@rosthq/cli 0.5.20 → 0.5.22

package/dist/index.js

@@ -42384,7 +42384,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-06-21.10",
+    version: "2026-06-21.12",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42443,7 +42443,8 @@ External connectors are being rolled out provider by provider, conservatively (r
       "integration.list",
       "integration.readiness",
       "integration.status",
-      "integration.test"
+      "integration.test",
+      "tenant.rename"
     ],
     legal: {
       publicRisk: "low",
@@ -42820,7 +42821,7 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} runner list|status|work-orders|revoke\` | \`runner.list\`, \`runner.status\`, \`work_order.list\`, \`runner.revoke\` | Inspect runners and work orders; revoke a runner. | Tenant | \`{{cli}} runner list --json\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` | \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | List connector metadata, read the setup-readiness checklist, read one connector's health, and run the provider-specific connection test without exposing credentials. | Tenant | \`{{cli}} integration readiness --provider google --json\` |
-| \`{{cli}} settings get|update\` | \`settings.get\`, \`settings.update\` | Read tenant settings; update budget caps. | Tenant | \`{{cli}} settings get --json\` |
+| \`{{cli}} settings get|update|product-learning|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, and rename the company. Budget and product-learning updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings product-learning update --mode disabled --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
@@ -42982,8 +42983,11 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_remove_member\` | \`member.remove\` | Remove a tenant member. | Tenant | Call with \`member_id\`; blocked if it would orphan an agent steward chain. |
 | \`rost_get_tenant_settings\` | \`settings.get\` | Read tenant operating settings and integration status. | Tenant | Call with \`{}\`; metadata only. |
 | \`rost_update_tenant_settings\` | \`settings.update\` | Update tenant AI budget caps. | Tenant | Call with \`soft_cap_usd\` or \`hard_cap_usd\`; expect human confirmation. |
+| \`rost_rename_company\` | \`tenant.rename\` | Rename the current company. | Tenant-admin | Call with \`company_name\`; expect human confirmation. |
 | \`rost_get_sync_brief_scope\` | \`settings.sync_brief_scope.get\` | Read the tenant's Sync Brief scope (company_wide or per_cluster). | Tenant | Call with \`{}\`. |
 | \`rost_update_sync_brief_scope\` | \`settings.sync_brief_scope.update\` | Set the tenant's Sync Brief scope (company_wide or per_cluster). | Tenant-admin | Owner-only; call with \`{"sync_brief_scope":"company_wide"}\` or \`{"sync_brief_scope":"per_cluster"}\`. |
+| \`rost_get_product_learning_policy\` | \`settings.product_learning.get\` | Read whether product/page/recommendation analytics are allowed. | Tenant | Call with \`{}\`; audit/security logs are always enabled. |
+| \`rost_update_product_learning_policy\` | \`settings.product_learning.update\` | Set product-learning mode. | Tenant-admin | Human-gated; call with \`{"mode":"enabled"}\`, \`{"mode":"disabled"}\`, or \`{"mode":"enterprise_contract"}\`. |
 | \`rost_list_signals\` | \`signal.list\` | List measurables with their latest reading and on/off-track state. | Seat or tenant-admin | Call with \`{}\` to find measurable ids. |
 | \`rost_get_signal\` | \`signal.get\` | Read a measurable with its full reading history. | Seat or tenant-admin | Call with \`{"measurable_id":"<id>"}\`. |
 | \`rost_confirm_signal_reading\` | \`signal.confirm_reading\` | Confirm an unconfirmed reading as human-verified. | Seat or tenant-admin | Humans confirm; call with \`{"reading_id":"<id>"}\`. |
@@ -43774,7 +43778,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-06-20.1",
+    version: "2026-06-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -43799,7 +43803,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
 ## Confirmation levels
 
