@rosthq/cli 0.7.98 → 0.7.100

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAuR3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAyR3D,CAAC"}

package/dist/index.js

@@ -43382,6 +43382,49 @@ var agentStatusOutputSchema = external_exports.object({
   runner_available: external_exports.boolean()
 }).strict();
 var agentListFleetInputSchema = external_exports.object({}).strict();
+var agentLivenessStateSchema = external_exports.enum([
+  "working",
+  "idle_waiting",
+  "resource_starved",
+  "unresponsive",
+  "failed_to_start",
+  "alive_but_silent"
+]);
+var hostResourcePressureSchema = external_exports.enum(["ok", "elevated", "critical"]);
+var agentLivenessSchema = external_exports.object({
+  state: agentLivenessStateSchema,
+  reasons: external_exports.array(external_exports.string()),
+  resource_pressure: hostResourcePressureSchema.nullable()
+}).strict();
+var fleetHostResourceSchema = external_exports.object({
+  reporting: external_exports.boolean(),
+  observed_at: isoDateTime4.nullable(),
+  load_avg_1m: external_exports.number().nullable(),
+  cpu_count: external_exports.number().int().nullable(),
+  memory_total_mb: external_exports.number().nullable(),
+  memory_available_mb: external_exports.number().nullable(),
+  swap_used_mb: external_exports.number().nullable(),
+  swap_total_mb: external_exports.number().nullable(),
+  pressure: hostResourcePressureSchema.nullable()
+}).strict();
+var fleetWorkEvidenceSchema = external_exports.object({
+  status: external_exports.enum(["fresh", "stale", "missing", "queued", "blocked"]),
+  label: external_exports.string(),
+  detail: external_exports.string(),
+  href: external_exports.string().nullable(),
+  run_id: uuidSchema14.nullable(),
+  linkable_run: external_exports.boolean(),
+  can_run_now: external_exports.boolean()
+}).strict();
+var workProgressStateSchema = external_exports.enum(["not_started", "in_progress", "handed_off", "done", "failed"]);
+var fleetWorkProgressSchema = external_exports.object({
+  state: workProgressStateSchema,
+  reasons: external_exports.array(external_exports.string()),
+  claimed_state: workProgressStateSchema.nullable(),
+  claim_mismatch: external_exports.boolean(),
+  last_activity_at: isoDateTime4.nullable(),
+  last_durable_activity_at: isoDateTime4.nullable()
+}).strict();
 var fleetOverviewRowSchema = external_exports.object({
   seat_id: uuidSchema14,
   seat_name: external_exports.string(),
@@ -43394,7 +43437,18 @@ var fleetOverviewRowSchema = external_exports.object({
   turns_7d: external_exports.number().int().nonnegative(),
   top_measurable_status: external_exports.enum(["on", "off", "pending", "none"]),
   open_escalations: external_exports.number().int().nonnegative(),
-  spend_usd: external_exports.string()
+  spend_usd: external_exports.string(),
+  // DER-1905: "idle" added — cadence-aware grading now distinguishes an
+  // on-demand agent with nothing pending (idle, neutral) from a scheduled
+  // agent that missed its cron (stale, alarming).
+  health_status: external_exports.enum(["needs_review", "stale", "idle", "setup_gap", "awaiting_data", "awaiting_data_overdue", "healthy"]),
+  health_reasons: external_exports.array(external_exports.string()),
+  work_evidence: fleetWorkEvidenceSchema,
+  liveness: agentLivenessSchema,
+  // runner-lane host-resource meter; null for cloud/mcp_session lanes.
+  host_resource: fleetHostResourceSchema.nullable(),
+  work_progress: fleetWorkProgressSchema,
+  work_progress_conflict: external_exports.boolean()
 }).strict();
 var agentListFleetOutputSchema = external_exports.object({
   agents: external_exports.array(fleetOverviewRowSchema)
@@ -43452,12 +43506,8 @@ var fleetDigestAgentSchema = fleetOverviewRowSchema.extend({
   spend_7d_usd: external_exports.string(),
   spend_30d_usd: external_exports.string(),
   cost_drift_percent: external_exports.number().int().nullable(),
-  // DER-1905: "idle" added — cadence-aware grading now distinguishes an
-  // on-demand agent with nothing pending (idle, neutral) from a scheduled
-  // agent that missed its cron (stale, alarming). Purely additive to this
-  // enum; no other field on this schema changed.
