@todoforai/cli 0.1.19 → 0.1.21

package/dist/todoai.js

@@ -42825,6 +42825,9 @@ class ApiClient {
   deleteTodo(todoId) {
     return this.request("DELETE", `/api/v1/todos/${todoId}`);
   }
+  listModels() {
+    return this.request("GET", "/api/v1/models");
+  }
   listAgentSettings(filters) {
     const params = new URLSearchParams;
     if (filters?.workspacePath)
@@ -42923,7 +42926,7 @@ function normalizeApiUrl(url) {
     return `https://${url}`;
   return url;
 }
-var SUBCOMMANDS = new Set(["login", "logout"]);
+var SUBCOMMANDS = new Set(["login", "logout", "update"]);
 function credentialsPath() {
   const sys = os2.platform();
   if (sys === "win32") {
@@ -43147,6 +43150,7 @@ var package_default = {
     postinstall: "rm -rf node_modules/@todoforai/edge && ln -s ../../../edge/bun node_modules/@todoforai/edge"
   },
   dependencies: {
+    "@shared/credentials": "file:../packages/shared-credentials",
     "@todoforai/update-notifier": "^0.1.0",
     "cli-highlight": "^2.1.11",
     "diff-match-patch": "^1.0.5",
@@ -43336,7 +43340,8 @@ var NON_SHELL_TYPES = new Set([
 var USER_INPUT_BLOCK_TYPES = new Set([
   "question" /* Question */,
   "login_prompt" /* Login */,
-  "business_onboarding" /* BusinessOnboarding */
+  "business_onboarding" /* BusinessOnboarding */,
+  "open_browser" /* OpenBrowser */
 ]);
 var EDGE_TOOL_TYPES = new Set([
   "read" /* Read */,
@@ -43363,7 +43368,6 @@ var API_TOOL_TYPES = new Set([
   "api_get_agent" /* ApiGetAgent */,
   "api_update_agent" /* ApiUpdateAgent */,
   "api_list_business_contexts" /* ApiListBusinessContexts */,
-  "api_get_business_context" /* ApiGetBusinessContext */,
   "api_get_context_item" /* ApiGetContextItem */,
   "api_create_context_item" /* ApiCreateContextItem */,
   "api_update_context_item" /* ApiUpdateContextItem */,
@@ -43396,6 +43400,9 @@ var SERVER_TO_FRONTENDS = {
   hexGrid: {
     updated: (projectId) => `${"hexgrid:updated" /* HEXGRID_UPDATED */}:${projectId}`
   },
+  recommendation: {
+    updated: (projectId) => `${"recommendation:updated" /* RECOMMENDATION_UPDATED */}:${projectId}`
+  },
   sandbox: {
     state: (userId) => `${"sandbox:state" /* SANDBOX_STATE */}:${userId}`
   },
@@ -43839,15 +43846,70 @@ Cover these sections (skip any without data):
 
 If anything important remains unclear, add an **Open Questions** section at the end.
 
+Maintain a single machine-readable **Growth Plan** block so the user's brand page can render a live presence map and a ranked, actionable growth plan. Write it as one fenced code block tagged \`growth-plan\` containing JSON (the user never sees this raw \u2014 it powers the presence hexes and the Growth Plan panel). Keep exactly one such block; rewrite it in full each time you update it. Concrete example (emit strictly valid JSON like this \u2014 no comments, no ranges, no "|" alternatives):
+
+\`\`\`growth-plan
+{
+  "presence": {
+    "linkedin-networking": { "score": 45, "handle": "https://linkedin.com/company/example", "note": "Company page exists but posts infrequently" },
+    "x-twitter-presence": { "score": 60, "handle": "@example", "note": "Active, regular posts" },
+    "newsletter": { "score": null, "note": "No newsletter signup found" }
+  },
+  "recommendations": [
+    {
+      "activityId": "linkedin-networking",
+      "title": "Publish two founder-led LinkedIn posts each week",
+      "rationale": "Target buyers are active on LinkedIn, but the page is nearly dormant.",
+      "angle": "Explain the operational pain through short customer scenarios.",
+      "track": "Qualified profile visits and demo requests per week",
+      "priority": "high"
+    }
+  ]
+}
+\`\`\`
+
+Rules for the Growth Plan block:
+- \`activityId\` MUST be one of these exact ids: facebook-posting, x-twitter-presence, tiktok-content, instagram-content, linkedin-networking, reddit-engagement, blog-writing, seo-optimization, backlink-building, keyword-research, aso-optimization, llm-optimization, google-ads-management, meta-ads-management, lead-outreach, crm-management, newsletter, affiliate-program, partnership-outreach, analytics-monitoring.
