@rosthq/cli 0.7.3 → 0.7.4

package/dist/index.js

@@ -41885,7 +41885,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-02.8",
+    version: "2026-07-02.9",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -41920,7 +41920,7 @@ In the authenticated app shell, AICOS opens from the floating assistant control.
 Each thread has a purpose:
 
 - **Onboarding** \u2014 setup help and page-aware setup context.
-- **Seat** \u2014 seat and agent setup context.
+- **Seat** \u2014 a seat-scoped assistant pinned to one seat (see "Seat-scoped AICOS" below).
 - **General** \u2014 company operating help.
 
 You can reopen prior threads, search thread titles and summaries, or start a new one. Session history is stored in tenant-scoped conversation tables so chat history is not reconstructed from analytics, events, or run logs.
@@ -41945,6 +41945,12 @@ During onboarding, the deterministic harness may execute only explicit low-risk
 
 AICOS posture is resolved on the server from the current user's AICOS access scope plus the tenant's Company guardrails. **Report-only** can read, explain, and draft guidance, but it cannot mutate setup or operating state. **Balanced** can perform narrow low-risk internal draft/setup actions and stops at human gates. **High autonomy** can perform allowed internal low-risk actions without changing the hard prohibitions: AICOS still cannot approve its own Charter or manifest, handle credentials, send externally, spend money, perform destructive/admin changes, go live, expand policy/access, or receive hidden sensitive data.
 
+## Seat-scoped AICOS
+
+From a seat page you can open **AICOS scoped to that seat** ("Ask AICOS about this seat"). A seat session is pinned to one seat and reads only that seat plus the seats it directly stewards \u2014 what needs attention there, what is blocked, and which tasks, Friction, Signals, goals, or approvals need action. The chat header shows **Seat: <name>** so it is always clear whether you are talking to Company AICOS or a Seat AICOS.
+
+Seat mode is the **intersection** of your access scope and one seat, never an escalation: it can only ever show a narrower slice than your company or own-scope session, and it can never reach data your base scope would already deny. The seat is resolved from the session (pinned when it was opened), re-authorized on the server every turn against your current occupancies and stewardship \u2014 a manually supplied seat id in a turn is ignored, a seat from another tenant or one you are not authorized over is indistinguishable from not-found, and if your occupancy or stewardship ends the session falls back to your base scope rather than widening. Setup-limited access does not get seat operating data. Drafted seat actions stay scoped to the session's seat and remain human-gated where required.
+
 AICOS grounds answers from three source classes before producing user-visible setup or operating guidance:
 
 - **Reference documents** \u2014 public {{brand}} guides such as this chat guide, onboarding guidance, the Responsibility Graph playbook, tool-access guidance, and confirmation guidance. AICOS retrieves the narrowest relevant guide before setup, Charter, Signal, Friction, Cascade, Sync, tool-access, or onboarding advice.
@@ -42746,7 +42752,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-02.7",
+    version: "2026-07-03.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -43271,8 +43277,8 @@ These read-only tools are available to any valid MCP token (like the reference t
 
 | Tool | Purpose | Scope | Safe example |
 |---|---|---|---|
-| \`rost_describe_command\` | Return a command's input/output JSON Schema, scope, confirmation gate, help pointer, guides, a validated example, and related commands. | Any valid MCP token | Query \`{"command_id":"compass.draft"}\` |
-| \`rost_list_commands\` | List every callable command id with its title, scope, confirmation, and stages. | Any valid MCP token | Call with \`{}\` |
+| \`rost_describe_command\` | Return a command's input/output JSON Schema, scope, confirmation gate, MCP tool name, help pointer, guides, a validated example, and related commands. | Any valid MCP token | Query \`{"command_id":"compass.draft"}\` |
+| \`rost_list_commands\` | List callable command ids in bounded pages with title, scope, confirmation, stages, and MCP tool name when callable. Supports \`q\`, \`category\`, \`stage\`, \`limit\`, and \`cursor\`. | Any valid MCP token | Query \`{"q":"status","limit":10}\` |
 
 The equivalent CLI verbs are \`{{cli}} command schema <id>\` and \`{{cli}} command list\`. The discoverable tool catalog is \`{{cli}} tools list\` (MCP \`rost_list_tool_catalog\`, tenant-scoped).
 
