@rosthq/cli 0.5.10 → 0.5.12

package/dist/auth.d.ts

@@ -1,6 +1,8 @@
 import type { CliConfig } from "./config.js";
 import type { CliSession } from "./token-store.js";
 export declare function loginWithBrowser(config: CliConfig): Promise<CliSession>;
+export declare function shouldRefreshSession(session: CliSession, now?: number): boolean;
+export declare function refreshCliSessionIfNeeded(config: CliConfig, session: CliSession, now?: number): Promise<CliSession>;
 /**
  * Best-effort attempt to open a URL in the default browser. Returns true when a
  * launcher was invoked, false when no launcher is available for the platform.

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA0C7E;AASD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBlE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAUnD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA2C7E;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,SAAa,GAAG,OAAO,CAKnF;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,UAAU,EACnB,GAAG,SAAa,GACf,OAAO,CAAC,UAAU,CAAC,CA4BrB;AASD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBlE"}

package/dist/device-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../src/device-auth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAGF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAGhD,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACnG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAwBF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAgCD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,UAAU,CAAC,CAuFrB"}
+{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../src/device-auth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAGF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAGhD,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACnG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAwBF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAiCD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,UAAU,CAAC,CAuFrB"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { loginWithBrowser } from "./auth.js";
+import { loginWithBrowser, refreshCliSessionIfNeeded } from "./auth.js";
 import { loginWithDeviceCode } from "./device-auth.js";
 import { type TokenStore } from "./token-store.js";
 type CliIo = {
@@ -12,6 +12,7 @@ type MainOptions = {
     io?: CliIo;
     login?: typeof loginWithBrowser;
     deviceLogin?: typeof loginWithDeviceCode;
+    refreshSession?: typeof refreshCliSessionIfNeeded;
 };
 export declare function main(argv?: string[], options?: MainOptions): Promise<number>;
 export declare function isCliEntrypoint(moduleUrl: string, argvPath: string | undefined): boolean;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAYrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;CAC1C,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyKnG;AAwXD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAYrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+LnG;AAwXD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}

