@scheduler-systems/gal-run 0.0.319 → 0.0.321

package/dist/index.cjs

@@ -3970,7 +3970,7 @@ var cliVersion, defaultApiUrl, BUILD_CONSTANTS, constants_default;
 var init_constants = __esm({
   "src/constants.ts"() {
     "use strict";
-    cliVersion = true ? "0.0.319" : "0.0.0-dev";
+    cliVersion = true ? "0.0.321" : "0.0.0-dev";
     defaultApiUrl = true ? "https://api.gal.run" : "http://localhost:3000";
     BUILD_CONSTANTS = Object.freeze([cliVersion, defaultApiUrl]);
     constants_default = BUILD_CONSTANTS;
@@ -4880,7 +4880,7 @@ function detectEnvironment() {
     return "dev";
   }
   try {
-    const version = true ? "0.0.319" : void 0;
+    const version = true ? "0.0.321" : void 0;
     if (version && version.includes("-local")) {
       return "dev";
     }
@@ -5249,7 +5249,7 @@ function getId() {
 }
 function getCliVersion() {
   try {
-    return true ? "0.0.319" : "0.0.0-dev";
+    return true ? "0.0.321" : "0.0.0-dev";
   } catch {
     return "0.0.0-dev";
   }
@@ -6047,6 +6047,20 @@ var init_sso = __esm({
   }
 });
 
+// ../../packages/types/dist/memory.js
+var init_memory = __esm({
+  "../../packages/types/dist/memory.js"() {
+    "use strict";
+  }
+});
+
+// ../../packages/types/dist/secrets.js
+var init_secrets = __esm({
+  "../../packages/types/dist/secrets.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/types/dist/index.js
 var GAL_TERMS_URL, GAL_PRIVACY_URL, PLATFORM_PATTERNS;
 var init_dist2 = __esm({
@@ -6101,6 +6115,8 @@ var init_dist2 = __esm({
     init_mal_cross_project();
     init_design_project();
     init_sso();
+    init_memory();
+    init_secrets();
     GAL_TERMS_URL = "https://scheduler-systems.com/legal/en/gal-terms.pdf";
     GAL_PRIVACY_URL = "https://scheduler-systems.com/legal/en/gal-privacy.pdf";
     PLATFORM_PATTERNS = {
@@ -6482,7 +6498,7 @@ var init_organization = __esm({
   "../../packages/core/src/domain/organization.ts"() {
     "use strict";
     Organization = class {
-      constructor(id, name, installationId2, accountType, totalRepos, totalConfigs, totalCommands, totalHooks, settings, commands, hooks, platforms, hookSettings, planTier, seatLimit, stripeCustomerId, stripeSubscriptionId, manualGrant, configRepoEnabled, configRepoUrl, configRepoCreatedAt, lastConfigSyncAt, lastScanAt, audienceTier, installedByGithubId, installedByLogin, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date()) {
+      constructor(id, name, installationId2, accountType, totalRepos, totalConfigs, totalCommands, totalHooks, settings, commands, hooks, platforms, hookSettings, planTier, seatLimit, stripeCustomerId, stripeSubscriptionId, manualGrant, configRepoEnabled, configRepoUrl, configRepoCreatedAt, lastConfigSyncAt, lastScanAt, audienceTierRef, audienceTierSource, entitledFeatures, installedByGithubId, installedByLogin, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date()) {
         this.id = id;
         this.name = name;
         this.installationId = installationId2;
@@ -6506,7 +6522,9 @@ var init_organization = __esm({
         this.configRepoCreatedAt = configRepoCreatedAt;
         this.lastConfigSyncAt = lastConfigSyncAt;
         this.lastScanAt = lastScanAt;
-        this.audienceTier = audienceTier;
+        this.audienceTierRef = audienceTierRef;
+        this.audienceTierSource = audienceTierSource;
+        this.entitledFeatures = entitledFeatures;
         this.installedByGithubId = installedByGithubId;
         this.installedByLogin = installedByLogin;
         this.createdAt = createdAt;
@@ -6621,6 +6639,13 @@ var init_team_member = __esm({
       isAdmin() {
         return this.galRole === "owner" || this.galRole === "admin";
       }
+      /**
+       * Check if member has security permissions (owner, admin, or security role).
+       * Admin automatically inherits security permissions per #4245.
+       */
+      isSecurity() {
+        return this.galRole === "owner" || this.galRole === "admin" || this.galRole === "security";
+      }
       /**
        * Check if member is a developer
        */
@@ -7596,6 +7621,13 @@ var init_MigrationRegistry = __esm({
   }
 });
 