+- \`score\` is an integer 0-100, or \`null\` when you checked but found no presence. Base scores on real findings, not guesses. Include every channel you actually checked.
+- \`recommendations\`: 3-6 items. \`priority\` is exactly one of "high", "medium", "low"; put the single highest-leverage action first. Choose channels that fit THIS business's model, audience, and stage \u2014 don't recommend all 20; prioritize gaps where presence is weak/absent but impact is high. Make \`title\` a concrete next action, \`angle\` the actual message/positioning to use, and \`track\` a specific metric or cadence to record.
+- Keep it consistent with the prose Online Presence and Next Steps sections \u2014 the JSON is the structured mirror of that advice.
+
+Document order for the saved brand page: human-readable sections first, then the **Next Steps** section, then Open Questions (if any), and finally exactly one \`growth-plan\` block as the very last element. (Your chat reply can still end with a short spoken summary; only the saved markdown must end with the machine block.)
+
 Guide the user one step at a time \u2014 they should always know the single next thing to do:
 - When you need input (brand voice, tone, target audience, which channel to prioritize), prefer the question tool with short multi-choice options over asking open-ended prose questions.
 - After completing any analysis or context update, always close with a short **Next Steps** section: 2-4 concrete, prioritized tips tailored to this specific business (e.g. SEO/content gaps, social channels worth activating, positioning against the competitors you found, conversion or messaging improvements). Base tips on what you actually observed, keep each to one or two sentences, and lead with the one you'd do first.
 
-In follow-up conversations, act as an ongoing advisor: answer growth and digital-presence questions using the business context, refresh your analysis when asked, and suggest what to tackle next.`,
+In follow-up conversations, act as an ongoing advisor: answer growth and digital-presence questions using the business context, refresh your analysis when asked, and suggest what to tackle next.
+
+When the user asks you to recommend how to grow (e.g. "recommend growth TODOs", the brand page's guided suggestion), treat it as a growth-plan request: read the current business context (including any existing \`growth-plan\` block), research only where information is missing or stale, then update the business context with a refreshed Growth Plan block and reply in chat with the same ranked recommendations in plain language \u2014 lead with the single highest-leverage action and why. This must work at any point in the conversation, not just after a full website analysis.
+
+Recommending actionable TODOs from your recommendations:
+When the user asks you to generate/recommend TODOs (e.g. "generate TODOs", the board's Generate button), turn your top recommendations into recommendation cards in the NEXT column. You NEVER create running todos \u2014 you only recommend templates by reference. Two tools, strict roles:
+
+1. FIND OR CREATE A TEMPLATE (todoregistry-cli):
+   - \`todoregistry-cli search <query>\` / \`todoregistry-cli list -c <category>\` / \`todoregistry-cli get <id>\` \u2014 prefer a matching existing template (proven playbook).
+   - If none fits, CREATE one right there (auth is inherited from your shell):
+     \`todoregistry-cli create --name "<name>" --description "<one line>" --body @<prompt-file>\` (or \`--body -\` for stdin). It prints the new template id on stdout.
+
+2. RECOMMEND (todoforai-cli \u2014 references a template id onto the project; never creates a running todo):
+   \`todoforai-cli recommend --template <id> --project <projectId> --business-context <businessContextId> --note "<why>" --priority high|medium|low\`
+   Take <projectId> and <businessContextId> from your current session context and pass them explicitly. The card appears PAUSED in the NEXT column for the user to review before any credits are spent.
