@rosthq/cli 0.5.14 → 0.5.15

package/dist/index.js

@@ -41752,7 +41752,7 @@ When operating through CLI or MCP, create fewer seats first and ask for confirma
     order: 30,
     title: "Charter design playbook",
     summary: "How to draft strong Charters that work for human, agent, and hybrid seats.",
-    version: "2026-06-13.1",
+    version: "2026-06-20.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["charter_design", "staffing"],
@@ -41809,6 +41809,8 @@ List and read first, then draft, then leave activation to a human.
 - Draft one: \`{{cli}} command charter.draft --json '{"seat_id":"<seat-id>"}'\` (scope: seat or tenant-admin); draft every eligible seat with \`charter.draft_all\` / \`rost_draft_all_charters\`. Draft commands are not gated \u2014 they produce a draft \`charter_version_id\`. \`charter.draft_all\` only drafts **active** seats and returns the real result: \`{ drafted, skipped, draft_ids, skipped_seats: [{ seat_id, reason }] }\` where \`reason\` is \`seat_not_active\` (the seat is still draft/vacant \u2014 confirm it first) or \`charter_exists\` (it already has a draft/active Charter). Read \`skipped_seats\` to see why a freshly-built graph drafted fewer Charters than it has seats.
 - Edit a draft: \`charter.update_draft\` / \`rost_update_charter_draft\` with the \`charter_version_id\` and the new \`doc\`.
 
+In the app, \`/charters\` is both a drafting queue and a governance library. It shows active Charters, draft amendments, seats missing Charters, unsigned manifests, and steward-review gaps. Opening a live Charter is a review mode: read the active version, inspect its governance state, and open an amendment draft when the job needs to change. Active Charter content is never silently edited in place.
+
 ## When to stop for confirmation
 
 \`charter.approve\`, \`charter.skip\`, \`charter.apply_seat_type_recommendation\`, and \`charter.sign_manifest\` are \`human_required\`. Over MCP \`rost_approve_charter\` returns a pending confirmation, not an activation. Approving a Charter, signing a permission manifest, or expanding authority is a human act recorded against \`decided_by\`. An agent prepares the draft and surfaces the approve link; it does not approve. See the confirmations guide.
@@ -42121,7 +42123,7 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
     order: 45,
     title: "How agents work",
     summary: "How {{brand}} agents operate inside seats, use Charters, report work, and escalate beyond authority.",
-    version: "2026-06-20.1",
+    version: "2026-06-20.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -42130,6 +42132,7 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
       "agent.go_live",
       "agent.status",
       "agent.list_fleet",
+      "agent.fleet_digest",
       "agent_setup.get",
       "agent_setup.update",
       "agent.decommission",
@@ -42204,13 +42207,17 @@ The model is only ever offered the tools the seat's manifest grants \u2014 a den
 3. The action runs bound to the seat's vaulted credential. The secret stays inside the call and never reaches the result, the audit row, the logs, or the model.
 4. Every call \u2014 allowed, denied, escalated, or invalid \u2014 writes a tool-call audit row you can review.
 
+When operational evidence appears in the app, it is formatted for review instead of shown as primary raw JSON. Tool arguments, escalation evidence, status evidence, Sync inputs, and task context are summarized as labeled fields; secret-looking values stay redacted. Raw identifiers remain available only as supporting detail when they help an operator trace the record.
+
 Provider requests carry only the model payload the runtime needs; run attribution, tenant attribution, usage, and cost are recorded in {{brand}} audit tables after the call, not sent as custom provider metadata.
 
 Before an agent goes live, the sandbox dry run rehearses this against fake data and returns a per-tool preview: for each tool the agent would touch, whether it would run it, would be blocked, or would escalate \u2014 no external side effect. Review that preview before you approve go-live.
 
