@rosthq/cli 0.7.82 → 0.7.84

package/dist/index.js

@@ -37796,10 +37796,30 @@ function windowsClearScript(target) {
   ].join("\n");
 }
 
+// src/cli-version.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var packageMetadataSchema = external_exports.object({
+  version: external_exports.string()
+});
+async function readCliVersion(embeddedVersion = typeof __ROST_CLI_VERSION__ === "string" ? __ROST_CLI_VERSION__ : void 0) {
+  if (embeddedVersion !== void 0) {
+    return embeddedVersion;
+  }
+  const packageJsonPath = resolve(dirname(fileURLToPath(import.meta.url)), "../package.json");
+  try {
+    const metadata = packageMetadataSchema.parse(JSON.parse(await readFile2(packageJsonPath, "utf8")));
+    return metadata.version;
+  } catch {
+    return null;
+  }
+}
+
 // ../../packages/prompts/src/index.ts
 import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { dirname as dirname2, join } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../../packages/protocol/src/cron.ts
 var uintPattern = /^\d+$/;
@@ -39891,6 +39911,86 @@ var toolGrantsAgentUpdateOutputSchema = external_exports.object({
 }).strict();
 var scopeDigestSchema = external_exports.string().regex(/^sha256:[0-9a-f]{64}$/);
 var classifierVersionSchema = external_exports.string().regex(/^[a-z][a-z0-9_.-]{0,79}$/);
+var toolGrantsTenantUpdateGrantInputSchema = external_exports.object({
+  tool_grant_id: uuidSchema5,
+  max_access_level: capabilityGrantAccessLevelSchema,
+  default_agent_access_level: capabilityGrantAccessLevelSchema.optional()
+}).strict();
+var toolGrantsTenantUpdateInputSchema = external_exports.object({
+  expected_policy_version: external_exports.number().int().nonnegative().optional(),
+  expected_policy_digest: scopeDigestSchema.optional(),
+  mode: external_exports.enum(["managed", "open"]),
+  grants: external_exports.array(toolGrantsTenantUpdateGrantInputSchema).max(50).default([])
+}).strict().superRefine((value, ctx) => {
+  if (value.expected_policy_version === void 0 && value.expected_policy_digest === void 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Provide expected_policy_version or expected_policy_digest.",
+      path: ["expected_policy_version"]
+    });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, grant] of value.grants.entries()) {
+    if (seen.has(grant.tool_grant_id)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Duplicate tool_grant_id values are not allowed.",
+        path: ["grants", index, "tool_grant_id"]
+      });
+      continue;
+    }
+    seen.add(grant.tool_grant_id);
+    if (grant.default_agent_access_level !== void 0) {
+      const levels = capabilityGrantAccessLevelSchema.options;
+      const maxRank = levels.indexOf(grant.max_access_level);
+      const defaultRank = levels.indexOf(grant.default_agent_access_level);
+      if (defaultRank > maxRank) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: "default_agent_access_level cannot exceed max_access_level.",
+          path: ["grants", index, "default_agent_access_level"]
+        });
+      }
+    }
+  }
+});
+var toolGrantsTenantUpdateGrantResultSchema = external_exports.object({
+  tool_grant_id: uuidSchema5,
+  capability_id: external_exports.string().min(1),
+  max_access_level: capabilityGrantAccessLevelSchema,
+  default_agent_access_level: capabilityGrantAccessLevelSchema
+}).strict();
+var toolGrantsTenantUpdateAgentImpactSchema = external_exports.object({
+  agent_id: uuidSchema5,
+  seat_id: uuidSchema5,
+  capability_ids: external_exports.array(external_exports.string().min(1)).min(1)
+}).strict();
+var toolGrantsTenantUpdateOutputSchema = external_exports.object({
+  policy: external_exports.object({
+    mode: external_exports.enum(["managed", "open"]),
+    version: external_exports.number().int().nonnegative(),
+    digest: scopeDigestSchema
+  }).strict(),
+  changed_grants: external_exports.array(toolGrantsTenantUpdateGrantResultSchema),
+  clamped_defaults: external_exports.array(toolGrantsTenantUpdateGrantResultSchema),
+  affected_live_agents: external_exports.array(toolGrantsTenantUpdateAgentImpactSchema)
+}).strict();
+var executableHandlerCoverageItemSchema = external_exports.object({
+  tool_name: external_exports.string().min(1),
+  implemented: external_exports.boolean()
+}).strict();
+var executableHandlerCoverageInputSchema = external_exports.object({
+  registry_tool_names: external_exports.array(external_exports.string().min(1)).default([]),
+  catalog_tool_names: external_exports.array(external_exports.string().min(1)).default([]),
+  required_tool_names: external_exports.array(external_exports.string().min(1)).default([])
+}).strict();
+var executableHandlerCoverageOutputSchema = external_exports.object({
+  coverage_digest: scopeDigestSchema,
+  covered_tool_names: external_exports.array(external_exports.string().min(1)),
+  missing_registry_tool_names: external_exports.array(external_exports.string().min(1)),
+  missing_catalog_tool_names: external_exports.array(external_exports.string().min(1)),
+  items: external_exports.array(executableHandlerCoverageItemSchema)
+}).strict();
 var agentActivationReceiptInputSchema = external_exports.object({
   agent_id: uuidSchema5,
   proposed_budget_cents: external_exports.number().int().nonnegative().max(1e7).optional()
@@ -42457,6 +42557,14 @@ var tenantAnthropicKeySaveInputSchema = external_exports.object({
 var tenantAnthropicKeySaveOutputSchema = external_exports.object({
   stored: external_exports.literal(true)
 }).strict();
+var tenantAnthropicKeyDisableInputSchema = external_exports.object({}).strict();
+var tenantAnthropicKeyDisableOutputSchema = external_exports.object({
+  tenant_id: uuidSchema11,
+  credential_id: uuidSchema11.nullable(),
+  disabled: external_exports.boolean(),
+  already_disabled: external_exports.boolean(),
+  managed_fallback_ready: external_exports.boolean()
+}).strict();
 var seatCreateInputSchema = external_exports.object({
   name: external_exports.string().trim().min(1).max(120),
   parent_seat_id: uuidSchema11.nullable().optional(),
@@ -42781,6 +42889,7 @@ var markNotificationsReadRequestSchema = external_exports.object({
 
