@rosthq/cli 0.7.78 → 0.7.79

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAiQ3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAkQ3D,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAOA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAwBrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAcF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwRnG;AA0hBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAOA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAwBrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAcF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0RnG;AA0hBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}

package/dist/index.js

@@ -42527,6 +42527,20 @@ var credentialIngressOutputSchema = external_exports.object({
   provider: external_exports.string().min(1),
   seat_id: uuidSchema11.nullable()
 }).strict();
+var credentialListInputSchema = external_exports.object({}).strict();
+var credentialSummarySchema = external_exports.object({
+  credential_id: uuidSchema11,
+  provider: external_exports.string(),
+  scope_description: external_exports.string(),
+  seat_id: uuidSchema11.nullable(),
+  status: external_exports.string(),
+  created_at: external_exports.string(),
+  rotated_at: external_exports.string(),
+  revoked_at: external_exports.string().nullable()
+}).strict();
+var credentialListOutputSchema = external_exports.object({
+  credentials: external_exports.array(credentialSummarySchema)
+}).strict();
 var agentGoLiveInputSchema = external_exports.object({
   seat_id: uuidSchema11,
   charter_version_id: uuidSchema11
@@ -44251,8 +44265,13 @@ var secretGrantRequestOutputSchema = external_exports.object({
 var secretGrantGrantInputSchema = external_exports.object({
   seat_id: uuid10,
   grant_key: brokerGrantKeySchema,
-  // POINTER only. The vault-ref refinement rejects any raw-secret value.
-  vault_ref: brokerVaultRefSchema,
+  // Supply EXACTLY ONE of `vault_ref` or `credential_id` (DER-1777):
+  //  - `vault_ref`: the POINTER directly. The vault-ref refinement rejects any raw-secret value.
+  //  - `credential_id`: an existing tenant `credentials` row (from `credential.list` /
+  //    `credential.ingress` output); the command resolves its vault_ref server-side, so a human
+  //    never has to handle a ref. Both keep invariant #5 (Postgres stores only pointers).
+  vault_ref: brokerVaultRefSchema.optional(),
+  credential_id: uuid10.optional(),
   provider: brokerProviderSchema,
   allowed_host: brokerAllowedHostSchema,
   allowed_path_prefix: brokerAllowedPathPrefixSchema.optional(),
@@ -44262,7 +44281,17 @@ var secretGrantGrantInputSchema = external_exports.object({
   injection_name: brokerInjectionNameSchema.optional(),
   // ISO-8601; absent = no expiry.
   expires_at: external_exports.string().datetime({ offset: true }).optional()
-}).strict().superRefine((value, ctx) => refineGrantShape(value, ctx));
+}).strict().superRefine((value, ctx) => {
+  refineGrantShape(value, ctx);
+  const provided = [value.vault_ref, value.credential_id].filter((v) => v !== void 0).length;
+  if (provided !== 1) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["credential_id"],
+      message: "provide exactly one of vault_ref or credential_id"
+    });
+  }
+});
 var secretGrantGrantOutputSchema = external_exports.object({
   grant_id: uuid10,
   seat_id: uuid10,
@@ -46734,7 +46763,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-13.2",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -46825,6 +46854,8 @@ Agent creation at \`/agents/new\` begins with four doors: **Describe the job** o
 
 Agent seat pages show the operator-facing output trail, not just low-level run telemetry. The completed work area combines explicit \`agent_deliverables\`, successful \`work.log\` evidence, and recent successful run summaries into one readable list. Each item shows what was delivered, when it happened, what kind of work it was, and safe evidence links labelled as internal, Linear, GitHub, or external. Secret-shaped values are redacted before display, and run or task context is shown only when it belongs to the same seat. Forge artifact batches can also carry a metadata-only integrity verdict so duplicate hashes, zero-byte files, size outliers, and manifest count mismatches are visible without exposing file contents.
 
