@rosthq/cli 0.7.84 → 0.7.86

package/dist/generator/groups.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/generator/groups.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAM1D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKhF,CAAC;AAgsCF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAmPjD,CAAC"}
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/generator/groups.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAM1D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKhF,CAAC;AAosCF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAmPjD,CAAC"}

package/dist/index.js

@@ -43827,6 +43827,17 @@ var runnerPostureSchema = external_exports.object({
   network: external_exports.enum(["allow", "deny", "unknown"]),
   capability_set: external_exports.array(external_exports.string())
 }).strict();
+var runnerCapacityStateSchema = external_exports.enum(["available", "near_cap", "exhausted", "unknown"]);
+var runnerCapacitySchema = external_exports.object({
+  account_alias: external_exports.string().nullable(),
+  state: runnerCapacityStateSchema,
+  raw_state: external_exports.string().nullable(),
+  // Null until the harness gains rate-limit error classification (out of scope for DER-1588);
+  // surfaced now so a fleet reader picks it up automatically once it starts being set.
+  rate_limited_until: isoDateTime6.nullable(),
+  has_observation: external_exports.boolean(),
+  freshness: external_exports.enum(["fresh", "stale"])
+}).strict();
 var runnerSummarySchema = external_exports.object({
   id: uuid8,
   name: external_exports.string(),
@@ -43836,6 +43847,7 @@ var runnerSummarySchema = external_exports.object({
   cli_version: external_exports.string().nullable(),
   posture: runnerPostureSchema,
   execution: runnerExecutionReadinessSchema,
+  capacity: runnerCapacitySchema,
   paired_at: isoDateTime6.nullable(),
   last_heartbeat_at: isoDateTime6.nullable(),
   revoked_at: isoDateTime6.nullable(),
@@ -44219,6 +44231,8 @@ var systemHealthConnectivitySectionSchema = external_exports.object({
   runner_count: external_exports.number().int().nonnegative(),
   offline_runner_count: external_exports.number().int().nonnegative(),
   not_execute_ready_runner_count: external_exports.number().int().nonnegative(),
+  // DER-1588: fleet-wide near-cap/at-limit warning, driven off the runner capacity badge.
+  near_cap_or_exhausted_runner_count: external_exports.number().int().nonnegative(),
   integration_count: external_exports.number().int().nonnegative(),
   disconnected_integration_count: external_exports.number().int().nonnegative(),
   failed_notification_count: external_exports.number().int().nonnegative()
@@ -45727,7 +45741,12 @@ var softwareGithubAutomationPolicyInputSchema = external_exports.object({
   // are identical to the union (`SoftwareGithubAction | SoftwareAutomationMode`).
   requires_human_for: external_exports.array(external_exports.enum([...softwareGithubActionSchema.options, ...softwareAutomationModeSchema.options])).max(20).refine((values) => values.includes("deploy_production"), {
     message: "production deploy must remain human-gated"
-  })
+  }),
+  // DER-1266: optional per-policy inferred-risk tolerance. When set and the server-inferred
+  // risk EXCEEDS this level, rule 5 (ADR-0018 §5) downgrades the effective automation mode
+  // to plan_only. Omitted/null = the fixed riskModeCeilingFor table (no change for existing
+  // policies). Conservative-by-default (invariant #10): this can only tighten, never loosen.
