@plotio/cli 0.3.0 → 0.5.0

package/README.md

@@ -1,6 +1,6 @@
 # @plotio/cli
 
-`plot`: read Plot pages, follow a meeting while it happens, and post back, from
+`plot`: read Plot pages, follow a meeting while it happens, and write back, from
 any agent with a shell (Claude Code, Codex CLI, Amp, OpenCode) or a script.
 
 Plot records conversations — meetings, calls, voice notes — as shared pages: a
@@ -33,6 +33,14 @@ a hash. Each is kept once redeemed, so later shells need nothing.
   browser, against the authorization server the API itself names — so `--api`
   at a local or preview deployment signs in on that deployment's own web app,
   never production's.
+- **A workspace, with no browser anywhere.** Someone signed in to Plot creates
+  a token in Settings > Agents and hands it over. Set `PLOT_TOKEN` (and
+  `PLOT_API_URL` unless it is production) and every command works with no login
+  and nothing stored, which is what a sandbox or a CI job wants.
+
+Whoever grants the access also chooses whether the agent may post. Allowed
+drafts only, `plot message` still works and `--send` is refused
+(`draft_only`); `plot whoami` says so under **Writes**.
 
 `plot login` ends three ways, and what it can see decides which:
 
@@ -48,21 +56,24 @@ a hash. Each is kept once redeemed, so later shells need nothing.
 
 ## Commands
 
-| Command                                                     | Does                                                                          |
-| ----------------------------------------------------------- | ----------------------------------------------------------------------------- |
-| `plot open <temp_code_…> [--agent <name>]`                  | Redeem a handoff code and store the page token                                |
-| `plot login [--agent] [--no-browser]`                       | Connect a workspace: sign in and approve in the browser                       |
-| `plot login --code <code>`                                  | Finish a login started without a terminal, with the code the browser showed   |
-| `plot logout [<page>] [--all]`                              | Revoke a credential on the server, then forget it                             |
-| `plot whoami [<page>] [--json]`                             | What the credential acts for, its scope and expiry                            |
-| `plot pages [--limit <n>] [--next <c>] [--json]`            | Pages the workspace grant can read, newest first                              |
-| `plot read <page> [--json]`                                 | The page as Markdown (topics included), or as JSON; stores the updates cursor |
-| `plot watch <page> [--level …] [options]`                   | Wait for the next update, print it, store the cursor                          |
-| `plot topics <page>`                                        | Topics as JSON, with the quotes behind each point                             |
-| `plot search <query> [--limit] [--next] [--json]`           | Search every page the workspace grant can read                                |
-| `plot post <page> [--branch <id>] [--body <t>]`             | Post a message (body from `--body`, else stdin), idempotent per run           |
-| `plot mcp-config [--host <h>] [--token] [--write] [<page>]` | The MCP server block for a host: the `<api>/mcp` URL, signed in with OAuth    |
-| `plot help agents`                                          | The guide for an AI agent                                                     |
+| Command                                                       | Does                                                                          |
+| ------------------------------------------------------------- | ----------------------------------------------------------------------------- |
+| `plot open <temp_code_…> [--agent <name>]`                    | Redeem a handoff code and store the page token                                |
+| `plot login [--agent] [--no-browser]`                         | Connect a workspace: sign in and approve in the browser                       |
+| `plot login --code <code>`                                    | Finish a login started without a terminal, with the code the browser showed   |
+| `plot logout [<page>] [--all]`                                | Revoke a credential on the server, then forget it                             |
+| `plot whoami [<page>] [--json]`                               | What the credential acts for, its scope and expiry                            |
+| `plot pages [--limit <n>] [--next <c>] [--json]`              | Pages the workspace grant can read, newest first                              |
+| `plot read <page> [--json]`                                   | The page as Markdown (topics included), or as JSON; stores the updates cursor |
+| `plot watch <page> [--level …] [options]`                     | Wait for the next update, print it, store the cursor                          |
+| `plot topics <page>`                                          | Topics as JSON, with the quotes behind each point                             |
+| `plot task <page> [--status <s>] [--assign <id>]…`            | A task page's Status and assignees; with an option, set them                  |
+| `plot search <query> [--limit] [--next] [--json]`             | Search every page the workspace grant can read                                |
+| `plot message <page> [--body <t>] [--branch] [--note] [--id]` | Draft a message into the person's composer (body from `--body`, else stdin)   |
+| `plot message <page> --send …`                                | Post it now instead, shown as your agent, for the person                      |
+| `plot message <page> --show\|--discard [<id>]`                | Read back or withdraw a draft (the last one made here by default)             |
+| `plot mcp-config [--host <h>] [--token] [--write] [<page>]`   | The MCP server block for a host: the `<api>/mcp` URL, signed in with OAuth    |
+| `plot help agents`                                            | The guide for an AI agent                                                     |
 
 `<page>` is a page id or a page URL (`https://www.plot.io/p/<id>`).
 
@@ -119,7 +130,8 @@ calls expired or revoked is removed and the next one tried.
 `~/.config/plot/credentials.json`, mode `0600` in a `0700` directory. It is
 keyed by API base, so production's tokens and a preview's never collide — and
 so changing `--api` or `PLOT_API_URL` changes which credential is in play. It
-also holds each page's last `watch` cursor, which is how a new shell resumes.
+also holds each page's last `watch` cursor, which is how a new shell resumes,
+and the id of the last message `plot message` made there.
 `plot logout --all` revokes and removes everything for the current API base.
 