+// ../../packages/core/src/migrations/register-all-migrations.ts
+var init_register_all_migrations = __esm({
+  "../../packages/core/src/migrations/register-all-migrations.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/core/src/index.ts
 var init_src = __esm({
   "../../packages/core/src/index.ts"() {
@@ -7639,6 +7671,7 @@ var init_src = __esm({
     init_convenience_model_telemetry();
     init_DiscoveryInsightValidator();
     init_MigrationRegistry();
+    init_register_all_migrations();
   }
 });
 
@@ -7736,7 +7769,7 @@ function getHiddenCommandError(commandName, context) {
     const requiredAudience = flag.audience ?? "public";
     if (!meetsAudience(resolvedContext.audience, requiredAudience)) {
       if (requiredAudience === "internal") {
-        reasons.push("Requires admin org membership");
+        reasons.push("Requires an org with internal audienceTier");
       } else if (requiredAudience === "partners") {
         reasons.push("Requires partner access");
       }
@@ -7761,7 +7794,7 @@ function getHiddenCommandError(commandName, context) {
     "  gal mcp doctor       Verify MCP connectivity and tools",
     "  gal --help           Show all available commands",
     "",
-    "Requires internal org membership. Run: gal auth login"
+    "Requires an org with internal audienceTier. Run: gal auth login"
   );
   if (flag?.environments && !flag.environments.includes(resolvedContext.environment)) {
     lines.push("For environment override, set: GAL_ENVIRONMENT=dev");
@@ -7856,7 +7889,7 @@ var init_feature_flags2 = __esm({
     COMMAND_CATEGORIES = {
       // Core convenience package (always visible)
       core: ["auth", "sync", "mcp", "feedback", "update", "hooks", "status", "discover", "approve", "approved-config", "propose", "workspace", "fetch", "join", "scan", "memory", "policy"],
-      // Internal development commands (requires admin org membership or GAL_INTERNAL=true)
+      // Internal development commands (requires org with internal audienceTier; GAL_INTERNAL=true is dev/test override only)
       internal: [
         "admin",
         "agent",
@@ -11796,7 +11829,7 @@ var init_organization2 = __esm({
   "../../packages/core/dist/domain/organization.js"() {
     "use strict";
     Organization2 = class {
-      constructor(id, name, installationId2, accountType, totalRepos, totalConfigs, totalCommands, totalHooks, settings, commands, hooks, platforms, hookSettings, planTier, seatLimit, stripeCustomerId, stripeSubscriptionId, manualGrant, configRepoEnabled, configRepoUrl, configRepoCreatedAt, lastConfigSyncAt, lastScanAt, audienceTier, installedByGithubId, installedByLogin, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date()) {
+      constructor(id, name, installationId2, accountType, totalRepos, totalConfigs, totalCommands, totalHooks, settings, commands, hooks, platforms, hookSettings, planTier, seatLimit, stripeCustomerId, stripeSubscriptionId, manualGrant, configRepoEnabled, configRepoUrl, configRepoCreatedAt, lastConfigSyncAt, lastScanAt, audienceTierRef, audienceTierSource, entitledFeatures, installedByGithubId, installedByLogin, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date()) {
         this.id = id;
         this.name = name;
         this.installationId = installationId2;
@@ -11820,7 +11853,9 @@ var init_organization2 = __esm({
         this.configRepoCreatedAt = configRepoCreatedAt;
         this.lastConfigSyncAt = lastConfigSyncAt;
         this.lastScanAt = lastScanAt;
-        this.audienceTier = audienceTier;
+        this.audienceTierRef = audienceTierRef;
+        this.audienceTierSource = audienceTierSource;
+        this.entitledFeatures = entitledFeatures;
         this.installedByGithubId = installedByGithubId;
         this.installedByLogin = installedByLogin;
         this.createdAt = createdAt;
@@ -12178,6 +12213,13 @@ var init_team_member2 = __esm({
       isAdmin() {
         return this.galRole === "owner" || this.galRole === "admin";
       }
+      /**
+       * Check if member has security permissions (owner, admin, or security role).
+       * Admin automatically inherits security permissions per #4245.
+       */
+      isSecurity() {
+        return this.galRole === "owner" || this.galRole === "admin" || this.galRole === "security";
+      }
       /**
        * Check if member is a developer
        */
@@ -12865,6 +12907,13 @@ var init_MigrationRegistry2 = __esm({
   }
 });
 
