@rosthq/cli 0.5.21 → 0.5.22

package/dist/index.js

@@ -42384,7 +42384,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-06-21.11",
+    version: "2026-06-21.12",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42443,7 +42443,8 @@ External connectors are being rolled out provider by provider, conservatively (r
       "integration.list",
       "integration.readiness",
       "integration.status",
-      "integration.test"
+      "integration.test",
+      "tenant.rename"
     ],
     legal: {
       publicRisk: "low",
@@ -42820,7 +42821,7 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} runner list|status|work-orders|revoke\` | \`runner.list\`, \`runner.status\`, \`work_order.list\`, \`runner.revoke\` | Inspect runners and work orders; revoke a runner. | Tenant | \`{{cli}} runner list --json\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` | \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | List connector metadata, read the setup-readiness checklist, read one connector's health, and run the provider-specific connection test without exposing credentials. | Tenant | \`{{cli}} integration readiness --provider google --json\` |
-| \`{{cli}} settings get|update|product-learning\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\` | Read tenant settings, update budget caps, and read or update product-learning participation. Product-learning updates stop at human confirmation in non-interactive CLI/MCP sessions. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings product-learning update --mode disabled --json\` |
+| \`{{cli}} settings get|update|product-learning|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, and rename the company. Budget and product-learning updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings product-learning update --mode disabled --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
@@ -42982,6 +42983,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_remove_member\` | \`member.remove\` | Remove a tenant member. | Tenant | Call with \`member_id\`; blocked if it would orphan an agent steward chain. |
 | \`rost_get_tenant_settings\` | \`settings.get\` | Read tenant operating settings and integration status. | Tenant | Call with \`{}\`; metadata only. |
 | \`rost_update_tenant_settings\` | \`settings.update\` | Update tenant AI budget caps. | Tenant | Call with \`soft_cap_usd\` or \`hard_cap_usd\`; expect human confirmation. |
+| \`rost_rename_company\` | \`tenant.rename\` | Rename the current company. | Tenant-admin | Call with \`company_name\`; expect human confirmation. |
 | \`rost_get_sync_brief_scope\` | \`settings.sync_brief_scope.get\` | Read the tenant's Sync Brief scope (company_wide or per_cluster). | Tenant | Call with \`{}\`. |
 | \`rost_update_sync_brief_scope\` | \`settings.sync_brief_scope.update\` | Set the tenant's Sync Brief scope (company_wide or per_cluster). | Tenant-admin | Owner-only; call with \`{"sync_brief_scope":"company_wide"}\` or \`{"sync_brief_scope":"per_cluster"}\`. |
 | \`rost_get_product_learning_policy\` | \`settings.product_learning.get\` | Read whether product/page/recommendation analytics are allowed. | Tenant | Call with \`{}\`; audit/security logs are always enabled. |
@@ -43776,7 +43778,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-06-20.1",
+    version: "2026-06-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -43801,7 +43803,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
 ## Confirmation levels
 
 - \`none\`: no confirmation gate \u2014 the command never returns a pending confirmation. Most are reads or reversible drafts an agent can run directly, including over MCP (graph reads, \`charter.draft\`, \`status.record\`, \`sync.brief.compile\`, \`sync.run.start\`, \`task.complete\`). A few \`none\` commands still require a human actor or an interactive channel \u2014 \`confirmation.approve\` is \`none\` (approving a gate cannot itself be gated) yet runs only as a human in the UI or CLI \u2014 so \`none\` means "no confirmation gate", not always "agent-callable".
-- \`human_required\`: a human must approve. Structural, staffing, resolution, and go-live commands (\`seat.reparent\`, \`charter.approve\`, \`goal.reparent\`, \`friction.resolve\`, \`agent.go_live\`, \`mcp_token.create\`).
+- \`human_required\`: a human must approve. Structural, staffing, resolution, tenant profile, and go-live commands (\`seat.reparent\`, \`charter.approve\`, \`goal.reparent\`, \`friction.resolve\`, \`agent.go_live\`, \`mcp_token.create\`, \`tenant.rename\`).
 - \`credential_flow\`: routes through the vault-backed credential path so a secret is captured as a vault reference, never stored or logged in the clear (\`credential.ingress\`, \`tenant.anthropic_key.save\`; \`agent.configure_tools\` is \`credential_flow\` too \u2014 it stages credential-ingress requests through the same path without ever taking raw secret material).
 - \`dangerous\`: the highest-risk human gate. Only two commands carry it \u2014 \`settings.update\` and \`agent.decommission\`.
 
