@productbrain/cli 0.1.0-beta.925 → 0.1.0-beta.9253

package/dist/commands/relate.js

@@ -10,6 +10,7 @@ import { readSession } from '../lib/session.js';
 import { runCliCommand } from '../lib/runner.js';
 import { formatRelateReceipt, formatUnrelateReceipt } from '../formatters/relate.js';
 import { CLIError, ErrorCode } from '../lib/errors.js';
+import { emitEffectiveTenantNotice } from '../lib/workspaceNotice.js';
 export async function runRelate(options) {
     const config = await getConfigOrGuide(() => runRelate(options));
     if (!config)
@@ -20,7 +21,8 @@ export async function runRelate(options) {
         throw new CLIError('No active session.', {
             code: ErrorCode.SESSION_REQUIRED,
             category: 'session',
-            guidance: 'Run `pb session start` first. Write access requires a tracked session (DEC-9).',
+            // DEC-9
+            guidance: 'Run `pb session start` first. Write access requires a tracked session.',
         });
     }
     const fromId = options.fromId.trim();
@@ -33,6 +35,8 @@ export async function runRelate(options) {
             guidance: 'Usage: pb relate <from-id> <type> <to-id>',
         });
     }
+    // WP-1: name the target workspace before the write (stderr, every output mode — WP-721).
+    await emitEffectiveTenantNotice();
     await runCliCommand({
         fn: async () => {
             const mcpArgs = {
@@ -43,31 +47,98 @@ export async function runRelate(options) {
             if (options.ifMissing) {
                 mcpArgs.ifMissing = true;
             }
-            const result = await kernelCallWithSession('chain.createEntryRelation', mcpArgs);
-            // WP-363 S5: Chain debt prevented — misuse pattern intercepted, print coaching message.
-            if (result?.chainDebtPrevented) {
+            if (options.dryRun) {
+                mcpArgs.preview = true;
+            }
+            // WP-688 S2a review fix (thread bb1oj): a genuinely separate call arity for dry-run — a
+            // real write ALWAYS passes exactly 2 args (unchanged from before this fix), never a 3rd
+            // `undefined` options arg, so this is a true opt-IN to skipSessionTouch, not a silent
+            // no-op default threaded through every call.
+            let result;
+            try {
+                result = options.dryRun
+                    ? await kernelCallWithSession('chain.createEntryRelation', mcpArgs, { skipSessionTouch: true })
+                    : await kernelCallWithSession('chain.createEntryRelation', mcpArgs);
+            }
+            catch (err) {
+                // WP-745 (DEC-1681, round 4 M2 + PR #896 review): do NOT copy update.ts:213-227's
+                // invalid_option branch verbatim — it pre-empts mcpErr.message and would drop the
+                // task-naming instruction. Render the server's message FIRST (it already names task +
+                // the 12 verbs), then also surface the structured validOptions line so an agent parsing
+                // stderr sees it twice. Gated on validOptions actually being present (the REL-LEGAL-2
+                // refusal shape) — any OTHER McpError (auth denial, rate limit, a different validation
+                // failure) rethrows unchanged so its own code/category/guidance survive (review finding:
+                // the prior unconditional `err.name === 'McpError'` match reclassified every gateway
+                // failure as VALIDATION_FAILED).
+                if (err instanceof Error && err.name === 'McpError') {
+                    const mcpErr = err;
+                    const validOptions = mcpErr.details?.find((d) => d.errorType === 'invalid_option' && d.validOptions)?.validOptions;
+                    if (validOptions && validOptions.length > 0) {
+                        const lines = [mcpErr.message, `Legal relation types toward this work package: ${validOptions.join(', ')}`];
+                        throw new CLIError(lines.join('\n'), { code: ErrorCode.VALIDATION_FAILED, category: 'validation' });
+                    }
+                }
+                throw err;
+            }
+            // WP-753 O4 (TEN-3651): chain.createEntryRelation now judges organisational authority
+            // and RETURNS `{outcome:'refused', refusal}` on refusal (never throws) — the exact shape
+            // update.ts's runUpdate already guards against with the same "a refusal must never read
+            // as success" comment. Without this check, the code below reads a refused write as a
+            // plain successful `action: 'related'` receipt.
+            const maybeRefused = result;
+            if (maybeRefused.outcome === 'refused' && maybeRefused.refusal) {
+                const refusal = maybeRefused.refusal;
+                const authorityRefusal = refusal.category === 'auth';
+                throw new CLIError(refusal.reason ?? `Relating ${fromId} to ${toId} was refused.`, {
+                    code: authorityRefusal ? ErrorCode.AUTH_DENIED : ErrorCode.VALIDATION_FAILED,