 A `plot login` with no TTY leaves a `pending-login.json` beside it, same mode,

package/dist/plot.js

@@ -6,22 +6,22 @@ import { parseArgs } from "node:util";
 // src/errors.ts
 var CliError = class extends Error {
   exitCode;
-  constructor(message, exitCode = 1) {
-    super(message);
+  constructor(message2, exitCode = 1) {
+    super(message2);
     this.name = "CliError";
     this.exitCode = exitCode;
   }
 };
 var UsageError = class extends CliError {
-  constructor(message) {
-    super(`${message}
+  constructor(message2) {
+    super(`${message2}
 Run "plot --help" for usage.`, 2);
     this.name = "UsageError";
   }
 };
 
 // src/version.ts
-var VERSION = "0.3.0";
+var VERSION = "0.5.0";
 
 // src/api.ts
 var DEFAULT_API_URL = "https://agents.plot.io";
@@ -29,8 +29,8 @@ var ApiError = class extends Error {
   status;
   /** The server's machine reason (`expired`, `no_access`, …), or `network`/`http`. */
   code;
-  constructor(status, code, message) {
-    super(message);
+  constructor(status, code, message2) {
+    super(message2);
     this.name = "ApiError";
     this.status = status;
     this.code = code;
@@ -61,6 +61,7 @@ var UPDATE_LEVELS = [
 ];
 var MAX_WAIT_SECONDS = 240;
 var CURSOR_HEADER = "X-Plot-Updates-Cursor";
+var TASK_STATUSES = ["Todo", "Doing", "Done"];
 function createApi(opts) {
   const fetchFn = opts.fetch ?? fetch;
   const base = opts.base;
@@ -214,6 +215,50 @@ function createApi(opts) {
       });
       return { body: await json(response), cursor: cursorFrom(response) };
     },
+    /** GET /v1/pages/:id/attachments/:id: where one file's bytes are. */
+    async attachment(token, pageId, attachmentId, variant) {
+      const response = await request(
+        "GET",
+        `/v1/pages/${enc(pageId)}/attachments/${enc(attachmentId)}`,
+        { token, query: { variant } }
+      );
+      return await json(response);
+    },
+    /**
+     * The bytes, from the presigned URL the call above handed back.
+     *
+     * No Authorization header, and not through `request`, which would add
+     * one. R2 signs a presigned URL in the query string and refuses a
+     * request that also carries an Authorization header, with
+     * `400 InvalidRequest: Missing x-amz-content-sha256` — an error naming a
+     * header nobody was trying to send, which is why it is written down.
+     *
+     * Note what does *not* need defending against: Node's fetch and `curl`
+     * both drop the header themselves when following a cross-origin
+     * redirect, so `?redirect=1` is safe with either. The way to meet this
+     * is to send the header on purpose, which is what any authenticated
+     * fetch wrapper does — including this file's own `request`.
+     */
+    async download(url) {
+      let response;
+      try {
+        response = await fetchFn(new URL(url), { method: "GET" });
+      } catch (err) {
+        throw new ApiError(
+          0,
+          "network",
+          `Could not fetch the file: ${err.message}`
+        );
+      }
+      if (!response.ok) {
+        throw new ApiError(
+          response.status,
+          "download_failed",
+          `The storage service answered ${response.status} for that file. A signed URL lives only a few minutes; ask for it again.`
+        );
+      }
+      return new Uint8Array(await response.arrayBuffer());
+    },
     /**
      * GET /v1/pages/:id/updates. `wait` is honoured by the production proxy
      * (a long poll, capped at MAX_WAIT_SECONDS) and ignored by Convex directly, so
@@ -242,6 +287,24 @@ function createApi(opts) {
         await request("GET", `/v1/pages/${enc(pageId)}/topics`, { token })
       );
     },
+    /**
+     * PATCH /v1/pages/:id/task: set a task page's Status, its assignees, or
+     * both. Only the fields given are sent. 400 `not_a_task` on any other
+     * page; a grant that cannot post is refused as a send is.
+     */
+    async updateTask(token, pageId, update) {
+      const body = {};
+      if (update.status !== void 0) body.status = update.status;
+      if (update.assigneeIds !== void 0) {
+        body.assigneeIds = update.assigneeIds;
+      }
+      return json(
+        await request("PATCH", `/v1/pages/${enc(pageId)}/task`, {
+          token,
+          body
+        })
+      );
+    },
     /** GET /v1/search?q=. */
     async search(token, q, page2 = {}) {
       return json(
@@ -252,32 +315,65 @@ function createApi(opts) {
       );
     },
     /**
-     * POST /v1/pages/:id/messages. `id` makes the post idempotent, which is
-     * what lets a transport failure (no answer, or a gateway 5xx) be retried
-     * with the same id: the server posts it once however many times it
-     * arrives. A refusal with a reason is never retried.
+     * POST /v1/pages/:id/messages: a draft in the person's composer, or with
+     * `send` a message on the page. `id` makes it idempotent, which is what
+     * lets a transport failure (no answer, or a gateway 5xx) be retried with
+     * the same id: the server acts once however many times it arrives. A
+     * refusal with a reason is never retried. Returns the HTTP status too,
+     * since 201 (new) and 200 (an existing draft updated) differ only there.
      */
-    async post(token, pageId, message, retry = {}) {
-      const body = {
-        body: message.body,
-        id: message.id
-      };
-      if (message.branchId) body.branchId = message.branchId;
+    async createMessage(token, pageId, message2, retry = {}) {
+      const body = {};
+      if (message2.body !== void 0) body.body = message2.body;
+      body.id = message2.id;
+      if (message2.branchId) body.branchId = message2.branchId;
+      if (message2.send) body.send = true;
+      if (message2.note) body.note = message2.note;
       const attempts = retry.attempts ?? 3;
       for (let attempt = 1; ; attempt++) {
         try {
-          return await json(
-            await request("POST", `/v1/pages/${enc(pageId)}/messages`, {
-              token,
-              body
-            })
+          const response = await request(
+            "POST",
+            `/v1/pages/${enc(pageId)}/messages`,
+            { token, body }
           );
+          return {
+            status: response.status,
+            body: await json(response)
+          };
         } catch (err) {
           const transport = err instanceof ApiError && (err.code === "network" || [502, 503, 504].includes(err.status));
           if (!transport || attempt >= attempts) throw err;
           await retry.sleep?.(1e3 * attempt);
         }
       }
+    },
+    /**
+     * GET /v1/pages/:id/messages/:messageId: a draft's words and note, or
+     * just `status: 'sent'` once it is on the page. 404 `no_draft` when the
+     * id names nothing of the person's.
+     */
+    async getMessage(token, pageId, messageId) {
+      const body = await json(
+        await request(
+          "GET",
+          `/v1/pages/${enc(pageId)}/messages/${enc(messageId)}`,
+          { token }
+        )
+      );
+      return "message" in body && body.message && typeof body.message === "object" ? body.message : body;
+    },
+    /**
+     * DELETE /v1/pages/:id/messages/:messageId: withdraw a draft. 204; 404
+     * `no_draft`; 403 `not_a_draft` for a message already sent, which the
+     * agent surface never deletes.
+     */
+    async discardMessage(token, pageId, messageId) {
+      await request(
+        "DELETE",
+        `/v1/pages/${enc(pageId)}/messages/${enc(messageId)}`,
+        { token }
+      );
     }
   };
 }
@@ -296,8 +392,8 @@ async function errorFrom(response) {
     const body = JSON.parse(text);
     if (body && typeof body === "object") {
       const code = typeof body.error === "string" ? body.error : "http";
-      const message = typeof body.message === "string" && body.message ? body.message : `Request failed with HTTP ${response.status} (${code}).`;
-      return new ApiError(response.status, code, message);
+      const message2 = typeof body.message === "string" && body.message ? body.message : `Request failed with HTTP ${response.status} (${code}).`;
+      return new ApiError(response.status, code, message2);
     }
   } catch {
   }
@@ -349,6 +445,7 @@ var KNOWN_NODES = /* @__PURE__ */ new Set([
   ...INLINE_NODES
 ]);
 var KNOWN_MARKS = new Set(MARKS);
+var MAX_DOC_DEPTH = 20;
 var MAX_DOC_BYTES = 256 * 1024;
 var MARKDOWN_SYNTAX = new RegExp(
   [
@@ -385,6 +482,9 @@ var MARKDOWN_SYNTAX = new RegExp(
   ].join("|"),
   "m"
 );
+var MAX_PARAGRAPH_DEPTH = MAX_DOC_DEPTH - 1;
+var MAX_QUOTE_DEPTH = MAX_DOC_DEPTH - 2;
+var MAX_LIST_DEPTH = MAX_DOC_DEPTH - 3;
 
