@rosthq/cli 0.7.83 → 0.7.85

package/dist/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare function readCliVersion(): Promise<string | null>;
+export declare function readCliVersion(embeddedVersion?: string | undefined): Promise<string | null>;
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-version.d.ts","sourceRoot":"","sources":["../src/cli-version.ts"],"names":[],"mappings":"AAgBA,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7D"}
+{"version":3,"file":"cli-version.d.ts","sourceRoot":"","sources":["../src/cli-version.ts"],"names":[],"mappings":"AA0BA,wBAAsB,cAAc,CAClC,eAAe,GAAE,MAAM,GAAG,SAAuF,GAChH,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAOA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAwBrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAcF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0RnG;AA0hBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAOA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAyBrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAcF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkSnG;AA0hBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}

package/dist/index.js

@@ -37796,10 +37796,30 @@ function windowsClearScript(target) {
   ].join("\n");
 }
 
+// src/cli-version.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var packageMetadataSchema = external_exports.object({
+  version: external_exports.string()
+});
+async function readCliVersion(embeddedVersion = typeof __ROST_CLI_VERSION__ === "string" ? __ROST_CLI_VERSION__ : void 0) {
+  if (embeddedVersion !== void 0) {
+    return embeddedVersion;
+  }
+  const packageJsonPath = resolve(dirname(fileURLToPath(import.meta.url)), "../package.json");
+  try {
+    const metadata = packageMetadataSchema.parse(JSON.parse(await readFile2(packageJsonPath, "utf8")));
+    return metadata.version;
+  } catch {
+    return null;
+  }
+}
+
 // ../../packages/prompts/src/index.ts
 import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { dirname as dirname2, join } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../../packages/protocol/src/cron.ts
 var uintPattern = /^\d+$/;
@@ -44876,6 +44896,30 @@ var softwareTaskSummarySchema = external_exports.object({
   completed_at: external_exports.string().nullable(),
   created_at: external_exports.string()
 });
+var softwarePlanArtifactTaskSummarySchema = external_exports.object({
+  task_key: external_exports.string(),
+  title: external_exports.string(),
+  depends_on: external_exports.array(external_exports.string()).default([]),
+  parallelizable: external_exports.boolean().default(false),
+  est_turns: external_exports.number().int().nullable().default(null),
+  files_likely: external_exports.array(external_exports.string()).default([]),
+  verification: external_exports.array(external_exports.string()).default([])
+});
+var softwarePlanArtifactChangesetSummarySchema = external_exports.object({
+  ordinal: external_exports.number().int(),
+  title: external_exports.string(),
+  split_criterion: external_exports.string(),
+  task_keys: external_exports.array(external_exports.string()).default([])
+});
+var softwarePlanArtifactSummarySchema = external_exports.object({
+  scope: external_exports.string(),
+  plan_steps: external_exports.array(external_exports.string()).default([]),
+  files_or_systems: external_exports.array(external_exports.string()).default([]),
+  verification: external_exports.array(external_exports.string()).default([]),
+  risks: external_exports.array(external_exports.string()).default([]),
+  tasks: external_exports.array(softwarePlanArtifactTaskSummarySchema).default([]),
+  changesets: external_exports.array(softwarePlanArtifactChangesetSummarySchema).default([])
+});
 var softwarePlanVersionSummarySchema = external_exports.object({
   id: uuid11,
   build_request_id: uuid11,
@@ -44888,6 +44932,7 @@ var softwarePlanVersionSummarySchema = external_exports.object({
     question: external_exports.string(),
     answer: external_exports.string()
   })).default([]),
+  planning_artifact: softwarePlanArtifactSummarySchema.nullable(),
   created_by_seat_id: uuid11.nullable(),
   created_at: external_exports.string()
 });
@@ -45682,7 +45727,12 @@ var softwareGithubAutomationPolicyInputSchema = external_exports.object({
   // are identical to the union (`SoftwareGithubAction | SoftwareAutomationMode`).
   requires_human_for: external_exports.array(external_exports.enum([...softwareGithubActionSchema.options, ...softwareAutomationModeSchema.options])).max(20).refine((values) => values.includes("deploy_production"), {
     message: "production deploy must remain human-gated"
-  })
+  }),
+  // DER-1266: optional per-policy inferred-risk tolerance. When set and the server-inferred
+  // risk EXCEEDS this level, rule 5 (ADR-0018 §5) downgrades the effective automation mode
+  // to plan_only. Omitted/null = the fixed riskModeCeilingFor table (no change for existing
+  // policies). Conservative-by-default (invariant #10): this can only tighten, never loosen.
+  max_risk: softwareRiskLevelSchema.nullable().optional()
 }).strict();
 var softwareGithubConnectedRepositoryInputSchema = external_exports.object({
   repository_id: external_exports.number().int().positive(),
@@ -45754,7 +45804,8 @@ var softwareGithubInstallationListOutputSchema = external_exports.object({
 var softwareGithubAutomationPolicyUpsertOutputSchema = external_exports.object({
   policy_id: uuid11,
   software_project_id: uuid11,
-  automation_mode_ceiling: softwareAutomationModeSchema
+  automation_mode_ceiling: softwareAutomationModeSchema,
+  max_risk: softwareRiskLevelSchema.nullable()
 });
 var softwareGithubInstallationTokenCreateInputSchema = external_exports.object({
   software_project_id: uuid11,
@@ -46717,7 +46768,7 @@ var eventEnvelopeReaderSchema = external_exports.discriminatedUnion("type", [
 ]);
 
