@remits/remits-cli 0.1.118 → 0.1.120

package/README.md

@@ -71,9 +71,10 @@ remits-cli install --skills --overwrite true
 - An **empty workset never clears a lane**: `--workset` on a clean working tree stages nothing and leaves the lane as it is. Pass `--empty-workset clear` to opt in, or use `components clear --all`.
 - A **deleted component file cannot be represented in Redis staging** — clearing a staged entry falls back to the committed row, so the component still resolves. Those changes are reported as NOT REPRESENTABLE. On a non-trunk variant branch, prove a deletion through `components sync --dry-run --summary --fail-on-errors`; on trunk there is no dry-run plan, so use the full pre-sync safety check before any mutating reconcile.
 - Schema `.meta.yml` sidecars can stage/sync the schema flags: `enableTrigger`, `enableFullText`, `enableRAG`, `enableRevisions`, `enableBigQuerySync`, `enableRules`, `anchor`, and `auxiliary`.
-- `components status` shows the branch/user staging entries that can shadow DB components during CLI-scoped test-mode execution.
+- `components status` shows the branch/user staging entries that can shadow DB components during CLI-scoped test-mode execution, plus the other live lanes on the account.
+- `components lanes` lists every indexed staging lane on the account. `components entries --lane-id <id>` reads the authoritative staged files for one lane without switching your workspace, clearing anything, or using SQL.
 - `components clear` clears staged entries. Scope it with `--component-type` and/or `--component-id`. Component ids are type-local, so an id alone clears that one component when the id is staged in only one family; if the same id is staged across multiple families it returns an ambiguity error asking you to add `--component-type`. With no filter it clears every staged entry for the current branch; pass `--all` to force the full-branch wipe explicitly.
-- `components stage`, `components status`, and `components clear` print concise summaries by default. Add `--json` or `--verbose` to print the full server response.
+- `components stage`, `components status`, `components lanes`, `components entries`, and `components clear` print concise summaries by default. Add `--json` or `--verbose` to print the full server response.
 - `components stage` and `components status` report three separate numbers, and they answer three different questions: the **workset** (components git reports this working tree changed), what was **submitted**, and the materialized **overlay** the lane now holds — which is what a run resolves. A number that could not be established prints as `unknown`, never as `0`.
 - `components sync` performs a server-side sync from the git remote into the Remits platform for the selected branch. It does not run local git commands. After a successful non-dry-run sync, the platform clears the branch/user staging scope so staged aliases cannot keep shadowing the newly synced DB rows.
 - On trunk, `components sync` performs the full repo-to-DB reconcile. On a non-trunk branch, it writes `ComponentVariant` overlays only and may refresh branch-local `account-info.json`, `account-hierarchy.json`, and `account-configurations.json` for the subscribing account that initiated the sync. `--dry-run` is accepted only for non-trunk variant syncs and reports overrides/additions/tombstones without writing variants, caching the sync SHA, updating metadata, or clearing staging. Add `--summary` to dry-run output when you only need counts, removals/tombstones, errors, skipped items, and warnings. `--force-tombstones` is accepted only for non-trunk variant syncs and should be used only when missing trunk component files are intentional tombstone overrides.
@@ -83,6 +84,7 @@ remits-cli install --skills --overwrite true
 - `accountId` resolution for CLI commands: explicit `--account-id` flag wins, then the current repo's `account-info.json` (`resolution.accountId`, then the short-lived `repoContext.accountInfoAccountId`, then the legacy top-level id — legacy files are rooted at the hierarchy ROOT, so their top-level `id` may be an ancestor), then the active session.
 - For `remits-cli tool`, read/discovery tools treat that resolved account as the **scope root**. You do not need the owning child account id for an exact document/record lookup: pass `--scope children`, or put `scope:"children"` in `--input`, and use the returned `resolvedTargetAccountId` for follow-up writes/runs. Use `--target-account-id` when you already know the exact owner, `--account-ids` for an explicit bounded owner list, and `--anchor-account-id` only to disambiguate multi-parent paths. Mutating tools still require an exact target.
 - Auth sessions are stored per `accountId + dataMode + baseUrl`, so the same account can stay authenticated against both localhost and production without overwriting the other session.
+- Active verification envelopes are scoped per `baseUrl + accountId + branch + workspace + dataMode`, so a localhost envelope does not silently capture evidence from a production command. Pass `--verify-envelope <id>` for an intentional cross-context attachment.
 - `--base-url` and `--data-mode` are independent. `--base-url` chooses the Remits host (`http://localhost:8080` vs deployed prod), while `--data-mode` chooses the data segment on that host (`test` vs `prod`). Do not assume `--data-mode prod` means the deployed prod host, or that `--data-mode test` means localhost.
 - `remits-cli start` scans the machine for `account-info.json` files and rebuilds `~/.remits-cli/account-repos.json` before bringing up the background service.
 - Front-stage guides are **not** bundled with the CLI npm package. For account-work commands (`components`, `test`, `token`, `tools`, `tool`) and on `auth`, `remits-cli` downloads the latest guides from the authenticated `/cli/guides` endpoint and writes them into the current account repo: root `platform-overview.md` / `development-guide.md`, `guides/*.md`, `guides/features/*.md`, and the agent-guidance files `CLAUDE.md` / `AGENTS.md` / `GEMINI.md` (from `docs/front-stage/remits-components-zip-readme.md`).

