@todoforai/cli 0.1.56 → 0.1.58

package/dist/todoforai-cli.js

@@ -42767,9 +42767,9 @@ class ApiClient {
     }
     return h;
   }
-  async request(method, endpoint, body) {
+  async request(method, endpoint, body, timeoutMs = 30000) {
     const url = `${this.apiUrl}${endpoint.replace(/^\/api\/v1/, restBasePath(this.apiKey))}`;
-    const opts = { method, headers: this.headers, signal: AbortSignal.timeout(30000) };
+    const opts = { method, headers: this.headers, signal: AbortSignal.timeout(timeoutMs) };
     if (body)
       opts.body = JSON.stringify(body);
     const res = await fetch(url, opts);
@@ -42900,7 +42900,7 @@ class ApiClient {
     return this.request("GET", `/api/v1/projects/${projectId}/voice-sources`);
   }
   collectVoiceSource(projectId, channel, opts) {
-    return this.request("POST", "/api/v1/business-context/collect-voice-source", { projectId, channel, ...opts });
+    return this.request("POST", "/api/v1/business-context/collect-voice-source", { projectId, channel, ...opts }, 130000);
   }
   removeVoiceSource(projectId, channel, opts = {}) {
     return this.request("POST", "/api/v1/business-context/remove-voice-source", { projectId, channel, ...opts });
@@ -42939,6 +42939,12 @@ class ApiClient {
   sendFeedMessage(msg) {
     return this.request("POST", "/api/v1/feed/message", msg);
   }
+  getProjectMembers(projectId) {
+    return this.request("GET", `/api/v1/projects/${projectId}/members`);
+  }
+  sendMemberMessage(msg) {
+    return this.request("POST", "/api/v1/feed/message/member", msg);
+  }
   listProjectSurfaces(projectId) {
     return this.request("GET", `/api/v1/projects/${projectId}/surfaces`);
   }
@@ -43882,7 +43888,7 @@ function manualAnswersOf(sources) {
   return out;
 }
 var manualSamples = (answers) => Object.entries(answers).filter(([, a]) => a.trim()).map(([prompt, text]) => ({ prompt, text: text.trim() }));
-var senderLabel = (s) => s.kind === "team" ? `${s.name} · TODO for AI team` : `${s.name} · your agent`;
+var senderLabel = (s) => s.kind === "team" ? `${s.name} · TODO for AI team` : s.kind === "member" ? `${s.name} · teammate` : `${s.name} · your agent`;
 // ../packages/shared-fbe/src/templateBody.ts
 var USER_HEADINGS = new Set([
   "your task",
@@ -44861,7 +44867,7 @@ var tool_catalog_default = {
     installer: "npm",
     label: "TODOforAI",
     summary: "Create and follow up on your TODOs, and show results in the chat.",
-    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype; `--card <name>` via project renderer; `--alias <name>` updates in place), `open <url>` embeds a live preview. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>]` leaves a note in the user\'s Messages tab + phone push — recipient is ALWAYS the key\'s own user (no --to; cannot message teammates or anyone else), shown as from you, same text is delivered once, max 10/day, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows.',
+    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype; `--card <name>` via project renderer; `--alias <name>` updates in place), `open <url>` embeds a live preview. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>]` leaves a note in the user\'s Messages tab + phone push (shown as from you); `--to <email>` reaches a member of the current project instead (`project members` lists them, 20/day) — nobody else; same text is delivered once, max 10/day to the user, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows.',
     installCmd: "npm install -g @todoforai/cli",
     versionCmd: "tfa-cli --version 2>/dev/null | sed -n 1p",
     preinstallCloud: true,
@@ -44987,7 +44993,8 @@ var tool_catalog_default = {
     installer: "system",
     label: "Google Cloud",
     summary: "Manage your Google Cloud projects and services.",
