@productbrain/cli 0.1.0-beta.1131 → 0.1.0-beta.11313

package/dist/commands/role.js

@@ -0,0 +1,235 @@
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCall, kernelCallWithSession } from '../lib/client.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { runCliCommand } from '../lib/runner.js';
+import { formatSeatSentence, personStatusTag } from '../lib/seatSentence.js';
+import { sanitizeSingleLineField } from '../lib/strip.js';
+import { runOrganisationWrite } from './organisationWrite.js';
+import { formatOwnerLine } from '../formatters/entry.js';
+/** Holders first: who answers for the role, a non-active holder tagged with their state word (TASK-712, DEC-2007). */
+function formatHolders(result) {
+    if (result.holders.length === 0)
+        return [`  holders: none${result.holdersTruncated ? ' found, but the membership scan is incomplete' : ''}`];
+    return [
+        '  holders:',
+        ...result.holders.map((h) => {
+            const word = personStatusTag(h.status);
+            const tag = word ? ` (${word})` : '';
+            const team = h.teamName ? `  in ${sanitizeSingleLineField(h.teamName)}` : '';
+            return `    ${sanitizeSingleLineField(h.displayName)}${tag}${team}`;
+        }),
+        ...(result.holdersTruncated ? ['    (membership scan cut at 500 rows, more holders may exist)'] : []),
+    ];
+}
+const validation = (message, guidance) => new CLIError(message, { code: ErrorCode.VALIDATION_FAILED, category: 'validation', guidance });
+/** argv is a string; `--limit`/`--cursor` want whole numbers. Refused HERE, before any network
+ *  call, naming the flag — same shape `outcome.ts`'s own `requireNumber` and `shape.ts`'s enum
+ *  checks use (CLIError + code: VALIDATION_FAILED + category: 'validation'), so an invalid flag
+ *  reports category=validation in JSON mode rather than falling through to `runCliCommand`'s
+ *  generic unknown-error wrap (code: INTERNAL). Un-refused, `Number('abc')` is NaN, which
+ *  `JSON.stringify` silently turns into `null` on the wire — a validation bug disguised as a
+ *  present-but-empty value, not caught until the gateway's own (differently-worded) refusal.
+ */
+function requireInteger(raw, flag, range) {
+    const trimmed = raw.trim();
+    const parsed = Number(trimmed);
+    if (trimmed === '' || !Number.isInteger(parsed)) {
+        throw validation(`${flag} must be a whole number (got "${raw}").`, 'Usage: pb role accountable <role-id> [--limit <n>] [--cursor <n>]');
+    }
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZI): `requireInteger` checked only
+    // integrality, so `--limit 0`, a negative value, or anything above 200 reached the network
+    // call and was silently clamped server-side (convex/agentKnowledge/entriesByRole.ts:1-200
+    // range) to a page size the caller never asked for. Reject the advertised 1-200 range here,
+    // matching the MCP tool's own schema (packages/mcp-server/src/tools/role.ts), before the call.
+    if (range && (parsed < range.min || parsed > range.max)) {
+        throw validation(`${flag} must be between ${range.min} and ${range.max} (got ${parsed}).`, 'Usage: pb role accountable <role-id> [--limit <n>] [--cursor <n>]');
+    }
+    return parsed;
+}
+/** One row, terminal-safe. `name` is stored content any connector with write access can set —
+ *  sanitized for the same reason `outcome.ts`'s `formatReadingsList` sanitizes `note`/`valueText`:
+ *  this rendering is a plain-text sink, and an embedded newline would forge an extra row. */
+function formatRow(row) {
+    const id = row.entryId ?? row.id;
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZW): `chain.listByRole` deliberately
+    // includes each row's domain `workflowStatus` (convex/agentKnowledge/entriesByRole.ts:73-90)
+    // separately from `status` (the TRUST status, e.g. 'accepted') — a tension's `open` vs
+    // `closed` is exactly the distinction between a current obligation and a completed one.
+    // Dropping it here made both render identically as `[tension/accepted]`; render it, mirroring
+    // `packages/mcp-server/src/tools/entries.ts:697-700`'s existing formatter.
+    // PR #872 review round 3 (Codex P2): workflowStatus is stored content read from a workspace
+    // collection's `validWorkflowStatuses` declaration — vocabulary-checked by guardWorkflowStatus,
+    // never terminal-safety-checked, so a value containing a newline/control sequence could still
+    // forge an extra row. Sanitized the same way `row.name` already is.
+    const statusDisplay = row.workflowStatus ? `${row.status} / ${sanitizeSingleLineField(row.workflowStatus)}` : row.status;
+    // WP-771 S1b round 2 (Codex P2, PRRT_kwDORS4ils6lGWJ0): render the real collection slug,
+    // matching the MCP `role` tool's formatRow fixed this round — same sanitization, same '?'
+    // fallback for a row whose collection couldn't be resolved.
