@rosthq/cli 0.7.105 → 0.7.106

package/dist/index.js

@@ -46738,22 +46738,32 @@ var provisioningEventPayloadSchema = authoritativePrefixUnion(
   // permissive branches unchanged, preserving parse-compat with stored rows.
   [{ prefix: "invite.", strict: inviteLifecycleEventPayloadSchema }]
 );
+function rejectNonProvisioningInviteAction(payload, ctx) {
+  const action = payload.action;
+  if (typeof action === "string" && action.startsWith("invite.")) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["action"],
+      message: `invite.* event payloads are only valid under a "provisioning" envelope, not this internal event type (DER-2049).`
+    });
+  }
+}
 var decisionEventPayloadSchema = external_exports.union([
   actionEventPayloadSchema,
   internalEventObjectSchema
-]);
+]).superRefine(rejectNonProvisioningInviteAction);
 var systemEventPayloadSchema = external_exports.union([
   actionEventPayloadSchema,
   internalEventObjectSchema
-]);
+]).superRefine(rejectNonProvisioningInviteAction);
 var charterEventPayloadSchema = external_exports.union([
   actionEventPayloadSchema,
   internalEventObjectSchema
-]);
+]).superRefine(rejectNonProvisioningInviteAction);
 var taskEventPayloadSchema = external_exports.union([
   actionEventPayloadSchema,
   internalEventObjectSchema
-]);
+]).superRefine(rejectNonProvisioningInviteAction);
 
 // ../../packages/protocol/src/held-tool-action.ts
 var heldToolActionReplaySchema = external_exports.object({
@@ -47440,17 +47450,44 @@ var intakeEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
   type: external_exports.literal("intake"),
   payload: intakeEventPayloadSchema
 }).strict();
-var internalEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
-  type: external_exports.enum(["decision", "provisioning", "system", "charter", "task"]),
-  payload: internalEventWriterPayloadSchema
+var decisionEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
+  type: external_exports.literal("decision"),
+  payload: decisionEventPayloadSchema
+}).strict();
+var provisioningEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
+  type: external_exports.literal("provisioning"),
+  payload: provisioningEventPayloadSchema
+}).strict();
+var systemEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
+  type: external_exports.literal("system"),
+  payload: systemEventPayloadSchema
 }).strict();
+var charterEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
+  type: external_exports.literal("charter"),
+  payload: charterEventPayloadSchema
+}).strict();
+var taskEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
+  type: external_exports.literal("task"),
+  payload: taskEventPayloadSchema
+}).strict();
+var internalEventEnvelopeSchema = external_exports.discriminatedUnion("type", [
+  decisionEventEnvelopeSchema,
+  provisioningEventEnvelopeSchema,
+  systemEventEnvelopeSchema,
+  charterEventEnvelopeSchema,
+  taskEventEnvelopeSchema
+]);
 var eventEnvelopeSchema = external_exports.discriminatedUnion("type", [
   statusEventEnvelopeSchema,
   handoffEventEnvelopeSchema,
   escalationEventEnvelopeSchema,
   issueEventEnvelopeSchema,
   intakeEventEnvelopeSchema,
-  internalEventEnvelopeSchema
+  decisionEventEnvelopeSchema,
+  provisioningEventEnvelopeSchema,
+  systemEventEnvelopeSchema,
+  charterEventEnvelopeSchema,
+  taskEventEnvelopeSchema
 ]);
 var eventEnvelopeReaderBaseSchema = eventEnvelopeBaseSchema.passthrough();
 var statusEventEnvelopeReaderSchema = eventEnvelopeReaderBaseSchema.extend({
@@ -48526,11 +48563,11 @@ Use the lower-level commands after health names a finding: \`agent.get_run\` for
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-07-14.1",
+    version: "2026-07-19.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
-    relatedCommandIds: ["charter.sign_manifest", "credential.ingress", "agent.configure_tools", "integration.connect_rest", "integration.list", "integration.readiness", "integration.status", "integration.test", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "confirmation.approve"],
+    relatedCommandIds: ["charter.sign_manifest", "charter.set", "charter.update_draft", "credential.ingress", "agent.configure_tools", "integration.connect_rest", "integration.list", "integration.readiness", "integration.status", "integration.test", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "confirmation.approve"],
     legal: {
       publicRisk: "low",
       notes: [
@@ -48602,6 +48639,12 @@ There is exactly one way to give a connected tool its credential, and it is the
 - Must-escalate cases are stated.
 - The tool provider and credential name are enough for audit; secret values are not displayed.
 
