@simonfestl/husky-cli 1.2.0 → 1.3.0

package/dist/commands/biz/gotess.js

@@ -0,0 +1,320 @@
+import { Command } from "commander";
+import { GotessClient } from "../../lib/biz/gotess.js";
+import { getConfig, setGotessConfig } from "../config.js";
+import * as readline from "readline";
+function prompt(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+async function pollSmsCode(apiUrl, afterTimestamp, maxRetries = 3) {
+    for (let retry = 0; retry < maxRetries; retry++) {
+        if (retry > 0) {
+            console.log(`\n  Retry ${retry}/${maxRetries - 1}...`);
+        }
+        await new Promise(r => setTimeout(r, 60000));
+        try {
+            const res = await fetch(`${apiUrl}/api/webhooks/sms/latest?after=${afterTimestamp}`);
+            const data = await res.json();
+            if (data.code) {
+                return data.code;
+            }
+        }
+        catch {
+            // ignore fetch errors
+        }
+        process.stdout.write(".");
+    }
+    return null;
+}
+export const gotessCommand = new Command("gotess")
+    .description("Manage accounting (Gotess/Tess)");
+gotessCommand
+    .command("login")
+    .description("Login to Gotess with 2FA")
+    .option("-e, --email <email>", "Email address")
+    .option("-p, --password <password>", "Password")
+    .action(async (options) => {
+    try {
+        const client = new GotessClient();
+        const email = options.email || await prompt("Email: ");
+        const password = options.password || await prompt("Password: ");
+        console.log("\n  Logging in...");
+        const loginResult = await client.login(email, password);
+        if (loginResult.user.factors && loginResult.user.factors.length > 0) {
+            const factor = loginResult.user.factors[0];
+            console.log(`  2FA required (${factor.factor_type})`);
+            const challenge = await client.startMfaChallenge(factor.id);
+            const smsRequestTime = Date.now();
+            console.log("  SMS sent! Waiting for code via webhook");
+            const config = getConfig();
+            const apiUrl = config.apiUrl || "https://husky-api-474966775596.europe-west1.run.app";
+            const code = await pollSmsCode(apiUrl, smsRequestTime);
+            if (!code) {
+                console.error("\n  ✗ Timeout waiting for SMS code");
+                process.exit(1);
+            }
+            console.log(`\n  ✓ Code received: ${code}`);
+            const verified = await client.verifyMfa(factor.id, challenge.id, code);
+            setGotessConfig('gotessToken', verified.access_token);
+            console.log("  ✓ Login successful (with 2FA)");
+        }
+        else {
+            setGotessConfig('gotessToken', loginResult.access_token);
+            console.log("\n  ✓ Login successful");
+        }
+        const books = await client.listBooks();
+        if (books.length > 0) {
+            console.log("\n  Available books:");
+            books.forEach((b, i) => console.log(`    ${i + 1}. ${b.name} (${b.id})`));
+            if (books.length === 1) {
+                setGotessConfig('gotessBookId', books[0].id);
+                console.log(`\n  ✓ Auto-selected: ${books[0].name}`);
+            }
+            else {
+                const choice = await prompt("\n  Select book (number): ");
+                const idx = parseInt(choice, 10) - 1;
+                if (idx >= 0 && idx < books.length) {
+                    setGotessConfig('gotessBookId', books[idx].id);
+                    console.log(`  ✓ Selected: ${books[idx].name}`);
+                }
+            }
+        }
+        console.log("");
+    }
+    catch (error) {
+        console.error("Error:", error.message);
+        process.exit(1);
+    }
+});
+gotessCommand
+    .command("missing")
+    .description("List transactions with missing invoices")
+    .option("-l, --limit <num>", "Limit results", "50")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+    try {
+        const client = GotessClient.fromConfig();
+        const transactions = await client.getMissingInvoices();
+        if (options.json) {
+            console.log(JSON.stringify(transactions, null, 2));
+            return;
+        }
+        console.log(`\n  📋 Missing Invoices (${transactions.length})\n`);
+        if (transactions.length === 0) {
+            console.log("  No missing invoices!");
+            return;
+        }
+        let total = 0;
+        for (const tx of transactions.slice(0, parseInt(options.limit, 10))) {
+            const date = tx.value_date?.slice(0, 10) || "?";
+            const amount = tx.amount || 0;
+            const name = (tx.counterpart_name || tx.purpose || "Unknown").slice(0, 35);
+            total += Math.abs(amount);
+            console.log(`  ${date} │ ${amount.toFixed(2).padStart(10)} EUR │ ${name}`);
+        }
+        console.log(`\n  Total: ${total.toFixed(2)} EUR\n`);
+    }
+    catch (error) {
+        console.error("Error:", error.message);
+        process.exit(1);
+    }
+});
+gotessCommand
+    .command("transactions")
+    .description("List transactions")
+    .option("-s, --status <status>", "Filter by status (invoice_missing, invoice_linked, proofless_auto)")
+    .option("-l, --limit <num>", "Limit results", "30")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+    try {
+        const client = GotessClient.fromConfig();
+        const transactions = await client.listTransactions({
+            status: options.status,
+            limit: parseInt(options.limit, 10),
+        });
+        if (options.json) {
+            console.log(JSON.stringify(transactions, null, 2));
+            return;
+        }
+        console.log(`\n  📊 Transactions (${transactions.length})\n`);
+        for (const tx of transactions) {
+            const date = tx.value_date?.slice(0, 10) || "?";
+            const amount = tx.amount || 0;
+            const name = (tx.counterpart_name || "?").slice(0, 30);
+            const status = tx.transaction_status || "-";
+            const marker = tx.invoice_id ? "✓" : "✗";
+            console.log(`  ${marker} ${date} │ ${amount.toFixed(2).padStart(10)} EUR │ ${name.padEnd(30)} │ ${status}`);
