@uru-intelligence/cli 0.4.11 → 0.4.12

package/CHANGELOG.md

@@ -4,24 +4,62 @@
 
 ## Unreleased
 
+### Breaking
+
+- gem.validate and gem.build return a hosted job id immediately. Pass --wait to poll gem.build_job until the compile settles. — surfaces: cli, docs; reference: skills/uru-gems/SKILL.md
+  - Action: Update agents and scripts that expected a compiler result from uru gems validate or uru gems build. Print or store hosted_job_id, then poll gem.build_job, or pass --wait.
+
 ### Security
 
 - Bind npm publication to an attested candidate tarball and require the published cli_pin matrix before release success. — surfaces: cli, release; reference: docs/plans/cli-sdk-native-release-modernization/PLAN.md
   - Action: Release operators must supply the exact candidate run, attempt, release-evidence artifact ID, and MCP commit to the protected publish workflow.
+- Stop uru mcp config and install from printing or writing a live API token. Generated MCP config now points at the URU_API_KEY environment variable. — surfaces: cli; reference: apps/cli/src/local-commands.ts
+  - Action: Set URU_API_KEY in the MCP client environment. uru mcp config no longer embeds the current CLI token.
 
 ### Added
 
+- Add `uru link --verify` for local link diagnostics and `uru gems links create --verify` to run browser verification after link creation. — surfaces: cli, docs; reference: apps/cli/src/workspace-commands.ts
+  - Action: Use `uru link --verify` to confirm `.uru/project.json` and the remote Gem still resolve before source work. After `uru gems links create`, add `--verify` to run `gem.browser_verify` on the new Link's Gem.
 - Add a side-effect-free internal CLI library entrypoint with a typed whoami foundation. _(internal)_ — surfaces: cli, sdk; reference: docs/plans/cli-sdk-native-release-modernization/DECISION_RECORDS.md
   - Action: Programmatic callers must pass an explicit token and workspace; no public SDK compatibility promise is introduced.
 - Add direct CLI access to Home pins and Focus rules from the shared operation registry. — surfaces: cli, docs; reference: content/docs/home.mdx
   - Action: Use uru home <operation> --params-json '{...}' or the matching home.* operation ID.
+- Add first-class CLI verbs for Gem filesystem, deploy, build diagnostics, components, page verify, public-tool delegations, and bindings. — surfaces: cli, docs; reference: docs/reference/uru-cli-mcp-operations.md
+  - Action: Use uru gems fs, uru gems deploy, uru gems build logs|inspect, uru gems verify, uru gems components, uru gems delegations, and uru gems bindings. These wrap existing gem.* operations.
+- Add first-class Dataset list/history/jobs/inspect verbs and a uru distribution group for the 17 collection operations. — surfaces: cli, docs; reference: content/docs/guides/cli.mdx
+  - Action: Use uru datasets ls|inspect|history|jobs and uru distribution list|get|create|update. Dataset SQL stays uru datasets sql. DATA-008 export/typegen is not added.
+- Add first-class Library upload, patch-preview, and favorite verbs, plus automations validate, delete, graph-patch, triggers, connections, and update. — surfaces: cli, docs; reference: docs/reference/uru-cli-mcp-operations.md
+  - Action: Use uru library upload|patch-preview|favorite and uru automations validate|delete|graph-patch|triggers|connections|update instead of operations run for those catalog ids. library write --create now accepts --folder-id.
+- Add first-class uru gems bindings and uru gems api commands so tool-call source and connection bindings stay separate. — surfaces: cli; reference: apps/cli/src/gem-lifecycle-resource-commands.ts
+  - Action: Use uru gems bindings list|upsert|resolve to attach connections, and uru gems api describe|query|action|job to run declared Gem capabilities. Do not put connection ids in Gem source.
+- Add MCP list/target commands, auth status, text-mode list tables, and regenerate the full CLI/MCP operations reference. — surfaces: cli, docs; reference: docs/reference/uru-cli-mcp-operations.md
+  - Action: Use uru mcp list, uru auth status, and uru docs search. List commands print tables in text mode; --json stays JSON. Prefer ${URU_API_KEY} in generated MCP config.
+- Add TTY visual chrome for help, tables, doctor, and login without changing JSON or pipe output. — surfaces: cli; reference: apps/cli/src/visual.ts
+  - Action: No action is required. Color and box drawing appear only on a color TTY. Use --no-color, CI, or a pipe to keep the previous plain text.
+- Add uru tools inspect and uru operations inspect, and accept --params-json @file or @- for large tool parameters. — surfaces: cli; reference: apps/cli/src/command-spec.ts
+  - Action: Use uru tools inspect <name> or uru operations inspect <operation-id> to print a contract. Pass --params-json @path.json or --params-json @- to load parameters from a file or stdin.
+- Make uru update compare this CLI to the latest npm version and add --check --json. — surfaces: cli; reference: apps/cli/src/update-check.ts
+  - Action: No action is required. uru update never installs itself. Run uru update --check --json for machine output, or npm install -g @uru-intelligence/cli@latest to install.
+
+### Changed
+
+- `uru logs --follow` streams Gem runtime logs over SSE for up to 30 minutes and falls back to polling when the stream route is missing. — surfaces: cli; reference: apps/cli/src/gem-lifecycle-commands.ts
+  - Action: No action is required. `--follow-duration-ms` now accepts up to 30 minutes (was 5).
 