+The **Activity** tab layers a curated business-activity narrative above the Trust Card's forensic execution trace: period-scoped counter tiles (today, this week, or 30 days) summarise the seat's \`work.record\` activity by kind \u2014 a "held for your approval" tile is always shown, and an operator can pick which other kinds appear via a per-seat, browser-local tile picker. Below the tiles, a run-grouped activity feed lists each \`work.list\` record \u2014 verb, object, outcome, evidence link, and time \u2014 with a drill-down for entity refs, the \`template_ref\` used for external comms when one was recorded, and the raw structured details. A sessions browser lists the seat's runs and, for the selected one, its persisted transcript (\`session_transcripts\`) and artifacts rail: binary artifacts (Supabase Storage) get a freshly minted 60-second signed download link at render time, pointer artifacts (Gmail draft, Drive doc, PR, or an internal reference) link out when an external URL is known. The task queue and Trust Card below are unchanged. All of this sits behind the same sensitive-data access gate as the Trust Card; a restricted viewer sees an explicit unavailable state, never a guessed empty feed. The \`/agents\` fleet page mirrors the same row grammar in a tenant-wide **Work** view \u2014 every seat's activity in one filterable stream, each row linking back to that seat's Activity tab with the originating session focused.
+
 ## Read a human seat's page
 
 A human seat's page opens on one computed answer line \u2014 for example "On track \u2014 4 of 5 measurables on target \xB7 1 held draft awaiting review" \u2014 instead of a wall of always-shown sections. Below it:
@@ -46971,7 +47002,7 @@ Drafting can be assisted by agents. Activation is a human decision. When authori
     order: 40,
     title: "Agent staffing playbook",
     summary: "How to decide whether a seat should be human, agent, or hybrid, and how to go live safely.",
-    version: "2026-07-13.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -47030,7 +47061,7 @@ Two creation paths, both draft-first. Read the stock-agents guide for templates
 - Custom: \`agent_setup.start\` / \`rost_start_agent_setup\` (returns a \`setup_id\`), iterate with \`agent_setup.get\` and \`agent_setup.update\`, then \`agent.create_custom\` / \`rost_create_custom_agent\`. Stage tools with \`agent.configure_tools\` (vault refs only) and sandbox with \`agent.run_dry_run\`.
 - Inspect runtime: \`agent.status\` / \`rost_get_agent_status\` with \`{"seat_id":"<seat-id>"}\` returns lane, live state, steward chain, dry-run result, and Runner availability.
 - Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. The command is ungated but still requires a live staffed agent and the normal server-side tool guard.
-- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include a \`denied_tool_call_count\` rollup \u2014 the actions held because they exceeded the charter. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card.
+- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include a \`denied_tool_call_count\` rollup \u2014 the actions held because they exceeded the charter. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card, and its Activity tab additionally renders the full persisted transcript and artifacts rail for a selected session inline (no \`--transcript\` flag needed there) alongside the business-activity ledger (\`work.record\`/\`work.list\`) \u2014 counter tiles and a run-grouped feed with each record's verb, object, outcome, evidence, and \`template_ref\` when one was used.
 
 ## Review readiness before go-live
 
@@ -47299,7 +47330,7 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
     order: 45,
     title: "How agents work",
     summary: "How {{brand}} agents operate inside seats, use Charters, report work, and escalate beyond authority.",
-    version: "2026-07-04.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -47397,7 +47428,7 @@ Beyond each seat's own manifest, the company can set one ceiling on how much an
 
 ## What humans should review
 
-The Agents page shows fleet health first: live state, work evidence, failed runs, open held actions, cost, and the next operator action. Work evidence distinguishes fresh real runs, stale runs, no completed run yet, queued or running work orders, and recent failures. A failure link opens the failed run itself; queued or stale rows route the operator to the seat's agent operations instead of pretending there is a hidden run to inspect. The page also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, loaded Skill versions, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason. For a live agent, the seat page's agent operations panel can queue one immediate governed run through the same \`agent.run_now\` command path used by CLI and MCP; it does not expand authority or change the saved schedule. Seat pages render legacy Charter manifest scope text with customer-safe labels when old setup data used internal placeholder wording.
+The Agents page shows fleet health first: live state, work evidence, failed runs, open held actions, cost, and the next operator action. Work evidence distinguishes fresh real runs, stale runs, no completed run yet, queued or running work orders, and recent failures. A failure link opens the failed run itself; queued or stale rows route the operator to the seat's agent operations instead of pretending there is a hidden run to inspect. The page also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, loaded Skill versions, and held confirmations or escalations. The same seat's Activity tab also shows a curated business-activity ledger (counter tiles plus a run-grouped \`work.record\` feed) and a sessions browser with the full persisted transcript and artifacts for the selected run \u2014 a layer above the Trust Card's forensic trace, not a replacement for it. The fleet page's own **Work** tab mirrors that ledger across every seat in one filterable, seat-labelled stream. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason. For a live agent, the seat page's agent operations panel can queue one immediate governed run through the same \`agent.run_now\` command path used by CLI and MCP; it does not expand authority or change the saved schedule. Seat pages render legacy Charter manifest scope text with customer-safe labels when old setup data used internal placeholder wording.
 