+// ../../packages/core/dist/migrations/register-all-migrations.js
+var init_register_all_migrations2 = __esm({
+  "../../packages/core/dist/migrations/register-all-migrations.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/core/dist/index.js
 var init_dist3 = __esm({
   "../../packages/core/dist/index.js"() {
@@ -12908,6 +12957,7 @@ var init_dist3 = __esm({
     init_convenience_model_telemetry2();
     init_DiscoveryInsightValidator2();
     init_MigrationRegistry2();
+    init_register_all_migrations2();
   }
 });
 
@@ -13142,7 +13192,12 @@ var init_HttpOrganizationRepository = __esm({
           data.configRepoCreatedAt,
           data.lastConfigSyncAt,
           data.lastScanAt ? new Date(data.lastScanAt) : void 0,
-          data.audienceTier,
+          data.audienceTierRef ?? null,
+          // #4220: reads only audienceTierRef (migration removes old audienceTier string)
+          data.audienceTierSource ?? null,
+          // #4089: 'stripe' | 'admin' | null
+          data.entitledFeatures ?? null,
+          // #4201: entitled features from Stripe sync
           data.installedByGithubId,
           data.installedByLogin,
           data.createdAt ? new Date(data.createdAt) : /* @__PURE__ */ new Date(),
@@ -33692,7 +33747,7 @@ function writeCursorConfig(directory, configData, syncedFiles, syncedItems) {
     });
   }
 }
-function writeClaudeConfig(directory, configData, syncedFiles, syncedItems) {
+function writeClaudeConfig(directory, configData, syncedFiles, syncedItems, orgName) {
   const claudeDir = (0, import_path18.join)(directory, ".claude");
   if (configData.instructions?.content) {
     const claudeMdPath = (0, import_path18.join)(directory, "CLAUDE.md");
@@ -33873,9 +33928,9 @@ function writeClaudeConfig(directory, configData, syncedFiles, syncedItems) {
       });
     }
   }
-  writeMcpConfig(directory, configData.mcp?.content || "{}", syncedFiles, syncedItems);
+  writeMcpConfig(directory, configData.mcp?.content || "{}", syncedFiles, syncedItems, orgName);
 }
-function writeMcpConfig(directory, mcpContent, syncedFiles, syncedItems) {
+function writeMcpConfig(directory, mcpContent, syncedFiles, syncedItems, orgName) {
   const mcpPath = (0, import_path18.join)(directory, ".mcp.json");
   let merged = { mcpServers: {} };
   try {
@@ -33897,7 +33952,8 @@ function writeMcpConfig(directory, mcpContent, syncedFiles, syncedItems) {
   merged.mcpServers["gal"] = {
     type: "http",
     transport: "http",
-    url: "https://api.gal.run/mcp"
+    url: "https://api.gal.run/mcp",
+    ...orgName ? { headers: { "X-Gal-Organization": orgName } } : {}
   };
   (0, import_fs19.writeFileSync)(mcpPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
   syncedFiles.push(".mcp.json");
@@ -34302,7 +34358,7 @@ async function pullApprovedConfig(configRepo, authRepo, orgName, directory, plat
       if (platform5 === "cursor") {
         writeCursorConfig(directory, configData, platformFiles, platformItems);
       } else if (platform5 === "claude") {
-        writeClaudeConfig(directory, configData, platformFiles, platformItems);
+        writeClaudeConfig(directory, configData, platformFiles, platformItems, orgName);
         writeApprovedClaudeConfig(directory, configData);
       } else if (platform5 === "codex") {
         writeCodexConfig(directory, configData, platformFiles, platformItems);
@@ -34973,6 +35029,10 @@ async function refreshInternalStatus(apiUrl, authToken) {
     const config = ConfigManager.load();
     config.internalOrgs = isInternal ? userOrgs : [];
     config.internalOrgsCheckedAt = Date.now();
+    if (data.user?.capabilities) {
+      config.capabilities = data.user.capabilities;
+      config.capabilitiesCachedAt = Date.now();
+    }
     ConfigManager.save(config);
   } catch {
   }
@@ -42357,7 +42417,7 @@ function getCommandDisableReason(commandName, context) {
   if (flag.environments && !flag.environments.includes(context.environment)) {
     return `Available in ${flag.environments.join(", ")}`;
   }
-  if (flag.audience === "internal" && !context.isInternal) return "Requires internal org membership or GAL_INTERNAL=true";
+  if (flag.audience === "internal" && !context.isInternal) return "Requires org with internal audienceTier";
   if (flag.audience === "partners" && !context.isInternal) return "Requires partner access";
   return void 0;
 }
@@ -42395,7 +42455,7 @@ function formatCommandDisplay(commands, context) {
   lines.push(`Environment: ${envLabel}`);
   if (context.isInternal) {
     if (process.env.GAL_INTERNAL === "true") {
-      lines.push(source_default.dim(`  Source: GAL_INTERNAL=true (env var override)`));
+      lines.push(source_default.dim(`  Source: GAL_INTERNAL=true (dev/test override)`));
     } else {
       lines.push(source_default.dim(`  Source: org audienceTier='internal' in Firestore (#3323)`));
     }
@@ -42410,7 +42470,7 @@ function formatCommandDisplay(commands, context) {
   lines.push("");
   lines.push(source_default.bold.yellow("Internal Commands"));
   if (!context.isInternal) {
-    lines.push(source_default.dim("  Log in with an internal org (gal auth login) or set GAL_INTERNAL=true"));
+    lines.push(source_default.dim("  Log in with an internal org: gal auth login"));
   }
   const internalCommands = commands.filter((c) => c.category === "internal");
   for (const cmd of internalCommands) {
@@ -42471,6 +42531,108 @@ var init_flags = __esm({
   }
 });
 
