@openwop/cli 1.6.0 → 1.8.0

package/README.md

@@ -498,7 +498,7 @@ The `goals` group drives the host's standing goals — an objective the host pur
 openwop goals list --state active                      # the goal list (also satisfied | escalated | bound-exceeded | paused)
 openwop goals get goal_123 --json                      # inspect (objective, judge, continuation, bounds, iterations)
 openwop goals create --objective "Keep the triage backlog under 20" \
-  --judge verifier --continuation schedule --max-iterations 50 --max-cost 5.00 --timeout-ms 600000
+  --verifier-ref <ref> --continuation schedule --max-iterations 50 --max-cost 5.00 --timeout-ms 600000
 openwop goals pause goal_123                            # suspend continuation (resume to restart)
 openwop goals abandon goal_123 --yes                   # close the goal
 ```

package/dist/cli.js

@@ -578,7 +578,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.6.0",
+  version: "1.8.0",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -855,21 +855,31 @@ function mergeConfig(existing, next) {
 function getByPath(obj, path) {
   return path.split(".").reduce((acc, key) => acc == null ? acc : acc[key], obj);
 }
-function setByPath(obj, path, value) {
+var UNSAFE_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function safePathParts(path) {
   const parts = path.split(".");
+  for (const part of parts) {
+    if (UNSAFE_PATH_SEGMENTS.has(part)) throw new CliError(`Config key segment '${part}' is not allowed: ${path}`);
+  }
+  return parts;
+}
+function setByPath(obj, path, value) {
+  const parts = safePathParts(path);
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    if (typeof cur[parts[i]] !== "object" || cur[parts[i]] === null) cur[parts[i]] = {};
-    cur = cur[parts[i]];
+    const key = parts[i];
+    if (!Object.hasOwn(cur, key) || typeof cur[key] !== "object" || cur[key] === null) cur[key] = {};
+    cur = cur[key];
   }
   cur[parts[parts.length - 1]] = value;
 }
 function unsetByPath(obj, path) {
-  const parts = path.split(".");
+  const parts = safePathParts(path);
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    if (typeof cur[parts[i]] !== "object" || cur[parts[i]] === null) return;
-    cur = cur[parts[i]];
+    const key = parts[i];
+    if (!Object.hasOwn(cur, key) || typeof cur[key] !== "object" || cur[key] === null) return;
+    cur = cur[key];
   }
   delete cur[parts[parts.length - 1]];
 }
@@ -1096,12 +1106,22 @@ function decodeSegment(segment) {
     return segment;
   }
 }
+function splitRunSegment(bare) {
+  const PREFIX = "/runs/";
+  if (!bare.startsWith(PREFIX)) return null;
+  let end = PREFIX.length;
+  while (end < bare.length && bare[end] !== "/" && bare[end] !== ":") end++;
+  if (end === PREFIX.length) return null;
+  const rest = bare.slice(end);
+  if (/[\n\r\u2028\u2029]/.test(rest)) return null;
+  return [bare.slice(PREFIX.length, end), rest];
+}
 function projectRunIdsInPath(path) {
   const q = path.indexOf("?");
   const bare = q === -1 ? path : path.slice(0, q);
   let query = q === -1 ? "" : path.slice(q);
-  const m = /^\/runs\/([^/:]+)(.*)$/.exec(bare);
-  const projectedBare = m ? `/runs/${projectTenantBoundId(decodeSegment(m[1]))}${m[2]}` : bare;
+  const m = splitRunSegment(bare);
+  const projectedBare = m ? `/runs/${projectTenantBoundId(decodeSegment(m[0]))}${m[1]}` : bare;
   if (m && query) {
     query = query.replace(/([?&]against=)([^&]*)/, (_all, key, value) => `${key}${projectTenantBoundId(decodeSegment(value))}`);
   }
@@ -1167,9 +1187,11 @@ function v2SeamTwin(path) {
   }
   return null;
 }
-var V2_MATCHERS = V2_PATH_TEMPLATES.map(
-  (t) => new RegExp(`^${t.replace(/[.:]/g, "\\$&").replace(/\{[A-Za-z]+\}/g, "[^/]+")}$`)
