@parall/cli 1.36.0 → 1.37.0

package/dist/commands/dm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dm.d.ts","sourceRoot":"","sources":["../../src/commands/dm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiCpC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,QAwDlD"}
+{"version":3,"file":"dm.d.ts","sourceRoot":"","sources":["../../src/commands/dm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuCpC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,QA+DlD"}

package/dist/commands/dm.js

@@ -1,5 +1,6 @@
 import { resolveCredentials, resolveRuntimeContext } from '../lib/client.js';
 import { printJson, printError, printRefHint, stripPrllScheme } from '../lib/output.js';
+import { NO_BODY_ERROR, resolveMessageText, TEXT_FILE_OPTION_DESC, TEXT_OPTION_DESC, } from '../lib/text-input.js';
 import { uploadFile } from '../lib/upload.js';
 /**
  * Resolve a name-or-id argument to a user ID.
@@ -25,7 +26,8 @@ export function registerDMCommands(program) {
         .command('dm')
         .description('Send a direct message to a user by name or ID (auto-creates chat if needed)')
         .argument('<nameOrId>', 'Target user display name or ID (usr_...)')
-        .option('--text <text>', 'Message text')
+        .option('--text <text>', TEXT_OPTION_DESC)
+        .option('--text-file <path>', TEXT_FILE_OPTION_DESC)
         .option('--file <path>', 'Upload and attach a local file')
         .option('--attachment <id>', 'Attach an existing attachment (att_xxx or prll://att_xxx)')
         .option('--no-reply', 'Hint that the recipient should not reply')
@@ -38,7 +40,7 @@ export function registerDMCommands(program) {
                 printError(new Error('--file and --attachment are mutually exclusive'));
                 return;
             }
-            const text = opts.text || '';
+            const text = resolveMessageText(opts) || '';
             let attachmentIds;
             if (opts.file) {
                 const result = await uploadFile(client, orgId, opts.file);
@@ -48,7 +50,7 @@ export function registerDMCommands(program) {
                 attachmentIds = [stripPrllScheme(opts.attachment)];
             }
             if (!text && !attachmentIds) {
-                printError(new Error('Provide --text, --file, or --attachment'));
+                printError(new Error(NO_BODY_ERROR));
                 return;
             }
             const req = {

package/dist/commands/messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/commands/messages.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QAqJvD"}
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/commands/messages.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QA0JvD"}