+## Change tool access after go-live
+
+Tool access on a live seat is part of its signed Charter, so changing it is a governed amendment, not an in-place edit. You can make the change from the agent detail page without leaving it: the Tools tab's manage-tools drawer edits the permission manifest directly \u2014 grant or revoke a tool, adjust its scope tier, or add an available tool from the catalog. Your edits are staged as one confirmation that lands in Approvals with a plain summary of what changes ("grants work.record (draft) \xB7 revokes email.draft"). Approving that confirmation is the re-sign: it creates a new Charter version that supersedes the prior one, and the tool guard honors the new manifest on the next run. Nothing changes until a human approves \u2014 selecting a tool never grants access on its own.
+
+The charter builder's amendment mode edits the same manifest for a draft Charter (toggle a tool's grant or scope tier), staged into the draft; the draft stays inert until the existing sign or go-live step. If a seat already has an amendment draft open, finish it in the charter editor rather than staging a separate tool change from the drawer.
+
 ## Connect tools and credentials from CLI or MCP
 
 - Stage tools on a draft agent: \`agent.configure_tools\` / \`rost_configure_agent_tools\` \u2014 connect or decline proposed tools and stage credential-ingress requests. Pass vault references, never raw secret material.
@@ -48674,7 +48717,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-18.4",
+    version: "2026-07-19.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49219,6 +49262,14 @@ These read-only tools are available to any valid MCP token (like the reference t
 
 The equivalent CLI verbs are \`{{cli}} command schema <id>\` and \`{{cli}} command list\`. The discoverable tool catalog is \`{{cli}} tools list\` (MCP \`rost_list_tool_catalog\`, tenant-scoped).
 
+### Deferred tool schemas (JIT loading)
+
+For tokens whose catalog of generated command tools is large, each operating command tool is still advertised in the tool listing by name with a one-line description, but its full input contract is deferred rather than sent up front \u2014 this keeps the default tool listing small for large catalogs. The description names the command's \`command_id\`. To call a deferred tool, first call \`rost_describe_command\` with that \`command_id\` to load its exact input and output contract, then call the tool with the real arguments; the tool is fully callable either way, only the delivery of that contract is deferred.
+
+Deferral is threshold-gated: small catalogs keep their full per-command contracts with no change in behavior. The pinned core seat tools (\`rost_get_context\`, \`rost_escalate\`, \`rost_report_status\`, and the task tools \`rost_get_tasks\`, \`rost_accept_task\`, \`rost_decline_task\`, \`rost_complete_task\`) and the reference and discovery tools are never deferred.
+
+Deferring a contract changes only what is advertised in \`tools/list\`. Authorization is unaffected: every call still passes the server-side guard against the seat's signed permission manifest and writes its audit row, exactly as described above \u2014 visibility into a tool's arguments is never a security control.
+
 ### Public reference tools and resources
 
 | Tool or resource | Purpose | Scope | Safe example |
@@ -50202,7 +50253,7 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
     order: 62,
     title: "Friction guide",
     summary: "How to capture issues with evidence, rank them, and resolve them without losing ownership.",
-    version: "2026-07-18.1",
+    version: "2026-07-19.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -50275,7 +50326,7 @@ In the app, the Tasks surface exposes the same queue operations for a seat's vis
 
 ## When to stop for confirmation
 
-\`friction.resolve\` is \`human_required\`; resolving an issue is a human decision. \`friction.link_task\`, \`task.create\`, \`task.accept\`, \`task.decline\`, \`task.confirm_proposal\`, \`task.decline_proposal\`, and \`task.complete\` are \`none\`, so they do not mint pending confirmations. The proposal decision commands still require a human actor with target-side authority and are app/CLI-only, not MCP-exposed; they are not agent-callable approval shortcuts. \`friction.update_status\`, \`escalation.raise\`, \`friction.file_issue\`, and \`friction.list\` are also not gated. An agent files Friction, proposes the task, and escalates; a human resolves or decides the proposed commitment.
+\`friction.resolve\` is \`human_required\`; resolving an issue is a human decision. Resolve authority is role-scoped: an owner or admin may resolve any issue tenant-wide, while any other member may resolve only issues raised by a seat they occupy or a downstream seat in the Responsibility Graph (their seat subtree). \`friction.link_task\`, \`task.create\`, \`task.accept\`, \`task.decline\`, \`task.confirm_proposal\`, \`task.decline_proposal\`, and \`task.complete\` are \`none\`, so they do not mint pending confirmations. The proposal decision commands still require a human actor with target-side authority and are app/CLI-only, not MCP-exposed; they are not agent-callable approval shortcuts. \`friction.update_status\`, \`escalation.raise\`, \`friction.file_issue\`, and \`friction.list\` are also not gated. An agent files Friction, proposes the task, and escalates; a human resolves or decides the proposed commitment.
 