 // ../shared/src/transcriptDelta.ts
 var INT64_MAX = BigInt("9223372036854775807");
@@ -405,9 +505,13 @@ Usage: plot <command> [options]
   read <page> [--json]                  The page as Markdown, topics included
   watch <page> [--level <level>]        Wait for what is new since the last watch
   topics <page>                         The page's topics as JSON
+  files <page> [--get <id>] [--out <p>] Files on the page; --get writes one to disk
+  task <page> [--status <s>]            A task's Status and assignees, or set them
   search <query> [--limit] [--next]    Search your pages (workspace login)
-  post <page> [--branch <id>] [--body <text> | stdin]
-                                        Post a message onto the page
+  message <page> [--body <text> | stdin] Draft a message into the person's composer
+  message <page> --send \u2026               Or post it as them, only when they asked
+  message <page> --show|--discard [<id>]
+                                        Read back or withdraw a draft
   mcp-config [--host <host>] [--write]  Config block for an MCP host
   help agents                           How an AI agent should use this
 
@@ -430,11 +534,21 @@ Get access (once; the token is stored, so later shells need nothing):
                                                 the code the page shows. Then:
   plot login --code <code>                      Finishes it (within ten minutes)
 
+If nobody can open a browser for you at all, ask your person for a token from
+Plot's Settings > Agents, and export PLOT_TOKEN=plot_agent_sk_\u2026 in your shell
+(plus PLOT_API_URL if they say so). Then no login is needed.
+
 Read:
   plot read <page>            The page as Markdown: transcript, then Topics.
                               A later watch starts from the end of this read.
   plot read <page> --json     The same, structured
   plot topics <page>          Topics as JSON, with the quotes behind each point
+  plot files <page>           Files on the page, with the ids read prints
+  plot files <page> --get <id>
+                              Writes that file where you can open it and
+                              prints the path. This is how you look at a
+                              screenshot or a PDF someone attached: fetch
+                              it, then read the path with your own tools
   plot pages                  Pages you can read (workspace login only)
   plot search "<words>"       Find a page or a moment (workspace login only)
 
@@ -449,7 +563,16 @@ Follow a meeting that is still happening:
                               tool's own timeout, e.g. --timeout 100)
 
 Write back (only if the person who gave you access can post):
-  plot post <page> --body "\u2026"   Appears as the person, marked "via <your name>"
+  plot message <page> --body "\u2026"         Goes into their composer as a draft for them to send
+  plot message <page> --send --body "\u2026"  Appears at once, as you, for the person:
+                                         only when they asked you to post
+
+A task page carries a Status (Todo, Doing, Done) and Assignees; plot read
+shows them on the line under the title. If you are working a task, say
+where you stand on the page itself, with the same access as a send:
+  plot task <page> --status Doing        When you start
+  plot task <page> --status Done         When it is finished
+  plot task <page>                       Just print the Status and assignees
 
 <page> is a page id or a link like https://www.plot.io/p/<id>.
 
@@ -527,17 +650,80 @@ stored cursor the server refuses is dropped and the watch starts over.
 
 The page's topics as JSON: title, emoji, summary and points with their
 source quotes and message ids.`,
+  files: `plot files <page> [--json]
+plot files <page> --get <id> [--out <path>] [--original]
+
+The files people attached to messages on the page: name, type, size, an
+image's pixel size, and the id. The same ids "plot read" prints.
+
+--get <id> fetches one and writes it where you can open it, printing the
+path it wrote. That is the point of this command: your file-reading tool
+takes a path, and the signed URL behind the file lives five minutes.
+
+For an image you get the preview Plot made (bounded, WebP, a fraction of
+the bytes) unless you ask for --original; everything else has only the
+original. The bytes come straight from storage, never through Plot.
+  --get <id>        Fetch this file
+  --out <path>      Write it here instead of the cache directory
+                    ($XDG_CACHE_HOME/plot/files/<page>/, else ~/.cache/...).
+                    "--out -" writes the bytes to stdout and nothing to disk
+  --original        The file as uploaded, rather than the preview
+  --variant <v>     original or preview, said explicitly
+  --json            The file's fields, with the path it was written to`,
+  task: `plot task <page> [--status Todo|Doing|Done] [--assign <userId>]...
+                 [--unassign-all] [--json]
+
+A task page's fields, as the line under its title in "plot read": Status
+and Assignees, and the page it is part of. With no options it prints them;
+with any, it sets them and prints the result. An option left out leaves
+that field as it is. A page that is not a task is refused before anything
+is written.
+  --status <s>      Todo, Doing or Done
+  --assign <id>     Make this user an assignee; repeat for more. Replaces the
+                    assignees, so name everyone who should stay. User ids are
+                    the members' ids in "plot read <page> --json"
+  --unassign-all    Leave the task with no assignees
+  --json            Print the task block (status, assignees with id and name)
+
+Setting needs a member who can post: a viewer's grant is refused (read_only)
+as a send is.`,
   search: `plot search <query> [--limit <n>] [--next <cursor>] [--json]
 
