@rosthq/cli 0.7.97 → 0.7.98

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAsR3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAuR3D,CAAC"}

package/dist/index.js

@@ -44731,7 +44731,15 @@ var brokerProviderSchema = external_exports.string().trim().min(1).max(100).refi
   message: "provider must be a label, never raw secret material"
 });
 var brokerAllowedHostSchema = external_exports.string().trim().min(1).max(255).regex(/^[a-zA-Z0-9.-]+$/, "allowed_host must be a bare hostname (letters, digits, dots, hyphens) \u2014 no scheme, port, or path");
-var brokerAllowedPathPrefixSchema = external_exports.string().min(1).max(512).refine((value) => value.startsWith("/"), { message: "allowed_path_prefix must start with /" }).refine((value) => !value.includes("//"), { message: "allowed_path_prefix must not contain //" }).refine((value) => !value.includes("\\"), { message: "allowed_path_prefix must not contain a backslash" }).refine((value) => !value.includes("://"), { message: "allowed_path_prefix must not contain a scheme" }).refine((value) => !value.includes("?") && !value.includes("#"), { message: "allowed_path_prefix must not contain a query or fragment" }).refine((value) => !value.includes(".."), { message: "allowed_path_prefix must not contain .." }).refine((value) => ![...value].some((ch) => ch <= " "), { message: "allowed_path_prefix must not contain whitespace or control characters" });
+var brokerAllowedPathPrefixSchema = external_exports.string().min(1).max(512).refine((value) => value.startsWith("/"), { message: "allowed_path_prefix must start with /" }).refine((value) => !value.includes("//"), { message: "allowed_path_prefix must not contain //" }).refine((value) => !value.includes("\\"), { message: "allowed_path_prefix must not contain a backslash" }).refine((value) => !value.includes("://"), { message: "allowed_path_prefix must not contain a scheme" }).refine((value) => !value.includes("?") && !value.includes("#"), { message: "allowed_path_prefix must not contain a query or fragment" }).refine((value) => !value.includes(".."), { message: "allowed_path_prefix must not contain .." }).refine((value) => {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    return false;
+  }
+  return !decoded.includes("..");
+}, { message: "allowed_path_prefix must not contain encoded path traversal" }).refine((value) => !/[\s\x00-\x1f]/.test(value), { message: "allowed_path_prefix must not contain whitespace or control characters" });
 var brokerHttpMethodSchema = external_exports.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]);
 var READ_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
 var brokerScopeTierSchema = external_exports.enum(["read", "write"]);
@@ -44766,6 +44774,9 @@ var secretGrantRequestInputSchema = external_exports.object({
 var secretGrantRequestOutputSchema = external_exports.object({
   requested: external_exports.literal(true),
   event_id: uuid10,
+  // DER-1888: the durable, resolvable agent_grant_interventions handle this
+  // request opened (blocker_kind 'vault_credential') — the human's next hop.
+  intervention_id: uuid10,
   seat_id: uuid10,
   grant_key: external_exports.string(),
   scope_tier: brokerScopeTierSchema
@@ -46682,6 +46693,17 @@ var deliverableAcceptOutputSchema = external_exports.object({
   accepted_at: external_exports.string(),
   impact_value_usd: external_exports.number().nonnegative()
 }).strict();
+var deliverableRejectInputSchema = external_exports.object({
+  deliverable_id: external_exports.string().uuid(),
+  reason: external_exports.string().max(500).optional()
+}).strict();
+var deliverableRejectOutputSchema = external_exports.object({
+  deliverable_id: external_exports.string().uuid(),
+  acceptance_status: external_exports.literal("rejected"),
+  rejected_by: external_exports.string().uuid(),
+  rejected_at: external_exports.string(),
+  reason: external_exports.string().nullable()
+}).strict();
 