+  max_risk: softwareRiskLevelSchema.nullable().optional()
 }).strict();
 var softwareGithubConnectedRepositoryInputSchema = external_exports.object({
   repository_id: external_exports.number().int().positive(),
@@ -45799,7 +45818,8 @@ var softwareGithubInstallationListOutputSchema = external_exports.object({
 var softwareGithubAutomationPolicyUpsertOutputSchema = external_exports.object({
   policy_id: uuid11,
   software_project_id: uuid11,
-  automation_mode_ceiling: softwareAutomationModeSchema
+  automation_mode_ceiling: softwareAutomationModeSchema,
+  max_risk: softwareRiskLevelSchema.nullable()
 });
 var softwareGithubInstallationTokenCreateInputSchema = external_exports.object({
   software_project_id: uuid11,
@@ -46406,6 +46426,8 @@ var WORK_VERBS = [
 var workVerbSchema = external_exports.enum(WORK_VERBS);
 var WORK_OUTCOMES = ["success", "warning", "error", "held"];
 var workOutcomeSchema = external_exports.enum(WORK_OUTCOMES);
+var RESOLUTION_ATTRIBUTIONS = ["agent_self", "escalated_human"];
+var resolutionAttributionSchema = external_exports.enum(RESOLUTION_ATTRIBUTIONS);
 var objectKindSchema = external_exports.string().trim().min(1).max(128);
 var externalIdSchema = external_exports.string().trim().min(1).max(512);
 var labelSchema = external_exports.string().trim().min(1).max(200);
@@ -46541,6 +46563,12 @@ var workDetailsSchemas = {
     currency: external_exports.string().length(3).optional(),
     unit: external_exports.string().max(64).optional(),
     lead_time_days: external_exports.number().int().nonnegative().optional()
+  }).strict(),
+  // DER-1574: the resolution-attribution marker for a record that closes out an
+  // `escalated`/`held` item — see RESOLUTION_ATTRIBUTIONS above.
+  escalation_resolution: external_exports.object({
+    resolved_by: resolutionAttributionSchema,
+    resolution_note: external_exports.string().trim().min(1).max(2e3).optional()
   }).strict()
 };
 
@@ -47949,7 +47977,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-15.4",
+    version: "2026-07-15.5",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -48721,7 +48749,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_forge_secret_requests\` | \`software_factory.secret_request.list\` | List missing-secret requests and their approval Task ids/statuses. It returns request metadata only \u2014 no secret values and no vault refs. | Tenant | Call with \`{}\` or \`{"status":"pending"}\`. |
 | \`rost_grant_a_forge_secret\` | \`software_factory.secret.grant\` | A human grants a seat scoped access to a project secret by vault ref (Postgres stores only the pointer, never secret material). Owner-only and human-gated. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","environment":"production","seat_id":"<seat-id>","action":"vercel.env.sync","key_name":"OPENAI_API_KEY","vault_ref":"infisical://prod/OPENAI_API_KEY"}\`. |
 | \`rost_revoke_a_forge_secret_grant\` | \`software_factory.secret.revoke\` | Revoke a Forge secret grant (teardown \u2014 cut a compromised seat's access immediately). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_set_a_forge_github_automation_policy\` | \`software_factory.github.policy.upsert\` | Set the server-side GitHub automation policy: allowed actions, automation-mode ceiling, and operations requiring humans. The allowed-actions and human-gated-actions lists are stored server-side as structured JSON arrays. Owner-only and human-gated. Raising the ceiling to a merge-capable mode (merge_after_checks or higher) first verifies the bound repository has required status checks on its default branch and refuses otherwise. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","automation_mode_ceiling":"pr_only","allowed_actions":["webhook_intake","installation_token"],"requires_human_for":["deploy_production"]}\`. |
+| \`rost_set_a_forge_github_automation_policy\` | \`software_factory.github.policy.upsert\` | Set the server-side GitHub automation policy: allowed actions, automation-mode ceiling, and operations requiring humans. The allowed-actions and human-gated-actions lists are stored server-side as structured JSON arrays. Owner-only and human-gated. Raising the ceiling to a merge-capable mode (merge_after_checks or higher) first verifies the bound repository has required status checks on its default branch and refuses otherwise. Optional \`max_risk\` (\`low\`\\|\`medium\`\\|\`high\`\\|\`critical\`) tightens the fixed inferred-risk\u2192mode-ceiling table per policy \u2014 an inferred risk strictly above \`max_risk\` is capped to \`plan_only\`; unset keeps the existing fixed-table behavior exactly, and \`critical\` inferred risk always stays \`plan_only\` regardless of \`max_risk\` (invariant #10, tighten-only). | Tenant-admin | Call with \`{"software_project_id":"<project-id>","automation_mode_ceiling":"pr_only","allowed_actions":["webhook_intake","installation_token"],"requires_human_for":["deploy_production"],"max_risk":"medium"}\`. |