+                    category: authorityRefusal ? 'auth' : 'validation',
+                    guidance: refusal.requiredAction ?? 'Route this change to the accountable role or Team Lead.',
+                });
+            }
+            // WP-363 S5: Chain debt prevented — misuse pattern intercepted. Checked BEFORE the
+            // dry-run branch (WP-688 S2a review fix, thread bbzfq): the server now evaluates this
+            // gate regardless of preview, so a dry-run must reflect the SAME predicted diversion a
+            // real call would take, never a plain clean "would write" result.
+            // WP-776 S2a (DEC-1771): a real (non-dry-run) misuse hit now THROWS from the server
+            // (relations.ts refuses outright, fail-closed — no more agent sign-off proposal
+            // diversion), caught and rethrown unchanged by the catch block above, so only the
+            // dry-run/preview branch below is still reachable — a preview call never throws.
+            if (result?.chainDebtPrevented && options.dryRun) {
                 const alts = result.suggestedAlternatives ?? [];
-                console.warn(`\n⚠ Chain debt prevented`);
+                console.warn(`\n⚠ [dry-run] Chain debt would be prevented`);
                 console.warn(`  "${result.originalType ?? type}" is a common misuse for this entry pair.`);
-                console.warn(`  Created agent sign-off proposal: ${result.proposalId}`);
+                console.warn(`  A real (non-dry-run) call would refuse this relation outright.`);
                 console.warn(`\nSuggested alternatives:`);
-                for (const alt of alts) {
+                for (const alt of alts)
                     console.warn(`  • ${alt.type}: ${alt.reason}`);
-                }
-                console.warn(`\nReview at /review in Cortex UI or use \`pb proposals\` to manage.`);
-                return { fromId, type, toId, action: 'proposal_created', proposalId: result.proposalId };
+                return { fromId, type, toId, action: 'dry_run', chainDebtPrevented: true };
+            }
+            // WP-688 S2a: preview mode returns a DIFFERENT shape than a real write — never asserted
+            // as 'related'. `alreadyExists` (thread bb38B) survives into the dry-run receipt: the
+            // ifMissing early-return in relations.ts is itself non-mutating regardless of `preview`,
+            // so it is safe and necessary to preserve — dropping it hid whether a real
+            // `--if-missing --dry-run` call would be a no-op.
+            if (options.dryRun) {
+                return {
+                    fromId, type, toId, action: 'dry_run',
+                    advisories: result?.advisories && result.advisories.length > 0 ? result.advisories : undefined,
+                    wouldBlock: result?.wouldBlock, blockingReason: result?.blockingReason,
+                    alreadyExists: options.ifMissing ? result?.alreadyExists === true : undefined,
+                };
             }
-            const isProposal = result?.status === 'proposal_created';
+            // WP-776 S2a (DEC-1771): a real write is always 'related' now — the relation-consent
+            // proposal system that used to divert some governs writes into 'proposal_created' is gone.
             const output = {
                 fromId,
                 type,
                 toId,
-                action: isProposal ? 'proposal_created' : 'related',
+                action: 'related',
             };
-            if (isProposal && result?.proposalId)
-                output.proposalId = result.proposalId;
             if (options.ifMissing)
                 output.alreadyExists = result?.alreadyExists === true;
+            // WP-625 (S3 of WP-618, DEC-1546, TEN-3037): surface the relate door's advisories in the CLI.
+            if (result?.advisories && result.advisories.length > 0)
+                output.advisories = result.advisories;
             return output;
         },
         formatPretty: (result) => formatRelateReceipt(result),
@@ -83,7 +154,8 @@ export async function runUnrelate(options) {
         throw new CLIError('No active session.', {
             code: ErrorCode.SESSION_REQUIRED,
             category: 'session',
-            guidance: 'Run `pb session start` first. Write access requires a tracked session (DEC-9).',
+            // DEC-9
+            guidance: 'Run `pb session start` first. Write access requires a tracked session.',
         });
     }
     const fromId = options.fromId.trim();
@@ -96,6 +168,8 @@ export async function runUnrelate(options) {
             guidance: 'Usage: pb unrelate <from-id> <type> <to-id>',
         });
     }
+    // WP-1: name the target workspace before the write (stderr, every output mode — WP-721).
+    await emitEffectiveTenantNotice();
     await runCliCommand({
         fn: async () => {
             await kernelCallWithSession('chain.removeEntryRelation', {