+    const collectionSlug = row.collectionSlug ? sanitizeSingleLineField(row.collectionSlug) : '?';
+    return `    ${id}  ${sanitizeSingleLineField(row.name)}  [${collectionSlug}/${statusDisplay}]`;
+}
+/** One labelled section — `explicit` or `reporting`. Empty prints the shared empty-state text
+ *  rather than an ambiguous blank, and a truncated page says so with an ACTIONABLE hint rather
+ *  than a vague "more exist" (review PRRT_kwDORS4ils6gQAqo, §13: cap every read AND surface
+ *  truncation to the caller — a claim of "continue with the printed cursor" that never printed
+ *  one is the failure this fixes). `cursorHint` is `undefined` for a section the gateway cannot
+ *  page (`reporting` — PR-1's own design: only `explicit` accepts a cursor) — that section
+ *  states the cap plainly instead of pointing at a flag that would silently be ignored. */
+function formatSection(label, rows, truncated, cursorHint) {
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrY9): `canonicalKey` filtering can
+    // legitimately return `rows: []` with `truncated: true` and a usable cursor — the backend's
+    // raw scan window was exhausted without confirming no more matches exist beyond it
+    // (convex/agentKnowledge/entriesByRole.ts). Printing "not recorded yet" for that response
+    // falsely presents the role as having no matching entries at all and swallows the cursor that
+    // would let the caller keep looking. Check truncation BEFORE the empty-state early return.
+    if (rows.length === 0 && !truncated)
+        return [`  ${label}: not recorded yet`];
+    const lines = rows.length === 0 ? [`  ${label}: not recorded yet, but the scan is incomplete`] : [`  ${label}:`, ...rows.map(formatRow)];
+    // PR #872 review round 3 (Codex P2): `truncated` can be true purely because the raw scan
+    // budget (MAX_SCAN_BATCHES batches, entriesByRole.ts) was exhausted without confirming the
+    // true end of the index range — NOT because a filtered match beyond this page was actually
+    // found. "more exist" overclaimed a fact the backend never established; "scan incomplete"
+    // states only what is actually known (keep paging to find out), never asserts a match exists.
+    if (truncated)
+        lines.push(`    (scan incomplete, more may exist — ${cursorHint ?? 'raise --limit (capped at 200, no cursor for this list)'})`);
+    return lines;
+}
+/**
+ * Pretty rendering for `pb role accountable`. Exported so door-parity content-equality against
+ * the MCP tool's own rendering (`packages/mcp-server/src/tools/role.ts`) is assertable directly,
+ * not only through a live walk — both read the SAME `chain.listByRole` JSON shape and both print
+ * the SAME three sections in the SAME order.
+ */
+export function formatRoleAccountable(result) {
+    if (!result)
+        return 'Role not found.';
+    const roleLabel = `${sanitizeSingleLineField(result.role.name)} (${result.role.entryId ?? result.role.id})`;
+    // `explicit` is the only cursor-able list (PR-1's design) — print the REAL next cursor when
+    // truncated, never a bare claim that one exists.
+    const explicitCursorHint = result.nextCursor !== null
+        ? `raise --limit or continue with --cursor ${result.nextCursor}`
+        : 'raise --limit';
+    return [
+        `${roleLabel} — accountability:`,
+        ...formatHolders(result),
+        ...formatSection('explicit (owns)', result.explicit, result.explicitTruncated, explicitCursorHint),
+        ...formatSection('reporting (reports on)', result.reporting, result.reportingTruncated),
+        // DEC-1587 Team-Lead vacancy coverage — always not-computed today (see
+        // convex/agentKnowledge/entriesByRole.ts's own header for why); named, never faked as an
+        // empty computed list.
+        `  inherited: not-computed — ${result.inheritedNotComputedReason}`,
+    ].join('\n');
+}
+export async function runRoleAccountable(roleId, options) {
+    // Refuse everything refusable BEFORE the network call — same discipline outcome.ts's
+    // requireNumber and shape.ts's enum checks use.
+    const limit = options.limit !== undefined ? requireInteger(options.limit, '--limit', { min: 1, max: 200 }) : undefined;
+    const cursor = options.cursor !== undefined ? requireInteger(options.cursor, '--cursor') : undefined;
+    const config = await getConfigOrGuide(() => runRoleAccountable(roleId, options));
+    if (!config)
+        return;
+    await runCliCommand({
+        // A read: no session required, same posture as `pb outcome list`.
+        fn: async () => {
+            const raw = await kernelCall('chain.listByRole', {
+                roleId,
+                ...(options.canonicalKey ? { canonicalKey: options.canonicalKey } : {}),
+                ...(limit !== undefined ? { limit } : {}),
+                ...(cursor !== undefined ? { cursor } : {}),
+            });
+            return raw;
+        },
+        formatPretty: (value_) => formatRoleAccountable(value_),
+    });
+}
+const seatSentence = (action) => (result) => formatSeatSentence(action, result, sanitizeSingleLineField);
+export async function runRoleSeat(roleId, options) {
+    // Exactly one of an existing person or --new-person; refused before any network call.