 | \`rost_create_a_forge_github_installation_token\` | \`software_factory.github.installation_token.create\` | Mint a short-lived GitHub App installation token for one bound repository after policy evaluation. The token is returned once and never stored. | Tenant | Call with \`{"software_project_id":"<project-id>","repository_id":789,"requested_actions":["read"],"requested_automation_mode":"plan_only"}\`. |
 | \`rost_list_forge_github_installations\` | \`software_factory.github.installation.list\` | List connected GitHub App installations and each repository's bind state (connected or active) with the Forge project it maps to. Read-only. | Tenant | Call with \`{}\`; a \`connected\` repository is verified but not yet bound to a project. |
 | \`rost_list_forge_vercel_links\` | \`software_factory.vercel.project.list\` | List connected Vercel accounts/teams and linked existing Vercel projects. Read-only; no OAuth tokens or vault refs are returned. | Tenant | Call with \`{}\`; tenant admins connect/link from \`/forge/settings/vercel\`. |
@@ -49992,7 +50020,7 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-07-10.1",
+    version: "2026-07-16.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -50069,7 +50097,7 @@ A Forge turn should load its context in one order: build context first, then Ski
 ## Inspect and control runners from CLI or MCP
 
 - Pair a new runner: \`runner.pairing.start\` / \`rost_start_runner_pairing\` with \`name\` and \`platform\` returns a human pairing code. This is owner/admin-only because it mints a short-lived runner pairing session that leads to machine credentials.
-- Inspect: \`{{cli}} runner list --json\` / \`runner.list\` / \`rost_list_runners\` shows heartbeat state plus execution readiness. A runner is execute-ready only when it has a live heartbeat, a detected local Claude or Codex runtime, and recent claim/result evidence or active queue processing. Settings and runner status/list surfaces also project the runner CLI version, sandbox posture, network posture, and reported capability set from heartbeat so operators can see whether the machine is current and still running with the expected guardrails. \`{{cli}} runner status\` / \`runner.status\` / \`rost_runner_status\` reads one runner with the same execution detail, due queue count, claimed/running counts, and recent result timestamps.
+- Inspect: \`{{cli}} runner list --json\` / \`runner.list\` / \`rost_list_runners\` shows heartbeat state plus execution readiness. A runner is execute-ready only when it has a live heartbeat, a detected local Claude or Codex runtime, and recent claim/result evidence or active queue processing. Settings and runner status/list surfaces also project the runner CLI version, sandbox posture, network posture, and reported capability set from heartbeat so operators can see whether the machine is current and still running with the expected guardrails. \`{{cli}} runner status\` / \`runner.status\` / \`rost_runner_status\` reads one runner with the same execution detail, due queue count, claimed/running counts, and recent result timestamps. Both surfaces also project a \`capacity\` view: the runner's active model-account alias, a badge state (\`available\`, \`near_cap\`, \`exhausted\`, or \`unknown\`), a rate-limited-until timestamp when the harness has classified one, and a fresh/stale refreshability flag mirroring heartbeat recency. The badge reads \`unknown\` \u2014 never a fabricated \`available\` \u2014 whenever no capacity observation has been recorded yet or the runner reported a state {{brand}} does not recognize; real 5-hour/weekly usage percentages and reset timestamps are not collected yet, so this view never claims a percentage it does not have. Settings > Connected machines and the Health dashboard's Connectivity tile (a fleet-wide near-cap/at-limit count) surface the same signal.
 - Diagnose (DER-949): \`{{cli}} runner diagnose --runner-id <id>\` / \`runner.diagnose\` / \`rost_diagnose_runner\` returns health, capabilities, and repair guidance without exposing secrets. Use when a runner is offline or stale to get actionable next steps.
 - Repair steps (DER-949): \`{{cli}} runner repair --runner-id <id> [--issue restart|re_pair|revoke_stale|missing_cli_runtime]\` / \`runner.repair\` / \`rost_repair_runner\` returns focused repair instructions. The optional \`issue\` flag narrows to a specific kind of repair (restart the app, re-pair, revoke a stale runner, or install a missing CLI runtime).