 ### Fixed
 
+- JSON output for destructive CLI operations refused without `--yes` now includes `confirmationRequired: true` and a copy-paste `suggestedCommand` with `--yes` appended. — surfaces: cli; reference: apps/cli/src/cli-runtime.ts
+  - Action: No action is required. Agents and scripts can read `suggestedCommand` from JSON errors instead of guessing the confirmation flag.
+- Keep the CLI login when you switch workspace. A leftover workspace from a previous switch no longer poisons the next login. `uru switch` marks the current workspace in the list. — surfaces: cli; reference: apps/cli/src/oauth-credential.ts
+  - Action: No action is required. After you switch workspace, the next command keeps the same login. A new login writes only the workspace the login response selected.
+- Recover from a revoked CLI session without reusing the dead JWT. When the API returns `session_revoked`, the CLI now rotates the stored OAuth login once or clears it instead of sending the revoked token until local expiry. — surfaces: cli; reference: apps/cli/src/cli.ts
+  - Action: No action is required. Failures of this class now carry the `session_revoked` error code so they can be distinguished from a generic `auth_required` response.
 - Report a non-JSON API response as what it is. A proxy or firewall that answers with an HTML page now produces the HTTP status and content type instead of `Unexpected token '<', "<!DOCTYPE "... is not valid JSON`. — surfaces: cli; reference: apps/cli/src/client.ts
   - Action: No action is required. Failures of this class now carry the `non_json_response` error code, keep the auth exit code on a 401, and print a tip naming the likely cause.
 - Report what a rejected credential actually means: `uru doctor` now runs a read-only data call instead of trusting `uru whoami`, API error envelopes are read in full, and auth advice follows where the token came from. — surfaces: cli; reference: apps/cli/src/doctor.ts
   - Action: No action is required. `uru doctor` gains a `data access` check and fails when a credential validates but cannot execute tools; a token supplied through `--token` or `URU_TOKEN` is no longer told to run `uru login`.
+- Send scope on uru automations create, honor --output/--json on uru tools run, and keep errorId plus httpStatus on JSON errors. — surfaces: cli; reference: apps/cli/src/local-commands.ts
+  - Action: uru automations create now sends scope=workspace by default. Pass --scope personal when creating a personal automation. JSON errors include errorId and httpStatus when the API provides them.
 - Use the shared SemVer contract when deciding whether to show a CLI update notice. — surfaces: cli, release; reference: docs/plans/cli-sdk-native-release-modernization/PLAN.md
   - Action: No action is required; prerelease and malformed registry versions now follow the same validation and ordering rules as release publication.
 