package/index.js

@@ -546,6 +546,7 @@ function localStatePaths(cwd) {
     toolResponsesDir: path.join(base, 'tool-responses'),
     verificationDir: path.join(base, 'verification'),
     activeVerificationFile: path.join(base, 'verification', 'active'),
+    activeVerificationContextsFile: path.join(base, 'verification', 'active-contexts.json'),
     currentSessionFile: path.join(base, 'current-session.txt'),
     workspaceFile: path.join(base, 'workspace')
   };
@@ -771,7 +772,49 @@ function verificationPaths(cwd, envelopeId) {
   };
 }
 
-function readActiveVerificationEnvelope(cwd) {
+function verificationContextKey(context = {}) {
+  const baseUrl = normalizeBaseUrl(context.baseUrl || context.host || DEFAULT_BASE_URL);
+  const accountId = context.accountId != null ? String(context.accountId) : 'unknown-account';
+  const branchName = context.branchName || context.branch || 'unknown-branch';
+  const workspace = normalizeWorkspace(context.workspace) || 'shared';
+  const dataMode = normalizeDataMode(context.dataMode);
+  return [baseUrl, accountId, branchName, workspace, dataMode].join('|');
+}
+
+function readActiveVerificationContexts(cwd) {
+  const file = localStatePaths(cwd).activeVerificationContextsFile;
+  if (!fs.existsSync(file)) return {};
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+  } catch (_) {
+    return {};
+  }
+}
+
+function writeActiveVerificationContexts(cwd, contexts) {
+  const paths = ensureLocalState(cwd);
+  atomicWriteFile(paths.activeVerificationContextsFile, JSON.stringify(contexts || {}, null, 2));
+}
+
+function activeVerificationContext(cwd, flags = {}, session = null, accountId = null) {
+  return {
+    baseUrl: normalizeBaseUrl(flags['base-url'] || (session && session.baseUrl) || DEFAULT_BASE_URL),
+    accountId,
+    branchName: flags.branch || currentBranch(cwd),
+    workspace: resolveWorkspace(cwd, flags),
+    dataMode: resolveDataMode(flags, session)
+  };
+}
+
+function readActiveVerificationEnvelope(cwd, context = null) {
+  if (context) {
+    const contexts = readActiveVerificationContexts(cwd);
+    const entry = contexts[verificationContextKey(context)];
+    if (entry && typeof entry === 'object') return entry.envelopeId || null;
+    if (typeof entry === 'string') return entry || null;
+    return null;
+  }
   const file = verificationPaths(cwd).activeFile;
   try {
     if (!fs.existsSync(file)) return null;
@@ -782,8 +825,25 @@ function readActiveVerificationEnvelope(cwd) {
   }
 }
 
-function writeActiveVerificationEnvelope(cwd, envelopeId) {
+function writeActiveVerificationEnvelope(cwd, envelopeId, context = null) {
   const paths = verificationPaths(cwd);
+  if (context) {
+    const contexts = readActiveVerificationContexts(cwd);
+    const key = verificationContextKey(context);
+    if (!envelopeId) {
+      delete contexts[key];
+    } else {
+      contexts[key] = {
+        envelopeId: String(envelopeId),
+        updatedAt: new Date().toISOString(),
+        context: Object.assign({}, context, {
+          baseUrl: normalizeBaseUrl(context.baseUrl || context.host || DEFAULT_BASE_URL),
+          workspace: normalizeWorkspace(context.workspace)
+        })
+      };
+    }
+    writeActiveVerificationContexts(cwd, contexts);
+  }
   if (!envelopeId) {
     try { if (fs.existsSync(paths.activeFile)) fs.unlinkSync(paths.activeFile); } catch (_) { /* best-effort */ }
     return null;
@@ -792,11 +852,11 @@ function writeActiveVerificationEnvelope(cwd, envelopeId) {
   return String(envelopeId);
 }
 
-function verificationEnvelopeIdForCommand(cwd, flags = {}) {
+function verificationEnvelopeIdForCommand(cwd, flags = {}, context = null) {
   if (flagEnabled(flags['no-verify-envelope']) || flagEnabled(flags.noVerifyEnvelope)) return null;
   const explicit = flags['verify-envelope'] || flags.verifyEnvelope || flags.envelope;
   if (explicit !== undefined && explicit !== null && explicit !== true) return String(explicit).trim() || null;
-  return readActiveVerificationEnvelope(cwd);
+  return context ? readActiveVerificationEnvelope(cwd, context) : readActiveVerificationEnvelope(cwd);
 }
 
 function writeLocalVerificationEnvelope(cwd, envelope) {
@@ -903,7 +963,8 @@ async function postVerificationCommand(api, cwd, session, accountId, command, pa
 }
 
 async function appendVerificationPacket(api, cwd, session, accountId, flags, packet, options = {}) {
-  const envelopeId = verificationEnvelopeIdForCommand(cwd, flags);
+  const context = activeVerificationContext(cwd, flags, session, accountId);
+  const envelopeId = verificationEnvelopeIdForCommand(cwd, flags, context);
   if (!envelopeId) return null;
   const finalPacket = Object.assign({
     packetId: crypto.randomUUID(),
@@ -929,6 +990,52 @@ async function appendVerificationPacket(api, cwd, session, accountId, flags, pac
   }
 }
 