+        }
+        console.log("");
+    }
+    catch (error) {
+        console.error("Error:", error.message);
+        process.exit(1);
+    }
+});
+gotessCommand
+    .command("invoices")
+    .description("List invoices/receipts")
+    .option("-s, --search <term>", "Search by sender or filename")
+    .option("-l, --limit <num>", "Limit results", "30")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+    try {
+        const client = GotessClient.fromConfig();
+        const invoices = await client.listInvoices({
+            search: options.search,
+            limit: parseInt(options.limit, 10),
+        });
+        if (options.json) {
+            console.log(JSON.stringify(invoices, null, 2));
+            return;
+        }
+        console.log(`\n  🧾 Invoices (${invoices.length})\n`);
+        for (const inv of invoices) {
+            const date = inv.invoice_date?.slice(0, 10) || "?";
+            const amount = inv.amount?.toFixed(2).padStart(10) || "?".padStart(10);
+            const sender = (inv.sender_name || "?").slice(0, 25);
+            const file = (inv.filename || "").slice(0, 40);
+            console.log(`  ${date} │ ${amount} EUR │ ${sender.padEnd(25)} │ ${file}`);
+        }
+        console.log("");
+    }
+    catch (error) {
+        console.error("Error:", error.message);
+        process.exit(1);
+    }
+});
+gotessCommand
+    .command("match")
+    .description("Auto-match invoices to transactions")
+    .option("--dry-run", "Show matches without applying")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+    try {
+        const client = GotessClient.fromConfig();
+        console.log("\n  🔍 Analyzing transactions and invoices...\n");
+        const result = await client.autoMatch();
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (result.matched.length > 0) {
+            console.log(`  ✓ Found ${result.matched.length} matches:\n`);
+            for (const { transaction, invoice } of result.matched) {
+                const txName = (transaction.counterpart_name || "?").slice(0, 25);
+                const invName = (invoice.sender_name || invoice.filename || "?").slice(0, 25);
+                console.log(`    ${transaction.value_date?.slice(0, 10)} │ ${transaction.amount.toFixed(2)} EUR │ ${txName}`);
+                console.log(`      → ${invName}`);
+            }
+        }
+        if (result.unmatched.length > 0) {
+            console.log(`\n  ✗ ${result.unmatched.length} unmatched transactions`);
+        }
+        if (!options.dryRun && result.matched.length > 0) {
+            const confirm = await prompt("\n  Apply matches? (y/n): ");
+            if (confirm.toLowerCase() === 'y') {
+                for (const { transaction, invoice } of result.matched) {
+                    await client.linkInvoice(transaction.id, invoice.id);
+                }
+                console.log(`\n  ✓ Linked ${result.matched.length} invoices`);
+            }
+        }
+        console.log("");
+    }
+    catch (error) {
+        console.error("Error:", error.message);
+        process.exit(1);
+    }
+});
+gotessCommand
+    .command("link <transactionId> <invoiceId>")
+    .description("Manually link an invoice to a transaction")
+    .action(async (transactionId, invoiceId) => {
+    try {
+        const client = GotessClient.fromConfig();
+        await client.linkInvoice(transactionId, invoiceId);
+        console.log(`\n  ✓ Linked invoice ${invoiceId} to transaction ${transactionId}\n`);
+    }
+    catch (error) {
+        console.error("Error:", error.message);
+        process.exit(1);
+    }
+});
+gotessCommand
+    .command("proofless <transactionId>")
+    .description("Mark a transaction as proofless (no invoice needed)")
+    .action(async (transactionId) => {
+    try {
+        const client = GotessClient.fromConfig();
+        await client.markProofless(transactionId);
+        console.log(`\n  ✓ Transaction ${transactionId} marked as proofless\n`);
+    }
+    catch (error) {
+        console.error("Error:", error.message);
+        process.exit(1);
+    }
+});
+gotessCommand
+    .command("accounts")
+    .description("List connected bank accounts")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+    try {
+        const client = GotessClient.fromConfig();
+        const accounts = await client.listAccounts();
+        if (options.json) {
+            console.log(JSON.stringify(accounts, null, 2));
+            return;
+        }
+        console.log(`\n  🏦 Bank Accounts (${accounts.length})\n`);
+        for (const acc of accounts) {
+            const name = acc.account_name || "Unknown";
+            const iban = acc.iban || "-";
+            const type = acc.account_type || "-";
+            console.log(`  ${acc.finapi_account_id} │ ${name.padEnd(20)} │ ${iban} │ ${type}`);
+        }
+        console.log("");
+    }
+    catch (error) {
+        console.error("Error:", error.message);
+        process.exit(1);
+    }
+});
+gotessCommand
+    .command("status")
+    .description("Show current Gotess session status")
+    .action(async () => {
+    try {
+        const config = getConfig();
+        const token = config.gotessToken;
+        const bookId = config.gotessBookId;
+        console.log("\n  Gotess Status");
+        console.log("  " + "─".repeat(40));
+        console.log(`  Logged in:  ${token ? "Yes" : "No"}`);
+        console.log(`  Book ID:    ${bookId || "Not set"}`);
+        if (token) {
+            const client = new GotessClient(token, bookId);
+            try {
+                const books = await client.listBooks();
+                const book = books.find(b => b.id === bookId);
+                if (book) {
+                    console.log(`  Book Name:  ${book.name}`);
+                }
+            }
+            catch {
+                console.log("  Session:    Expired (re-login required)");
+            }
+        }
+        console.log("");
+    }
+    catch (error) {
+        console.error("Error:", error.message);
+        process.exit(1);
+    }
+});
+export default gotessCommand;

