@parall/cli 1.36.1 → 1.37.0

package/dist/commands/dm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dm.d.ts","sourceRoot":"","sources":["../../src/commands/dm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiCpC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,QAwDlD"}
+{"version":3,"file":"dm.d.ts","sourceRoot":"","sources":["../../src/commands/dm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuCpC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,QA+DlD"}

package/dist/commands/dm.js

@@ -1,5 +1,6 @@
 import { resolveCredentials, resolveRuntimeContext } from '../lib/client.js';
 import { printJson, printError, printRefHint, stripPrllScheme } from '../lib/output.js';
+import { NO_BODY_ERROR, resolveMessageText, TEXT_FILE_OPTION_DESC, TEXT_OPTION_DESC, } from '../lib/text-input.js';
 import { uploadFile } from '../lib/upload.js';
 /**
  * Resolve a name-or-id argument to a user ID.
@@ -25,7 +26,8 @@ export function registerDMCommands(program) {
         .command('dm')
         .description('Send a direct message to a user by name or ID (auto-creates chat if needed)')
         .argument('<nameOrId>', 'Target user display name or ID (usr_...)')
-        .option('--text <text>', 'Message text')
+        .option('--text <text>', TEXT_OPTION_DESC)
+        .option('--text-file <path>', TEXT_FILE_OPTION_DESC)
         .option('--file <path>', 'Upload and attach a local file')
         .option('--attachment <id>', 'Attach an existing attachment (att_xxx or prll://att_xxx)')
         .option('--no-reply', 'Hint that the recipient should not reply')
@@ -38,7 +40,7 @@ export function registerDMCommands(program) {
                 printError(new Error('--file and --attachment are mutually exclusive'));
                 return;
             }
-            const text = opts.text || '';
+            const text = resolveMessageText(opts) || '';
             let attachmentIds;
             if (opts.file) {
                 const result = await uploadFile(client, orgId, opts.file);
@@ -48,7 +50,7 @@ export function registerDMCommands(program) {
                 attachmentIds = [stripPrllScheme(opts.attachment)];
             }
             if (!text && !attachmentIds) {
-                printError(new Error('Provide --text, --file, or --attachment'));
+                printError(new Error(NO_BODY_ERROR));
                 return;
             }
             const req = {

package/dist/commands/messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/commands/messages.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QAwJvD"}
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/commands/messages.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QA0JvD"}

package/dist/commands/messages.js

@@ -1,6 +1,7 @@
 import { ApiError } from '@parall/sdk';
 import { resolveCredentials, resolveRuntimeContext } from '../lib/client.js';
 import { printError, printJson, printRefHint, stripPrllScheme } from '../lib/output.js';
+import { NO_BODY_ERROR, resolveMessageText, TEXT_FILE_OPTION_DESC, TEXT_OPTION_DESC, } from '../lib/text-input.js';
 import { uploadFile } from '../lib/upload.js';
 export function registerMessageCommands(program) {
     const messages = program.command('messages').description('Manage messages');
@@ -53,7 +54,8 @@ export function registerMessageCommands(program) {
         .command('send')
         .description('Send a message to a chat (text, file, or both)')
         .argument('[chatId]', 'Chat ID (defaults to PRLL_CHAT_ID if set)')
-        .option('--text <text>', 'Message text')
+        .option('--text <text>', TEXT_OPTION_DESC)
+        .option('--text-file <path>', TEXT_FILE_OPTION_DESC)
         .option('--file <path>', 'Upload and attach a local file')
         .option('--attachment <id>', 'Attach an existing attachment (att_xxx or prll://att_xxx)')
         .option('--thread-root-id <id>', 'Reply to a thread')
@@ -70,14 +72,14 @@ export function registerMessageCommands(program) {
             // `messages send` targets a chat. A user id here is an addressing
             // mistake — point at `dm` instead of letting the server reject it.
             if (chatId.startsWith('usr_')) {
-                printError(new ApiError(400, `prll://${chatId} is a user, not a chat. To message a user use: parall dm prll://${chatId} --text "..."`, 'INVALID_TARGET'));
+                printError(new ApiError(400, `prll://${chatId} is a user, not a chat. To message a user use: parall dm prll://${chatId} --text-file -`, 'INVALID_TARGET'));
                 return;
             }
             if (opts.file && opts.attachment) {
                 printError(new Error('--file and --attachment are mutually exclusive'));
                 return;
             }
-            const text = opts.text || '';
+            const text = resolveMessageText(opts) || '';
             let attachmentIds;
             if (opts.file) {
                 const result = await uploadFile(client, orgId, opts.file);
@@ -87,7 +89,7 @@ export function registerMessageCommands(program) {
                 attachmentIds = [stripPrllScheme(opts.attachment)];
             }
             if (!text && !attachmentIds) {
-                printError(new Error('Provide --text, --file, or --attachment'));
+                printError(new Error(NO_BODY_ERROR));
                 return;
             }
             const req = {