+    if ((options.person === undefined) === (options.newPerson === undefined)) {
+        throw validation(options.person === undefined ? 'Say who to seat: --person <id-or-email>, or --new-person <name>.' : 'Give --person or --new-person, not both.', 'Usage: pb role seat <role-id> (--person <id-or-email> | --new-person <name>) [--team <team-id>]');
+    }
+    const config = await getConfigOrGuide(() => runRoleSeat(roleId, options));
+    if (!config)
+        return;
+    await runOrganisationWrite((context) => kernelCallWithSession('organisation.seatInRole', {
+        roleRef: roleId, targetPersonRef: options.person, newPersonName: options.newPerson, teamRef: options.team, sessionId: context.sessionId,
+    }), seatSentence('seat'));
+}
+export async function runRoleUnseat(roleId, options) {
+    const config = await getConfigOrGuide(() => runRoleUnseat(roleId, options));
+    if (!config)
+        return;
+    await runOrganisationWrite((context) => kernelCallWithSession('organisation.unseatFromRole', {
+        roleRef: roleId, targetPersonRef: options.person, teamRef: options.team, sessionId: context.sessionId,
+    }), seatSentence('unseat'));
+}
+/** TEN-4847: `pb role list` reads at most this many roles; past it, it says the list is cut. Each role
+ *  costs two gateway reads (team, holders), so 40 roles stay near 82 requests, under the default
+ *  120-per-minute API-key quota (convex/rateLimiter.ts). A larger list needs one kernel read (DEC-2104). */
+export const ROLE_LIST_CAP = 40;
+const ROLE_PAGE_SIZE = 50; // the paged read's own page cap (convex/agentKnowledge/listEntriesPaged.ts)
+const ROLE_READS_AT_ONCE = 8;
+const MAX_ROLE_PAGES = 10;
+/** One role's team (its owner line, as `pb get` reads it) and how many holder seats it has. */
+async function readRoleRow(role) {
+    const [entry, raw] = await Promise.all([
+        kernelCall('chain.getEntry', { entryId: role.entryId }),
+        kernelCall('chain.listByRole', { roleId: role.entryId, limit: 1 }),
+    ]);
+    const holders = raw;
+    return {
+        entryId: role.entryId,
+        name: role.name,
+        owner: entry?.owner ?? null,
+        holders: holders.holders.length,
+        holdersTruncated: holders.holdersTruncated,
+    };
+}
+/** Every role in the workspace over the paged collection read (slug `roles`), capped at ROLE_LIST_CAP. */
+export async function readRoleList() {
+    const roles = [];
+    let cursor;
+    let truncated = false;
+    let pages = 0;
+    do {
+        pages += 1;
+        const page = (await kernelCall('chain.listEntriesPaged', {
+            collectionSlug: 'roles', cursor, pageSize: Math.min(ROLE_PAGE_SIZE, ROLE_LIST_CAP - roles.length),
+        }));
+        for (const row of page.rows)
+            if (row.entryId)
+                roles.push({ entryId: row.entryId, name: row.name });
+        cursor = page.continueCursor ?? undefined;
+        // A page can come back short (drafts are filtered after the index), so pages are bounded too.
+        if (cursor && (roles.length >= ROLE_LIST_CAP || pages >= MAX_ROLE_PAGES))
+            truncated = true;
+    } while (cursor && !truncated);
+    const kept = roles.slice(0, ROLE_LIST_CAP);
+    const rows = [];
+    for (let i = 0; i < kept.length; i += ROLE_READS_AT_ONCE) {
+        rows.push(...await Promise.all(kept.slice(i, i + ROLE_READS_AT_ONCE).map(readRoleRow)));
+    }
+    return { roles: rows, truncated: truncated || roles.length > ROLE_LIST_CAP };
+}
+export function formatRoleList(result) {
+    const cut = result.truncated ? [`  (list cut after ${result.roles.length} roles; more may exist)`] : [];
+    if (result.roles.length === 0)
+        return cut.length > 0 ? ['No roles read yet.', ...cut].join('\n') : 'No roles in this workspace.';
+    const lines = result.roles.map((r) => {
+        const holders = `${r.holders}${r.holdersTruncated ? '+' : ''} ${r.holders === 1 && !r.holdersTruncated ? 'holder' : 'holders'}`;
+        return `  ${r.entryId}  ${sanitizeSingleLineField(r.name)}${r.owner ? `  ${formatOwnerLine(r.owner)}` : ''}  ${holders}`;
+    });
+    return [
+        `Roles (${result.roles.length}):`,
+        ...lines,
+        ...cut,
+    ].join('\n');
+}
+export async function runRoleList() {
+    const config = await getConfigOrGuide(runRoleList);
+    if (!config)
+        return;
+    // A read: no session required, same posture as `pb role accountable`.
+    await runCliCommand({ fn: readRoleList, formatPretty: formatRoleList });
+}
+//# sourceMappingURL=role.js.map

package/dist/commands/role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.js","sourceRoot":"","sources":["../../src/commands/role.