-    installCmd: 'curl -sSL https://sdk.cloud.google.com | bash -s -- --disable-prompts && mkdir -p "$HOME/.todoforai/tools/bin" && ln -sf "$HOME/google-cloud-sdk/bin/gcloud" "$HOME/.todoforai/tools/bin/gcloud"',
+    needsPython: true,
+    installCmd: `curl -fsSL https://dl.google.com/dl/cloudsdk/channels/rapid/google-cloud-sdk.tar.gz | tar -xzC "$HOME" && CLOUDSDK_PYTHON="$py" "$HOME/google-cloud-sdk/install.sh" --quiet --install-python false --usage-reporting false --path-update false --command-completion false && mkdir -p "$HOME/.todoforai/tools/bin" && rm -f "$HOME/.todoforai/tools/bin/gcloud" && printf '#!/bin/sh\\nCLOUDSDK_PYTHON="\${CLOUDSDK_PYTHON:-%s}" exec "$HOME/google-cloud-sdk/bin/gcloud" "$@"\\n' "$py" > "$HOME/.todoforai/tools/bin/gcloud" && chmod +x "$HOME/.todoforai/tools/bin/gcloud"`,
     statusCmd: `gcloud auth list --filter=status:ACTIVE --format="value(account)" 2>/dev/null | tr -d '\\r' | grep -m1 .`,
     loginCmd: "gcloud auth login --no-launch-browser",
     loginNeedsPty: true,
@@ -45270,7 +45277,7 @@ var tool_catalog_default = {
     label: "Surface",
     summary: "See and control what is on your TODOforAI screen.",
     platformAuth: true,
-    description: "The user's live UI from the shell. Everything on screen is a SURFACE holding one ref (a todo id, `<todoId>:<alias>` = a shown artifact, or a url). `describe` lists them (kind, id, ref, focus, embedded-browser CDP URL; `--json`). `open overlay <todoId>` (full page), `open window <ref>` (floating), `open panel changes|preview|browser|terminal [--url]` (a todo's side panel), `open card <ref> [--title] [--group <slug>]` (a persisted board card every member sees); `close|focus <kind> <id>`. Persistent state (plans, reports, live status) → `show chat.panel <todoId> \"...md\"` (stdin ok; re-show updates in place), `clear` removes; events go in chat. `card add|list|get|rm <name>` = project HTML renderers. Exit 2 = no frontend connected.",
+    description: "The user's live UI from the shell. Everything on screen is a SURFACE holding one ref (a todo id, `<todoId>:<alias>` = a shown artifact, or a url). `describe` lists them (kind, id, ref, focus, embedded-browser CDP URL; `--json`). `open overlay <todoId>` (full page), `open window <ref> [--detached]` (floating; --detached = out of the grid, own size, resizable), `open panel changes|preview|browser|terminal [--url]` (a todo's side panel), `open card <ref> [--title] [--group <slug>]` (a persisted board card every member sees); `close|focus <kind> <id>`. Persistent state (plans, reports, live status) → `show chat.panel <todoId> \"...md\"` (stdin ok; re-show updates in place), `clear` removes; events go in chat. `card add|list|get|rm <name>` = project HTML renderers. Exit 2 = no frontend connected.",
     versionCmd: "tfa-surface --version 2>/dev/null | sed -n 1p",
     installCmd: "npm install -g @todoforai/tfa-surface",
     internal: true
@@ -45844,7 +45851,7 @@ var tool_catalog_default = {
     logoutCmd: "cd ~ && mcporter config remove blender",
     credentialPaths: ["~/.mcporter/mcporter.json"],
     description: "Blender 3D via the ahujasid/blender-mcp server through mcporter: `mcporter list blender --schema`, `mcporter call blender.<tool> key=value` (`code=@file.py`; every tool needs `user_prompt`). Workhorse: execute_blender_code (any bpy Python); also scene/object info, viewport screenshot (`--save-images <dir>`), PolyHaven/Sketchfab import. Needs a GUI Blender with the addon server started (socket :9876; headless has none). 'Could not connect' → `blender-mcp install-addon`, enable in Preferences → Add-ons, N-panel → Start MCP Server (scripted: `blender --python s.py`, s.py registers a `bpy.app.timers` calling `bpy.ops.blendermcp.start_server()`). Code runs unguarded: save first (`bpy.ops.wm.save_mainfile()`), approve destructive ops.",