package/dist/index.js

@@ -36984,6 +36984,7 @@ var run = promisify(execFile);
 var oauthCallbackSchema = external_exports.object({
   code: external_exports.string().min(1)
 }).strict();
+var REFRESH_SKEW_MS = 5 * 60 * 1e3;
 async function loginWithBrowser(config2) {
   const callback = await waitForOAuthCallback();
   const supabase = createClient(config2.supabaseUrl, config2.supabaseAnonKey, {
@@ -37021,9 +37022,43 @@ async function loginWithBrowser(config2) {
   }
   return {
     accessToken,
+    ...sessionData.session.refresh_token ? { refreshToken: sessionData.session.refresh_token } : {},
     ...sessionData.session.expires_at ? { expiresAt: new Date(sessionData.session.expires_at * 1e3).toISOString() } : {}
   };
 }
+function shouldRefreshSession(session, now = Date.now()) {
+  if (!session.refreshToken || !session.expiresAt) {
+    return false;
+  }
+  return new Date(session.expiresAt).getTime() <= now + REFRESH_SKEW_MS;
+}
+async function refreshCliSessionIfNeeded(config2, session, now = Date.now()) {
+  const refreshToken = session.refreshToken;
+  if (!refreshToken || !shouldRefreshSession(session, now)) {
+    return session;
+  }
+  const supabase = createClient(config2.supabaseUrl, config2.supabaseAnonKey, {
+    auth: {
+      autoRefreshToken: false,
+      detectSessionInUrl: false,
+      persistSession: false
+    }
+  });
+  const { data, error: error51 } = await supabase.auth.refreshSession({ refresh_token: refreshToken });
+  if (error51) {
+    throw error51;
+  }
+  const refreshed = data.session;
+  const accessToken = refreshed?.access_token;
+  if (!accessToken) {
+    throw new Error("Supabase did not return a refreshed access token.");
+  }
+  return {
+    accessToken,
+    refreshToken: refreshed.refresh_token ?? refreshToken,
+    ...refreshed.expires_at ? { expiresAt: new Date(refreshed.expires_at * 1e3).toISOString() } : {}
+  };
+}
 async function openBrowser(url2) {
   const opened = await tryOpenBrowser(url2);
   if (!opened) {
@@ -37131,6 +37166,7 @@ async function defaultVerifyOtp(config2, input) {
   }
   return {
     accessToken,
+    ...data.session?.refresh_token ? { refreshToken: data.session.refresh_token } : {},
     ...data.session?.expires_at ? { expiresAt: new Date(data.session.expires_at * 1e3).toISOString() } : {}
   };
 }
@@ -37241,6 +37277,7 @@ import { promisify as promisify2 } from "node:util";
 var execFile2 = promisify2(execFileCallback);
 var sessionSchema = external_exports.object({
   accessToken: external_exports.string().min(1),
+  refreshToken: external_exports.string().min(1).optional(),
   expiresAt: external_exports.string().datetime({ offset: true }).optional()
 }).strict();
 var serviceName = `${cliBrand.binName}-cli`;
@@ -37332,7 +37369,7 @@ function createTokenStore(options = {}) {
   if (env[allowFileStoreKey] === "1") {
     const warning = [
       "WARNING: using the development-only plain-file CLI token store.",
-      "It stores only the CLI session token, never tenant secrets, API keys, or vault refs."
+      "It stores only CLI session tokens, never tenant secrets, API keys, or vault refs."
     ].join(" ");
     (options.stderr ?? process.stderr).write(`${warning}
 `);
@@ -37346,7 +37383,7 @@ function createTokenStore(options = {}) {
     [
       "No OS credential store is available (the CLI uses the macOS Keychain by default; there is no Windows or Linux keychain integration).",
       `For headless Linux, CI runners, or any no-keychain host, export ${allowFileStoreKey}=1 (set it for every invocation) to opt into the development-only plain-file token store.`,
-      "It is not encrypted: it writes an owner-only file (directory 0700, file 0600) holding only the CLI session token \u2014 never tenant secrets, API keys, or vault refs."
+      "It is not encrypted: it writes an owner-only file (directory 0700, file 0600) holding only CLI session tokens \u2014 never tenant secrets, API keys, or vault refs."
     ].join(" ")
   );
 }
@@ -42180,7 +42217,7 @@ Review the first dry runs, fleet overview, tool-call audit rows, escalations, an
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-06-20.1",
+    version: "2026-06-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42222,7 +42259,7 @@ Connecting a tool is a human-controlled step. The agent can recommend a tool, ex
 
 ## Generic REST connector
 
-For an API with no dedicated connector, the generic REST tool lets a seat call an HTTP endpoint with a credential you paste through the vault \u2014 no {{brand}}-owned app. It is escalate-by-default: the agent may only call a host a steward has signed onto the allowlist; any other host is refused and escalated, with no request made. The connector sets the Authorization header from the vaulted credential itself \u2014 the agent never sees the token, and the secret is redacted from the response before it reaches the agent, the audit row, or the logs. The token is only ever sent over HTTPS, only to the signed host, and a redirect is never followed \u2014 so an allowlisted endpoint cannot bounce the call (and the token) to another host. A sandbox dry run of a REST tool makes no real request.
+For an API with no dedicated connector, the generic REST tool lets a seat call an HTTP endpoint with a credential you paste through the vault \u2014 no {{brand}}-owned app. It is escalate-by-default: the agent may only call a host, method, and explicit path prefix a steward has signed onto the allowlist; any other host, method, or path is refused and escalated, with no request made. A path prefix of \`/\` means the steward intentionally approved every path. The connector sets the Authorization header from the vaulted credential itself \u2014 the agent never sees the token, and the secret is redacted from the response before it reaches the agent, the audit row, or the logs. The token is only ever sent over HTTPS, only to the signed host and scoped path, and a redirect is never followed \u2014 so an allowlisted endpoint cannot bounce the call (and the token) to another host. A sandbox dry run of a REST tool makes no real request.
 