 Review the first dry runs, fleet overview, tool-call audit rows, escalations, deliverables, and Signal impact. A seat's completed-work area combines explicit deliverables, work-log evidence, and successful run summaries into one operator-facing trail with safe links labelled as internal, Linear, GitHub, or external. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalents are \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\` for the compact overview, and \`{{cli}} agent fleet-digest --json\` / \`agent.fleet_digest\` / \`rost_get_dogfood_fleet_health_digest\` for the daily dogfood evidence bundle. The digest returns live/idle state, 24h/7d turns, 7d/30d spend, recent failed runs, unresolved product errors, failed notifications, and a next action per seat.
 
@@ -47556,7 +47587,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-13.7",
+    version: "2026-07-13.8",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -48349,12 +48380,13 @@ Preview deployment creation is a governed command. \`software_factory.vercel.dep
 
 #### Secret broker grants (tenant-level)
 
-Generalized brokered-secret egress beyond Forge (DER-1738). A human grants an agent seat a scoped secret the \`secret.broker\` egress tool and the \`baserow.read\`/\`baserow.write\` tools (DER-1739) resolve server-side; Postgres stores only a vault-ref pointer, never secret material. A seat agent asks for and lists its own grants through the seat-scoped \`secret_grant.request\` / \`secret_grant.list\` tools (in Seat-scoped operating tools below); a human grants and revokes here. Baserow authenticates with an \`Authorization: Token <key>\` header, so a Baserow grant uses \`injection_mode: "header"\`, \`injection_name: "Authorization"\`, and stores the full \`Token <key>\` string as its vault secret.
+Generalized brokered-secret egress beyond Forge (DER-1738). A human grants an agent seat a scoped secret the \`secret.broker\` egress tool and the \`baserow.read\`/\`baserow.write\` tools (DER-1739) resolve server-side; Postgres stores only a vault-ref pointer, never secret material. A seat agent asks for and lists its own grants through the seat-scoped \`secret_grant.request\` / \`secret_grant.list\` tools (in Seat-scoped operating tools below); a human grants and revokes here. To grant, pass \`credential_id\` (from \`credential.list\`, DER-1777) instead of a raw \`vault_ref\` \u2014 the command resolves the ref server-side so no product flow ever exposes it. Baserow authenticates with an \`Authorization: Token <key>\` header, so a Baserow grant uses \`injection_mode: "header"\`, \`injection_name: "Authorization"\`, and stores the full \`Token <key>\` string as its vault secret.
 
 | Tool | Command | What it does | Scope | Notes |
 |---|---|---|---|---|
-| \`rost_grant_a_brokered_secret\` | \`secret_grant.grant\` | A human grants a seat scoped brokered-secret access by vault ref (host, path prefix, methods, injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker and baserow.* tools resolve it server-side and the secret never enters agent context. | Tenant-admin | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET","POST","PATCH"],"scope_tier":"write","injection_mode":"header","injection_name":"Authorization","vault_ref":"infisical://prod/baserow-token"}. |
+| \`rost_grant_a_brokered_secret\` | \`secret_grant.grant\` | A human grants a seat scoped brokered-secret access. Supply exactly one of credential_id (from credential.list / credential.ingress \u2014 resolved to its vault ref server-side, so a human never handles a ref) or vault_ref directly. Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker and baserow.* tools resolve it server-side and the secret never enters agent context. | Tenant-admin | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET","POST","PATCH"],"scope_tier":"write","injection_mode":"header","injection_name":"Authorization","credential_id":"<credential-id>"} (or "vault_ref":"infisical://prod/baserow-token" instead of credential_id). |
 | \`rost_revoke_a_brokered_secret_grant\` | \`secret_grant.revoke\` | Revoke a brokered secret grant (teardown \u2014 cut a compromised or over-scoped seat egress immediately; the next broker call fails closed). Owner-only and human-gated. | Tenant-admin | Call with {"grant_id":"<grant-id>"}; non-interactive callers receive a confirmation handoff. |
+| \`rost_list_stored_credentials\` | \`credential.list\` | List the tenant's stored credentials as metadata only \u2014 credential id, provider, label, seat, status, and created/rotated/revoked dates. NEVER returns the vault ref or any secret. Use the returned credential_id with secret_grant.grant. | Tenant-admin | Call with {}. |
 
