@todoforai/cli 0.1.69 → 0.1.70

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023-2026 TODOforAI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -137,3 +137,7 @@ No global install needed — `"command": "npx", "args": ["-y", "@todoforai/cli",
 --reset-config                  Reset config file
 --help, -h                      Show this help
 ```
+
+## License
+
+MIT, see [LICENSE](LICENSE).

package/dist/todoforai-cli.js

@@ -43132,6 +43132,18 @@ class ApiClient {
       throw new Error(`API POST /resources/open failed: ${res.status} ${await res.text()}`);
     return res.json();
   }
+  async showConnect(todoId, keys, opts = {}) {
+    const endpoint = `${this.apiUrl}${restBasePath(this.apiKey)}/resources/connect`;
+    const res = await fetch(endpoint, {
+      method: "POST",
+      headers: { "x-api-key": this.apiKey, "Content-Type": "application/json" },
+      body: JSON.stringify({ todoId, keys, ...opts }),
+      signal: AbortSignal.timeout(30000)
+    });
+    if (!res.ok)
+      throw new Error(`API POST /resources/connect failed: ${res.status} ${await res.text()}`);
+    return res.json();
+  }
   async listShows(opts = {}) {
     const qs = new URLSearchParams;
     if (opts.todoId)
@@ -43976,8 +43988,7 @@ var ToolType;
   ToolType2["Question"] = "question";
   ToolType2["Login"] = "login_prompt";
   ToolType2["BusinessOnboarding"] = "business_onboarding";
-  ToolType2["RequestMcpAccess"] = "request_mcp_access";
-  ToolType2["EdgeNotRunning"] = "edge_not_running";
+  ToolType2["ConnectDevice"] = "connect_device";
   ToolType2["WebFetch"] = "webfetch";
   ToolType2["GoogleSearch"] = "google_search";
   ToolType2["WebSearch"] = "web_search";
@@ -43998,7 +44009,8 @@ var USER_INPUT_BLOCK_TYPES = new Set([
   "question" /* Question */,
   "login_prompt" /* Login */,
   "business_onboarding" /* BusinessOnboarding */,
-  "open_browser" /* OpenBrowser */
+  "open_browser" /* OpenBrowser */,
+  "connect_device" /* ConnectDevice */
 ]);
 var EDGE_TOOL_TYPES = new Set([
   "read" /* Read */,
@@ -44711,6 +44723,7 @@ var tool_catalog_default = {
     voiceChannel: "Gmail",
     summary: "Read and send Gmail from your own account.",
     statusCmd: "zele whoami 2>/dev/null | grep -o 'email: *[^ ]*' | tr -d ' ' | paste -sd ' ' - | grep -m1 .",
+    logoutCmd: "zele logout {{ACCOUNT}}",
     loginNeedsPty: true,
     loginCmd: "zele login --method google",
     oauthUrlPattern: "(https://accounts\\.google\\.com\\S+)",
@@ -44722,6 +44735,7 @@ var tool_catalog_default = {
     description: "Gmail (multi-account, OAuth login): inbox, search, send, reply, contacts. Google Calendar via `zele cal`: list/create/update/delete events (Meet links, recurrence), respond to invites, free/busy."
   },
   "zele-calendar": {
+    subcommands: ["cal"],
     preinstallCloud: true,
     category: "productivity",
     pkg: "zele",
@@ -44730,6 +44744,7 @@ var tool_catalog_default = {
     label: "Google Calendar",
     summary: "See your Google Calendar and book, move or cancel events.",
     statusCmd: "zele whoami 2>/dev/null | grep -o 'email: *[^ ]*' | tr -d ' ' | paste -sd ' ' - | grep -m1 .",
+    logoutCmd: "zele logout {{ACCOUNT}}",
     loginNeedsPty: true,
     loginCmd: "zele login --method google",
     oauthUrlPattern: "(https://accounts\\.google\\.com\\S+)",
@@ -44940,6 +44955,24 @@ var tool_catalog_default = {
     versionCmd: "ntn --version 2>/dev/null | sed -n 1p",
     description: "Official Notion CLI: raw API calls (`ntn api <path>`), page/data-source management, file uploads, Workers deploy."