-    versionCmd: `{ python -c 'from importlib.metadata import version; print(version("blender-mcp"))' || python3 -c 'from importlib.metadata import version; print(version("blender-mcp"))'; } 2>/dev/null`
+    versionCmd: "{ python -c 'import sys; from importlib.metadata import version; print(version(sys.argv[1]))' blender-mcp || python3 -c 'import sys; from importlib.metadata import version; print(version(sys.argv[1]))' blender-mcp; } 2>/dev/null"
   },
   "google-ads": {
     category: "marketing",
@@ -46116,7 +46123,7 @@ import { parseArgs } from "util";
 // package.json
 var package_default = {
   name: "@todoforai/cli",
-  version: "0.1.56",
+  version: "0.1.58",
   type: "module",
   bin: {
     "todoforai-cli": "bin/todoforai-cli.js",
@@ -46186,7 +46193,7 @@ Examples:
   tfa-cli recommend --template <id>    # Add a template as a recommendation card
   tfa-cli inbox [needs-you|messages|activity] [--unread]  # Read the notification feed (the bell)
   tfa-cli inbox seen [tab]              # Mark notifications read
-  tfa-cli notify "Title" "message" [--href /t/<id>]  # Note to YOUR OWN user only (Messages tab + phone push); no --to
+  tfa-cli notify [--to <email>] "Title" "message" [--href /t/<id>]  # Note to your own user, or --to a project member (Messages tab + phone push)
   tfa-cli claim mint --seed <projectId> [--emails a@x,b@y] [--ttl <sec>]  # Mint /claim/<token> links for a project you own
   tfa-cli next [--direction "<text>"]  # Analyzer growth recommendation cards
   tfa-cli <command> help                # Details per command
@@ -46304,6 +46311,7 @@ function parseCliArgs() {
       ttl: { type: "string" },
       subject: { type: "string" },
       href: { type: "string" },
+      to: { type: "string" },
       unread: { type: "boolean", default: false },
       limit: { type: "string" },
       resume: { type: "string", short: "r" },
@@ -49524,6 +49532,7 @@ tfa-cli project — edit the current project
 
 Usage:
   tfa-cli project list                             Projects you can access (* = default)
+  tfa-cli project members                          Who is on it (notify --to <email> reaches them)
   tfa-cli project set <field=value>…               name=… description=…
                                                     (isPublic refused from an agent shell)
   tfa-cli project default                          Make it the project you land on at /
@@ -49625,6 +49634,17 @@ async function projectCommand(api, positionals, args, projectId) {
   }
   if (!projectId)
     fail(NO_PROJECT);
+  if (sub === "members") {
+    const members = await api.getProjectMembers(projectId);
+    if (args.json) {
+      console.log(JSON.stringify(members, null, 2));
+      return;
+    }
+    for (const m of members)
+      process.stderr.write(`  ${m.name ?? ""}  ${m.email ?? ""}  ${DIM}${m.id}${RESET}
+`);
+    return;
+  }
   if (sub === "set") {
     if (!rest.length)
       fail("Usage: tfa-cli project set <field=value>…");
@@ -50557,16 +50577,19 @@ Filters (same as the bell's chips):
 }
 function printNotifyHelp() {
   process.stderr.write(`
-tfa-cli notify — leave a note for YOUR user (their Messages tab + phone push)
+tfa-cli notify — leave a note in someone's Messages inbox (+ phone push)
 
 Usage:
   tfa-cli notify "Title" "message" [--href /t/<todo-id>] [--subject <key>] [--json]
+  tfa-cli notify --to <email> "Title" "message" [--project <id>]
   echo "message" | tfa-cli notify "Title"
 
-Recipient: ALWAYS the user this key belongs to (the person you work for). There is no --to:
-it cannot message a teammate, a customer or any other account. Shown as from your agent.
