@overaihq/cli 0.14.5 → 0.14.7

package/dist/index.js

@@ -27703,22 +27703,7 @@ var whoami = (args = []) => {
 };
 
 // src/commands/agent.ts
-var runAgent = async (args) => {
-  const [operation, id] = args;
-  if (operation !== "generate" || id == null) throw new Error("Usage: overai agent generate <id> --message <text|@file|@->");
-  const message = await readValue(flagValue(args, "--message", "-m"), "--message");
-  if (message == null) throw new Error("Agent generate requires --message.");
-  const { organizationId } = await getAccessToken();
-  const response = await v2Fetch(`/v2/agents/${organizationId}/${id}/generate/text`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ message })
-  });
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("agent generate", response, raw2);
-  const body = JSON.parse(raw2);
-  printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
-};
+import { createInterface } from "readline";
 
 // src/gql.ts
 var gqlRequest = async (query, variables) => {
@@ -27748,6 +27733,283 @@ var gqlRequest = async (query, variables) => {
   return body.data;
 };
 
+// src/commands/agent.ts
+var USAGE = [
+  "Usage:",
+  "  overai agent generate <id> --message <text|@file|@->",
+  "  overai agent tools <id> [--version <n>] [-o json|table|csv]",
+  "  overai agent chat <id> [--conversation <id>] [--message <text>]"
+].join("\n");
+var generate = async (args, id) => {
+  const message = await readValue(
+    flagValue(args, "--message", "-m"),
+    "--message"
+  );
+  if (message == null) throw new Error("Agent generate requires --message.");
+  const { organizationId } = await getAccessToken();
+  const response = await v2Fetch(
+    `/v2/agents/${organizationId}/${id}/generate/text`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ message })
+    }
+  );
+  const raw2 = await response.text();
+  if (!response.ok) throw v2Error("agent generate", response, raw2);
+  printResult(
+    JSON.parse(raw2),
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
+};
+var deployedVersionNumber = async (id) => {
+  const deployed = await gqlRequest(
+    `query CliAgentDeployedVersion($id: String!) {
+      agentDeployedVersions(condition: { agentId: $id }) { nodes { versionNumber } }
+    }`,
+    { id }
+  );
+  const versionNumber = deployed.agentDeployedVersions?.nodes[0]?.versionNumber;
+  if (versionNumber == null) {
+    throw new Error(
+      `Agent ${id} has no deployed version; pass --version <n> to inspect a saved one.`
+    );
+  }
+  return versionNumber;
+};
+var tools = async (args, id) => {
+  const versionFlag = flagValue(args, "--version", "-v");
+  if (versionFlag != null && !Number.isInteger(Number(versionFlag))) {
+    throw new Error("--version must be an integer.");
+  }
+  const version = versionFlag == null ? await deployedVersionNumber(id) : Number(versionFlag);
+  const data = await gqlRequest(
+    `query CliAgentTools($id: String!, $version: Int!) {
+      agent(id: $id) {
+        name
+        agentVersions(first: 1, condition: { versionNumber: $version }) {
+          nodes {
+            versionNumber
+            model
+            agentVersionFunctionsByAgentIdAndVersionNumber(orderBy: [FUNCTION_ID_ASC]) {
+              nodes { functionId function { name } }
+            }
+            agentVersionTableSpacesByAgentIdAndVersionNumber(orderBy: [TABLE_SPACE_ID_ASC]) {
+              nodes { tableSpaceId accessMode }
+            }
+            agentVersionAgentsByAgentIdAndVersionNumber(orderBy: [ATTACHED_AGENT_ID_ASC]) {
+              nodes { attachedAgentId }
+            }
+            agentVersionKnowledgeBasesByAgentIdAndVersionNumber(orderBy: [KNOWLEDGE_BASE_ID_ASC]) {
+              nodes { knowledgeBaseId }
+            }
+            agentVersionBuiltinToolSetsByAgentIdAndVersionNumber(orderBy: [TOOL_SET_ASC]) {
+              nodes { toolSet }
+            }
+          }
+        }
+      }
+    }`,
+    { id, version }
+  );
+  if (data.agent == null) throw new Error(`Agent ${id} not found.`);
+  const agentVersion = data.agent.agentVersions.nodes[0];
+  if (agentVersion == null) {
+    throw new Error(`Agent ${id} has no version ${String(version)}.`);
+  }
+  const rows = [
+    ...agentVersion.agentVersionFunctionsByAgentIdAndVersionNumber.nodes.map(
+      (link) => ({
+        kind: "function",
+        name: link.function?.name ?? link.functionId,
+        detail: link.functionId
+      })
+    ),
+    ...agentVersion.agentVersionTableSpacesByAgentIdAndVersionNumber.nodes.map(
+      (link) => ({
+        kind: "table space",
+        name: link.tableSpaceId,
+        detail: link.accessMode
+      })
+    ),
+    ...agentVersion.agentVersionAgentsByAgentIdAndVersionNumber.nodes.map(
+      (link) => ({
+        kind: "sub-agent",
+        name: link.attachedAgentId,
+        detail: ""
+      })
+    ),
+    ...agentVersion.agentVersionKnowledgeBasesByAgentIdAndVersionNumber.nodes.map(
+      (link) => ({
+        kind: "knowledge base",
+        name: link.knowledgeBaseId,
+        detail: ""
+      })
+    ),
+    ...agentVersion.agentVersionBuiltinToolSetsByAgentIdAndVersionNumber.nodes.map(
+      (link) => ({ kind: "built-in", name: link.toolSet, detail: "" })
+    )
+  ];
+  const format2 = resolveFormat(flagValue(args, "-o", "--output"));
+  if (format2 === "json") {
+    printResult(
+      {
+        agent: data.agent.name,
+        version: agentVersion.versionNumber,
+        model: agentVersion.model,
+        tools: rows
+      },
+      format2
+    );
+    return;
+  }
+  if (format2 === "table") {