 // ../../packages/prompts/src/index.ts
-var promptRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "prompts");
+var promptRoot = join(dirname2(fileURLToPath2(import.meta.url)), "..", "prompts");
 function loadPromptBody(filename) {
   const raw = readFileSync(join(promptRoot, filename), "utf8");
   return raw.replace(/^---\n[\s\S]*?\n---\n?/, "").trim();
@@ -47078,7 +47129,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-14.1",
+    version: "2026-07-14.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -47126,7 +47177,7 @@ Seats that do not reach the single root through the resolved parent chain are li
 
 ## Forge Developer Team seats are pinned
 
-Seats under \`forge.developer_team\` are resolved by Forge build dispatch using their exact path, so they cannot be reparented or merged from the graph, CLI, or MCP \u2014 moving a seat (or an ancestor whose subtree holds them) would eject them from dispatch, and no command can restore the path. To change who is accountable for one of these seats, update its steward with \`agent_setup.update\`; the reporting path stays fixed. To stand the team down, use the governed Forge team teardown flow, not a merge or decommission.
+Seats under \`forge.developer_team\` are resolved by Forge build dispatch using their exact path, so they cannot be reparented or merged from the graph, CLI, or MCP \u2014 moving a seat (or an ancestor whose subtree holds them) would eject them from dispatch, and no command can restore the path. To change who is accountable for one of these seats, update its steward with \`agent_setup.update\`; the reporting path stays fixed. To stand the team down, use the governed Forge team teardown flow, not a merge or decommission. The web canvas surfaces this pin visibly: a lock badge on the seat card (Responsibility Chart and Cascade views) and in the seat inspector panel, with a tooltip explaining the seat can't be moved, merged, or reparented \u2014 so the restriction is visible before a user hits the guard, not only as an error after the fact.
 
 ## Add an agent from the graph
 
@@ -47904,7 +47955,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-15.3",
+    version: "2026-07-15.5",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -48424,6 +48475,7 @@ Skills wrapper help:
 | \`{{cli}} mcp install --client cursor --scope tenant-admin\` | Mint a tenant-admin MCP token and print Cursor JSON. | Tenant | \`{{cli}} mcp install --client cursor --scope tenant-admin\` |
 | \`{{cli}} mcp install --client <client> --scope seat --seat-id <seat-id>\` | Mint a token limited to one seat (the narrowest scope \u2014 prefer for day-to-day). | Seat | \`{{cli}} mcp install --client codex --scope seat --seat-id <seat-id>\` |
 | \`{{cli}} --help\` | Print top-level CLI help. | Public help | \`{{cli}} --help\` |
+| \`{{cli}} --version\` / \`{{cli}} -v\` | Print the installed CLI's own version and exit \u2014 no usage text, no auth. | Public help | \`{{cli}} --version\` |
 