 Searches every page the workspace grant can read: messages, topics and page
 fields, each with pageId, pageTitle, url, snippet and at. Needs "plot login".`,
-  post: `plot post <page> [--branch <id>] [--body <text>]
+  message: `plot message <page> [--branch <id>] [--note <line>] [--id <id>]
+             [--body <text> | stdin]
+plot message <page> --send \u2026
+plot message <page> --show [<id>]
+plot message <page> --discard [<id>]
+
+Puts Markdown words (from --body, else stdin) into the composer of the
+person who granted access, on that page, as a draft: nobody else sees it,
+and it reaches the page only when they send it (or they discard it). Prints
+the message id and the page URL. One draft per lane: a second draft on the
+same lane replaces the first, and says so.
+  --branch <id>   Draft a reply on that branch instead of the main thread
+  --note <line>   One line to the person, shown with the draft (200 chars)
+  --id <id>       Use this message id (8 to 64 of A-Z a-z 0-9 _ -). The same
+                  id again updates that draft in place. Each run otherwise
+                  makes one id, so a retry after a dropped connection lands
+                  once
+
+--send posts it now instead, shown as your agent, for the person. Use it
+only when they asked you to post. With no words given it sends your earlier
+draft as it stands, formatting intact: the one --id names, else the last one
+made here. A grant that cannot post is refused (read_only), never quietly
+turned into a draft, and so is one whose person allowed drafts only
+(draft_only) \u2014 the same command without --send still works.
 
-Posts a text message onto the page, from --body or else from stdin. It
-appears as the person who granted access, marked as posted via your agent.
-Needs a member who can post; a viewer's grant is refused (read_only). Each
-run sends one idempotency id, so a retry after a dropped connection posts
-once.`,
+--show reads a draft back (its words and note), or says it was sent.
+--discard withdraws a draft; a sent message cannot be withdrawn here
+(not_a_draft). Both act on <id>, else --id, else the last message this
+machine made on the page.
+
+Needs a member who can post: a viewer's grant is refused (read_only) for a
+draft as for a send. plot whoami says "Writes: drafts only" for a grant that
+was connected without the send.`,
   "mcp-config": `plot mcp-config [--host <host>] [--write] [--token]
                 [--inline-token] [<page>]
 
@@ -726,7 +912,10 @@ function renderPages(pages2, next) {
   const rows = pages2.map((page2) => {
     const extras = [
       page2.unread ? `${page2.unread} unread` : "",
-      page2.canPost === false ? "read-only" : ""
+      // Three states, not two: a draft-only grant may still write into the
+      // person's composer here, and labelling that "read-only" tells the
+      // agent not to try.
+      page2.canPost === false ? page2.canDraft ? "drafts only" : "read-only" : ""
     ].filter(Boolean);
     const when = formatTime(page2.updatedAt);
     return [
@@ -791,6 +980,11 @@ function renderUpdate(update) {
       ].filter(Boolean);
       const tag = marks.length ? ` [${marks.join(", ")}]` : "";
       out.push(`${line.authorName || "Unknown"}${tag}: ${line.text ?? ""}`);
+      for (const file of line.files ?? []) {
+        out.push(
+          `  [Attachment: ${file.name} \xB7 ${file.contentType} \xB7 id ${file.id}]`
+        );
+      }
     }
     out.push("");
   }
@@ -807,10 +1001,35 @@ function renderUpdate(update) {
 // src/store.ts
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+function pageMemory(page2) {
+  const kept = {};
+  if (page2?.title) kept.title = page2.title;
+  if (page2?.cursor) kept.cursor = page2.cursor;
+  if (page2?.lastMessageId) kept.lastMessageId = page2.lastMessageId;
+  return kept;
+}
+function dropPageCredential(entry, pageId) {
+  const page2 = entry.pages?.[pageId];
+  if (!page2) return;
+  const kept = pageMemory(page2);
+  if (kept.cursor || kept.lastMessageId) entry.pages[pageId] = kept;
+  else delete entry.pages[pageId];
+}
+function setLastMessageId(entry, pageId, messageId) {
+  const page2 = { ...entry.pages?.[pageId], lastMessageId: messageId };
+  if (messageId === void 0) delete page2.lastMessageId;
+  entry.pages ??= {};
+  if (Object.keys(page2).length === 0) delete entry.pages[pageId];
+  else entry.pages[pageId] = page2;
+}
 function credentialsPath(env, homeDir) {
   const configHome = env.XDG_CONFIG_HOME?.trim() || join(homeDir, ".config");
   return join(configHome, "plot", "credentials.json");
 }
+function filesCachePath(env, homeDir, pageId) {
+  const cacheHome = env.XDG_CACHE_HOME?.trim() || join(homeDir, ".cache");
+  return join(cacheHome, "plot", "files", pageId);
+}
 async function loadStore(path) {
   let text;
   try {
@@ -935,7 +1154,7 @@ async function withToken(rt, pageId, fn) {
   });
   if (candidates.length === 0) {
     throw new CliError(
-      pageId ? `No credential for page ${pageId} on ${rt.origin}. Redeem the code you were given with "plot open temp_code_\u2026", or connect a workspace with "plot login".` : `No workspace credential for ${rt.origin}. Run "plot login" (a code from "plot open" reaches only its one page).`
+      pageId ? `No credential for page ${pageId} on ${rt.origin}. Redeem the code you were given with "plot open temp_code_\u2026", or connect a workspace with "plot login".` : `No workspace credential for ${rt.origin}. Run "plot login", or set PLOT_TOKEN to a token from Plot's Settings > Agents (a code from "plot open" reaches only its one page).`
     );
   }
   for (let i = 0; i < candidates.length; i++) {
@@ -960,10 +1179,8 @@ async function withToken(rt, pageId, fn) {
 async function forget(rt, candidate, pageId) {
   await updateOrigin(rt, (entry) => {
     if (candidate.source === "workspace") delete entry.workspace;
-    if (candidate.source === "page" && pageId && entry.pages?.[pageId]) {
-      const { cursor, title } = entry.pages[pageId];
-      if (cursor) entry.pages[pageId] = { cursor, title };
-      else delete entry.pages[pageId];
+    if (candidate.source === "page" && pageId) {
+      dropPageCredential(entry, pageId);
     }
   });
 }
@@ -1027,7 +1244,7 @@ async function open(rt) {
   rt.ctx.out(
     [
       `Opened "${title}"${by}. ${canPost ? "Read and post" : "Read-only"} access until ${session.expiresAt}; each read extends it${session.absoluteExpiresAt ? `, up to ${session.absoluteExpiresAt}` : ""}.`,
-      `Next: plot read ${pageId}${canPost ? `, plot post ${pageId} --body "\u2026"` : ""}    (plot help agents for more)`,
+      `Next: plot read ${pageId}${canPost ? `, plot message ${pageId} --body "\u2026"` : ""}    (plot help agents for more)`,
       DATA_NOT_INSTRUCTIONS
     ].join("\n")
   );
@@ -1210,11 +1427,7 @@ async function logout(rt) {
     for (const [id, page2] of Object.entries(e.pages ?? {})) {
       if (page2.token && revoked.has(page2.token)) {
         if (rt.values.all) delete e.pages[id];
-        else {
-          delete page2.token;
-          delete page2.expiresAt;
-          if (!page2.cursor) delete e.pages[id];
-        }
+        else dropPageCredential(e, id);
       }
     }
   });
@@ -1251,6 +1464,13 @@ function describeMe(me, source, origin) {
   const rows = [
     ["API", origin],
     ["Credential", `${me.scope ?? "unknown"} scope (from ${source})`],
+    // Only worth a row when it is the narrower one: "can post" is what a
+    // credential has always been able to do, and whether it can here still
+    // depends on the page.
+    [
+      "Writes",
+      me.capability === "draft" ? "drafts only, cannot post" : void 0
+    ],
     ["Agent", me.agent],
     ["Granted by", me.grantedBy],
     ["Workspace", me.workspace?.name],
@@ -1266,37 +1486,178 @@ function describeMe(me, source, origin) {
   return rows.filter(([, value]) => value).map(([label, value]) => `${`${label}:`.padEnd(12)}${value}`).join("\n");
 }
 