 ## Resolution rule
 
@@ -52818,7 +52869,7 @@ var COMMAND_MANIFEST = [
   { "id": "friction.import", "namespace": "friction", "action": "import", "title": "Import Friction issues from a ninety Issues List", "description": "Bulk-import a ninety Issues List export into Friction. Owners are seat names resolved to seats; each issue is raised by the resolved seat and attributed to the importing human. Idempotent \u2014 re-importing the same export is a no-op, and an existing open issue with the same seat + summary is skipped.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "dry_run", "flag": "dry-run", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Import a ninety Issues List export into Friction; owners resolve to seats, idempotent by file + seat/summary." },
   { "id": "friction.link_task", "namespace": "friction", "action": "link_task", "title": "Link task to Friction issue", "description": "Attach an existing tenant task as the action task for a non-terminal issue. Both ids must belong to the tenant.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "task_id", "flag": "task-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Attach an existing task as the action task for a non-terminal issue." },
   { "id": "friction.list", "namespace": "friction", "action": "list", "title": "List Friction issues", "description": "List Friction issues ranked by status, impact, and severity. Defaults to active (open + diagnosing).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "status", "flag": "status", "type": "enum", "required": false, "enumValues": ["open", "diagnosing", "resolved", "dropped", "active", "all"] }], "hasComplexInput": false, "help": "List Friction issues ranked by impact and severity to find the issue id before updating or resolving it." },
-  { "id": "friction.resolve", "namespace": "friction", "action": "resolve", "title": "Resolve Friction issue", "description": 'Resolve an issue with a root cause. In the default "ids" resolution_mode this also creates a remediation follow-up task; "already_fixed" records only the root cause (no follow-up task). Always records a human decision (decided_by) in the same transaction.', "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "resolution_mode", "flag": "resolution-mode", "type": "enum", "required": false, "enumValues": ["ids", "already_fixed"] }, { "name": "root_cause", "flag": "root-cause", "type": "string", "required": true }, { "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": false }, { "name": "task_title", "flag": "task-title", "type": "string", "required": false }, { "name": "task_description", "flag": "task-description", "type": "string", "required": false }, { "name": "done_by", "flag": "done-by", "type": "string", "required": false }, { "name": "resolving_seat_id", "flag": "resolving-seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resolve an issue with a root cause and remediation task; resolution is a human decision." },
+  { "id": "friction.resolve", "namespace": "friction", "action": "resolve", "title": "Resolve Friction issue", "description": 'Resolve an issue with a root cause. In the default "ids" resolution_mode this also creates a remediation follow-up task; "already_fixed" records only the root cause (no follow-up task). Always records a human decision (decided_by) in the same transaction.', "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "resolution_mode", "flag": "resolution-mode", "type": "enum", "required": false, "enumValues": ["ids", "already_fixed"] }, { "name": "root_cause", "flag": "root-cause", "type": "string", "required": true }, { "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": false }, { "name": "task_title", "flag": "task-title", "type": "string", "required": false }, { "name": "task_description", "flag": "task-description", "type": "string", "required": false }, { "name": "done_by", "flag": "done-by", "type": "string", "required": false }, { "name": "resolving_seat_id", "flag": "resolving-seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resolve an issue with a root cause and remediation task; resolution is a human decision." },
   { "id": "friction.stale_candidates", "namespace": "friction", "action": "stale_candidates", "title": "Find stale friction", "description": "List open or diagnosing Friction issues whose linked remediation task has already shipped, making them high-confidence candidates for bulk resolution, with per-row evidence. Read-only \u2014 it never resolves anything.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "stale_after_days", "flag": "stale-after-days", "type": "integer", "required": false }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List open or diagnosing issues whose remediation task already shipped \u2014 high-confidence candidates for a bulk close-the-loop pass. Read-only." },
   { "id": "friction.update_status", "namespace": "friction", "action": "update_status", "title": "Update Friction issue status", "description": "Move a non-terminal issue between open and diagnosing. Terminal issues (resolved/dropped) cannot be reopened here.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "status", "flag": "status", "type": "enum", "required": true, "enumValues": ["open", "diagnosing"] }], "hasComplexInput": false, "help": "Move a non-terminal issue between open and diagnosing while it is being worked." },
   { "id": "gate.decide", "namespace": "gate", "action": "decide", "title": "Decide a conversational gate", "description": "A human approves or rejects a conversational gate bound to an artifact digest (a prototype URL, deliverable, or artifact). The agent drafts the decision and the human confirms it; the resolver is always a human (invariant #7). On approval the artifact must be unchanged since the gate was drafted \u2014 a stale digest re-blocks. Requires confirmation.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "subject_kind", "flag": "subject-kind", "type": "enum", "required": true, "enumValues": ["prototype", "deliverable", "artifact"] }, { "name": "subject_id", "flag": "subject-id", "type": "string", "required": true }, { "name": "artifact_digest", "flag": "artifact-digest", "type": "string", "required": true }, { "name": "decision", "flag": "decision", "type": "enum", "required": true, "enumValues": ["approve", "reject"] }, { "name": "ask", "flag": "ask", "type": "string", "required": true }, { "name": "consequence", "flag": "consequence", "type": "string", "required": true }, { "name": "unblocked_targets", "flag": "unblocked-targets", "type": "array", "required": false, "itemType": "string" }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": true, "help": "A human approves or rejects a conversational gate bound to an artifact digest; the agent drafts, the human confirms (invariant #7)." },