@@ -43281,7 +43287,7 @@ The equivalent CLI verbs are \`{{cli}} command schema <id>\` and \`{{cli}} comma
 | Tool or resource | Purpose | Scope | Safe example |
 |---|---|---|---|
 | \`rost_reference_search\` | Search public reference guides. | Any valid MCP token | Query \`{"query":"agent-reference-map","audience":"mcp"}\` |
-| \`rost_reference_get\` | Retrieve a public guide by slug. | Any valid MCP token | Query \`{"slug":"agent-reference-map"}\` |
+| \`rost_reference_get\` | Retrieve a bounded public guide payload by slug, or one requested section by section id/title. The response includes available \`sections\` for follow-up reads. | Any valid MCP token | Query \`{"slug":"agent-reference-map","section":"mcp-surfaces"}\` |
 | \`rost://reference/{slug}\` | Read a public reference guide as a resource. | Any valid MCP token | Resource \`rost://reference/mcp-and-cli-guide\` |
 
 ### Tenant-admin tools
@@ -43809,7 +43815,7 @@ Set \`ROST_SKILL_INSTALL_ROOT\` only for a sandbox or CI override. Local copies
     order: 55,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-07-02.3",
+    version: "2026-07-03.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -43845,7 +43851,7 @@ Use this map when you are a CLI session, MCP client, or in-app agent and need to
 - Reference resource template: rost://reference/{slug}
 - Operation resources (read-only, scope-enforced): rost://tenant/status, rost://graph, rost://seat/{id}/context, rost://compass/current, rost://sync/latest, rost://skills, rost://skills/{slug}, rost://skills/{slug}/files/{path}, rost://seat/{id}/skills, rost://operations/reference-map
 
-Start with rost_reference_search when the user asks a broad question. Use rost_reference_get when a workflow or command metadata already names a guide slug. Read the operation resources to load current tenant/seat facts before mutating; tenant-wide resources need a tenant-admin token and a seat token may read only its own rost://seat/{id}/context.
+Start with rost_reference_search when the user asks a broad question. Use rost_reference_get when a workflow or command metadata already names a guide slug; pass a section id/title to read one bounded section when the guide is large. Read the operation resources to load current tenant/seat facts before mutating; tenant-wide resources need a tenant-admin token and a seat token may read only its own rost://seat/{id}/context.
 
 ## CLI surface
 
@@ -43857,8 +43863,8 @@ Start with rost_reference_search when the user asks a broad question. Use rost_r
 
 Never guess a command's JSON shape. Before calling a command that changes state, read its exact contract:
 
-- List every callable command: {{cli}} command list (CLI) or rost_list_commands (MCP)
-- Read one command's exact input/output schema, help pointer, and a worked example: {{cli}} command schema <id> (CLI) or rost_describe_command with {"command_id":"<id>"} (MCP)
+- List callable commands: {{cli}} command list (CLI) or rost_list_commands (MCP, bounded pages with q/category/stage/limit/cursor filters)
+- Read one command's exact input/output schema, help pointer, MCP tool name, and a worked example: {{cli}} command schema <id> (CLI) or rost_describe_command with {"command_id":"<id>"} (MCP)
 - List the tool catalog the agent builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance): {{cli}} tools list (CLI) or rost_list_tool_catalog (MCP)
 - List guided model tiers before choosing --model (recommended default, effort, token prices, cost bands, best-fit work, model id): {{cli}} model list (CLI) or rost_list_model_catalog (MCP)
 - Show a Compass, Charter, or agent setup as a markdown card to review with your human: {{cli}} compass show --markdown, {{cli}} charter show --seat-id <id> --markdown, {{cli}} agent show --seat-id <id> --markdown
@@ -44568,7 +44574,7 @@ Agents may explain which setting is needed and why. They should not ask users to
     order: 73,
     title: "Members and invites guide",
     summary: "How to invite humans into the company without confusing user access with seat accountability.",
-    version: "2026-07-02.2",
+    version: "2026-07-03.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -44593,7 +44599,7 @@ Invite the person as a tenant member. Then assign them to one or more seats only
 
 Tenant roles control app access. Seats control operating accountability. Do not attach goals, tasks, or measurables directly to a user when the work belongs to a seat.
 