+function formatTime(value) {
+  if (!value) return 'unknown';
+  const n = Number(value);
+  const date = Number.isFinite(n) ? new Date(n) : new Date(value);
+  if (Number.isNaN(date.getTime())) return String(value);
+  return date.toISOString();
+}
+
+function printVerificationSummaryLine(env) {
+  const health = env.health ? ' health=' + env.health : '';
+  const failures = env.currentFailureCount ? ' currentFailures=' + env.currentFailureCount : (env.failedCount ? ' failed=' + env.failedCount : '');
+  const required = ' required=' + (env.satisfiedCount || 0) + '/' + (env.requiredCount || 0);
+  const noManifest = env.noRequiredEvidence ? ' no-manifest' : '';
+  const lane = [env.branchName || 'unknown-branch', env.workspace ? 'ws:' + env.workspace : 'shared', env.dataMode || null, env.sourceLayer || null]
+    .filter(Boolean).join(' | ');
+  console.log('- ' + (env.envelopeId || '(no id)') + '  ' + (env.status || 'unknown') + health + failures + required + noManifest);
+  if (env.summary) console.log('  ' + env.summary);
+  console.log('  ' + lane + '  packets=' + (env.packetCount || 0) + '  updated=' + formatTime(env.updatedAtMs || env.latestPacketAtMs));
+}
+
+function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
+  console.log('Verification envelope:', envelope.envelopeId || fallbackEnvelopeId);
+  if (envelope.summary) console.log('Summary:', envelope.summary);
+  console.log('Status:', envelope.status || 'unknown');
+  const evaluation = envelope.evaluation || {};
+  if (evaluation.health) console.log('Health:', evaluation.health);
+  if (evaluation.noRequiredEvidence) {
+    console.log('Required evidence: none declared - evidence packets do not prove a complete acceptance contract.');
+  } else {
+    console.log('Required evidence:', (evaluation.satisfiedCount || 0) + '/' + (evaluation.requiredCount || 0));
+  }
+  if (evaluation.failedCount) {
+    console.log('Failed packets:', evaluation.failedCount, 'current failures:', evaluation.currentFailureCount || 0);
+  }
+  const packets = Array.isArray(envelope.packets) ? envelope.packets : [];
+  console.log('Packets:', packets.length);
+  packets.slice(-20).forEach((packet) => {
+    const status = packet.stale ? ' stale' : (packet.success === false ? ' failed' : '');
+    const claim = packet.claim ? ' - ' + packet.claim : '';
+    console.log('- ' + (packet.type || 'unknown') + ' ' + (packet.packetId || '') + status + claim);
+  });
+  if (packets.length > 20) {
+    console.log('  ...' + (packets.length - 20) + ' earlier packet(s); rerun with --json for the full envelope');
+  }
+}
+
 function buildCommandWorld(response, fallback = {}) {
   const source = (response && response.staging) || {};
   const resolution = (response && response.resolution) || {};
@@ -2752,8 +2859,8 @@ async function pushComponentsCommand(flags) {
     world: buildCommandWorld(response, { accountId, dataMode, branchName, workspace, host: normalizeBaseUrl(baseUrl), sourceLayer: 'staged' }),
     revision: collectVerificationSource(cwd, flags),
     assertions: [
-      { category: 'stage', stageMode },
-      { category: 'staging_lane', value: response.stagingLane }
+      { id: 'stage', stageMode },
+      { id: 'staging_lane', value: response.stagingLane }
     ],
     evidenceCategories: ['stage', 'staging_lane'],
     rawRefs: { command: 'components stage' },
@@ -2995,6 +3102,9 @@ function printStageSummary(response, flags) {
   }
 
   printUnrepresentableChanges(response.unrepresentableChanges || (stage.unrepresentable || []));
+  if (typeof printAccountLanes === 'function') {
+    printAccountLanes(response);
+  }
   printComponentCommandResponse('Components stage', response, flags);
 }
 
@@ -3040,6 +3150,61 @@ function printStatusSummary(response, flags) {
   printComponentCommandResponse('Components staging', response, flags);
 }
 