+// src/commands/files.ts
+import { mkdir as mkdir2, mkdtemp, writeFile as writeFile2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename as basename2, isAbsolute, join as join2, resolve, sep } from "node:path";
+function renderFiles(files2) {
+  if (files2.length === 0) return "No files on this page.";
+  return files2.map((file) => {
+    const parts = [file.name, file.contentType, formatSize(file.size)];
+    if (file.image) parts.push(`${file.image.width}\xD7${file.image.height}`);
+    parts.push(`id ${file.id}`);
+    return parts.join(" \xB7 ");
+  }).join("\n");
+}
+function formatSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  const kb = bytes / 1024;
+  if (kb < 1024) return `${Math.round(kb)} KB`;
+  const mb = kb / 1024;
+  return `${mb < 10 ? mb.toFixed(1) : Math.round(mb)} MB`;
+}
+function safeFileName(name) {
+  const base = basename2(name).replace(/[^A-Za-z0-9._-]+/g, "-");
+  const trimmed = base.replace(/^[.-]+/, "").slice(0, 120);
+  return trimmed === "" ? "file" : trimmed;
+}
+var EXTENSION_FOR = {
+  "image/webp": ".webp",
+  "image/png": ".png",
+  "image/jpeg": ".jpg",
+  "image/gif": ".gif",
+  "image/avif": ".avif"
+};
+function nameForBytes(name, contentType) {
+  const want = EXTENSION_FOR[contentType];
+  if (!want) return name;
+  const dot = name.lastIndexOf(".");
+  const stem = dot > 0 ? name.slice(0, dot) : name;
+  return name.slice(dot).toLowerCase() === want ? name : `${stem}${want}`;
+}
+async function listFiles(rt, pageId, token) {
+  const read2 = await rt.api.readJson(token, pageId);
+  const messages = Array.isArray(read2.body.messages) ? read2.body.messages : [];
+  return messages.flatMap((message2) => message2.attachments ?? []);
+}
+function variantFlag(rt) {
+  const original = rt.values.original === true;
+  const asked = stringFlag(rt, "variant");
+  if (asked !== void 0 && original) {
+    throw new UsageError("--variant does not go with --original.");
+  }
+  if (original) return "original";
+  if (asked === void 0) return void 0;
+  if (asked !== "original" && asked !== "preview") {
+    throw new UsageError(
+      `--variant "${asked}" is not a variant: use original or preview.`
+    );
+  }
+  return asked;
+}
+function contained(dir, name) {
+  const path = resolve(dir, name);
+  if (path !== dir && !path.startsWith(resolve(dir) + sep)) {
+    throw new CliError(
+      `Refusing to write outside ${dir}: that file's details do not make a filename.`
+    );
+  }
+  return path;
+}
+async function write(path, bytes) {
+  await mkdir2(join2(path, ".."), { recursive: true });
+  await writeFile2(path, bytes);
+}
+async function files(rt) {
+  const pageId = parsePageRef(rt.positionals[0]);
+  if (rt.positionals.length > 1) {
+    throw new UsageError(`Unexpected argument "${rt.positionals[1]}".`);
+  }
+  const id = stringFlag(rt, "get");
+  if (id === void 0 && rt.values.get !== void 0) {
+    throw new UsageError(
+      '--get needs the id of a file. Run "plot files" for them.'
+    );
+  }
+  const variant = variantFlag(rt);
+  const out = stringFlag(rt, "out");
+  if (id === void 0 && (out !== void 0 || variant !== void 0)) {
+    throw new UsageError(
+      "--out, --variant and --original only apply with --get <id>."
+    );
+  }
+  if (id === void 0) {
+    const list = await withToken(
+      rt,
+      pageId,
+      (token) => listFiles(rt, pageId, token)
+    );
+    if (rt.values.json) printJson(rt, list);
+    else rt.ctx.out(renderFiles(list));
+    return;
+  }
+  const { found, bytes } = await withToken(rt, pageId, async (token) => {
+    const found2 = await rt.api.attachment(token, pageId, id, variant);
+    return { found: found2, bytes: await rt.api.download(found2.url) };
+  });
+  if (out === "-") {
+    rt.ctx.writeStdout(bytes);
+    return;
+  }
+  const label = found.variant === "preview" || found.variant === "original" ? found.variant : "file";
+  const name = `${safeFileName(id)}-${label}-${nameForBytes(
+    safeFileName(found.name),
+    found.urlContentType
+  )}`;
+  const dir = filesCachePath(rt.ctx.env, rt.ctx.homeDir, pageId);
+  const chosen = out === void 0 ? contained(dir, name) : isAbsolute(out) ? out : resolve(rt.ctx.cwd, out);
+  let path = chosen;
+  try {
+    await write(chosen, bytes);
+  } catch (err) {
+    if (out !== void 0) {
+      throw new CliError(`Could not write ${chosen}: ${err.message}`);
+    }
+    path = contained(await mkdtemp(join2(tmpdir(), "plot-files-")), name);
+    try {
+      await write(path, bytes);
+    } catch (second) {
+      throw new CliError(
+        `Could not write ${chosen} (${err.message}) or ${path} (${second.message}).`
+      );
+    }
+    rt.ctx.err(
+      `Could not write under ${filesCachePath(rt.ctx.env, rt.ctx.homeDir, pageId)}; used the temp directory instead. A temp directory may differ between calls in a sandbox, so read this file now rather than later.`
+    );
+  }
+  if (rt.values.json) {
+    printJson(rt, { ...found, path });
+  } else {
+    rt.ctx.out(path);
+  }
+}
+
 // src/commands/mcpConfig.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile2, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname2, join as join3 } from "node:path";
 var withHeaders = (headers) => headers ? { headers } : {};
 var HOSTS = {
   "claude-code": {
     root: "mcpServers",
     server: (url, headers) => ({ type: "http", url, ...withHeaders(headers) }),
-    file: (rt) => join2(rt.ctx.cwd, ".mcp.json"),
+    file: (rt) => join3(rt.ctx.cwd, ".mcp.json"),
     where: ".mcp.json in the project",