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAqB,MAAM,wBAAwB,CAAC;AA+C5E,sHAAsH;AACtH,SAAS,aAAa,CAAC,MAAwB;IAC9C,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,kBAAkB,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7I,OAAO;QACN,YAAY;QACZ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,uBAAuB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,OAAO,OAAO,uBAAuB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAY,EAAE,CAClE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY,EAAE,KAAoC;IACtF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,CACf,GAAG,IAAI,iCAAiC,GAAG,KAAK,EAChD,mEAAmE,CACnE,CAAC;IACH,CAAC;IACD,0FAA0F;IAC1F,2FAA2F;IAC3F,0FAA0F;IAC1F,4FAA4F;IAC5F,+FAA+F;IAC/F,IAAI,KAAK,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,UAAU,CACf,GAAG,IAAI,oBAAoB,KAAK,CAAC,GAAG,QAAQ,KAAK,CAAC,GAAG,SAAS,MAAM,IAAI,EACxE,mEAAmE,CACnE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;6FAE6F;AAC7F,SAAS,SAAS,CAAC,GAAiB;IACnC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;IACjC,4FAA4F;IAC5F,6FAA6F;IAC7F,uFAAuF;IACvF,wFAAwF;IACxF,8FAA8F;IAC9F,2EAA2E;IAC3E,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,oEAAoE;IACpE,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,MAAM,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACzH,yFAAyF;IACzF,0FAA0F;IAC1F,4DAA4D;IAC5D,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9F,OAAO,OAAO,EAAE,KAAK,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,cAAc,IAAI,aAAa,GAAG,CAAC;AAChG,CAAC;AAED;;;;;;2FAM2F;AAC3F,SAAS,aAAa,CAAC,KAAa,EAAE,IAA6B,EAAE,SAAkB,EAAE,UAAmB;IAC3G,yFAAyF;IACzF,4FAA4F;IAC5F,mFAAmF;IACnF,0FAA0F;IAC1F,8FAA8F;IAC9F,2FAA2F;IAC3F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,gDAAgD,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACzI,yFAAyF;IACzF,2FAA2F;IAC3F,2FAA2F;IAC3F,0FAA0F;IAC1F,8FAA8F;IAC9F,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,0CAA0C,UAAU,IAAI,wDAAwD,GAAG,CAAC,CAAC;IAC/I,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA+B;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,iBAAiB,CAAC;IACtC,MAAM,SAAS,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAC5G,4FAA4F;IAC5F,iDAAiD;IACjD,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI;QACpD,CAAC,CAAC,2CAA2C,MAAM,CAAC,UAAU,EAAE;QAChE,CAAC,CAAC,eAAe,CAAC;IACnB,OAAO;QACN,GAAG,SAAS,oBAAoB;QAChC,GAAG,aAAa,CAAC,MAAM,CAAC;QACxB,GAAG,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QAClG,GAAG,aAAa,CAAC,wBAAwB,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,kBAAkB,CAAC;QACvF,uEAAuE;QACvE,yFAAyF;QACzF,uBAAuB;QACvB,+BAA+B,MAAM,CAAC,0BAA0B,EAAE;KAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAA+B;IACvF,qFAAqF;IACrF,gDAAgD;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAC;QACnB,kEAAkE;QAClE,EAAE,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,GAAG,GAAG,MAAM,UAAU,CAA0B,kBAAkB,EAAE;gBACzE,MAAM;gBACN,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;YACH,OAAO,GAAuB,CAAC;QAChC,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAiC,CAAC;KAClF,CAAC,CAAC;AACJ,CAAC;AAUD,MAAM,YAAY,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,CAAC,MAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAmB,EAAE,uBAAuB,CAAC,CAAC;AAErJ,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAwB;IACzE,sFAAsF;IACtF,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,MAAM,UAAU,CACf,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,0CAA0C,EAC9I,iGAAiG,CACjG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAa,yBAAyB,EAAE;QACpG,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;KACvI,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAA0C;IAC7F,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAa,6BAA6B,EAAE;QACxG,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;KACrG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;4GAE4G;AAC5G,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC,4EAA4E;AACvG,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,cAAc,GAAG,EAAE,CAAC;AAQ1B,+FAA+F;AAC/F,KAAK,UAAU,WAAW,CAAC,IAAuC;IACjE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtC,UAAU,CAAsB,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5E,UAAU,CAA0B,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;KAC3F,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAuB,CAAC;IACxC,OAAO;QACN,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;QAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC1C,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,YAAY;IACjC,MAAM,KAAK,GAAwC,EAAE,CAAC;IACtD,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,GAAG,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;QACX,MAAM,IAAI,GAAG,CAAC,MAAM,UAAU,CAAqD,wBAAwB,EAAE;YAC5G,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC;SACjG,CAAC,CAAwB,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,GAAG,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;QAC1C,8FAA8F;QAC9F,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,aAAa,IAAI,KAAK,IAAI,cAAc,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC5F,CAAC,QAAQ,MAAM,IAAI,CAAC,SAAS,EAAE;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAsB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,MAAM,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC;IACjI,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChI,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;IAC1H,CAAC,CAAC,CAAC;IACH,OAAO;QACN,UAAU,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI;QACjC,GAAG,KAAK;QACR,GAAG,GAAG;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAChC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,sEAAsE;IACtE,MAAM,aAAa,CAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;AACzF,CAAC"}

package/dist/commands/role.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=role.test.d.ts.map

package/dist/commands/role.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.test.d.ts","sourceRoot":"","sources":["../../src/commands/role.test.ts"],"names":[],"mappings":""}

package/dist/commands/role.test.js

@@ -0,0 +1,348 @@
+/**
+ * WP-730 S2 — `pb role accountable <role-id>`.