-  health_status: external_exports.enum(["needs_review", "stale", "idle", "setup_gap", "awaiting_data", "awaiting_data_overdue", "healthy"]),
-  health_reasons: external_exports.array(external_exports.string()),
+  // DER-1895: health_status/health_reasons now live on the base
+  // fleetOverviewRowSchema above (purely additive there too) — not redefined here.
   recent_failed_runs: external_exports.array(fleetDigestRunSchema),
   unresolved_errors: external_exports.array(fleetDigestErrorSchema),
   notification_errors: external_exports.array(fleetDigestNotificationErrorSchema),
@@ -43586,7 +43636,6 @@ var agentWatchRunInputSchema = external_exports.object({
   seat_id: uuidSchema14,
   run_id: uuidSchema14
 }).strict();
-var workProgressStateSchema = external_exports.enum(["not_started", "in_progress", "handed_off", "done", "failed"]);
 var runWatchCurrentStateSchema = external_exports.object({
   state: workProgressStateSchema,
   reasons: external_exports.array(external_exports.string()),
@@ -44269,6 +44318,14 @@ var syncBriefScopeGetOutputSchema = external_exports.object({
 var syncBriefScopeUpdateInputSchema = external_exports.object({
   sync_brief_scope: syncBriefScopeSchema
 }).strict();
+var memberVisibilityModeSchema = external_exports.enum(["all", "seat_subtree"]);
+var memberVisibilityGetInputSchema = external_exports.object({}).strict();
+var memberVisibilityGetOutputSchema = external_exports.object({
+  member_visibility_mode: memberVisibilityModeSchema
+}).strict();
+var memberVisibilityUpdateInputSchema = external_exports.object({
+  member_visibility_mode: memberVisibilityModeSchema
+}).strict();
 var productLearningModeSchema = external_exports.enum(["enabled", "disabled", "enterprise_contract"]);
 var tenantProductLearningPolicySchema = external_exports.object({
   mode: productLearningModeSchema,
@@ -44350,6 +44407,7 @@ var settingsGetOutputSchema = external_exports.object({
   has_anthropic_key: external_exports.boolean(),
   notifications: notificationSettingsSchema,
   sync_brief_scope: syncBriefScopeSchema,
+  member_visibility_mode: memberVisibilityModeSchema,
   product_learning: tenantProductLearningPolicySchema,
   integrations: external_exports.array(integrationSummarySchema)
 }).strict();
@@ -47646,7 +47704,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-14.2",
+    version: "2026-07-18.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -47735,7 +47793,7 @@ Agent creation at \`/agents/new\` begins with four doors: **Describe the job** o
 
 ## Review an agent seat's delivered work
 
-Agent seat pages show the operator-facing output trail, not just low-level run telemetry. The completed work area combines explicit \`agent_deliverables\`, successful \`work.log\` evidence, and recent successful run summaries into one readable list. Each item shows what was delivered, when it happened, what kind of work it was, and safe evidence links labelled as internal, Linear, GitHub, or external. Secret-shaped values are redacted before display, and run or task context is shown only when it belongs to the same seat. Forge artifact batches can also carry a metadata-only integrity verdict so duplicate hashes, zero-byte files, size outliers, and manifest count mismatches are visible without exposing file contents.
+Agent seat pages show the operator-facing output trail, not just low-level run telemetry. The completed work area combines explicit \`agent_deliverables\`, successful \`work.log\` evidence, and recent successful run summaries into one readable list. Each item shows what was delivered, when it happened, what kind of work it was, and safe evidence links labelled as internal, Linear, GitHub, or external. Secret-shaped values are redacted before display, and run or task context is shown only when it belongs to the same seat. Forge artifact batches can also carry a metadata-only integrity verdict so duplicate hashes, zero-byte files, size outliers, and manifest count mismatches are visible without exposing file contents. Each recorded deliverable also carries a status badge \u2014 awaiting decision, accepted, or rejected \u2014 and its accepted USD value once one is recorded; a still-undecided deliverable links through to \`/approvals\` to accept or reject it there, since this tab is read-only status, not the decision surface. Run-derived (not yet explicitly recorded) items always read as awaiting decision and never link to \`/approvals\`, since there is no deliverable there yet to decide on.