   },
+  treg: {
+    preinstallCloud: true,
+    packages: ["tools-registry==0.27.0"],
+    category: "research",
+    pkg: "tools-registry",
+    pipModules: ["treg"],
+    installer: "pip",
+    label: "treg",
+    summary: "Call 4000+ paid data/SEO/enrichment APIs through one prepaid key, no vendor accounts.",
+    statusCmd: `python3 -c "import json,os;d=json.load(open(os.path.expanduser('~/.treg/config.json')));print(d.get('email') or '' if d.get('token') else '')" 2>/dev/null | grep -m1 .`,
+    loginCmd: "treg login",
+    oauthUrlPattern: "(https://treg\\.to/login\\?\\S+)",
+    sessionIdPattern: "#code=([A-Z0-9]{4,8})",
+    logoutCmd: "treg logout",
+    credentialPaths: ["~/.treg/config.json"],
+    versionCmd: "treg --version 2>/dev/null | sed -n 1p",
+    description: 'treg.to ("OpenRouter for agent tools"): one prepaid balance, 100+ providers (SE Ranking, DataForSEO, Perplexity, CompanyEnrich, ScrapeCreators, TikHub, cloro AI-search scrapes…) metered per call, credentials injected server-side. Find by intent: `treg catalog search "backlinks for a domain" --json` (each result shows price + a `call_template`); run: `treg call <endpoint.id> --query k=v --json` or `treg call <endpoint.id> --method POST --data \'<json>\' --json` (prints one `{result,_treg}` line); money: `treg balance`, `treg topup`; `treg review` rates a call. Own keys/CLIs: `treg secret|tool|skill`, `treg cli run <vendor> …` and `treg <cmd>` inject the team\'s stored credentials. Team: `treg org ls|use|invite|members`, `treg audit`. `--org <slug>` targets another team. Every catalog call spends real money — check the `cost` field and prefer a connected first-party connector when one exists. Docs: https://treg.to/llms.txt'
+  },
   "perplexity-api": {
     preinstallCloud: true,
     category: "research",
@@ -45201,7 +45234,7 @@ var tool_catalog_default = {
     installer: "npm",
     label: "TODOforAI",
     summary: "Create and follow up on your TODOs, and show results in the chat.",
-    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype, private to the todo\'s readers; `--card <name>` via project renderer; `--alias <name>` updates in place, `--alias <todoId>:<name>` updates another todo\'s artifact; `show share <ref>` makes it public and prints the link, `show unshare <ref>` makes it private again), `open <url>` embeds a live preview. Show viewer chrome: `--title` appears in the header; a kebab menu holds file actions, versions and sharing when available. Desktop floating previews add minimize (park in a tab), maximize/restore and close (X); inline blocks have no window controls. For authored HTML, do not duplicate the header/controls or add a rounded, bordered root card: the floating viewer owns the rounded frame. Keep content edge-to-edge; internal layout padding is fine. Pick by where the output lives: read once → plain reply; interactive, this chat only → `html_snippet`; kept/revised later → `show --alias`, then `show share` only if someone outside needs a link; format the user asked for (pptx, docx…) → `show` the file. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>]` leaves a note in the user\'s Messages tab + phone push (shown as from you); `--to <email>` reaches a member of the current project instead (`project members` lists them, 20/day) — nobody else; same text is delivered once, max 10/day to the user, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows. Project files: `memory sync|path [--project <id>]` requires a project and checks out only projects/<id>/{memory,context} and projects/<id>/me/{memory,context}; legacy global files are read-only recovery. Voice commands use `--scope mine|project` (default mine, private within this project; project is shared).',