-);
+function v2TemplatePattern(template) {
+  const literals = template.split(/\{[A-Za-z]+\}/);
+  return `^${literals.map((l) => l.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]+")}$`;
+}
+var V2_MATCHERS = V2_PATH_TEMPLATES.map((t) => new RegExp(v2TemplatePattern(t)));
 function v2Twin(path) {
   const q = path.indexOf("?");
   const bare = q === -1 ? path : path.slice(0, q);
@@ -1275,7 +1297,10 @@ function explicitStreamBase(raw) {
   if (url.username !== "" || url.password !== "") {
     throw new CliError("--stream-base-url / OPENWOP_STREAM_BASE_URL must not carry credentials (user:pass@); pass them with --api-key.");
   }
-  return raw.trim().replace(/\/+$/, "");
+  const base16 = raw.trim();
+  let end = base16.length;
+  while (end > 0 && base16[end - 1] === "/") end--;
+  return base16.slice(0, end);
 }
 function streamBaseFrom(extensions, baseUrl) {
   if (!extensions || typeof extensions !== "object" || Array.isArray(extensions)) return void 0;
@@ -20476,7 +20501,7 @@ var GOALS_ROUTES = [
 var GOALS_HELP = `Usage:
   openwop goals list [--state <s>] [--json]
   openwop goals get <goalId> [--json]
-  openwop goals create --objective <text> [--judge host|verifier] [--continuation <mode>]
+  openwop goals create --objective <text> --verifier-ref <ref> [--continuation schedule|manual]
                        [--max-iterations <n>] [--max-cost <usd>] [--timeout-ms <ms>] [--json]
   openwop goals pause <goalId> [--json]
   openwop goals resume <goalId> [--json]
@@ -20503,13 +20528,16 @@ Endpoints:
   resume   POST   /v1/host/openwop-app/goals/{id}/resume
   abandon  POST   /v1/host/openwop-app/goals/{id}/abandon
 
-  --state <s>            (list) Filter by state (e.g. active, satisfied, escalated, bound-exceeded, paused).
+  --state <s>            (list) Filter by state: active, satisfied, escalated, abandoned, bound-exceeded.
   --objective <text>     (create) The goal objective (required).
-  --judge host|verifier  (create) completion.check \u2014 who decides completion (default: host).
-  --continuation <mode>  (create) continuation.mode \u2014 the arm that re-engages work (e.g. schedule | commitment | manual).
-  --max-iterations <n>   (create) Bound: bounds.maxLoopIterations.
+  --verifier-ref <ref>   (create) completion.verifierRef \u2014 the verifier registered on the host that
+                         judges this goal (required; the host refuses a ref it has not registered).
+  --judge verifier       (create) completion.check \u2014 who decides completion. 'verifier' is the only
+                         judge a host advertising agents.goals.judge=verifier honours (the default).
+  --continuation <mode>  (create) continuation.mode \u2014 schedule | manual (default: manual).
+  --max-iterations <n>   (create) Bound: bounds.maxLoopIterations (positive integer).
   --max-cost <usd>       (create) Bound: bounds.maxCostUsd (accumulated USD).
-  --timeout-ms <ms>      (create) Bound: bounds.runTimeoutMs (wall-clock, milliseconds).
+  --timeout-ms <ms>      (create) Bound: bounds.runTimeoutMs (wall-clock, positive milliseconds).
   --yes                  (abandon) Required to confirm.
   --json                 Print the raw host response instead of the rendered view.
 
@@ -20519,13 +20547,14 @@ termination guarantee (bounds).
 
 Exit codes (get/create/pause/resume reflect the goal's state, so scripts can gate
 on the verdict):
-  0  satisfied      3  escalated or still open (active/paused)      1  bound-exceeded/abandoned or error
+  0  satisfied      3  escalated or still open (active)      1  bound-exceeded/abandoned or error
+A paused goal is still 'active' (pause stops its continuation, not the goal).
 \`list\` exits 0 on success.