package/dist/commands/relate.js.map

@@ -1 +1 @@
-{"version":3,"file":"relate.js","sourceRoot":"","sources":["../../src/commands/relate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAkBvD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACvC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,gFAAgF;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;YAC5C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,2CAA2C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAe;QAChC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,OAAO,GAA4B;gBACvC,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,IAAI;aACL,CAAC;YACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,2BAA2B,EAAE,OAAO,CAOlE,CAAC;YAEd,wFAAwF;YACxF,IAAI,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,YAAY,IAAI,IAAI,2CAA2C,CAAC,CAAC;gBAC3F,OAAO,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;gBAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;gBACpF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kBAA2B,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,EAAE,MAAM,KAAK,kBAAkB,CAAC;YACzD,MAAM,MAAM,GAAiB;gBAC3B,MAAM;gBACN,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,kBAA2B,CAAC,CAAC,CAAC,SAAkB;aACtE,CAAC;YACF,IAAI,UAAU,IAAI,MAAM,EAAE,UAAU;gBAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YAC5E,IAAI,OAAO,CAAC,SAAS;gBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;YAC7E,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACvC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,gFAAgF;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;YAC5C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,6CAA6C;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAe;QAChC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,qBAAqB,CAAC,2BAA2B,EAAE;gBACvD,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,IAAI;aACL,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;QAC9D,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"relate.js","sourceRoot":"","sources":["../../src/commands/relate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAY,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAuB,MAAM,yBAAyB,CAAC;AAC1G,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AA0BtE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACvC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ;YACR,QAAQ,EAAE,wEAAwE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;YAC5C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,2CAA2C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACzF,MAAM,yBAAyB,EAAE,CAAC;IAElC,MAAM,aAAa,CAAe;QAChC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,OAAO,GAA4B;gBACvC,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,IAAI;aACL,CAAC;YACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YACzB,CAAC;YAgBD,wFAAwF;YACxF,wFAAwF;YACxF,sFAAsF;YACtF,6CAA6C;YAC7C,IAAI,MAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,OAAO,CAAC,MAAM;oBACrB,CAAC,CAAC,MAAM,qBAAqB,CAAwD,2BAA2B,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAyB;oBAC9K,CAAC,CAAC,MAAM,qBAAqB,CAAwD,2BAA2B,EAAE,OAAO,CAAyB,CAAC;YACvJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kFAAkF;gBAClF,kFAAkF;gBAClF,sFAAsF;gBACtF,wFAAwF;gBACxF,sFAAsF;gBACtF,uFAAuF;gBACvF,yFAAyF;gBACzF,qFAAqF;gBACrF,iCAAiC;gBACjC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACpD,MAAM,MAAM,GAAG,GAAe,CAAC;oBAC/B,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,gBAAgB,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;oBACnH,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC5C,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,kDAAkD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBAC5G,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;oBACtG,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,sFAAsF;YACtF,yFAAyF;YACzF,wFAAwF;YACxF,qFAAqF;YACrF,gDAAgD;YAChD,MAAM,YAAY,GAAG,MAAmI,CAAC;YACzJ,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;gBAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;gBACrC,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;gBACrD,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,MAAM,OAAO,IAAI,eAAe,EAAE;oBACjF,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB;oBAC5E,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;oBAClD,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,yDAAyD;iBAC9F,CAAC,CAAC;YACL,CAAC;YAED,mFAAmF;YACnF,sFAAsF;YACtF,uFAAuF;YACvF,kEAAkE;YAClE,oFAAoF;YACpF,gFAAgF;YAChF,kFAAkF;YAClF,iFAAiF;YACjF,IAAI,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACjD,MAAM,IAAI,GAAG,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,YAAY,IAAI,IAAI,2CAA2C,CAAC,CAAC;gBAC3F,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;gBACjF,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;gBAC1C,KAAK,MAAM,GAAG,IAAI,IAAI;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACvE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAkB,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;YACtF,CAAC;YAED,wFAAwF;YACxF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,kDAAkD;YAClD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAkB;oBAC9C,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;oBAC9F,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc;oBACtE,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS;iBAC9E,CAAC;YACJ,CAAC;YAED,qFAAqF;YACrF,2FAA2F;YAC3F,MAAM,MAAM,GAAiB;gBAC3B,MAAM;gBACN,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,SAAkB;aAC3B,CAAC;YACF,IAAI,OAAO,CAAC,SAAS;gBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;YAC7E,8FAA8F;YAC9F,IAAI,MAAM,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YAC9F,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACvC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ;YACR,QAAQ,EAAE,wEAAwE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;YAC5C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,6CAA6C;SACxD,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACzF,MAAM,yBAAyB,EAAE,CAAC;IAElC,MAAM,aAAa,CAAe;QAChC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,qBAAqB,CAAwD,2BAA2B,EAAE;gBAC9G,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,IAAI;aACL,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;QAC9D,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/restore.d.ts

@@ -0,0 +1,2 @@
+export declare function runRestore(entryIdArg: string): Promise<void>;
+//# sourceMappingURL=restore.d.ts.map

package/dist/commands/restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAoBA,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsElE"}