+
+3. Recommend 3-6 templates matching your Growth Plan (highest priority first), then reply with a one-line summary per card and tell the user they're waiting in the NEXT column for review.`,
   mcpConfigs: {},
   edgesMcpConfigs: {},
   permissions: {
-    allow: ["builtin:webfetch", "builtin:google_search", "cloud:google_rag", "builtin:business_context", "builtin:todoforai_api", "builtin:question"],
+    allow: [
+      "builtin:webfetch",
+      "builtin:google_search",
+      "cloud:google_rag",
+      "builtin:todoforai_api",
+      "builtin:question",
+      "cloud:BASH(cmd: todoregistry-cli *)",
+      "cloud:BASH(cmd: todoforai-cli *)",
+      "cloud:BASH(cmd: curl *)"
+    ],
     ask: [],
     deny: []
   },
@@ -43914,6 +43976,10 @@ var TOPICS = {
     channel: (p) => SERVER_TO_FRONTENDS.hexGrid.updated(p.projectId),
     audience: "frontend"
   },
+  ["recommendation:updated" /* RECOMMENDATION_UPDATED */]: {
+    channel: (p) => SERVER_TO_FRONTENDS.recommendation.updated(p.projectId),
+    audience: "frontend"
+  },
   ["sandbox:state" /* SANDBOX_STATE */]: {
     channel: (p) => SERVER_TO_FRONTENDS.sandbox.state(p.userId),
     audience: "frontend"
@@ -44032,19 +44098,30 @@ Usage:
   todoforai-cli --inspect <todo-id>[@<slice>] # Read chat log. <slice> = -3:, :1, 5:10, 7  (Python-style)
   todoforai-cli --template <id> [--input k=v] # Start from a registry template
   todoforai-cli --list-agents                 # List available agents and exit
+  todoforai-cli --list-models [filter]        # List models usable with --model and exit
   todoforai-cli agent update <agent> model=<model>    # Update agent settings (see 'agent --help')
   todoforai-cli list [-n 30] [--cursor N] [--all] [--status S]  # List todos (paginated); see 'list --help'
   todoforai-cli status <todo-id> <STATUS>     # Update a todo's status (run 'status --help' for the full list)
   todoforai-cli delete <todo-id>              # Permanently delete a todo
   todoforai-cli addmessage <todo-id> "text"  # Add a message to an existing todo
+  todoforai-cli recommend --template <id>    # Add a template as a NEXT-column card (see 'todoregistry-cli create')
+  todoforai-cli claim mint --seed <projectId> [--emails a@x,b@y] [--ttl <sec>]  # Mint /claim/<token> ownership links for a project you own
+  todoforai-cli steering get                 # Show recommendation steering (direction + boosted/muted categories)
+  todoforai-cli steering direction "<text>"  # Set the direction the generator should follow
+  todoforai-cli steering boost|mute <cat>    # Favour / avoid a category
+  todoforai-cli next                         # Generate steered NEXT-column recommendations
 
 Options:
   --path <dir>                    Workspace path (default: cwd)
   --project <id>                  Project ID
   --agent, -a <name>              Agent name (partial match)
+  --model <model>                 Override the agent's model for this todo
+                                  (e.g. anthropic:anthropic/claude-opus-5, openai:openai/gpt-5.6-sol)
   --list-agents                   List available agents (name, id, workspace paths) and exit
+  --list-models                   List models usable with --model (optional substring filter) and exit
   --api-url <url>                 API URL
   --api-key <key>                 API key
+  --user-id <id>                  Admin HTTP impersonation; requires --no-watch
   --inspect, -i <todo-id>[@<slice>]     Print chat log (read-only)
   --template, -t <id>            Start from a registry template
   --input <key=value>            Template input (repeatable)
@@ -44098,11 +44175,20 @@ function parseCliArgs() {
       agent: { type: "string", short: "a" },
       model: { type: "string" },
       "list-agents": { type: "boolean", default: false },
+      "list-models": { type: "boolean", default: false },
       "api-url": { type: "string" },
