@rosthq/cli 0.5.24 → 0.5.25

package/dist/index.js

@@ -42384,7 +42384,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-06-21.14",
+    version: "2026-06-21.15",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42421,6 +42421,7 @@ External connectors are being rolled out provider by provider, conservatively (r
       "agent.status",
       "agent.list_fleet",
       "agent.fleet_digest",
+      "system.health",
       "agent.get_run",
       "agent.list_runs",
       "agent.list_tool_calls",
@@ -42451,7 +42452,9 @@ External connectors are being rolled out provider by provider, conservatively (r
       "deliverable.attach",
       "error_log.list",
       "error_log.resolve",
-      "error_log.supersede"
+      "error_log.supersede",
+      "runner.diagnose",
+      "runner.repair"
     ],
     legal: {
       publicRisk: "low",
@@ -42826,9 +42829,10 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} escalation list|get|resolve|reject\` | \`escalation.list\`, \`escalation.get\`, \`escalation.resolve\`, \`escalation.reject\` | Work the steward escalation queue. | Steward | \`{{cli}} escalation list --json\` |
 | \`{{cli}} error list|resolve|supersede\` | \`error_log.list\`, \`error_log.resolve\`, \`error_log.supersede\` | List active, acknowledged, resolved, or superseded product error logs and let a human acknowledge, resolve, or supersede stale errors with evidence links. | Tenant | \`{{cli}} error list --resolved active --json\`; \`{{cli}} error resolve --error-log-id <id> --reason "Fixed in PR #123"\` |
 | \`{{cli}} sync brief|compile|complete\` | \`sync.brief.get\`, \`sync.brief.compile\`, \`sync.run.complete\` | Compile, read, and complete a weekly Sync. | Tenant | \`{{cli}} sync brief --json\` |
-| \`{{cli}} runner list|status|work-orders|revoke\` | \`runner.list\`, \`runner.status\`, \`work_order.list\`, \`runner.revoke\` | Inspect runners and work orders; revoke a runner. | Tenant | \`{{cli}} runner list --json\` |
+| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\` | Inspect runners and work orders, diagnose offline runners, get repair guidance, and revoke a runner. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` | \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | List connector metadata, read the setup-readiness checklist, read one connector's health, and run the provider-specific connection test without exposing credentials. | Tenant | \`{{cli}} integration readiness --provider google --json\` |
+| \`{{cli}} system health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | \`{{cli}} system health --json\`; \`{{cli}} system health --seat <id> --json\` |
 | \`{{cli}} settings get|update|product-learning|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, and rename the company. Budget and product-learning updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings product-learning update --mode disabled --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
@@ -42955,6 +42959,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_get_agent_status\` | \`agent.status\` | Read agent lane, live state, steward chain, dry-run result, Runner availability. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_list_agent_fleet\` | \`agent.list_fleet\` | Read every staffed agent seat at once: lane, live state, last real turn, 24h/7d real turns, measurable status, escalations, and 7-day spend. | Tenant | Call with \`{}\`; counts use the same seat-run association as \`agent.list_runs\`, with sandbox dry runs excluded from real turns. |
 | \`rost_get_dogfood_fleet_health_digest\` | \`agent.fleet_digest\` | Capture the daily dogfood fleet-health digest: live/idle state, 24h/7d turns, spend, recent failed runs, unresolved errors, failed notifications, and next actions. | Tenant | Call with \`{}\`; optional \`window_hours\` bounds recent failed-run evidence, while \`error_limit\` caps linked evidence per seat. |
+| \`rost_system_health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | Call with \`{}\`; optional \`seat_id\` narrows inside the caller's server-derived scope. |
 | \`rost_run_agent_now\` | \`agent.run_now\` | Queue an immediate run for a live staffed agent without changing its saved schedule; cloud lane dispatches to the executor and runner lane queues for the paired runner. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_list_agent_runs\` | \`agent.list_runs\` | Read a seat's agent run history (status, lane, model, cost, per-run Skill activation, tool-call, and guard-held counts) plus the seat's run/tool-call rollup including held-action count. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`limit\` for a deeper window. |