+    process.stdout.write(
+      `${data.agent.name} \xB7 version ${String(agentVersion.versionNumber)} \xB7 ${agentVersion.model}
+`
+    );
+  }
+  printResult(rows, format2);
+};
+var printStreamLine = (line) => {
+  if (!line.startsWith("data: ")) return;
+  const payload = line.slice(6);
+  if (payload === "[DONE]") return;
+  let event;
+  try {
+    event = JSON.parse(payload);
+  } catch {
+    return;
+  }
+  if (event.type === "text-delta" && event.delta != null) {
+    process.stdout.write(event.delta);
+  }
+  if (event.type === "error") {
+    process.stderr.write(`
+${event.errorText ?? "agent turn failed"}
+`);
+  }
+};
+var streamReply = async (response) => {
+  const body = response.body;
+  if (body == null) return;
+  const decoder = new TextDecoder();
+  let buffer = "";
+  for await (const chunk of body) {
+    buffer += decoder.decode(chunk, { stream: true });
+    const lines = buffer.split("\n");
+    buffer = lines.pop() ?? "";
+    lines.forEach(printStreamLine);
+  }
+  printStreamLine(buffer + decoder.decode());
+};
+var send = async (organizationId, id, message, conversationId) => {
+  const response = await v2Fetch(`/v2/agents/${organizationId}/${id}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      messages: [{ role: "user", parts: [{ type: "text", text: message }] }],
+      conversationId
+    })
+  });
+  if (!response.ok) {
+    throw v2Error("agent chat", response, await response.text());
+  }
+  await streamReply(response);
+  process.stdout.write("\n");
+};
+var createConversation = async (id, firstMessage) => {
+  const versionNumber = await deployedVersionNumber(id);
+  const created = await gqlRequest(
+    `mutation CliCreateAgentConversation($input: CreateAgentConversationInput!) {
+      createAgentConversation(input: $input) { agentConversation { id } }
+    }`,
+    {
+      input: {
+        agentConversation: {
+          agentId: id,
+          versionNumber,
+          title: firstMessage.length > 50 ? `${firstMessage.slice(0, 47)}...` : firstMessage
+        }
+      }
+    }
+  );
+  const conversationId = created.createAgentConversation?.agentConversation?.id;
+  if (conversationId == null)
+    throw new Error("Failed to create a conversation.");
+  return conversationId;
+};
+var chat = async (args, id) => {
+  const { organizationId } = await getAccessToken();
+  let conversationId = flagValue(args, "--conversation", "-c") ?? null;
+  const single = await readValue(
+    flagValue(args, "--message", "-m"),
+    "--message"
+  );
+  if (single != null) {
+    conversationId ??= await createConversation(id, single);
+    try {
+      await send(organizationId, id, single, conversationId);
+    } finally {
+      process.stderr.write(`Conversation: ${conversationId}
+`);
+    }
+    return;
+  }
+  const interactive = process.stdin.isTTY;
+  const rl = createInterface({
+    input: process.stdin,
+    ...interactive ? { output: process.stdout, historySize: 1e3, terminal: true } : {}
+  });
+  if (interactive) {
+    process.stdout.write(
+      `Chatting with ${id}. Ctrl-C to leave; each reply prints as it streams.
+`
+    );
+    rl.setPrompt("> ");
+    rl.prompt();
+  }
+  for await (const line of rl) {
+    const message = line.trim();
+    if (message.length === 0) {
+      if (interactive) rl.prompt();
+      continue;
+    }
+    try {
+      conversationId ??= await createConversation(id, message);
+      await send(organizationId, id, message, conversationId);
+    } catch (error) {
+      process.stderr.write(
+        `${error instanceof Error ? error.message : String(error)}
+`
+      );
+    }
+    if (interactive) rl.prompt();
+  }
+  if (conversationId != null) {
+    process.stderr.write(`
+Conversation: ${conversationId}
+`);
+  }
+};
+var runAgent = async (args) => {
+  const [operation, id] = args;
+  if (id == null) throw new Error(USAGE);
+  switch (operation) {
+    case "generate":
+      await generate(args, id);
+      return;
+    case "tools":
+      await tools(args, id);
+      return;
+    case "chat":
+      await chat(args, id);
+      return;
+    default:
+      throw new Error(USAGE);
+  }
+};
+
 // src/commands/automation.ts
 var runRuns = async (automationId, args) => {
   const limit2 = Number(flagValue(args, "--limit") ?? 20);
@@ -28693,7 +28955,7 @@ var runList = async (args) => {
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
-var USAGE = "Usage: overai runner create <workspaceId> [--name <name>]\n       overai runner token <runnerId> [--note <note>]\n       overai runner run <runnerId> [--interpreter shell|powershell] --code '<code>'\n       overai runner upload <runnerId> --path '<path>'\n       overai runner list [workspaceId] [--limit <n>]\n";
+var USAGE2 = "Usage: overai runner create <workspaceId> [--name <name>]\n       overai runner token <runnerId> [--note <note>]\n       overai runner run <runnerId> [--interpreter shell|powershell] --code '<code>'\n       overai runner upload <runnerId> --path '<path>'\n       overai runner list [workspaceId] [--limit <n>]\n";
 var runRunner = async (args) => {
   const [sub, id, ...rest] = args;
   if (sub === "create" && id != null) return runCreate(id, rest);
@@ -28701,7 +28963,7 @@ var runRunner = async (args) => {
   if (sub === "run" && id != null) return runRun(id, rest);
   if (sub === "upload" && id != null) return runUpload(id, rest);
   if (sub === "list") return runList([id, ...rest].filter((a) => a != null));
-  process.stderr.write(USAGE);
+  process.stderr.write(USAGE2);
   process.exitCode = 1;
 };
 