+ *
+ * The surface is thin on purpose: every rule that matters (fail-closed roleId resolution,
+ * canonical-key restriction, the explicit/reporting split) lives behind the gateway and was
+ * proven in S1 (`convex/agentKnowledge/entriesByRole.ts`). What THIS slice can get wrong is the
+ * wire shape and the rendering — dropping a flag, or printing an empty section as a blank
+ * instead of the shared "not recorded yet" text.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const { getConfigOrGuide, kernelCall, kernelCallWithSession, runCliCommand, isJsonMode, readSession } = vi.hoisted(() => ({
+    getConfigOrGuide: vi.fn(),
+    kernelCall: vi.fn(),
+    kernelCallWithSession: vi.fn(),
+    runCliCommand: vi.fn(async ({ fn }) => fn()),
+    isJsonMode: vi.fn(() => false),
+    readSession: vi.fn(),
+}));
+vi.mock('../lib/config.js', () => ({ getConfigOrGuide }));
+vi.mock('../lib/client.js', () => ({ kernelCall, kernelCallWithSession }));
+vi.mock('../lib/runner.js', () => ({ runCliCommand, isJsonMode }));
+vi.mock('../lib/session.js', () => ({ readSession }));
+vi.mock('../lib/workspaceNotice.js', () => ({ emitEffectiveTenantNotice: vi.fn(async () => undefined) }));
+import { runRoleAccountable, runRoleSeat, runRoleUnseat, formatRoleAccountable, readRoleList, formatRoleList, ROLE_LIST_CAP } from './role.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+const ROLE = { id: 'doc-role-1', entryId: 'ROL-2', name: 'Data Steward' };
+const OWNED = { id: 'doc-obj-1', entryId: 'OBJ-1', name: 'An owned objective', canonicalKey: 'objective', collectionSlug: 'objectives', status: 'accepted' };
+const REPORTED = { id: 'doc-kr-1', entryId: 'KR-1', name: 'A reported key result', canonicalKey: 'key_result', collectionSlug: 'key-results', status: 'accepted' };
+const emptyResult = {
+    role: ROLE,
+    explicit: [], explicitTruncated: false, nextCursor: null,
+    reporting: [], reportingTruncated: false,
+    inherited: [], inheritedResolution: 'not-computed',
+    inheritedNotComputedReason: 'What a Team Lead covers for its empty roles is not computed per role yet, so this list is never shown as empty.',
+    truncated: false,
+    holders: [],
+    holdersTruncated: false,
+};
+describe('pb role accountable', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'pb_sk_test', siteUrl: 'https://example.test' });
+        kernelCall.mockResolvedValue(emptyResult);
+    });
+    it('calls chain.listByRole with roleId, no session required', async () => {
+        await runRoleAccountable('ROL-2', {});
+        expect(kernelCall).toHaveBeenCalledWith('chain.listByRole', { roleId: 'ROL-2' });
+    });
+    it('forwards canonicalKey, limit, and cursor only when supplied', async () => {
+        await runRoleAccountable('ROL-2', { canonicalKey: 'objective', limit: '5', cursor: '1700000000000' });
+        expect(kernelCall).toHaveBeenCalledWith('chain.listByRole', {
+            roleId: 'ROL-2', canonicalKey: 'objective', limit: 5, cursor: 1700000000000,
+        });
+    });
+    it('sends limit/cursor as NUMBERS, not the raw argv strings', async () => {
+        await runRoleAccountable('ROL-2', { limit: '5' });
+        const [, args] = kernelCall.mock.calls[0];
+        expect(args.limit).toBe(5);
+        expect(args.limit).not.toBe('5');
+    });
+    // PRRT_kwDORS4ils6gP8P9 (review): a non-numeric --limit/--cursor must refuse with
+    // CLIError/VALIDATION_FAILED (category: 'validation') BEFORE any network call — not fall
+    // through to runCliCommand's generic unknown-error wrap (code: INTERNAL), and never reach
+    // the gateway as `NaN` (which JSON.stringify silently turns into `null`).
+    it('refuses a non-numeric --limit with CLIError/VALIDATION_FAILED, before any network call', async () => {
+        await expect(runRoleAccountable('ROL-2', { limit: 'abc' })).rejects.toMatchObject({
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+    it('refuses a non-numeric --cursor with CLIError/VALIDATION_FAILED, before any network call', async () => {
+        await expect(runRoleAccountable('ROL-2', { cursor: 'not-a-timestamp' })).rejects.toBeInstanceOf(CLIError);
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+    it('refuses a fractional --limit (not a whole number)', async () => {
+        await expect(runRoleAccountable('ROL-2', { limit: '1.5' })).rejects.toMatchObject({
+            code: ErrorCode.VALIDATION_FAILED,
+        });
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZI): a whole number outside the
+    // advertised 1-200 range must be refused HERE, before the network call, not silently
+    // clamped server-side to a different page size than the caller asked for.
+    it.each(['0', '-1', '201'])('refuses --limit %s (outside the advertised 1-200 range)', async (limit) => {
+        await expect(runRoleAccountable('ROL-2', { limit })).rejects.toMatchObject({
+            code: ErrorCode.VALIDATION_FAILED,
+        });
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+    it('accepts the boundary values --limit 1 and --limit 200', async () => {
+        await runRoleAccountable('ROL-2', { limit: '1' });
+        await runRoleAccountable('ROL-2', { limit: '200' });
+        expect(kernelCall).toHaveBeenCalledTimes(2);
+    });
+});
+describe('formatRoleAccountable', () => {
+    it('prints "not recorded yet" for an empty explicit and reporting section', () => {
+        const text = formatRoleAccountable(emptyResult);
+        expect(text).toContain('explicit (owns): not recorded yet');
+        expect(text).toContain('reporting (reports on): not recorded yet');
+    });
+    it('lists explicit and reporting rows separately, never merged', () => {
+        const text = formatRoleAccountable({
+            ...emptyResult,
+            explicit: [OWNED], reporting: [REPORTED],
+        });
+        expect(text).toContain('explicit (owns):');
+        expect(text).toContain('OBJ-1');
+        expect(text).toContain('reporting (reports on):');
+        expect(text).toContain('KR-1');
+        // Never merged: OBJ-1 must not appear in the reporting section's own lines.