 ## Slack post connector
 
@@ -42256,7 +42293,7 @@ There is exactly one way to give a connected tool its credential, and it is the
     order: 47,
     title: "Available tools guide",
     summary: "How to think about tool categories available to seats and what each category should be used for.",
-    version: "2026-06-20.1",
+    version: "2026-06-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42298,14 +42335,14 @@ Agents should explain the job, the required tool category, the minimum permissio
 
 Every tool call passes the server-side guard first: the guard checks the call against the seat's signed permission manifest and records a tool-call audit row for **every** call \u2014 allowed, denied, or escalated. Tool selection is never authorization. Only an allowed call reaches its handler. A connected credential is bound into the handler for the duration of the call only; the secret never appears in the result, the audit summary, logs, or the model's context.
 
-External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST connector when a signed allowlist and credential exist, and \`slack.post_message\` for a bound Slack channel. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
+External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST connector when a signed host/method/path allowlist and credential exist, and \`slack.post_message\` for a bound Slack channel. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
   },
   {
     slug: "mcp-and-cli-guide",
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-06-20.2",
+    version: "2026-06-20.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42453,7 +42490,7 @@ Notes:
 
 By default the CLI stores the session in the **macOS Keychain** (on darwin). There is no built-in Windows or Linux keychain integration today \u2014 on any non-macOS host, or any machine without a keychain, the CLI errors with "No OS credential store is available" unless you opt into the file store.
 
-For headless Linux, CI runners, or any no-keychain environment, set \`{{envPrefix}}_CLI_ALLOW_FILE_TOKEN_STORE=1\` to opt into the **development-only plain-file token store**. It is **not encrypted** \u2014 it writes the file with owner-only permissions (directory \`0700\`, file \`0600\`) and prints a stderr warning. It stores **only the CLI session token**, never tenant secrets, API keys, or vault refs. Treat that file as a credential: do not bake it into a shared image and do not commit it.
+For headless Linux, CI runners, or any no-keychain environment, set \`{{envPrefix}}_CLI_ALLOW_FILE_TOKEN_STORE=1\` to opt into the **development-only plain-file token store**. It is **not encrypted** \u2014 it writes the file with owner-only permissions (directory \`0700\`, file \`0600\`) and prints a stderr warning. It stores **only CLI session tokens** (access + refresh token), never tenant secrets, API keys, or vault refs. Treat that file as a credential: do not bake it into a shared image and do not commit it.
 
 The CLI checks this flag on **every** invocation, not just \`login\`. Export it for the whole shell or CI job (so \`{{cli}} whoami\`, \`{{cli}} onboard status\`, and the rest also find the file store), not only on the login line:
 
@@ -42462,7 +42499,7 @@ export {{envPrefix}}_CLI_ALLOW_FILE_TOKEN_STORE=1
 {{cli}} login --device
 \`\`\`
 
-For CI, do not run an interactive device login on every job (a device code still needs a human approver, which CI does not have). Note that the CLI session is a **short-lived** auth session (it carries an expiry), not a durable credential \u2014 so storing the session file as a long-lived CI secret will stop working once it expires, and re-approving a device code unattended is not possible. For ongoing unattended automation, prefer a **seat-scoped MCP token** used directly by your MCP client, and treat that client config as a secret. Such a token now defaults to a **90-day** expiry, so for automation that must outlive that window, mint it with an explicit \`--expires-in <days>\` (up to 365) or, accepting the long-lived-credential tradeoff, \`--no-expiry\` \u2014 e.g. \`mcp install --scope seat --seat-id <id> --expires-in 365\`. Rotate it before it lapses (\`--rotate <old-token-id>\`), and revoke and re-mint if a runner image is rebuilt or shared.
+For CI, do not run an interactive device login on every job (a device code still needs a human approver, which CI does not have). The CLI stores the Supabase refresh token from \`login\` / \`login --device\` and refreshes the access token before command execution when it is close to expiry, so normal local agent sessions survive the short access-token window without repeated browser approvals. The refresh token is still a user credential; if refresh fails or is revoked, run \`{{cli}} login --device\` again. For ongoing unattended automation, prefer a **seat-scoped MCP token** used directly by your MCP client, and treat that client config as a secret. Such a token now defaults to a **90-day** expiry, so for automation that must outlive that window, mint it with an explicit \`--expires-in <days>\` (up to 365) or, accepting the long-lived-credential tradeoff, \`--no-expiry\` \u2014 e.g. \`mcp install --scope seat --seat-id <id> --expires-in 365\`. Rotate it before it lapses (\`--rotate <old-token-id>\`), and revoke and re-mint if a runner image is rebuilt or shared.
 