package/dist/commands/restore.js

@@ -0,0 +1,83 @@
+/**
+ * pb restore <entry-id> — restore an archived Chain entry to draft.
+ *
+ * WP-514 review round 2 (P1): the ONLY production path to restoreArchivedEntry — a brand-new,
+ * always-authority-gated capability (VALID_ENTRY_STATUS_TRANSITIONS stays closed for archived,
+ * lib/guards.ts:146; there is no legacy fallback). Thin client mirroring `pb update`'s
+ * session/refusal handling — the server owns validation (BR-104).
+ */
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCallWithSession } from '../lib/client.js';
+import { readSession } from '../lib/session.js';
+import { isJsonMode } from '../lib/runner.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { emitEffectiveTenantNotice } from '../lib/workspaceNotice.js';
+export async function runRestore(entryIdArg) {
+    const config = await getConfigOrGuide(() => runRestore(entryIdArg));
+    if (!config)
+        return;
+    const json = isJsonMode();
+    const session = readSession();
+    if (!session) {
+        throw new CLIError('No active session.', {
+            code: ErrorCode.SESSION_REQUIRED,
+            category: 'session',
+            guidance: 'Run `pb session start` first. Write access requires a tracked session.',
+        });
+    }
+    const entryId = entryIdArg.trim();
+    if (!entryId) {
+        throw new CLIError('Entry ID is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Usage: pb restore <entry-id>',
+        });
+    }
+    await emitEffectiveTenantNotice();
+    if (!json)
+        process.stdout.write(`Restoring ${entryId} to draft...\n`);
+    let result;
+    try {
+        result = await kernelCallWithSession('chain.restoreArchivedEntry', {
+            entryId, changedBy: `agent:${session.sessionId}`,
+        });
+    }
+    catch (err) {
+        const mcpErr = err;
+        if (err instanceof Error && err.name === 'McpError') {
+            // Sweep finding #5: preserve an authority refusal as an authority refusal — mirrors
+            // runUpdate (update.ts). Flattening every gateway error to VALIDATION_FAILED told a
+            // machine caller to "fix input" even for a deny-by-default AUTH_DENIED (e.g. a
+            // delegated credential), instead of routing the work to an authorized principal.
+            const serverCode = String(mcpErr.code);
+            if (serverCode === 'AUTHZ_PERMISSION_DENIED' || serverCode === ErrorCode.AUTH_DENIED) {
+                throw new CLIError(mcpErr.message, {
+                    code: ErrorCode.AUTH_DENIED,
+                    category: 'auth',
+                    guidance: mcpErr.guidance,
+                });
+            }
+            throw new CLIError(mcpErr.message, { code: ErrorCode.VALIDATION_FAILED, category: 'validation' });
+        }
+        throw err;
+    }
+    if (result.outcome === 'refused') {
+        const { refusal } = result;
+        if (json) {
+            process.stdout.write(JSON.stringify({ outcome: 'refused', refusal }) + '\n');
+        }
+        const authorityRefusal = refusal.code !== 'not_archived' && refusal.code !== 'still_superseded';
+        throw new CLIError(refusal.reason ?? `Restoring ${entryId} was refused.`, {
+            code: authorityRefusal ? ErrorCode.AUTH_DENIED : ErrorCode.VALIDATION_FAILED,
+            category: authorityRefusal ? 'auth' : 'validation',
+            guidance: refusal.requiredAction ?? 'Route this change to the accountable role or Team Lead.',
+        });
+    }
+    if (json) {
+        process.stdout.write(JSON.stringify({ outcome: 'restored', entryId }) + '\n');
+    }
+    else {
+        process.stdout.write(`${entryId} restored to draft.\n`);
+    }
+}
+//# sourceMappingURL=restore.js.map

package/dist/commands/restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAMtE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IAClD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAE1B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE;YAC3C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,8BAA8B;SACxC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,yBAAyB,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,gBAAgB,CAAC,CAAC;IAEtE,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,qBAAqB,CAAgB,4BAA4B,EAAE;YACjF,OAAO,EAAE,SAAS,EAAE,SAAS,OAAO,CAAC,SAAS,EAAE;SAChD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,GAAe,CAAC;QAC/B,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrD,oFAAoF;YACpF,oFAAoF;YACpF,+EAA+E;YAC/E,iFAAiF;YACjF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,UAAU,KAAK,yBAAyB,IAAI,UAAU,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;gBACtF,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE;oBAClC,IAAI,EAAE,SAAS,CAAC,WAAW;oBAC3B,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC;QAChG,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,OAAO,eAAe,EAAE;YACzE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB;YAC5E,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;YAClD,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,yDAAyD;SAC7F,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/E,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,uBAAuB,CAAC,CAAC;IACzD,CAAC;AACF,CAAC"}

package/dist/commands/rework.d.ts

@@ -0,0 +1,24 @@
+/**
+ * pb rework report — report an observed rework signal (WP-487 Slice 1 / FEAT-1373).
+ *
+ * Fills the M4 rework-meter slot reserved by `convex/scoreboard/aggregates.ts:1-15,597`. This is
+ * the SOLE ingestion path this quarter (founder-decided, WP-C spec §3/§4 Slice 1 Pass-2 review) —
+ * an agent-native checkpoint the CLI reports explicitly, not a CI/git-webhook adapter (excluded,
+ * spec §6). Requires an active session (mirrors `pb capture`, DEC-9/BR-8): the M4 join key needs
+ * a stable `conversationId`, which only resolves inside a tracked session.
+ */
+export interface ReworkReportOptions {
+    entryId: string;
+    classification: string;
+    reportedVia?: string;
+    attributable?: boolean;
+    task?: string;
+    /** Codex P2 fix (round 2, post-merge review): explicit conversation override, mirroring
+     *  `pb session start --conversation <id>`. Without this, `pb rework report` has no way to
+     *  find a session started with `--conversation <id>` when the shell never also set
+     *  PB_CONVERSATION_ID — readSession() with no override falls back to the legacy marker path,
+     *  not the conversation-scoped one `session start --conversation` wrote to. */
+    conversation?: string;
+}
+export declare function runReworkReport(options: ReworkReportOptions): Promise<void>;
+//# sourceMappingURL=rework.d.ts.map