+        const reportingSection = text.split('reporting (reports on):')[1] ?? '';
+        expect(reportingSection).not.toContain('OBJ-1');
+    });
+    it('names the holders, tagging a placeholder or invited holder with that word (TASK-636)', () => {
+        expect(formatRoleAccountable(emptyResult)).toContain('holders: none');
+        const text = formatRoleAccountable({
+            ...emptyResult,
+            holders: [
+                { personId: 'p1', displayName: 'Ann', status: 'active', teamName: 'Core' },
+                { personId: 'p2', displayName: 'Jan Jansen', status: 'placeholder', teamName: 'Core' },
+                { personId: 'p3', displayName: 'Mathijs', status: 'invited', teamName: null },
+            ],
+        });
+        expect(text).toContain('    Ann  in Core');
+        expect(text).toContain('    Jan Jansen (Not invited)  in Core');
+        expect(text).toContain('    Mathijs (Invited)');
+    });
+    it('always reports inherited as not-computed, with the reason, never faked as empty', () => {
+        const text = formatRoleAccountable(emptyResult);
+        expect(text).toContain('inherited: not-computed');
+        expect(text).toContain(emptyResult.inheritedNotComputedReason);
+    });
+    it('notes truncation on the relevant section only', () => {
+        const text = formatRoleAccountable({ ...emptyResult, explicit: [OWNED], explicitTruncated: true });
+        const explicitSection = text.split('reporting (reports on):')[0] ?? '';
+        expect(explicitSection).toContain('scan incomplete, more may exist');
+    });
+    // PRRT_kwDORS4ils6gQAqo (review): the truncation hint used to CLAIM a cursor was printed
+    // without ever printing one. `nextCursor` must actually appear so a caller (human or agent)
+    // can literally copy it into --cursor.
+    it('renders the REAL nextCursor value when explicit is truncated, not just a bare claim', () => {
+        const text = formatRoleAccountable({
+            ...emptyResult, explicit: [OWNED], explicitTruncated: true, nextCursor: 1700000000000,
+        });
+        expect(text).toContain('--cursor 1700000000000');
+    });
+    // reporting has no cursor support (PR-1's own design — only `explicit` accepts one). A
+    // truncated reporting page must say so plainly, never point at a flag the gateway ignores.
+    it('states plainly that reporting has NO cursor when truncated, never a fake cursor hint', () => {
+        const text = formatRoleAccountable({
+            ...emptyResult, reporting: [REPORTED], reportingTruncated: true,
+        });
+        const reportingSection = text.split('reporting (reports on):')[1] ?? '';
+        expect(reportingSection).toContain('no cursor');
+        expect(reportingSection).not.toContain('--cursor');
+    });
+    it('returns "Role not found." for a null result', () => {
+        expect(formatRoleAccountable(null)).toBe('Role not found.');
+    });
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrY9): an empty-but-truncated response
+    // (canonicalKey narrowing filtered out every row on this page, but the scan is incomplete and
+    // a real cursor exists) must never print the plain "not recorded yet" empty state — that
+    // swallows the cursor and falsely claims the role has no matching entries at all.
+    it('shows truncation and the cursor even when the page is empty (empty-but-truncated)', () => {
+        const text = formatRoleAccountable({
+            ...emptyResult, explicit: [], explicitTruncated: true, nextCursor: 1700000000000,
+        });
+        const explicitSection = text.split('reporting (reports on):')[0] ?? '';
+        expect(explicitSection).not.toContain('explicit (owns): not recorded yet\n');
+        expect(explicitSection).toContain('--cursor 1700000000000');
+    });
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZW): a tension's domain workflowStatus
+    // (open/closed) must render distinctly from its trust status, or two very different rows both
+    // print as `[tension/accepted]`.
+    it('renders the workflow status carried by a row, distinguishing open from closed', () => {
+        const openTension = { id: 'doc-ten-1', entryId: 'TEN-1', name: 'An open tension', canonicalKey: 'tension', collectionSlug: 'tensions', status: 'accepted', workflowStatus: 'open' };
+        const closedTension = { id: 'doc-ten-2', entryId: 'TEN-2', name: 'A closed tension', canonicalKey: 'tension', collectionSlug: 'tensions', status: 'accepted', workflowStatus: 'closed' };
+        const text = formatRoleAccountable({ ...emptyResult, explicit: [openTension, closedTension] });
+        expect(text).toContain('[tensions/accepted / open]');
+        expect(text).toContain('[tensions/accepted / closed]');
+    });
+    // WP-771 S1b round 2 (Codex P2, PRRT_kwDORS4ils6lGWJ0): the bracket must show the real
+    // collection slug, not canonicalKey (the semantic type) — door parity with the MCP `role`
+    // tool's own formatRow fix this round (packages/mcp-server/src/tools/role.ts), and with
+    // `pb get`'s own bracket fix (packages/cli/src/formatters/entry.ts).
+    it("prints the row's collectionSlug in the bracket, never canonicalKey", () => {
+        const text = formatRoleAccountable({ ...emptyResult, explicit: [OWNED] });
+        expect(text).toContain('[objectives/accepted]');
+        expect(text).not.toContain('[objective/accepted]');
+    });
+    it('falls back to "?" when a row has no collectionSlug', () => {
+        const rowWithoutSlug = { id: 'doc-obj-2', entryId: 'OBJ-2', name: 'Unresolved', canonicalKey: 'objective', status: 'accepted' };
+        const text = formatRoleAccountable({ ...emptyResult, explicit: [rowWithoutSlug] });
+        expect(text).toContain('[?/accepted]');
+    });
+    // WP-771 S1b round 2 (Codex P2, PRRT_kwDORS4ils6lGWJs class): a collectionSlug with an
+    // embedded newline must not forge an extra row, same treatment as name/workflowStatus above.