 // ../../packages/protocol/src/product-analytics.ts
 var uuidSchema12 = external_exports.string().uuid();
+var opaqueRequestIdSchema = external_exports.string().trim().min(1).max(240);
 var safeNameSchema = external_exports.string().trim().min(1).max(120).regex(/^[a-z][a-z0-9._:-]*$/);
 var safeSurfaceSchema = external_exports.string().trim().min(1).max(80).regex(/^[a-z][a-z0-9_-]*$/);
 var routeSegmentSchema = /^(?:[a-z][a-z0-9-]{0,31}|:[a-z][a-z0-9_]{0,31}|\*)$/;
@@ -42866,15 +42975,21 @@ var commandInvocationInputSchema = external_exports.object({
   tenant_id: uuidSchema12,
   user_id: uuidSchema12.optional(),
   seat_id: uuidSchema12.optional(),
+  run_id: uuidSchema12.optional(),
+  agent_turn_execution_id: uuidSchema12.optional(),
+  session_id: uuidSchema12.optional(),
   command_id: safeNameSchema,
   source: analyticsSourceSchema,
   actor_kind: external_exports.enum(["user", "agent", "system"]),
+  execution_lane: external_exports.enum(["chat", "run", "mcp_session", "runner", "system"]).optional(),
+  initiator_kind: external_exports.enum(["user", "agent", "system"]).optional(),
+  initiator_user_id: uuidSchema12.nullable().optional(),
   scope_kind: external_exports.enum(["tenant_admin", "tenant", "seat"]),
   status: commandInvocationStatusSchema,
   guard_result: external_exports.enum(["allowed", "denied_manifest", "denied_budget", "escalated", "denied_tenant_policy"]).optional(),
   duration_ms: durationMsSchema,
   confirmation_required: external_exports.boolean().optional(),
-  request_id: uuidSchema12.optional(),
+  request_id: opaqueRequestIdSchema.optional(),
   properties: analyticsPropertiesSchema.optional(),
   occurred_at: external_exports.string().datetime({ offset: true }).optional()
 }).strict().superRefine((value, ctx) => {
@@ -43343,8 +43458,8 @@ var seatTrustSummarySchema = external_exports.object({
   run_count: external_exports.number().int().nonnegative(),
   failed_run_count: external_exports.number().int().nonnegative(),
   tool_call_count: external_exports.number().int().nonnegative(),
-  // The hero metric: actions held this period because they exceeded the charter.
   denied_tool_call_count: external_exports.number().int().nonnegative(),
+  held_tool_call_count: external_exports.number().int().nonnegative(),
   last_activity_at: isoDateTime4.nullable()
 }).strict();
 var agentListRunsInputSchema = external_exports.object({
@@ -43372,6 +43487,7 @@ var seatRunSchema = external_exports.object({
   cost_usd: external_exports.string(),
   tool_call_count: external_exports.number().int().nonnegative(),
   denied_tool_call_count: external_exports.number().int().nonnegative(),
+  held_tool_call_count: external_exports.number().int().nonnegative(),
   skill_activation_count: external_exports.number().int().nonnegative()
 }).strict();
 var seatRunErrorLogSchema = runErrorLogSchema.extend({
@@ -43677,6 +43793,34 @@ var runnerExecutionReadinessSchema = external_exports.object({
   recent_completed_at: isoDateTime6.nullable(),
   recent_failed_at: isoDateTime6.nullable()
 }).strict();
+var runnerClaimabilityCheckSchema = external_exports.object({
+  key: external_exports.string(),
+  actual: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]),
+  required: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]),
+  passed: external_exports.boolean(),
+  remediation: external_exports.string()
+}).strict();
+var runnerClaimabilityExplainSchema = external_exports.object({
+  claimable: external_exports.boolean(),
+  build_claimable: external_exports.boolean(),
+  merge_claimable: external_exports.boolean(),
+  checks: external_exports.array(runnerClaimabilityCheckSchema),
+  hold_reasons: external_exports.array(external_exports.enum([
+    "dependency",
+    "serial",
+    "evidence",
+    "human",
+    "runner_capability",
+    "runner_version",
+    "runner_sandbox",
+    "capacity",
+    "schedule",
+    "paused",
+    "policy",
+    "unknown"
+  ])),
+  remediation: external_exports.string()
+}).strict();
 var runnerSandboxPostureSchema = external_exports.enum(["guard", "strict", "off", "none", "unknown"]);
 var runnerPostureSchema = external_exports.object({
   sandbox: runnerSandboxPostureSchema,
@@ -43777,6 +43921,7 @@ var runnerDiagnoseOutputSchema = external_exports.object({
   last_heartbeat_at: isoDateTime6.nullable(),
   paired_at: isoDateTime6.nullable(),
   revocation_state: external_exports.enum(["active", "revoked", "unpaired"]),
+  claimability: runnerClaimabilityExplainSchema,
   repair_guidance: external_exports.array(external_exports.object({
     action: external_exports.string(),
     command: external_exports.string(),
@@ -44626,6 +44771,62 @@ var softwarePhaseSchedulerStateSchema = external_exports.object({
   remediation_href: external_exports.string().nullable(),
   work_order_id: uuid11.nullable()
 });
+var softwareDispatchHoldReasonSchema = external_exports.enum([
+  "dependency",
+  "serial",
+  "evidence",
+  "human",
+  "runner_capability",
+  "runner_version",
+  "runner_sandbox",
+  "capacity",
+  "schedule",
+  "paused",
+  "policy",
+  "unknown"
+]);
+var softwareDispatchPreviewRunnerRequirementSchema = external_exports.object({
+  profile: external_exports.enum(["forge_build", "forge_merge", "grooming"]),
+  min_cli_version: external_exports.string().nullable(),
+  min_merge_version: external_exports.string().nullable(),
+  sandbox_postures: external_exports.array(external_exports.enum(["guard", "strict"]))
+}).strict();
+var softwareDispatchPreviewItemSchema = external_exports.object({
+  kind: external_exports.enum(["changeset", "task"]),
+  id: uuid11,
+  ordinal: external_exports.number().int().positive(),
+  title: external_exports.string(),
+  changeset_ordinal: external_exports.number().int().positive().nullable(),
+  task_key: external_exports.string().nullable(),
+  depends_on: external_exports.array(external_exports.string()),
+  parallelizable: external_exports.boolean(),
+  est_turns: external_exports.number().int().nullable(),
+  hold_reason: softwareDispatchHoldReasonSchema.nullable(),
+  hold_detail: external_exports.string().nullable()
+}).strict();
+var softwareDispatchPreviewSchema = external_exports.object({
+  status: external_exports.enum(["ready", "grooming", "held"]),
+  digest: external_exports.string().min(1),
+  expires_at: external_exports.string(),
+  included_order: external_exports.array(softwareDispatchPreviewItemSchema),
+  held_items: external_exports.array(softwareDispatchPreviewItemSchema),
+  dependencies: external_exports.array(external_exports.object({
+    from_task_key: external_exports.string(),
+    to_task_key: external_exports.string()
+  }).strict()).default([]),
+  serial_lanes: external_exports.array(external_exports.string()).default([]),
+  estimated_turns: external_exports.number().int().nullable(),
+  runner_requirements: softwareDispatchPreviewRunnerRequirementSchema,
+  authority_budget_envelope: external_exports.object({
+    automation_mode: softwareAutomationModeSchema,
+    inferred_risk: softwareRiskLevelSchema,
+    max_iterations: external_exports.number().int().nullable(),
+    max_wall_clock_seconds: external_exports.number().int().nullable(),
+    cost_budget_usd: external_exports.string().nullable()
+  }).strict(),
+  grooming_required: external_exports.boolean(),
+  grooming_reason: external_exports.string().nullable()
+}).strict();
 var softwareBuildRequestSummarySchema = external_exports.object({
   id: uuid11,
   software_project_id: uuid11,
@@ -44695,6 +44896,30 @@ var softwareTaskSummarySchema = external_exports.object({
   completed_at: external_exports.string().nullable(),
   created_at: external_exports.string()
 });
+var softwarePlanArtifactTaskSummarySchema = external_exports.object({
+  task_key: external_exports.string(),
+  title: external_exports.string(),
+  depends_on: external_exports.array(external_exports.string()).default([]),
+  parallelizable: external_exports.boolean().default(false),
+  est_turns: external_exports.number().int().nullable().default(null),
+  files_likely: external_exports.array(external_exports.string()).default([]),
+  verification: external_exports.array(external_exports.string()).default([])
+});
+var softwarePlanArtifactChangesetSummarySchema = external_exports.object({
+  ordinal: external_exports.number().int(),
+  title: external_exports.string(),
+  split_criterion: external_exports.string(),
+  task_keys: external_exports.array(external_exports.string()).default([])
+});
+var softwarePlanArtifactSummarySchema = external_exports.object({
+  scope: external_exports.string(),
+  plan_steps: external_exports.array(external_exports.string()).default([]),
+  files_or_systems: external_exports.array(external_exports.string()).default([]),
+  verification: external_exports.array(external_exports.string()).default([]),
+  risks: external_exports.array(external_exports.string()).default([]),
+  tasks: external_exports.array(softwarePlanArtifactTaskSummarySchema).default([]),
+  changesets: external_exports.array(softwarePlanArtifactChangesetSummarySchema).default([])
+});
 var softwarePlanVersionSummarySchema = external_exports.object({
   id: uuid11,
   build_request_id: uuid11,
@@ -44707,6 +44932,7 @@ var softwarePlanVersionSummarySchema = external_exports.object({
     question: external_exports.string(),
     answer: external_exports.string()
   })).default([]),
+  planning_artifact: softwarePlanArtifactSummarySchema.nullable(),
   created_by_seat_id: uuid11.nullable(),
   created_at: external_exports.string()
 });
@@ -44821,7 +45047,8 @@ var softwareRequestShowOutputSchema = external_exports.object({
   gates: external_exports.array(softwareGateSummarySchema),
   plan_versions: external_exports.array(softwarePlanVersionSummarySchema),
   changesets: external_exports.array(softwareChangesetSummarySchema),
-  tasks: external_exports.array(softwareTaskSummarySchema)
+  tasks: external_exports.array(softwareTaskSummarySchema),
+  dispatch_preview: softwareDispatchPreviewSchema.nullable()
 });
 var softwareRequestLifecycleReason = external_exports.string().trim().min(1).max(2e3);
 var softwareRequestPauseInputSchema = external_exports.object({
@@ -45786,6 +46013,7 @@ var syncBriefAgentActivitySchema = external_exports.object({
   failed_run_count: external_exports.number().int().nonnegative(),
   tool_call_count: external_exports.number().int().nonnegative(),
   denied_tool_call_count: external_exports.number().int().nonnegative(),
+  held_tool_call_count: external_exports.number().int().nonnegative().optional(),
   cost_usd: external_exports.number().nonnegative(),
   note: external_exports.string().min(1)
 }).strict();
@@ -46534,7 +46762,7 @@ var eventEnvelopeReaderSchema = external_exports.discriminatedUnion("type", [
 ]);
 