 ### Seat-scoped operating tools
 
@@ -51563,6 +51595,7 @@ var COMMAND_MANIFEST = [
   { "id": "confirmation.reject", "namespace": "confirmation", "action": "reject", "title": "Reject pending confirmation", "description": "Reject an in-flight confirmation without executing the original command.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Reject pending confirmations when authority, evidence, or human intent is unclear." },
   { "id": "confirmation.remint", "namespace": "confirmation", "action": "remint", "title": "Re-mint an expired confirmation", "description": "Stage a fresh confirmation for the same command as an expired one, re-running the normal minting authorization checks.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Re-mint an expired confirmation into a fresh one before approving, instead of re-running the original command from scratch." },
   { "id": "credential.ingress", "namespace": "credential", "action": "ingress", "title": "Store credential", "description": "Store a secret through the vault and persist only the credential vault reference.", "requiredScope": "seat", "confirmation": "credential_flow", "exposeOverMcp": false, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "scope_description", "flag": "scope-description", "type": "string", "required": true }, { "name": "secret_name", "flag": "secret-name", "type": "string", "required": true }], "hasComplexInput": false, "secretBlocked": true, "help": "Ingress credentials only through vault-backed flows; never place raw secrets in prompts, logs, or docs." },
+  { "id": "credential.list", "namespace": "credential", "action": "list", "title": "List stored credentials", "description": "List the tenant's stored credentials as metadata only \u2014 credential id, provider, label, seat, status, and created/rotated/revoked dates. NEVER returns the vault ref or any secret. Use the returned credential_id with secret_grant.grant to grant a seat brokered access without ever handling a raw ref.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List stored-credential metadata (id, provider, label, status, dates) to find the credential_id for secret_grant.grant. Never returns the vault ref or any secret." },
   { "id": "deliverable.accept", "namespace": "deliverable", "action": "accept", "title": "Accept deliverable value", "description": "Record a human-confirmed accepted value (USD) on a deliverable. Humans decide; agents cannot self-accept. Re-accepting records a correction as a new event; prior events are never mutated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "deliverable_id", "flag": "deliverable-id", "type": "string", "required": true }, { "name": "impact_value_usd", "flag": "impact-value-usd", "type": "number", "required": true }], "hasComplexInput": false, "help": "Record a human-confirmed accepted value (USD) on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-accept. Re-accepting records a correction as a new event." },
   { "id": "deliverable.attach", "namespace": "deliverable", "action": "attach", "title": "Attach agent deliverable", "description": "Attach a deliverable to a source run, task, or work order for the acting seat. Source refs are validated server-side.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "run_id", "flag": "run-id", "type": "string", "required": false }, { "name": "task_id", "flag": "task-id", "type": "string", "required": false }, { "name": "work_order_id", "flag": "work-order-id", "type": "string", "required": false }, { "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["brief", "work_evidence", "artifact", "report", "other"] }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": false }, { "name": "content", "flag": "content", "type": "string", "required": false }], "hasComplexInput": true, "help": "Attach a scrubbed deliverable to a source run, task, or work order that belongs to the acting seat." },
   { "id": "deliverable.create", "namespace": "deliverable", "action": "create", "title": "Create agent deliverable", "description": "Create an agent deliverable for the acting seat. The deliverable is scrubbed for secrets before storage.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["brief", "work_evidence", "artifact", "report", "other"] }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": false }, { "name": "content", "flag": "content", "type": "string", "required": false }, { "name": "delivered_at", "flag": "delivered-at", "type": "string", "required": false }], "hasComplexInput": true, "help": "Create a scrubbed durable work output for the acting seat without making a durable company decision." },
@@ -51638,7 +51671,7 @@ var COMMAND_MANIFEST = [
   { "id": "seat.rename", "namespace": "seat", "action": "rename", "title": "Rename seat", "description": "Rename a Responsibility Graph seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "name", "flag": "name", "type": "string", "required": true }], "hasComplexInput": false, "help": "Seat names should describe the function and accountability clearly." },
   { "id": "seat.reparent", "namespace": "seat", "action": "reparent", "title": "Reparent seat", "description": "Move a Responsibility Graph seat under a new parent.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "new_parent_seat_id", "flag": "new-parent-seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Reparent seats only when it clarifies accountable structure and preserves a clean graph." },