 // ../../packages/protocol/src/steward.ts
 var uuidSchema20 = external_exports.string().uuid();
@@ -47026,6 +47048,11 @@ var agentGrantInterventionDecideOutputSchema = external_exports.object({
   // True when the human chose the permanent option — the surface must route to a
   // Charter re-sign; no authority was widened by this call (invariant #10).
   requires_charter_resign: external_exports.boolean(),
+  // DER-1888: true when the blocked grant is a vault_credential ask — a decide
+  // grant does NOT clear it (it holds no vault_ref and would false-clear a secrets
+  // gate, invariant #5/#7); the surface must route the human to secret_grant.grant.
+  // No authority was granted here; the record stays open.
+  requires_secret_grant: external_exports.boolean(),
   // True when authority committed but the continuation enqueue did not complete —
   // the human can retry ONLY the enqueue via `resume` (never re-grant).
   enqueue_failed: external_exports.boolean()
@@ -48445,7 +48472,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-16.9",
+    version: "2026-07-17.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -48512,6 +48539,7 @@ External connectors are being rolled out provider by provider, conservatively (r
       "deliverable.create",
       "deliverable.attach",
       "deliverable.accept",
+      "deliverable.reject",
       "usage.report",
       "usage.snapshot",
       "error_log.list",
@@ -49060,6 +49088,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_agent_deliverables\` | \`deliverable.list\` | List durable agent deliverables for a seat, including explicit outputs and successful-run summaries. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_get_agent_deliverable\` | \`deliverable.get\` | Read one durable agent deliverable by id for a seat. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>","deliverable_id":"<id>"}\`. |
 | \`rost_accept_deliverable_value\` | \`deliverable.accept\` | Record a human-confirmed accepted value (USD) on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-accept. Re-accepting records a correction as a new event. | Tenant-admin | Call with \`{"deliverable_id":"<id>","impact_value_usd":<number>}\`; expect human confirmation. |
+| \`rost_reject_deliverable_value\` | \`deliverable.reject\` | Record a human-confirmed rejection on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-reject. Re-rejecting records a correction as a new event. | Tenant-admin | Call with \`{"deliverable_id":"<id>","reason":"<why>"}\`; expect human confirmation. |
 | \`rost_ai_workforce_roi_report\` | \`usage.report\` | Read the AI-workforce ROI report \u2014 per-period agent turns, token/run cost, human-accepted value, exceptions, and approvals \u2014 from immutable usage snapshots. | Tenant | Call with \`{}\` or \`{"limit":<n>}\`. |
 | \`rost_capture_usage_period_snapshot\` | \`usage.snapshot\` | Freeze the current (or a given) period's usage and accepted-value totals into an immutable snapshot; insert-only and idempotent. | Tenant | Call with \`{}\` or \`{"period":"YYYY-MM-DD"}\`. |
 | \`rost_list_agent_templates\` | \`agent_template.list\` | List stock agent templates and metadata. | Tenant | Call with \`{}\`. |
@@ -49183,7 +49212,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_expire_agent_trusted_grants\` | \`agent.trust.expire\` | Mark overdue active Trusted grants expired and append audit events. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>"}\`. |
 | \`rost_supersede_agent_trusted_grant\` | \`agent.trust.supersede\` | Replace the active Trusted grant with a fresh digest and budget. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>","expected_scope_digest":"sha256:...","budget_cents":2500}\`. |
 | \`rost_list_blocked_awaiting_grant_interventions\` | \`agent_grant_intervention.list\` | List durable blocked-awaiting-grant agent interventions with their missing grant, blocker kind, checkpoint, and decision state. Returns secret-scrubbed metadata only; a seat-scoped caller is clamped to its own seat. Pass \`include_decided\` to also return terminal (declined/resumed/expired) records. | Seat or tenant-admin | Call with \`{}\` (or \`{"seat_id":"<seat-id>","include_decided":true}\`). |
-| \`rost_decide_a_blocked_agent_grant\` | \`agent_grant_intervention.decide\` | Grant (one-time, exact-action) or decline a blocked agent intervention. A grant writes a human decision and enqueues the linked continuation; the \`permanent\` grant kind never auto-widens \u2014 it returns \`requires_charter_resign\` so the surface routes the human to a Charter re-sign. A supplied \`action_digest\` must byte-match the record's or the grant expires instead of replaying a stale action. Human steward/admin only and human-gated. | Tenant | Call with \`{"intervention_id":"<intervention-id>","action":"grant","grant_kind":"allow_once","action_digest":"sha256:..."}\`; non-interactive callers receive a confirmation handoff. |