+function printLanesSummary(response, flags) {
+  printBranchContext(response);
+  const lanes = Array.isArray(response.lanes) ? response.lanes : (Array.isArray(response.accountLanes) ? response.accountLanes : []);
+  console.log('Staging lanes for account ' + response.accountId + ':', lanes.length);
+  if (!lanes.length) {
+    console.log('No staged lanes are currently indexed for this account.');
+    return;
+  }
+  lanes.forEach((lane) => printStagingLaneRow(lane));
+  console.log('');
+  console.log('Inspect a lane: remits-cli components entries --lane-id <laneId>');
+  console.log('Or by scope:    remits-cli components entries --lane-account-id <id> --cli-user-id <id> --branch <name> [--workspace <name>]');
+  printComponentCommandResponse('Components lanes', response, flags);
+}
+
+function printStagingLaneRow(lane) {
+  const world = lane.onTrunk === true ? 'trunk'
+              : lane.onTrunk === false ? 'variant'
+              : 'unknown-world';
+  const ws = lane.workspace ? ' [ws:' + lane.workspace + ']' : ' [shared]';
+  const workset = lane.worksetKnown && lane.worksetCountAsOf != null
+    ? ' workset ' + lane.worksetCountAsOf
+    : ' workset unknown';
+  const shared = lane.sharedLane === true ? ' SHARED' : '';
+  const ttl = lane.expiresInSeconds != null ? ' expires ~' + Math.round(lane.expiresInSeconds / 60) + 'm' : '';
+  console.log('- ' + (lane.laneId || lane.stagingLane || '(no lane id)'));
+  console.log('  ' + lane.branchName + ws + ' ' + world + shared + ' overlay ' + (lane.stagedCountAsOf || lane.stagedCount || 0) + workset + ttl);
+  if (lane.userEmail || lane.cliUserId) console.log('  owner: ' + (lane.userEmail || 'user #' + lane.cliUserId) + '  cliUserId=' + lane.cliUserId);
+  if (lane.typeCounts) console.log('  types: ' + Object.entries(lane.typeCounts).map(([k, v]) => k + ':' + v).join(', '));
+}
+
+function printEntriesSummary(response, flags) {
+  console.log('Staging lane:', response.stagingLane || response.laneId);
+  console.log('Account:', response.accountId, 'CLI user:', response.cliUserId);
+  console.log('Branch:', response.branchName, 'Workspace:', response.workspace || 'shared');
+  printLaneSummary(response);
+  printComponentTypeCounts(response.entries || []);
+  const entries = Array.isArray(response.entries) ? response.entries : [];
+  if (entries.length) {
+    console.log('');
+    entries.slice(0, flagEnabled(flags.verbose) ? entries.length : 40).forEach((entry) => {
+      const id = entry.componentId != null ? '#' + entry.componentId : '(new)';
+      const name = entry.componentName || entry.name || '';
+      const pathText = entry.path ? '  ' + entry.path : '';
+      const fields = Array.isArray(entry.stagedFields) && entry.stagedFields.length ? ' fields=' + entry.stagedFields.join(',') : '';
+      const inWorkset = entry.stageInWorkset === true ? ' workset' : (entry.stageInWorkset === false ? ' retained' : '');
+      console.log('- ' + (entry.type || entry.componentType || 'component') + ' ' + id + (name ? ' ' + name : '') + inWorkset + fields + pathText);
+    });
+    if (!flagEnabled(flags.verbose) && entries.length > 40) {
+      console.log('  ...' + (entries.length - 40) + ' more; rerun with --verbose or --json');
+    }
+  }
+  printComponentCommandResponse('Components entries', response, flags);
+}
+
 /**
  * What THIS lane holds, separated into the work in flight and the overlay carried along with it.
  *
@@ -3269,6 +3434,85 @@ async function statusComponentsCommand(flags) {
   return response;
 }
 
+async function lanesComponentsCommand(flags) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const branchName = flags.branch || currentBranch(cwd);
+  const workspace = resolveWorkspace(cwd, flags);
+  const dataMode = resolveDataMode(flags, session);
+  const api = buildAxios(baseUrl, session.token);
+
+  const response = await loggedPost(api, cwd, '/cli/components', {
+    token: session.token,
+    accountId,
+    branchName,
+    workspace,
+    dataMode,
+    mode: 'lanes'
+  }).then((r) => r.data);
+
+  if (!response.success) {
+    throw new Error(response.message || 'Staging lanes failed');
+  }
+
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify(response, null, 2));
+    return response;
+  }
+
+  printSessionResolutionWarning(sessionContext);
+  printResolvedBaseUrl(baseUrl);
+  console.log('Data mode:', response.dataMode || dataMode);
+  printLanesSummary(response, flags);
+  return response;
+}
+
+async function entriesComponentsCommand(flags) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const branchName = flags.branch || currentBranch(cwd);
+  const workspace = resolveWorkspace(cwd, flags);
+  const dataMode = resolveDataMode(flags, session);
+  const api = buildAxios(baseUrl, session.token);
+
+  const response = await loggedPost(api, cwd, '/cli/components', {
+    token: session.token,
+    accountId,
+    branchName,
+    workspace,
+    dataMode,
+    mode: 'entries',
+    laneId: flags['lane-id'] || flags.lane,
+    laneAccountId: flags['lane-account-id'] || flags.ownerAccountId || flags['owner-account-id'],
+    cliUserId: flags['cli-user-id'] || flags.userId || flags['user-id'],
+    laneBranchName: flags['lane-branch'] || flags.targetBranch || flags['target-branch'],
+    laneWorkspace: flags['lane-workspace'] || flags.targetWorkspace || flags['target-workspace'],
+    componentType: flags['component-type'] || flags.type,
+    componentId: flags['component-id'] || flags.id
+  }).then((r) => r.data);
+
+  if (!response.success) {
+    throw new Error(response.message || 'Staging entries failed');
+  }
+
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify(response, null, 2));
+    return response;
+  }
+
+  printSessionResolutionWarning(sessionContext);
+  printResolvedBaseUrl(baseUrl);
+  console.log('Data mode:', response.dataMode || dataMode);
+  printEntriesSummary(response, flags);
+  return response;
+}
+
 async function clearComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
@@ -4560,6 +4804,9 @@ async function testCommand(flags) {
   printSessionResolutionWarning(sessionContext);
   printResolvedBaseUrl(baseUrl);
   printStagingLane(branchName, workspace, workspaceSource(cwd, flags));
+  if (start.staging && Array.isArray(start.staging.accountLanes)) {
+    printAccountLanes({ accountLanes: start.staging.accountLanes, branchName, workspace });
+  }
   console.log('Test run started:', start.taskId);
   runtimeState.currentTestTaskId = start.taskId;
 