package/dist/commands/biz.js

@@ -11,12 +11,16 @@ import { ticketsCommand } from "./biz/tickets.js";
 import { customersCommand } from "./biz/customers.js";
 import { seatableCommand } from "./biz/seatable.js";
 import { qdrantCommand } from "./biz/qdrant.js";
+import { gotessCommand } from "./biz/gotess.js";
+import { guards } from "../lib/permissions.js";
 export const bizCommand = new Command("biz")
     .description("Business operations for autonomous agents")
+    .hook("preAction", guards.bizAccess) // RBAC: Require biz permissions
     .addCommand(ordersCommand)
     .addCommand(productsCommand)
     .addCommand(ticketsCommand)
     .addCommand(customersCommand)
     .addCommand(seatableCommand)
-    .addCommand(qdrantCommand);
+    .addCommand(qdrantCommand)
+    .addCommand(gotessCommand);
 export default bizCommand;

package/dist/commands/completion.js

@@ -135,7 +135,7 @@ ${subcommandCases}
       return 0
       ;;
     --agent)
-      COMPREPLY=( $(compgen -W "claude-code gemini-cli aider custom" -- \${cur}) )
+      COMPREPLY=( $(compgen -W "claude-code gemini-cli custom" -- \${cur}) )
       return 0
       ;;
     --type)
@@ -268,7 +268,7 @@ complete -c husky -l project -d "Project ID" -r
 complete -c husky -l status -d "Filter by status" -r -a "backlog in_progress review done pending running completed failed"
 complete -c husky -l priority -d "Priority level" -r -a "low medium high urgent must should could wont"
 complete -c husky -l assignee -d "Assignee type" -r -a "human llm unassigned"
-complete -c husky -l agent -d "Agent type" -r -a "claude-code gemini-cli aider custom"
+complete -c husky -l agent -d "Agent type" -r -a "claude-code gemini-cli custom"
 complete -c husky -l type -d "Type filter" -r -a "global project architecture patterns decisions learnings"
 complete -c husky -l value-stream -d "Value stream" -r -a "order_to_delivery procure_to_pay returns_management product_lifecycle customer_service marketing_sales finance_accounting hr_operations it_operations general"
 complete -c husky -l action -d "Action type" -r -a "manual semi_automated fully_automated"