 ## First-run path
 
@@ -42721,6 +42758,7 @@ These ergonomic wrappers (including the \`{{cli}} agent\` group) require **{{cli
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, read one run's transcript/error diagnostics, and show a markdown readout. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id> --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
+| \`{{cli}} model list\` | \`model.catalog\` | List guided model tiers with recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | \`{{cli}} model list --json\` |
 | \`{{cli}} compass show\` | \`compass.show_markdown\` | Render the current Compass as a clean markdown card for review. | Tenant | \`{{cli}} compass show --markdown\` |
 | \`{{cli}} charter show\` | \`charter.show_markdown\` | Render a seat's Charter as a clean markdown card for review. | Tenant | \`{{cli}} charter show --seat-id <id> --markdown\` |
 
@@ -42743,7 +42781,8 @@ This catalog is the canonical machine surface \u2014 the \`rost_*\` tools your M
 
 1. **The MCP tools below** \u2014 the \`rost_*\` surface your client actually calls to read and act.
 2. **\`{{cli}} tools list\` / \`tool.catalog\`** (MCP \`rost_list_tool_catalog\`) \u2014 the agent-configuration catalog the builder reads when staffing an agent. It is selectable per agent, but selecting a tool is not itself a call; live handlers execute later only behind the signed manifest, guard, credentials, and bindings.
-3. **The "Available tools guide"** (in the sidebar) \u2014 covers tool *categories* and governance, not a callable surface. See the available-tools-guide.
+3. **\`{{cli}} model list\` / \`model.catalog\`** (MCP \`rost_list_model_catalog\`) \u2014 the guided model-tier catalog the builder reads for recommendations, effort, token prices, cost bands, and model id selection.
+4. **The "Available tools guide"** (in the sidebar) \u2014 covers tool *categories* and governance, not a callable surface. See the available-tools-guide.
 
 Sections below: Command discovery (2) \xB7 Public reference (3) \xB7 Tenant-admin tools (grouped by domain) \xB7 Seat-scoped operating tools (9) \xB7 MCP operation resources (9).
 
@@ -42879,6 +42918,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_show_charter_as_markdown\` | \`charter.show_markdown\` | Render a seat's active or latest Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_show_agent_setup_as_markdown\` | \`agent.show_markdown\` | Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_list_tool_catalog\` | \`tool.catalog\` | List the discoverable tool catalog the agent builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance. | Tenant | Call with \`{}\` or \`{"provider":"google"}\`. |
+| \`rost_list_model_catalog\` | \`model.catalog\` | List guided model tiers \u2014 recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | Call with \`{}\`. |
 
 ### Seat-scoped operating tools
 
@@ -42936,7 +42976,7 @@ These rows are quick, at-a-glance triage. For deeper auth, tenant, scope, confir
     order: 49,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-06-20.1",
+    version: "2026-06-20.2",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -42987,6 +43027,7 @@ Never guess a command's JSON shape. Before calling a command that changes state,
 - List every callable command: {{cli}} command list (CLI) or rost_list_commands (MCP)
 - Read one command's exact input/output schema, help pointer, and a worked example: {{cli}} command schema <id> (CLI) or rost_describe_command with {"command_id":"<id>"} (MCP)
 - List the tool catalog the agent builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance): {{cli}} tools list (CLI) or rost_list_tool_catalog (MCP)
+- List guided model tiers before choosing --model (recommended default, effort, token prices, cost bands, best-fit work, model id): {{cli}} model list (CLI) or rost_list_model_catalog (MCP)
 - Show a Compass, Charter, or agent setup as a markdown card to review with your human: {{cli}} compass show --markdown, {{cli}} charter show --seat-id <id> --markdown, {{cli}} agent show --seat-id <id> --markdown
 
