CliPermissionRuleV1 {
     }>;
 }
 /** Exact permission profile enum (design §16.1). */
-export type CliPermissionProfileId = 'LOCAL' | 'CONTEXT_READ' | 'BUNDLE_READ' | 'CANDIDATE_TEST' | 'BUNDLE_STAGE' | 'BUNDLE_GATE' | 'BUNDLE_PROMOTE' | 'BUNDLE_REVOKE';
+export type CliPermissionProfileId = 'LOCAL' | 'CONTEXT_READ' | 'BUNDLE_READ' | 'CANDIDATE_TEST' | 'BUNDLE_STAGE' | 'BUNDLE_GATE' | 'BUNDLE_PROMOTE' | 'BUNDLE_REVOKE' | 'WORKFORCE_READ' | 'WORKFORCE_EXECUTE' | 'WORKFORCE_WRITE' | 'WORKFORCE_PUBLISH';
 /** Exact effect enum; `['none']` cannot coexist with another effect. */
 export type CliEffectKind = 'none' | 'local_write' | 'remote_read' | 'remote_compute' | 'remote_write' | 'promote';
 export interface CliArgumentContract {

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/ai-employee-cognition/cognitive-policy.types.d.ts

@@ -105,9 +105,27 @@ export interface MemoryPolicyV1 {
     allowLegacyReadThrough: boolean;
     restrictedSensitivityRequiresHuman: true;
 }
+/**
+ * The four autonomy modes an AI employee's proactive policy may declare.
+ *
+ * - `A0_disabled` — no proactive behavior (also the only legal value for a
+ *   legacy agent with no success contract, and for any candidate whose
+ *   cognitive policy has not yet been promoted to the active release head).
+ * - `A1_recommend` / `A2_confirm` — P0 proactive reach.
+ * - `A3_bounded_execute` — P0+ only; runtime feature gate must reject it
+ *   until Phase 12 release-gate evidence is complete.
+ *
+ * This alias is the single source of truth shared by `ProactivePolicyV1.mode`
+ * and by the cognitive-policy read model's `effectiveAutonomy` projection.
+ * The read model derives `effectiveAutonomy` from the release-head-pinned
+ * AgentVersion's `proactivePolicy.mode`; it is never a second activation path
+ * (design.md §3.2 / §11.3: autonomy activates only with the full workforce
+ * release head CAS).
+ */
+export type EffectiveAutonomyV1 = 'A0_disabled' | 'A1_recommend' | 'A2_confirm' | 'A3_bounded_execute';
 export interface ProactivePolicyV1 {
     schemaVersion: 'proactive-policy/v1';
-    mode: 'A0_disabled' | 'A1_recommend' | 'A2_confirm' | 'A3_bounded_execute';
+    mode: EffectiveAutonomyV1;
     allowedWakeSources: ProactiveWakeSignalV1['source'][];
     actionAllowlist: Array<{
         kind: 'tool';

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/employee-package/types.d.ts

@@ -89,6 +89,13 @@ export interface PackageModelConfig {
     tier: 1 | 2 | 3;
     temperature: number;
     maxTokens: number;
+    /**
+     * Cumulative token budget for the WHOLE agent execution (input+output across
+     * all ReAct iterations). Distinct from `maxTokens` (per-call output cap).
+     * When unset, `ContextBuilderService` falls back to its 16k default
+     * (`context-builder.service.ts` `calculateConstraints`).
+     */
+    maxTokensPerExecution?: number;
     responseFormat: 'text' | 'json';
     inputCostPer1k?: number;
     outputCostPer1k?: number;