+// src/commands/governance.ts
+async function recordOverride(apiUrl, authToken, payload) {
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  if (authToken) {
+    headers["Authorization"] = `Bearer ${authToken}`;
+  }
+  const response = await fetch(`${apiUrl}/api/governance/overrides`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(payload)
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new Error(`API error ${response.status}: ${body.slice(0, 200)}`);
+  }
+  return response.json();
+}
+function createGovernanceCommand() {
+  const command = new Command("governance");
+  command.description("Manage and report AI governance decisions");
+  const reportCommand = new Command("report");
+  reportCommand.description("Report an incorrect AI governance decision").requiredOption("--decision <id>", "Decision ID to flag as incorrect").requiredOption("--correct <value>", "The correct value/decision (plain string or JSON)").option("--process-type <type>", `Governance process type: ${VALID_PROCESS_TYPES.join(", ")}`, "auto-approval").option("--org <orgName>", "Organization name").option("--reason <text>", "Optional reason for the correction").option("--json", "Output as JSON").action(async (options) => {
+    const config = ConfigManager.load();
+    const apiUrl = config.apiUrl || process.env.GAL_API_URL || "https://api.gal.run";
+    const authToken = config.authToken;
+    const org = options.org || config.defaultOrg;
+    if (!org) {
+      const msg = "No organization specified. Use --org <orgName> or set a default org.";
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red(msg));
+      }
+      process.exit(1);
+    }
+    if (!VALID_PROCESS_TYPES.includes(options.processType)) {
+      const msg = `Invalid process type "${options.processType}". Valid: ${VALID_PROCESS_TYPES.join(", ")}`;
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red(msg));
+      }
+      process.exit(1);
+    }
+    let correctedValue;
+    try {
+      correctedValue = JSON.parse(options.correct);
+    } catch {
+      correctedValue = options.correct;
+    }
+    const userId = config.userId ?? config.userEmail ?? "cli-user";
+    try {
+      const result = await recordOverride(apiUrl, authToken, {
+        processType: options.processType,
+        organizationId: org,
+        userId,
+        originalInput: { decisionId: options.decision },
+        originalOutput: { decisionId: options.decision },
+        correctedOutput: { decision: correctedValue, decisionId: options.decision },
+        overrideReason: options.reason
+      });
+      if (options.json) {
+        console.log(JSON.stringify({ success: true, id: result.id, timestamp: result.timestamp }));
+      } else {
+        console.log(source_default.green(`Override recorded \u2014 ID: ${result.id}`));
+        console.log(source_default.dim(`Process: ${options.processType} \xB7 Decision: ${options.decision}`));
+        console.log(source_default.dim("Correction queued for the next model training cycle."));
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (options.json) {
+        console.log(JSON.stringify({ error: message }));
+      } else {
+        console.error(source_default.red(`Failed to record override: ${message}`));
+      }
+      process.exit(1);