@@ -4687,6 +4934,7 @@ async function tokenCommand(flags) {
     variantBranch: data.variantBranch,
     workspace: data.workspace !== undefined ? data.workspace : workspace,
     stagingLane: data.stagingLane,
+    accountLanes: data.accountLanes,
     dataMode: data.dataMode || dataMode,
     shortBasePath: data.shortBasePath,
     embeddableUrl
@@ -5059,10 +5307,26 @@ async function verifyCommand(flags, subcommand) {
   ensureLocalState(cwd);
   const sub = String(subcommand || (flags._ && flags._[1]) || 'status').toLowerCase();
 
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const dataMode = resolveDataMode(flags, session);
+  const branchName = flags.branch || currentBranch(cwd);
+  const workspace = resolveWorkspace(cwd, flags);
+  const api = buildAxios(baseUrl, session.token);
+  const activeContext = activeVerificationContext(cwd, flags, session, accountId);
+
   if (sub === 'current') {
-    const active = readActiveVerificationEnvelope(cwd);
+    const active = readActiveVerificationEnvelope(cwd, activeContext);
+    printSessionResolutionWarning(sessionContext);
+    printResolvedBaseUrl(baseUrl);
+    console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
     if (!active) {
-      console.log('No active verification envelope in this checkout.');
+      const legacy = readActiveVerificationEnvelope(cwd);
+      console.log('No active verification envelope for this context.');
+      if (legacy) {
+        console.log('Legacy active envelope ignored for this context:', legacy);
+      }
       return;
     }
     console.log('Active verification envelope:', active);
@@ -5074,25 +5338,25 @@ async function verifyCommand(flags, subcommand) {
   if (sub === 'use') {
     const envelopeId = flags._ && flags._[2] || flags.envelope || flags['verify-envelope'];
     if (!envelopeId) throw new Error('Usage: remits-cli verify use <envelopeId>');
-    writeActiveVerificationEnvelope(cwd, envelopeId);
+    writeActiveVerificationEnvelope(cwd, envelopeId, activeContext);
     console.log('Active verification envelope:', envelopeId);
+    console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
     return;
   }
 
   if (sub === 'clear') {
-    writeActiveVerificationEnvelope(cwd, null);
-    console.log('Verification envelope cleared for this checkout.');
+    if (flagEnabled(flags.all)) {
+      writeActiveVerificationEnvelope(cwd, null);
+      writeActiveVerificationContexts(cwd, {});
+      console.log('All active verification envelope pointers cleared for this checkout.');
+    } else {
+      writeActiveVerificationEnvelope(cwd, null, activeContext);
+      console.log('Verification envelope cleared for this context.');
+      console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    }
     return;
   }
 
-  const sessionContext = resolveSessionContext(cwd, flags);
-  const { session, accountId } = sessionContext;
-  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
-  const dataMode = resolveDataMode(flags, session);
-  const branchName = flags.branch || currentBranch(cwd);
-  const workspace = resolveWorkspace(cwd, flags);
-  const api = buildAxios(baseUrl, session.token);
-
   if (sub === 'start') {
     const summary = flags.summary || flags._ && flags._.slice(2).join(' ');
     if (!summary) throw new Error('verify start requires --summary "..."');
@@ -5129,14 +5393,29 @@ async function verifyCommand(flags, subcommand) {
     });
     const envelope = response.envelope;
     writeLocalVerificationEnvelope(cwd, envelope);
-    writeActiveVerificationEnvelope(cwd, envelope.envelopeId);
+    writeActiveVerificationEnvelope(cwd, envelope.envelopeId, activeContext);
     console.log('Verification envelope started:', envelope.envelopeId);
     console.log('Target:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
     console.log('Local mirror:', verificationPaths(cwd, envelope.envelopeId).base);
     return envelope;
   }
 
-  const envelopeId = flags.envelope || flags['verify-envelope'] || flags.id || readActiveVerificationEnvelope(cwd);
+  if (sub === 'list' || sub === 'summaries') {
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'list', {
+      max: flags.max || flags.limit || 50
+    });
+    if (flagEnabled(flags.json)) {
+      console.log(JSON.stringify(response, null, 2));
+      return response;
+    }
+    printSessionResolutionWarning(sessionContext);
+    printResolvedBaseUrl(baseUrl);
+    console.log('Verification envelopes:', (response.envelopes || []).length);
+    (response.envelopes || []).forEach((env) => printVerificationSummaryLine(env));
+    return response;
+  }
+
+  const envelopeId = flags.envelope || flags['verify-envelope'] || flags.id || readActiveVerificationEnvelope(cwd, activeContext);
   if (!envelopeId) {
     throw new Error('No verification envelope selected. Run `remits-cli verify start --summary "..."` or pass --envelope <id>.');
   }
@@ -5168,14 +5447,7 @@ async function verifyCommand(flags, subcommand) {
       return response.envelope || response;
     }
     const envelope = response.envelope || {};
-    console.log('Verification envelope:', envelope.envelopeId || envelopeId);
-    if (envelope.summary) console.log('Summary:', envelope.summary);
-    console.log('Status:', envelope.status || 'unknown');
-    const packets = Array.isArray(envelope.packets) ? envelope.packets : [];
-    console.log('Packets:', packets.length);
-    packets.forEach((packet) => {
-      console.log('- ' + (packet.type || 'unknown') + ' ' + (packet.packetId || '') + (packet.success === false ? ' failed' : ''));
-    });
+    printVerificationEnvelope(envelope, envelopeId);
     return envelope;
   }
 
@@ -5268,6 +5540,24 @@ async function verifyCommand(flags, subcommand) {
     return response.envelope;
   }
 