 
 The **Activity** tab layers a curated business-activity narrative above the Trust Card's forensic execution trace: period-scoped counter tiles (today, this week, or 30 days) summarise the seat's \`work.record\` activity by kind \u2014 a "held for your approval" tile is always shown, and an operator can pick which other kinds appear via a per-seat, browser-local tile picker. Below the tiles, a run-grouped activity feed lists each \`work.list\` record \u2014 verb, object, outcome, evidence link, and time \u2014 with a drill-down for entity refs, the \`template_ref\` used for external comms when one was recorded, and the raw structured details. A sessions browser lists the seat's runs and, for the selected one, its persisted transcript (\`session_transcripts\`) and artifacts rail: binary artifacts (Supabase Storage) get a freshly minted 60-second signed download link at render time, pointer artifacts (Gmail draft, Drive doc, PR, or an internal reference) link out when an external URL is known. The task queue and Trust Card below are unchanged. All of this sits behind the same sensitive-data access gate as the Trust Card; a restricted viewer sees an explicit unavailable state, never a guessed empty feed. The \`/agents\` fleet page mirrors the same row grammar in a tenant-wide **Work** view \u2014 every seat's activity in one filterable stream, each row linking back to that seat's Activity tab with the originating session focused.
 
@@ -48472,7 +48530,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-17.2",
+    version: "2026-07-18.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49076,7 +49134,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_get_current_compass\` | \`compass.get_current\` | Read the active and draft Compass versions and source documents. | Tenant | Call with \`{}\`. |
 | \`rost_list_compass_gaps\` | \`compass.list_gaps\` | List unanswered and answered Compass context gaps. | Tenant | Call with \`{}\` before answering gaps. |
 | \`rost_get_agent_status\` | \`agent.status\` | Read agent lane, live state, steward chain, dry-run result, Runner availability. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
-| \`rost_list_agent_fleet\` | \`agent.list_fleet\` | Read every staffed agent seat at once: lane, live state, last real turn, 24h/7d real turns, measurable status, escalations, and 7-day spend. | Tenant | Call with \`{}\`; counts use the same seat-run association as \`agent.list_runs\`, with sandbox dry runs excluded from real turns. |
+| \`rost_list_agent_fleet\` | \`agent.list_fleet\` | Read every staffed agent seat at once: lane, live state, last real turn, 24h/7d real turns, measurable status, escalations, and 7-day spend, plus the liveness/health/work-progress axes the web fleet page renders (liveness state, health status, work evidence, host-resource pressure). | Tenant | Call with \`{}\`; counts use the same seat-run association as \`agent.list_runs\`, with sandbox dry runs excluded from real turns. |
 | \`rost_get_dogfood_fleet_health_digest\` | \`agent.fleet_digest\` | Capture the daily dogfood fleet-health digest: live/idle state, 24h/7d turns, spend, recent failed runs, unresolved errors, failed notifications, and next actions. | Tenant | Call with \`{}\`; optional \`window_hours\` bounds recent failed-run evidence, while \`error_limit\` caps linked evidence per seat. |
 | \`rost_system_health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | Call with \`{}\`; optional \`seat_id\` narrows inside the caller's server-derived scope. |
 | \`rost_get_run_heartbeats\` | \`agent.run_heartbeats\` | Read the per-seat run-heartbeat roll-up (quiet-but-healthy vs stalled) for long-running agent programs. | Tenant | Call with \`{}\`; optional \`seat_ids\` narrows to specific seats. |
@@ -49135,6 +49193,8 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_rename_company\` | \`tenant.rename\` | Rename the current company. | Tenant-admin | Call with \`company_name\`; expect human confirmation. |
 | \`rost_get_sync_brief_scope\` | \`settings.sync_brief_scope.get\` | Read the tenant's Sync Brief scope (company_wide or per_cluster). | Tenant | Call with \`{}\`. |
 | \`rost_update_sync_brief_scope\` | \`settings.sync_brief_scope.update\` | Set the tenant's Sync Brief scope (company_wide or per_cluster). | Tenant-admin | Owner-only; call with \`{"sync_brief_scope":"company_wide"}\` or \`{"sync_brief_scope":"per_cluster"}\`. |
+| \`rost_get_member_visibility_mode\` | \`settings.member_visibility.get\` | Read the tenant's member visibility mode (all or seat_subtree). | Tenant | Call with \`{}\`. |
+| \`rost_update_member_visibility_mode\` | \`settings.member_visibility.update\` | Set the tenant's member visibility mode (all or seat_subtree). | Tenant-admin | Owner-only; call with \`{"member_visibility_mode":"all"}\` or \`{"member_visibility_mode":"seat_subtree"}\`. |
 | \`rost_get_product_learning_policy\` | \`settings.product_learning.get\` | Read whether product/page/recommendation analytics are allowed. | Tenant | Call with \`{}\`; audit/security logs are always enabled. |
 | \`rost_update_product_learning_policy\` | \`settings.product_learning.update\` | Set product-learning mode. | Tenant-admin | Human-gated; call with \`{"mode":"enabled"}\`, \`{"mode":"disabled"}\`, or \`{"mode":"enterprise_contract"}\`. |