package/README.md

@@ -61,24 +61,41 @@ bun src/index.ts library search revenue
 bun src/index.ts library mkdir 'library/Golden Gems'
 bun src/index.ts library read 'library/Contexts/Client Brief.md'
 bun src/index.ts library write 'library/Contexts/Client Brief.md' --file ./brief.md --create
-bun src/index.ts library write 'library/Prompts/Sales Email.md' --content "Draft the follow-up." --create
+bun src/index.ts library write 'library/Prompts/Sales Email.md' --content "Draft the follow-up." --create --folder-id <folder-id>
+bun src/index.ts library patch-preview 'library/Prompts/Sales Email.md' --content "*** Begin Patch\n..."
+bun src/index.ts library favorite 'library/Contexts/Client Brief.md'
+bun src/index.ts library upload 'library/Assets/logo.png' --file ./logo.png
+bun src/index.ts library upload complete --upload-id <id> --bucket <bucket> --object-path <path> --filename logo.png --size-bytes 1024
 bun src/index.ts library patch 'library/Prompts/Sales Email.md' --stdin
 bun src/index.ts library cp 'library/Notes/Brief.md' 'library/Archive/Brief.md'
 bun src/index.ts library mv 'library/Notes/Draft.md' 'library/Notes/Final.md'
 bun src/index.ts library rm 'library/Notes/Old.md'
 bun src/index.ts library restore 'library/Notes/Old.md'
+bun src/index.ts datasets ls --limit 50 --json
 bun src/index.ts datasets query revenue_rows --limit 50 --response-format concise --json
 # Registry-family commands accept canonical camelCase fields and adapt them at
 # the tool-protocol boundary.
 bun src/index.ts datasets get revenue-rows
+bun src/index.ts datasets history revenue-rows --limit 20
+bun src/index.ts datasets jobs revenue-rows --limit 20
 bun src/index.ts datasets rows --params-json '{"op":"upsert","datasetId":"revenue-rows","rows":[{"name":"Acme"}]}'
 bun src/index.ts datasets create --params-json '{"title":"Revenue Rows","properties":[{"clientKey":"name","name":"Name","type":"title","required":true,"nullable":false,"position":0,"config":{}}]}'
+bun src/index.ts datasets sql --params-json '{"sql":"SELECT 1"}'
+bun src/index.ts distribution list --limit 20
+bun src/index.ts distribution get <collection-id>
+bun src/index.ts distribution create "Client pack" --scope workspace
 
 # Automation helpers over the platform tool surface.
 bun src/index.ts automations ls --limit 100
 bun src/index.ts automations get <automation-id>
 bun src/index.ts automations create "Daily revenue digest" --status draft
+bun src/index.ts automations update <automation-id> --description "Nightly digest"
 bun src/index.ts automations enable <automation-id>
+bun src/index.ts automations validate <automation-id> --mode structural --graph-json '{}'
+bun src/index.ts automations graph-patch <automation-id> --patch-json '{"ops":[]}'
+bun src/index.ts automations triggers list <automation-id>
+bun src/index.ts automations connections list
+bun src/index.ts automations delete <automation-id> --yes
 bun src/index.ts automations trigger <automation-id> --input-message "Run now"
 bun src/index.ts automations runs ls <automation-id> --scope workspace --limit 20
 bun src/index.ts automations runs tail <run-id> --level warn
@@ -95,11 +112,21 @@ bun src/index.ts operations ls --family automations
 bun src/index.ts operations run gem.inspect --params-json '{"path":"library/Golden Gems/My Gem.gem"}'
 bun src/index.ts library search "client brief"
 bun src/index.ts docs library_fs
+bun src/index.ts docs search library_fs
 bun src/index.ts api platform/tools/search_tools/execute -F query=gem
+bun src/index.ts api /api/platform/tools/search_tools/execute -F query=gem
 