 
 Examples:
   openwop goals list --state active
   openwop goals get goal_123 --json
-  openwop goals create --objective "Keep the triage backlog under 20" --judge verifier --continuation schedule --max-iterations 50 --max-cost 5.00 --timeout-ms 600000
+  openwop goals create --objective "Keep the triage backlog under 20" --verifier-ref <ref> --continuation schedule --max-iterations 50 --max-cost 5.00 --timeout-ms 600000
   openwop goals pause goal_123
   openwop goals abandon goal_123 --yes
 `;
@@ -20671,18 +20700,24 @@ function renderGoal(ctx, g, fallbackId) {
 async function runGoalsCreate(ctx, argv) {
   const { options } = parseOptions(argv, {
     bool: ["--help"],
-    value: ["--objective", "--judge", "--continuation", "--max-iterations", "--max-cost", "--timeout-ms"]
+    value: ["--objective", "--judge", "--verifier-ref", "--continuation", "--max-iterations", "--max-cost", "--timeout-ms"]
   });
   if (options.help || !options.objective) {
-    write(ctx.io.stdout, "Usage: openwop goals create --objective <text> [--judge host|verifier] [--continuation <mode>] [--max-iterations <n>] [--max-cost <usd>] [--timeout-ms <ms>] [--json]\n");
+    write(ctx.io.stdout, "Usage: openwop goals create --objective <text> --verifier-ref <ref> [--continuation schedule|manual] [--max-iterations <n>] [--max-cost <usd>] [--timeout-ms <ms>] [--json]\n");
     return options.help ? 0 : 2;
   }
-  if (options.judge !== void 0 && !["host", "verifier"].includes(options.judge)) {
-    throw new CliError("--judge must be one of: host, verifier", 2);
+  if (options.judge !== void 0 && options.judge !== "verifier") {
+    throw new CliError("--judge must be: verifier", 2);
+  }
+  if (!options.verifierRef) {
+    throw new CliError("goals create needs --verifier-ref <ref> \u2014 the verifier registered on the host that judges the goal", 2);
+  }
+  if (options.continuation !== void 0 && !["schedule", "manual"].includes(options.continuation)) {
+    throw new CliError("--continuation must be one of: schedule, manual", 2);
   }
   const body = {
     objective: options.objective,
-    completion: { check: options.judge ?? "host" },
+    completion: { check: "verifier", verifierRef: options.verifierRef },
     continuation: { mode: options.continuation ?? "manual" }
   };
   const bounds = {};
@@ -20698,7 +20733,7 @@ async function runGoalsCreate(ctx, argv) {
   }
   if (options.timeoutMs !== void 0) {
     const t = Number(options.timeoutMs);
-    if (!Number.isInteger(t) || t < 0) throw new CliError("--timeout-ms must be a non-negative integer (milliseconds)", 2);
+    if (!Number.isInteger(t) || t <= 0) throw new CliError("--timeout-ms must be a positive integer (milliseconds)", 2);
     bounds.runTimeoutMs = t;
   }
   if (Object.keys(bounds).length) body.bounds = bounds;
@@ -20707,8 +20742,8 @@ async function runGoalsCreate(ctx, argv) {
   try {
     res = await requestJson(ctx, "/v1/host/openwop-app/goals", { method: "POST", body });
   } catch (err) {
-    if (err instanceof HttpError && err.status === 422) {
-      const detail2 = err.body?.message ?? "this host requires bounds on an active goal \u2014 pass --max-iterations, --max-cost, and/or --timeout-ms";
+    if (err instanceof HttpError && (err.status === 422 || err.status === 400)) {
+      const detail2 = err.body?.message ?? (err.status === 422 ? "this host requires bounds on an active goal \u2014 pass --max-iterations, --max-cost, and/or --timeout-ms" : "the host refused the goal as malformed");
       throw new CliError(`goals: ${detail2}`, 1);
     }
     gate4045(err);
@@ -20718,7 +20753,7 @@ async function runGoalsCreate(ctx, argv) {
     writeJson(ctx.io.stdout, g);
     return exitForState2(g.state);
   }
-  writeLine(ctx.io.stdout, `\u2713 Created goal ${g.goalId ?? g.id ?? ""} (state ${g.state ?? "active"}, check ${g.completion?.check ?? options.judge ?? "host"}).`);
+  writeLine(ctx.io.stdout, `\u2713 Created goal ${g.goalId ?? g.id ?? ""} (state ${g.state ?? "active"}, check ${g.completion?.check ?? "verifier"}).`);
   return exitForState2(g.state);
 }
 async function runGoalsTransition(ctx, argv, verb) {
@@ -29786,7 +29821,7 @@ var INTENT_LEDGER_ROUTES = [
     words: ["draft"],
     method: "POST",
     path: `${C3}/draft`,
-    summary: "Draft (or REPLACE) the ledger: a new draft the user then approves.",
+    summary: "Draft the ledger (replaces a draft; an approved mission must be rejected first): a new draft the user then approves.",
     body: [
       { flag: "--goal", key: "goal", required: true },
       { flag: "--allowed", key: "allowed", type: "csv" },
@@ -29796,12 +29831,16 @@ var INTENT_LEDGER_ROUTES = [
       { flag: "--expires-at-rel-ms", key: "expiresAtRelMs", type: "number" }
     ]
   },
-  { words: ["approve"], method: "POST", path: `${C3}/approve`, summary: "Approve the drafted ledger (you become approvedBy)." },
-  { words: ["reject"], method: "POST", path: `${C3}/reject`, summary: "Reject the drafted ledger." },
   { words: ["reckoning"], method: "GET", path: `${C3}/reckoning`, summary: "What runs did vs. the mandate: used / blocked tools, within-mandate verdict (null before any stamped run)." }
 ];
 var INTENT_LEDGER_HELP = `Usage:
 ${routesHelp("intent-ledger", INTENT_LEDGER_ROUTES)}
+Decisions (read, review, then decide exactly what you reviewed \u2014 openwop-app ADR 0896):
+  openwop intent-ledger approve <conversationId> [--yes --digest <digest>] [--json]
+  openwop intent-ledger reject <conversationId> [--yes --digest <digest>] [--json]
+      Prints the contract; with --yes and the printed --digest, approves (or
+      rejects/revokes) exactly that version. POST ${C3}/approve|reject
+
 Intent ledger (ADR 0136). The host enforces the ledger at tool-call time; the CLI
 only records your intent and reads the host's reckoning.