 | \`rost_get_company_autonomy_ceiling\` | \`settings.agent_policy.get\` | Read the company autonomy ceiling (Company Guardrails): profile, enforcement, and max_autonomous_risk. | Tenant | Call with \`{}\`; metadata only. |
@@ -50345,7 +50405,7 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
-    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update", "settings.agent_policy.get", "settings.agent_policy.update", "settings.confirmation_policy.get", "settings.confirmation_policy.update", "tenant.model_gateway_policy.update", "aicos.brain_settings.get", "aicos.brain_settings.update"],
+    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.member_visibility.get", "settings.member_visibility.update", "settings.product_learning.get", "settings.product_learning.update", "settings.agent_policy.get", "settings.agent_policy.update", "settings.confirmation_policy.get", "settings.confirmation_policy.update", "tenant.model_gateway_policy.update", "aicos.brain_settings.get", "aicos.brain_settings.update"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native settings guidance."] },
     sources: [
       {
@@ -52533,7 +52593,7 @@ var COMMAND_MANIFEST = [
   { "id": "agent.get_run", "namespace": "agent", "action": "get_run", "title": "Get agent run diagnostics", "description": "Return one seat run's diagnostic record: run status, transcript reference, token/cost usage, outcome, and linked product-visible run errors.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "run_id", "flag": "run-id", "type": "string", "required": true }, { "name": "transcript", "flag": "transcript", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Read one run's diagnostic record, transcript reference, token/cost usage, outcome, and linked product-visible errors." },
   { "id": "agent.go_live", "namespace": "agent", "action": "go_live", "title": "Go live", "description": "Promote a dry-run agent seat to live after the human approval gate.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Move an agent live only after dry-run evidence, signed permissions, and a human Steward chain are clear.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc" } },
   { "id": "agent.import_definition", "namespace": "agent", "action": "import_definition", "title": "Import agent definition", "description": "Import a versioned ROST agent definition into a canonical draft Seat and setup state without credentials, placement identifiers, or go-live side effects.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "definition_json", "flag": "definition-json", "type": "string", "required": true }, { "name": "idempotency_key", "flag": "idempotency-key", "type": "string", "required": false }], "hasComplexInput": false, "help": "Import a strict, versioned ROST agent definition into a canonical draft Seat/setup. The file cannot carry credentials or tenant-local placement ids; tools remain proposal-only until reviewed through setup." },
-  { "id": "agent.list_fleet", "namespace": "agent", "action": "list_fleet", "title": "List agent fleet", "description": "Return every agent-occupied seat with lane, live state, last real turn, recent turn counts, top measurable status, open escalations, and 7-day real-run spend.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read every agent-occupied seat at once: lane, live state, last real turn, 24h/7d turns, measurable status, escalations, and spend." },
+  { "id": "agent.list_fleet", "namespace": "agent", "action": "list_fleet", "title": "List agent fleet", "description": "Return every agent-occupied seat with lane, live state, last real turn, recent turn counts, top measurable status, open escalations, 7-day real-run spend, and the honest liveness/health/work-progress axes the web fleet page renders (liveness, health status, work evidence, work progress, host-resource pressure).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read every agent-occupied seat at once: lane, live state, last real turn, 24h/7d turns, measurable status, escalations, and spend." },
   { "id": "agent.list_runs", "namespace": "agent", "action": "list_runs", "title": "List agent runs", "description": "Return a seat's agent run history (status, lane, model, cost, per-run tool-call, guard-denied, and guard-held counts) plus the seat's run/tool-call rollup with held-action count.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Audit a seat's agent run history with per-run tool-call, guard-denied, and guard-held counts (the Trust Card)." },
   { "id": "agent.list_tool_calls", "namespace": "agent", "action": "list_tool_calls", "title": "List agent tool calls", "description": "Return a seat's tool-call ledger (tool name, guard result, manifest clause, outcome) with the held-action count as the hero metric. Pass held_only to return only guard-held calls. Never returns argument summaries or secret material.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }, { "name": "held_only", "flag": "held-only", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Audit a seat's tool-call ledger with each call's guard result; held actions are the hero metric." },