package/dist/commands/messages.js

@@ -1,6 +1,7 @@
 import { ApiError } from '@parall/sdk';
 import { resolveCredentials, resolveRuntimeContext } from '../lib/client.js';
 import { printError, printJson, printRefHint, stripPrllScheme } from '../lib/output.js';
+import { NO_BODY_ERROR, resolveMessageText, TEXT_FILE_OPTION_DESC, TEXT_OPTION_DESC, } from '../lib/text-input.js';
 import { uploadFile } from '../lib/upload.js';
 export function registerMessageCommands(program) {
     const messages = program.command('messages').description('Manage messages');
@@ -11,6 +12,7 @@ export function registerMessageCommands(program) {
         .option('--limit <n>', 'Maximum number of messages to return', '20')
         .option('--before <cursor>', 'Cursor for messages before')
         .option('--after <cursor>', 'Cursor for messages after')
+        .option('--since <date>', 'Only messages at/after this time (RFC3339 or YYYY-MM-DD)')
         .option('--thread-root-id <id>', 'Filter by thread root message ID')
         .option('--top-level', 'Only return top-level messages')
         .action(async (chatId, opts) => {
@@ -21,6 +23,8 @@ export function registerMessageCommands(program) {
                 params.before = stripPrllScheme(opts.before);
             if (opts.after !== undefined)
                 params.after = stripPrllScheme(opts.after);
+            if (opts.since !== undefined)
+                params.since = opts.since;
             if (opts.threadRootId !== undefined)
                 params.thread_root_id = stripPrllScheme(opts.threadRootId);
             if (opts.topLevel)
@@ -50,7 +54,8 @@ export function registerMessageCommands(program) {
         .command('send')
         .description('Send a message to a chat (text, file, or both)')
         .argument('[chatId]', 'Chat ID (defaults to PRLL_CHAT_ID if set)')
-        .option('--text <text>', 'Message text')
+        .option('--text <text>', TEXT_OPTION_DESC)
+        .option('--text-file <path>', TEXT_FILE_OPTION_DESC)
         .option('--file <path>', 'Upload and attach a local file')
         .option('--attachment <id>', 'Attach an existing attachment (att_xxx or prll://att_xxx)')
         .option('--thread-root-id <id>', 'Reply to a thread')
@@ -67,14 +72,14 @@ export function registerMessageCommands(program) {
             // `messages send` targets a chat. A user id here is an addressing
             // mistake — point at `dm` instead of letting the server reject it.
             if (chatId.startsWith('usr_')) {
-                printError(new ApiError(400, `prll://${chatId} is a user, not a chat. To message a user use: parall dm prll://${chatId} --text "..."`, 'INVALID_TARGET'));
+                printError(new ApiError(400, `prll://${chatId} is a user, not a chat. To message a user use: parall dm prll://${chatId} --text-file -`, 'INVALID_TARGET'));
                 return;
             }
             if (opts.file && opts.attachment) {
                 printError(new Error('--file and --attachment are mutually exclusive'));
                 return;
             }
-            const text = opts.text || '';
+            const text = resolveMessageText(opts) || '';
             let attachmentIds;
             if (opts.file) {
                 const result = await uploadFile(client, orgId, opts.file);
@@ -84,7 +89,7 @@ export function registerMessageCommands(program) {
                 attachmentIds = [stripPrllScheme(opts.attachment)];
             }
             if (!text && !attachmentIds) {
-                printError(new Error('Provide --text, --file, or --attachment'));
+                printError(new Error(NO_BODY_ERROR));
                 return;
             }
             const req = {

package/dist/commands/refs.d.ts

@@ -1,3 +1,10 @@
 import { Command } from 'commander';
+/** Build the SDK ref-graph params from the positional URI + CLI flags. */
+export declare function buildRefGraphParams(uri: string, opts: {
+    depth?: string;
+}): {
+    uri: string;
+    depth?: number;
+};
 export declare function registerRefCommands(program: Command): void;
 //# sourceMappingURL=refs.d.ts.map

package/dist/commands/refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../src/commands/refs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,QA+CnD"}
+{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../src/commands/refs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,0EAA0E;AAC1E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAOjC;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,QA+DnD"}

package/dist/commands/refs.js

@@ -1,5 +1,15 @@
 import { resolveCredentials } from '../lib/client.js';
-import { printJson, printError } from '../lib/output.js';
+import { ensurePrllScheme, parsePositiveInt, printError, printJson } from '../lib/output.js';
+/** Build the SDK ref-graph params from the positional URI + CLI flags. */
+export function buildRefGraphParams(uri, opts) {
+    const params = { uri: ensurePrllScheme(uri) };
+    // Drop a non-positive-integer --depth (NaN / 1.5 / -2) so the server applies
+    // its default; the server clamps the valid range (1–4) regardless.
+    const depth = parsePositiveInt(opts.depth);
+    if (depth !== undefined)
+        params.depth = depth;
+    return params;
+}
 export function registerRefCommands(program) {
     const refs = program.command('refs').description('Reference resolution and backlinks');
     refs
@@ -34,6 +44,20 @@ export function registerRefCommands(program) {
             printError(err);
         }
     });
+    refs
+        .command('graph <uri>')
+        .description('Multi-hop traversal of the prll:// reference graph around an entity-level URI (no path/anchor)')
+        .option('--depth <n>', 'Hops to traverse outward (server clamps to 1–4)', '2')
+        .action(async (uri, opts) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.getRefsGraph(orgId, buildRefGraphParams(uri, opts));
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
     refs
         .command('check')
         .description('Check for broken references in the organization (admin only)')