       "api-key": { type: "string" },
+      "user-id": { type: "string" },
       inspect: { type: "string", short: "i" },
       template: { type: "string", short: "t" },
       input: { type: "string", multiple: true },
+      note: { type: "string" },
+      priority: { type: "string" },
+      title: { type: "string" },
+      "business-context": { type: "string" },
+      seed: { type: "string" },
+      emails: { type: "string" },
+      ttl: { type: "string" },
       resume: { type: "string", short: "r" },
       continue: { type: "boolean", short: "c", default: false },
       "non-interactive": { type: "boolean", short: "n", default: false },
@@ -44550,17 +44636,22 @@ function ensureBridgeCredentials(apiUrl) {
 }
 function bridgeAlreadyRunning() {
   if (process.platform === "win32")
-    return false;
-  const r = spawnSync("pgrep", ["-f", "todoforai-bridge"], { encoding: "utf-8" });
-  return r.status === 0 && (r.stdout || "").trim().length > 0;
+    return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const r = spawn("pgrep", ["-f", "todoforai-bridge"]);
+    let out = "";
+    r.stdout.on("data", (d) => out += d);
+    r.on("error", () => resolve(false));
+    r.on("close", (code) => resolve(code === 0 && out.trim().length > 0));
+  });
 }
-function ensureBridgeRunning(apiUrl, _apiKey) {
+async function ensureBridgeRunning(apiUrl, _apiKey) {
+  if (await bridgeAlreadyRunning())
+    return;
   if (!hasBridge()) {
     console.error("\x1B[2mBridge not started: `todoforai-bridge` was not found on PATH. Install TODOforAI Bridge, or pass --no-bridge (or deprecated --no-edge) to silence this.\x1B[0m");
     return;
   }
-  if (bridgeAlreadyRunning())
-    return;
   if (!ensureBridgeCredentials(apiUrl)) {
     console.error("\x1B[33mBridge not started: `todoforai-bridge login` did not complete successfully.\x1B[0m");
     return;
@@ -44784,40 +44875,38 @@ class ScopedConfig {
   }
 }
 
-// src/credentials.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+// ../packages/shared-credentials/src/index.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, chmodSync } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
 import { homedir as homedir2, platform as platform2 } from "os";
 function credentialsPath2() {
-  const sys = platform2();
-  if (sys === "win32")
-    return join2(homedir2(), "AppData", "Roaming", "todoforai", "credentials.json");
-  if (sys === "darwin")
-    return join2(homedir2(), "Library", "Application Support", "todoforai", "credentials.json");
-  const xdg = process.env.XDG_CONFIG_HOME || join2(homedir2(), ".config");
-  return join2(xdg, "todoforai", "credentials.json");
+  return platform2() === "win32" ? join2(homedir2(), "AppData", "Roaming", "todoforai", "credentials.json") : platform2() === "darwin" ? join2(homedir2(), "Library", "Application Support", "todoforai", "credentials.json") : join2(process.env.XDG_CONFIG_HOME || join2(homedir2(), ".config"), "todoforai", "credentials.json");
 }
-var CREDENTIALS_PATH2 = credentialsPath2();
 function read() {
-  if (!existsSync2(CREDENTIALS_PATH2))
-    return {};
   try {
-    return JSON.parse(readFileSync2(CREDENTIALS_PATH2, "utf-8"));
+    return JSON.parse(readFileSync2(credentialsPath2(), "utf-8"));
   } catch {
     return {};
   }
 }
+function writeSecure(data) {
+  const p = credentialsPath2();
+  mkdirSync2(dirname2(p), { recursive: true });
+  writeFileSync2(p, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(p, 384);
+  } catch {}
+}
 function readCredential(apiUrl) {
-  const v = read()[apiUrl];
+  const c2 = read();
+  const v = c2[apiUrl] || c2.apiToken || c2.apiKey;
   return typeof v === "string" ? v : "";
 }
 function writeCredential(apiUrl, apiKey) {
-  const data = read();
-  data[apiUrl] = apiKey;
-  mkdirSync2(dirname2(CREDENTIALS_PATH2), { recursive: true });