-# MCP client config helper. Prefer a scoped API key for real installs.
+# MCP client config helper. Prefer ${URU_API_KEY} or --api-key. List never prints keys.
+bun src/index.ts mcp list
+bun src/index.ts mcp list --target cursor
 bun src/index.ts mcp config --api-key "$URU_API_KEY"
+bun src/index.ts mcp install --target cursor
 bun src/index.ts mcp install --path ~/.config/claude-code/mcp.json --api-key "$URU_API_KEY"
+bun src/index.ts mcp remove --target cursor
+
+# Local auth facts. Never prints a JWT.
+bun src/index.ts auth status --json
+bun src/index.ts doctor --json
 
 # Local shell integration.
 bun src/index.ts complete bash
@@ -141,7 +168,7 @@ explicit token/API-key paths:
 - `uru login --token ...` stores the token in OS credential storage when available: macOS Keychain, Linux `secret-tool`/libsecret, or Windows Credential Manager via PowerShell
 - `uru login --token ... --insecure-storage` is the explicit plaintext fallback
 - Linux token storage requires `secret-tool` (often installed as `libsecret-tools`); Windows token storage requires PowerShell access to Credential Manager. If the OS store is unavailable, login fails closed with an actionable `--insecure-storage` fallback message.
-- browser/device credentials renew within five minutes of session expiry and when switching workspaces
+- browser/device credentials renew within five minutes of session expiry. A workspace switch is request scope and does not rotate the login.
 - interactive commands with missing or expired stored auth start browser login and then retry the command without printing login success text to stdout
 - `--no-input` disables implicit login and exits `4` when authentication is missing
 - `uru logout` invalidates the current CLI session, revokes the renewable OAuth credential, and clears local auth state
@@ -151,6 +178,9 @@ explicit token/API-key paths:
 - config file permissions: `0600`
 - linked project state: `.uru/project.json` with `{workspaceId, gemId, libraryPath}`
 - no credentials are written to `.uru/project.json`
+- `uru auth status` reports logged-in / workspace / storage / expiry and never prints a JWT. `uru whoami` stays a server identity call.
+- `uru switch` sets the local default workspace. `uru link` binds this directory to one Gem. `--workspace` / `URU_WORKSPACE_ID` override one invocation.
+- The screen says Agent; Library paths and schemas say persona (`library/Agents/Name.persona.md`).
 - Gem-scoped deploy tokens for CI use `uru tokens create|ls|revoke`
     - `uru tokens create` requires `--name` plus exactly one lifetime flag:
       `--expiry <duration>` or `--expires-at <iso timestamp>`
@@ -163,6 +193,21 @@ explicit token/API-key paths:
   file
 - `uru env run -- <cmd>` overlays local values and redacts all non-empty values from captured output
 
+## CI cookbook
+
+Use a Gem-scoped token, never a session JWT, and fail closed:
+
+```bash
+uru tokens create 'library/Golden Gems/My Gem.gem' --name CI --expiry 30d --json
+export URU_TOKEN=<token-from-create-once>
+export URU_WORKSPACE_ID=<workspace-id>
+uru --no-input doctor --json
+uru --no-input auth status --json
+uru --no-input whoami --json
+```
+
+`--no-input` exits instead of opening a browser. `auth status` and `doctor` warn if the token lives in `--insecure-storage` and do not print the token. `env pull` writes names only; it does not download secret values.
+
 ## Install shape
 
 The package name is `@uru-intelligence/cli`; the installed binary is still `uru`:

package/dist/library.mjs

@@ -6595,10 +6595,6 @@ var zArtifactToolPolicyReceiptTerminalResponse = union([
     terminalized: literal(false)
   })
 ]);
-var zAuditorConversationBootstrapRequest = object({
-  evaluationId: string2().nullish(),
-  forceNew: boolean2().optional().default(false)
-});
 var zAuthMode = _enum(["oauth2", "bearer", "none"]).default("none");
 var zAuthPreflightResponse = object({
   expiresAt: exports_iso.datetime({ offset: true })
@@ -12931,21 +12927,6 @@ var zGetPrimaryRubricForAutomationApiAutomationsAutomationIdRubricGetQuery = obj
   scope: _enum(["personal", "workspace"]).optional().default("personal")
 });
 var zGetPrimaryRubricForAutomationApiAutomationsAutomationIdRubricGetResponse = record(string2(), unknown());
-var zQuickCreateRubricForAutomationApiAutomationsAutomationIdRubricQuickCreatePostPath = object({
-  automationId: string2()
-});
-var zQuickCreateRubricForAutomationApiAutomationsAutomationIdRubricQuickCreatePostQuery = object({
-  scope: _enum(["personal", "workspace"]).optional().default("personal")
-});
-var zQuickCreateRubricForAutomationApiAutomationsAutomationIdRubricQuickCreatePostResponse = record(string2(), unknown());
-var zBootstrapRubricReviewConversationApiAutomationsAutomationIdRubricRubricIdConversationPostPath = object({
-  automationId: string2(),
-  rubricId: string2()
-});
-var zBootstrapRubricReviewConversationApiAutomationsAutomationIdRubricRubricIdConversationPostQuery = object({
-  scope: _enum(["personal", "workspace"]).optional().default("personal")
-});
-var zBootstrapRubricReviewConversationApiAutomationsAutomationIdRubricRubricIdConversationPostResponse = record(string2(), unknown());
 var zTriggerRubricEvaluationApiAutomationsAutomationIdRubricRubricIdEvaluatePostPath = object({
   automationId: string2(),
   rubricId: string2()
@@ -16857,7 +16838,7 @@ function pickString(record2, keys) {
 // package.json
 var package_default = {
   name: "@uru-intelligence/cli",
-  version: "0.4.11",
+  version: "0.4.12",
   private: false,
   description: "Uru full-platform command line interface",
   repository: {
@@ -16935,11 +16916,27 @@ var ExitCode = {
 class CliError extends Error {
   exitCode;
   errorCode;
+  confirmationRequired;
+  suggestedCommand;
+  errorId;
+  httpStatus;
   constructor(message, options = {}) {
     super(message, options.cause === undefined ? undefined : { cause: options.cause });
     this.name = "CliError";
     this.exitCode = options.code ?? ExitCode.Failure;
     this.errorCode = options.errorCode ?? defaultCliErrorCode(this.exitCode);
+    if (options.confirmationRequired === true) {
+      this.confirmationRequired = true;
+    }
+    if (options.suggestedCommand !== undefined) {
+      this.suggestedCommand = options.suggestedCommand;
+    }
+    if (options.errorId !== undefined) {
+      this.errorId = options.errorId;
+    }
+    if (options.httpStatus !== undefined) {
+      this.httpStatus = options.httpStatus;
+    }
   }
 }
 function defaultCliErrorCode(exitCode) {
@@ -16957,6 +16954,9 @@ function defaultCliErrorCode(exitCode) {
   }
 }
 