package/dist/commands/tasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../src/commands/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QAqTpD"}
+{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../src/commands/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QA6UpD"}

package/dist/commands/tasks.js

@@ -268,10 +268,20 @@ export function registerTaskCommands(program) {
         .command('watch')
         .description('Watch a task (subscribe to comment notifications)')
         .argument('<taskId>', 'Task ID')
-        .action(async (taskId) => {
+        .option('--user-id <userId>', 'Subscribe another user instead of yourself (requires you to be the task creator, assignee, project lead, or an org owner/admin)')
+        .action(async (taskId, opts) => {
         try {
             const { client, orgId } = resolveCredentials();
-            await client.watchTask(orgId, stripPrllScheme(taskId));
+            const normalizedTaskId = stripPrllScheme(taskId);
+            const targetUserId = opts.userId ? stripPrllScheme(opts.userId) : undefined;
+            // A self-targeted --user-id is equivalent to plain self-watch; route it
+            // back to /watch so the behaviour matches `parall tasks watch` exactly.
+            if (targetUserId && targetUserId !== (await client.getMe()).id) {
+                await client.subscribeTaskMember(orgId, normalizedTaskId, targetUserId);
+            }
+            else {
+                await client.watchTask(orgId, normalizedTaskId);
+            }
             printJson({ ok: true });
         }
         catch (err) {
@@ -282,10 +292,20 @@ export function registerTaskCommands(program) {
         .command('unwatch')
         .description('Unwatch a task (stop receiving comment notifications)')
         .argument('<taskId>', 'Task ID')
-        .action(async (taskId) => {
+        .option('--user-id <userId>', 'Unsubscribe another user instead of yourself (requires you to be the task creator, assignee, project lead, or an org owner/admin)')
+        .action(async (taskId, opts) => {
         try {
             const { client, orgId } = resolveCredentials();
-            await client.unwatchTask(orgId, stripPrllScheme(taskId));
+            const normalizedTaskId = stripPrllScheme(taskId);
+            const targetUserId = opts.userId ? stripPrllScheme(opts.userId) : undefined;
+            // A self-targeted --user-id is equivalent to plain self-unwatch; route it
+            // back to /watch so the behaviour matches `parall tasks unwatch` exactly.
+            if (targetUserId && targetUserId !== (await client.getMe()).id) {
+                await client.unsubscribeTaskMember(orgId, normalizedTaskId, targetUserId);
+            }
+            else {
+                await client.unwatchTask(orgId, normalizedTaskId);
+            }
             printJson({ ok: true });
         }
         catch (err) {

package/dist/lib/text-input.d.ts

@@ -0,0 +1,30 @@
+export declare const TEXT_OPTION_DESC = "Message text (shell-safe only for short literals with no $, backtick, or quote)";
+export declare const TEXT_FILE_OPTION_DESC = "Read message text from a file ('-' = stdin) \u2014 shell-safe channel for content with $, backticks, or quotes";
+export declare const NO_BODY_ERROR = "Provide --text, --text-file, --file, or --attachment";
+/**
+ * Resolve message body text from the mutually-exclusive `--text` / `--text-file`
+ * options shared by `messages send` and `dm`.
+ *
+ * Agents build these commands with an LLM and run them through a shell, so any
+ * body passed as a double-quoted `--text "..."` argument is mangled by shell
+ * expansion *before* the CLI ever sees it: `$1,000` becomes `,000`, `$USER`
+ * expands, and `` `cmd` `` / `$(cmd)` execute. Single quotes are no better —
+ * they break on the apostrophes that fill natural-language replies. `--text-file`
+ * sidesteps the shell entirely: the body comes from a file the agent wrote (raw
+ * bytes, no shell) or from stdin via a quoted heredoc (`<<'EOF'`, which disables
+ * all expansion). `-` means stdin.
+ *
+ * A single trailing newline — the structural newline a heredoc or editor appends
+ * — is stripped so a one-line reply doesn't arrive with a dangling blank line;
+ * this mirrors how `$(...)` command substitution trims trailing newlines, and
+ * leading/interior whitespace is preserved untouched.
+ *
+ * Returns `undefined` when neither option is set (preserving the old
+ * `opts.text`-or-nothing contract). Throws on conflicting options or an
+ * unreadable file; callers already funnel that into `printError`.
+ */
+export declare function resolveMessageText(opts: {
+    text?: string;
+    textFile?: string;
+}): string | undefined;
+//# sourceMappingURL=text-input.d.ts.map