 ## MCP tool and resource catalog
 
@@ -48675,7 +48727,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_forge_secret_requests\` | \`software_factory.secret_request.list\` | List missing-secret requests and their approval Task ids/statuses. It returns request metadata only \u2014 no secret values and no vault refs. | Tenant | Call with \`{}\` or \`{"status":"pending"}\`. |
 | \`rost_grant_a_forge_secret\` | \`software_factory.secret.grant\` | A human grants a seat scoped access to a project secret by vault ref (Postgres stores only the pointer, never secret material). Owner-only and human-gated. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","environment":"production","seat_id":"<seat-id>","action":"vercel.env.sync","key_name":"OPENAI_API_KEY","vault_ref":"infisical://prod/OPENAI_API_KEY"}\`. |
 | \`rost_revoke_a_forge_secret_grant\` | \`software_factory.secret.revoke\` | Revoke a Forge secret grant (teardown \u2014 cut a compromised seat's access immediately). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_set_a_forge_github_automation_policy\` | \`software_factory.github.policy.upsert\` | Set the server-side GitHub automation policy: allowed actions, automation-mode ceiling, and operations requiring humans. The allowed-actions and human-gated-actions lists are stored server-side as structured JSON arrays. Owner-only and human-gated. Raising the ceiling to a merge-capable mode (merge_after_checks or higher) first verifies the bound repository has required status checks on its default branch and refuses otherwise. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","automation_mode_ceiling":"pr_only","allowed_actions":["webhook_intake","installation_token"],"requires_human_for":["deploy_production"]}\`. |
+| \`rost_set_a_forge_github_automation_policy\` | \`software_factory.github.policy.upsert\` | Set the server-side GitHub automation policy: allowed actions, automation-mode ceiling, and operations requiring humans. The allowed-actions and human-gated-actions lists are stored server-side as structured JSON arrays. Owner-only and human-gated. Raising the ceiling to a merge-capable mode (merge_after_checks or higher) first verifies the bound repository has required status checks on its default branch and refuses otherwise. Optional \`max_risk\` (\`low\`\\|\`medium\`\\|\`high\`\\|\`critical\`) tightens the fixed inferred-risk\u2192mode-ceiling table per policy \u2014 an inferred risk strictly above \`max_risk\` is capped to \`plan_only\`; unset keeps the existing fixed-table behavior exactly, and \`critical\` inferred risk always stays \`plan_only\` regardless of \`max_risk\` (invariant #10, tighten-only). | Tenant-admin | Call with \`{"software_project_id":"<project-id>","automation_mode_ceiling":"pr_only","allowed_actions":["webhook_intake","installation_token"],"requires_human_for":["deploy_production"],"max_risk":"medium"}\`. |
 | \`rost_create_a_forge_github_installation_token\` | \`software_factory.github.installation_token.create\` | Mint a short-lived GitHub App installation token for one bound repository after policy evaluation. The token is returned once and never stored. | Tenant | Call with \`{"software_project_id":"<project-id>","repository_id":789,"requested_actions":["read"],"requested_automation_mode":"plan_only"}\`. |
 | \`rost_list_forge_github_installations\` | \`software_factory.github.installation.list\` | List connected GitHub App installations and each repository's bind state (connected or active) with the Forge project it maps to. Read-only. | Tenant | Call with \`{}\`; a \`connected\` repository is verified but not yet bound to a project. |
 | \`rost_list_forge_vercel_links\` | \`software_factory.vercel.project.list\` | List connected Vercel accounts/teams and linked existing Vercel projects. Read-only; no OAuth tokens or vault refs are returned. | Tenant | Call with \`{}\`; tenant admins connect/link from \`/forge/settings/vercel\`. |
@@ -51810,25 +51862,6 @@ function helpText() {
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import path2 from "node:path";
-
-// src/cli-version.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { dirname as dirname2, resolve } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-var packageMetadataSchema = external_exports.object({
-  version: external_exports.string()
-});
-async function readCliVersion() {
-  const packageJsonPath = resolve(dirname2(fileURLToPath2(import.meta.url)), "../package.json");
-  try {
-    const metadata = packageMetadataSchema.parse(JSON.parse(await readFile2(packageJsonPath, "utf8")));
-    return metadata.version;
-  } catch {
-    return null;
-  }
-}
-
-// src/update-check.ts
 var latestPackageSchema = external_exports.object({
   version: external_exports.string()
 });
@@ -52130,7 +52163,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.github.installation.bind", "namespace": "software_factory", "action": "github.installation.bind", "title": "Bind Forge GitHub repositories to projects", "description": "Bind already-connected GitHub repositories to Forge projects. Owner-only and human-gated; operates on repositories already verified and connected in this tenant, so no GitHub re-authorization is required. Available any time, add or re-map bindings.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }], "hasComplexInput": true, "help": "Bind already-connected GitHub repositories to Forge projects from the Forge GitHub settings flow. Owner-only and human-gated; no GitHub re-authorization required." },
   { "id": "software_factory.github.installation.connect", "namespace": "software_factory", "action": "github.installation.connect", "title": "Connect a Forge GitHub installation", "description": "Record a proven GitHub App installation and its verified repositories as connected (unbound) so they can be bound to Forge projects later. Owner-only and human-gated; starts from the authenticated Forge GitHub settings flow. Idempotent \u2014 re-connecting reconciles metadata and never unbinds an already-bound repository.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }, { "name": "account_login", "flag": "account-login", "type": "string", "required": true }, { "name": "account_id", "flag": "account-id", "type": "integer", "required": true }, { "name": "account_type", "flag": "account-type", "type": "string", "required": true }], "hasComplexInput": true, "help": "Record a verified GitHub App installation and its repositories as connected (unbound) so they can be bound to Forge projects later. Owner-only and human-gated." },