 ## What humans should review
 
-Review the first dry runs, fleet overview, tool-call audit rows, escalations, and Signal impact. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalent is \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\`, which returns lane, live state, last real turn, 24h/7d real turns, top measurable status, open escalations, and 7-day spend. Fleet real-turn counts use the same seat-run association as \`agent.list_runs\`, filtered to real runs. Scheduled agents are checked in rounded five-minute buckets, so a minute-level cron inside the bucket queues one work order for that bucket rather than one order per minute. Sandbox dry runs do not count as real turns. If the agent is repeatedly blocked, revise the Charter or split the seat. If the agent is taking too much judgment, narrow its autonomous scope.`
+The Agents page shows fleet health first: live state, recent runs, failed runs, open held actions, last activity, cost, and the next operator action. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason.
+
+Review the first dry runs, fleet overview, tool-call audit rows, escalations, and Signal impact. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalents are \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\` for the compact overview, and \`{{cli}} agent fleet-digest --json\` / \`agent.fleet_digest\` / \`rost_get_dogfood_fleet_health_digest\` for the daily dogfood evidence bundle. The digest returns live/idle state, 24h/7d turns, 7d/30d spend, recent failed runs, unresolved product errors, failed notifications, and a next action per seat. Fleet real-turn counts use the same seat-run association as \`agent.list_runs\`, filtered to real runs. Scheduled agents are checked in rounded five-minute buckets, so a minute-level cron inside the bucket queues one work order for that bucket rather than one order per minute. Sandbox dry runs do not count as real turns. If the agent is repeatedly blocked, revise the Charter or split the seat. If the agent is taking too much judgment, narrow its autonomous scope.`
   },
   {
     slug: "tool-access-and-vault",
@@ -42300,7 +42307,7 @@ There is exactly one way to give a connected tool its credential, and it is the
     order: 47,
     title: "Available tools guide",
     summary: "How to think about tool categories available to seats and what each category should be used for.",
-    version: "2026-06-20.2",
+    version: "2026-06-20.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42349,7 +42356,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-06-20.7",
+    version: "2026-06-20.8",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42385,6 +42392,7 @@ External connectors are being rolled out provider by provider, conservatively (r
       "agent.go_live",
       "agent.status",
       "agent.list_fleet",
+      "agent.fleet_digest",
       "agent.get_run",
       "agent.list_runs",
       "agent.list_tool_calls"
@@ -42764,7 +42772,7 @@ These ergonomic wrappers (including the \`{{cli}} agent\` group) require **{{cli
 | \`{{cli}} integration list|status|test\` | \`integration.list\`, \`integration.status\`, \`integration.test\` | List connector metadata, read one connector's health, and run the provider-specific connection test without exposing credentials. | Tenant | \`{{cli}} integration test --provider google --json\` |
 | \`{{cli}} settings get|update\` | \`settings.get\`, \`settings.update\` | Read tenant settings; update budget caps. | Tenant | \`{{cli}} settings get --json\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
-| \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, read one run's transcript/error diagnostics, and show a markdown readout. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id> --json\` |
+| \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
 | \`{{cli}} model list\` | \`model.catalog\` | List guided model tiers with recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | \`{{cli}} model list --json\` |
 | \`{{cli}} compass show\` | \`compass.show_markdown\` | Render the current Compass as a clean markdown card for review. | Tenant | \`{{cli}} compass show --markdown\` |
@@ -42864,6 +42872,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_compass_gaps\` | \`compass.list_gaps\` | List unanswered and answered Compass context gaps. | Tenant | Call with \`{}\` before answering gaps. |
 | \`rost_get_agent_status\` | \`agent.status\` | Read agent lane, live state, steward chain, dry-run result, Runner availability. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_list_agent_fleet\` | \`agent.list_fleet\` | Read every staffed agent seat at once: lane, live state, last real turn, 24h/7d real turns, measurable status, escalations, and 7-day spend. | Tenant | Call with \`{}\`; counts use the same seat-run association as \`agent.list_runs\`, with sandbox dry runs excluded from real turns. |
+| \`rost_get_dogfood_fleet_health_digest\` | \`agent.fleet_digest\` | Capture the daily dogfood fleet-health digest: live/idle state, 24h/7d turns, spend, recent failed runs, unresolved errors, failed notifications, and next actions. | Tenant | Call with \`{}\`; optional \`window_hours\` bounds recent failed-run evidence, while \`error_limit\` caps linked evidence per seat. |
 | \`rost_run_agent_now\` | \`agent.run_now\` | Queue an immediate run for a live staffed agent without changing its saved schedule; cloud lane dispatches to the executor and runner lane queues for the paired runner. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_list_agent_runs\` | \`agent.list_runs\` | Read a seat's agent run history (status, lane, model, cost, per-run tool-call and guard-held counts) plus the seat's run/tool-call rollup including held-action count. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`limit\` for a deeper window. |
 | \`rost_get_agent_run_diagnostics\` | \`agent.get_run\` | Read one run's diagnostic record: transcript reference, token/cost usage, outcome, and linked product-visible run errors. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>","run_id":"<run-id>"}\`. |
@@ -43426,7 +43435,7 @@ Stop before: approving a Charter, signing a manifest, connecting a tool or crede
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-06-20.1",
+    version: "2026-06-20.5",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -43458,9 +43467,15 @@ Start with members and invites, then provider and channel connections, then MCP
 - Stored credentials (vault references only) and tool access approvals.
 - Operating defaults, including Sync Brief scope.
 