 | \`rost_get_agent_run_diagnostics\` | \`agent.get_run\` | Read one run's diagnostic record: transcript reference, token/cost usage, outcome, linked product-visible run errors, and loaded Skill activation file metadata. File hashes/sizes identify the immutable source package, while model prompt text may be bounded or truncated. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>","run_id":"<run-id>"}\`. |
@@ -42978,6 +42983,8 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_mcp_tokens\` | \`mcp_token.list\` | List MCP token metadata (never token material). | Tenant | Call with \`{}\` or \`{"include_revoked":true}\`. |
 | \`rost_list_runners\` | \`runner.list\` | List local runners and their online/offline/revoked state. | Tenant | Call with \`{}\`. |
 | \`rost_runner_status\` | \`runner.status\` | Read a single runner's capability and state. | Tenant | Call with \`runner_id\`. |
+| \`rost_diagnose_runner\` | \`runner.diagnose\` | Return runner health, capabilities, and repair guidance without secrets. | Tenant | Call with \`runner_id\`; actionable repair guidance exposes restart, re-pair, or missing CLI steps. |
+| \`rost_runner_repair_guidance\` | \`runner.repair\` | Return focused repair steps for a runner: restart, re-pair, revoke stale, or install missing CLI runtime. | Tenant | Call with \`runner_id\` and optional \`issue\` (restart, re_pair, revoke_stale, missing_cli_runtime). |
 | \`rost_start_runner_pairing\` | \`runner.pairing.start\` | Open a runner pairing session and return the human pairing code. | Tenant-admin | Call with \`name\` and \`platform\`; owner/admin only. |
 | \`rost_revoke_runner\` | \`runner.revoke\` | Revoke a runner so it can no longer authenticate. | Tenant | Call with \`runner_id\`; expect human confirmation. |
 | \`rost_list_work_orders\` | \`work_order.list\` | List runner/cloud work orders for the tenant. | Tenant | Call with optional \`status\`, \`agent_id\`, or \`runner_id\`. |
@@ -43997,11 +44004,11 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-06-20.1",
+    version: "2026-06-21.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
-    relatedCommandIds: ["mcp_token.create", "mcp_token.revoke", "runner.list", "runner.status", "runner.pairing.start", "runner.revoke", "work_order.list", "work_order.enqueue", "work_order.cancel", "confirmation.approve"],
+    relatedCommandIds: ["mcp_token.create", "mcp_token.revoke", "runner.list", "runner.status", "runner.diagnose", "runner.repair", "runner.pairing.start", "runner.revoke", "work_order.list", "work_order.enqueue", "work_order.cancel", "confirmation.approve"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native local-runner guidance."] },
     sources: [
       {
@@ -44027,6 +44034,8 @@ The local runner is for human-controlled local agent work. It should retrieve {{
 
 - Pair a new runner: \`runner.pairing.start\` / \`rost_start_runner_pairing\` with \`name\` and \`platform\` returns a human pairing code. This is owner/admin-only because it mints a short-lived runner pairing session that leads to machine credentials.
 - Inspect: \`{{cli}} runner list --json\` / \`runner.list\` / \`rost_list_runners\` shows online/offline/revoked state; \`{{cli}} runner status\` / \`runner.status\` / \`rost_runner_status\` reads one runner.
+- Diagnose (DER-949): \`{{cli}} runner diagnose --runner-id <id>\` / \`runner.diagnose\` / \`rost_diagnose_runner\` returns health, capabilities, and repair guidance without exposing secrets. Use when a runner is offline or stale to get actionable next steps.
+- Repair steps (DER-949): \`{{cli}} runner repair --runner-id <id> [--issue restart|re_pair|revoke_stale|missing_cli_runtime]\` / \`runner.repair\` / \`rost_repair_runner\` returns focused repair instructions. The optional \`issue\` flag narrows to a specific kind of repair (restart the app, re-pair, revoke a stale runner, or install a missing CLI runtime).
 - Work orders: \`{{cli}} runner work-orders\` / \`work_order.list\` / \`rost_list_work_orders\`; queue with \`work_order.enqueue\` / \`rost_enqueue_work_order\` for a live scheduled agent, or use \`agent.run_now\` / \`rost_run_agent_now\` when an operator wants the product to queue and dispatch an immediate live run from a seat id; cancel with \`work_order.cancel\` / \`rost_cancel_work_order\`.