   { "id": "software_factory.github.installation.list", "namespace": "software_factory", "action": "github.installation.list", "title": "List Forge GitHub installations", "description": "List connected GitHub App installations and their repositories with bind state (connected or active) and the Forge project each bound repository maps to. Read-only; requires the Forge add-on.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }], "hasComplexInput": false, "help": "List connected GitHub App installations and each repository's bind state (connected or active) with the Forge project it maps to. Read-only." },
-  { "id": "software_factory.github.policy.upsert", "namespace": "software_factory", "action": "github.policy.upsert", "title": "Set a Forge GitHub automation policy", "description": "Set the server-side policy for GitHub actions and automation-mode ceilings. Owner-only and human-gated; production deploy remains human-gated. Raising the ceiling to a merge-capable mode (merge_after_checks or higher) first verifies the bound repository has required status checks configured \u2014 it refuses otherwise.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "authority_profile_id", "flag": "authority-profile-id", "type": "string", "required": false }, { "name": "automation_mode_ceiling", "flag": "automation-mode-ceiling", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "allowed_actions", "flag": "allowed-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requires_human_for", "flag": "requires-human-for", "type": "array", "required": true, "itemType": "string" }], "hasComplexInput": false, "help": "Set Forge's server-side GitHub automation policy for actions, mode ceilings, and human-gated operations." },
+  { "id": "software_factory.github.policy.upsert", "namespace": "software_factory", "action": "github.policy.upsert", "title": "Set a Forge GitHub automation policy", "description": "Set the server-side policy for GitHub actions and automation-mode ceilings. Owner-only and human-gated; production deploy remains human-gated. Raising the ceiling to a merge-capable mode (merge_after_checks or higher) first verifies the bound repository has required status checks configured \u2014 it refuses otherwise.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "authority_profile_id", "flag": "authority-profile-id", "type": "string", "required": false }, { "name": "automation_mode_ceiling", "flag": "automation-mode-ceiling", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "allowed_actions", "flag": "allowed-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requires_human_for", "flag": "requires-human-for", "type": "array", "required": true, "itemType": "string" }, { "name": "max_risk", "flag": "max-risk", "type": "enum", "required": false, "enumValues": ["low", "medium", "high", "critical"] }], "hasComplexInput": false, "help": "Set Forge's server-side GitHub automation policy for actions, mode ceilings, and human-gated operations." },
   { "id": "software_factory.github.repository.unbind", "namespace": "software_factory", "action": "github.repository.unbind", "title": "Unbind a Forge GitHub repository", "description": "Remove a GitHub repository's Forge project binding. By default the repository stays connected (unbound) and can be re-bound later; pass disconnect to remove it entirely. Owner-only and human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }, { "name": "repository_id", "flag": "repository-id", "type": "integer", "required": true }, { "name": "disconnect", "flag": "disconnect", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Remove a GitHub repository's Forge project binding; the repository stays connected for re-binding unless disconnect is set. Owner-only and human-gated." },
   { "id": "software_factory.phase.advance", "namespace": "software_factory", "action": "phase.advance", "title": "Advance a Forge build request phase", "description": "Advance a build request to the next phase, enforcing the closed phase state machine server-side (an illegal transition is rejected). Writes a phase-run row and updates the current phase. Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "to_phase", "flag": "to-phase", "type": "enum", "required": true, "enumValues": ["intake", "discovery_scoping", "plan_review", "implementation", "plan_conformance_review", "security_review", "qa_verification", "release_preview", "merge_or_deploy_gate", "closeout"] }, { "name": "owning_seat_id", "flag": "owning-seat-id", "type": "string", "required": false }, { "name": "note", "flag": "note", "type": "string", "required": false }], "hasComplexInput": false, "help": "Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition." },
   { "id": "software_factory.plan.approve", "namespace": "software_factory", "action": "plan.approve", "title": "Approve a Forge plan", "description": "A human approves the current plan at the plan_review gate; records a human decision and advances the request to implementation. Owner-only and human-gated (invariant #7).", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human approves the current plan at the plan_review gate; records a human decision and advances the request to implementation. Owner-only and human-gated." },
@@ -58395,6 +58428,12 @@ async function main(argv = process.argv.slice(2), options = {}) {
   const deviceLogin = options.deviceLogin ?? loginWithDeviceCode;
   const refreshSession = options.refreshSession ?? refreshCliSessionIfNeeded;
   const [rawCommand, ...args] = argv;
+  if (rawCommand === "--version" || rawCommand === "-v") {
+    const version4 = await readCliVersion();
+    io.stdout.write(`${version4 ?? "unknown"}
+`);
+    return 0;
+  }
   const command = rawCommand === "--help" || rawCommand === "-h" ? "help" : rawCommand;
   if (isSecretBlockedNamespace(command) || isSecretBlockedCommand(args[0] === void 0 ? void 0 : `${command}.${args[0]}`)) {
     io.stderr.write(`${SECRET_ARGV_GUIDANCE}