+    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype, private to the todo\'s readers; `--card <name>` via project renderer; `--alias <name>` updates in place, `--alias <todoId>:<name>` updates another todo\'s artifact; `show share <ref>` makes it public and prints the link, `show unshare <ref>` makes it private again), `open <url>` embeds a live preview. Show viewer chrome: `--title` appears in the header; a kebab menu holds file actions, versions and sharing when available. Desktop floating previews add minimize (park in a tab), maximize/restore and close (X); inline blocks have no window controls. For authored HTML, do not duplicate the header/controls or add a rounded, bordered root card: the floating viewer owns the rounded frame. Keep content edge-to-edge; internal layout padding is fine. Pick by where the output lives: read once → plain reply; interactive, this chat only → `html_snippet`; kept/revised later → `show --alias`, then `show share` only if someone outside needs a link; format the user asked for (pptx, docx…) → `show` the file. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>] [--url <link>: tap opens it on the phone, e.g. a Google Maps navigation link]` leaves a note in the user\'s Messages tab + phone push (shown as from you); `--to <email>` reaches a member of the current project instead (`project members` lists them, 20/day) — nobody else; same text is delivered once, max 10/day to the user, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows. Project files: `memory sync|path [--project <id>]` requires a project and checks out only projects/<id>/{memory,context} and projects/<id>/me/{memory,context}; legacy global files are read-only recovery. Voice commands use `--scope mine|project` (default mine, private within this project; project is shared).',
     installCmd: "npm install -g @todoforai/cli",
     versionCmd: "tfa-cli --version 2>/dev/null | sed -n 1p",
     preinstallCloud: true,
@@ -45384,6 +45417,7 @@ var tool_catalog_default = {
     needsPython: true,
     installCmd: `case "$(uname -s)-$(uname -m)" in Darwin-arm64) p=darwin-arm;; Darwin-*) p=darwin-x86_64;; Linux-aarch64|Linux-arm64) p=linux-arm;; *) p=linux-x86_64;; esac && tmp="$HOME/.gcloud-new.$$" && rm -rf "$tmp" && mkdir -p "$tmp" && curl -fsSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-$p.tar.gz" | tar -xzC "$tmp" && rm -rf "$HOME/google-cloud-sdk" && mv "$tmp/google-cloud-sdk" "$HOME/google-cloud-sdk" && rm -rf "$tmp" && mkdir -p "$HOME/.todoforai/tools/bin" && rm -f "$HOME/.todoforai/tools/bin/gcloud" && printf '#!/bin/sh\\nCLOUDSDK_PYTHON="\${CLOUDSDK_PYTHON:-%s}" exec "$HOME/google-cloud-sdk/bin/gcloud" "$@"\\n' "$py" > "$HOME/.todoforai/tools/bin/gcloud" && chmod +x "$HOME/.todoforai/tools/bin/gcloud"`,
     statusCmd: `gcloud auth list --filter=status:ACTIVE --format="value(account)" 2>/dev/null | tr -d '\\r' | grep -m1 .`,
+    logoutCmd: "gcloud auth revoke --all --quiet",
     loginCmd: "gcloud auth login --no-launch-browser",
     loginNeedsPty: true,
     stdinPaste: true,
@@ -45489,7 +45523,7 @@ var tool_catalog_default = {
     preinstallCloud: true,
     label: "Browser",
     summary: "Browse websites automatically: click, type, read and screenshot.",