 // ../../packages/prompts/src/index.ts
-var promptRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "prompts");
+var promptRoot = join(dirname2(fileURLToPath2(import.meta.url)), "..", "prompts");
 function loadPromptBody(filename) {
   const raw = readFileSync(join(promptRoot, filename), "utf8");
   return raw.replace(/^---\n[\s\S]*?\n---\n?/, "").trim();
@@ -46895,7 +47123,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-14.1",
+    version: "2026-07-14.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -46943,7 +47171,7 @@ Seats that do not reach the single root through the resolved parent chain are li
 
 ## Forge Developer Team seats are pinned
 
-Seats under \`forge.developer_team\` are resolved by Forge build dispatch using their exact path, so they cannot be reparented or merged from the graph, CLI, or MCP \u2014 moving a seat (or an ancestor whose subtree holds them) would eject them from dispatch, and no command can restore the path. To change who is accountable for one of these seats, update its steward with \`agent_setup.update\`; the reporting path stays fixed. To stand the team down, use the governed Forge team teardown flow, not a merge or decommission.
+Seats under \`forge.developer_team\` are resolved by Forge build dispatch using their exact path, so they cannot be reparented or merged from the graph, CLI, or MCP \u2014 moving a seat (or an ancestor whose subtree holds them) would eject them from dispatch, and no command can restore the path. To change who is accountable for one of these seats, update its steward with \`agent_setup.update\`; the reporting path stays fixed. To stand the team down, use the governed Forge team teardown flow, not a merge or decommission. The web canvas surfaces this pin visibly: a lock badge on the seat card (Responsibility Chart and Cascade views) and in the seat inspector panel, with a tooltip explaining the seat can't be moved, merged, or reparented \u2014 so the restriction is visible before a user hits the guard, not only as an error after the fact.
 
 ## Add an agent from the graph
 
@@ -47134,7 +47362,7 @@ Drafting can be assisted by agents. Activation is a human decision. When authori
     order: 40,
     title: "Agent staffing playbook",
     summary: "How to decide whether a seat should be human, agent, or hybrid, and how to go live safely.",
-    version: "2026-07-14.1",
+    version: "2026-07-14.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -47193,7 +47421,7 @@ Two creation paths, both draft-first. Read the stock-agents guide for templates
 - Custom: \`agent_setup.start\` / \`rost_start_agent_setup\` (returns a \`setup_id\`), iterate with \`agent_setup.get\` and \`agent_setup.update\`, then \`agent.create_custom\` / \`rost_create_custom_agent\`. Stage tools with \`agent.configure_tools\` (vault refs only) and sandbox with \`agent.run_dry_run\`.
 - Inspect runtime: \`agent.status\` / \`rost_get_agent_status\` with \`{"seat_id":"<seat-id>"}\` returns lane, live state, steward chain, dry-run result, and Runner availability.
 - Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. The command is ungated but still requires a live staffed agent and the normal server-side tool guard.
-- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include a \`denied_tool_call_count\` rollup \u2014 the actions held because they exceeded the charter. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card, and its Activity tab additionally renders the full persisted transcript and artifacts rail for a selected session inline (no \`--transcript\` flag needed there) alongside the business-activity ledger (\`work.record\`/\`work.list\`) \u2014 counter tiles and a run-grouped feed with each record's verb, object, outcome, evidence, and \`template_ref\` when one was used.
+- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call, guard-denied, and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include \`denied_tool_call_count\` and \`held_tool_call_count\` rollups: hard guard denials stay separate from actions escalated for review. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card, and its Activity tab additionally renders the full persisted transcript and artifacts rail for a selected session inline (no \`--transcript\` flag needed there) alongside the business-activity ledger (\`work.record\`/\`work.list\`) \u2014 counter tiles and a run-grouped feed with each record's verb, object, outcome, evidence, and \`template_ref\` when one was used.
 
 ## Review readiness before go-live
 
@@ -47721,7 +47949,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-15.2",
+    version: "2026-07-15.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -47794,7 +48022,9 @@ External connectors are being rolled out provider by provider, conservatively (r
       "error_log.resolve",
       "error_log.supersede",
       "runner.diagnose",
-      "runner.repair"
+      "runner.repair",
+      "tenant.anthropic_key.disable",
+      "tool_grants.tenant.update"
     ],
     legal: {
       publicRisk: "low",
@@ -47835,7 +48065,7 @@ A headless agent cannot complete setup unattended. Two things always require a h
 
 Treat these as blocking prerequisites: the agent prepares the request and waits for the human approver.
 
-- **Secrets never travel through the CLI.** Raw-secret sinks (\`credential.ingress\`, \`tenant.anthropic_key.save\`) are refused on every CLI path \u2014 an ergonomic verb, \`--input\`, and \`{{cli}} command <id> --json\` all stop with guidance instead of accepting the secret, because a value in argv lands in shell history and process arguments before any redaction. Provide the secret through the vault-backed flow (web Settings or the integration connect flow); the CLI only ever carries the non-secret credential *name*, scope, and provider.
+- **Secrets never travel through the CLI.** Raw-secret sinks (\`credential.ingress\`, \`tenant.anthropic_key.save\`) are refused on every CLI path \u2014 an ergonomic verb, \`--input\`, and \`{{cli}} command <id> --json\` all stop with guidance instead of accepting the secret, because a value in argv lands in shell history and process arguments before any redaction. Provide the secret through the vault-backed flow (web Settings or the integration connect flow); the CLI only ever carries the non-secret credential *name*, scope, and provider. Disabling tenant BYOK (\`tenant.anthropic_key.disable\`) never returns the old key; it revokes the active vault-backed credential only after managed Anthropic fallback is available.
 