+Recipient: your own user by default. --to <email> reaches a TEAMMATE: someone who is a member
+of the current project (--project, $TODOFORAI_PROJECT_ID or your default), shown as from you.
+Anyone else is refused. List them with: tfa-cli project members
 --subject dedupes: the same subject is delivered once (default: hash of title+message,
-so a retry never double-notifies). --href must be an in-app path. Max 10 new notes/day.
+so a retry never double-notifies). --href must be an in-app path.
+Limits: 10 notes/day to yourself, 20/day to teammates.
 `);
 }
 function tierArg(name) {
@@ -50618,12 +50641,22 @@ async function inboxCommand(api, positionals, args) {
       console.log(`    ${DIM}${e.href}${RESET}`);
   }
 }
-var RECIPIENT_FLAGS = ["--to", "--email", "--user", "--recipient", "--cc"];
-async function notifyCommand(api, positionals, args) {
-  const argv = process.argv.slice(2);
-  const bad = argv.find((a) => RECIPIENT_FLAGS.some((f) => a === f || a.startsWith(`${f}=`)));
+var OTHER_RECIPIENT_FLAGS = ["--email", "--user", "--recipient", "--cc"];
+async function notifyCommand(api, positionals, args, projectId) {
+  const bad = process.argv.slice(2).find((a) => OTHER_RECIPIENT_FLAGS.some((f) => a === f || a.startsWith(`${f}=`)));
   if (bad) {
-    process.stderr.write(`${RED}notify has no recipient option (${bad.split("=")[0]}): it only reaches the user this key belongs to — your own user. Messaging other people is not supported.${RESET}
+    process.stderr.write(`${RED}Unknown option ${bad.split("=")[0]}: use --to <email> for a project teammate${RESET}
+`);
+    process.exit(2);
+  }
+  const to = args.to === undefined ? undefined : String(args.to).trim();
+  if (to === "") {
+    process.stderr.write(`${RED}--to is empty: pass a teammate's email, or drop --to to notify your own user${RESET}
+`);
+    process.exit(2);
+  }
+  if (to && !projectId) {
+    process.stderr.write(`${RED}--to needs a project: pass --project <id> (the recipient must be a member of it)${RESET}
 `);
     process.exit(2);
   }
@@ -50635,12 +50668,13 @@ async function notifyCommand(api, positionals, args) {
   }
   const subject = args.subject || createHash("sha256").update(`${title}
 ${message}`).digest("hex").slice(0, 16);
-  const row = await api.sendFeedMessage({ subject, title, message, ...args.href ? { href: String(args.href) } : {} });
+  const msg = { subject, title, message, ...args.href ? { href: String(args.href) } : {} };
+  const row = await (to ? api.sendMemberMessage({ ...msg, projectId, to }) : api.sendFeedMessage(msg));
   if (args.json) {
     console.log(JSON.stringify(row));
     return;
   }
-  process.stderr.write(row.created !== false ? `${GREEN}✅ Delivered to your own user's Messages inbox (not anyone else)${RESET} ${DIM}(subject ${subject})${RESET}
+  process.stderr.write(row.created !== false ? `${GREEN}✅ Delivered to ${to ?? "your own user"}'s Messages inbox${RESET} ${DIM}(subject ${subject})${RESET}
 ` : `${DIM}Already sent (subject ${subject}) — nothing new delivered${RESET}
 `);
 }
@@ -75353,7 +75387,7 @@ async function main() {
     return;
   }
   if (positionals[0] === "notify") {
-    await notifyCommand(api2, positionals, args);
+    await notifyCommand(api2, positionals, args, scopedProject);
     return;
   }
   if (positionals[0] === "delete") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@todoforai/cli",
-  "version": "0.1.56",
+  "version": "0.1.58",
   "type": "module",
   "bin": {
     "todoforai-cli": "bin/todoforai-cli.js",