-    description: "Browser automation over CDP (`open`/`snapshot`/`click`/`type`/`fill`/`read`/`screenshot`/`eval`). `connect '<url>'` to a listed live browser (prefer the user's real Chrome), verify with `snapshot`; if empty, `close` (own session only) and reconnect once. NEVER `close --all`. Shared browser: `tab new` for your own tab, `tab <id>` before each command. No URL listed: cloud → browser-manager-cli; PC with display → Chrome `--remote-debugging-port=9222`, attach `--cdp 9222`. Never `sleep`: `open` returns after load, but `click`/`fill` fail at once if the element isn't there yet — `wait '<sel>'`, `wait --text 'Done'`, `wait --url '**/dash'`, `wait --load networkidle` or `wait '#spinner' --state hidden` first. Extension browsers (WEB_EXTENSION) only: try sign-in with credentials from `tfa-vault`; request human help only for a step you cannot complete yourself (MFA/CAPTCHA/consent). Use Node/Bun WebSocket on the listed CDP URL; `Target.getTargets` or `device_list` gives `tab-N`, whose N is the numeric tabId. On the SAME socket send `{id: 1, method: 'TodoforAI.requestHumanHelp', params: {tabId: N, message: 'what to do'}}` (message 1–500 chars). This focuses and pauses the tab, sets its yellow `?` badge, and shows needs-you in the extension popup. Tell the user to click Resume control and reply here, then end your turn; Resume does not wake the agent. Afterwards reconnect and snapshot fresh. `TodoforAI.humanHelpStatus` with `{tabId}` remains available while paused. If bootstrap fails on a restricted target, direct CDP `Target.createTarget` with an ordinary URL opens your tab on the SAME socket; pass numeric N from returned `tab-N` as `tabId`.",
+    description: "Browser automation over CDP (`open`/`snapshot`/`click`/`type`/`fill`/`read`/`screenshot`/`eval`). `connect '<url>'` to a listed live browser (prefer the user's real Chrome); connect prints `whoami` (browser=extension|embedded|local, headless, ua) — run `agent-browser whoami` again after any error or odd output, and stop on `ERROR`/`DISCONNECTED`/`headless=yes` where the user's browser was expected: re-run the connect command, never continue in another browser. If a page is empty, `close` (own session only) and reconnect once. NEVER `close --all`. Shared browser: `tab new` for your own tab, `tab <id>` before each command. No URL listed: cloud → browser-manager-cli; PC with display → Chrome `--remote-debugging-port=9222`, attach `--cdp 9222`. Never `sleep`: `open` returns after load, but `click`/`fill` fail at once if the element isn't there yet — `wait '<sel>'`, `wait --text 'Done'`, `wait --url '**/dash'`, `wait --load networkidle` or `wait '#spinner' --state hidden` first. Extension browsers (WEB_EXTENSION) only: try sign-in with credentials from `tfa-vault`; request human help only for a step you cannot complete yourself (MFA/CAPTCHA/consent). Use Node/Bun WebSocket on the listed CDP URL; `Target.getTargets` or `device_list` gives `tab-N`, whose N is the numeric tabId. On the SAME socket send `{id: 1, method: 'TodoforAI.requestHumanHelp', params: {tabId: N, message: 'what to do'}}` (message 1–500 chars). This only marks the tab (yellow count badge on the extension icon, needs-you row with Show in the popup); it never pauses you or takes the tab away. Tell the user what to do and to reply here, then end your turn. When resumed, snapshot to verify, then clear the marker with `TodoforAI.clearHumanHelp` `{tabId: N}`. If bootstrap fails on a restricted target, direct CDP `Target.createTarget` with an ordinary URL opens your tab on the SAME socket; pass numeric N from returned `tab-N` as `tabId`.",
     versionCmd: "agent-browser --version 2>/dev/null | sed -n 1p",
     preinstallJarvis: true
   },
@@ -46090,7 +46124,7 @@ var tool_catalog_default = {
     summary: "Read and write your Outlook mail.",