 - Work orders: \`{{cli}} runner work-orders\` / \`work_order.list\` / \`rost_list_work_orders\`; queue with \`work_order.enqueue\` / \`rost_enqueue_work_order\` for a live scheduled agent, or use \`agent.run_now\` / \`rost_run_agent_now\` when an operator wants the product to queue and dispatch an immediate live run from a seat id; cancel with \`work_order.cancel\` / \`rost_cancel_work_order\`. The operator Settings page mirrors queued, claimed, running, and recent completed runner evidence so online does not imply can execute.
@@ -52157,7 +52185,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.github.installation.bind", "namespace": "software_factory", "action": "github.installation.bind", "title": "Bind Forge GitHub repositories to projects", "description": "Bind already-connected GitHub repositories to Forge projects. Owner-only and human-gated; operates on repositories already verified and connected in this tenant, so no GitHub re-authorization is required. Available any time, add or re-map bindings.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }], "hasComplexInput": true, "help": "Bind already-connected GitHub repositories to Forge projects from the Forge GitHub settings flow. Owner-only and human-gated; no GitHub re-authorization required." },
   { "id": "software_factory.github.installation.connect", "namespace": "software_factory", "action": "github.installation.connect", "title": "Connect a Forge GitHub installation", "description": "Record a proven GitHub App installation and its verified repositories as connected (unbound) so they can be bound to Forge projects later. Owner-only and human-gated; starts from the authenticated Forge GitHub settings flow. Idempotent \u2014 re-connecting reconciles metadata and never unbinds an already-bound repository.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }, { "name": "account_login", "flag": "account-login", "type": "string", "required": true }, { "name": "account_id", "flag": "account-id", "type": "integer", "required": true }, { "name": "account_type", "flag": "account-type", "type": "string", "required": true }], "hasComplexInput": true, "help": "Record a verified GitHub App installation and its repositories as connected (unbound) so they can be bound to Forge projects later. Owner-only and human-gated." },
   { "id": "software_factory.github.installation.list", "namespace": "software_factory", "action": "github.installation.list", "title": "List Forge GitHub installations", "description": "List connected GitHub App installations and their repositories with bind state (connected or active) and the Forge project each bound repository maps to. Read-only; requires the Forge add-on.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }], "hasComplexInput": false, "help": "List connected GitHub App installations and each repository's bind state (connected or active) with the Forge project it maps to. Read-only." },
-  { "id": "software_factory.github.policy.upsert", "namespace": "software_factory", "action": "github.policy.upsert", "title": "Set a Forge GitHub automation policy", "description": "Set the server-side policy for GitHub actions and automation-mode ceilings. Owner-only and human-gated; production deploy remains human-gated. Raising the ceiling to a merge-capable mode (merge_after_checks or higher) first verifies the bound repository has required status checks configured \u2014 it refuses otherwise.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "authority_profile_id", "flag": "authority-profile-id", "type": "string", "required": false }, { "name": "automation_mode_ceiling", "flag": "automation-mode-ceiling", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "allowed_actions", "flag": "allowed-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requires_human_for", "flag": "requires-human-for", "type": "array", "required": true, "itemType": "string" }], "hasComplexInput": false, "help": "Set Forge's server-side GitHub automation policy for actions, mode ceilings, and human-gated operations." },
+  { "id": "software_factory.github.policy.upsert", "namespace": "software_factory", "action": "github.policy.upsert", "title": "Set a Forge GitHub automation policy", "description": "Set the server-side policy for GitHub actions and automation-mode ceilings. Owner-only and human-gated; production deploy remains human-gated. Raising the ceiling to a merge-capable mode (merge_after_checks or higher) first verifies the bound repository has required status checks configured \u2014 it refuses otherwise.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "authority_profile_id", "flag": "authority-profile-id", "type": "string", "required": false }, { "name": "automation_mode_ceiling", "flag": "automation-mode-ceiling", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "allowed_actions", "flag": "allowed-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requires_human_for", "flag": "requires-human-for", "type": "array", "required": true, "itemType": "string" }, { "name": "max_risk", "flag": "max-risk", "type": "enum", "required": false, "enumValues": ["low", "medium", "high", "critical"] }], "hasComplexInput": false, "help": "Set Forge's server-side GitHub automation policy for actions, mode ceilings, and human-gated operations." },