package/dist/commands/search.d.ts

@@ -0,0 +1,20 @@
+import type { SearchParams } from '@parall/sdk';
+import { Command } from 'commander';
+/**
+ * Normalize a `--types m,t,w` flag into the server's CSV of canonical entity
+ * names (`message,task,wiki`). Unknown tokens pass through unchanged so the
+ * server can reject/ignore them. Returns undefined for an empty/absent flag so
+ * the server applies its default (search all three).
+ */
+export declare function normalizeSearchTypes(raw?: string): string | undefined;
+export interface SearchOpts {
+    types?: string;
+    channel?: string;
+    limit?: string;
+    wikiType?: string;
+    since?: string;
+}
+/** Build the SDK search params from the positional query + CLI flags. */
+export declare function buildSearchParams(query: string, opts: SearchOpts): SearchParams;
+export declare function registerSearchCommands(program: Command): void;
+//# sourceMappingURL=search.d.ts.map

package/dist/commands/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../src/commands/search.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBpC;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASrE;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,CAY/E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,QA4BtD"}

package/dist/commands/search.js

@@ -0,0 +1,70 @@
+import { resolveCredentials } from '../lib/client.js';
+import { parsePositiveInt, printError, printJson, stripPrllScheme } from '../lib/output.js';
+// Short aliases agents pass via --types map to the server's entity names.
+const TYPE_ALIASES = {
+    m: 'message',
+    message: 'message',
+    messages: 'message',
+    t: 'task',
+    task: 'task',
+    tasks: 'task',
+    w: 'wiki',
+    wiki: 'wiki',
+};
+/**
+ * Normalize a `--types m,t,w` flag into the server's CSV of canonical entity
+ * names (`message,task,wiki`). Unknown tokens pass through unchanged so the
+ * server can reject/ignore them. Returns undefined for an empty/absent flag so
+ * the server applies its default (search all three).
+ */
+export function normalizeSearchTypes(raw) {
+    if (!raw)
+        return undefined;
+    const mapped = raw
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean)
+        .map((s) => TYPE_ALIASES[s] ?? s);
+    const unique = [...new Set(mapped)];
+    return unique.length > 0 ? unique.join(',') : undefined;
+}
+/** Build the SDK search params from the positional query + CLI flags. */
+export function buildSearchParams(query, opts) {
+    const params = { q: query };
+    const types = normalizeSearchTypes(opts.types);
+    if (types)
+        params.types = types;
+    if (opts.channel !== undefined)
+        params.chat_id = stripPrllScheme(opts.channel);
+    // Only forward a clean positive integer; a bad --limit falls through to the
+    // server default rather than sending NaN/1.5/-2.
+    const limit = parsePositiveInt(opts.limit);
+    if (limit !== undefined)
+        params.limit = limit;
+    if (opts.wikiType !== undefined)
+        params.wiki_type = opts.wikiType;
+    if (opts.since !== undefined)
+        params.since = opts.since;
+    return params;
+}
+export function registerSearchCommands(program) {
+    program
+        .command('search')
+        .description('Unified semantic search across messages, tasks, and wiki (org-scoped)')
+        .argument('<query>', 'Search query')
+        .option('--types <list>', 'Comma-separated entity types: m[essage], t[ask], w[iki] (default: all)')
+        .option('--channel <chatId>', 'Narrow MESSAGE results to one chat — tasks/wiki unaffected (prll://cht_… or cht_…)')
+        .option('--limit <n>', 'Max results per entity type (server caps at 50)')
+        .option('--wiki-type <type>', 'Narrow wiki results to a frontmatter document type')
+        .option('--since <date>', 'Only messages/tasks at or after this time (RFC3339 or YYYY-MM-DD); not applied to wiki')
+        .action(async (query, opts) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.search(orgId, buildSearchParams(query, opts));
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+}

package/dist/commands/tasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../src/commands/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QAqTpD"}
+{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../src/commands/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QA6UpD"}