 
@@ -29809,10 +29848,70 @@ Exit codes: 0 ok \xB7 1 server error \xB7 2 usage / not found \xB7 4 not signed
 
 Examples:
   openwop intent-ledger draft conv_1 --goal "Book travel" --allowed travel.search,travel.book --require-approval travel.book
-  openwop intent-ledger approve conv_1
+  openwop intent-ledger approve conv_1                      # prints the contract + its digest
+  openwop intent-ledger approve conv_1 --yes --digest sha256:\u2026
   openwop intent-ledger reckoning conv_1 --json
 `;
+function contractLines(l) {
+  const list = (xs) => xs && xs.length ? xs.join(", ") : "(none)";
+  return [
+    `Mission ${l.ledgerId ?? "?"} \u2014 ${l.status ?? "?"}${l.revision !== void 0 ? ` (revision ${l.revision})` : ""}`,
+    `  goal:             ${l.goal ?? ""}`,
+    `  allowed:          ${l.allowed && l.allowed.length ? l.allowed.join(", ") : "(none \u2014 the agent may talk but not act)"}`,
+    `  forbidden:        ${list(l.forbidden)}`,
+    `  needs approval:   ${list(l.requireApproval)}`,
+    `  success criteria: ${list(l.successCriteria)}`,
+    ...l.expiresAtRelMs !== void 0 ? [`  ends:             ${Math.round(l.expiresAtRelMs / 6e4)} min after the agent starts working under it`] : [],
+    ...l.digest ? [`  digest:           ${l.digest}`] : []
+  ];
+}
+async function decide2(ctx, verb, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--yes", "-y", "--json", "--help", "-h"], value: ["--digest"] });
+  if (options.help || options.h) {
+    write(ctx.io.stdout, INTENT_LEDGER_HELP);
+    return 0;
+  }
+  const conversationId = positionals[0];
+  if (!conversationId || positionals.length > 1) throw new CliError(`Usage: openwop intent-ledger ${verb} <conversationId> [--yes --digest <digest>]`, 2);
+  const path = C3.replace(":conversationId", encodeURIComponent(conversationId));
+  try {
+    const got = await requestJson(ctx, path);
+    const ledger = got.body?.ledger ?? null;
+    if (!ledger) throw new CliError(`No mission ledger on conversation ${conversationId}.`, 2);
+    if (!options.yes && !options.y) {
+      if (options.json) writeJson(ctx.io.stdout, got.body);
+      else for (const line of contractLines(ledger)) writeLine(ctx.io.stdout, line);
+      writeLine(ctx.io.stderr, `Review the contract above, then re-run: openwop intent-ledger ${verb} ${conversationId} --yes${ledger.digest ? ` --digest ${ledger.digest}` : ""}`);
+      return 2;
+    }
+    if (ledger.digest) {
+      if (!options.digest) {
+        for (const line of contractLines(ledger)) writeLine(ctx.io.stderr, line);
+        throw new CliError(`Pass --digest ${ledger.digest} to ${verb} exactly this contract.`, 2);
+      }
+      if (options.digest !== ledger.digest) {
+        for (const line of contractLines(ledger)) writeLine(ctx.io.stderr, line);
+        throw new CliError(`The mission changed since you reviewed it (digest ${options.digest} \u2192 ${ledger.digest}). Review the version above and re-run with its digest.`, 2);
+      }
+    }
+    const body = {};
+    if (ledger.ledgerId !== void 0) body.ledgerId = ledger.ledgerId;
+    if (ledger.revision !== void 0) body.revision = ledger.revision;
+    if (ledger.digest !== void 0) body.digest = ledger.digest;
+    const res = await requestJson(ctx, `${path}/${verb}`, { method: "POST", body });
+    if (options.json) writeJson(ctx.io.stdout, res.body);
+    else {
+      const out = res.body?.ledger;
+      writeLine(ctx.io.stdout, `Mission ${out?.ledgerId ?? ledger.ledgerId ?? ""} ${out?.status ?? (verb === "approve" ? "approved" : "rejected")}.`);
+    }
+    return 0;
+  } catch (err) {
+    if (err instanceof HttpError) throw hostError(err);
+    throw err;
+  }
+}
 async function runIntentLedger(ctx, argv) {
+  if (argv[0] === "approve" || argv[0] === "reject") return decide2(ctx, argv[0], argv.slice(1));
   return runRouteGroup(ctx, "intent-ledger", INTENT_LEDGER_HELP, INTENT_LEDGER_ROUTES, argv);
 }
 
@@ -31014,5 +31113,6 @@ export {
   streamBaseFrom,
   streamRunEvents,
   submitTurn,
-  summarizeCapabilities
+  summarizeCapabilities,
+  v2TemplatePattern
 };

package/dist/openwop.js

@@ -579,7 +579,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.6.0",
+  version: "1.8.0",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -856,21 +856,31 @@ function mergeConfig(existing, next) {
 function getByPath(obj, path) {