 ## Placeholder legend
 
@@ -48086,7 +48316,7 @@ A leaked tenant-admin token can administer the whole tenant, not just one seat.
 
 ### Storing the Anthropic key and other credentials
 
-Storing the tenant model key or any other secret goes through **credential ingress** as a vault reference \u2014 the secret is never pasted into a prompt, config, or log. Use \`rost_save_tenant_anthropic_key\` (\`tenant.anthropic_key.save\`) for the tenant Anthropic key; other secrets go through the Settings vault-ingress flow (\`credential.ingress\`), a human-only interactive flow that is deliberately not an agent-callable MCP tool and refuses raw secrets over CLI argv. \`rost_configure_agent_tools\` stages credential *requests* (provider, scope, and label only) but never accepts raw secrets. Credential storage is a gated \`credential_flow\` confirmation that a human approves. For the vault model and the security posture behind this, see the security-model-guide and the tool-access-and-vault guide; for model-bound data, BYOK provider handling, and local-client provider settings, see the ai-model-data-handling-guide; for the confirmation gate, see the confirmations-guide.
+Storing the tenant model key or any other secret goes through **credential ingress** as a vault reference \u2014 the secret is never pasted into a prompt, config, or log. Use \`rost_save_tenant_anthropic_key\` (\`tenant.anthropic_key.save\`) for the tenant Anthropic key; other secrets go through the Settings vault-ingress flow (\`credential.ingress\`), a human-only interactive flow that is deliberately not an agent-callable MCP tool and refuses raw secrets over CLI argv. Disabling the tenant Anthropic key uses \`tenant.anthropic_key.disable\`: it is owner/admin-only, always human-gated, revokes the active credential row without reading or returning secret material, and first checks that managed Anthropic fallback is configured. \`rost_configure_agent_tools\` stages credential *requests* (provider, scope, and label only) but never accepts raw secrets. Credential storage is a gated \`credential_flow\` confirmation that a human approves. For the vault model and the security posture behind this, see the security-model-guide and the tool-access-and-vault guide; for model-bound data, BYOK provider handling, and local-client provider settings, see the ai-model-data-handling-guide; for the confirmation gate, see the confirmations-guide.
 
 ## When to use MCP or CLI
 
@@ -48185,7 +48415,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} escalation list|get|resolve|reject\` | \`escalation.list\`, \`escalation.get\`, \`escalation.resolve\`, \`escalation.reject\` | Work the steward escalation queue. | Steward | \`{{cli}} escalation list --json\` |
 | \`{{cli}} error list|resolve|supersede\` | \`error_log.list\`, \`error_log.resolve\`, \`error_log.supersede\` | List active, acknowledged, resolved, or superseded product error logs and let a human acknowledge, resolve, or supersede stale errors with evidence links. | Tenant | \`{{cli}} error list --resolved active --json\`; \`{{cli}} error resolve --error-log-id <id> --reason "Fixed in PR #123"\` |
 | \`{{cli}} sync brief|compile|complete\` | \`sync.brief.get\`, \`sync.brief.compile\`, \`sync.run.complete\` | Compile, read, and complete a weekly Sync. | Tenant | \`{{cli}} sync brief --json\` |
-| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect heartbeat and execute-readiness evidence, inspect work orders, diagnose offline runners, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
+| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect heartbeat and execute-readiness evidence, inspect work orders, diagnose offline runners, explain claimability gates, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
 | \`{{cli}} runner install-service|start|stop|restart|status|logs|uninstall --name <name> [--user-code <code>]\` | launchd/service manager (macOS today) + \`{{cli}} runner serve\` | Install and manage an always-on local runner service that keeps the runner online across reboots. The service runs the runner under the absolute Node binary with an explicit PATH (so it works under nvm/Homebrew) and bootstraps into whichever launchd domain the session supports. Pass \`--user-code\` to pair the service at install; otherwise install prints the exact command to pair it. No secret is stored in the service definition, its arguments, or logs. Non-macOS emits an explicit unsupported message. | Tenant (local machine) | \`{{cli}} runner install-service --name mac-mini --execute --user-code ABCD-EFGH\`; \`{{cli}} runner logs --name mac-mini\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` / credential flow for Baserow REST connect | \`integration.connect_rest\`, \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | Create a vault-backed Baserow REST integration through the credential flow, list connector metadata, read setup-readiness, read one connector's health, and run provider-specific tests without exposing credentials. | Tenant-admin for connect; tenant for reads/tests | \`{{cli}} integration readiness --provider google --json\` |
@@ -48206,7 +48436,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} deliverable list|get|create|attach\` | \`deliverable.list\`, \`deliverable.get\`, \`deliverable.create\`, \`deliverable.attach\` | List, get, create, or attach agent deliverables for a seat. Deliverables are durable work outputs visible across UI, CLI, and MCP. | Tenant (list/get), Seat (create/attach) | \`{{cli}} deliverable list --seat-id <id> --json\`; \`{{cli}} deliverable create --title "Brief" --kind brief\` |
 | \`{{cli}} graph show\` | \`graph.get\` | Print a table view of the Responsibility Graph with explicit \`seat_id\` and \`parent_seat_id\` columns. | Tenant | \`{{cli}} graph show\` |
 | \`{{cli}} seat list|get|create|rename|reparent|decommission\` | \`graph.get\`, \`seat.get\`, \`seat.create\`, \`seat.rename\`, \`seat.reparent\`, \`seat.decommission\`, \`seat.decommission_preview\` | Work with seats as first-class CLI primitives. \`seat decommission --dry-run\` previews affected occupancies, agents, Charters, tokens, credentials, work orders, and schedules before the human-gated teardown. | Tenant / Seat for targeted mutations | \`{{cli}} seat list\`; \`{{cli}} seat decommission --seat-id <id> --dry-run\` |
-| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Request create/list/show return \`scheduler_state\`: \`queued\` when a runner work order exists, \`parked\` when the Forge team is staffed but no paired online runner can claim it, and \`not_configured\` when the runner-lane Forge Seat is missing. Parked and not-configured states link to \`/settings/runners/setup\`; runner pairing or the repair sweep re-enqueues the same pending intake idempotently. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --project <slug-or-name> --title "Add invoice export"\` (accepts \`--software-project-id <id>\` instead of \`--project\` too); \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
+| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Request create/list/show return \`scheduler_state\`: \`queued\` when a runner work order exists, \`parked\` when the Forge team is staffed but no paired online runner can claim it, and \`not_configured\` when the runner-lane Forge Seat is missing. Request detail also surfaces the signed, expiring dispatch preview with included order, held items, dependencies, estimated turns, runner requirements, and authority budget envelope. Parked and not-configured states link to \`/settings/runners/setup\`; runner pairing or the repair sweep re-enqueues the same pending intake idempotently. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --project <slug-or-name> --title "Add invoice export"\` (accepts \`--software-project-id <id>\` instead of \`--project\` too); \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
 
 Skills wrapper help:
 
@@ -48239,6 +48469,7 @@ Skills wrapper help:
 | \`{{cli}} mcp install --client cursor --scope tenant-admin\` | Mint a tenant-admin MCP token and print Cursor JSON. | Tenant | \`{{cli}} mcp install --client cursor --scope tenant-admin\` |
 | \`{{cli}} mcp install --client <client> --scope seat --seat-id <seat-id>\` | Mint a token limited to one seat (the narrowest scope \u2014 prefer for day-to-day). | Seat | \`{{cli}} mcp install --client codex --scope seat --seat-id <seat-id>\` |
 | \`{{cli}} --help\` | Print top-level CLI help. | Public help | \`{{cli}} --help\` |
+| \`{{cli}} --version\` / \`{{cli}} -v\` | Print the installed CLI's own version and exit \u2014 no usage text, no auth. | Public help | \`{{cli}} --version\` |
 