     statusCmd: `outlook-api whoami 2>/dev/null | sed -n 's/.*"userPrincipalName"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
     logoutCmd: "outlook-api logout",
-    loginCmd: "outlook-api auth",
+    loginCmd: "outlook-api auth --tenant common",
     credentialPaths: ["~/.config/outlook-api/config.json"],
     description: "Outlook/Hotmail/M365 mail over Microsoft Graph (on-prem Exchange → ews-api). `auth` = device-code flow; `--tenant consumers` (default, personal) | `organizations`. list/search/read/attachments are read-only; `draft`/`reply` stay in Drafts unless --send; `send <draftId>`. `get <path>` = raw Graph GET. JSON out.",
     versionCmd: "outlook-api --version 2>/dev/null | sed -n 1p",
@@ -46137,6 +46171,7 @@ var tool_catalog_default = {
     label: "Google Workspace",
     summary: "Work with Google Sheets, Docs, Slides, Drive, Forms, Tasks, Contacts and Chat.",
     statusCmd: `gws auth status 2>/dev/null | sed -n 's/.*"user"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m1 .`,
+    logoutCmd: "gws auth logout",
     loginCmd: "gws auth login --scopes https://www.googleapis.com/auth/spreadsheets,https://www.googleapis.com/auth/documents,https://www.googleapis.com/auth/presentations,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/forms.body,https://www.googleapis.com/auth/forms.responses.readonly,https://www.googleapis.com/auth/tasks,https://www.googleapis.com/auth/contacts,https://www.googleapis.com/auth/chat.spaces,https://www.googleapis.com/auth/chat.messages,https://www.googleapis.com/auth/chat.memberships,https://www.googleapis.com/auth/chat.delete",
     loginTerminalHint: "gws needs your own Google OAuth client first: in console.cloud.google.com create a Desktop-app OAuth client (consent screen External/testing, add yourself as test user), enable the APIs you need (Sheets/Docs/Slides/Drive/Forms/Tasks/People/Chat), save the JSON as ~/.config/gws/client_secret.json (or run `gws auth setup` if gcloud is logged in), then `gws auth login -s sheets,drive`.",
     oauthUrlPattern: "(https://accounts\\.google\\.com/o/oauth2/auth\\S+)",
@@ -46231,6 +46266,7 @@ var tool_catalog_default = {
     summary: "Read your Granola meeting notes and transcripts.",
     statusCmd: `granola auth status -o json 2>/dev/null | sed -n 's/.*"authenticated": *true.*/authenticated/p' | grep -m1 .`,
     loginCmd: "granola auth login",
+    logoutCmd: "granola auth logout",
     loginTerminalHint: "Imports the Granola desktop app's session: install Granola on this host, sign in there, then run `granola auth login`.",
     credentialPaths: ["~/.config/keyring", "~/.config/granola"],
     versionCmd: "granola --version 2>/dev/null | sed -n 1p",
@@ -48798,6 +48834,7 @@ var tool_catalog_default = {
     label: "Heroku",
     summary: "Deploy and manage apps, add-ons and databases on Heroku.",
     statusCmd: "heroku auth:whoami 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    logoutCmd: "heroku logout",
     loginCmd: `k=<api_key>; f="$HOME/.netrc"; (umask 077; touch "$f"; chmod 600 "$f") && K="$k" python3 -c 'import os,re,sys; f=sys.argv[1]; k=os.environ["K"]; s=re.sub(r"machine\\s+(api|git)\\.heroku\\.com\\s+login\\s+\\S+\\s+password\\s+\\S+\\s*", "", open(f).read()); open(f, "w").write(s + "".join("machine %s.heroku.com\\n  login token\\n  password %s\\n" % (h, k) for h in ("api", "git")))' "$f" && heroku auth:whoami`,
     credentialPaths: ["~/.netrc"],
     versionCmd: "heroku --version 2>/dev/null | sed -n 1p",
@@ -49270,6 +49307,7 @@ var tool_catalog_default = {