@@ -35297,7 +35559,7 @@ var runGraphql = async (args) => {
 };
 
 // src/commands/integration.ts
-var USAGE2 = "Usage: overai integration configure <id> --config <json|@file|@-> | integration config <id> | integration secret set <id> <KEY> --value <@file|@-> | integration secret unset <id> <KEY>";
+var USAGE3 = "Usage: overai integration configure <id> --config <json|@file|@-> | integration config <id> | integration secret set <id> <KEY> --value <@file|@-> | integration secret unset <id> <KEY>";
 var setSecret = async (integrationId, key, rawValue) => {
   if (rawValue == null) {
     throw new Error("Integration secret set requires --value.");
@@ -35331,7 +35593,7 @@ var runIntegration = async (args) => {
   if (operation === "secret") {
     const [, action, id2, key] = args;
     if (action !== "set" && action !== "unset" || id2 == null || key == null || key.startsWith("-")) {
-      throw new Error(USAGE2);
+      throw new Error(USAGE3);
     }
     if (action === "set") {
       await setSecret(id2, key, flagValue(args, "--value"));
@@ -35347,7 +35609,7 @@ var runIntegration = async (args) => {
   }
   const [, id] = args;
   if (id == null || operation !== "configure" && operation !== "config") {
-    throw new Error(USAGE2);
+    throw new Error(USAGE3);
   }
   if (operation === "configure") {
     const raw2 = await readValue(flagValue(args, "--config"), "--config");
@@ -35471,6 +35733,7 @@ var ID_PREFIXES = {
   automation_email_address: { prefix: "aea", body: 10 },
   automation_email_alert: { prefix: "aes", body: 10 },
   automation_error_alert_queue: { prefix: "aeaq", body: 10 },
+  billing_period: { prefix: "bpd", body: 12 },
   browser_automation: { prefix: "bra", body: 10 },
   browser_automation_run: { prefix: "brr", body: 20 },
   browser_session_usage: { prefix: "bsu", body: 12 },
@@ -35575,6 +35838,108 @@ var idTableByPrefix = (id) => {
   return best?.table ?? null;
 };
 