package/dist/commands/tasks.js

@@ -268,10 +268,20 @@ export function registerTaskCommands(program) {
         .command('watch')
         .description('Watch a task (subscribe to comment notifications)')
         .argument('<taskId>', 'Task ID')
-        .action(async (taskId) => {
+        .option('--user-id <userId>', 'Subscribe another user instead of yourself (requires you to be the task creator, assignee, project lead, or an org owner/admin)')
+        .action(async (taskId, opts) => {
         try {
             const { client, orgId } = resolveCredentials();
-            await client.watchTask(orgId, stripPrllScheme(taskId));
+            const normalizedTaskId = stripPrllScheme(taskId);
+            const targetUserId = opts.userId ? stripPrllScheme(opts.userId) : undefined;
+            // A self-targeted --user-id is equivalent to plain self-watch; route it
+            // back to /watch so the behaviour matches `parall tasks watch` exactly.
+            if (targetUserId && targetUserId !== (await client.getMe()).id) {
+                await client.subscribeTaskMember(orgId, normalizedTaskId, targetUserId);
+            }
+            else {
+                await client.watchTask(orgId, normalizedTaskId);
+            }
             printJson({ ok: true });
         }
         catch (err) {
@@ -282,10 +292,20 @@ export function registerTaskCommands(program) {
         .command('unwatch')
         .description('Unwatch a task (stop receiving comment notifications)')
         .argument('<taskId>', 'Task ID')
-        .action(async (taskId) => {
+        .option('--user-id <userId>', 'Unsubscribe another user instead of yourself (requires you to be the task creator, assignee, project lead, or an org owner/admin)')
+        .action(async (taskId, opts) => {
         try {
             const { client, orgId } = resolveCredentials();
-            await client.unwatchTask(orgId, stripPrllScheme(taskId));
+            const normalizedTaskId = stripPrllScheme(taskId);
+            const targetUserId = opts.userId ? stripPrllScheme(opts.userId) : undefined;
+            // A self-targeted --user-id is equivalent to plain self-unwatch; route it
+            // back to /watch so the behaviour matches `parall tasks unwatch` exactly.
+            if (targetUserId && targetUserId !== (await client.getMe()).id) {
+                await client.unsubscribeTaskMember(orgId, normalizedTaskId, targetUserId);
+            }
+            else {
+                await client.unwatchTask(orgId, normalizedTaskId);
+            }
             printJson({ ok: true });
         }
         catch (err) {

package/dist/index.js

@@ -16,6 +16,7 @@ import { registerWikiCommands } from './commands/wiki.js';
 import { registerMcpCommands } from './commands/mcp.js';
 import { registerNoReplyCommands } from './commands/no-reply.js';
 import { registerRefCommands } from './commands/refs.js';
+import { registerSearchCommands } from './commands/search.js';
 import { registerFileCommands } from './commands/files.js';
 import { registerMachineCommands } from './commands/machines.js';
 import { registerClipCommands } from './commands/clip.js';
@@ -41,6 +42,7 @@ registerWikiCommands(program);
 registerMcpCommands(program);
 registerNoReplyCommands(program);
 registerRefCommands(program);
+registerSearchCommands(program);
 registerFileCommands(program);
 registerMachineCommands(program);
 registerClipCommands(program);

package/dist/lib/output.d.ts

@@ -9,5 +9,17 @@ export declare function printRefHint(entityId: string, action?: string): void;
  * Allows CLI commands to accept both raw IDs (`tsk_abc`) and URIs (`prll://tsk_abc`).
  */
 export declare function stripPrllScheme(idOrUri: string): string;
+/**
+ * Ensure a value carries the `prll://` scheme — the inverse of stripPrllScheme.
+ * Lets URI-consuming commands accept both `tsk_abc` and `prll://tsk_abc`.
+ */
+export declare function ensurePrllScheme(idOrUri: string): string;
+/**
+ * Parse a CLI numeric flag (string) into a positive integer, or undefined when
+ * absent or not a clean positive integer (NaN / fractional / <= 0). Callers omit
+ * the param on undefined so the server applies its own default + bounds rather
+ * than receiving a malformed value.
+ */
+export declare function parsePositiveInt(raw: string | undefined): number | undefined;
 export declare function printError(err: unknown): never;
 //# sourceMappingURL=output.d.ts.map