 When a command fails, the error returns a machine-readable code, a message, and a help field naming the exact command to run next. Read the help field and run the command it points at \u2014 do not retry the same call blindly. A failed precondition (for example a manifest not yet signed, a dry run that has not passed, or the inference budget hard cap reached) returns COMMAND_PRECONDITION_FAILED with a help pointer, not an opaque internal error.
@@ -43029,7 +43070,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Add an agent through the app (graph or sidebar, visual journey): add-agents-guide.
 - Create an agent from a template: stock-agents-guide, then how-agents-work.
 - Create a custom agent (operational answers, Charter Builder, configure tools, dry run, go live): custom-agents-guide, then agent-staffing-playbook and tool-access-and-vault.
-- Build a controlled agent worker directly on the CLI/MCP path (seat, steward, job, boundaries, tools, credentials, model, schedule, dry-run, go-live): agent-builder-guide \u2014 it shows the full setup sequence, the structured model config, the access tiers, how to discover tools (tool.catalog), which connector entries have live execution boundaries, and how to show your human a markdown readout (agent.show_markdown).
+- Build a controlled agent worker directly on the CLI/MCP path (seat, steward, job, boundaries, tools, credentials, model, schedule, dry-run, go-live): agent-builder-guide \u2014 it shows the full setup sequence, the structured model config, the model catalog (model.catalog), the access tiers, how to discover tools (tool.catalog), which connector entries have live execution boundaries, and how to show your human a markdown readout (agent.show_markdown).
 - Connect an existing or local agent to a seat: stock-agents-guide (connect section), then mcp-and-cli-guide and runner-guide.
 - Run the operating loop as a seat (context, tasks, status, escalate): how-agents-work.
 - Track goals: cascade-guide. Track measurables: signal-guide. File and resolve issues, tasks, escalations: friction-guide.
@@ -43735,7 +43776,7 @@ Name the failing surface, collect evidence, recommend the smallest correction, a
     order: 78,
     title: "Security model guide",
     summary: "How {{brand}} protects tenant data, credentials, tool calls, and human decisions across web, MCP, CLI, and agents.",
-    version: "2026-06-13.1",
+    version: "2026-06-20.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing", "operating_rhythm"],
@@ -43766,6 +43807,8 @@ Name the failing surface, collect evidence, recommend the smallest correction, a
 - Agents recommend and draft; humans approve durable decisions.
 - Accepted knowledge changes by supersession, not silent mutation.
 
+The public Privacy Policy and Terms of Service are available at \`/privacy\` and \`/terms\` before sign-in and from the authenticated app chrome.
+
 ## Agent guidance
 