 - Revoke: \`{{cli}} runner revoke\` / \`runner.revoke\` / \`rost_revoke_runner\` so a runner can no longer authenticate.
 
@@ -46372,6 +46381,53 @@ var runnerWrapper = (context, args) => dispatch(context, "runner", args, {
       return `${field(record2, "id")}  ${field(record2, "health")}  ${field(record2, "name")} (last heartbeat ${field(record2, "last_heartbeat_at")}).`;
     });
   },
+  diagnose: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const runnerId = requireValue2(parsed, "runner-id");
+    return execute(ctx, parsed, "runner.diagnose", { runner_id: runnerId }, (output) => {
+      const record2 = asRecord(output);
+      const guidance = asArray(record2.repair_guidance);
+      const lines = [
+        `Runner ${field(record2, "name")} (${field(record2, "id")})`,
+        `health: ${field(record2, "health")}  platform: ${field(record2, "platform")}`,
+        `paired_at: ${field(record2, "paired_at")}  last_heartbeat: ${field(record2, "last_heartbeat_at")}`,
+        `capabilities: claude=${String(asRecord(record2.capabilities).claude)} codex=${String(asRecord(record2.capabilities).codex)}`,
+        `revocation_state: ${field(record2, "revocation_state")}`
+      ];
+      if (guidance.length > 0) {
+        lines.push("repair_guidance:");
+        guidance.forEach((step) => {
+          const s = asRecord(step);
+          lines.push(`  ${field(s, "action")}: ${field(s, "detail")}`);
+        });
+      }
+      return lines.join("\n");
+    });
+  },
+  repair: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const runnerId = requireValue2(parsed, "runner-id");
+    const issue2 = optionalValue(parsed, "issue");
+    const body = issue2 ? { runner_id: runnerId, issue: issue2 } : { runner_id: runnerId };
+    return execute(ctx, parsed, "runner.repair", body, (output) => {
+      const record2 = asRecord(output);
+      const steps = asArray(record2.repair_steps);
+      const lines = [
+        `Runner ${field(record2, "runner_name")} (${field(record2, "runner_id")}) health: ${field(record2, "runner_health")}`,
+        `requires_human: ${field(record2, "requires_human")}`
+      ];
+      if (steps.length > 0) {
+        lines.push("repair_steps:");
+        steps.forEach((step) => {
+          const s = asRecord(step);
+          lines.push(`  ${field(s, "action")}`);
+          lines.push(`    command: ${field(s, "command")}`);
+          lines.push(`    detail: ${field(s, "detail")}`);
+        });
+      }
+      return lines.join("\n");
+    });
+  },
   "work-orders": (ctx, rest) => {
     const parsed = parseFlags(rest);
     const body = withOptional({}, {
@@ -46401,9 +46457,11 @@ var runnerWrapper = (context, args) => dispatch(context, "runner", args, {
   }
 }, runnerUsage(context.binName));
 function runnerUsage(bin) {
-  return `Usage: ${bin} runner list|status|work-orders|revoke [--json]
+  return `Usage: ${bin} runner list|status|diagnose|repair|work-orders|revoke [--json]
   ${bin} runner list [--include-revoked]
   ${bin} runner status --runner-id <id>
+  ${bin} runner diagnose --runner-id <id>
+  ${bin} runner repair --runner-id <id> [--issue restart|re_pair|revoke_stale|missing_cli_runtime]
   ${bin} runner work-orders [--status <s>] [--agent-id <id>] [--runner-id <id>] [--limit <n>]
   ${bin} runner revoke --runner-id <id>`;
 }
@@ -47295,6 +47353,51 @@ function deliverableUsage(bin) {
   ${bin} deliverable create --title <text> [--kind brief|work_evidence|artifact|report|other] [--summary <text>] [--content <text>]
   ${bin} deliverable attach --title <text> [--run-id <id>] [--task-id <id>] [--work-order-id <id>] [--kind brief|work_evidence|artifact|report|other] [--summary <text>] [--content <text>]`;
 }
+function formatSystemHealth(output) {
+  const record2 = asRecord(output);
+  const scope = asRecord(record2.scope);
+  const sections = asRecord(record2.sections);
+  const actions = asArray(record2.top_actions);