+| \`rost_decide_a_blocked_agent_grant\` | \`agent_grant_intervention.decide\` | Grant (one-time, exact-action) or decline a blocked agent intervention. A grant writes a human decision and enqueues the linked continuation; the \`permanent\` grant kind never auto-widens \u2014 it returns \`requires_charter_resign\` so the surface routes the human to a Charter re-sign. A grant on a \`vault_credential\` blocker returns \`requires_secret_grant\` (a decide holds no vault ref and cannot mint the secret) so the surface routes the human to \`secret_grant.grant\` instead of clearing the block. A supplied \`action_digest\` must byte-match the record's or the grant expires instead of replaying a stale action. Human steward/admin only and human-gated. | Tenant | Call with \`{"intervention_id":"<intervention-id>","action":"grant","grant_kind":"allow_once","action_digest":"sha256:..."}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_resume_a_granted_agent_intervention\` | \`agent_grant_intervention.resume\` | Retry ONLY the continuation enqueue for an already-granted blocked intervention whose enqueue did not complete. Never re-grants authority (the one-time grant is already committed). Human steward/admin only. | Tenant | Call with \`{"intervention_id":"<intervention-id>"}\`. |
 | \`rost_suggest_setup_capability_grants\` | \`agent_setup.capability_suggestions\` | Suggest deterministic minimum capability grants from the current setup/template and tenant grant availability. | Tenant | Call with \`{"seat_id":"<seat-id>"}\` or \`{"setup_id":"<agent-id>"}\`; no model call and no mutation. |
 | \`rost_list_skills\` | \`skill.list\` | List tenant Skills with application descriptors, dependency metadata, source status, latest version, and assigned Seat count. Seat-scoped reads are available through \`rost://skills\`. | Tenant-admin | Call with \`{}\` or \`{"query":"invoice"}\`. |
@@ -49285,7 +49314,7 @@ Seat-scoped MCP tokens expose the operating protocol below. The server still che
 | \`rost_list_work_records\` | \`work.list\` | List the seat's work-ledger records newest-first (keyset-paginated), filterable by verb, object kind/ref, outcome, or run. | Seat | Call with \`{"verb":"contacted","object_kind":"supplier","limit":50}\`. |
 | \`rost_request_a_forge_secret_grant\` | \`software_factory.secret.request\` | Request access to a project secret by key. It creates a durable credential request and approval Task, never accepts a secret value, and does not grant access by itself. | Seat | Call with \`{"software_project_id":"<project-id>","environment":"preview","seat_id":"<seat-id>","action":"test.run","key_name":"OPENAI_API_KEY"}\`. |
 | \`rost_verify_forge_secret_broker_access\` | \`software_factory.secret.use\` | Verify broker authorization for a Forge secret without opening the vault. Missing grants create or reuse a credential request + approval Task; allowed grants return a redacted authorization summary only. Runtime vault use happens runner-side. | Seat | Call with \`{"software_project_id":"<project-id>","environment":"preview","seat_id":"<seat-id>","action":"test.run","key_name":"OPENAI_API_KEY","operation":"test_execution"}\`. |
-| \`rost_request_a_brokered_secret_grant\` | \`secret_grant.request\` | A seat agent requests a scoped brokered-secret grant (for secret.broker / baserow.*) by naming the host, path prefix, methods, and scope it needs. Draft-and-confirm: no secret and no vault ref; returns an event id for a human to grant via secret_grant.grant. | Seat | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET"],"scope_tier":"read"}. |
+| \`rost_request_a_brokered_secret_grant\` | \`secret_grant.request\` | A seat agent requests a scoped brokered-secret grant (for secret.broker / baserow.*) by naming the host, path prefix, methods, and scope it needs. Draft-and-confirm: no secret and no vault ref. It records a durable blocked-awaiting-grant intervention (blocker_kind vault_credential) that surfaces on the Home "Needs you" band and the blocked seat's page, and returns both an event id and an intervention_id (the human's resolvable handle). A human grants via secret_grant.grant, which closes the intervention. | Seat | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET"],"scope_tier":"read"}. |
 | \`rost_list_brokered_secret_grants\` | \`secret_grant.list\` | List the seat's own brokered secret grants. Returns egress allowlist metadata only (host, path prefix, methods, scope, status), never the vault ref or any secret. | Seat | Call with {} (an agent is server-pinned to its own seat). |
 | \`rost_record_forge_conformance_findings\` | \`software_factory.conformance.record_findings\` | A Forge review seat (plan conformance, security, or QA) records structured findings as reviewer evidence. Set \`changeset_id\` on a finding that targets a specific changeset. Open findings route the request back to implementation; accepting a gap remains a separate human gate. Requires the seat's signed manifest grant. | Seat | Call with \`{"build_request_id":"<request-id>","findings":[{"severity":"major","category":"scope_gap","summary":"Missing migration verification","changeset_id":"<changeset-id>"}]}\`. |
 | \`rost_resolve_forge_conformance_finding\` | \`software_factory.conformance.resolve_finding\` | A Forge review seat marks a prior open finding resolved after re-reviewing the changeset and verifying it is fixed (reviewer verification, not human gap-acceptance). A resolved finding stops routing the request back to implementation, so the recycle loop converges. Requires the seat's signed manifest grant. | Seat | Call with \`{"build_request_id":"<request-id>","finding_ids":["<finding-id>"]}\`. |
@@ -50134,7 +50163,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-07-17.1",
+    version: "2026-07-17.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -50192,7 +50221,7 @@ A confirmation that expires before a human acts on it is dead \u2014 it can no l
 