 Never infer permission from the user's wording or a locally available tool. Check the Charter, manifest, and server response. When in doubt, escalate with the evidence and the narrow question a human must decide.`
@@ -44067,7 +44110,7 @@ This worked document **omits** \`unanswered_boundaries\` and \`seat_type_recomme
     order: 43,
     title: "Agent builder guide",
     summary: "The full agent setup sequence on the CLI/MCP path \u2014 seat, steward, job, boundaries, tools, credentials, model, schedule, dry-run, go-live \u2014 with the structured model config and access tiers.",
-    version: "2026-06-20.1",
+    version: "2026-06-20.2",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -44078,6 +44121,7 @@ This worked document **omits** \`unanswered_boundaries\` and \`seat_type_recomme
       "agent_setup.update",
       "agent.configure_tools",
       "tool.catalog",
+      "model.catalog",
       "agent.run_dry_run",
       "agent.go_live",
       "agent.show_markdown",
@@ -44116,7 +44160,7 @@ Building teams of controlled agent workers is the product's core differentiator.
 5. **Tools** \u2014 pick from the discoverable catalog (\`{{cli}} tools list\`); each tool has a default scope tier and access policy. Connect or decline via \`agent.configure_tools\`. Selecting a tool records permission; live handlers execute later only behind the signed manifest, server guard, required credential or binding, and connector-specific approval boundary.
 6. **Credentials** \u2014 a tool that needs access declares a credential-ingress request (provider, scope, secret name). The secret itself flows through the vault-backed ingress command as a vault ref \u2014 never paste a secret into a builder command.
 7. **Operating instructions** \u2014 the runtime composes the agent's context from its Charter; you do not write a system prompt.
-8. **Model** \u2014 select the structured model config (see below).
+8. **Model** \u2014 select the structured model config (see below). Read \`{{cli}} model list\` / \`model.catalog\` first when you are unsure; it returns the recommended default, effort, token price estimates, cost band, and best-fit work for each tier. If \`agent.create_custom\` omits \`model_config\`, {{brand}} recommends a tier from the supplied responsibility answers.
 9. **Heartbeat** \u2014 set the schedule (\`schedule_cron\`) for a recurring agent; a live scheduled agent must keep a steward chain.
 10. **Dry-run** \u2014 \`agent.run_dry_run\` rehearses in sandbox after the manifest is signed; it is ungated by human approval but requires a signed manifest.
 11. **Go-live** \u2014 \`agent.go_live\` is \`human_required\`. Prepare everything and surface the go-live to a human; never go live on a human's behalf.
@@ -44133,6 +44177,8 @@ The agent's model is a structured object, not a bare string:
 - \`model\` is a model id. Pick by the work the seat does \u2014 a triage tier for cheap, high-volume classification; a balanced tier for most seats; a complex tier for judgment-heavy reasoning; the hardest tier for long-horizon agentic work. The builder offers tier shortcuts (\`triage\`, \`balanced\`, \`complex\`, \`hardest\`) that map to a current Claude id, so you never hardcode a stale one.
 - \`effort\` (\`low\` \u2192 \`max\`) trades thoroughness for cost/latency. Low for triage; high or xhigh for the hardest agentic seats.
 
+Run \`{{cli}} model list\` (MCP \`rost_list_model_catalog\`) before choosing when cost or reasoning depth is unclear. Balanced is the recommended default. Token prices are catalog estimates per million tokens, and cost bands are planning guidance for relative spend; the billing-grade number is still each run's recorded token usage and \`cost_usd\`. Custom agent creation recommends a tier from responsibility answers when \`model_config\` is omitted.
+
 On the CLI, \`{{cli}} agent create --custom --seat-id <id> --model balanced --effort medium \u2026\`, or set it later with \`{{cli}} agent setup answer --seat-id <id> --model complex\`. The model cannot change after the agent is live.
 