+  if (sub === 'abandon' || sub === 'close') {
+    const reason = flags.reason || flags.message || flags._ && flags._.slice(2).join(' ') || 'abandoned';
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'abandon', { envelopeId, reason });
+    writeLocalVerificationEnvelope(cwd, response.envelope);
+    console.log('Envelope abandoned:', envelopeId);
+    return response.envelope;
+  }
+
+  if (sub === 'supersede') {
+    const supersededBy = flags['superseded-by'] || flags.supersededBy || flags.next || flags._ && flags._[2];
+    if (!supersededBy) throw new Error('verify supersede requires --superseded-by <envelopeId>');
+    const reason = flags.reason || flags.message || 'superseded by a newer verification envelope';
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'supersede', { envelopeId, supersededBy, reason });
+    writeLocalVerificationEnvelope(cwd, response.envelope);
+    console.log('Envelope superseded:', envelopeId, '->', supersededBy);
+    return response.envelope;
+  }
+
   if (sub === 'status' || sub === 'report') {
     let statusPacket = null;
     try {
@@ -10825,6 +11115,23 @@ function printComponentsHelp(subcommand) {
     console.log('whether another agent is staging alongside you.');
     return;
   }
+  if (subcommand === 'lanes' || subcommand === 'lane') {
+    console.log('Usage: remits-cli components lanes [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--json]');
+    console.log('');
+    console.log('Lists every indexed staging lane on the account, across users, branches, and workspaces.');
+    console.log('This is read-only and uses the same lane registry that powers the admin Platforms view.');
+    console.log('Use `components entries --lane-id <id>` to inspect the actual staged files in a lane.');
+    return;
+  }
+  if (subcommand === 'entries' || subcommand === 'entry' || subcommand === 'staged') {
+    console.log('Usage: remits-cli components entries --lane-id ID [--base-url URL] [--account-id ID] [--json|--verbose]');
+    console.log('       remits-cli components entries --lane-account-id ID --cli-user-id ID --branch BRANCH [--workspace NAME]');
+    console.log('');
+    console.log('Reads the authoritative staged entries for one lane from Redis staging keys.');
+    console.log('Use this for review/audit: it does not switch your workspace, impersonate another user,');
+    console.log('clear anything, or affect what your own runs resolve.');
+    return;
+  }
   if (subcommand === 'clear') {
     console.log('Usage: remits-cli components clear [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--component-type TYPE] [--component-id ID] [--all] [--json|--verbose]');
     console.log('');
@@ -10846,12 +11153,14 @@ function printComponentsHelp(subcommand) {
     console.log('`remits-cli components sync --safe`.');
     return;
   }
-  console.log('Usage: remits-cli components <stage|status|clear|sync|commit|promotion|branches|branch>');
+  console.log('Usage: remits-cli components <stage|status|lanes|entries|clear|sync|commit|promotion|branches|branch>');
   console.log('');
   console.log('All staging subcommands accept --workspace NAME to isolate a lane on the same branch,');
   console.log('so several agents can iterate at once. See: remits-cli workspace --help');
   console.log('  remits-cli components stage [--workset|--changed-only] [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--json|--verbose]');
   console.log('  remits-cli components status [--base-url URL] [--account-id ID] [--branch BRANCH] [--component-type TYPE --component-id ID] [--json|--verbose]');
+  console.log('  remits-cli components lanes [--base-url URL] [--account-id ID] [--json]');
+  console.log('  remits-cli components entries --lane-id ID [--base-url URL] [--account-id ID] [--json|--verbose]');
   console.log('  remits-cli components clear [--base-url URL] [--account-id ID] [--branch BRANCH] [--component-type TYPE] [--component-id ID] [--all] [--json|--verbose]');
   console.log('  remits-cli components sync [--safe] [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--force-tombstones] [--dry-run] [--summary]');
   console.log('  remits-cli components commit [--safe] [--message "msg"] [--allow-empty true|false] [--skip-git true|false] [--branch BRANCH] [--data-mode test|prod] [--force-tombstones]');
@@ -10931,12 +11240,16 @@ function printVerifyHelp() {
   console.log('');
   console.log('Envelope lifecycle:');
   console.log('  remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID]');
+  console.log('  remits-cli verify list [--max 50] [--json]');
   console.log('  remits-cli verify use <envelopeId>');
   console.log('  remits-cli verify current');
-  console.log('  remits-cli verify clear');
+  console.log('  remits-cli verify clear [--all]');
   console.log('  remits-cli verify show [--envelope ID] [--json]');
   console.log('  remits-cli verify status [--envelope ID]');
   console.log('  remits-cli verify report [--envelope ID]');
+  console.log('  remits-cli verify abandon --envelope ID --reason "..."');
+  console.log('  remits-cli verify supersede --envelope ID --superseded-by ID [--reason "..."]');
+  console.log('  Active envelopes are scoped by host, account, branch, workspace, and data mode.');
   console.log('');
   console.log('Manifest and manual evidence:');
   console.log('  remits-cli verify manifest --file file.json [--envelope ID]');
@@ -11034,9 +11347,11 @@ async function main() {
     console.log('  remits-cli tool status --call-id <callId> [--base-url URL] [--account-id ID] [--data-mode test|prod]');
     console.log('  remits-cli workspace [show|use <name>|use --auto|clear]        # isolate staging when several agents share a repo');
     console.log('  remits-cli verify start --summary "..." [--manifest file.json]  # start a verification envelope');
-    console.log('  remits-cli verify [current|use|clear|status|report|attach|test|token|stage|sync|tool]');
+    console.log('  remits-cli verify [current|list|use|clear|show|status|report|attach|abandon|supersede|test|token|stage|sync|tool]');
     console.log('  remits-cli components stage [--workset|--changed-only] [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--data-mode test|prod] [--json|--verbose]');
     console.log('  remits-cli components status [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--component-type TYPE --component-id ID] [--json|--verbose]');
+    console.log('  remits-cli components lanes [--base-url URL] [--account-id ID] [--json]');
+    console.log('  remits-cli components entries --lane-id ID [--base-url URL] [--account-id ID] [--json|--verbose]');
     console.log('  remits-cli components clear [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--component-type TYPE] [--component-id ID] [--all] [--json|--verbose]');
     console.log('  remits-cli components sync [--safe] [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--force-tombstones] [--dry-run] [--summary]');
     console.log('  remits-cli components commit [--message \"msg\"] [--allow-empty true|false] [--skip-git true|false] [--branch BRANCH] [--data-mode test|prod] [--force-tombstones]');
@@ -11139,6 +11454,16 @@ async function main() {
     return;
   }
 