package/dist/lib/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAEA,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE7C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,IAAI,CAEvE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAwC9C"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAEA,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE7C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,IAAI,CAEvE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW5E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAwC9C"}

package/dist/lib/output.js

@@ -16,6 +16,33 @@ export function printRefHint(entityId, action = 'Created') {
 export function stripPrllScheme(idOrUri) {
     return idOrUri.startsWith('prll://') ? idOrUri.slice(7) : idOrUri;
 }
+/**
+ * Ensure a value carries the `prll://` scheme — the inverse of stripPrllScheme.
+ * Lets URI-consuming commands accept both `tsk_abc` and `prll://tsk_abc`.
+ */
+export function ensurePrllScheme(idOrUri) {
+    return idOrUri.startsWith('prll://') ? idOrUri : `prll://${idOrUri}`;
+}
+/**
+ * Parse a CLI numeric flag (string) into a positive integer, or undefined when
+ * absent or not a clean positive integer (NaN / fractional / <= 0). Callers omit
+ * the param on undefined so the server applies its own default + bounds rather
+ * than receiving a malformed value.
+ */
+export function parsePositiveInt(raw) {
+    if (raw === undefined)
+        return undefined;
+    // Plain decimal digits only — reject the scientific/hex/float forms Number()
+    // would otherwise coerce (1e2, 0x10, 1.5) so "clean positive integer" holds.
+    const t = raw.trim();
+    if (!/^\d+$/.test(t))
+        return undefined;
+    // The regex alone is NOT enough: a digit-only string of hundreds of digits
+    // overflows Number() to Infinity, which Number.isInteger rejects — so this
+    // guard still does real work (keeps `limit=Infinity` off the wire).
+    const n = Number(t);
+    return Number.isInteger(n) && n > 0 ? n : undefined;
+}
 export function printError(err) {
     if (err instanceof ApiError) {
         // Faithful, parseable line: the server's real message + machine anchors.

package/dist/lib/text-input.d.ts

@@ -0,0 +1,30 @@
+export declare const TEXT_OPTION_DESC = "Message text (shell-safe only for short literals with no $, backtick, or quote)";
+export declare const TEXT_FILE_OPTION_DESC = "Read message text from a file ('-' = stdin) \u2014 shell-safe channel for content with $, backticks, or quotes";
+export declare const NO_BODY_ERROR = "Provide --text, --text-file, --file, or --attachment";
+/**
+ * Resolve message body text from the mutually-exclusive `--text` / `--text-file`
+ * options shared by `messages send` and `dm`.
+ *
+ * Agents build these commands with an LLM and run them through a shell, so any
+ * body passed as a double-quoted `--text "..."` argument is mangled by shell
+ * expansion *before* the CLI ever sees it: `$1,000` becomes `,000`, `$USER`
+ * expands, and `` `cmd` `` / `$(cmd)` execute. Single quotes are no better —
+ * they break on the apostrophes that fill natural-language replies. `--text-file`
+ * sidesteps the shell entirely: the body comes from a file the agent wrote (raw
+ * bytes, no shell) or from stdin via a quoted heredoc (`<<'EOF'`, which disables
+ * all expansion). `-` means stdin.
+ *
+ * A single trailing newline — the structural newline a heredoc or editor appends
+ * — is stripped so a one-line reply doesn't arrive with a dangling blank line;
+ * this mirrors how `$(...)` command substitution trims trailing newlines, and
+ * leading/interior whitespace is preserved untouched.
+ *
+ * Returns `undefined` when neither option is set (preserving the old
+ * `opts.text`-or-nothing contract). Throws on conflicting options or an
+ * unreadable file; callers already funnel that into `printError`.
+ */
+export declare function resolveMessageText(opts: {
+    text?: string;
+    textFile?: string;
+}): string | undefined;
+//# sourceMappingURL=text-input.d.ts.map