package/dist/commands/rework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework.d.ts","sourceRoot":"","sources":["../../src/commands/rework.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;mFAI+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AASD,wBAAsB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFjF"}

package/dist/commands/rework.js

@@ -0,0 +1,97 @@
+/**
+ * pb rework report — report an observed rework signal (WP-487 Slice 1 / FEAT-1373).
+ *
+ * Fills the M4 rework-meter slot reserved by `convex/scoreboard/aggregates.ts:1-15,597`. This is
+ * the SOLE ingestion path this quarter (founder-decided, WP-C spec §3/§4 Slice 1 Pass-2 review) —
+ * an agent-native checkpoint the CLI reports explicitly, not a CI/git-webhook adapter (excluded,
+ * spec §6). Requires an active session (mirrors `pb capture`, DEC-9/BR-8): the M4 join key needs
+ * a stable `conversationId`, which only resolves inside a tracked session.
+ */
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCallWithSession } from '../lib/client.js';
+import { runCliCommand } from '../lib/runner.js';
+import { readSession } from '../lib/session.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+const CLASSIFICATIONS = ['revision', 'ci_review_correction', 'user_override'];
+const REPORTED_VIA = ['followup_commit', 'ci_rerun', 'manual'];
+export async function runReworkReport(options) {
+    const config = await getConfigOrGuide(() => runReworkReport(options));
+    if (!config)
+        return;
+    const entryId = options.entryId?.trim();
+    if (!entryId) {
+        throw new CLIError('An entry ID is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+    }
+    if (!CLASSIFICATIONS.includes(options.classification)) {
+        throw new CLIError(`--classification must be one of: ${CLASSIFICATIONS.join(', ')}`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+    }
+    const classification = options.classification;
+    const reportedVia = (options.reportedVia ?? 'manual');
+    if (!REPORTED_VIA.includes(reportedVia)) {
+        throw new CLIError(`--via must be one of: ${REPORTED_VIA.join(', ')}`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+    }
+    // Require active session (DEC-9, BR-8, mirrors pb capture) — write access needs a tracked
+    // session, and the M4 join key needs the session's resolved conversationId.
+    //
+    // Codex P2 fix (round 2, post-merge review): pass `options.conversation` through to
+    // readSession() so a caller who started the session with `pb session start --conversation <id>`
+    // (writing the marker to .productbrain/sessions/<id>.json) can find it here even when the shell
+    // never ALSO exported PB_CONVERSATION_ID — a bare readSession() falls back to the legacy marker
+    // path and misses it. Without this override, an agent following `pb session start`'s own
+    // recovery guidance would still hit "No active session" on the very next command.
+    const session = readSession(options.conversation);
+    if (!session) {
+        throw new CLIError('No active session.', {
+            code: ErrorCode.SESSION_REQUIRED,
+            category: 'session',
+            guidance: 'Run `pb session start` first. Write access requires a tracked session. If you started a ' +
+                'session with `pb session start --conversation <id>`, re-run this command with ' +
+                '`--conversation <id>` (or export PB_CONVERSATION_ID=<id> in this shell) so it resolves the ' +
+                'same conversation-scoped marker.',
+        });
+    }
+    if (!session.conversationId) {
+        // Fail closed client-side too (TEN-2728): a rework signal with no conversationId cannot
+        // anchor the M4 join, and the server refuses it anyway — surface the real cause here rather
+        // than a generic server validation error.
+        throw new CLIError('No conversation identity resolved for this session.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'A rework signal needs a stable conversationId to join against the governance-served log (M4). ' +
+                'Run this from a harness that sets PB_CONVERSATION_ID / CLAUDE_CODE_SESSION_ID / CURSOR_CONVERSATION_ID, ' +
+                'or start a fresh session with `pb session start --conversation <id>` and re-run this command ' +
+                'with the SAME `--conversation <id>` (the flag is only read by `session start` otherwise).',
+        });
+    }
+    await runCliCommand({
+        fn: async () => {
+            return await kernelCallWithSession('rework.report', {
+                // Codex P1 fix (post-merge review): sessionId lets the server resolve conversationId
+                // AUTHORITATIVELY from the caller's own agentSessions row (mirrors served.ts's
+                // recordGovernanceServed stamping) rather than trusting the client-supplied string alone.
+                // conversationId still travels as a fallback for the server's bare-conversationId lookup
+                // path — both are verified server-side against the gateway-injected caller identity.
+                sessionId: session.sessionId,
+                conversationId: session.conversationId,
+                entryId,
+                classification,
+                reportedVia,
+                ...(options.attributable ? { attributableToGovernanceMiss: true } : {}),
+                ...(options.task ? { task: options.task } : {}),
+            });
+        },
+        formatPretty: (result) => result.deduped
+            ? `Rework signal already recorded (${classification}, via ${reportedVia}) — reused the existing row from a moment ago.`
+            : `Rework signal recorded (${classification}, via ${reportedVia}).`,
+    });
+}
+//# sourceMappingURL=rework.js.map

package/dist/commands/rework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework.js","sourceRoot":"","sources":["../../src/commands/rework.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,CAAU,CAAC;AAGvF,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAwBxE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA4B;IAChE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAsC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,oCAAoC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACnF,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAsC,CAAC;IAEtE,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAsB,CAAC;IAC3E,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAAC,yBAAyB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACrE,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAED,0FAA0F;IAC1F,4EAA4E;IAC5E,EAAE;IACF,oFAAoF;IACpF,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,yFAAyF;IACzF,kFAAkF;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACvC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EACN,0FAA0F;gBAC1F,gFAAgF;gBAChF,6FAA6F;gBAC7F,kCAAkC;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,wFAAwF;QACxF,4FAA4F;QAC5F,0CAA0C;QAC1C,MAAM,IAAI,QAAQ,CAAC,qDAAqD,EAAE;YACxE,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EACN,gGAAgG;gBAChG,0GAA0G;gBAC1G,+FAA+F;gBAC/F,2FAA2F;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAqB;QACtC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,OAAO,MAAM,qBAAqB,CAA4C,eAAe,EAAE;gBAC7F,qFAAqF;gBACrF,+EAA+E;gBAC/E,0FAA0F;gBAC1F,yFAAyF;gBACzF,qFAAqF;gBACrF,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,OAAO;gBACP,cAAc;gBACd,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACvB,MAAM,CAAC,OAAO;YACZ,CAAC,CAAC,mCAAmC,cAAc,SAAS,WAAW,gDAAgD;YACvH,CAAC,CAAC,2BAA2B,cAAc,SAAS,WAAW,IAAI;KACxE,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/role.d.ts

@@ -0,0 +1,57 @@
+export interface RoleAccountableOptions {
+    canonicalKey?: string;
+    limit?: string;
+    cursor?: string;
+    json?: boolean;
+}
+/** Mirrors `chain.listByRole`'s row shape (convex/agentKnowledge/entriesByRole.ts's
+ *  `RoleEntrySummary`) with a PLAIN `id: string` — the door returns a Convex document id over
+ *  the wire as a bare string, and this interface (not the raw gateway type's branded
+ *  `Id<'entries'>`) is what argv-facing code and its own tests actually handle, same pattern
+ *  `outcome.ts`'s own `ReadingRow`/`ListReadingsResult` use. The call site below still derives
+ *  from `GatewayRouteReturnByName<'chain.listByRole'>` (review PRRT_kwDORS4ils6gQAqu) so a
+ *  route-shape drift fails the `as` cast at compile time — the branded id only blocks the
+ *  OPPOSITE direction (a plain-string test fixture claiming to BE the branded type), which never
+ *  happens here: the widening cast below (branded -> plain) is always legal. */
+export interface RoleEntryRow {
+    id: string;
+    entryId?: string;
+    name: string;
+    canonicalKey?: string;
+    collectionSlug?: string;
+    status: string;
+    workflowStatus?: string;
+}
+export interface ListByRoleResult {
+    role: {
+        id: string;
+        entryId?: string;
+        name: string;
+    };
+    explicit: RoleEntryRow[];
+    explicitTruncated: boolean;
+    nextCursor: number | null;
+    reporting: RoleEntryRow[];
+    reportingTruncated: boolean;
+    inherited: RoleEntryRow[];
+    inheritedResolution: 'not-computed';
+    inheritedNotComputedReason: string;
+    truncated: boolean;
+    /** TASK-636 (DEC-1810): who holds the role; status is active, invited or placeholder. */
+    holders: {
+        personId: string;
+        displayName: string;
+        status: string;
+        teamName: string | null;
+    }[];
+    holdersTruncated: boolean;
+}
+/**
+ * Pretty rendering for `pb role accountable`. Exported so door-parity content-equality against
+ * the MCP tool's own rendering (`packages/mcp-server/src/tools/role.ts`) is assertable directly,
+ * not only through a live walk — both read the SAME `chain.listByRole` JSON shape and both print
+ * the SAME three sections in the SAME order.
+ */
+export declare function formatRoleAccountable(result: ListByRoleResult | null): string;
+export declare function runRoleAccountable(roleId: string, options: RoleAccountableOptions): Promise<void>;
+//# sourceMappingURL=role.d.ts.map