   { "id": "seat.set_type", "namespace": "seat", "action": "set_type", "title": "Set seat type", "description": "Set a Responsibility Graph seat type.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "seat_type", "flag": "seat-type", "type": "enum", "required": true, "enumValues": ["human", "agent", "hybrid"] }], "hasComplexInput": false, "help": "Seat type should follow the work, risk, measurable, and stewardship model." },
-  { "id": "secret_grant.grant", "namespace": "secret_grant", "action": "grant", "title": "Grant a brokered secret", "description": "A human grants a seat scoped access to a brokered secret by VAULT REF (host + path prefix + methods + scope + injection). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. The secret.broker/baserow.* tools resolve this grant server-side; the secret never enters agent context.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": true }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "injection_mode", "flag": "injection-mode", "type": "enum", "required": false, "enumValues": ["header_bearer", "header", "query"] }, { "name": "injection_name", "flag": "injection-name", "type": "string", "required": false }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human grants a seat a scoped brokered secret by vault ref (host + path prefix + methods + injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker/baserow.* tools resolve it server-side." },
+  { "id": "secret_grant.grant", "namespace": "secret_grant", "action": "grant", "title": "Grant a brokered secret", "description": "A human grants a seat scoped access to a brokered secret by CREDENTIAL ID (from credential.list / credential.ingress \u2014 resolved to its vault ref server-side) or by VAULT REF directly (exactly one). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. The secret.broker/baserow.* tools resolve this grant server-side; the secret never enters agent context.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": false }, { "name": "credential_id", "flag": "credential-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "injection_mode", "flag": "injection-mode", "type": "enum", "required": false, "enumValues": ["header_bearer", "header", "query"] }, { "name": "injection_name", "flag": "injection-name", "type": "string", "required": false }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human grants a seat a scoped brokered secret by vault ref (host + path prefix + methods + injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker/baserow.* tools resolve it server-side." },
   { "id": "secret_grant.list", "namespace": "secret_grant", "action": "list", "title": "List brokered secret grants", "description": "List brokered secret grants for the tenant (or one seat). Returns the egress allowlist metadata only (host, path prefix, methods, scope, status) \u2014 never the vault ref or any secret. An agent sees only its own seat's grants.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "include_revoked", "flag": "include-revoked", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "List brokered secret grants for the tenant (or one seat). Returns the egress allowlist metadata only \u2014 host, path prefix, methods, scope, status \u2014 never the vault ref or any secret." },
   { "id": "secret_grant.request", "namespace": "secret_grant", "action": "request", "title": "Request a brokered secret grant", "description": "An agent or user REQUESTS a scoped brokered-secret grant by naming the egress it needs (grant key, host, path prefix, methods, scope). No secret and no vault ref are ever accepted (invariant #5) \u2014 this only records a durable ask for a human to grant.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "An agent or user requests a brokered-secret egress grant by naming the host, path prefix, methods, and scope it needs. Draft-and-confirm: no secret or vault ref is accepted; a human grants it." },
   { "id": "secret_grant.revoke", "namespace": "secret_grant", "action": "revoke", "title": "Revoke a brokered secret grant", "description": "Revoke a brokered secret grant \u2014 a compromised or over-scoped seat's egress access can be cut immediately; the next broker call resolves no grant and fails closed. Owner-only, human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "grant_id", "flag": "grant-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Revoke a brokered secret grant (teardown \u2014 cut a compromised or over-scoped seat's egress immediately; the next broker call fails closed). Owner-only and human-gated." },
@@ -57958,7 +57991,7 @@ async function main(argv = process.argv.slice(2), options = {}) {
   const refreshSession = options.refreshSession ?? refreshCliSessionIfNeeded;
   const [rawCommand, ...args] = argv;
   const command = rawCommand === "--help" || rawCommand === "-h" ? "help" : rawCommand;
-  if (isSecretBlockedNamespace(command)) {
+  if (isSecretBlockedNamespace(command) || isSecretBlockedCommand(args[0] === void 0 ? void 0 : `${command}.${args[0]}`)) {
     io.stderr.write(`${SECRET_ARGV_GUIDANCE}
 `);
     return 1;