+// src/commands/resource.ts
+var resources = {
+  workspace: { collection: "workspaces", mutation: "updateWorkspace", result: "workspace", patch: "WorkspacePatch", fields: "id name description isArchived", editable: ["name", "description", "isArchived"] },
+  automation: { collection: "automations", mutation: "updateAutomation", result: "automation", patch: "AutomationPatch", fields: "id name description isArchived isActive workspaceId", editable: ["name", "description", "isArchived", "isActive"] },
+  function: { collection: "functions", mutation: "updateFunction", result: "function", patch: "FunctionPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
+  web_page: { collection: "webPages", mutation: "updateWebPage", result: "webPage", patch: "WebPagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
+  printable_page: { collection: "printablePages", mutation: "updatePrintablePage", result: "printablePage", patch: "PrintablePagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
+  agent: { collection: "agents", mutation: "updateAgent", result: "agent", patch: "AgentPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
+  integration: { collection: "integrations", mutation: "updateIntegration", result: "integration", patch: "IntegrationPatch", fields: "id name description isArchived integrationTypeId workspaceId", editable: ["name", "description", "isArchived", "integrationTypeId"] },
+  table_space: { collection: "tableSpaces", mutation: "updateTableSpace", result: "tableSpace", patch: "TableSpacePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
+  data_stream: { collection: "dataStreams", mutation: "updateDataStream", result: "dataStream", patch: "DataStreamPatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
+  knowledge_base: { collection: "knowledgeBases", mutation: "updateKnowledgeBase", result: "knowledgeBase", patch: "KnowledgeBasePatch", fields: "id name description isArchived embeddingModel workspaceId", editable: ["name", "description", "isArchived"] },
+  data_file: { collection: "dataFiles", mutation: "updateDataFile", result: "dataFile", patch: "DataFilePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
+  action_runner: { collection: "actionRunners", mutation: "updateActionRunner", result: "actionRunner", patch: "ActionRunnerPatch", fields: "id isArchived actionTimeoutSeconds config workspaceId identityId identity { name }", editable: ["isArchived", "actionTimeoutSeconds", "config"] }
+  // Keyed by table so `idTableByPrefix` can index it; `satisfies` rejects a key
+  // the registry does not know.
+};
+var resourceFor = (id) => {
+  const table = idTableByPrefix(id);
+  const resource = table == null ? void 0 : resources[table];
+  if (resource == null) throw new Error(`Unsupported resource id: ${id}`);
+  return resource;
+};
+var readResource = async (id, resource) => {
+  const data = await gqlRequest(
+    `query CliResource($id: String!) {
+      ${resource.collection}(condition: { idIgnoringCase: $id }, includeArchived: YES, first: 1) {
+        nodes { ${resource.fields} }
+      }
+    }`,
+    { id }
+  );
+  const row = data[resource.collection]?.nodes[0];
+  if (row == null) throw new Error(`Resource ${id} not found.`);
+  return row;
+};
+var runResource = async (args) => {
+  const [operation, id] = args;
+  if (operation !== "show" && operation !== "update" || id == null) {
+    throw new Error("Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive]");
+  }
+  const resource = resourceFor(id);
+  if (operation === "show") {
+    printResult(await readResource(id, resource), resolveFormat(flagValue(args, "-o", "--output")));
+    return;
+  }
+  const patch = {};
+  const scalarFlags = [
+    ["name", "--name"],
+    ["description", "--description"],
+    ["integrationTypeId", "--type"],
+    ["actionTimeoutSeconds", "--timeout"]
+  ];
+  scalarFlags.forEach(([field, flag]) => {
+    const value = flagValue(args, flag);
+    if (value != null && resource.editable.includes(field)) {