-Owners and admins can invite people and manage member roles. Use \`external_implementer\` plus setup-limited access for a temporary implementation partner helping configure onboarding, Responsibility Graph, Compass, Charters, and agent setup. Do not grant external implementers sensitive run history, hidden tool arguments, credentials, Memory, or company-operating data unless an owner explicitly expands their profile.
+Owners and admins can invite people and manage member roles. Use \`external_implementer\` plus setup-limited access for a temporary implementation partner helping configure onboarding, Responsibility Graph, Compass, Charters, and agent setup. Setup-limited access is intentionally not enough for sensitive operating surfaces: Settings member/invite/token/runner/credential metadata, run and tool-call history, runner diagnostics, integration metadata and tests, system health, Signal operating data, and owner/operating pages require owner/admin or full setup access. Do not grant external implementers sensitive run history, hidden tool arguments, credentials, Memory, or company-operating data unless an owner explicitly expands their profile.
 
 ## Working across several client companies
 
@@ -49051,6 +49057,11 @@ import path3 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify3 } from "node:util";
 var execFile3 = promisify3(execFileCallback3);
+var RUNNER_CHARTER_LOAD_TOOLS = [
+  "mcp__rost__rost_get_context",
+  "mcp__rost__rost_report_status",
+  "mcp__rost__rost_get_tasks"
+];
 async function runRunnerServe(options) {
   const env = options.env ?? process.env;
   const fetchImpl = options.fetchImpl ?? fetch;
@@ -49321,7 +49332,17 @@ function buildTurnCommand(runtime, prompt, configPath) {
   }
   return {
     command: "claude",
-    args: ["-p", prompt, "--mcp-config", configPath, "--strict-mcp-config", "--output-format", "text"]
+    args: [
+      "-p",
+      prompt,
+      "--mcp-config",
+      configPath,
+      "--strict-mcp-config",
+      "--allowedTools",
+      RUNNER_CHARTER_LOAD_TOOLS.join(","),
+      "--output-format",
+      "text"
+    ]
   };
 }
 async function spawnRunnerTurn(appUrl2, workOrder, runtime) {
@@ -49334,14 +49355,14 @@ async function spawnRunnerTurn(appUrl2, workOrder, runtime) {
     work_order_id: workOrder.id,
     task_id: workOrder.task_id ?? null,
     seat: workOrder.seat ?? null,
-    charter: workOrder.charter ?? null,
-    permission_manifest: workOrder.permission_manifest ?? null,
+    charter_ref: workOrder.charter_ref ?? null,
     aicos: workOrder.aicos ?? null
   };
   const hasAicosContext = typeof workOrder.aicos === "object" && workOrder.aicos !== null;
   const prompt = [
-    hasAicosContext ? `Load your ${cliBrand.name} context, answer the AICOS user turn using only seat-authorized context and tools, and stop.` : `Load your ${cliBrand.name} context, report one read-only status, and stop.`,
+    hasAicosContext ? `Call rost_get_context first to load your full ${cliBrand.name} charter, answer the AICOS user turn using only seat-authorized context and tools, and stop.` : `Call rost_get_context first to load your full ${cliBrand.name} charter, report one read-only status, and stop.`,
     "Do not call external systems or mutating tools.",
+    "The work order includes only a compact charter pointer; rost_get_context is the canonical full charter load path.",
     `Claimed work order context: ${JSON.stringify(context).slice(0, 8e3)}`
   ].join("\n");
   await writeFile2(configPath, `${mcpConfig}