+    it('sanitizes an embedded newline in collectionSlug instead of forging an extra row', () => {
+        const evilRow = { ...OWNED, collectionSlug: 'objectives\nFAKE ROW: nothing to see here' };
+        const text = formatRoleAccountable({ ...emptyResult, explicit: [evilRow] });
+        expect(text.split('\n')).not.toContain('    FAKE ROW: nothing to see here');
+        expect(text).toContain('objectives FAKE ROW: nothing to see here');
+    });
+    // PR #872 review round 3 (Codex P2): workflowStatus is stored content (a workspace
+    // collection's validWorkflowStatuses declaration), vocabulary-checked but never
+    // terminal-safety-checked — an embedded newline must not forge an extra row.
+    it('sanitizes an embedded newline in workflowStatus instead of forging an extra row', () => {
+        const evilRow = { id: 'doc-ten-1', entryId: 'TEN-1', name: 'A tension', canonicalKey: 'tension', status: 'accepted', workflowStatus: 'open\nFAKE ROW: nothing to see here' };
+        const text = formatRoleAccountable({ ...emptyResult, explicit: [evilRow] });
+        expect(text.split('\n')).not.toContain('    FAKE ROW: nothing to see here');
+        expect(text).toContain('open FAKE ROW: nothing to see here');
+    });
+});
+// TASK-633 S3c (WP-808, DEC-1954): `pb role seat` / `pb role unseat` call the same kernel doors as the
+// MCP role tool and print the same sentence (packages/mcp-server/src/tools/__tests__/role.test.ts).
+describe('pb role seat / unseat', () => {
+    const seated = {
+        outcome: 'applied', operation: 'role.seat', created: true, person: 'Jan Jansen', personId: 'p1', personStatus: 'placeholder',
+        role: 'ROL-8', roleName: 'Product Analyst', team: 'TEAM-1', teamName: 'Product',
+    };
+    let printed;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'pb_sk_test', siteUrl: 'https://example.test' });
+        readSession.mockReturnValue({ sessionId: 'sess-1' });
+        isJsonMode.mockReturnValue(false);
+        printed = [];
+        vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => { printed.push(String(chunk)); return true; });
+    });
+    it('seat: a new person by name calls organisation.seatInRole with the session and prints who was seated as what', async () => {
+        kernelCallWithSession.mockResolvedValue(seated);
+        await runRoleSeat('ROL-8', { newPerson: 'Jan Jansen' });
+        expect(kernelCallWithSession).toHaveBeenCalledWith('organisation.seatInRole', {
+            roleRef: 'ROL-8', targetPersonRef: undefined, newPersonName: 'Jan Jansen', teamRef: undefined, sessionId: 'sess-1',
+        });
+        expect(printed.join('')).toBe('Seated Jan Jansen (Not invited) [p1] as Product Analyst (ROL-8) in Product.\n');
+    });
+    it('seat: the same placeholder again reads as confirmed (the kernel reuses the person by exact name)', async () => {
+        kernelCallWithSession.mockResolvedValue({ ...seated, created: false });
+        await runRoleSeat('ROL-8', { newPerson: 'Jan Jansen' });
+        expect(printed.join('')).toBe('Confirmed Jan Jansen (Not invited) [p1] as Product Analyst (ROL-8) in Product.\n');
+    });
+    it('seat: an existing person with --team (Team Lead) forwards the team, and an active person carries no status tag', async () => {
+        kernelCallWithSession.mockResolvedValue({ ...seated, created: false, person: 'Ada', personStatus: 'active', roleName: 'Team Lead', role: 'ROL-1' });
+        await runRoleSeat('ROL-1', { person: 'ada@example.test', team: 'TEAM-1' });
+        expect(kernelCallWithSession).toHaveBeenCalledWith('organisation.seatInRole', expect.objectContaining({ roleRef: 'ROL-1', targetPersonRef: 'ada@example.test', teamRef: 'TEAM-1' }));
+        expect(printed.join('')).toBe('Confirmed Ada [p1] as Team Lead (ROL-1) in Product.\n');
+    });
+    it('seat: refuses both or neither person before any call', async () => {
+        await expect(runRoleSeat('ROL-8', { person: 'p1', newPerson: 'Jan' })).rejects.toThrow('not both');
+        await expect(runRoleSeat('ROL-8', {})).rejects.toMatchObject({ code: ErrorCode.VALIDATION_FAILED, message: expect.stringContaining('Say who to seat') });
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('seat: a kernel refusal fails the command with its reason, and the required action as guidance', async () => {
+        kernelCallWithSession.mockResolvedValue({ outcome: 'refused', refusal: { code: 'team_lead_required', reason: "Only the team's Team Lead can change its seats.", requiredAction: 'Ask the Team Lead.' } });
+        await expect(runRoleSeat('ROL-8', { person: 'p1' })).rejects.toMatchObject({
+            message: "Only the team's Team Lead can change its seats.", code: ErrorCode.AUTH_DENIED, guidance: 'Ask the Team Lead.',
+        });
+        expect(printed.join('')).toBe('');
+    });
+    it('seat and unseat refuse without an active session, before any call', async () => {
+        readSession.mockReturnValue(null);
+        await expect(runRoleSeat('ROL-8', { person: 'p1' })).rejects.toThrow('No active session');
+        await expect(runRoleUnseat('ROL-8', { person: 'p1' })).rejects.toThrow('No active session');