 ## MCP tool and resource catalog
 
@@ -48285,6 +48516,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_upload_org_context\` | \`onboarding.upload_context\` | Back-compat alias of \`onboarding.attach_reference\`. | Tenant | Prefer \`rost_attach_reference_document\`; same widened schema. |
 | \`rost_create_onboarding_invite\` | \`onboarding.create_invite\` | Invite a team member during onboarding. | Tenant | Call with a business email and role. |
 | \`rost_save_tenant_anthropic_key\` | \`tenant.anthropic_key.save\` | Store a tenant model key through the vault. | Tenant | Use only with a real human-provided secret. |
+| \`rost_disable_tenant_anthropic_key\` | \`tenant.anthropic_key.disable\` | Revoke the active tenant Anthropic BYOK credential after managed fallback is available. | Tenant-admin | Human-gated; call with \`{}\`. The old key value is never returned. |
 | \`rost_create_seat\` | \`seat.create\` | Create a Responsibility Graph seat. | Tenant | Call with \`{"name":"Finance","seat_type":"human"}\`. |
 | \`rost_rename_seat\` | \`seat.rename\` | Rename a seat. | Seat or tenant-admin | Call with \`seat_id\` and \`name\`. |
 | \`rost_reparent_seat\` | \`seat.reparent\` | Move a seat under a new parent. | Seat or tenant-admin | Call with \`seat_id\` and \`parent_seat_id\`. |
@@ -48324,7 +48556,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_get_dogfood_fleet_health_digest\` | \`agent.fleet_digest\` | Capture the daily dogfood fleet-health digest: live/idle state, 24h/7d turns, spend, recent failed runs, unresolved errors, failed notifications, and next actions. | Tenant | Call with \`{}\`; optional \`window_hours\` bounds recent failed-run evidence, while \`error_limit\` caps linked evidence per seat. |
 | \`rost_system_health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | Call with \`{}\`; optional \`seat_id\` narrows inside the caller's server-derived scope. |
 | \`rost_run_agent_now\` | \`agent.run_now\` | Queue an immediate run for a live staffed agent without changing its saved schedule; cloud lane dispatches to the executor and runner lane queues for the paired runner. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
-| \`rost_list_agent_runs\` | \`agent.list_runs\` | Read a seat's agent run history (status, lane, model, cost, per-run Skill activation, tool-call, and guard-held counts) plus the seat's run/tool-call rollup including held-action count. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`limit\` for a deeper window. |
+| \`rost_list_agent_runs\` | \`agent.list_runs\` | Read a seat's agent run history (status, lane, model, cost, per-run Skill activation, tool-call, guard-denied, and guard-held counts) plus the seat's run/tool-call rollup including held-action count. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`limit\` for a deeper window. |
 | \`rost_get_agent_run_diagnostics\` | \`agent.get_run\` | Read one run's diagnostic record: transcript reference, token/cost usage, outcome, linked product-visible run errors, and loaded Skill activation file metadata. File hashes/sizes identify the immutable source package, while model prompt text may be bounded or truncated. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>","run_id":"<run-id>"}\`. |
 | \`rost_list_agent_tool_calls\` | \`agent.list_tool_calls\` | Read a seat's tool-call ledger (tool name, guard result, manifest clause, outcome) with the held-action count as the hero metric. Never returns argument summaries or secret material. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`held_only: true\` for only guard-held calls. |
 | \`rost_list_agent_deliverables\` | \`deliverable.list\` | List durable agent deliverables for a seat, including explicit outputs and successful-run summaries. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
@@ -48348,7 +48580,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_mcp_tokens\` | \`mcp_token.list\` | List MCP token metadata (never token material). | Tenant | Call with \`{}\` or \`{"include_revoked":true}\`. |
 | \`rost_list_runners\` | \`runner.list\` | List local runners with heartbeat health, execution readiness, queue counts, and recent result evidence. | Tenant | Call with \`{}\`. |
 | \`rost_runner_status\` | \`runner.status\` | Read a single runner's capability, heartbeat health, and execute-readiness state. | Tenant | Call with \`runner_id\`. |
-| \`rost_diagnose_runner\` | \`runner.diagnose\` | Return runner health, capabilities, and repair guidance without secrets. | Tenant | Call with \`runner_id\`; actionable repair guidance exposes restart, re-pair, or missing CLI steps. |
+| \`rost_diagnose_runner\` | \`runner.diagnose\` | Return runner health, claimability checks, capabilities, and repair guidance without secrets. | Tenant | Call with \`runner_id\`; claimability exposes safe predicates, required vs actual values, pass/fail state, and remediation for claimable work. |
 | \`rost_runner_repair_guidance\` | \`runner.repair\` | Return focused repair steps for a runner: restart, re-pair, revoke stale, or install missing CLI runtime. | Tenant | Call with \`runner_id\` and optional \`issue\` (restart, re_pair, revoke_stale, missing_cli_runtime). |
 | \`rost_start_runner_pairing\` | \`runner.pairing.start\` | Open a runner pairing session and return the human pairing code. | Tenant-admin | Call with \`name\` and \`platform\`; owner/admin only. |
 | \`rost_revoke_runner\` | \`runner.revoke\` | Revoke a runner so it can no longer authenticate. | Tenant | Call with \`runner_id\`; expect human confirmation. |
@@ -48437,6 +48669,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_show_agent_setup_as_markdown\` | \`agent.show_markdown\` | Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_list_tool_catalog\` | \`tool.catalog\` | List the discoverable tool catalog the agent builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance. | Tenant | Call with \`{}\` or \`{"provider":"google"}\`. |
 | \`rost_list_tenant_capability_grants\` | \`tool_grants.tenant.list\` | List tenant capability ceilings/defaults with connection, availability, source, and compile status. | Tenant | Call with \`{}\`; no secrets or vault refs. |
+| \`rost_update_tenant_capability_policy\` | \`tool_grants.tenant.update\` | Change tenant-wide capability ceilings/defaults with optimistic policy version or digest protection. | Tenant-admin | Human-gated; call with \`expected_policy_version\` or \`expected_policy_digest\`, \`mode\`, and grant ceiling changes. Returns changed grants, clamped defaults, and affected live agents. |
 | \`rost_list_agent_effective_capability_grants\` | \`tool_grants.agent.effective\` | Read one agent's effective capability grants after tenant ceilings, agent selections, and compile availability are applied. | Tenant | Call with \`{"agent_id":"<agent-id>"}\`. |
 | \`rost_update_agent_capability_grants\` | \`tool_grants.agent.update\` | Compile a Charter supersession proposal for agent capability grant reductions or expansions. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>","grants":[{"tool_grant_id":"<grant-id>","access_level":"read"}]}\`; active authority changes only after the signed Charter is superseded. |
 | \`rost_build_agent_activation_receipt\` | \`agent.activation_receipt\` | Build the current activation receipt for an agent: capabilities, connection metadata, digest, budget, and always-human boundary. | Seat or tenant-admin | Call with \`{"agent_id":"<agent-id>"}\`; rebuild after Charter, connection, lane, schedule, or grant changes. |
@@ -48471,7 +48704,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_resume_a_forge_build_request\` | \`software_factory.request.resume\` | Resume a paused or human-blocked Forge build request from the last completed task checkpoint and requeue the current phase. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Budget raised"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_forge_projects\` | \`software_factory.project.list\` | List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. | Tenant | Call with \`{}\`; use the returned \`id\` as \`software_project_id\`. |
 | \`rost_list_forge_build_requests\` | \`software_factory.request.list\` | The Forge control-room board: build requests with status, current phase, risk, and current \`scheduler_state\` remediation. Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"limit":20}\`. |
-| \`rost_show_a_forge_build_request\` | \`software_factory.request.show\` | The Forge request detail: the request, current phase, phase-run history, gates, and current \`scheduler_state\` remediation. Read-only; requires the Forge add-on. | Tenant | Call with \`{"build_request_id":"<request-id>"}\`. |
+| \`rost_show_a_forge_build_request\` | \`software_factory.request.show\` | The Forge request detail: the request, current phase, signed dispatch preview, phase-run history, gates, and current \`scheduler_state\` remediation. Read-only; requires the Forge add-on. | Tenant | Call with \`{"build_request_id":"<request-id>"}\`. |
 | \`rost_advance_a_forge_build_request_phase\` | \`software_factory.phase.advance\` | Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition. | Tenant | Call with \`{"build_request_id":"<request-id>","to_phase":"discovery_scoping"}\`. |
 | \`rost_decide_a_forge_gate\` | \`software_factory.gate.decide\` | A human approves or rejects a Forge gate; an agent caller routes to \`/approvals\` and can never self-approve. Sensitive gates record a linked human decision. | Tenant | Call with \`{"gate_id":"<gate-id>","decision":"approve"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_answer_forge_plan_clarifications\` | \`software_factory.request.answer_clarification\` | Write structured human answers to a draft plan's clarifying questions and optionally mark it ready for plan review; answers append to the versioned planning artifact and never widen authority or automation mode. | Tenant | Call with \`{"build_request_id":"<request-id>","answers":[{"question":"Which database?","answer":"Postgres"}],"mark_ready_for_plan_review":true}\`. |
@@ -50063,12 +50296,13 @@ Name the failing surface, collect evidence, recommend the smallest correction, a
     order: 78,
     title: "AI model data handling guide",
     summary: "How {{brand}} cloud agents, local MCP sessions, runners, BYOK, and connected tools handle model-bound data.",
-    version: "2026-07-01.3",
+    version: "2026-07-01.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing", "operating_rhythm"],
     relatedCommandIds: [
       "tenant.anthropic_key.save",
+      "tenant.anthropic_key.disable",
       "credential.ingress",
       "agent.configure_tools",
       "mcp_token.create",
@@ -50154,7 +50388,7 @@ Tenant BYOK changes which provider account is used for eligible \`cloud\` model
 