-  writeFileSync2(CREDENTIALS_PATH2, JSON.stringify(data, null, 2), "utf-8");
+  const c2 = read();
+  c2[apiUrl] = apiKey;
+  writeSecure(c2);
 }
-
 // src/logo.ts
 var LETTERS = {
   t: [" x  ", "xxxx", " x  ", " xll", " xll", " xxx"],
@@ -44828,11 +44917,10 @@ var LETTERS = {
   c: ["    ", "xxxx", "x   ", "xlll", "xlll", "xxxx"],
   e: ["    ", "xxxx", "x  x", "xxxx", "xlll", "xxxx"],
   a: ["    ", "xxxx", "   x", "xxxx", "xllx", "xxxx"],
-  i: ["x", " ", "x", "x", "x", "x"],
-  "4": ["    ", "  x ", " xx ", "xlxl", "xxxx", "llxl"]
+  i: ["x", " ", "x", "x", "x", "x"]
 };
 var GAP = " ";
-var WORD = "todo4ai";
+var WORD = "todoforai";
 function renderHalfBlock(top, bot) {
   const W = c("\x1B[38;2;249;110;46m");
   const G = c("\x1B[38;2;140;60;20m");
@@ -45993,6 +46081,20 @@ async function listAgentsCommand(api, opts) {
   }
 }
 
+// src/list-models.ts
+async function listModelsCommand(api, opts) {
+  const res = await api.listModels();
+  const q = opts.filter?.toLowerCase();
+  const ids = (res?.data || []).map((m) => String(m.id).includes("/") ? `${String(m.id).split("/")[0]}:${m.id}` : String(m.id)).filter((id) => !q || id.toLowerCase().includes(q));
+  if (opts.json) {
+    console.log(JSON.stringify(ids, null, 2));
+    return;
+  }
+  for (const id of ids)
+    process.stderr.write(`${BRAND}${id}${RESET}
+`);
+}
+
 // src/agent-command.ts
 function printAgentHelp() {
   process.stderr.write(`
@@ -46302,6 +46404,92 @@ async function listTodosCommand(api, defaultProjectId, argv) {
 `);
 }
 
+// src/steering-command.ts
+var RED2 = "\x1B[31m";
+var GREEN2 = "\x1B[32m";
+var DIM2 = "\x1B[2m";
+var RESET2 = "\x1B[0m";
+async function rest(ctx, method, path4, body) {
+  const res = await fetch(`${ctx.apiUrl}/api/v1${path4}`, {
+    method,
+    headers: { "content-type": "application/json", "x-api-key": ctx.apiKey },
+    ...body ? { body: JSON.stringify(body) } : {},
+    signal: AbortSignal.timeout(30000)
+  });
+  const text = await res.text();
+  if (!res.ok)
+    throw new Error(`${method} ${path4} failed: ${res.status} ${text}`);
+  return text ? JSON.parse(text) : null;
+}
+function printSteering(s) {
+  process.stderr.write(`${GREEN2}Direction:${RESET2} ${s.direction || DIM2 + "(none)" + RESET2}
+`);
+  process.stderr.write(`${GREEN2}Boosted:${RESET2}   ${s.boostedCategoryIds?.join(", ") || DIM2 + "(none)" + RESET2}
+`);
+  process.stderr.write(`${GREEN2}Muted:${RESET2}     ${s.mutedCategoryIds?.join(", ") || DIM2 + "(none)" + RESET2}
+`);
+}
+var USAGE = `${RED2}Usage:
+  todoforai-cli steering get [--project <id>]
+  todoforai-cli steering direction "<text>" [--project <id>]   (empty text clears it)
+  todoforai-cli steering boost <categoryId> [--project <id>]
+  todoforai-cli steering mute  <categoryId> [--project <id>]
+  todoforai-cli steering clear [--project <id>]                (clears all steering)${RESET2}`;
+async function steeringCommand(ctx, argv) {
+  const sub = argv[0];
+  const path4 = `/projects/${ctx.projectId}/recommendation-steering`;
+  if (!sub || sub === "get") {
+    const s = await rest(ctx, "GET", path4);
+    if (ctx.json)
+      console.log(JSON.stringify(s, null, 2));
+    else
+      printSteering(s);
+    return;
+  }
+  if (sub === "direction") {
+    const text = argv.slice(1).join(" ").trim();
+    const s = await rest(ctx, "PATCH", path4, { projectId: ctx.projectId, direction: text || null });
+    if (ctx.json)
+      console.log(JSON.stringify(s, null, 2));
+    else
+      process.stderr.write(`${GREEN2}\u2705 ${text ? `Direction set: ${text}` : "Direction cleared"}${RESET2}
+`);
+    return;
+  }
+  if (sub === "boost" || sub === "mute") {
+    const categoryId = argv[1];
+    if (!categoryId) {
+      process.stderr.write(USAGE + `
+`);
+      process.exit(2);
+    }
+    const current = await rest(ctx, "GET", path4);
+    const key = sub === "boost" ? "boostedCategoryIds" : "mutedCategoryIds";