package/dist/commands/config.d.ts

@@ -1,9 +1,13 @@
 import { Command } from "commander";
+type AgentRole = "supervisor" | "worker" | "reviewer" | "e2e_agent" | "pr_agent" | "support";
 interface Config {
     apiUrl?: string;
     apiKey?: string;
     workerId?: string;
     workerName?: string;
+    role?: AgentRole;
+    permissions?: string[];
+    roleLastChecked?: string;
     billbeeApiKey?: string;
     billbeeUsername?: string;
     billbeePassword?: string;
@@ -17,8 +21,31 @@ interface Config {
     qdrantApiKey?: string;
     gcpProjectId?: string;
     gcpLocation?: string;
+    gotessToken?: string;
+    gotessBookId?: string;
 }
 export declare function getConfig(): Config;
+/**
+ * Fetch role and permissions from /api/auth/whoami
+ * Caches the result in config for 1 hour
+ */
+export declare function fetchAndCacheRole(): Promise<{
+    role?: AgentRole;
+    permissions?: string[];
+}>;
+/**
+ * Check if current config has a specific permission
+ */
+export declare function hasPermission(permission: string): boolean;
+/**
+ * Get current role from config (may be undefined if not fetched)
+ */
+export declare function getRole(): AgentRole | undefined;
+/**
+ * Clear the role cache to force a refresh on next fetchAndCacheRole call
+ */
+export declare function clearRoleCache(): void;
 export declare function setConfig(key: "apiUrl" | "apiKey" | "workerId" | "workerName", value: string): void;
+export declare function setGotessConfig(token: string, bookId: string): void;
 export declare const configCommand: Command;
 export {};