 {{brand}} also includes a capped, app-provided Claude allowance for agent-assisted setup so a new company can complete onboarding before saving its own key. That allowance is shown in the onboarding provider card and in Settings as an approximate number of included setup tokens \u2014 never a dollar amount \u2014 and is enforced server-side on every platform-key call: an agent turn or an org-intake step reserves the allowance before the provider request and settles actual usage after. When the included tokens are used, agent-assisted steps stop before calling the provider and prompt you to add your own Anthropic API key, while non-AI setup steps stay available. Saving a tenant Anthropic key (BYOK) switches those calls to your provider account and does not draw down the included allowance.
 
-Store a tenant Anthropic key only through \`tenant.anthropic_key.save\` / \`rost_save_tenant_anthropic_key\` or the generic credential ingress path. The key is handled as a vault-backed credential: {{brand}} stores a vault reference and safe metadata, not the raw key in prompts, config, logs, or command output. A human approves the credential flow.
+Store a tenant Anthropic key only through \`tenant.anthropic_key.save\` / \`rost_save_tenant_anthropic_key\` or the generic credential ingress path. Disable it through \`tenant.anthropic_key.disable\` or Settings, which revokes the active credential only after managed Anthropic fallback is configured and never reads or returns the old secret. The key is handled as a vault-backed credential: {{brand}} stores a vault reference and safe metadata, not the raw key in prompts, config, logs, or command output. A human approves the credential flow and the disable flow.
 
 After BYOK is saved, provider-side retention, training, regional, HIPAA, or zero-data-retention posture depends on that Anthropic organization, workspace, model, feature, and contract. Do not tell a customer "BYOK means zero retention" or "BYOK means no training" unless their provider arrangement actually says that.
 