     envRef: (name) => `\${${name}}`
   },
   cursor: {
     root: "mcpServers",
     server: (url, headers) => ({ url, ...withHeaders(headers) }),
-    file: (rt) => join2(rt.ctx.homeDir, ".cursor", "mcp.json"),
+    file: (rt) => join3(rt.ctx.homeDir, ".cursor", "mcp.json"),
     where: "~/.cursor/mcp.json",
     envRef: (name) => `\${env:${name}}`
   },
   vscode: {
     root: "servers",
     server: (url, headers) => ({ type: "http", url, ...withHeaders(headers) }),
-    file: (rt) => join2(rt.ctx.cwd, ".vscode", "mcp.json"),
+    file: (rt) => join3(rt.ctx.cwd, ".vscode", "mcp.json"),
     where: ".vscode/mcp.json in the project",
     envRef: (name) => `\${env:${name}}`
   },
   zed: {
     root: "context_servers",
     server: (url, headers) => ({ url, ...withHeaders(headers) }),
-    file: (rt) => join2(
-      rt.ctx.env.XDG_CONFIG_HOME?.trim() || join2(rt.ctx.homeDir, ".config"),
+    file: (rt) => join3(
+      rt.ctx.env.XDG_CONFIG_HOME?.trim() || join3(rt.ctx.homeDir, ".config"),
       "zed",
       "settings.json"
     ),
@@ -1441,8 +1802,8 @@ async function mcpConfig(rt) {
   }
   const root = existing[spec.root] ?? {};
   existing[spec.root] = { ...root, ...block[spec.root] };
-  await mkdir2(dirname2(file), { recursive: true });
-  await writeFile2(file, `${JSON.stringify(existing, null, 2)}
+  await mkdir3(dirname2(file), { recursive: true });
+  await writeFile3(file, `${JSON.stringify(existing, null, 2)}
 `, {
     mode: created ? 384 : void 0
   });
@@ -1503,35 +1864,241 @@ async function search(rt) {
   if (rt.values.json) printJson(rt, result);
   else rt.ctx.out(renderSearch(query, result.results ?? [], result.next));
 }
-async function post(rt) {
-  const pageId = parsePageRef(rt.positionals[0]);
+var MESSAGE_ID = /^[A-Za-z0-9_-]{8,64}$/;
+function checkedId(raw, what) {
+  if (!MESSAGE_ID.test(raw)) {
+    throw new UsageError(
+      `${what} "${raw}" is not a message id (8 to 64 of A-Z a-z 0-9 _ -).`
+    );
+  }
+  return raw;
+}
+async function messageBody(rt) {
   let body = typeof rt.values.body === "string" ? rt.values.body : void 0;
-  if (body === void 0) {
-    if (rt.ctx.stdinIsTTY) {
-      throw new UsageError("Give the message with --body, or pipe it on stdin.");
+  if (body === void 0 && !rt.ctx.stdinIsTTY) body = await rt.ctx.readStdin();
+  body = body?.trim();
+  return body || void 0;
+}
+async function existingId(rt, pageId) {
+  const named = rt.positionals[1] ?? stringFlag(rt, "id");
+  if (named) return checkedId(named, "Message id");
+  const remembered = (await originEntry(rt)).pages?.[pageId]?.lastMessageId;
+  if (remembered) return remembered;
+  throw new UsageError(
+    `No message id given, and none remembered for page ${pageId}: name one with --id.`
+  );
+}
+async function rememberMessage(rt, pageId, messageId) {
+  await updateOrigin(rt, (entry) => setLastMessageId(entry, pageId, messageId));
+}
+function where(title, url) {
+  const named = title ? `"${title}"` : "";
+  if (named && url) return `${named} (${url})`;
+  return named || url || "the page";
+}
+function renderCreated(status, created, title) {
+  const m = created.message;
+  const agent = created.agent || "your agent";
+  const place = where(title, m?.url);
+  const lines = [];
+  if (created.replaced) {
+    lines.push("Replaced the earlier draft on this lane; its id is gone.");
+  }
+  if (m?.status === "sent" && status === 200) {
+    lines.push(
+      created.agent ? `Already sent as ${created.agent}, for the person who granted access, on ${place} (id ${m.id}). Nothing new was posted.` : `Already sent by the person who granted access, from their composer, on ${place} (id ${m.id}). Nothing new was posted.`
+    );
+  } else if (m?.status === "sent") {
+    lines.push(
+      `Sent as ${agent}, for the person who granted access, on ${place} (id ${m.id}).`
+    );
+  } else {
+    const verb = status === 201 || created.replaced ? "Drafted" : "Updated the draft";
+    lines.push(
+      `${verb} into the composer of the person who granted access, on ${place} (id ${m?.id}).`
+    );
+    if (m?.canSend === false) {
+      lines.push(
+        "Nobody else sees it: they edit it and send it, or discard it. This connection cannot post, so sending it is theirs to do."
+      );
+    } else {
+      lines.push(
+        "Nobody else sees it: they edit it and send it, or discard it. Send it yourself only if they ask:",
+        `  plot message ${m?.pageId ?? "<page>"} --send --id ${m?.id}`
+      );
     }
-    body = await rt.ctx.readStdin();
   }
-  body = body.trim();
-  if (!body) throw new UsageError("The message is empty.");
-  const id = newClientId();
+  return lines.join("\n");
+}
+function renderMessage(m, title) {
+  const place = where(title, m.url);
+  if (m.status === "sent") {
+    return `Message ${m.id} is sent: it is on ${place}${m.messageId ? ` as ${m.messageId}` : ""}.`;
+  }
+  const lines = [
+    `Draft ${m.id} is waiting in the person's composer on ${place}${m.branchId ? `, in reply ${m.branchId}` : ""}.`
+  ];
+  if (m.note) lines.push(`Note: ${m.note}`);
+  if (m.body !== void 0) lines.push("", m.body);
+  return lines.join("\n");
+}
+async function message(rt) {
+  const pageId = parsePageRef(rt.positionals[0]);
+  const show = rt.values.show === true;
+  const discard = rt.values.discard === true;
+  const send = rt.values.send === true;
+  if ([show, discard, send].filter(Boolean).length > 1) {
+    throw new UsageError("Choose one of --send, --show and --discard.");
+  }