package/dist/commands/config.js

@@ -46,12 +46,86 @@ function saveConfig(config) {
     }
     writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
 }
+/**
+ * Fetch role and permissions from /api/auth/whoami
+ * Caches the result in config for 1 hour
+ */
+export async function fetchAndCacheRole() {
+    const config = getConfig();
+    // Check if we have cached role that's less than 1 hour old
+    if (config.role && config.roleLastChecked) {
+        const lastChecked = new Date(config.roleLastChecked);
+        const oneHourAgo = new Date(Date.now() - 60 * 60 * 1000);
+        if (lastChecked > oneHourAgo) {
+            return { role: config.role, permissions: config.permissions };
+        }
+    }
+    // Fetch fresh role/permissions
+    if (!config.apiUrl || !config.apiKey) {
+        return {};
+    }
+    try {
+        const url = new URL("/api/auth/whoami", config.apiUrl);
+        const res = await fetch(url.toString(), {
+            headers: { "x-api-key": config.apiKey },
+        });
+        if (res.ok) {
+            const data = await res.json();
+            // Update config cache
+            config.role = data.role;
+            config.permissions = data.permissions;
+            config.roleLastChecked = new Date().toISOString();
+            saveConfig(config);
+            return { role: data.role, permissions: data.permissions };
+        }
+    }
+    catch {
+        // Ignore fetch errors, return cached or empty
+    }
+    return { role: config.role, permissions: config.permissions };
+}
+/**
+ * Check if current config has a specific permission
+ */
+export function hasPermission(permission) {
+    const config = getConfig();
+    if (!config.permissions)
+        return false;
+    // Direct match
+    if (config.permissions.includes(permission))
+        return true;
+    // Wildcard match (e.g., "task:*" matches "task:read")
+    const [resource] = permission.split(":");
+    if (config.permissions.includes(`${resource}:*`))
+        return true;
+    return false;
+}
+/**
+ * Get current role from config (may be undefined if not fetched)
+ */
+export function getRole() {
+    return getConfig().role;
+}
+/**
+ * Clear the role cache to force a refresh on next fetchAndCacheRole call
+ */
+export function clearRoleCache() {
+    const config = getConfig();
+    delete config.roleLastChecked;
+    saveConfig(config);
+}
 // Helper to set a single config value (used by interactive mode and worker identity)
 export function setConfig(key, value) {
     const config = getConfig();
     config[key] = value;
     saveConfig(config);
 }
+export function setGotessConfig(token, bookId) {
+    const config = getConfig();
+    config.gotessToken = token;
+    config.gotessBookId = bookId;
+    saveConfig(config);
+}
 export const configCommand = new Command("config")
     .description("Manage CLI configuration");
 // husky config set <key> <value>
@@ -82,6 +156,8 @@ configCommand
         // GCP
         "gcp-project-id": "gcpProjectId",
         "gcp-location": "gcpLocation",
+        "gotess-token": "gotessToken",
+        "gotess-book-id": "gotessBookId",
     };
     const configKey = keyMappings[key];
     if (!configKey) {
@@ -93,6 +169,7 @@ configCommand
         console.log("  SeaTable: seatable-api-token, seatable-server-url");
         console.log("  Qdrant:   qdrant-url, qdrant-api-key");
         console.log("  GCP:      gcp-project-id, gcp-location");
+        console.log("  Gotess:   gotess-token, gotess-book-id");
         process.exit(1);
     }
     // Validation for specific keys
@@ -107,7 +184,7 @@ configCommand
     config[configKey] = value;
     saveConfig(config);
     // Mask sensitive values in output
-    const sensitiveKeys = ["api-key", "billbee-api-key", "billbee-password", "zendesk-api-token", "seatable-api-token"];
+    const sensitiveKeys = ["api-key", "billbee-api-key", "billbee-password", "zendesk-api-token", "seatable-api-token", "gotess-token"];
     const displayValue = sensitiveKeys.includes(key) ? "***" : value;
     console.log(`✓ Set ${key} = ${displayValue}`);
 });
@@ -155,37 +232,49 @@ configCommand
     }
     console.log("Testing API connection...");
     try {
-        const url = new URL("/api/tasks", config.apiUrl);
-        const res = await fetch(url.toString(), {
-            headers: {
-                "x-api-key": config.apiKey,
-            },
+        // First test basic connectivity with /api/tasks
+        const tasksUrl = new URL("/api/tasks", config.apiUrl);
+        const tasksRes = await fetch(tasksUrl.toString(), {
+            headers: { "x-api-key": config.apiKey },
         });
-        if (res.ok) {
-            console.log(`API connection successful (API URL: ${config.apiUrl})`);
-        }
-        else if (res.status === 401) {
-            console.error(`API connection failed: Unauthorized (HTTP 401)`);
-            console.error("  Check your API key with: husky config set api-key <key>");
-            process.exit(1);
-        }
-        else if (res.status === 403) {
-            console.error(`API connection failed: Forbidden (HTTP 403)`);
-            console.error("  Your API key may not have the required permissions");
-            process.exit(1);
+        if (!tasksRes.ok) {
+            if (tasksRes.status === 401) {
+                console.error(`API connection failed: Unauthorized (HTTP 401)`);
+                console.error("  Check your API key with: husky config set api-key <key>");
+                process.exit(1);
+            }
+            else if (tasksRes.status === 403) {
+                console.error(`API connection failed: Forbidden (HTTP 403)`);
+                console.error("  Your API key may not have the required permissions");
+                process.exit(1);
+            }
+            else {
+                console.error(`API connection failed: HTTP ${tasksRes.status}`);
+                process.exit(1);
+            }
         }
-        else {
-            console.error(`API connection failed: HTTP ${res.status}`);
-            try {
-                const body = await res.json();
-                if (body.error) {
-                    console.error(`  Error: ${body.error}`);
-                }
+        console.log(`API connection successful (API URL: ${config.apiUrl})`);
+        // Now fetch role/permissions from whoami
+        const whoamiUrl = new URL("/api/auth/whoami", config.apiUrl);
+        const whoamiRes = await fetch(whoamiUrl.toString(), {
+            headers: { "x-api-key": config.apiKey },
+        });
+        if (whoamiRes.ok) {
+            const data = await whoamiRes.json();
+            // Cache the role/permissions
+            const updatedConfig = getConfig();
+            updatedConfig.role = data.role;
+            updatedConfig.permissions = data.permissions;
+            updatedConfig.roleLastChecked = new Date().toISOString();
+            saveConfig(updatedConfig);
+            console.log(`\nRBAC Info:`);
+            console.log(`  Role: ${data.role || "(not assigned)"}`);
+            if (data.permissions && data.permissions.length > 0) {
+                console.log(`  Permissions: ${data.permissions.join(", ")}`);
             }
-            catch {
-                // Ignore JSON parse errors
+            if (data.agentId) {
+                console.log(`  Agent ID: ${data.agentId}`);
             }
-            process.exit(1);
         }
     }
     catch (error) {