+      patch[field] = field === "actionTimeoutSeconds" ? Number(value) : value;
+    }
+  });
+  [
+    ["isArchived", "--archive", true],
+    ["isArchived", "--restore", false],
+    ["isEnabled", "--enable", true],
+    ["isEnabled", "--disable", false],
+    ["isActive", "--active", true],
+    ["isActive", "--inactive", false]
+  ].forEach(([field, flag, value]) => {
+    if (args.includes(flag) && resource.editable.includes(field)) patch[field] = value;
+  });
+  const config = await readValue(flagValue(args, "--config"), "--config");
+  if (config != null && resource.editable.includes("config")) {
+    try {
+      patch.config = JSON.parse(config);
+    } catch {
+      throw new Error("--config must be valid JSON (or @<file> containing JSON).");
+    }
+  }
+  const current = await readResource(id, resource);
+  const name2 = flagValue(args, "--name");
+  if (name2 != null && idTableByPrefix(id) === "action_runner") {
+    const result = await gqlRequest(
+      `mutation CliRenameRunner($id: String!, $name: String!) {
+        updateIdentity(input: { id: $id, patch: { name: $name } }) { identity { id } }
+      }`,
+      { id: current.identityId, name: name2 }
+    );
+    if (result.updateIdentity?.identity == null) throw new Error(`Runner ${id} could not be renamed; check your workspace role.`);
+  }
+  if (Object.keys(patch).length > 0) {
+    const result = await gqlRequest(
+      `mutation CliUpdateResource($id: String!, $patch: ${resource.patch}!) {
+        ${resource.mutation}(input: { id: $id, patch: $patch }) { updated: ${resource.result} { id } }
+      }`,
+      { id: current.id, patch }
+    );
+    if (result[resource.mutation]?.updated == null) throw new Error(`Resource ${id} was not updated; check that it exists and your workspace role allows editing.`);
+  } else if (!(name2 != null && idTableByPrefix(id) === "action_runner")) {
+    throw new Error(`No supported changes supplied for ${id}.`);
+  }
+  printResult(await readResource(current.id, resource), resolveFormat(flagValue(args, "-o", "--output")));
+};
+
 // src/commands/open.ts
 var ROUTE_BY_TYPE = {
   automation: "automations",
@@ -35600,7 +35965,7 @@ var ROUTE_BY_TABLE = {
 var runOpen = async (args) => {
   const filter2 = args.find((a) => !a.startsWith("-"));
   const { organizationId } = await getAccessToken();
-  const url = (() => {
+  const url = await (async () => {
     const manifest = (() => {
       try {
         return readManifest(findWorkspaceRoot());
@@ -35613,11 +35978,11 @@ var runOpen = async (args) => {
         return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/workspaces/${manifest.workspaceId}`;
       }
       const match = Object.entries(manifest.resources).find(
-        ([id, r]) => id === filter2 || r.name.toLowerCase().includes(filter2.toLowerCase()) || r.files.some((f) => f.includes(filter2))
+        ([id2, r]) => id2.toLowerCase() === filter2.toLowerCase() || r.name.toLowerCase().includes(filter2.toLowerCase()) || r.files.some((f) => f.includes(filter2))
       );
       if (match != null) {
-        const [id, resource] = match;
-        return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/${ROUTE_BY_TYPE[resource.type]}/${id}`;
+        const [id2, resource2] = match;
+        return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/${ROUTE_BY_TYPE[resource2.type]}/${id2}`;
       }
     }
     if (filter2 == null) {
@@ -35632,7 +35997,9 @@ var runOpen = async (args) => {
         `Nothing matched "${filter2}" (not a tracked resource or a recognized id prefix).`
       );
     }
-    return `${appBaseUrl(apiBaseUrl())}/${organizationId}/${route}/${filter2}`;
+    const resource = table == null ? void 0 : resources[table];
+    const id = resource == null ? filter2 : (await readResource(filter2, resource)).id;
+    return `${appBaseUrl(apiBaseUrl())}/${organizationId}/${route}/${id}`;
   })();
   process.stdout.write(`${url}
 `);
@@ -35640,7 +36007,7 @@ var runOpen = async (args) => {
 };
 