   return path.split(".").reduce((acc, key) => acc == null ? acc : acc[key], obj);
 }
-function setByPath(obj, path, value) {
+var UNSAFE_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function safePathParts(path) {
   const parts = path.split(".");
+  for (const part of parts) {
+    if (UNSAFE_PATH_SEGMENTS.has(part)) throw new CliError(`Config key segment '${part}' is not allowed: ${path}`);
+  }
+  return parts;
+}
+function setByPath(obj, path, value) {
+  const parts = safePathParts(path);
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    if (typeof cur[parts[i]] !== "object" || cur[parts[i]] === null) cur[parts[i]] = {};
-    cur = cur[parts[i]];
+    const key = parts[i];
+    if (!Object.hasOwn(cur, key) || typeof cur[key] !== "object" || cur[key] === null) cur[key] = {};
+    cur = cur[key];
   }
   cur[parts[parts.length - 1]] = value;
 }
 function unsetByPath(obj, path) {
-  const parts = path.split(".");
+  const parts = safePathParts(path);
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    if (typeof cur[parts[i]] !== "object" || cur[parts[i]] === null) return;
-    cur = cur[parts[i]];
+    const key = parts[i];
+    if (!Object.hasOwn(cur, key) || typeof cur[key] !== "object" || cur[key] === null) return;
+    cur = cur[key];
   }
   delete cur[parts[parts.length - 1]];
 }
@@ -1097,12 +1107,22 @@ function decodeSegment(segment) {
     return segment;
   }
 }
+function splitRunSegment(bare) {
+  const PREFIX = "/runs/";
+  if (!bare.startsWith(PREFIX)) return null;
+  let end = PREFIX.length;
+  while (end < bare.length && bare[end] !== "/" && bare[end] !== ":") end++;
+  if (end === PREFIX.length) return null;
+  const rest = bare.slice(end);
+  if (/[\n\r\u2028\u2029]/.test(rest)) return null;
+  return [bare.slice(PREFIX.length, end), rest];
+}
 function projectRunIdsInPath(path) {
   const q = path.indexOf("?");
   const bare = q === -1 ? path : path.slice(0, q);
   let query = q === -1 ? "" : path.slice(q);
-  const m = /^\/runs\/([^/:]+)(.*)$/.exec(bare);
-  const projectedBare = m ? `/runs/${projectTenantBoundId(decodeSegment(m[1]))}${m[2]}` : bare;
+  const m = splitRunSegment(bare);
+  const projectedBare = m ? `/runs/${projectTenantBoundId(decodeSegment(m[0]))}${m[1]}` : bare;
   if (m && query) {
     query = query.replace(/([?&]against=)([^&]*)/, (_all, key, value) => `${key}${projectTenantBoundId(decodeSegment(value))}`);
   }
@@ -1167,9 +1187,11 @@ function v2SeamTwin(path) {
   }
   return null;
 }
-var V2_MATCHERS = V2_PATH_TEMPLATES.map(
-  (t) => new RegExp(`^${t.replace(/[.:]/g, "\\$&").replace(/\{[A-Za-z]+\}/g, "[^/]+")}$`)
-);
+function v2TemplatePattern(template) {
+  const literals = template.split(/\{[A-Za-z]+\}/);
+  return `^${literals.map((l) => l.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]+")}$`;
+}
+var V2_MATCHERS = V2_PATH_TEMPLATES.map((t) => new RegExp(v2TemplatePattern(t)));
 function v2Twin(path) {
   const q = path.indexOf("?");
   const bare = q === -1 ? path : path.slice(0, q);
@@ -1275,7 +1297,10 @@ function explicitStreamBase(raw) {
   if (url.username !== "" || url.password !== "") {
     throw new CliError("--stream-base-url / OPENWOP_STREAM_BASE_URL must not carry credentials (user:pass@); pass them with --api-key.");
   }
-  return raw.trim().replace(/\/+$/, "");
+  const base16 = raw.trim();
+  let end = base16.length;
+  while (end > 0 && base16[end - 1] === "/") end--;
+  return base16.slice(0, end);
 }
 function streamBaseFrom(extensions, baseUrl) {
   if (!extensions || typeof extensions !== "object" || Array.isArray(extensions)) return void 0;
@@ -20476,7 +20501,7 @@ var GOALS_ROUTES = [
 var GOALS_HELP = `Usage:
   openwop goals list [--state <s>] [--json]
   openwop goals get <goalId> [--json]
-  openwop goals create --objective <text> [--judge host|verifier] [--continuation <mode>]
+  openwop goals create --objective <text> --verifier-ref <ref> [--continuation schedule|manual]
                        [--max-iterations <n>] [--max-cost <usd>] [--timeout-ms <ms>] [--json]
   openwop goals pause <goalId> [--json]
   openwop goals resume <goalId> [--json]
@@ -20503,13 +20528,16 @@ Endpoints:
   resume   POST   /v1/host/openwop-app/goals/{id}/resume
   abandon  POST   /v1/host/openwop-app/goals/{id}/abandon
 
-  --state <s>            (list) Filter by state (e.g. active, satisfied, escalated, bound-exceeded, paused).