package/dist/commands/interactive/vm-sessions.js

@@ -140,7 +140,6 @@ async function createVMSession(config) {
             choices: [
                 { name: "Claude Code", value: "claude-code" },
                 { name: "Gemini CLI", value: "gemini-cli" },
-                { name: "Aider", value: "aider" },
                 { name: "Custom", value: "custom" },
             ],
             default: "claude-code",

package/dist/commands/llm-context.js

@@ -11,6 +11,7 @@ export function generateLLMContext() {
 > 
 > **DO NOT:**
 > - Make direct API calls to Billbee, Zendesk, or other services
+> - Make direct API calls to husky-api (use CLI instead)
 > - Bypass Husky CLI for task management
 > - Create custom integrations when Husky commands exist
 > 
@@ -18,6 +19,7 @@ export function generateLLMContext() {
 > - Use \`husky biz\` commands for business operations
 > - Use \`husky task\` commands for task lifecycle
 > - Use \`husky worktree\` for Git isolation
+> - Use \`husky chat\` commands for Google Chat communication
 > - Check \`husky config test\` before operations
 
 ---
@@ -153,6 +155,31 @@ husky worker sessions                   # List active sessions
 husky worker activity                   # Who is working on what
 \`\`\`
 
+### Chat (Google Chat Integration)
+\`\`\`bash
+husky chat reply-chat --space <space-id> "<message>"  # Send message to Google Chat
+husky chat inbox                        # Get messages from Google Chat
+husky chat inbox --unread               # Only unread messages
+husky chat pending                      # Get pending messages from user
+husky chat send "<message>"             # Send message as supervisor
+husky chat reply <messageId> "<response>"  # Reply to specific message
+husky chat review "<question>"          # Request human review via Google Chat
+husky chat review-status <reviewId>     # Check review status
+husky chat watch                        # Watch for new messages (blocking)
+\`\`\`
+
+### Agent Messaging (agent-to-agent communication)
+\`\`\`bash
+husky agent-msg send --type <type> --title "<title>"  # Send message (types: approval_request, status_update, error_report, completion, query)
+husky agent-msg list                    # List messages
+husky agent-msg list --status pending   # Filter by status
+husky agent-msg pending                 # List pending messages (for supervisor)
+husky agent-msg respond <id> --approve  # Approve request
+husky agent-msg respond <id> --reject   # Reject request
+husky agent-msg get <id>                # Get message details
+husky agent-msg wait <id>               # Wait for response (blocking)
+\`\`\`
+
 ### Utility Commands
 \`\`\`bash
 husky explain <command>                 # Explain CLI commands

package/dist/commands/preview.js

@@ -2,7 +2,7 @@ import { Command } from "commander";
 import { getConfig } from "./config.js";
 const PREVIEW_DEPLOY_TRIGGER_ID = "80b3ba55-ae74-41cd-b7d0-a477ecc357b1";
 const PREVIEW_CLEANUP_TRIGGER_ID = "965c3e86-677f-4063-b391-43019f621ea2";
-const GCP_PROJECT = "tigerv0";
+const GCP_PROJECT = process.env.GCP_PROJECT_ID || process.env.GOOGLE_CLOUD_PROJECT || "tigerv0";
 async function apiRequest(method, path, body) {
     const config = getConfig();
     const url = `${config.apiUrl}${path}`;

package/dist/commands/task.js

@@ -7,6 +7,7 @@ import { ensureWorkerRegistered, generateSessionId, registerSession } from "../l
 import { WorktreeManager } from "../lib/worktree.js";
 import { execSync } from "child_process";
 import { resolveProject, fetchProjects, formatProjectList } from "../lib/project-resolver.js";
+import { requirePermission } from "../lib/permissions.js";
 export const taskCommand = new Command("task")
     .description("Manage tasks");
 // Helper: Get task ID from --id flag or HUSKY_TASK_ID env var
@@ -284,6 +285,8 @@ taskCommand
     .option("--pr <url>", "Link to PR")
     .option("--skip-qa", "Skip QA review and mark as done directly")
     .action(async (id, options) => {
+    // RBAC: Only supervisor and pr_agent can set tasks to done
+    requirePermission("task:done");
     const config = getConfig();
     if (!config.apiUrl) {
         console.error("Error: API URL not configured.");