@@ -50249,6 +50483,7 @@ When asked about AI data handling:
       "charter.sign_manifest",
       "credential.ingress",
       "tenant.anthropic_key.save",
+      "tenant.anthropic_key.disable",
       "runner.pairing.start",
       "agent.configure_tools",
       "agent.list_tool_calls",
@@ -51621,25 +51856,6 @@ function helpText() {
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import path2 from "node:path";
-
-// src/cli-version.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { dirname as dirname2, resolve } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-var packageMetadataSchema = external_exports.object({
-  version: external_exports.string()
-});
-async function readCliVersion() {
-  const packageJsonPath = resolve(dirname2(fileURLToPath2(import.meta.url)), "../package.json");
-  try {
-    const metadata = packageMetadataSchema.parse(JSON.parse(await readFile2(packageJsonPath, "utf8")));
-    return metadata.version;
-  } catch {
-    return null;
-  }
-}
-
-// src/update-check.ts
 var latestPackageSchema = external_exports.object({
   version: external_exports.string()
 });
@@ -51760,7 +51976,7 @@ var COMMAND_MANIFEST = [
   { "id": "agent.go_live", "namespace": "agent", "action": "go_live", "title": "Go live", "description": "Promote a dry-run agent seat to live after the human approval gate.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Move an agent live only after dry-run evidence, signed permissions, and a human Steward chain are clear.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc" } },
   { "id": "agent.import_definition", "namespace": "agent", "action": "import_definition", "title": "Import agent definition", "description": "Import a versioned ROST agent definition into a canonical draft Seat and setup state without credentials, placement identifiers, or go-live side effects.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "definition_json", "flag": "definition-json", "type": "string", "required": true }, { "name": "idempotency_key", "flag": "idempotency-key", "type": "string", "required": false }], "hasComplexInput": false, "help": "Import a strict, versioned ROST agent definition into a canonical draft Seat/setup. The file cannot carry credentials or tenant-local placement ids; tools remain proposal-only until reviewed through setup." },
   { "id": "agent.list_fleet", "namespace": "agent", "action": "list_fleet", "title": "List agent fleet", "description": "Return every agent-occupied seat with lane, live state, last real turn, recent turn counts, top measurable status, open escalations, and 7-day real-run spend.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read every agent-occupied seat at once: lane, live state, last real turn, 24h/7d turns, measurable status, escalations, and spend." },
-  { "id": "agent.list_runs", "namespace": "agent", "action": "list_runs", "title": "List agent runs", "description": "Return a seat's agent run history (status, lane, model, cost, per-run tool-call and guard-denial counts) plus the seat's run/tool-call rollup with held-action count.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Audit a seat's agent run history with per-run tool-call and guard-held counts (the Trust Card)." },
+  { "id": "agent.list_runs", "namespace": "agent", "action": "list_runs", "title": "List agent runs", "description": "Return a seat's agent run history (status, lane, model, cost, per-run tool-call, guard-denied, and guard-held counts) plus the seat's run/tool-call rollup with held-action count.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Audit a seat's agent run history with per-run tool-call, guard-denied, and guard-held counts (the Trust Card)." },
   { "id": "agent.list_tool_calls", "namespace": "agent", "action": "list_tool_calls", "title": "List agent tool calls", "description": "Return a seat's tool-call ledger (tool name, guard result, manifest clause, outcome) with the held-action count as the hero metric. Pass held_only to return only guard-held calls. Never returns argument summaries or secret material.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }, { "name": "held_only", "flag": "held-only", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Audit a seat's tool-call ledger with each call's guard result; held actions are the hero metric." },
   { "id": "agent.pause", "namespace": "agent", "action": "pause", "title": "Pause agent", "description": "Pause a live agent so it stops scheduled and on-demand runs. Reversible with agent.resume.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Pause a live agent so it stops scheduled and on-demand runs; queued work orders are expired and a paused agent refuses to run until resumed. Reversible, unlike agent.decommission." },
   { "id": "agent.resume", "namespace": "agent", "action": "resume", "title": "Resume agent", "description": "Resume a paused agent back to live. Blocks if the steward chain no longer resolves to a human.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resume a paused agent back to live; the no-orphan guard blocks a resume whose steward chain no longer resolves to a human." },
@@ -51869,7 +52085,7 @@ var COMMAND_MANIFEST = [
   { "id": "onboarding.finish", "namespace": "onboarding", "action": "finish", "title": "Finish onboarding", "description": "Mark onboarding complete after the existing onboarding requirements pass.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Finish onboarding when the graph, at least one Charter, and the first operating rhythm are clear." },
   { "id": "onboarding.status", "namespace": "onboarding", "action": "status", "title": "Onboard status", "description": "Return current onboarding progress, graph summary, and the next recommended actions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Start by checking onboarding status, then use the implementation method guide to choose the next setup step." },
   { "id": "onboarding.upload_context", "namespace": "onboarding", "action": "upload_context", "title": "Upload org context", "description": "Compatibility alias for onboarding.attach_reference: attach a company reference document (text/markdown) that Compass and Charters can cite. Reference-only \u2014 it does not build a Compass.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "text", "flag": "text", "type": "string", "required": true }, { "name": "filename", "flag": "filename", "type": "string", "required": false }, { "name": "mime_type", "flag": "mime-type", "type": "enum", "required": false, "enumValues": ["text/plain", "text/markdown", "text/csv"] }, { "name": "title", "flag": "title", "type": "string", "required": false }, { "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["plan", "financial", "org_chart", "process"] }, { "name": "source", "flag": "source", "type": "string", "required": false }], "hasComplexInput": false, "help": "Compatibility alias for onboarding.attach_reference: attach a company reference document so Compass and Charters can cite it. It does not build a Compass.", "example": { "text": "# Company handbook\n\nWe build precision components for the aerospace supply chain.", "filename": "handbook.md", "mime_type": "text/markdown", "title": "Company handbook", "kind": "plan", "source": "handbook/overview.md" } },
-  { "id": "runner.diagnose", "namespace": "runner", "action": "diagnose", "title": "Diagnose runner", "description": "Returns a runner's health, capabilities, and repair guidance without exposing secrets.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Inspect a runner's health, capabilities, and get repair guidance without exposing secrets." },
+  { "id": "runner.diagnose", "namespace": "runner", "action": "diagnose", "title": "Diagnose runner", "description": "Returns a runner's health, capabilities, and repair guidance without exposing secrets.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Inspect a runner's health, claimability checks, and repair guidance without exposing secrets." },
   { "id": "runner.list", "namespace": "runner", "action": "list", "title": "List runners", "description": "List local runners registered to the tenant with online/offline/revoked state.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "include_revoked", "flag": "include-revoked", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "List local runners and their online/offline/revoked state before queueing runner work." },
   { "id": "runner.pairing.start", "namespace": "runner", "action": "pairing.start", "title": "Start runner pairing", "description": "Open a runner pairing session and return the human pairing code and URL. The runner bearer secret is never returned here.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "name", "flag": "name", "type": "string", "required": true }, { "name": "platform", "flag": "platform", "type": "string", "required": true }], "hasComplexInput": false, "help": "Open a runner pairing session and share the user code; the runner bearer secret is never surfaced here." },
   { "id": "runner.repair", "namespace": "runner", "action": "repair", "title": "Runner repair guidance", "description": "Returns actionable repair steps for a runner: restart, re-pair, revoke stale, or install missing CLI runtime. No secrets exposed.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": true }, { "name": "issue", "flag": "issue", "type": "enum", "required": false, "enumValues": ["restart", "re_pair", "revoke_stale", "missing_cli_runtime"] }], "hasComplexInput": false, "help": "Get focused repair steps for a runner: restart, re-pair, revoke a stale runner, or install missing CLI runtime." },
@@ -51954,7 +52170,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.request.list", "namespace": "software_factory", "action": "request.list", "title": "List Forge build requests", "description": "The Forge control-room board: the tenant's build requests with status, current phase, and risk/automation mode. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge build requests (the control-room board) with status, current phase, and risk. Read-only; requires the Forge add-on." },
   { "id": "software_factory.request.pause", "namespace": "software_factory", "action": "request.pause", "title": "Pause a Forge build request", "description": "Pause an in-flight Forge build request. New runner claims stop immediately; any running task halts at the next task checkpoint before resume. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Pause an in-flight Forge build request so no new runner work starts; running work stops at the next task checkpoint. Tenant-admin and human-gated." },
   { "id": "software_factory.request.resume", "namespace": "software_factory", "action": "request.resume", "title": "Resume a Forge build request", "description": "Resume a paused or human-blocked Forge build request from the last completed task checkpoint and requeue the current phase. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": true, "help": "Resume a paused or blocked Forge build request from its last completed task checkpoint after human review. Tenant-admin and human-gated." },
-  { "id": "software_factory.request.show", "namespace": "software_factory", "action": "request.show", "title": "Show a Forge build request", "description": "The Forge request detail: the build request, its current phase, phase-run history, and gates. Read-only, entitlement-gated, tenant-scoped.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Show a Forge build request's detail: current phase, phase-run history, and gates. Read-only; requires the Forge add-on." },