+    const other = sub === "boost" ? "mutedCategoryIds" : "boostedCategoryIds";
+    const next = Array.from(new Set([...current[key] ?? [], categoryId]));
+    const nextOther = (current[other] ?? []).filter((c2) => c2 !== categoryId);
+    const s = await rest(ctx, "PATCH", path4, { projectId: ctx.projectId, [key]: next, [other]: nextOther });
+    if (ctx.json)
+      console.log(JSON.stringify(s, null, 2));
+    else
+      process.stderr.write(`${GREEN2}\u2705 ${sub === "boost" ? "Boosted" : "Muted"} ${categoryId}${RESET2}
+`);
+    return;
+  }
+  if (sub === "clear") {
+    const s = await rest(ctx, "PATCH", path4, { projectId: ctx.projectId, direction: null, boostedCategoryIds: [], mutedCategoryIds: [] });
+    if (ctx.json)
+      console.log(JSON.stringify(s, null, 2));
+    else
+      process.stderr.write(`${GREEN2}\u2705 Steering cleared${RESET2}
+`);
+    return;
+  }
+  process.stderr.write(USAGE + `
+`);
+  process.exit(2);
+}
+
 // src/index.ts
 try {
   const pkgPath = path4.resolve(fileURLToPath(import.meta.url), "../../package.json");
@@ -46419,8 +46607,8 @@ Cancelled by user (Ctrl+C)
     return;
   }
   if (args["reset-config"]) {
-    const { existsSync: existsSync3, unlinkSync } = await import("fs");
-    if (existsSync3(cfg.path)) {
+    const { existsSync: existsSync2, unlinkSync } = await import("fs");
+    if (existsSync2(cfg.path)) {
       unlinkSync(cfg.path);
       console.log(`Configuration reset: ${formatPathWithTilde(cfg.path)}`);
     } else
@@ -46429,6 +46617,15 @@ Cancelled by user (Ctrl+C)
   }
   const apiUrl = normalizeApiUrl(args["api-url"] || getEnv("API_URL") || DEFAULT_API_URL);
   const cfgScope = cfg.scope(apiUrl);
+  if (args["user-id"]) {
+    const url = new URL(apiUrl);
+    const loopback = ["localhost", "127.0.0.1", "::1", "[::1]"].includes(url.hostname);
+    if (url.protocol !== "http:" || !loopback) {
+      process.stderr.write(`Error: --user-id is restricted to HTTP loopback URLs
+`);
+      process.exit(2);
+    }
+  }
   async function deviceLogin() {
     const loginApi = new ApiClient(apiUrl, "");
     const { code, url, expiresIn } = await loginApi.initDeviceLogin("edge");
@@ -46484,11 +46681,27 @@ Cancelled by user (Ctrl+C)
     await deviceLogin();
     return;
   }
-  let apiKey = args["api-key"] || readCredential(apiUrl) || getEnv("API_TOKEN") || "";
+  const notDst = (t) => t.startsWith("dst_") ? "" : t;
+  let apiKey = args["api-key"] || notDst(readCredential(apiUrl)) || notDst(getEnv("API_TOKEN")) || "";
   if (!apiKey) {
     apiKey = await deviceLogin();
   }
-  const api = new ApiClient(apiUrl, apiKey);
+  const api = new ApiClient(apiUrl, apiKey, args["user-id"]);
+  if (args["user-id"] && args.safe) {
+    process.stderr.write(`Error: --safe is not supported with --user-id
+`);
+    process.exit(2);
+  }
+  if (args["user-id"] && (args.resume || args.continue)) {
+    process.stderr.write(`Error: resume is not supported with --user-id
+`);
+    process.exit(2);
+  }
+  if (args["user-id"] && args.template && !args["no-watch"]) {
+    process.stderr.write(`Error: --user-id uses admin HTTP impersonation and requires --no-watch
+`);
+    process.exit(2);
+  }
   if (positionals[0] === "status") {
     const [, todoId, status] = positionals;
     if (!todoId || !status) {
@@ -46513,8 +46726,8 @@ Cancelled by user (Ctrl+C)
     return;
   }
   if (positionals[0] === "addmessage") {
-    const [, todoId, ...rest] = positionals;
-    const content2 = rest.join(" ") || await readStdin();
+    const [, todoId, ...rest2] = positionals;
+    const content2 = rest2.join(" ") || await readStdin();
     if (!todoId || !content2) {
       process.stderr.write(`${RED}Usage: todoforai-cli addmessage <todo-id> "content"${RESET}
 `);
@@ -46529,10 +46742,132 @@ Cancelled by user (Ctrl+C)
 `);
     return;
   }
+  if (positionals[0] === "recommend") {