+Settings lifecycle timestamps are display metadata for tokens, connected machines, integrations, and stored credentials. They may be emitted by the database as either timestamp values or strings, but Settings renders them as safe labels rather than treating timestamp formatting failures as page-level failures.
+
+When a settings source is temporarily unavailable, the app keeps the route open and marks affected sections as unavailable instead of showing raw errors or stale-looking editable values. Budget and Sync Brief controls stay read-only until their server-backed data can be loaded.
+
 ## Integration health
 
-\`integration.list\` lists connector metadata for CLI and MCP operators, \`integration.status\` reads one provider or integration id, and \`integration.test\` runs the installed provider-specific health check. These commands return account labels, scopes, capabilities, timestamps, and health only; they never return vault references, access tokens, refresh tokens, or raw provider responses. Google's test refreshes the vaulted OAuth credential and reads the Gmail profile as the minimal live check.
+\`integration.list\` lists connector metadata for CLI and MCP operators, \`integration.status\` reads one provider or integration id, and \`integration.test\` runs the installed provider-specific health check. These commands return account labels, scopes, capabilities, timestamps, and health only; they never return vault references, access tokens, refresh tokens, or raw provider responses. Google's test refreshes the vaulted OAuth credential and reads the Gmail profile as the minimal live check. Settings exposes the same Google test as an owner/operator button beside Connect/Reconnect, shows the last tested time, and turns failures into reconnect-oriented remediation copy rather than raw provider errors.
+
+Reconnects keep historical rows for audit, but provider status in Settings, CLI, and MCP prefers the current connected row first, then the latest error or disconnected row.
 
 ## Sync Brief scope
 
@@ -45962,6 +45977,24 @@ ${field(record2, "summary")}`;
       return `queued ${field(workOrder, "lane")} work order ${field(workOrder, "id")} for agent ${field(workOrder, "agent_id")} (${field(workOrder, "status")})`;
     });
   },
+  "fleet-digest": (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const body = withOptional({}, {
+      window_hours: optionalNumber(parsed, "window-hours"),
+      error_limit: optionalNumber(parsed, "error-limit")
+    });
+    return execute(ctx, parsed, "agent.fleet_digest", body, (output) => {
+      const record2 = asRecord(output);
+      const summary = asRecord(record2.summary);
+      const agents = asArray(record2.agents);
+      const header = `fleet ${field(summary, "fleet_count")} seats  live=${field(summary, "live_count")}  idle=${field(summary, "idle_count")}  turns24h=${field(summary, "turns_24h")}  failed24h=${field(summary, "failed_runs_24h")}  spend7d=$${field(summary, "spend_7d_usd")}`;
+      const lines = agents.map((agent) => {
+        const r = asRecord(agent);
+        return `${field(r, "seat_name")}  ${field(r, "health_status")}  live=${field(r, "live")}  turns24h=${field(r, "turns_24h")}  failed=${field(r, "failed_runs_24h")}  next=${field(r, "suggested_next_action")}`;
+      });
+      return [header, ...lines].join("\n");
+    });
+  },
   "get-run": (ctx, rest) => {
     const parsed = parseFlags(rest);
     const body = {
@@ -46003,7 +46036,7 @@ function agentConfigureTools(ctx, rest, decision) {
   });
 }
 function agentUsage(bin) {
-  return `Usage: ${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|get-run|show [--json]
+  return `Usage: ${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show [--json]
   ${bin} agent templates
   ${bin} agent create --seat-id <id> --template <slug> [--expected-version <v>]
   ${bin} agent create --seat-id <id> --custom [--steward-seat-id <id>] [--lane cloud|mcp_session|runner] [--model triage|balanced|complex|hardest|<id>] [--effort low|medium|high|xhigh|max] [--owns <text>] [--success <text>] [--never-alone <text>]
@@ -46014,6 +46047,7 @@ function agentUsage(bin) {
   ${bin} agent go-live --seat-id <id> --charter-version-id <id>
   ${bin} agent status --seat-id <id>
   ${bin} agent run-now --seat-id <id> [--task-id <id>]
+  ${bin} agent fleet-digest [--window-hours <n>] [--error-limit <n>]
   ${bin} agent get-run --seat-id <id> --run-id <id>
   ${bin} agent show --seat-id <id> [--markdown]`;
 }
@@ -46200,7 +46234,7 @@ function operationUsageLines(bin) {
     `${bin} notification settings|test|errors`,
     `${bin} settings get|update`,
     `${bin} member invite|update|remove`,
-    `${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|get-run|show`,
+    `${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show`,
     `${bin} tools list`,
     `${bin} model list`,
     `${bin} compass show`,