 ## The rule for agents
 
-An agent never approves or rejects its own request. \`decisions.decided_by\` is always a human. The steward decision commands (\`escalation.resolve\`, \`escalation.reject\`) and proposal decision commands (\`task.confirm_proposal\`, \`task.decline_proposal\`) are not exposed over MCP. When an agent hits a gate, it prepares the evidence and the recommended action, returns the approve link, and waits for a human. Draft task proposals follow the same rule: the agent can propose the commitment, but a target-side human confirms or declines it unless a bounded Trusted grant applies.
+An agent never approves or rejects its own request. \`decisions.decided_by\` is always a human. A rejection is a decision too: rejecting any human-gated confirmation writes its own \`decisions\` row (\`decided_by\` = the rejecting human, referencing the confirmation, the command id, and its redacted argument summary), so a human's "no" is recorded in the durable audit trail \u2014 the same standing an approval leaves, not just a status flip on the pending card. Dismissing an expired card is the sole exception (queue hygiene, not a decision). The steward decision commands (\`escalation.resolve\`, \`escalation.reject\`) and proposal decision commands (\`task.confirm_proposal\`, \`task.decline_proposal\`) are not exposed over MCP. When an agent hits a gate, it prepares the evidence and the recommended action, returns the approve link, and waits for a human. Draft task proposals follow the same rule: the agent can propose the commitment, but a target-side human confirms or declines it unless a bounded Trusted grant applies.
 
 ## When to stop
 
@@ -52562,6 +52591,7 @@ var COMMAND_MANIFEST = [
   { "id": "deliverable.create", "namespace": "deliverable", "action": "create", "title": "Create agent deliverable", "description": "Create an agent deliverable for the acting seat. The deliverable is scrubbed for secrets before storage.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["brief", "work_evidence", "artifact", "report", "other"] }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": false }, { "name": "content", "flag": "content", "type": "string", "required": false }, { "name": "delivered_at", "flag": "delivered-at", "type": "string", "required": false }], "hasComplexInput": true, "help": "Create a scrubbed durable work output for the acting seat without making a durable company decision." },
   { "id": "deliverable.get", "namespace": "deliverable", "action": "get", "title": "Get agent deliverable", "description": "Return one agent deliverable by id for a seat.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Read one durable agent deliverable by id after checking seat-scoped access." },
   { "id": "deliverable.list", "namespace": "deliverable", "action": "list", "title": "List agent deliverables", "description": "Return agent deliverables for a seat, including derived entries from succeeded runs with outcome summaries.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "List durable agent deliverables for a seat, including explicit outputs and successful-run summaries." },
+  { "id": "deliverable.reject", "namespace": "deliverable", "action": "reject", "title": "Reject deliverable value", "description": "Record a human-confirmed rejection on a deliverable. Humans decide; agents cannot self-reject. Re-rejecting records a correction as a new event; prior events are never mutated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "deliverable_id", "flag": "deliverable-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Record a human-confirmed rejection on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-reject. Re-rejecting records a correction as a new event." },
   { "id": "error_log.bulk_resolve", "namespace": "error_log", "action": "bulk_resolve", "title": "Bulk resolve error logs", "description": "Acknowledge or resolve a batch of stale error logs in one human-confirmed action, with a required reason. Each error log is resolved independently (partial success) and writes its own resolution event; already-resolved or missing ids are skipped.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "error_log_ids", "flag": "error-log-ids", "type": "array", "required": true, "itemType": "string" }, { "name": "reason", "flag": "reason", "type": "string", "required": true }, { "name": "disposition", "flag": "disposition", "type": "enum", "required": false, "enumValues": ["acknowledged", "resolved"] }], "hasComplexInput": false, "help": "Acknowledge or resolve a batch of stale error logs in one human-confirmed action with a required reason; each is resolved independently (partial success) and already-resolved or missing ids are skipped." },
   { "id": "error_log.list", "namespace": "error_log", "action": "list", "title": "List error logs", "description": "List tenant error logs with optional filtering by seat, source, severity, and resolved state.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "source", "flag": "source", "type": "enum", "required": false, "enumValues": ["run", "llm", "tool", "mcp", "runner", "integration", "job", "web"] }, { "name": "severity", "flag": "severity", "type": "enum", "required": false, "enumValues": ["warning", "error", "critical"] }, { "name": "resolved", "flag": "resolved", "type": "enum", "required": false, "enumValues": ["active", "acknowledged", "resolved", "all"] }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List product-visible error logs by source, severity, seat, and active/resolved disposition before closing stale failures." },
   { "id": "error_log.resolve", "namespace": "error_log", "action": "resolve", "title": "Resolve error log", "description": "Acknowledge or resolve an error log with a required reason and optional linked task, Friction issue, or PR reference.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "error_log_id", "flag": "error-log-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": true }, { "name": "disposition", "flag": "disposition", "type": "enum", "required": false, "enumValues": ["acknowledged", "resolved"] }, { "name": "linked_task_id", "flag": "linked-task-id", "type": "string", "required": false }, { "name": "linked_issue_id", "flag": "linked-issue-id", "type": "string", "required": false }, { "name": "linked_pr_ref", "flag": "linked-pr-ref", "type": "string", "required": false }], "hasComplexInput": false, "help": "Acknowledge or resolve a stale error log with a required human reason and optional task, issue, or PR evidence." },