package/dist/commands/role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/commands/role.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,sBAAsB;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;gFAQgF;AAChF,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IAItB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,mBAAmB,EAAE,cAAc,CAAC;IACpC,0BAA0B,EAAE,MAAM,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAC9F,gBAAgB,EAAE,OAAO,CAAC;CAC1B;AAsGD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAkB7E;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvG"}

package/dist/commands/role.js

@@ -0,0 +1,141 @@
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCall } from '../lib/client.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { runCliCommand } from '../lib/runner.js';
+import { sanitizeSingleLineField } from '../lib/strip.js';
+/** Holders first: who answers for the role, a non-active holder tagged with their status. */
+function formatHolders(result) {
+    if (result.holders.length === 0)
+        return [`  holders: none${result.holdersTruncated ? ' found, but the membership scan is incomplete' : ''}`];
+    return [
+        '  holders:',
+        ...result.holders.map((h) => {
+            const tag = h.status === 'active' ? '' : ` (${sanitizeSingleLineField(h.status)})`;
+            const team = h.teamName ? `  in ${sanitizeSingleLineField(h.teamName)}` : '';
+            return `    ${sanitizeSingleLineField(h.displayName)}${tag}${team}`;
+        }),
+        ...(result.holdersTruncated ? ['    (membership scan cut at 500 rows, more holders may exist)'] : []),
+    ];
+}
+const validation = (message, guidance) => new CLIError(message, { code: ErrorCode.VALIDATION_FAILED, category: 'validation', guidance });
+/** argv is a string; `--limit`/`--cursor` want whole numbers. Refused HERE, before any network
+ *  call, naming the flag — same shape `outcome.ts`'s own `requireNumber` and `shape.ts`'s enum
+ *  checks use (CLIError + code: VALIDATION_FAILED + category: 'validation'), so an invalid flag
+ *  reports category=validation in JSON mode rather than falling through to `runCliCommand`'s
+ *  generic unknown-error wrap (code: INTERNAL). Un-refused, `Number('abc')` is NaN, which
+ *  `JSON.stringify` silently turns into `null` on the wire — a validation bug disguised as a
+ *  present-but-empty value, not caught until the gateway's own (differently-worded) refusal.
+ */
+function requireInteger(raw, flag, range) {
+    const trimmed = raw.trim();
+    const parsed = Number(trimmed);
+    if (trimmed === '' || !Number.isInteger(parsed)) {
+        throw validation(`${flag} must be a whole number (got "${raw}").`, 'Usage: pb role accountable <role-id> [--limit <n>] [--cursor <n>]');
+    }
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZI): `requireInteger` checked only
+    // integrality, so `--limit 0`, a negative value, or anything above 200 reached the network
+    // call and was silently clamped server-side (convex/agentKnowledge/entriesByRole.ts:1-200
+    // range) to a page size the caller never asked for. Reject the advertised 1-200 range here,
+    // matching the MCP tool's own schema (packages/mcp-server/src/tools/role.ts), before the call.
+    if (range && (parsed < range.min || parsed > range.max)) {
+        throw validation(`${flag} must be between ${range.min} and ${range.max} (got ${parsed}).`, 'Usage: pb role accountable <role-id> [--limit <n>] [--cursor <n>]');
+    }
+    return parsed;
+}
+/** One row, terminal-safe. `name` is stored content any connector with write access can set —
+ *  sanitized for the same reason `outcome.ts`'s `formatReadingsList` sanitizes `note`/`valueText`:
+ *  this rendering is a plain-text sink, and an embedded newline would forge an extra row. */
+function formatRow(row) {
+    const id = row.entryId ?? row.id;
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZW): `chain.listByRole` deliberately
+    // includes each row's domain `workflowStatus` (convex/agentKnowledge/entriesByRole.ts:73-90)
+    // separately from `status` (the TRUST status, e.g. 'accepted') — a tension's `open` vs
+    // `closed` is exactly the distinction between a current obligation and a completed one.
+    // Dropping it here made both render identically as `[tension/accepted]`; render it, mirroring
+    // `packages/mcp-server/src/tools/entries.ts:697-700`'s existing formatter.
+    // PR #872 review round 3 (Codex P2): workflowStatus is stored content read from a workspace
+    // collection's `validWorkflowStatuses` declaration — vocabulary-checked by guardWorkflowStatus,
+    // never terminal-safety-checked, so a value containing a newline/control sequence could still
+    // forge an extra row. Sanitized the same way `row.name` already is.
+    const statusDisplay = row.workflowStatus ? `${row.status} / ${sanitizeSingleLineField(row.workflowStatus)}` : row.status;
+    // WP-771 S1b round 2 (Codex P2, PRRT_kwDORS4ils6lGWJ0): render the real collection slug,
+    // matching the MCP `role` tool's formatRow fixed this round — same sanitization, same '?'
