@rosthq/cli 0.7.0 → 0.7.1

package/dist/index.js

@@ -41877,7 +41877,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-02.3",
+    version: "2026-07-02.5",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -41925,6 +41925,10 @@ The current chat harness shows the effective lane and model. The initial lane is
 
 Model behavior is now explicit in the AICOS session contract. A thread can run in **Auto** or use a pinned compatible model from the guided catalog. Auto chooses a fast tier for short low-risk turns, the balanced default for normal operating help, and a higher-reasoning tier for onboarding synthesis or large context. The panel shows the effective model, disables lower-context choices once the active thread outgrows them, and tells the user to start a new session for those models. Session context is estimated and compacted into a durable summary when it crosses the configured threshold; raw messages remain in history, but future model calls can use the summary rather than resending the whole thread. Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK/manual continuation. Because the DER-1068 implementation still uses the deterministic harness, it does not create fake llm_calls rows or settle fake allowance usage; reservation/settlement belongs to the real provider call path.
 
+During onboarding, the deterministic harness may execute only explicit low-risk draft actions. In the Responsibility Graph step, a user with setup/action authority can ask AICOS to create one named draft seat per turn; the seat stays vacant, is traceable to the AICOS message through artifact sources, and still needs human review before staffing, Charters, manifests, or go-live. Compass and Charter help remains draft guidance and clarifying questions until the live drafting planner lands. AICOS never silently finishes onboarding, approves Compass or Charter content, signs manifests, goes live, stores credentials, changes autonomy policy, or invites external people; those actions remain human-confirmed.
+
+AICOS posture is resolved on the server from the current user's AICOS access scope plus the tenant's Company guardrails. **Report-only** can read, explain, and draft guidance, but it cannot mutate setup or operating state. **Balanced** can perform narrow low-risk internal draft/setup actions and stops at human gates. **High autonomy** can perform allowed internal low-risk actions without changing the hard prohibitions: AICOS still cannot approve its own Charter or manifest, handle credentials, send externally, spend money, perform destructive/admin changes, go live, expand policy/access, or receive hidden sensitive data.
+
 AICOS grounds answers from two source classes before producing user-visible setup or operating guidance:
 
 - **Reference documents** \u2014 public {{brand}} guides such as this chat guide, onboarding guidance, the Responsibility Graph playbook, tool-access guidance, and confirmation guidance. AICOS retrieves the narrowest relevant guide before setup, Charter, Signal, Friction, Cascade, Sync, tool-access, or onboarding advice.
@@ -44600,7 +44604,7 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-07-02.1",
+    version: "2026-07-02.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -44632,7 +44636,7 @@ Use Local Runner when a Seat should run on a machine you control. Install it fro
 
 Recommended paths:
 
-- **Always-on host:** \`{{cli}} runner install-service --name <runner-name> --execute\` installs a background service (macOS launchd user agent) that keeps the runner online across reboots. Manage it with \`{{cli}} runner start|stop|restart|status|logs|uninstall --name <runner-name>\`.
+- **Always-on host:** \`{{cli}} runner install-service --name <runner-name> --execute\` installs a background service (macOS launchd user agent, \`user/<uid>\` domain) that keeps the runner online. Manage it with \`{{cli}} runner start|stop|restart|status|logs|uninstall --name <runner-name>\`. On macOS this loads reliably when the runner user is logged in at the console; on a purely headless SSH box where that user is not at the console, run \`{{cli}} runner serve\` under a process supervisor instead.
 - **Manual smoke:** \`{{cli}} runner serve --once\` heartbeats once and exits; \`{{cli}} runner serve --execute\` claims and executes runner work orders while it runs.
 
 Two ways to authenticate and pair \u2014 both first-class, an agent can drive either entirely from the terminal:
@@ -49122,10 +49126,16 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
 `);
     return existing;
   }
-  if (!client) {
-    throw new Error(`No paired runner state at ${config2.stateFile}. Run with a CLI login once to pair this runner before starting without a CLI session.`);
+  let userCode;
+  if (config2.userCode !== void 0) {
+    userCode = config2.userCode;
+  } else if (client) {
+    userCode = await startPairing(client, config2);
+  } else {
+    throw new Error(
+      `No paired runner state at ${config2.stateFile}. Provide --user-code <code> from Settings > Runners (Add a runner), or run \`${cliBrand.binName} login --device\` once to pair this runner.`
+    );
   }
-  const userCode = config2.userCode ?? await startPairing(client, config2);
   const claim = await post2(fetchImpl, appUrl2, "/api/runner/pairing/claim", { user_code: userCode });
   const runnerSecret = claim.json.runner_secret;
   const runnerId = claim.json.runner_id;
@@ -49679,10 +49689,10 @@ function serviceLabel(safeName) {
   return `com.${cliBrand.binName}.runner.${safeName}`;
 }
 function domainTarget(uid) {
-  return `gui/${uid}`;
+  return `user/${uid}`;
 }
 function serviceTarget(uid, label) {
-  return `gui/${uid}/${label}`;
+  return `user/${uid}/${label}`;
 }
 async function bootoutQuietly(exec, uid, plistPath) {
   try {