   { "id": "software_factory.github.repository.unbind", "namespace": "software_factory", "action": "github.repository.unbind", "title": "Unbind a Forge GitHub repository", "description": "Remove a GitHub repository's Forge project binding. By default the repository stays connected (unbound) and can be re-bound later; pass disconnect to remove it entirely. Owner-only and human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }, { "name": "repository_id", "flag": "repository-id", "type": "integer", "required": true }, { "name": "disconnect", "flag": "disconnect", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Remove a GitHub repository's Forge project binding; the repository stays connected for re-binding unless disconnect is set. Owner-only and human-gated." },
   { "id": "software_factory.phase.advance", "namespace": "software_factory", "action": "phase.advance", "title": "Advance a Forge build request phase", "description": "Advance a build request to the next phase, enforcing the closed phase state machine server-side (an illegal transition is rejected). Writes a phase-run row and updates the current phase. Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "to_phase", "flag": "to-phase", "type": "enum", "required": true, "enumValues": ["intake", "discovery_scoping", "plan_review", "implementation", "plan_conformance_review", "security_review", "qa_verification", "release_preview", "merge_or_deploy_gate", "closeout"] }, { "name": "owning_seat_id", "flag": "owning-seat-id", "type": "string", "required": false }, { "name": "note", "flag": "note", "type": "string", "required": false }], "hasComplexInput": false, "help": "Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition." },
   { "id": "software_factory.plan.approve", "namespace": "software_factory", "action": "plan.approve", "title": "Approve a Forge plan", "description": "A human approves the current plan at the plan_review gate; records a human decision and advances the request to implementation. Owner-only and human-gated (invariant #7).", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human approves the current plan at the plan_review gate; records a human decision and advances the request to implementation. Owner-only and human-gated." },
@@ -52984,17 +53012,20 @@ function renderRunnerList(output) {
   return runners.map((runner) => {
     const record2 = asRecord(runner);
     const posture = asRecord(record2.posture);
+    const capacity = asRecord(record2.capacity);
     const capabilitySet = asArray(posture.capability_set).map((value) => String(value)).join(", ");
-    return `${field(record2, "id")}  ${field(record2, "health")}  ${field(record2, "name")} (${field(record2, "platform")}) cli=${field(record2, "cli_version")} sandbox=${field(posture, "sandbox")} network=${field(posture, "network")}${capabilitySet.length > 0 ? ` capabilities=${capabilitySet}` : ""}`;
+    return `${field(record2, "id")}  ${field(record2, "health")}  ${field(record2, "name")} (${field(record2, "platform")}) cli=${field(record2, "cli_version")} sandbox=${field(posture, "sandbox")} network=${field(posture, "network")}${capabilitySet.length > 0 ? ` capabilities=${capabilitySet}` : ""} capacity=${field(capacity, "state")} account=${field(capacity, "account_alias")} freshness=${field(capacity, "freshness")}`;
   }).join("\n");
 }
 function renderRunnerStatus(output) {
   const record2 = asRecord(output);
   const posture = asRecord(record2.posture);
+  const capacity = asRecord(record2.capacity);
   const capabilitySet = asArray(posture.capability_set).map((value) => String(value)).join(", ");
   const lines = [
     `${field(record2, "id")}  ${field(record2, "health")}  ${field(record2, "name")} (last heartbeat ${field(record2, "last_heartbeat_at")}).`,
-    `cli_version: ${field(record2, "cli_version")}  sandbox: ${field(posture, "sandbox")}  network: ${field(posture, "network")}`
+    `cli_version: ${field(record2, "cli_version")}  sandbox: ${field(posture, "sandbox")}  network: ${field(posture, "network")}`,
+    `capacity: ${field(capacity, "state")}  account: ${field(capacity, "account_alias")}  freshness: ${field(capacity, "freshness")}  rate_limited_until: ${field(capacity, "rate_limited_until")}`
   ];
   if (capabilitySet.length > 0) {
     lines.push(`capabilities: ${capabilitySet}`);