+  if (command === 'components' && (subcommand === 'lanes' || subcommand === 'lane')) {
+    await lanesComponentsCommand(args);
+    return;
+  }
+
+  if (command === 'components' && (subcommand === 'entries' || subcommand === 'entry' || subcommand === 'staged')) {
+    await entriesComponentsCommand(args);
+    return;
+  }
+
   if (command === 'components' && subcommand === 'clear') {
     await clearComponentsCommand(args);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remits/remits-cli",
-  "version": "0.1.118",
+  "version": "0.1.120",
   "description": "Local CLI for auth, component sync, and live test execution against Remits",
   "license": "MIT",
   "private": false,

package/skills/remits-cli/SKILL.md

@@ -101,6 +101,10 @@ reference named after it.
   holds — what a run resolves. The workset is what git says you changed. A full stage makes them differ
   by the size of the repo, and `--changed-only` merges, so it can never shrink an overlay it inherited.
   `components status` prints all three numbers; so does the console. (`component-resolution.md`)
+- **Review other lanes with read-only commands, not SQL.** `components lanes` lists every indexed lane on
+  the account, and `components entries --lane-id <id>` shows the actual staged files in one lane without
+  changing your workspace or clearing anything. Use these when another agent's workstream is relevant.
+  (`component-resolution.md`, `command-reference.md`)
 - **Host and data mode are two independent decisions.** `--base-url` picks the Remits host,
   `--data-mode` picks the data segment on it. Neither implies the other. (`command-reference.md`)
 - **`test run` ignores the stored session data lane.** It defaults to `test` even when `whoami` shows

package/skills/remits-cli/references/command-reference.md

@@ -194,6 +194,8 @@ remits-cli data-mode [set test|prod]
 remits-cli components stage [--workset | --changed-only] [--branch <name>] [--workspace <name>] [--empty-workset clear] [--data-mode test|prod] [--json|--verbose]   # default = FULL SNAPSHOT of the repo; --workset = only what git says changed, lane reconciled to it
 remits-cli workspace [show | use <name> | use --auto | clear]
 remits-cli components status [--branch <name>] [--component-type <type>] [--component-id <id>] [--json|--verbose]
+remits-cli components lanes [--json]                         # every indexed staging lane on the account
+remits-cli components entries --lane-id <id> [--json|--verbose]  # authoritative staged files for one lane
 remits-cli components clear [--branch <name>] [--component-type <type>] [--component-id <id>] [--all] [--json|--verbose]   # id alone scopes to one component when unambiguous (ids are type-local; add --component-type if the same id is staged in multiple families); no filter clears the whole branch scope; --all forces the full wipe
 remits-cli components sync [--safe [--yes]] [--branch <name>] [--data-mode test|prod] [--force-tombstones] [--dry-run] [--summary] [--changed-only [--changed-since <ref>]]   # gated; on trunk = full repo->DB reconcile, on a variant branch = ComponentVariant overlays only
 remits-cli components commit [--safe] [--message "msg"] [--data-mode test|prod] [--force-tombstones]   # --safe gates phase 2; it cannot un-push phase 1
@@ -211,9 +213,10 @@ remits-cli tools [--branch <name>] [--data-mode test|prod] [--variant-branch <na
 remits-cli tool --name <toolName> [--branch <name>] [--input "{...}"] [--data-mode test|prod] [--variant-branch <name|none>] [--timeout-ms 60000] [--async true --wait true]
 remits-cli tool status --call-id <callId> [--data-mode test|prod]
 remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID]
+remits-cli verify list [--max 50] [--json]
 remits-cli verify use <envelopeId>
 remits-cli verify current
-remits-cli verify clear
+remits-cli verify clear [--all]
 remits-cli verify show [--envelope ID] [--json]
 remits-cli verify manifest --file file.json [--envelope ID]
 remits-cli verify manifest --print [--envelope ID]
@@ -230,6 +233,8 @@ remits-cli verify sync --safe
 remits-cli verify tool --name <toolName> [--input "{...}"]
 remits-cli verify status [--envelope ID]
 remits-cli verify report [--envelope ID]
+remits-cli verify abandon --envelope ID --reason "..."
+remits-cli verify supersede --envelope ID --superseded-by <envelopeId> [--reason "..."]
 ```
 
 ### Verification envelopes
@@ -245,8 +250,11 @@ remits-cli components status
 remits-cli verify start --summary "Hosted upload updates an existing profile" --manifest acceptance.json
 ```
 