 - \`none\`: no confirmation gate \u2014 the command never returns a pending confirmation. Most are reads or reversible drafts an agent can run directly, including over MCP (graph reads, \`charter.draft\`, \`status.record\`, \`sync.brief.compile\`, \`sync.run.start\`, \`task.complete\`). A few \`none\` commands still require a human actor or an interactive channel \u2014 \`confirmation.approve\` is \`none\` (approving a gate cannot itself be gated) yet runs only as a human in the UI or CLI \u2014 so \`none\` means "no confirmation gate", not always "agent-callable".
-- \`human_required\`: a human must approve. Structural, staffing, resolution, and go-live commands (\`seat.reparent\`, \`charter.approve\`, \`goal.reparent\`, \`friction.resolve\`, \`agent.go_live\`, \`mcp_token.create\`).
+- \`human_required\`: a human must approve. Structural, staffing, resolution, tenant profile, and go-live commands (\`seat.reparent\`, \`charter.approve\`, \`goal.reparent\`, \`friction.resolve\`, \`agent.go_live\`, \`mcp_token.create\`, \`tenant.rename\`).
 - \`credential_flow\`: routes through the vault-backed credential path so a secret is captured as a vault reference, never stored or logged in the clear (\`credential.ingress\`, \`tenant.anthropic_key.save\`; \`agent.configure_tools\` is \`credential_flow\` too \u2014 it stages credential-ingress requests through the same path without ever taking raw secret material).
 - \`dangerous\`: the highest-risk human gate. Only two commands carry it \u2014 \`settings.update\` and \`agent.decommission\`.
 
@@ -43829,11 +43833,11 @@ Stop before: approving a Charter, signing a manifest, connecting a tool or crede
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-06-21.1",
+    version: "2026-06-21.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
-    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update"],
+    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native settings guidance."] },
     sources: [
       {
@@ -43852,7 +43856,7 @@ Start with members and invites, then provider and channel connections, then MCP
 
 ## What belongs in Settings
 
-- Company profile and workspace defaults.
+- Company profile and workspace defaults. Rename the company from Settings or with \`tenant.rename\` (CLI: \`{{cli}} settings rename --company "<name>"\`); the command is owner-only, human-gated, and records a rename event with old and new names.
 - Members, invites, and tenant roles.
 - Agent access tokens for local agents.
 - Provider and integration configuration.
@@ -43860,6 +43864,7 @@ Start with members and invites, then provider and channel connections, then MCP
 - Connected machines (the paired Runners that run scheduled local work orders).
 - Stored credentials (vault references only) and tool access approvals.
 - Operating defaults, including Sync Brief scope.
+- Product-learning participation for bounded product analytics.
 
 Settings lifecycle timestamps are display metadata for tokens, connected machines, integrations, and stored credentials. They may be emitted by the database as either timestamp values or strings, but Settings renders them as safe labels rather than treating timestamp formatting failures as page-level failures.
 
@@ -43875,6 +43880,18 @@ Reconnects keep historical rows for audit, but provider status in Settings, CLI,
 
 The weekly Sync Brief compiles either company-wide or per cluster. Company-wide is one brief covering the whole company and is the default for a new company. Per cluster compiles one brief per cluster, scoped to each cluster's seats; pick it when clusters run their own weekly sync. Per cluster falls back to a single company-wide brief when the company has no clusters, so the rhythm never produces zero briefs. The owner sets this at onboarding and can change it later in Settings.
 
+## Product learning
+
+Product-learning participation controls whether {{brand}} may record product/page/recommendation analytics for this tenant. It does not disable security logs, audit logs, error logs, events, tool-call guard records, or other operational records required to run and secure the service.
+
+- \`enabled\` allows bounded product analytics for feature quality, defaults, templates, recommendations, safety checks, and reliability.
+- \`disabled\` blocks generic product/page/recommendation analytics for the tenant.
+- \`enterprise_contract\` blocks generic product-learning writes until contract-specific handling exists.
+
+Read the policy with \`settings.product_learning.get\` (CLI: \`{{cli}} settings product-learning get\`). Change it with \`settings.product_learning.update\` (CLI: \`{{cli}} settings product-learning update --mode disabled\`). Analytics ingestion code should call the shared product-learning policy helper instead of reading \`tenants.settings\` directly.
+
+The product analytics foundation stores only bounded product telemetry: product events, page views by route template, command invocation metadata, onboarding milestones, and recommendation outcomes. Authenticated users can read analytics rows for their tenant, but writes are server-owned through the trusted DB helpers. The helpers and database constraints reject or redact obvious raw URLs, filesystem paths, secrets, prompt/content fields, command argument/output fields, direct contact/payment identifiers, and long prose-shaped values. These analytics rows are not audit records; operational logs and security evidence stay in their dedicated append-only or product-visible tables.
+
 ## Inference budget
 