 // src/commands/org.ts
-import { createInterface } from "readline/promises";
+import { createInterface as createInterface2 } from "readline/promises";
 var USER_ORGS_QUERY = `
   query UserOrganizations($identityId: String!) {
     identityOrganizations(condition: { identityId: $identityId }) {
@@ -35770,7 +36137,7 @@ var promptForOrg = async () => {
 `
     );
   });
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     const answer = await rl.question("Switch to: ");
     const chosen = rows[Number(answer.trim()) - 1];
@@ -36577,108 +36944,6 @@ var runReport = async (args) => {
   );
 };
 
-// src/commands/resource.ts
-var resources = {
-  workspace: { collection: "workspaces", mutation: "updateWorkspace", result: "workspace", patch: "WorkspacePatch", fields: "id name description isArchived", editable: ["name", "description", "isArchived"] },
-  automation: { collection: "automations", mutation: "updateAutomation", result: "automation", patch: "AutomationPatch", fields: "id name description isArchived isActive workspaceId", editable: ["name", "description", "isArchived", "isActive"] },
-  function: { collection: "functions", mutation: "updateFunction", result: "function", patch: "FunctionPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
-  web_page: { collection: "webPages", mutation: "updateWebPage", result: "webPage", patch: "WebPagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
-  printable_page: { collection: "printablePages", mutation: "updatePrintablePage", result: "printablePage", patch: "PrintablePagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
-  agent: { collection: "agents", mutation: "updateAgent", result: "agent", patch: "AgentPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
-  integration: { collection: "integrations", mutation: "updateIntegration", result: "integration", patch: "IntegrationPatch", fields: "id name description isArchived integrationTypeId workspaceId", editable: ["name", "description", "isArchived", "integrationTypeId"] },
-  table_space: { collection: "tableSpaces", mutation: "updateTableSpace", result: "tableSpace", patch: "TableSpacePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
-  data_stream: { collection: "dataStreams", mutation: "updateDataStream", result: "dataStream", patch: "DataStreamPatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
-  knowledge_base: { collection: "knowledgeBases", mutation: "updateKnowledgeBase", result: "knowledgeBase", patch: "KnowledgeBasePatch", fields: "id name description isArchived embeddingModel workspaceId", editable: ["name", "description", "isArchived"] },
-  data_file: { collection: "dataFiles", mutation: "updateDataFile", result: "dataFile", patch: "DataFilePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
-  action_runner: { collection: "actionRunners", mutation: "updateActionRunner", result: "actionRunner", patch: "ActionRunnerPatch", fields: "id isArchived actionTimeoutSeconds config workspaceId identityId identity { name }", editable: ["isArchived", "actionTimeoutSeconds", "config"] }
-  // Keyed by table so `idTableByPrefix` can index it; `satisfies` rejects a key
-  // the registry does not know.
-};
-var resourceFor = (id) => {
-  const table = idTableByPrefix(id);
-  const resource = table == null ? void 0 : resources[table];
-  if (resource == null) throw new Error(`Unsupported resource id: ${id}`);
-  return resource;
-};
-var readResource = async (id, resource) => {
-  const data = await gqlRequest(
-    `query CliResource($id: String!) {
-      ${resource.collection}(condition: { id: $id }, includeArchived: YES, first: 1) {
-        nodes { ${resource.fields} }
-      }
-    }`,
-    { id }
-  );
-  const row = data[resource.collection]?.nodes[0];
-  if (row == null) throw new Error(`Resource ${id} not found.`);
-  return row;
-};
-var runResource = async (args) => {
-  const [operation, id] = args;
-  if (operation !== "show" && operation !== "update" || id == null) {
-    throw new Error("Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive]");
-  }
-  const resource = resourceFor(id);
-  if (operation === "show") {
-    printResult(await readResource(id, resource), resolveFormat(flagValue(args, "-o", "--output")));
-    return;
-  }
-  const patch = {};
-  const scalarFlags = [
-    ["name", "--name"],
-    ["description", "--description"],
-    ["integrationTypeId", "--type"],
-    ["actionTimeoutSeconds", "--timeout"]
-  ];
-  scalarFlags.forEach(([field, flag]) => {
-    const value = flagValue(args, flag);
-    if (value != null && resource.editable.includes(field)) {
-      patch[field] = field === "actionTimeoutSeconds" ? Number(value) : value;
-    }
-  });
-  [
-    ["isArchived", "--archive", true],
-    ["isArchived", "--restore", false],
-    ["isEnabled", "--enable", true],
-    ["isEnabled", "--disable", false],
-    ["isActive", "--active", true],
-    ["isActive", "--inactive", false]
-  ].forEach(([field, flag, value]) => {
-    if (args.includes(flag) && resource.editable.includes(field)) patch[field] = value;
-  });
-  const config = await readValue(flagValue(args, "--config"), "--config");
-  if (config != null && resource.editable.includes("config")) {
-    try {
-      patch.config = JSON.parse(config);
-    } catch {
-      throw new Error("--config must be valid JSON (or @<file> containing JSON).");
-    }
-  }
-  const name2 = flagValue(args, "--name");
-  if (name2 != null && idTableByPrefix(id) === "action_runner") {
-    const current = await readResource(id, resource);
-    const result = await gqlRequest(
-      `mutation CliRenameRunner($id: String!, $name: String!) {
-        updateIdentity(input: { id: $id, patch: { name: $name } }) { identity { id } }
-      }`,
-      { id: current.identityId, name: name2 }
-    );
-    if (result.updateIdentity?.identity == null) throw new Error(`Runner ${id} could not be renamed; check your workspace role.`);
-  }
-  if (Object.keys(patch).length > 0) {
-    const result = await gqlRequest(
-      `mutation CliUpdateResource($id: String!, $patch: ${resource.patch}!) {
-        ${resource.mutation}(input: { id: $id, patch: $patch }) { updated: ${resource.result} { id } }
-      }`,
-      { id, patch }
-    );
-    if (result[resource.mutation]?.updated == null) throw new Error(`Resource ${id} was not updated; check that it exists and your workspace role allows editing.`);
-  } else if (!(name2 != null && idTableByPrefix(id) === "action_runner")) {
-    throw new Error(`No supported changes supplied for ${id}.`);
-  }
-  printResult(await readResource(id, resource), resolveFormat(flagValue(args, "-o", "--output")));
-};
-
 // src/docs/bestPractices.ts
 var platform2 = `# OverAI platform primer
 