package/dist/lib/text-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text-input.d.ts","sourceRoot":"","sources":["../../src/lib/text-input.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,gBAAgB,oFACsD,CAAC;AACpF,eAAO,MAAM,qBAAqB,mHAC2E,CAAC;AAC9G,eAAO,MAAM,aAAa,yDAAyD,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CA8BjG"}

package/dist/lib/text-input.js

@@ -0,0 +1,61 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+// Shared option help + validation copy for the message-body flags, so
+// `messages send` and `dm` stay in lockstep. commander's --help prints these
+// verbatim (no markdown), so keep them backtick-free.
+export const TEXT_OPTION_DESC = 'Message text (shell-safe only for short literals with no $, backtick, or quote)';
+export const TEXT_FILE_OPTION_DESC = "Read message text from a file ('-' = stdin) — shell-safe channel for content with $, backticks, or quotes";
+export const NO_BODY_ERROR = 'Provide --text, --text-file, --file, or --attachment';
+/**
+ * Resolve message body text from the mutually-exclusive `--text` / `--text-file`
+ * options shared by `messages send` and `dm`.
+ *
+ * Agents build these commands with an LLM and run them through a shell, so any
+ * body passed as a double-quoted `--text "..."` argument is mangled by shell
+ * expansion *before* the CLI ever sees it: `$1,000` becomes `,000`, `$USER`
+ * expands, and `` `cmd` `` / `$(cmd)` execute. Single quotes are no better —
+ * they break on the apostrophes that fill natural-language replies. `--text-file`
+ * sidesteps the shell entirely: the body comes from a file the agent wrote (raw
+ * bytes, no shell) or from stdin via a quoted heredoc (`<<'EOF'`, which disables
+ * all expansion). `-` means stdin.
+ *
+ * A single trailing newline — the structural newline a heredoc or editor appends
+ * — is stripped so a one-line reply doesn't arrive with a dangling blank line;
+ * this mirrors how `$(...)` command substitution trims trailing newlines, and
+ * leading/interior whitespace is preserved untouched.
+ *
+ * Returns `undefined` when neither option is set (preserving the old
+ * `opts.text`-or-nothing contract). Throws on conflicting options or an
+ * unreadable file; callers already funnel that into `printError`.
+ */
+export function resolveMessageText(opts) {
+    if (opts.text !== undefined && opts.textFile !== undefined) {
+        throw new Error('--text and --text-file are mutually exclusive');
+    }
+    if (opts.textFile === undefined)
+        return opts.text;
+    let raw;
+    if (opts.textFile === '-') {
+        // fd 0 = stdin; readFileSync drains a heredoc / pipe synchronously. Guard
+        // the interactive case — reading a TTY would block until EOF (which an
+        // agent never sends), hanging the dispatch until its deadline.
+        if (process.stdin.isTTY) {
+            throw new Error("--text-file - reads the body from stdin; pipe it in (e.g. a quoted heredoc `<<'EOF'`), don't run it interactively");
+        }
+        raw = fs.readFileSync(0, 'utf-8');
+    }
+    else {
+        const resolved = path.resolve(opts.textFile);
+        try {
+            raw = fs.readFileSync(resolved, 'utf-8');
+        }
+        catch (err) {
+            // Surface the underlying reason (missing / no permission / is-a-directory)
+            // so the agent can self-correct — printError renders only `.message` — and
+            // keep the original error as `cause` for anything that inspects it.
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new Error(`Cannot read --text-file ${opts.textFile}: ${reason}`, { cause: err });
+        }
+    }
+    return raw.replace(/\r?\n$/, '');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/cli",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "description": "CLI client for Parall — universal agent & human access to Parall API",
   "license": "MIT",
   "repository": {
@@ -36,13 +36,13 @@
     "diff": "^8.0.3",
     "js-yaml": "^4.1.0",
     "zod": "^4.3.6",
-    "@parall/sdk": "1.36.0"
+    "@parall/sdk": "1.37.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "typescript": "^5.7.0",
-    "@parall/agent-core": "1.36.0"
+    "@parall/agent-core": "1.37.0"
   },
   "scripts": {
     "build": "tsc",