+    const templateId = args.template || positionals[1];
+    if (!templateId) {
+      process.stderr.write(`${RED}Usage: todoforai-cli recommend --template <id> [--note "why"] [--priority high|medium|low] [--title "..."] [--project <id>]${RESET}
+`);
+      process.stderr.write(`${DIM}Create a template first with: todoregistry-cli create --name ... --description ... --body @prompt.md${RESET}
+`);
+      process.exit(2);
+    }
+    let projectId2 = args.project || cfgScope.data.default_project_id;
+    if (!projectId2) {
+      const projects2 = await api.listProjects();
+      projectId2 = projects2.find((p) => p.project?.isDefault)?.project?.id || projects2[0]?.project?.id;
+    }
+    if (!projectId2) {
+      process.stderr.write(`${RED}No project found \u2014 pass --project <id>${RESET}
+`);
+      process.exit(2);
+    }
+    const priority = args.priority;
+    if (priority && !["high", "medium", "low"].includes(priority)) {
+      process.stderr.write(`${RED}--priority must be high, medium, or low${RESET}
+`);
+      process.exit(2);
+    }
+    const rec = await api.recommend({
+      projectId: projectId2,
+      templateId,
+      ...args.title ? { title: args.title } : {},
+      ...args.note ? { note: args.note } : {},
+      ...priority ? { priority } : {},
+      ...args["business-context"] ? { businessContextId: args["business-context"] } : {}
+    });
+    if (args.json)
+      console.log(JSON.stringify(rec, null, 2));
+    else
+      process.stderr.write(`${GREEN}\u2705 Recommended template ${templateId} on project ${projectId2}${RESET}
+`);
+    return;
+  }
+  if (positionals[0] === "claim" && positionals[1] === "mint") {
+    let seedProjectId = args.seed || args.project || cfgScope.data.default_project_id;
+    if (!seedProjectId) {
+      const projects2 = await api.listProjects();
+      seedProjectId = projects2.find((p) => p.project?.isDefault)?.project?.id || projects2[0]?.project?.id;
+    }
+    if (!seedProjectId) {
+      process.stderr.write(`${RED}Usage: todoforai-cli claim mint --seed <projectId> [--emails a@x,b@y] [--ttl <sec>]${RESET}
+`);
+      process.exit(2);
+    }
+    const emails = args.emails?.split(",").map((e) => e.trim()).filter(Boolean);
+    let ttlSec;
+    if (args.ttl !== undefined) {
+      ttlSec = Number(args.ttl);
+      if (!Number.isFinite(ttlSec)) {
+        process.stderr.write(`${RED}--ttl must be a number (seconds)${RESET}
+`);
+        process.exit(2);
+      }
+    }
+    const res = await fetch(`${apiUrl}/api/v1/claims/mint`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-api-key": apiKey },
+      body: JSON.stringify({ seedProjectId, ...emails?.length ? { emails } : {}, ...ttlSec !== undefined ? { ttlSec } : {} }),
+      signal: AbortSignal.timeout(30000)
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      process.stderr.write(`${RED}Mint failed: ${res.status} ${text}${RESET}
+`);
+      process.exit(1);
+    }
+    const out = JSON.parse(text);
+    if (args.json)
+      console.log(JSON.stringify(out, null, 2));
+    else
+      for (const l of out.links)
+        process.stdout.write(`${l.email ? `${l.email}	` : ""}${CYAN}${l.url}${RESET}
+`);
+    return;
+  }
+  if (positionals[0] === "steering" || positionals[0] === "next") {
+    let projectId2 = args.project || cfgScope.data.default_project_id;
+    if (!projectId2) {
+      const projects2 = await api.listProjects();
+      projectId2 = projects2.find((p) => p.project?.isDefault)?.project?.id || projects2[0]?.project?.id;
+    }
+    if (!projectId2) {
+      process.stderr.write(`${RED}No project found \u2014 pass --project <id>${RESET}
+`);
+      process.exit(2);
+    }
+    const sctx = { apiUrl, apiKey, projectId: projectId2, json: !!args.json };
+    if (positionals[0] === "next") {
+      const res = await fetch(`${apiUrl}/api/v1/projects/${projectId2}/recommendations/generate`, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-api-key": apiKey },