+    // fallback for a row whose collection couldn't be resolved.
+    const collectionSlug = row.collectionSlug ? sanitizeSingleLineField(row.collectionSlug) : '?';
+    return `    ${id}  ${sanitizeSingleLineField(row.name)}  [${collectionSlug}/${statusDisplay}]`;
+}
+/** One labelled section — `explicit` or `reporting`. Empty prints the shared empty-state text
+ *  rather than an ambiguous blank, and a truncated page says so with an ACTIONABLE hint rather
+ *  than a vague "more exist" (review PRRT_kwDORS4ils6gQAqo, §13: cap every read AND surface
+ *  truncation to the caller — a claim of "continue with the printed cursor" that never printed
+ *  one is the failure this fixes). `cursorHint` is `undefined` for a section the gateway cannot
+ *  page (`reporting` — PR-1's own design: only `explicit` accepts a cursor) — that section
+ *  states the cap plainly instead of pointing at a flag that would silently be ignored. */
+function formatSection(label, rows, truncated, cursorHint) {
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrY9): `canonicalKey` filtering can
+    // legitimately return `rows: []` with `truncated: true` and a usable cursor — the backend's
+    // raw scan window was exhausted without confirming no more matches exist beyond it
+    // (convex/agentKnowledge/entriesByRole.ts). Printing "not recorded yet" for that response
+    // falsely presents the role as having no matching entries at all and swallows the cursor that
+    // would let the caller keep looking. Check truncation BEFORE the empty-state early return.
+    if (rows.length === 0 && !truncated)
+        return [`  ${label}: not recorded yet`];
+    const lines = rows.length === 0 ? [`  ${label}: not recorded yet, but the scan is incomplete`] : [`  ${label}:`, ...rows.map(formatRow)];
+    // PR #872 review round 3 (Codex P2): `truncated` can be true purely because the raw scan
+    // budget (MAX_SCAN_BATCHES batches, entriesByRole.ts) was exhausted without confirming the
+    // true end of the index range — NOT because a filtered match beyond this page was actually
+    // found. "more exist" overclaimed a fact the backend never established; "scan incomplete"
+    // states only what is actually known (keep paging to find out), never asserts a match exists.
+    if (truncated)
+        lines.push(`    (scan incomplete, more may exist — ${cursorHint ?? 'raise --limit (capped at 200, no cursor for this list)'})`);
+    return lines;
+}
+/**
+ * Pretty rendering for `pb role accountable`. Exported so door-parity content-equality against
+ * the MCP tool's own rendering (`packages/mcp-server/src/tools/role.ts`) is assertable directly,
+ * not only through a live walk — both read the SAME `chain.listByRole` JSON shape and both print
+ * the SAME three sections in the SAME order.
+ */
+export function formatRoleAccountable(result) {
+    if (!result)
+        return 'Role not found.';
+    const roleLabel = `${sanitizeSingleLineField(result.role.name)} (${result.role.entryId ?? result.role.id})`;
+    // `explicit` is the only cursor-able list (PR-1's design) — print the REAL next cursor when
+    // truncated, never a bare claim that one exists.
+    const explicitCursorHint = result.nextCursor !== null
+        ? `raise --limit or continue with --cursor ${result.nextCursor}`
+        : 'raise --limit';
+    return [
+        `${roleLabel} — accountability:`,
+        ...formatHolders(result),
+        ...formatSection('explicit (owns)', result.explicit, result.explicitTruncated, explicitCursorHint),
+        ...formatSection('reporting (reports on)', result.reporting, result.reportingTruncated),
+        // DEC-1587 Team-Lead vacancy coverage — always not-computed today (see
+        // convex/agentKnowledge/entriesByRole.ts's own header for why); named, never faked as an
+        // empty computed list.
+        `  inherited: not-computed — ${result.inheritedNotComputedReason}`,
+    ].join('\n');
+}
+export async function runRoleAccountable(roleId, options) {
+    // Refuse everything refusable BEFORE the network call — same discipline outcome.ts's
+    // requireNumber and shape.ts's enum checks use.
+    const limit = options.limit !== undefined ? requireInteger(options.limit, '--limit', { min: 1, max: 200 }) : undefined;
+    const cursor = options.cursor !== undefined ? requireInteger(options.cursor, '--cursor') : undefined;
+    const config = await getConfigOrGuide(() => runRoleAccountable(roleId, options));
+    if (!config)
+        return;
+    await runCliCommand({
+        // A read: no session required, same posture as `pb outcome list`.
+        fn: async () => {
+            const raw = await kernelCall('chain.listByRole', {
+                roleId,
+                ...(options.canonicalKey ? { canonicalKey: options.canonicalKey } : {}),
+                ...(limit !== undefined ? { limit } : {}),
+                ...(cursor !== undefined ? { cursor } : {}),
+            });
+            return raw;
+        },
+        formatPretty: (value_) => formatRoleAccountable(value_),
+    });
+}
+//# sourceMappingURL=role.js.map