@@ -43831,11 +43833,11 @@ Stop before: approving a Charter, signing a manifest, connecting a tool or crede
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-06-21.2",
+    version: "2026-06-21.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
-    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update"],
+    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native settings guidance."] },
     sources: [
       {
@@ -43854,7 +43856,7 @@ Start with members and invites, then provider and channel connections, then MCP
 
 ## What belongs in Settings
 
-- Company profile and workspace defaults.
+- Company profile and workspace defaults. Rename the company from Settings or with \`tenant.rename\` (CLI: \`{{cli}} settings rename --company "<name>"\`); the command is owner-only, human-gated, and records a rename event with old and new names.
 - Members, invites, and tenant roles.
 - Agent access tokens for local agents.
 - Provider and integration configuration.
@@ -43888,6 +43890,8 @@ Product-learning participation controls whether {{brand}} may record product/pag
 
 Read the policy with \`settings.product_learning.get\` (CLI: \`{{cli}} settings product-learning get\`). Change it with \`settings.product_learning.update\` (CLI: \`{{cli}} settings product-learning update --mode disabled\`). Analytics ingestion code should call the shared product-learning policy helper instead of reading \`tenants.settings\` directly.
 
+The product analytics foundation stores only bounded product telemetry: product events, page views by route template, command invocation metadata, onboarding milestones, and recommendation outcomes. Authenticated users can read analytics rows for their tenant, but writes are server-owned through the trusted DB helpers. The helpers and database constraints reject or redact obvious raw URLs, filesystem paths, secrets, prompt/content fields, command argument/output fields, direct contact/payment identifiers, and long prose-shaped values. These analytics rows are not audit records; operational logs and security evidence stay in their dedicated append-only or product-visible tables.
+
 ## Inference budget
 
 Agents that run on {{brand}}-managed inference draw against a tenant inference budget with a hard cap. A new company starts with a hard cap of $0, so a managed-inference run is blocked until the cap is raised. When a run hits the cap it stops with a typed budget error that names the fix; raise the cap before agents can run again.
@@ -46543,14 +46547,26 @@ var settingsWrapper = (context, args) => dispatch(context, "settings", args, {
       const spend = asRecord(asRecord(output).spend);
       return `Updated budget caps (soft=$${field(spend, "soft_cap_usd")}, hard=$${field(spend, "hard_cap_usd")}).`;
     });
+  },
+  rename: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const companyName = optionalValue(parsed, "company");
+    if (!companyName) {
+      throw new UsageError("Provide --company <name>.");
+    }
+    return execute(ctx, parsed, "tenant.rename", { company_name: companyName }, (output) => {
+      const record2 = asRecord(output);
+      return `Renamed company from ${field(record2, "previous_name")} to ${field(record2, "name")}.`;
+    });
   }
 }, settingsUsage(context.binName));
 function settingsUsage(bin) {
-  return `Usage: ${bin} settings get|update|product-learning [--json]
+  return `Usage: ${bin} settings get|update|product-learning|rename [--json]
   ${bin} settings get
   ${bin} settings update [--soft-cap-usd <n>] [--hard-cap-usd <n>]
   ${bin} settings product-learning get
-  ${bin} settings product-learning update --mode enabled|disabled|enterprise_contract`;
+  ${bin} settings product-learning update --mode enabled|disabled|enterprise_contract
+  ${bin} settings rename --company <name>`;
 }
 var memberWrapper = (context, args) => dispatch(context, "member", args, {
   invite: (ctx, rest) => {
@@ -47200,7 +47216,7 @@ function operationUsageLines(bin) {
     `${bin} sync brief|compile|complete`,
     `${bin} runner list|status|work-orders|revoke`,
     `${bin} notification settings|test|errors`,
-    `${bin} settings get|update|product-learning`,
+    `${bin} settings get|update|product-learning|rename`,
     `${bin} member invite|update|remove`,
     `${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show`,
     `${bin} tools list`,