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('unseat: calls organisation.unseatFromRole and says who lost which role, or that nothing changed', async () => {
+        kernelCallWithSession.mockResolvedValue({ ...seated, operation: 'role.unseat', removed: true, personStatus: undefined });
+        await runRoleUnseat('ROL-8', { person: 'p1' });
+        expect(kernelCallWithSession).toHaveBeenCalledWith('organisation.unseatFromRole', { roleRef: 'ROL-8', targetPersonRef: 'p1', teamRef: undefined, sessionId: 'sess-1' });
+        kernelCallWithSession.mockResolvedValue({ ...seated, operation: 'role.unseat', removed: false, personStatus: undefined });
+        await runRoleUnseat('ROL-8', { person: 'p1' });
+        expect(printed.join('')).toBe('Unseated Jan Jansen from Product Analyst (ROL-8) in Product.\nJan Jansen did not hold Product Analyst (ROL-8) in Product; nothing changed.\n');
+    });
+    it('unseat: the last active Team Lead refusal is a validation failure naming the reason', async () => {
+        kernelCallWithSession.mockResolvedValue({ outcome: 'refused', refusal: { code: 'last_team_lead', reason: 'Product needs an active Team Lead.' } });
+        await expect(runRoleUnseat('ROL-1', { person: 'p1', team: 'TEAM-1' })).rejects.toMatchObject({
+            message: 'Product needs an active Team Lead.', code: ErrorCode.VALIDATION_FAILED,
+        });
+    });
+    it('--json prints the kernel result as it came', async () => {
+        isJsonMode.mockReturnValue(true);
+        kernelCallWithSession.mockResolvedValue(seated);
+        await runRoleSeat('ROL-8', { newPerson: 'Jan Jansen' });
+        expect(JSON.parse(printed.join(''))).toEqual(seated);
+    });
+});
+describe('pb role list (TEN-4847)', () => {
+    const roles = (n, from = 0) => Array.from({ length: n }, (_, i) => ({ entryId: `ROL-${from + i + 1}`, name: `Role ${from + i + 1}`, status: 'accepted', workflowStatus: null }));
+    const placed = (team) => ({ owner: { kind: 'placed', of: 'role', team: { name: team }, ancestors: [], ancestorsTruncated: false } });
+    function route(pages) {
+        let page = 0;
+        kernelCall.mockImplementation(async (name, args) => {
+            if (name === 'chain.listEntriesPaged')
+                return pages[page++];
+            if (name === 'chain.getEntry')
+                return placed('Agent Engineering');
+            if (name === 'chain.listByRole') {
+                return { ...emptyResult, holders: args.roleId === 'ROL-1' ? [{ personId: 'p1', displayName: 'Ann', status: 'active', teamName: 'Agent Engineering' }] : [] };
+            }
+            throw new Error(`unexpected ${name}`);
+        });
+    }
+    beforeEach(() => {
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'pb_sk_test', siteUrl: 'https://example.test' });
+    });
+    it('reads the roles collection through the paged read and prints id, name, team and holder count', async () => {
+        route([{ rows: roles(2), continueCursor: null }]);
+        const result = await readRoleList();
+        expect(kernelCall).toHaveBeenCalledWith('chain.listEntriesPaged', { collectionSlug: 'roles', cursor: undefined, pageSize: ROLE_LIST_CAP });
+        expect(kernelCall).toHaveBeenCalledWith('chain.listByRole', { roleId: 'ROL-1', limit: 1 });
+        expect(result.truncated).toBe(false);
+        expect(formatRoleList(result)).toBe([
+            'Roles (2):',
+            '  ROL-1  Role 1  Team: Agent Engineering  1 holder',
+            '  ROL-2  Role 2  Team: Agent Engineering  0 holders',
+        ].join('\n'));
+    });
+    it('follows the cursor and stops at the cap, saying the list is cut', async () => {
+        route([
+            { rows: roles(30), continueCursor: 'c1' },
+            { rows: roles(30, 30), continueCursor: 'c2' },
+            { rows: roles(30, 60), continueCursor: null },
+        ]);
+        const result = await readRoleList();
+        expect(result.roles).toHaveLength(ROLE_LIST_CAP);
+        expect(result.truncated).toBe(true);
+        const pageCalls = kernelCall.mock.calls.filter((c) => c[0] === 'chain.listEntriesPaged');
+        expect(pageCalls.map((c) => c[1].pageSize)).toEqual([ROLE_LIST_CAP, ROLE_LIST_CAP - 30]);
+        expect(formatRoleList(result).split('\n').at(-1)).toBe(`  (list cut after ${ROLE_LIST_CAP} roles; more may exist)`);
+    });
+    it('an empty workspace says so', () => {
+        expect(formatRoleList({ roles: [], truncated: false })).toBe('No roles in this workspace.');
+    });
+    it('an empty but cut read never claims the workspace has no roles', () => {
+        expect(formatRoleList({ roles: [], truncated: true })).toBe('No roles read yet.\n  (list cut after 0 roles; more may exist)');
+    });
+    it('stops after the page bound when pages come back empty', async () => {
+        route(Array.from({ length: 11 }, () => ({ rows: [], continueCursor: 'more' })));
+        const result = await readRoleList();
+        expect(result).toEqual({ roles: [], truncated: true });
+        expect(kernelCall.mock.calls.filter((c) => c[0] === 'chain.listEntriesPaged')).toHaveLength(10);
+    });
+});
+//# sourceMappingURL=role.test.js.map