+  --state <s>            (list) Filter by state: active, satisfied, escalated, abandoned, bound-exceeded.
   --objective <text>     (create) The goal objective (required).
-  --judge host|verifier  (create) completion.check \u2014 who decides completion (default: host).
-  --continuation <mode>  (create) continuation.mode \u2014 the arm that re-engages work (e.g. schedule | commitment | manual).
-  --max-iterations <n>   (create) Bound: bounds.maxLoopIterations.
+  --verifier-ref <ref>   (create) completion.verifierRef \u2014 the verifier registered on the host that
+                         judges this goal (required; the host refuses a ref it has not registered).
+  --judge verifier       (create) completion.check \u2014 who decides completion. 'verifier' is the only
+                         judge a host advertising agents.goals.judge=verifier honours (the default).
+  --continuation <mode>  (create) continuation.mode \u2014 schedule | manual (default: manual).
+  --max-iterations <n>   (create) Bound: bounds.maxLoopIterations (positive integer).
   --max-cost <usd>       (create) Bound: bounds.maxCostUsd (accumulated USD).
-  --timeout-ms <ms>      (create) Bound: bounds.runTimeoutMs (wall-clock, milliseconds).
+  --timeout-ms <ms>      (create) Bound: bounds.runTimeoutMs (wall-clock, positive milliseconds).
   --yes                  (abandon) Required to confirm.
   --json                 Print the raw host response instead of the rendered view.
 
@@ -20519,13 +20547,14 @@ termination guarantee (bounds).
 
 Exit codes (get/create/pause/resume reflect the goal's state, so scripts can gate
 on the verdict):
-  0  satisfied      3  escalated or still open (active/paused)      1  bound-exceeded/abandoned or error
+  0  satisfied      3  escalated or still open (active)      1  bound-exceeded/abandoned or error
+A paused goal is still 'active' (pause stops its continuation, not the goal).
 \`list\` exits 0 on success.
 
 Examples:
   openwop goals list --state active
   openwop goals get goal_123 --json
-  openwop goals create --objective "Keep the triage backlog under 20" --judge verifier --continuation schedule --max-iterations 50 --max-cost 5.00 --timeout-ms 600000
+  openwop goals create --objective "Keep the triage backlog under 20" --verifier-ref <ref> --continuation schedule --max-iterations 50 --max-cost 5.00 --timeout-ms 600000
   openwop goals pause goal_123
   openwop goals abandon goal_123 --yes
 `;
@@ -20671,18 +20700,24 @@ function renderGoal(ctx, g, fallbackId) {
 async function runGoalsCreate(ctx, argv) {
   const { options } = parseOptions(argv, {
     bool: ["--help"],
-    value: ["--objective", "--judge", "--continuation", "--max-iterations", "--max-cost", "--timeout-ms"]
+    value: ["--objective", "--judge", "--verifier-ref", "--continuation", "--max-iterations", "--max-cost", "--timeout-ms"]
   });
   if (options.help || !options.objective) {
-    write(ctx.io.stdout, "Usage: openwop goals create --objective <text> [--judge host|verifier] [--continuation <mode>] [--max-iterations <n>] [--max-cost <usd>] [--timeout-ms <ms>] [--json]\n");
+    write(ctx.io.stdout, "Usage: openwop goals create --objective <text> --verifier-ref <ref> [--continuation schedule|manual] [--max-iterations <n>] [--max-cost <usd>] [--timeout-ms <ms>] [--json]\n");
     return options.help ? 0 : 2;
   }
-  if (options.judge !== void 0 && !["host", "verifier"].includes(options.judge)) {
-    throw new CliError("--judge must be one of: host, verifier", 2);
+  if (options.judge !== void 0 && options.judge !== "verifier") {
+    throw new CliError("--judge must be: verifier", 2);
+  }
+  if (!options.verifierRef) {
+    throw new CliError("goals create needs --verifier-ref <ref> \u2014 the verifier registered on the host that judges the goal", 2);
+  }
+  if (options.continuation !== void 0 && !["schedule", "manual"].includes(options.continuation)) {