+    }
+  });
+  command.addCommand(reportCommand);
+  return command;
+}
+var VALID_PROCESS_TYPES;
+var init_governance = __esm({
+  "src/commands/governance.ts"() {
+    "use strict";
+    init_esm();
+    init_source();
+    init_config_manager();
+    VALID_PROCESS_TYPES = [
+      "auto-approval",
+      "config-copilot",
+      "orchestrator",
+      "discovery",
+      "llm-analysis",
+      "pick-by-ai",
+      "sync-copilot"
+    ];
+  }
+});
+
 // src/commands/fleet.ts
 function getMachineId() {
   const info2 = [
@@ -44606,7 +44768,7 @@ Examples:
   return command;
 }
 var import_fs25, import_path24, import_os18;
-var init_memory = __esm({
+var init_memory2 = __esm({
   "src/commands/memory.ts"() {
     "use strict";
     init_esm();
@@ -54267,6 +54429,7 @@ var init_command_registry = __esm({
     init_feedback2();
     init_fetch();
     init_flags();
+    init_governance();
     init_fleet();
     init_headless();
     init_hooks();
@@ -54274,7 +54437,7 @@ var init_command_registry = __esm({
     init_join();
     init_maintain();
     init_mcp();
-    init_memory();
+    init_memory2();
     init_policy();
     init_propose();
     init_protect();
@@ -54316,6 +54479,7 @@ var init_command_registry = __esm({
       { name: "feedback", create: createFeedbackCommand },
       { name: "fetch", create: createFetchCommand },
       { name: "flags", create: createFlagsCommand },
+      { name: "governance", create: createGovernanceCommand },
       { name: "fleet", create: createFleetCommand },
       { name: "headless", create: createHeadlessCommand },
       { name: "hooks", create: createHooksCommand },
@@ -54668,6 +54832,10 @@ function refreshOrgMemberships() {
               const isInternal = user.isInternal === true;
               config.internalOrgs = isInternal ? user.organizations : [];
               config.internalOrgsCheckedAt = Date.now();
+              if (user.capabilities) {
+                config.capabilities = user.capabilities;
+                config.capabilitiesCachedAt = Date.now();
+              }
               if (!(0, import_fs40.existsSync)(UPDATE_CACHE_DIR)) {
                 (0, import_fs40.mkdirSync)(UPDATE_CACHE_DIR, { recursive: true });
               }
@@ -54689,7 +54857,7 @@ function refreshOrgMemberships() {
     }
     const flagsReq = import_https2.default.get(
       `${apiUrl}/feature-flags`,
-      { timeout: 5e3 },
+      { timeout: 5e3, headers: { authorization: `Bearer ${config.authToken}` } },
       (res) => {
         let data = "";
         res.on("data", (chunk) => data += chunk);
@@ -54910,7 +55078,7 @@ var init_index = __esm({
 });
 
 // src/bootstrap.ts
-var cliVersion10 = true ? "0.0.319" : "0.0.0-dev";
+var cliVersion10 = true ? "0.0.321" : "0.0.0-dev";
 var args = process.argv.slice(2);
 var requestedGlobalHelp = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
 var requestedVersion = args.length === 1 && (args[0] === "--version" || args[0] === "-V");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scheduler-systems/gal-run",
-  "version": "0.0.319",
+  "version": "0.0.321",
   "description": "GAL CLI - Command-line tool for managing AI agent configurations across your organization",
   "license": "Elastic-2.0",
   "private": false,