+// src/oauth-credential.ts
+var SESSION_REFRESH_LEEWAY_MS = 5 * 60 * 1000;
+
 // ../../packages/types/src/mcp/gemResult.ts
 var GEM_RESULT_SCHEMA_V1 = "uru.gem.result.v1";
 // src/gem-result.ts
@@ -17009,6 +17009,7 @@ function gemToolError(operation, value) {
   };
   return new CliError(`Gem ${operation} failed: code=${error2.code}; message=${error2.message}; error_id=${error2.error_id}`, {
     errorCode: error2.code,
+    errorId: error2.error_id,
     ...error2.code === "source_revision_conflict" ? { code: ExitCode.Conflict } : {}
   });
 }
@@ -17145,6 +17146,40 @@ class UruApiClient {
     }
     return { streamed: false, payload: body.value };
   }
+  async requestSseStream(path, options = {}) {
+    const query = buildQueryString(options.query);
+    const signals = [this.signal, options.signal].filter((signal2) => signal2 !== undefined);
+    const signal = signals.length === 0 ? undefined : signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+    const init = {
+      method: options.method ?? "GET",
+      ...signal === undefined ? {} : { signal },
+      headers: {
+        Authorization: `Bearer ${this.token}`,
+        Accept: "text/event-stream",
+        "X-Uru-Client-Name": "uru-cli",
+        "X-Uru-Client-Version": CLI_VERSION,
+        ...options.cliOperation === undefined ? {} : { "X-Uru-Client-Operation": options.cliOperation },
+        ...this.workspaceId === undefined ? {} : { "X-Uru-Workspace-Id": this.workspaceId },
+        ...options.lastEventId === undefined || options.lastEventId === "" ? {} : { "Last-Event-ID": options.lastEventId }
+      }
+    };
+    const response = await this.fetchImpl(`${this.apiUrl}${path}${query}`, init);
+    if (response.status === 404) {
+      return { streamed: false, notFound: true };
+    }
+    if (response.ok && response.body !== null && isEventStreamResponse(response.headers.get("content-type"))) {
+      return { streamed: true, stream: response.body };
+    }
+    const text = await response.text();
+    const body = parseResponseBody(text);
+    if (!body.parsed) {
+      throw nonJsonResponseError(response.status, response.headers.get("content-type"));
+    }
+    if (!response.ok) {
+      throw apiError(response.status, body.value, undefined);
+    }
+    throw new CliError("API returned a non-SSE runtime log stream.");
+  }
   async streamGemTool(name, parameters, operation, onEvent) {
     const streamed = await this.streamTool(name, parameters, onEvent, operation);
     if (streamed.streamed) {
@@ -17172,21 +17207,26 @@ function toolTransportError(body, requestBody) {
   }
   const status = body["httpStatus"];
   const message = `${error2.message} (HTTP ${status})`;
+  const structured = {
+    ...error2.errorCode === undefined ? {} : { errorCode: error2.errorCode },
+    ...error2.errorId === undefined ? {} : { errorId: error2.errorId },
+    httpStatus: status
+  };
   if (status === 409) {
     return new CliError(message, {
       code: ExitCode.Conflict,
-      ...error2.errorCode === undefined ? {} : { errorCode: error2.errorCode }
+      ...structured
     });
   }
   if (status === 401 || status === 403) {
     return new CliError(message, {
       code: ExitCode.AuthRequired,
-      ...error2.errorCode === undefined ? {} : { errorCode: error2.errorCode }
+      ...structured
     });
   }
   return new CliError(message, {
     code: error2.exitCode,
-    ...error2.errorCode === undefined ? {} : { errorCode: error2.errorCode }
+    ...structured
   });
 }
 function normalizeApiUrl(value) {
@@ -17220,6 +17260,23 @@ function isNdjsonResponse(contentType) {
   const normalized = String(contentType ?? "").toLowerCase();
   return normalized.includes("application/x-ndjson") || normalized.includes("application/ndjson") || normalized.includes("text/x-ndjson");
 }
+function isEventStreamResponse(contentType) {
+  return String(contentType ?? "").toLowerCase().includes("text/event-stream");
+}
+function buildQueryString(query) {
+  if (query === undefined) {
+    return "";
+  }
+  const params = new URLSearchParams;
+  for (const [key, value] of Object.entries(query)) {
+    if (value === undefined || value === "") {
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  const encoded = params.toString();
+  return encoded === "" ? "" : `?${encoded}`;
+}
 async function readNdjsonStream(body, onEvent) {
   const reader = body.getReader();
   const decoder = new TextDecoder;
@@ -17286,9 +17343,12 @@ function apiError(status, payload, requestBody) {
     "errorCode",
     "error_code"
   ]);
+  const errorId = pickStringFromJsonValue(envelope, ["errorId", "error_id"]);
   return new CliError(message, {
     code: status === 401 ? ExitCode.AuthRequired : ExitCode.Failure,
-    errorCode: backendCode ?? (status === 401 ? "auth_required" : status === 403 ? "permission_denied" : "api_request_failed")
+    errorCode: backendCode ?? (status === 401 ? "auth_required" : status === 403 ? "permission_denied" : "api_request_failed"),
+    httpStatus: status,
+    ...errorId === undefined ? {} : { errorId }
   });
 }
 function pickStringFromJsonValue(value, keys) {