   { "id": "agent.pause", "namespace": "agent", "action": "pause", "title": "Pause agent", "description": "Pause a live agent so it stops scheduled and on-demand runs. Reversible with agent.resume.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Pause a live agent so it stops scheduled and on-demand runs; queued work orders are expired and a paused agent refuses to run until resumed. Reversible, unlike agent.decommission." },
@@ -52678,6 +52738,8 @@ var COMMAND_MANIFEST = [
   { "id": "settings.confirmation_policy.get", "namespace": "settings", "action": "confirmation_policy.get", "title": "Get CLI confirmation mode", "description": "Read this company's CLI confirmation mode (DER-1490): careful (the strict default \u2014 the CLI cannot silently auto-approve a confirmation) or trusted_operator (an owner opt-in permitting silent auto-approval of non-dangerous confirmations). Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read this company's CLI confirmation mode: careful (the strict default \u2014 the CLI cannot silently auto-approve a confirmation) or trusted_operator (an owner opt-in permitting silent auto-approval of non-dangerous confirmations)." },
   { "id": "settings.confirmation_policy.update", "namespace": "settings", "action": "confirmation_policy.update", "title": "Set CLI confirmation mode", "description": "Set this company's CLI confirmation mode (DER-1490): careful (strict \u2014 no silent CLI auto-approval) or trusted_operator (owner opt-in permitting silent auto-approval of non-dangerous confirmations; dangerous confirmations always require an interactive review). Owner-only and human-gated: choosing trusted_operator establishes an ADR-0018 \xA76 standing authorization.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "cli_mode", "flag": "cli-mode", "type": "enum", "required": true, "enumValues": ["trusted_operator", "careful"] }], "hasComplexInput": false, "help": "Set the CLI confirmation mode to careful or trusted_operator. Owner-only and human-gated; trusted_operator establishes a standing authorization and dangerous confirmations still require an interactive review." },
   { "id": "settings.get", "namespace": "settings", "action": "get", "title": "Get tenant settings", "description": "Read tenant operating settings: plan, status, spend/budgets, integration status, and notification preferences. Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read tenant operating settings: plan, spend, budgets, integration status, and notification preferences. No secrets." },
+  { "id": "settings.member_visibility.get", "namespace": "settings", "action": "member_visibility.get", "title": "Get member visibility mode", "description": "Read the tenant's member visibility mode: all (every member sees all Signals/Frictions) or seat_subtree (a member sees only their occupied seats plus downstream seats).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read whether members see all Signals/Frictions tenant-wide (all) or only their occupied seats plus downstream seats (seat_subtree)." },
+  { "id": "settings.member_visibility.update", "namespace": "settings", "action": "member_visibility.update", "title": "Update member visibility mode", "description": "Set the tenant's member visibility mode (all or seat_subtree). Governs how non-owner members see Signals (Scorecard) and Frictions (Issues); write actions stay role-gated.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "member_visibility_mode", "flag": "member-visibility-mode", "type": "enum", "required": true, "enumValues": ["all", "seat_subtree"] }], "hasComplexInput": false, "help": "Set member visibility to all or seat_subtree; owner-only. Governs how non-owner members see the Scorecard and Issues; write actions stay role-gated." },
   { "id": "settings.product_learning.get", "namespace": "settings", "action": "product_learning.get", "title": "Get product-learning policy", "description": "Read whether product/page/recommendation analytics may be recorded for this tenant. Security and audit logs remain enabled in every mode.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read whether product/page/recommendation analytics are allowed for the tenant; security and audit logs always stay enabled." },
   { "id": "settings.product_learning.update", "namespace": "settings", "action": "product_learning.update", "title": "Update product-learning policy", "description": "Set tenant product-learning participation. Disabled and enterprise-contract modes block generic product analytics writes, but not security/audit logs.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "mode", "flag": "mode", "type": "enum", "required": true, "enumValues": ["enabled", "disabled", "enterprise_contract"] }], "hasComplexInput": false, "help": "Set tenant product-learning mode to enabled, disabled, or enterprise_contract; the change is human-gated." },
   { "id": "settings.sync_brief_scope.get", "namespace": "settings", "action": "sync_brief_scope.get", "title": "Get Sync Brief scope", "description": "Read the tenant's Sync Brief scope: company_wide (one weekly brief) or per_cluster (one brief per cluster).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read whether weekly Sync Briefs compile company-wide (one brief) or per cluster (one brief per cluster)." },