+        body: JSON.stringify({ projectId: projectId2, ...args["business-context"] ? { businessContextId: args["business-context"] } : {} }),
+        signal: AbortSignal.timeout(30000)
+      });
+      const text = await res.text();
+      if (!res.ok) {
+        process.stderr.write(`${RED}Generate failed: ${res.status} ${text}${RESET}
+`);
+        process.exit(1);
+      }
+      const out = JSON.parse(text);
+      if (args.json)
+        console.log(JSON.stringify(out, null, 2));
+      else
+        process.stderr.write(`${GREEN}\u2705 Generating recommendations \u2014 analyzer todo ${out.todoId}${RESET}
+`);
+      return;
+    }
+    await steeringCommand(sctx, positionals.slice(1));
+    return;
+  }
   if (args["list-agents"]) {
     await listAgentsCommand(api, { json: !!args.json, formatPath: formatPathWithTilde });
     return;
   }
+  if (args["list-models"]) {
+    await listModelsCommand(api, { json: !!args.json, filter: positionals[0] });
+    return;
+  }
   if (positionals[0] === "agent") {
     await agentCommand(api, positionals, args, formatPathWithTilde);
     return;
@@ -46632,6 +46967,8 @@ Cancelled by user (Ctrl+C)
     const frontendUrl2 = getFrontendUrl(apiUrl, projectId2, todoId);
     if (args.json) {
       console.log(JSON.stringify({ ...todo2, frontend_url: frontendUrl2 }, null, 2));
+    } else if (args["no-watch"]) {
+      console.log(`created ${todoId}`);
     } else {
       process.stderr.write(`${DIM}TODO:${RESET} ${CYAN}${frontendUrl2}${RESET}
 `);
@@ -46706,6 +47043,15 @@ Resumed: ${CYAN}${getFrontendUrl(apiUrl, projectId2, todoId)}${RESET}
     await ws2.close();
     return;
   }
+  if (args["user-id"] && !args["no-watch"]) {
+    process.stderr.write(`Error: --user-id uses admin HTTP impersonation and requires --no-watch
+`);
+    process.exit(2);
+  }
+  const ws = args["no-watch"] ? null : new FrontendWebSocket(apiUrl, apiKey);
+  const wsReady = ws ? ws.connect() : null;
+  if (!args["no-bridge"] && !args["no-watch"])
+    ensureBridgeRunning(apiUrl, apiKey);
   let preMatchedAgent = null;
   let agents = null;
   if (args.agent) {
@@ -46757,8 +47103,6 @@ Resumed: ${CYAN}${getFrontendUrl(apiUrl, projectId2, todoId)}${RESET}
   }
   process.stderr.write(`${DIM}Tip: ${randomTip()}${RESET}
 `);
-  if (!args["no-bridge"] && !args["no-watch"])
-    ensureBridgeRunning(apiUrl, apiKey);
   let content;
   if (positionals.length > 0) {
     content = positionals.join(" ");
@@ -46800,9 +47144,8 @@ Resumed: ${CYAN}${getFrontendUrl(apiUrl, projectId2, todoId)}${RESET}
   } else {
     agent = await selectAgent(agents, cfgScope.data.default_agent_name, (name, settings) => cfgScope.setDefaultAgent(name, settings));
   }
-  const ws = args["no-watch"] ? null : new FrontendWebSocket(apiUrl, apiKey);
-  if (ws)
-    await ws.connect();
+  if (wsReady)
+    await wsReady;
   if (args.model)
     agent = { ...agent, model: args.model };
   if (args["raw-sysmsg"]) {
@@ -46820,6 +47163,8 @@ Resumed: ${CYAN}${getFrontendUrl(apiUrl, projectId2, todoId)}${RESET}
   const frontendUrl = getFrontendUrl(apiUrl, projectId, actualTodoId);
   if (args.json) {
     console.log(JSON.stringify({ ...todo, frontend_url: frontendUrl }, null, 2));
+  } else if (!ws) {
+    console.log(`created ${actualTodoId}`);
   } else {
     process.stderr.write(`${DIM}TODO:${RESET} ${CYAN}${frontendUrl}${RESET}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@todoforai/cli",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "type": "module",
   "bin": {
     "todoforai-cli": "dist/todoai.js",
@@ -16,6 +16,7 @@
     "dev": "bun run src/index.ts"
   },
   "dependencies": {
+    "@shared/credentials": "file:../packages/shared-credentials",
     "@todoforai/update-notifier": "^0.1.0",
     "cli-highlight": "^2.1.11",
     "diff-match-patch": "^1.0.5",