+    throw new CliError("--continuation must be one of: schedule, manual", 2);
   }
   const body = {
     objective: options.objective,
-    completion: { check: options.judge ?? "host" },
+    completion: { check: "verifier", verifierRef: options.verifierRef },
     continuation: { mode: options.continuation ?? "manual" }
   };
   const bounds = {};
@@ -20698,7 +20733,7 @@ async function runGoalsCreate(ctx, argv) {
   }
   if (options.timeoutMs !== void 0) {
     const t = Number(options.timeoutMs);
-    if (!Number.isInteger(t) || t < 0) throw new CliError("--timeout-ms must be a non-negative integer (milliseconds)", 2);
+    if (!Number.isInteger(t) || t <= 0) throw new CliError("--timeout-ms must be a positive integer (milliseconds)", 2);
     bounds.runTimeoutMs = t;
   }
   if (Object.keys(bounds).length) body.bounds = bounds;
@@ -20707,8 +20742,8 @@ async function runGoalsCreate(ctx, argv) {
   try {
     res = await requestJson(ctx, "/v1/host/openwop-app/goals", { method: "POST", body });
   } catch (err) {
-    if (err instanceof HttpError && err.status === 422) {
-      const detail2 = err.body?.message ?? "this host requires bounds on an active goal \u2014 pass --max-iterations, --max-cost, and/or --timeout-ms";
+    if (err instanceof HttpError && (err.status === 422 || err.status === 400)) {
+      const detail2 = err.body?.message ?? (err.status === 422 ? "this host requires bounds on an active goal \u2014 pass --max-iterations, --max-cost, and/or --timeout-ms" : "the host refused the goal as malformed");
       throw new CliError(`goals: ${detail2}`, 1);
     }
     gate4045(err);
@@ -20718,7 +20753,7 @@ async function runGoalsCreate(ctx, argv) {
     writeJson(ctx.io.stdout, g);
     return exitForState2(g.state);
   }
-  writeLine(ctx.io.stdout, `\u2713 Created goal ${g.goalId ?? g.id ?? ""} (state ${g.state ?? "active"}, check ${g.completion?.check ?? options.judge ?? "host"}).`);
+  writeLine(ctx.io.stdout, `\u2713 Created goal ${g.goalId ?? g.id ?? ""} (state ${g.state ?? "active"}, check ${g.completion?.check ?? "verifier"}).`);
   return exitForState2(g.state);
 }
 async function runGoalsTransition(ctx, argv, verb) {
@@ -29786,7 +29821,7 @@ var INTENT_LEDGER_ROUTES = [
     words: ["draft"],
     method: "POST",
     path: `${C3}/draft`,
-    summary: "Draft (or REPLACE) the ledger: a new draft the user then approves.",
+    summary: "Draft the ledger (replaces a draft; an approved mission must be rejected first): a new draft the user then approves.",
     body: [
       { flag: "--goal", key: "goal", required: true },
       { flag: "--allowed", key: "allowed", type: "csv" },
@@ -29796,12 +29831,16 @@ var INTENT_LEDGER_ROUTES = [
       { flag: "--expires-at-rel-ms", key: "expiresAtRelMs", type: "number" }
     ]
   },
-  { words: ["approve"], method: "POST", path: `${C3}/approve`, summary: "Approve the drafted ledger (you become approvedBy)." },
-  { words: ["reject"], method: "POST", path: `${C3}/reject`, summary: "Reject the drafted ledger." },
   { words: ["reckoning"], method: "GET", path: `${C3}/reckoning`, summary: "What runs did vs. the mandate: used / blocked tools, within-mandate verdict (null before any stamped run)." }
 ];
 var INTENT_LEDGER_HELP = `Usage:
 ${routesHelp("intent-ledger", INTENT_LEDGER_ROUTES)}
+Decisions (read, review, then decide exactly what you reviewed \u2014 openwop-app ADR 0896):
+  openwop intent-ledger approve <conversationId> [--yes --digest <digest>] [--json]
+  openwop intent-ledger reject <conversationId> [--yes --digest <digest>] [--json]
+      Prints the contract; with --yes and the printed --digest, approves (or
+      rejects/revokes) exactly that version. POST ${C3}/approve|reject
+
 Intent ledger (ADR 0136). The host enforces the ledger at tool-call time; the CLI
 only records your intent and reads the host's reckoning.