     description: "Official Pinecone CLI (`pc`). Connect with a project API key (app.pinecone.io → API keys). `pc index list`, `pc index create --name <n> --dimension 1536 --metric cosine --cloud aws --region us-east-1`, `pc index describe --name <n>`.",
     loginCmd: "pc auth configure --api-key <api_key>",
     statusCmd: "pc index list --json >/dev/null 2>&1 && echo authenticated",
+    logoutCmd: "pc auth logout",
     versionCmd: "pc version 2>/dev/null | sed -n 1p",
     credentialPaths: [
       "~/.config/pinecone/secrets.yaml",
@@ -49647,6 +49685,7 @@ var tool_catalog_default = {
   cloudinary: {
     category: "creative",
     pkg: "cloudinary-cli",
+    pipSdist: ["cloudinary-cli"],
     installer: "pip",
     label: "Cloudinary",
     binName: "cld",
@@ -50099,6 +50138,24 @@ var tool_catalog_default = {
 
 // ../packages/shared-fbe/src/toolCatalog.ts
 var TOOL_CATALOG = tool_catalog_default;
+// ../packages/shared-fbe/src/emailDomains.ts
+var PUBLIC_EMAIL_DOMAINS = new Set([
+  "gmail.com",
+  "googlemail.com",
+  "outlook.com",
+  "hotmail.com",
+  "live.com",
+  "icloud.com",
+  "me.com",
+  "yahoo.com",
+  "proton.me",
+  "protonmail.com",
+  "fastmail.com",
+  "gmx.com",
+  "gmx.net",
+  "mail.com",
+  "zoho.com"
+]);
 // ../packages/shared-fbe/src/toolInstallCommand.ts
 var NPM_HOME = '"${TFA_NPM_HOME:-$HOME}"';
 var NPM_TOOLS = NPM_HOME.replace('}"', '}/.todoforai/tools"');
@@ -50338,13 +50395,14 @@ import { parseArgs } from "util";
 // package.json
 var package_default = {
   name: "@todoforai/cli",
+  license: "MIT",
   description: "TODOforAI CLI — create and manage tasks with tfa-cli.",
   homepage: "https://todofor.ai",
   repository: {
     type: "git",
     url: "git+https://github.com/todoforai/cli.git"
   },
-  version: "0.1.69",
+  version: "0.1.70",
   type: "module",
   bin: {
     "todoforai-cli": "bin/todoforai-cli.js",
@@ -50412,10 +50470,11 @@ Examples:
   tfa-cli show <file|-> [todo-id]     # Render a local file (image/pdf/html…) in the chat; - = stdin
   tfa-cli show list|rm …              # List / take down shown files
   tfa-cli open <url> [todo-id]        # Live url preview in the chat
+  tfa-cli connect <key>… [--reason "why"]  # Sign-in card for connectors on this machine (several keys = one choice)
   tfa-cli recommend --template <id>    # Add a template as a recommendation card
   tfa-cli inbox [needs-you|messages|activity] [--unread]  # Read the notification feed (the bell)
   tfa-cli inbox seen [tab]              # Mark notifications read
-  tfa-cli notify [--to <email>] "Title" "message" [--href /t/<id>]  # Note to your own user, or --to a project member (Messages tab + phone push)
+  tfa-cli notify [--to <email>] "Title" "message" [--href /t/<id>] [--url <link>]  # Note to your own user, or --to a project member (Messages tab + phone push)
   tfa-cli claim mint --seed <projectId> [--emails a@x,b@y] [--ttl <sec>]  # Mint /claim/<token> links for a project you own
   tfa-cli next [--direction "<text>"]  # Analyzer growth recommendation cards
   tfa-cli import [claude|codex|<file>...] [--dry-run]  # Import Claude Code / Codex sessions as todos
@@ -50546,6 +50605,7 @@ function parseCliArgs() {
       link: { type: "boolean", default: false },
       force: { type: "boolean", default: false },
       direction: { type: "string" },
+      reason: { type: "string" },
       url: { type: "string" },
       account: { type: "string" },
       "from-company": { type: "boolean", default: false },
@@ -53361,7 +53421,9 @@ Examples:
   tfa-cli agent update <agent> sysmsg="You are a terse video editor."
   tfa-cli agent create name=Reviewer model=claude sysmsg="Review diffs only."