+  const title = (await originEntry(rt)).pages?.[pageId]?.title;
+  if (show || discard) {
+    for (const flag of ["body", "branch", "note"]) {
+      if (rt.values[flag] !== void 0) {
+        throw new UsageError(
+          `--${flag} does not go with --${show ? "show" : "discard"}.`
+        );
+      }
+    }
+    if (rt.positionals.length > 2) {
+      throw new UsageError("Too many arguments: <page> and at most one id.");
+    }
+    const id2 = await existingId(rt, pageId);
+    if (show) {
+      const found = await withToken(
+        rt,
+        pageId,
+        (token) => rt.api.getMessage(token, pageId, id2)
+      );
+      if (rt.values.json) printJson(rt, found);
+      else rt.ctx.out(renderMessage(found, title));
+      return;
+    }
+    await withToken(
+      rt,
+      pageId,
+      (token) => rt.api.discardMessage(token, pageId, id2)
+    );
+    const remembered = (await originEntry(rt)).pages?.[pageId]?.lastMessageId;
+    if (remembered === id2) await rememberMessage(rt, pageId, void 0);
+    if (rt.values.json) printJson(rt, { id: id2, discarded: true });
+    else
+      rt.ctx.out(
+        `Discarded draft ${id2}; it is gone from the person's composer.`
+      );
+    return;
+  }
+  if (rt.positionals.length > 1) {
+    throw new UsageError(
+      `Unexpected argument "${rt.positionals[1]}". Give the words with --body, or pipe them on stdin.`
+    );
+  }
+  const branchId = stringFlag(rt, "branch");
+  const note = stringFlag(rt, "note");
+  const body = await messageBody(rt);
+  let id;
+  if (body !== void 0) {
+    const named = stringFlag(rt, "id");
+    id = named ? checkedId(named, "--id") : newClientId();
+  } else if (send) {
+    id = await existingId(rt, pageId);
+  } else {
+    throw new UsageError(
+      rt.ctx.stdinIsTTY ? "Give the message with --body, or pipe it on stdin." : "The message is empty."
+    );
+  }
   const created = await withToken(
     rt,
     pageId,
-    (token) => rt.api.post(
+    (token) => rt.api.createMessage(
       token,
       pageId,
-      { body, branchId: stringFlag(rt, "branch"), id },
+      {
+        body,
+        id,
+        branchId,
+        send,
+        note
+      },
       { sleep: rt.ctx.sleep }
     )
+  ).catch((err) => {
+    if (body === void 0 && err instanceof ApiError && err.code === "no_draft") {
+      throw new CliError(
+        `No draft to send here: ${id} is not a draft of yours on page ${pageId}. (${err.message})`
+      );
+    }
+    throw err;
+  });
+  await rememberMessage(rt, pageId, created.body.message?.id ?? id);
+  if (rt.values.json) printJson(rt, created.body);
+  else rt.ctx.out(renderCreated(created.status, created.body, title));
+}
+
+// src/commands/task.ts
+function statusFlag(rt) {
+  const raw = stringFlag(rt, "status");
+  if (raw === void 0) {
+    if (rt.values.status !== void 0) throw badStatus("");
+    return void 0;
+  }
+  const status = TASK_STATUSES.find((s) => s.toLowerCase() === raw.toLowerCase());
+  if (!status) throw badStatus(raw);
+  return status;
+}
+function badStatus(raw) {
+  return new UsageError(
+    `--status "${raw}" is not a status: use ${TASK_STATUSES.join(", ")}.`
   );
-  if (rt.values.json) printJson(rt, created);
-  else {
-    const via = created.postedByAgent ? ` via ${created.postedByAgent}` : "";
-    rt.ctx.out(
-      `Posted${via}: ${created.message?.url ?? created.message?.id ?? ""}`.trim()
-    );
+}
+function assigneeFlags(rt) {
+  const raw = rt.values.assign;
+  const given = (Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]).map((id) => String(id).trim()).filter(Boolean);
+  const all = rt.values["unassign-all"] === true;
+  if (all && given.length > 0) {
+    throw new UsageError("--assign does not go with --unassign-all.");
   }
+  if (all) return [];
+  if (raw !== void 0 && given.length === 0) {
+    throw new UsageError("--assign needs a user id.");
+  }
+  return given.length > 0 ? given : void 0;
+}
+function notATask(page2, pageId) {
+  const name = page2.title ? `"${page2.title}"` : pageId;
+  return new CliError(
+    `Not a task page: ${name}${page2.type ? ` (a ${page2.type})` : ""}. Only a task has a Status and assignees.`
+  );
+}
+function renderTask(page2, task2) {
+  const parts = ["Task", `Status: ${task2.status ?? "not set"}`];
+  const names = task2.assignees.map((a) => a.name || a.id);
+  if (names.length > 0) parts.push(`Assignees: ${names.join(", ")}`);
+  if (page2.parentUrl) parts.push(`Part of ${page2.parentUrl}`);
+  return page2.url ? `${parts.join(" \xB7 ")}
+${page2.url}` : parts.join(" \xB7 ");
+}
+async function task(rt) {
+  const pageId = parsePageRef(rt.positionals[0]);
+  if (rt.positionals.length > 1) {
+    throw new UsageError(`Unexpected argument "${rt.positionals[1]}".`);
+  }
+  const status = statusFlag(rt);
+  const assigneeIds = assigneeFlags(rt);
+  const writes = status !== void 0 || assigneeIds !== void 0;
+  const result = await withToken(rt, pageId, async (token) => {
+    const read2 = await rt.api.readJson(token, pageId);
+    const page2 = read2.body.page;
+    if (page2.type !== "task" || !page2.task) throw notATask(page2, pageId);
+    if (!writes) return { page: page2, task: page2.task };
+    return rt.api.updateTask(token, pageId, { status, assigneeIds }).catch((err) => {
+      if (err instanceof ApiError && err.code === "not_a_task") {
+        throw notATask(page2, pageId);
+      }
+      throw err;
+    });
+  });
+  if (rt.values.json) printJson(rt, result.task);
+  else rt.ctx.out(renderTask(result.page, result.task));
 }
 