@@ -36794,7 +37059,20 @@ A page version's config JSON carries the code; the CLI splits it into
 language, customTitle, hideTopBar, ...). Push reassembles them.
 
 - Web pages are React (TSX). Printable pages are React or Liquid.
-- Web page config authorizationMode defaults to "workspace" for shared access.
+- Web page config authorizationMode defaults to "workspace": every end user
+  who opens the page gets a workspace token that can read AND write every
+  table space in the workspace and any shared into it, call any function it
+  reaches, trigger any of its automations, and call any agent visible to it.
+  Four rules follow:
+  1. The workspace is the unit of trust. Everything in it trusts everything
+     else, and a page's end users count as "in it."
+  2. A public workspace is public all the way down. Public (or
+     password-protected) is a workspace setting, not a page setting; every table space, function, automation
+     and agent in it is reachable by anyone who can open a page.
+  3. Sharing into a workspace extends its trust. A table space shared into a
+     public or password-protected workspace is public.
+  4. Cross a trust line with a function, not a table. Keep data in a private
+     workspace and share a function into the page's workspace.
   Opt into "viewer" for personal pages spanning the signed-in viewer's workspaces.
   Page code uses their permissions; results/access errors can differ by user.
   Public links require sign-in. Save and deploy publishes the mode with the code.
@@ -36840,8 +37118,9 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
   null. Identity-scoped features degrade: useAgentChat streams but persists
   nothing (conversationId stays null, useAgentConversations is empty, the
   conversation helpers throw), and author-requiring writes like
-  env.DFxxx.saveVersion 401. Reads use the workspace's own access, so treat
-  anything the page can query as public.
+  env.DFxxx.saveVersion 401. The page runs on the workspace token, so anyone
+  with the link can read and write every table space and call every function,
+  automation and agent the workspace reaches (rule 2 above).
 - meta.json \`runtime\`: "v2" serves the page from its own origin (separate
   process, real localStorage/cookies \u2014 no noSandbox needed); absent or "v1" is
   the sandboxed srcdoc iframe. Anything else is rejected on push.
@@ -36887,11 +37166,15 @@ esm.sh imports allowed. The CLI materializes <slug>.<id>.ts (code) and
 executionMemory MB, callerAccess).
 