 
-From an agent shell (dst_ token) permissions, edgesMcpConfigs, devicesConfig and delete are refused by the backend.
+  tfa-cli agent update <agent> judgeSysmsg="Ask before destructive actions. Everything else can run."   (auto-approve policy)
+
+From an agent shell (dst_ token) permissions, judgeSysmsg, edgesMcpConfigs, devicesConfig and delete are refused by the backend.
 `);
 }
 var FIELD_ALIASES = {
@@ -54953,15 +55015,17 @@ function printNotifyHelp() {
 tfa-cli notify — leave a note in someone's Messages inbox (+ phone push)
 
 Usage:
-  tfa-cli notify "Title" "message" [--href /t/<todo-id>] [--subject <key>] [--json]
+  tfa-cli notify "Title" "message" [--href /t/<todo-id>] [--url <link>] [--subject <key>] [--json]
   tfa-cli notify --to <email> "Title" "message" [--project <id>]
   echo "message" | tfa-cli notify "Title"
 
 Recipient: your own user by default. --to <email> reaches a TEAMMATE: someone who is a member
 of the current project (--project, $TODOFORAI_PROJECT_ID or your default), shown as from you.
 Anyone else is refused. List them with: tfa-cli project members
---subject dedupes: the same subject is delivered once (default: hash of title+message,
+--subject dedupes: the same subject is delivered once (default: hash of title+message+url,
 so a retry never double-notifies). --href must be an in-app path.
+--url is what tapping the phone notification opens (https/tel/sms/mailto), e.g. navigation:
+  --url "https://www.google.com/maps/dir/?api=1&destination=Deák+tér&dir_action=navigate"
 Limits: 10 notes/day to yourself, 20/day to teammates.
 `);
 }
@@ -55040,8 +55104,9 @@ async function notifyCommand(api, positionals, args, projectId) {
     process.exit(2);
   }
   const subject = args.subject || createHash("sha256").update(`${title}
-${message}`).digest("hex").slice(0, 16);
-  const msg = { subject, title, message, ...args.href ? { href: String(args.href) } : {} };
+${message}${args.url ? `
+${args.url}` : ""}`).digest("hex").slice(0, 16);
+  const msg = { subject, title, message, ...args.href ? { href: String(args.href) } : {}, ...args.url ? { url: String(args.url) } : {} };
   const row = await (to ? api.sendMemberMessage({ ...msg, projectId, to }) : api.sendFeedMessage(msg));
   if (args.json) {
     console.log(JSON.stringify(row));
@@ -80252,6 +80317,21 @@ async function main() {
       console.log(res.ref);
     return;
   }
+  if (positionals[0] === "connect") {
+    const keys = positionals.slice(1);
+    const todoId = aliasTodoId(args.alias) || getEnv("TODO_ID") || cfgScope.data.last_todo_id;
+    if (!keys.length || !todoId) {
+      process.stderr.write(`${RED3}Usage: tfa-cli connect <key> [<key>\u2026] [--reason "why"]${RESET2}
+`);
+      process.exit(2);
+    }
+    const res = await api2.showConnect(todoId, keys, { reason: args.reason, alias: args.alias });
+    if (args.json)
+      console.log(JSON.stringify(res, null, 2));
+    else
+      console.log(res.ref);
+    return;
+  }
   if (positionals[0] === "recommend") {
     const templateId = args.template || positionals[1];
     if (!templateId) {

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@todoforai/cli",
+  "license": "MIT",
   "description": "TODOforAI CLI — create and manage tasks with tfa-cli.",
   "homepage": "https://todofor.ai",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/todoforai/cli.git"
   },
-  "version": "0.1.69",
+  "version": "0.1.70",
   "type": "module",
   "bin": {
     "todoforai-cli": "bin/todoforai-cli.js",