package/dist/lib/text-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text-input.d.ts","sourceRoot":"","sources":["../../src/lib/text-input.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,gBAAgB,oFACsD,CAAC;AACpF,eAAO,MAAM,qBAAqB,mHAC2E,CAAC;AAC9G,eAAO,MAAM,aAAa,yDAAyD,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CA8BjG"}

package/dist/lib/text-input.js

@@ -0,0 +1,61 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+// Shared option help + validation copy for the message-body flags, so
+// `messages send` and `dm` stay in lockstep. commander's --help prints these
+// verbatim (no markdown), so keep them backtick-free.
+export const TEXT_OPTION_DESC = 'Message text (shell-safe only for short literals with no $, backtick, or quote)';
+export const TEXT_FILE_OPTION_DESC = "Read message text from a file ('-' = stdin) — shell-safe channel for content with $, backticks, or quotes";
+export const NO_BODY_ERROR = 'Provide --text, --text-file, --file, or --attachment';
+/**
+ * Resolve message body text from the mutually-exclusive `--text` / `--text-file`
+ * options shared by `messages send` and `dm`.
+ *
+ * Agents build these commands with an LLM and run them through a shell, so any
+ * body passed as a double-quoted `--text "..."` argument is mangled by shell
+ * expansion *before* the CLI ever sees it: `$1,000` becomes `,000`, `$USER`
+ * expands, and `` `cmd` `` / `$(cmd)` execute. Single quotes are no better —
+ * they break on the apostrophes that fill natural-language replies. `--text-file`
+ * sidesteps the shell entirely: the body comes from a file the agent wrote (raw
+ * bytes, no shell) or from stdin via a quoted heredoc (`<<'EOF'`, which disables
+ * all expansion). `-` means stdin.
+ *
+ * A single trailing newline — the structural newline a heredoc or editor appends
+ * — is stripped so a one-line reply doesn't arrive with a dangling blank line;
+ * this mirrors how `$(...)` command substitution trims trailing newlines, and
+ * leading/interior whitespace is preserved untouched.
+ *
+ * Returns `undefined` when neither option is set (preserving the old
+ * `opts.text`-or-nothing contract). Throws on conflicting options or an
+ * unreadable file; callers already funnel that into `printError`.
+ */
+export function resolveMessageText(opts) {
+    if (opts.text !== undefined && opts.textFile !== undefined) {
+        throw new Error('--text and --text-file are mutually exclusive');
+    }
+    if (opts.textFile === undefined)
+        return opts.text;
+    let raw;
+    if (opts.textFile === '-') {
+        // fd 0 = stdin; readFileSync drains a heredoc / pipe synchronously. Guard
+        // the interactive case — reading a TTY would block until EOF (which an
+        // agent never sends), hanging the dispatch until its deadline.
+        if (process.stdin.isTTY) {
+            throw new Error("--text-file - reads the body from stdin; pipe it in (e.g. a quoted heredoc `<<'EOF'`), don't run it interactively");
+        }
+        raw = fs.readFileSync(0, 'utf-8');
+    }
+    else {
+        const resolved = path.resolve(opts.textFile);
+        try {
+            raw = fs.readFileSync(resolved, 'utf-8');
+        }
+        catch (err) {
+            // Surface the underlying reason (missing / no permission / is-a-directory)
+            // so the agent can self-correct — printError renders only `.message` — and
+            // keep the original error as `cause` for anything that inspects it.
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new Error(`Cannot read --text-file ${opts.textFile}: ${reason}`, { cause: err });
+        }
+    }
+    return raw.replace(/\r?\n$/, '');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/cli",
-  "version": "1.36.1",
+  "version": "1.37.0",
   "description": "CLI client for Parall — universal agent & human access to Parall API",
   "license": "MIT",
   "repository": {
@@ -36,13 +36,13 @@
     "diff": "^8.0.3",
     "js-yaml": "^4.1.0",
     "zod": "^4.3.6",
-    "@parall/sdk": "1.36.1"
+    "@parall/sdk": "1.37.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "typescript": "^5.7.0",
-    "@parall/agent-core": "1.36.1"
+    "@parall/agent-core": "1.37.0"
   },
   "scripts": {
     "build": "tsc",