 // src/commands/watch.ts
@@ -1638,13 +2205,38 @@ var COMMANDS = {
     }
   },
   topics: { run: topics },
+  files: {
+    run: files,
+    options: {
+      get: { type: "string" },
+      out: { type: "string" },
+      variant: { type: "string" },
+      original: { type: "boolean" }
+    }
+  },
+  task: {
+    run: task,
+    options: {
+      status: { type: "string" },
+      assign: { type: "string", multiple: true },
+      "unassign-all": { type: "boolean" }
+    }
+  },
   search: {
     run: search,
     options: { next: { type: "string" }, limit: { type: "string" } }
   },
-  post: {
-    run: post,
-    options: { branch: { type: "string" }, body: { type: "string" } }
+  message: {
+    run: message,
+    options: {
+      branch: { type: "string" },
+      body: { type: "string" },
+      note: { type: "string" },
+      id: { type: "string" },
+      send: { type: "boolean" },
+      show: { type: "boolean" },
+      discard: { type: "boolean" }
+    }
   },
   "mcp-config": {
     run: mcpConfig,
@@ -1719,8 +2311,8 @@ import { createServer } from "node:http";
 function startLoopback(state) {
   let resolveCode;
   let rejectCode;
-  const code = new Promise((resolve, reject) => {
-    resolveCode = resolve;
+  const code = new Promise((resolve2, reject) => {
+    resolveCode = resolve2;
     rejectCode = reject;
   });
   code.catch(() => {
@@ -1769,13 +2361,13 @@ function startLoopback(state) {
     );
     resolveCode(value);
   });
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       server.off("error", reject);
       const { port } = server.address();
       let closed = false;
-      resolve({
+      resolve2({
         redirectUri: `http://127.0.0.1:${port}/callback`,
         code,
         close: () => {
@@ -1796,8 +2388,8 @@ function oauthFailure(error, description) {
   }
   return new CliError(`Login failed: the browser returned "${error}".`);
 }
-function page(res, status, title, message) {
-  const body = `<!doctype html><meta charset="utf-8"><title>${escape(title)}</title><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem"><h1 style="font-size:1.25rem">${escape(title)}</h1><p>${escape(message)}</p></body>`;
+function page(res, status, title, message2) {
+  const body = `<!doctype html><meta charset="utf-8"><title>${escape(title)}</title><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem"><h1 style="font-size:1.25rem">${escape(title)}</h1><p>${escape(message2)}</p></body>`;
   res.writeHead(status, {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",
@@ -1821,13 +2413,14 @@ function nodeContext() {
 `),
     err: (text) => process.stderr.write(text.endsWith("\n") ? text : `${text}
 `),
+    writeStdout: (bytes) => process.stdout.write(bytes),
     readStdin: async () => {
       const chunks = [];
       for await (const chunk of process.stdin) chunks.push(chunk);
       return Buffer.concat(chunks).toString("utf8");
     },
     stdinIsTTY: Boolean(process.stdin.isTTY),
-    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)),
     now: () => Date.now(),
     openUrl: (url) => openInBrowser(url, process.platform),
     listenLoopback: (state) => startLoopback(state).catch(() => void 0),
@@ -1838,8 +2431,8 @@ function nodeContext() {
   };
 }
 function promptLine(question, signal) {
-  return new Promise((resolve) => {
-    if (signal.aborted) return resolve(void 0);
+  return new Promise((resolve2) => {
+    if (signal.aborted) return resolve2(void 0);
     const rl = createInterface({
       input: process.stdin,
       output: process.stderr,
@@ -1847,7 +2440,7 @@ function promptLine(question, signal) {
     });
     let answered = false;
     rl.once("close", () => {
-      if (!answered) resolve(void 0);
+      if (!answered) resolve2(void 0);
     });
     signal.addEventListener(
       "abort",
@@ -1861,23 +2454,23 @@ function promptLine(question, signal) {
     rl.question(question, (answer) => {
       answered = true;
       rl.close();
-      resolve(answer);
+      resolve2(answer);
     });
   });
 }
 function openInBrowser(url, platform) {
   const command = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
   if (!command) return Promise.resolve(false);
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     try {
       const child = spawn(command, [url], { stdio: "ignore", detached: true });
-      child.once("error", () => resolve(false));
+      child.once("error", () => resolve2(false));
       child.once("spawn", () => {
         child.unref();
-        resolve(true);
+        resolve2(true);
       });
     } catch {
-      resolve(false);
+      resolve2(false);
     }
   });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plotio/cli",
-  "version": "0.3.0",
-  "description": "Read Plot pages, follow a meeting as it happens, and post back, from any agent with a shell.",
+  "version": "0.5.0",
+  "description": "Read Plot pages, follow a meeting as it happens, and draft or send messages, from any agent with a shell.",
   "type": "module",
   "license": "MIT",
   "bin": {