 Agents that run on {{brand}}-managed inference draw against a tenant inference budget with a hard cap. A new company starts with a hard cap of $0, so a managed-inference run is blocked until the cap is raised. When a run hits the cap it stops with a typed budget error that names the fix; raise the cap before agents can run again.
@@ -46488,12 +46505,33 @@ function integrationUsage(bin) {
   ${bin} integration test --provider <name>`;
 }
 var settingsWrapper = (context, args) => dispatch(context, "settings", args, {
+  "product-learning": (ctx, rest) => dispatch(ctx, "settings product-learning", rest, {
+    get: (innerCtx, innerRest) => {
+      const parsed = parseFlags(innerRest);
+      return execute(innerCtx, parsed, "settings.product_learning.get", {}, (output) => {
+        const policy = asRecord(asRecord(output).product_learning);
+        return `product_learning ${field(policy, "mode")}  product_analytics_enabled=${field(policy, "product_analytics_enabled")}  security_audit_logs_enabled=${field(policy, "security_audit_logs_enabled")}`;
+      });
+    },
+    update: (innerCtx, innerRest) => {
+      const parsed = parseFlags(innerRest);
+      const mode = optionalValue(parsed, "mode");
+      if (mode !== "enabled" && mode !== "disabled" && mode !== "enterprise_contract") {
+        throw new UsageError("Provide --mode enabled|disabled|enterprise_contract.");
+      }
+      return execute(innerCtx, parsed, "settings.product_learning.update", { mode }, (output) => {
+        const policy = asRecord(asRecord(output).product_learning);
+        return `Updated product-learning policy to ${field(policy, "mode")} (product_analytics_enabled=${field(policy, "product_analytics_enabled")}).`;
+      });
+    }
+  }, settingsUsage(ctx.binName)),
   get: (ctx, rest) => {
     const parsed = parseFlags(rest);
     return execute(ctx, parsed, "settings.get", {}, (output) => {
       const record2 = asRecord(output);
       const spend = asRecord(record2.spend);
-      return `tenant ${field(record2, "tenant_id")}  plan=${field(record2, "plan")}  status=${field(record2, "status")}  spend=$${field(spend, "spend_usd")}  has_anthropic_key=${field(record2, "has_anthropic_key")}`;
+      const policy = asRecord(record2.product_learning);
+      return `tenant ${field(record2, "tenant_id")}  plan=${field(record2, "plan")}  status=${field(record2, "status")}  spend=$${field(spend, "spend_usd")}  has_anthropic_key=${field(record2, "has_anthropic_key")}  product_learning=${field(policy, "mode")}`;
     });
   },
   update: (ctx, rest) => {
@@ -46509,12 +46547,26 @@ var settingsWrapper = (context, args) => dispatch(context, "settings", args, {
       const spend = asRecord(asRecord(output).spend);
       return `Updated budget caps (soft=$${field(spend, "soft_cap_usd")}, hard=$${field(spend, "hard_cap_usd")}).`;
     });
+  },
+  rename: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const companyName = optionalValue(parsed, "company");
+    if (!companyName) {
+      throw new UsageError("Provide --company <name>.");
+    }
+    return execute(ctx, parsed, "tenant.rename", { company_name: companyName }, (output) => {
+      const record2 = asRecord(output);
+      return `Renamed company from ${field(record2, "previous_name")} to ${field(record2, "name")}.`;
+    });
   }
 }, settingsUsage(context.binName));
 function settingsUsage(bin) {
-  return `Usage: ${bin} settings get|update [--json]
+  return `Usage: ${bin} settings get|update|product-learning|rename [--json]
   ${bin} settings get
-  ${bin} settings update [--soft-cap-usd <n>] [--hard-cap-usd <n>]`;
+  ${bin} settings update [--soft-cap-usd <n>] [--hard-cap-usd <n>]
+  ${bin} settings product-learning get
+  ${bin} settings product-learning update --mode enabled|disabled|enterprise_contract
+  ${bin} settings rename --company <name>`;
 }
 var memberWrapper = (context, args) => dispatch(context, "member", args, {
   invite: (ctx, rest) => {
@@ -47164,7 +47216,7 @@ function operationUsageLines(bin) {
     `${bin} sync brief|compile|complete`,
     `${bin} runner list|status|work-orders|revoke`,
     `${bin} notification settings|test|errors`,
-    `${bin} settings get|update`,
+    `${bin} settings get|update|product-learning|rename`,
     `${bin} member invite|update|remove`,
     `${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show`,
     `${bin} tools list`,