 - New functions allow only callers with workspace access by default. Set
-  callerAccess to "public" in meta.json only when an unauthenticated endpoint is
-  intended. Existing functions retain their saved policy when older meta.json
-  files omit this field. The policy is versioned: deploy the saved version to
-  change who can call the live endpoint. Workspace uses Authorization for the
-  platform bearer token; put additional application credentials in another header.
+  callerAccess to "organization" to accept members of the function's organization
+  or tokens from any private workspace in that organization without a share.
+  A public-workspace token does not qualify; when a token has both workspace and
+  user claims, the workspace claim takes precedence. Set callerAccess to "public"
+  only when an unauthenticated endpoint is intended. Existing functions retain
+  their saved policy when older meta.json files omit this field. The policy is
+  versioned: deploy the saved version to change live access. Use Authorization
+  for the platform bearer token; put application credentials in another header.
+  Test as a user, a workspace, and anonymous before deploying.
 - Functions are full HTTP apps: method + sub-path are forwarded to your code,
   and each execution records requestMethod/requestPath. Callers reach a route
   with env.FNxxx.call({ method, path: "/features/123" }) \u2014 path defaults to the
@@ -37172,7 +37455,7 @@ var runReview = async () => {
 };
 
 // src/commands/sql.ts
-import { createInterface as createInterface2 } from "readline";
+import { createInterface as createInterface3 } from "readline";
 
 // src/commands/sqlCredential.ts
 var connectionString = async (tableSpaceId, secret) => {
@@ -37316,7 +37599,7 @@ transaction \u2014 BEGIN/SET/temp tables don't carry across statements.
 `;
 var runRepl = async (organizationId, tableSpaceId, format2) => {
   const interactive = process.stdin.isTTY;
-  const rl = createInterface2({
+  const rl = createInterface3({
     input: process.stdin,
     ...interactive ? { output: process.stdout, historySize: 1e3, terminal: true } : {}
   });
@@ -37462,10 +37745,10 @@ var runSql = async (args) => {
 
 // src/commands/storage.ts
 import { openAsBlob, writeFileSync as writeFileSync6 } from "fs";
-var USAGE3 = "Usage: overai storage upload <path> [--no-random-prefix] | storage download <key> [path|-] | storage exists <key> | storage head <key> [--lines N] | storage presign <key> [--expires-in <seconds>]";
+var USAGE4 = "Usage: overai storage upload <path> [--no-random-prefix] | storage download <key> [path|-] | storage exists <key> | storage head <key> [--lines N] | storage presign <key> [--expires-in <seconds>]";
 var runStorage = async (args) => {
   const [operation, first2, second] = args;
-  if (operation == null) throw new Error(USAGE3);
+  if (operation == null) throw new Error(USAGE4);
   const { organizationId } = await getAccessToken();
   const segment = (key) => encodeURIComponent(key);
   if (operation === "upload") {
@@ -37496,7 +37779,7 @@ var runStorage = async (args) => {
 `);
     return;
   }
-  if (first2 == null) throw new Error(USAGE3);
+  if (first2 == null) throw new Error(USAGE4);
   if (operation === "download") {
     const response = await v2Fetch(
       `/v2/storage/${organizationId}/${segment(first2)}`,
@@ -37553,7 +37836,7 @@ var runStorage = async (args) => {
 `);
     return;
   }
-  throw new Error(USAGE3);
+  throw new Error(USAGE4);
 };
 
 // src/commands/workspace.ts
@@ -37639,7 +37922,7 @@ var listWorkspaceUsers = async (args) => {
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
-var USAGE4 = `Usage:
+var USAGE5 = `Usage:
   overai workspace list [--archived] [--limit <n>]
   overai workspace show [workspaceId]
   overai workspace users [workspaceId]
@@ -37657,7 +37940,7 @@ var runWorkspace = async (args) => {
     await listWorkspaceUsers(args.slice(1));
     return;
   }
-  process.stderr.write(USAGE4);
+  process.stderr.write(USAGE5);
   process.exitCode = 1;
 };
 
@@ -37815,6 +38098,8 @@ Automations:
 
 Other resources:
   overai agent generate <agentId> --message <text|@file|@->
+  overai agent tools <agentId> [--version <n>]
+  overai agent chat <agentId> [--conversation <id>] [--message <text>]
   overai data-stream append <id> <json|@file|@->
   overai data-stream query <id> --start <date> --end <date> [--query <filter>]
   overai data-file upload <id> <path> [-m <message>]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.14.5",
+  "version": "0.14.7",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",