+  { "id": "software_factory.request.show", "namespace": "software_factory", "action": "request.show", "title": "Show a Forge build request", "description": "The Forge request detail: the build request, its current phase, phase-run history, and gates. Read-only, entitlement-gated, tenant-scoped.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Show a Forge build request's detail: current phase, dispatch preview, phase-run history, and gates. Read-only; requires the Forge add-on." },
   { "id": "software_factory.secret_request.list", "namespace": "software_factory", "action": "secret_request.list", "title": "List Forge secret requests", "description": "List durable Forge missing-secret/config requests. Metadata only; no secret values or vault refs are returned.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "status", "flag": "status", "type": "enum", "required": false, "enumValues": ["pending", "fulfilled", "rejected", "canceled"] }], "hasComplexInput": false, "help": "List durable Forge missing-secret requests and their approval-task status. Metadata only; no secret values or vault refs." },
   { "id": "software_factory.secret.grant", "namespace": "software_factory", "action": "secret.grant", "title": "Grant a Forge secret", "description": "A human grants a seat scoped access to a project secret by VAULT REF (project \xD7 env \xD7 seat \xD7 action \xD7 key). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. Entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "string", "required": true }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": true }], "hasComplexInput": false, "help": "A human grants a seat scoped access to a project secret by vault ref (Postgres stores only the pointer, never secret material). Owner-only and human-gated." },
   { "id": "software_factory.secret.request", "namespace": "software_factory", "action": "secret.request", "title": "Request a Forge secret grant", "description": "An agent or user REQUESTS access to a project secret by key (draft-and-confirm \u2014 no value, no grant). Records the ask as a durable event for a human to grant. Never accepts a secret value (invariant #5). Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "string", "required": true }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Request access to a project secret by key; persists the request and creates a human approval task. Never accepts a secret value." },
@@ -51984,6 +52200,7 @@ var COMMAND_MANIFEST = [
   { "id": "task.list", "namespace": "task", "action": "list", "title": "List seat tasks", "description": "List open handoff tasks owned by the acting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List the seat's open handoff tasks before accepting, declining, or completing work." },
   { "id": "task.update", "namespace": "task", "action": "update", "title": "Update task", "description": "Reschedule (due date), reassign (owner seat), or edit a non-terminal task's title, description, or acceptance criteria. Terminal tasks cannot be edited \u2014 a correction is a new task.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "task_id", "flag": "task-id", "type": "string", "required": true }, { "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": false }, { "name": "due_on", "flag": "due-on", "type": "string", "required": false }, { "name": "title", "flag": "title", "type": "string", "required": false }, { "name": "description", "flag": "description", "type": "string", "required": false }, { "name": "acceptance_criteria", "flag": "acceptance-criteria", "type": "array", "required": false, "itemType": "string" }], "hasComplexInput": false, "help": "Reschedule, reassign, or edit a non-terminal task; terminal tasks are immutable (a correction is a new task)." },
   { "id": "team.health_score", "namespace": "team", "action": "health_score", "title": "Team health score", "description": "Return the single rolled-up 0\u2013100 team-health score (latest month) with its band (green/yellow/red) and label. Honest insufficient-data state when no metrics exist yet.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read the single rolled-up 0-100 team-health score (latest month) with its band and label." },
+  { "id": "tenant.anthropic_key.disable", "namespace": "tenant", "action": "anthropic_key.disable", "title": "Disable tenant Anthropic key", "description": "Revoke the active tenant Anthropic BYOK credential while preserving audit history, after validating managed inference fallback is available.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Disable tenant BYOK only after managed Anthropic fallback is available; this revokes metadata without reading or returning the old key." },
   { "id": "tenant.anthropic_key.save", "namespace": "tenant", "action": "anthropic_key.save", "title": "Save tenant Anthropic key", "description": "Store a tenant-scoped Anthropic key in the configured vault.", "requiredScope": "tenant", "confirmation": "credential_flow", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "secretBlocked": true, "help": "Save model-provider credentials only through vault-backed flows and keep raw keys out of prompts, logs, and command metadata." },
   { "id": "tenant.create", "namespace": "tenant", "action": "create", "title": "Create additional company", "description": "Create a new clean company for an already-provisioned account after checking tenant.create.additional entitlement.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "company_name", "flag": "company-name", "type": "string", "required": true }], "hasComplexInput": false, "help": "Create an additional clean company from an existing company session. Requires tenant.create.additional entitlement; first-company bootstrap stays signup.provision_tenant." },
   { "id": "tenant.model_gateway_policy.update", "namespace": "tenant", "action": "model_gateway_policy.update", "title": "Update model gateway policy", "description": "Unlock or relock managed models that do not offer a zero-retention (ZDR) tier (ADR-0019). Locked (the conservative default) restricts the AI Gateway to zero-retention-eligible managed models. Owner-only and human-gated: unlocking is a deliberate ADR-0018 \xA76 standing authorization that lets managed brains without a zero-retention tier run. This provider retains data up to 30 days for abuse monitoring.", "requiredScope": "tenant_admin", "confirmation": "dangerous", "exposeOverMcp": true, "fields": [{ "name": "allow_non_zdr_models", "flag": "allow-non-zdr-models", "type": "boolean", "required": true }], "hasComplexInput": false, "help": "Unlock or relock managed models that do not offer a zero-retention (ZDR) tier (ADR-0019). Locked (default) restricts the AI Gateway to zero-retention-eligible managed models. Owner-only and human-gated; unlocking establishes an ADR-0018 \xA76 standing authorization and surfaces the per-model retention disclosure." },
@@ -51991,6 +52208,7 @@ var COMMAND_MANIFEST = [
   { "id": "tool_grants.agent.effective", "namespace": "tool_grants", "action": "agent.effective", "title": "List agent effective capability grants", "description": "Read the effective capability grants for one agent, including the lower-of-ceiling-and-selection access level and compile status. Returns metadata only.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Read one agent's effective capability grants after tenant ceilings, agent selections, and compile availability are applied." },
   { "id": "tool_grants.agent.update", "namespace": "tool_grants", "action": "agent.update", "title": "Update agent capability grants", "description": "Compile a Charter supersession proposal for per-agent capability grant reductions or expansions. Human steward/admin only.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": true, "help": "Compile a Charter supersession proposal for an agent capability grant reduction or expansion. Human steward/admin only." },
   { "id": "tool_grants.tenant.list", "namespace": "tool_grants", "action": "tenant.list", "title": "List tenant capability grants", "description": "Read the tenant capability ceiling/default matrix with connection, availability, source, ceiling, and compile status. Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List tenant capability ceilings/defaults with connection, availability, source, and compile status. Read-only." },
+  { "id": "tool_grants.tenant.update", "namespace": "tool_grants", "action": "tenant.update", "title": "Update tenant capability policy", "description": "Atomically update tenant capability mode, company maximums, and new-agent defaults with stale-write protection and affected-agent impact.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "expected_policy_version", "flag": "expected-policy-version", "type": "integer", "required": false }, { "name": "expected_policy_digest", "flag": "expected-policy-digest", "type": "string", "required": false }, { "name": "mode", "flag": "mode", "type": "enum", "required": true, "enumValues": ["managed", "open"] }], "hasComplexInput": true, "help": "Update tenant capability ceilings/defaults with stale-write protection; owner/admin only, human-gated, and event-audited." },
   { "id": "tool.catalog", "namespace": "tool", "action": "catalog", "title": "List tool catalog", "description": "List the discoverable tool catalog the agent builder reads \u2014 tool id, title, provider, prescriptive description, default scope tiers, credential requirement, access policy, and execution-boundary guidance.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "provider", "flag": "provider", "type": "string", "required": false }], "hasComplexInput": false, "help": "List the tool catalog the builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance." },
   { "id": "usage.report", "namespace": "usage", "action": "report", "title": "AI-workforce ROI report", "description": "Return the tenant's immutable per-period usage snapshots \u2014 agents ran, outputs, token/run cost, human-accepted value, exceptions, and approvals \u2014 for the AI-workforce ROI report.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Read the AI-workforce ROI report \u2014 per-period agents/outputs/token+run cost, human-accepted value, exceptions, and approvals \u2014 from immutable usage snapshots." },
   { "id": "usage.snapshot", "namespace": "usage", "action": "snapshot", "title": "Capture usage period snapshot", "description": "Freeze the current (or a given) period's usage and accepted-value totals into an immutable snapshot for the ROI report. Insert-only and idempotent \u2014 re-running a captured period changes nothing.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": true, "help": "Freeze the current period's usage and accepted-value totals into an immutable snapshot for the ROI report; insert-only and idempotent, so re-running a captured period changes nothing." },
@@ -58204,6 +58422,12 @@ async function main(argv = process.argv.slice(2), options = {}) {
   const deviceLogin = options.deviceLogin ?? loginWithDeviceCode;
   const refreshSession = options.refreshSession ?? refreshCliSessionIfNeeded;
   const [rawCommand, ...args] = argv;
+  if (rawCommand === "--version" || rawCommand === "-v") {
+    const version4 = await readCliVersion();
+    io.stdout.write(`${version4 ?? "unknown"}
+`);
+    return 0;
+  }
   const command = rawCommand === "--help" || rawCommand === "-h" ? "help" : rawCommand;
   if (isSecretBlockedNamespace(command) || isSecretBlockedCommand(args[0] === void 0 ? void 0 : `${command}.${args[0]}`)) {
     io.stderr.write(`${SECRET_ARGV_GUIDANCE}