+  const findings = asArray(record2.findings);
+  const lines = [
+    `verdict: ${field(record2, "verdict")}  scope: ${field(scope, "mode")}  seats: ${field(scope, "total_seat_count")}  findings: ${findings.length}`
+  ];
+  if (actions.length > 0) {
+    lines.push("top_actions:");
+    for (const action of actions) {
+      const item = asRecord(action);
+      lines.push(`  ${field(item, "label")}  command=${field(item, "command_id")}  cli=${field(item, "cli")}`);
+    }
+  }
+  const fleet = asRecord(sections.fleet);
+  const runs = asRecord(sections.runs);
+  const signals = asRecord(sections.signals);
+  const cascade = asRecord(sections.cascade_setup);
+  const workLoop = asRecord(sections.work_loop);
+  const connectivity = asRecord(sections.connectivity);
+  const sync = asRecord(sections.sync);
+  lines.push(
+    `fleet: agents=${field(fleet, "agent_count")} live=${field(fleet, "live_count")} stale=${field(fleet, "stale_count")} setup_gaps=${field(fleet, "setup_gap_count")}`,
+    `runs: failed_24h=${field(runs, "failed_24h")} failed_7d=${field(runs, "failed_7d")} unresolved_errors=${field(runs, "unresolved_error_count")}`,
+    `signals: off_track=${field(signals, "off_track_count")} pending=${field(signals, "pending_count")}`,
+    `cascade: recommendations=${field(cascade, "recommendation_count")} warnings=${field(cascade, "warning_count")}`,
+    `work_loop: open_issues=${field(workLoop, "open_issue_count")} friction_without_task=${field(workLoop, "friction_without_task_count")} open_or_stalled_tasks=${field(workLoop, "open_or_stalled_task_count")}`,
+    `connectivity: runners=${field(connectivity, "runner_count")} offline_runners=${field(connectivity, "offline_runner_count")} integrations=${field(connectivity, "integration_count")} disconnected_integrations=${field(connectivity, "disconnected_integration_count")} failed_notifications=${field(connectivity, "failed_notification_count")}`,
+    `sync: latest_brief=${field(sync, "latest_brief_at")} missing_latest_brief=${field(sync, "missing_latest_brief")} flagged_gaps=${field(sync, "flagged_gap_count")}`
+  );
+  return lines.join("\n");
+}
+var systemWrapper = (context, args) => dispatch(context, "system", args, {
+  health: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const body = withOptional({}, { seat_id: parsed.seat });
+    return execute(ctx, parsed, "system.health", body, formatSystemHealth);
+  }
+}, systemUsage(context.binName));
+function systemUsage(bin) {
+  return `Usage: ${bin} system health [--seat <id>] [--json]
+  ${bin} system health [--seat <id>]`;
+}
 var OPERATION_GROUPS = [
   "task",
   "status",
@@ -47315,7 +47418,8 @@ var OPERATION_GROUPS = [
   "model",
   "compass",
   "charter",
-  "deliverable"
+  "deliverable",
+  "system"
 ];
 var wrappers = {
   task: taskWrapper,
@@ -47337,7 +47441,8 @@ var wrappers = {
   model: modelWrapper,
   compass: compassWrapper,
   charter: charterWrapper,
-  deliverable: deliverableWrapper
+  deliverable: deliverableWrapper,
+  system: systemWrapper
 };
 function isOperationGroup(value) {
   return value !== void 0 && OPERATION_GROUPS.includes(value);
@@ -47362,7 +47467,8 @@ var groupUsageBuilders = {
   model: modelUsage,
   compass: compassUsage,
   charter: charterUsage,
-  deliverable: deliverableUsage
+  deliverable: deliverableUsage,
+  system: systemUsage
 };
 function operationGroupUsage(group, bin) {
   return usageWithSchemaFooter(groupUsageBuilders[group](bin), bin);
@@ -47385,7 +47491,7 @@ function operationUsageLines(bin) {
     `${bin} escalation list|get|resolve|reject`,
     `${bin} error list|resolve|supersede`,
     `${bin} sync brief|compile|complete`,
-    `${bin} runner list|status|work-orders|revoke`,
+    `${bin} runner list|status|diagnose|repair|work-orders|revoke`,
     `${bin} notification settings|test|errors`,
     `${bin} settings get|update|product-learning|rename`,
     `${bin} member invite|update|remove`,