 ## Access tiers
@@ -45088,7 +45134,7 @@ function markdownLine(output) {
   const markdown = asRecord(output).markdown;
   return typeof markdown === "string" ? markdown : JSON.stringify(output, null, 2);
 }
-var MODEL_TIER_MAP = {
+var CLI_MODEL_TIER_MAP = {
   triage: { model: "claude-haiku-4-5", effort: "low" },
   balanced: { model: "claude-sonnet-4-6", effort: "medium" },
   complex: { model: "claude-opus-4-8", effort: "high" },
@@ -45098,7 +45144,7 @@ function resolveModelConfig(model, effort) {
   if (model === void 0) {
     return void 0;
   }
-  const tier = MODEL_TIER_MAP[model];
+  const tier = CLI_MODEL_TIER_MAP[model];
   const resolvedModel = tier ? tier.model : model;
   const resolvedEffort = effort ?? tier?.effort;
   return {
@@ -45945,6 +45991,44 @@ function toolsUsage(bin) {
   return `Usage: ${bin} tools list [--provider <name>] [--json]
   ${bin} tools list \u2014 the discoverable tool catalog the builder reads; live handlers execute only behind signed manifests, guards, credentials, and bindings.`;
 }
+var modelWrapper = (context, args) => dispatch(context, "model", args, {
+  list: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "model.catalog", {}, (output) => {
+      const record2 = asRecord(output);
+      const tiers = asArray(record2.tiers);
+      const header = `# Model tiers
+
+${field(record2, "note")}
+`;
+      if (tiers.length === 0) {
+        return `${header}
+No model tiers are configured.`;
+      }
+      const defaultTier = field(record2, "default_tier");
+      const lines = tiers.map((entry) => {
+        const r = asRecord(entry);
+        const tier = field(r, "tier");
+        const recommended = r.recommended === true || tier === defaultTier ? " recommended" : "";
+        const bestFor = asArray(r.best_for).map(String).join(", ");
+        return [
+          `- \`${tier}\` [${field(r, "provider")}/${field(r, "model")} \xB7 effort ${field(r, "effort")} \xB7 cost ${field(r, "cost_band")}${recommended}]`,
+          `  ${field(r, "description")}`,
+          `  Best for: ${bestFor}`,
+          `  Price: $${field(r, "input_usd_per_million_tokens")}/1M input \xB7 $${field(r, "output_usd_per_million_tokens")}/1M output`,
+          `  Cost: ${field(r, "cost_note")}`,
+          `  Avoid for: ${field(r, "avoid_for")}`
+        ].join("\n");
+      });
+      return `${header}
+${lines.join("\n")}`;
+    });
+  }
+}, modelUsage(context.binName));
+function modelUsage(bin) {
+  return `Usage: ${bin} model list [--json]
+  ${bin} model list \u2014 guided model tiers with recommendations, token prices, cost bands, and model ids for --model.`;
+}
 var compassWrapper = (context, args) => dispatch(context, "compass", args, {
   show: (ctx, rest) => {
     const parsed = parseFlags(rest, /* @__PURE__ */ new Set(["markdown"]));
@@ -45980,6 +46064,7 @@ var OPERATION_GROUPS = [
   "member",
   "agent",
   "tools",
+  "model",
   "compass",
   "charter"
 ];
@@ -45997,6 +46082,7 @@ var wrappers = {
   member: memberWrapper,
   agent: agentWrapper,
   tools: toolsWrapper,
+  model: modelWrapper,
   compass: compassWrapper,
   charter: charterWrapper
 };
@@ -46017,6 +46103,7 @@ var groupUsageBuilders = {
   member: memberUsage,
   agent: agentUsage,
   tools: toolsUsage,
+  model: modelUsage,
   compass: compassUsage,
   charter: charterUsage
 };
@@ -46046,6 +46133,7 @@ function operationUsageLines(bin) {
     `${bin} member invite|update|remove`,
     `${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|get-run|show`,
     `${bin} tools list`,
+    `${bin} model list`,
     `${bin} compass show`,
     `${bin} charter show`
   ];
@@ -46130,6 +46218,7 @@ async function main(argv = process.argv.slice(2), options = {}) {
   };
   const login = options.login ?? loginWithBrowser;
   const deviceLogin = options.deviceLogin ?? loginWithDeviceCode;
+  const refreshSession = options.refreshSession ?? refreshCliSessionIfNeeded;
   const [rawCommand, ...args] = argv;
   const command = rawCommand === "--help" || rawCommand === "-h" ? "help" : rawCommand;
   if (!isCommand(command) && !isOperationGroup(command)) {
@@ -46230,6 +46319,29 @@ async function main(argv = process.argv.slice(2), options = {}) {
     return 1;
   }
   const config2 = loadConfig();
+  let refreshed;
+  try {
+    refreshed = await refreshSession(config2, session);
+  } catch (error51) {
+    io.stderr.write(
+      `${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+Session refresh failed. Run ${cliBrand.binName} login --device again.
+`
+    );
+    return 1;
+  }
+  if (refreshed !== session) {
+    session = refreshed;
+    try {
+      await store.write(session);
+    } catch (error51) {
+      io.stderr.write(
+        `Session refreshed, but storing it failed: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+Run ${cliBrand.binName} login --device again if the next command asks you to authenticate.
+`
+      );
+    }
+  }
   const client = new CommandClient({
     appUrl: config2.appUrl,
     token: session.accessToken