-An active envelope is stored in `./.remits-cli/verification/active`. Stage/test/token/tool/sync commands
-attach evidence automatically while an envelope is active. The explicit wrappers do the same thing and
+An active envelope is stored per command world: `baseUrl + accountId + branch + workspace + dataMode`.
+The legacy `./.remits-cli/verification/active` pointer is still understood for compatibility, but normal
+auto-attachment uses `./.remits-cli/verification/active-contexts.json`, so a localhost envelope does not
+silently capture evidence from a production command. Stage/test/token/tool/sync commands attach evidence
+automatically while an envelope is active for that context. The explicit wrappers do the same thing and
 make the intent visible in terminal history:
 
 ```bash
@@ -260,6 +268,10 @@ remits-cli verify report
 Existing commands also accept `--verify-envelope <id>` to attach to a specific envelope and
 `--no-verify-envelope` to suppress automatic attachment for one command.
 
+Use `remits-cli verify list` to review open envelopes for the account without SQL. If a newer envelope
+replaces an older one, use `verify supersede`; if a duplicate or abandoned attempt should no longer read
+as live work, use `verify abandon`. Both keep the evidence history.
+
 The manifest is the proof contract. It should name the world being exercised: repo account, host,
 git/component branch, workspace, data mode, source layer, user journeys, artifacts and hashes, and the
 evidence categories required before the final response may claim the work is done. If the manifest

package/skills/remits-cli/references/component-resolution.md

@@ -153,9 +153,16 @@ TestMode still uses the committed DB source. Staging remains a dev/verification
 - **Confirm the DB version:** `mcp_component_view` reads the live DB source directly (no staging, no compile
   cache), so it is the source of truth for "what was committed."
 - **Ask the CLI what is staged:** `remits-cli components status` lists this lane's staged entries,
-  including staged fields, aliases, hashes, and TTLs. The default terminal output is concise; pass `--json` or
-  `--verbose` when you need the full staged-entry payload. `remits-cli components clear` removes those entries
-  when you intentionally want to fall back to DB source.
+  including staged fields, aliases, hashes, and TTLs. It also reports the other indexed lanes on the
+  account so you can see parallel work before assuming you are alone. The default terminal output is
+  concise; pass `--json` or `--verbose` when you need the full staged-entry payload.
+- **Inspect another lane without impersonating it:** `remits-cli components lanes` lists every indexed
+  lane on the account; `remits-cli components entries --lane-id <id>` reads the authoritative staged
+  files for one lane. These are read-only review surfaces. They do not switch your workspace, clear
+  anything, or change what your own test/token/tool runs resolve.
+- **Clear only your own lane:** `remits-cli components clear` removes entries when you intentionally want
+  to fall back to DB source. `--all` is scoped to the command's account/user/branch/workspace lane, not
+  every lane another agent may be using.
 
 ### Working alongside other agents: the staging WORKSPACE
 
@@ -198,9 +205,11 @@ commit write `ComponentVariant` overlays for a branch nobody subscribes to).
 - Every stage / test run / token / clear prints its `Staging lane:` — if a change seems to have had no
   effect, check that line FIRST. A mismatched lane resolves committed source, which looks identical to
   "the stage did not work".
-- `remits-cli components status` lists every lane staged on the branch AND every lane on the account, so
-  you can see whether another agent is working alongside you. Each row names its world (trunk or variant
-  branch), its overlay, its workset where known, and whether it is the SHARED lane.
+- `remits-cli components status`, `components stage`, `test run`, and `token` include the current
+  account's lane context in their responses. A shared current lane is printed loudly; sibling lanes are
+  listed when they matter.
+- `remits-cli components lanes` is the review view across users/branches/workspaces, and
+  `remits-cli components entries --lane-id <id>` is the drill-down into actual staged files.
 - `remits-cli components clear --all` is scoped to YOUR lane and never touches another agent's.
 
 ### A lane holds an OVERLAY; your workset is a different number

package/skills/remits-cli/references/development-loop.md

@@ -270,6 +270,22 @@ interchangeable:
 A missing answer is printed as `unknown`, never as `0`: "git could not answer" and "git says nothing
 changed" are different facts and only one of them is a number.
 
+##### Review lanes without changing them
+
+`components status` is still the normal first read: it tells you which world this checkout resolves,
+what this lane holds, and whether other account lanes are live. For review/debugging, use the dedicated
+read-only surfaces:
+
+```bash
+remits-cli components lanes
+remits-cli components entries --lane-id <id>
+```
+
+`components lanes` shows every indexed lane on the account across users, branches and workspaces.
+`components entries` reads the authoritative staged files for one lane. It does not switch your
+workspace, clear entries, or affect what your own runs resolve. Use it before assuming a shared lane is
+safe to overwrite, and when reviewing another agent's workstream from the CLI.
+
 **THE STAGE-BEFORE-RUN RULE:** You MUST run `remits-cli components stage` after EVERY file edit and BEFORE any test run or verification. The platform executes whatever version is in the staging cache at the moment the test starts. If you edit a file and run a test without staging first, the test runs the OLD code — not your changes. This is the single most common mistake. Never skip staging. The sequence is always: **edit → stage → run**.
 
 This applies to: