@rosthq/cli 0.7.62 → 0.7.63

package/dist/index.js

@@ -37801,6 +37801,104 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
+// ../../packages/protocol/src/cron.ts
+var uintPattern = /^\d+$/;
+var CRON_FIELD_SPECS = [
+  { name: "minute", min: 0, max: 59 },
+  { name: "hour", min: 0, max: 23 },
+  { name: "day-of-month", min: 1, max: 31 },
+  { name: "month", min: 1, max: 12 },
+  { name: "day-of-week", min: 0, max: 7 }
+];
+var CRON_FIELD_COUNT = CRON_FIELD_SPECS.length;
+function parseCronField(raw, spec) {
+  const parts = raw.split(",");
+  const terms = [];
+  for (const part of parts) {
+    const token = part.trim();
+    if (token.length === 0) {
+      return { ok: false, reason: "empty value in list" };
+    }
+    if (token === "*") {
+      terms.push({ kind: "all" });
+      continue;
+    }
+    if (token.startsWith("*/")) {
+      const stepText = token.slice(2);
+      if (!uintPattern.test(stepText)) {
+        return { ok: false, reason: `"${token}" is not a valid step` };
+      }
+      const step = Number(stepText);
+      if (step < 1 || step > spec.max) {
+        return { ok: false, reason: `step in "${token}" must be between 1 and ${spec.max}` };
+      }
+      terms.push({ kind: "step", step });
+      continue;
+    }
+    if (token.includes("-")) {
+      const segments = token.split("-");
+      if (segments.length !== 2 || !uintPattern.test(segments[0] ?? "") || !uintPattern.test(segments[1] ?? "")) {
+        return { ok: false, reason: `"${token}" is not a valid range` };
+      }
+      const start = Number(segments[0]);
+      const end = Number(segments[1]);
+      if (start < spec.min || end > spec.max || start > end) {
+        return { ok: false, reason: `range "${token}" must be within ${spec.min}-${spec.max} and ascending` };
+      }
+      terms.push({ kind: "range", start, end });
+      continue;
+    }
+    if (uintPattern.test(token)) {
+      const value = Number(token);
+      if (value < spec.min || value > spec.max) {
+        return { ok: false, reason: `"${token}" must be between ${spec.min} and ${spec.max}` };
+      }
+      terms.push({ kind: "value", value });
+      continue;
+    }
+    return { ok: false, reason: `"${token}" is not a supported cron token` };
+  }
+  return { ok: true, field: terms };
+}
+function parseCronExpression(expression) {
+  const trimmed = expression.trim();
+  if (trimmed.length === 0) {
+    return { ok: false, message: "Schedule must not be empty." };
+  }
+  if (/[\r\n\u2028\u2029]/.test(trimmed)) {
+    return { ok: false, message: "Schedule must be a single-line cron expression." };
+  }
+  if (/[^0-9*/,\t\x20-]/.test(trimmed)) {
+    return { ok: false, message: "Schedule may only contain digits, spaces, and the characters * / , -" };
+  }
+  const rawFields = trimmed.split(/\s+/);
+  if (rawFields.length !== CRON_FIELD_COUNT) {
+    return {
+      ok: false,
+      message: `Schedule must have exactly ${CRON_FIELD_COUNT} fields (minute hour day-of-month month day-of-week); got ${rawFields.length}.`
+    };
+  }
+  const fields = [];
+  for (let i = 0; i < CRON_FIELD_COUNT; i += 1) {
+    const spec = CRON_FIELD_SPECS[i];
+    const result = parseCronField(rawFields[i], spec);
+    if (!result.ok) {
+      return { ok: false, message: `Invalid ${spec.name} field: ${result.reason}.` };
+    }
+    fields.push(result.field);
+  }
+  return { ok: true, cron: { fields } };
+}
+var cronExpressionSchema = external_exports.string().trim().min(1).max(120).superRefine((value, ctx) => {
+  if (value.length > 120) {
+    return;
+  }
+  const result = parseCronExpression(value);
+  if (!result.ok) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: result.message });
+  }
+});
+
 // ../../packages/protocol/src/agent-model-config.ts
 var agentModelProviderSchema = external_exports.enum(["anthropic"]);
 var agentModelEffortSchema = external_exports.enum(["low", "medium", "high", "xhigh", "max"]);
@@ -37923,7 +38021,7 @@ var dryRunTranscriptSchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/scrub.ts
-var SECRET_SHAPED_VALUE = /(sk-ant-|sk-proj-|sk-live-|sk-[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|BEGIN [A-Z ]*PRIVATE KEY|api[_-]?key\s*=|secret\s*=|password\s*=|authorization:\s*bearer\s+|x-api-key\s*:|api[-_ ]?key\s*:\s*\S{3,}|secret\s*:\s*\S{3,}|password\s*:\s*\S{3,}|token\s*:\s*\S{3,})/i;
+var SECRET_SHAPED_VALUE = /(rost_mcp_[A-Za-z0-9_-]{20,}|sk-ant-|sk-proj-|sk-live-|sk-[A-Za-z0-9_-]{12,}|gh[opsur]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{20,}|xox[baoprs]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[0-9A-Z]{16}|BEGIN [A-Z ]*PRIVATE KEY|api[_-]?key\s*=|secret\s*=|password\s*=|authorization:\s*bearer\s+|(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{20,}|x-api-key\s*:|api[-_ ]?key\s*:\s*\S{3,}|secret\s*:\s*\S{3,}|password\s*:\s*\S{3,}|token\s*:\s*\S{3,})/i;
 var SECRET_KEY = /(api[_-]?key|secret|password|token|authorization|credential|private[_-]?key)/i;
 function hasSecretShapedContent(value) {
   if (typeof value === "string") {
@@ -38677,7 +38775,7 @@ var agentLifecycleSchema = external_exports.enum([
   "paused",
   "decommissioned"
 ]);
-var cronSchema = external_exports.string().trim().min(1).max(120).regex(/^[^\n\r]+$/, "Schedule must be a single-line cron expression.");
+var cronSchema = cronExpressionSchema;
 var agentTemplateListInputSchema = external_exports.object({}).strict();
 var agentTemplateSummarySchema = external_exports.object({
   slug: external_exports.string().min(1),
@@ -38785,6 +38883,11 @@ var agentSetupStateSchema = external_exports.object({
   steward_seat_id: uuidSchema2.nullable(),
   steward_chain_resolves_to_human: external_exports.boolean(),
   has_occupancy: external_exports.boolean(),
+  // DER-1529: the seat agent's run-time skill-discovery toggle. VISIBILITY only —
+  // it never grants tools (invariant #6). Always present (the column is NOT NULL
+  // default false) so agent_setup.get / .update round-trip the current value back
+  // to any client; conservative default false (#10).
+  skill_discovery_enabled: external_exports.boolean(),
   tool_decisions: external_exports.array(agentSetupToolDecisionSchema),
   available_skill_recommendations: external_exports.array(agentSetupSkillRecommendationSchema),
   assigned_skills: external_exports.array(skillAssignmentSummarySchema),
@@ -38816,9 +38919,12 @@ var agentSetupUpdateInputSchema = external_exports.object({
   // DER-787 (H1): set the structured model selection for this agent.
   model_config: agentModelConfigSchema.optional(),
   answers: external_exports.array(external_exports.string().min(1).max(2e3)).max(20).optional(),
-  tool_decisions: external_exports.array(agentSetupToolUpdateSchema).max(50).optional()
+  tool_decisions: external_exports.array(agentSetupToolUpdateSchema).max(50).optional(),
+  // DER-1529: toggle run-time skill discovery (visibility only; never grants
+  // tools). Settable any time, including on a live agent.
+  skill_discovery_enabled: external_exports.boolean().optional()
 }).strict().refine(
-  (value) => value.parent_seat_id !== void 0 || value.steward_seat_id !== void 0 || value.lane !== void 0 || value.schedule_cron !== void 0 || value.model_config !== void 0 || value.answers !== void 0 || value.tool_decisions !== void 0,
+  (value) => value.parent_seat_id !== void 0 || value.steward_seat_id !== void 0 || value.lane !== void 0 || value.schedule_cron !== void 0 || value.model_config !== void 0 || value.answers !== void 0 || value.tool_decisions !== void 0 || value.skill_discovery_enabled !== void 0,
   "Provide at least one field to update."
 );
 var agentUpdateScheduleInputSchema = external_exports.object({
@@ -41208,6 +41314,7 @@ var MCP_ONBOARDING_TOOL_NAMES = {
 };
 var FORGE_TURN_HARD_CEILING_SECONDS = 30 * 60;
 var FORGE_TURN_PHASE_OVERHEAD_SECONDS = 20 * 60;
+var SEAT_MCP_CLAIM_TOKEN_TTL_SECONDS = (FORGE_TURN_HARD_CEILING_SECONDS + FORGE_TURN_PHASE_OVERHEAD_SECONDS) * 2;
 
 // ../../packages/protocol/src/mcp-onboarding.ts
 var MCP_TOKEN_ABSOLUTE_MAX_EXPIRY_MS = (MCP_TOKEN_NO_EXPIRY_SENTINEL_DAYS + 1) * 24 * 60 * 60 * 1e3;
@@ -42181,6 +42288,11 @@ var errorLogSupersedeOutputSchema = external_exports.object({
   resolved_at: isoDateTime3
 }).strict();
 
+// ../../packages/protocol/src/run-summary.ts
+var runSummaryOutputSchema = external_exports.object({
+  summary: external_exports.string().min(1).max(140)
+});
+
 // ../../packages/protocol/src/runner-settings.ts
 var uuid8 = external_exports.string().uuid();
 var isoDateTime4 = external_exports.string().datetime({ offset: true });
@@ -44025,6 +44137,23 @@ var softwareVercelDeployPreviewOutputSchema = external_exports.object({
   status: softwareVercelDeploymentStatusSchema
 });
 
+// ../../packages/protocol/src/software-factory-events.ts
+var uuid11 = external_exports.string().uuid();
+var softwareFactoryPhaseRunCompletedEventSchema = external_exports.object({
+  tenantId: uuid11,
+  phaseRunId: uuid11,
+  buildRequestId: uuid11.nullish(),
+  status: external_exports.enum(["passed", "failed"]),
+  idempotencyKey: external_exports.string().min(1).optional()
+}).strict();
+var softwareFactoryBudgetExhaustedEventSchema = external_exports.object({
+  tenantId: uuid11,
+  phaseRunId: uuid11,
+  buildRequestId: uuid11,
+  reason: external_exports.string().min(1),
+  idempotencyKey: external_exports.string().min(1).optional()
+}).strict();
+
 // ../../packages/protocol/src/sync-brief.ts
 var uuidSchema15 = external_exports.string().uuid();
 var dateSchema = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/);
@@ -45420,7 +45549,7 @@ For CLI and MCP setup, read agent-skill-setup-guide before adding or assigning S
     order: 42,
     title: "Design a custom agent",
     summary: "How to build a custom agent from operational questions through the Charter Builder, tools, dry run, and go-live without writing prompts.",
-    version: "2026-07-04.1",
+    version: "2026-07-10.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "charter_design"],
@@ -45466,7 +45595,7 @@ Then choose one of three named triggers:
 - **Scheduled** \u2014 runs on a recurring cadence you pick (every weekday morning, every morning, weekly, hourly). No cron to write.
 - **Event** \u2014 runs in response to work routed to it, like a sync or a mention, rather than on a clock.
 
-Open **Advanced** for the explicit lane select and a raw cron expression when you need a custom cadence. The same schedule presets appear on the agent's seat page after go-live (Agent operations \u2192 Run schedule).
+Open **Advanced** for the explicit lane select and a raw cron expression when you need a custom cadence. A raw schedule is a five-field UTC cron \u2014 \`minute hour day-of-month month day-of-week\` \u2014 supporting \`*\`, \`*/N\` steps, \`A-B\` ranges, and comma lists (for example \`0 9 * * 1-5\`). Day-of-week is 0\u20137 where both 0 and 7 mean Sunday. It is validated when you save: an unsupported or out-of-range expression is rejected with a field-level error rather than saved as a schedule that never runs, and the builder previews the next run in UTC. When both day-of-month and day-of-week are set, a run fires only when both match. The same schedule presets appear on the agent's seat page after go-live (Agent operations \u2192 Run schedule).
 
 ## Configure tools and credentials
 
@@ -45830,7 +45959,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-10.2",
+    version: "2026-07-10.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -46437,7 +46566,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_agent_from_template\` | \`agent.create_from_template\` | Create a draft stock agent and draft Charter from a template (draft-only; occupancy needs a human steward). | Tenant | Call with \`seat_id\` and \`template_slug\`; expect human confirmation. |
 | \`rost_start_agent_setup\` | \`agent_setup.start\` | Start an agent setup draft for template, custom, or existing mode. | Tenant | Call with \`mode\` and seat placement. |
 | \`rost_get_agent_setup\` | \`agent_setup.get\` | Read agent setup state, blockers, and next action. | Seat or tenant-admin | Call with \`{"setup_id":"<id>"}\`. |
-| \`rost_update_agent_setup\` | \`agent_setup.update\` | Update parent, steward, lane, schedule, or answers on a setup draft. | Tenant | Call with \`setup_id\` and the fields to change. |
+| \`rost_update_agent_setup\` | \`agent_setup.update\` | Update parent, steward, lane, schedule, answers, or skill discovery on a setup draft. | Tenant | Call with \`setup_id\` and the fields to change. |
 | \`rost_update_agent_schedule\` | \`agent.update_schedule\` | Update a draft or live agent's scheduled execution. | Tenant | Call with \`agent_id\` and \`schedule_cron\`; expect human confirmation. |
 | \`rost_decommission_agent\` | \`agent.decommission\` | Retire an agent occupancy safely (no-orphan guarded). | Tenant | Call with \`agent_id\`; expect human confirmation. |
 | \`rost_pause_agent\` | \`agent.pause\` | Pause a live agent so it stops scheduled and on-demand runs; reversible. | Tenant | Call with \`seat_id\`; expect human confirmation. |
@@ -49676,7 +49805,7 @@ var COMMAND_MANIFEST = [
   { "id": "agent_setup.get", "namespace": "agent_setup", "action": "get", "title": "Get agent setup", "description": "Read the resumable agent-setup state: mode, parent, steward, template, lane, schedule, tool decisions, dry run, and next action.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "setup_id", "flag": "setup-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Read the resumable setup state: mode, parent, steward, lane, schedule, tool decisions, dry-run blockers, and the next action." },
   { "id": "agent_setup.relane", "namespace": "agent_setup", "action": "relane", "title": "Re-lane a live agent", "description": "Governed re-lane of a live agent: pause, move to the new lane, force a fresh dry-run rehearsal on that lane, then go live. Owner-only and human-gated; records a rationale.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "lane", "flag": "lane", "type": "enum", "required": true, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "reason", "flag": "reason", "type": "string", "required": true }], "hasComplexInput": false, "help": "Re-lane a live agent (cloud / runner / mcp_session): it pauses, moves to the new lane, forces a fresh dry-run rehearsal on that lane, then goes live \u2014 owner-only, human-gated, with a required rationale. A runner target needs a paired runner; a failed rehearsal leaves the agent paused on the new lane." },
   { "id": "agent_setup.start", "namespace": "agent_setup", "action": "start", "title": "Start agent setup", "description": "Start (or resume) a draft agent setup for a seat in template, custom, or existing mode.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "mode", "flag": "mode", "type": "enum", "required": true, "enumValues": ["template", "custom", "existing"] }, { "name": "template_slug", "flag": "template-slug", "type": "string", "required": false }], "hasComplexInput": false, "help": "Start a draft agent setup from a template, custom, or existing mode; the setup resumes from the draft agent and Charter, not a fresh start." },
-  { "id": "agent_setup.update", "namespace": "agent_setup", "action": "update", "title": "Update agent setup", "description": "Update the draft agent's parent, steward, lane, schedule, operational answers, and tool decisions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "parent_seat_id", "flag": "parent-seat-id", "type": "string", "required": false }, { "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": false }, { "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "schedule_cron", "flag": "schedule-cron", "type": "string", "required": false }, { "name": "answers", "flag": "answers", "type": "array", "required": false, "itemType": "string" }], "hasComplexInput": true, "help": "Update parent, steward, lane, schedule, answers, or tool decisions on the draft; steward and parent changes keep the no-orphan chain explicit." },
+  { "id": "agent_setup.update", "namespace": "agent_setup", "action": "update", "title": "Update agent setup", "description": "Update the draft agent's parent, steward, lane, schedule, operational answers, and tool decisions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "parent_seat_id", "flag": "parent-seat-id", "type": "string", "required": false }, { "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": false }, { "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "schedule_cron", "flag": "schedule-cron", "type": "string", "required": false }, { "name": "answers", "flag": "answers", "type": "array", "required": false, "itemType": "string" }, { "name": "skill_discovery_enabled", "flag": "skill-discovery-enabled", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Update parent, steward, lane, schedule, answers, or tool decisions on the draft; steward and parent changes keep the no-orphan chain explicit." },
   { "id": "agent_template.list", "namespace": "agent_template", "action": "list", "title": "List agent templates", "description": "List stock agent templates and their responsibilities, default tools, and dry-run rehearsal.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List stock agent templates and their default tools and safety boundaries before starting a template setup." },
   { "id": "agent.configure_tools", "namespace": "agent", "action": "configure_tools", "title": "Configure agent tools", "description": "Save tool proposals, declines, and credential-ingress requests for a draft agent. Never stores or echoes secret material; vault refs only.", "requiredScope": "seat", "confirmation": "credential_flow", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Connect or decline proposed tools and stage credential-ingress requests; never place raw secrets here \u2014 secrets flow through vault-backed credential.ingress as vault refs only.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "tool_decisions": [{ "tool": "ap.invoices.read", "decision": "connect" }, { "tool": "email.draft", "decision": "connect" }] } },
   { "id": "agent.create_custom", "namespace": "agent", "action": "create_custom", "title": "Create custom agent", "description": "Create a draft custom agent shell and a draft Charter seed from operational answers (what it owns, success, never-do-alone, steward).", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": false }, { "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "what_it_owns", "flag": "what-it-owns", "type": "string", "required": false }, { "name": "what_success_looks_like", "flag": "what-success-looks-like", "type": "string", "required": false }, { "name": "what_it_must_never_do_alone", "flag": "what-it-must-never-do-alone", "type": "string", "required": false }], "hasComplexInput": true, "help": "Create a draft custom agent from operational answers (what it owns, success, never-do-alone, steward); the Charter Builder owns the contract and go-live stays human-gated.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "steward_seat_id": "0190bbbb-bbbb-7bbb-8bbb-bbbbbbbbbbbb", "lane": "cloud", "what_it_owns": "Drafting AP invoice entries from inbound vendor emails for human review.", "what_success_looks_like": "Every inbound invoice is drafted within one business day with the correct GL coding.", "what_it_must_never_do_alone": "Never send payment or approve an invoice without a human sign-off." } },