 
@@ -29809,10 +29848,70 @@ Exit codes: 0 ok \xB7 1 server error \xB7 2 usage / not found \xB7 4 not signed
 
 Examples:
   openwop intent-ledger draft conv_1 --goal "Book travel" --allowed travel.search,travel.book --require-approval travel.book
-  openwop intent-ledger approve conv_1
+  openwop intent-ledger approve conv_1                      # prints the contract + its digest
+  openwop intent-ledger approve conv_1 --yes --digest sha256:\u2026
   openwop intent-ledger reckoning conv_1 --json
 `;
+function contractLines(l) {
+  const list = (xs) => xs && xs.length ? xs.join(", ") : "(none)";
+  return [
+    `Mission ${l.ledgerId ?? "?"} \u2014 ${l.status ?? "?"}${l.revision !== void 0 ? ` (revision ${l.revision})` : ""}`,
+    `  goal:             ${l.goal ?? ""}`,
+    `  allowed:          ${l.allowed && l.allowed.length ? l.allowed.join(", ") : "(none \u2014 the agent may talk but not act)"}`,
+    `  forbidden:        ${list(l.forbidden)}`,
+    `  needs approval:   ${list(l.requireApproval)}`,
+    `  success criteria: ${list(l.successCriteria)}`,
+    ...l.expiresAtRelMs !== void 0 ? [`  ends:             ${Math.round(l.expiresAtRelMs / 6e4)} min after the agent starts working under it`] : [],
+    ...l.digest ? [`  digest:           ${l.digest}`] : []
+  ];
+}
+async function decide2(ctx, verb, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--yes", "-y", "--json", "--help", "-h"], value: ["--digest"] });
+  if (options.help || options.h) {
+    write(ctx.io.stdout, INTENT_LEDGER_HELP);
+    return 0;
+  }
+  const conversationId = positionals[0];
+  if (!conversationId || positionals.length > 1) throw new CliError(`Usage: openwop intent-ledger ${verb} <conversationId> [--yes --digest <digest>]`, 2);
+  const path = C3.replace(":conversationId", encodeURIComponent(conversationId));
+  try {
+    const got = await requestJson(ctx, path);
+    const ledger = got.body?.ledger ?? null;
+    if (!ledger) throw new CliError(`No mission ledger on conversation ${conversationId}.`, 2);
+    if (!options.yes && !options.y) {
+      if (options.json) writeJson(ctx.io.stdout, got.body);
+      else for (const line of contractLines(ledger)) writeLine(ctx.io.stdout, line);
+      writeLine(ctx.io.stderr, `Review the contract above, then re-run: openwop intent-ledger ${verb} ${conversationId} --yes${ledger.digest ? ` --digest ${ledger.digest}` : ""}`);
+      return 2;
+    }
+    if (ledger.digest) {
+      if (!options.digest) {
+        for (const line of contractLines(ledger)) writeLine(ctx.io.stderr, line);
+        throw new CliError(`Pass --digest ${ledger.digest} to ${verb} exactly this contract.`, 2);
+      }
+      if (options.digest !== ledger.digest) {
+        for (const line of contractLines(ledger)) writeLine(ctx.io.stderr, line);
+        throw new CliError(`The mission changed since you reviewed it (digest ${options.digest} \u2192 ${ledger.digest}). Review the version above and re-run with its digest.`, 2);
+      }
+    }
+    const body = {};
+    if (ledger.ledgerId !== void 0) body.ledgerId = ledger.ledgerId;
+    if (ledger.revision !== void 0) body.revision = ledger.revision;
+    if (ledger.digest !== void 0) body.digest = ledger.digest;
+    const res = await requestJson(ctx, `${path}/${verb}`, { method: "POST", body });
+    if (options.json) writeJson(ctx.io.stdout, res.body);
+    else {
+      const out = res.body?.ledger;
+      writeLine(ctx.io.stdout, `Mission ${out?.ledgerId ?? ledger.ledgerId ?? ""} ${out?.status ?? (verb === "approve" ? "approved" : "rejected")}.`);
+    }
+    return 0;
+  } catch (err) {
+    if (err instanceof HttpError) throw hostError(err);
+    throw err;
+  }
+}
 async function runIntentLedger(ctx, argv) {
+  if (argv[0] === "approve" || argv[0] === "reject") return decide2(ctx, argv[0], argv.slice(1));
   return runRouteGroup(ctx, "intent-ledger", INTENT_LEDGER_HELP, INTENT_LEDGER_ROUTES, argv);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/cli",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   "license": "Apache-2.0",
   "type": "module",