@usenaive-sdk/cli 0.12.5 → 0.13.1

package/dist/commands/approvals.js

@@ -1,10 +1,90 @@
 import { Command } from "commander";
 import { apiRequest, handleApiError, activeUserId } from "../client.js";
 import { agentOutput } from "../output.js";
+/**
+ * THE SUCCESS ENVELOPE.
+ *
+ * `naive --help` promises "every command returns structured JSON with result
+ * data, next steps, and contextual guidance for autonomous operation"
+ * (index.ts), /cli/overview documents the same shape. `approvals` shipped with
+ * `next_steps: []` on `get`/`deny`/`watch`, `<id>` placeholders on `list`, and
+ * no `hints` anywhere — so an agent that listed its own frozen actions was told
+ * neither which id to act on nor that a pending action has not run yet.
+ *
+ * Both are DERIVED from the response the API just returned — the id in a
+ * suggested command is an id the API echoed (`serializeApproval`,
+ * api/src/services/approvals.ts:410), a hint restates a field it actually sent —
+ * so neither can drift from the queue's real state. Same rule `workloadHints`
+ * follows in compute.ts and `creditCostHint` in output.ts.
+ */
 /** Resolve the user path segment — explicit --user wins, else active, else "default". */
 function userPath(user) {
     return `/v1/users/${user ?? activeUserId() ?? "default"}`;
 }
+/** A non-empty string field, or undefined — the API sends `null` for unset. */
+function str(o, k) {
+    const v = o?.[k];
+    return typeof v === "string" && v ? v : undefined;
+}
+/** The id for a suggested command: the one the API echoed, else what the caller
+ *  typed, so a next step is copy-pasteable rather than an `<id>` placeholder. */
+function aid(data, typed) {
+    return str(data, "id") ?? typed ?? "<id>";
+}
+/** The rows of a queue read — the API answers `{ approvals: [...] }`. */
+function rows(data) {
+    const a = data?.approvals;
+    if (!Array.isArray(a))
+        return [];
+    return a.filter((r) => !!r && typeof r === "object");
+}
+/** What `pending` MEANS, stated once — the action is frozen and has not run. */
+const FROZEN = "Pending means frozen: the action has NOT run yet, and runs only if it is approved.";
+/** Hints echoed off one approval the API returned — restated, never asserted. */
+function approvalHints(data) {
+    const out = [];
+    const status = str(data, "status");
+    if (status)
+        out.push(`Status: ${status}`);
+    const title = str(data, "title");
+    if (title)
+        out.push(`Action: ${title}`);
+    const type = str(data, "action_type");
+    if (type)
+        out.push(`Action type: ${type}`);
+    const reason = str(data, "reason");
+    if (reason)
+        out.push(`Reason on record: ${reason}`);
+    const err = str(data, "error");
+    if (err)
+        out.push(`Failed with: ${err}`);
+    if (status === "pending")
+        out.push(FROZEN);
+    if (status === "executed")
+        out.push("Already replayed by the API — `result` holds what the action returned.");
+    if (status === "denied")
+        out.push("Denied — this action will never run.");
+    // The contract is a NON-EMPTY hints array; a row the API sent with none of the
+    // fields above still has to say something true rather than nothing.
+    return out.length > 0 ? out : ["The API returned this approval with no status or title."];
+}
+/** Hints for a queue read — the shape of the queue the API just returned. */
+function queueHints(list, filter) {
+    const out = [list.length === 1 ? "1 approval." : `${list.length} approvals.`];
+    if (filter)
+        out.push(`Filtered by status: ${filter}.`);
+    const counts = new Map();
+    for (const r of list)
+        counts.set(str(r, "status") ?? "unknown", (counts.get(str(r, "status") ?? "unknown") ?? 0) + 1);
+    if (counts.size > 0)
+        out.push(`Statuses: ${[...counts].map(([s, n]) => `${s} ${n}`).join(", ")}.`);
+    if ((counts.get("pending") ?? 0) > 0)
+        out.push(FROZEN);
+    if (list.length === 0) {
+        out.push('Only actions that require human approval land here — a gated action returns HTTP 202 with status "pending_approval" and waits.');
+    }
+    return out;
+}
 export const approvalsCmd = new Command("approvals")
     .alias("approval")
     .description("Governance — review & resolve agent-requested approvals for sensitive actions")
@@ -39,13 +119,25 @@ approvalsCmd
     const q = opts.status ? `?status=${encodeURIComponent(opts.status)}` : "";
     const resp = await apiRequest("GET", `${userPath(opts.user)}/approvals${q}`, undefined, { userId: opts.user });
     handleApiError("approvals.list", resp);
+    const list = rows(resp.data);
+    // Point at a REAL row — a pending one first, since that is the only state
+    // approve/deny can act on. With an empty queue there is no id to name, so
+    // the next step is the re-read that would surface one.
+    const target = list.find((r) => str(r, "status") === "pending") ?? list[0];
+    const next = target
+        ? [
+            { command: `naive approvals get ${aid(target)}`, description: "Show this approval's frozen payload" },
+            { command: `naive approvals approve ${aid(target)}`, description: "Approve it — the API replays the action" },
+            { command: `naive approvals deny ${aid(target)}`, description: "Deny it — the action never runs" },
+        ]
+        : opts.status
+            ? [{ command: "naive approvals list", description: `Show every approval, not just "${opts.status}"` }]
+            : [{ command: "naive approvals list --status pending", description: "Re-check for newly frozen actions" }];
     agentOutput({
         action: "approvals.list",
         result: resp.data,
-        next_steps: [
-            { command: "naive approvals approve <id>", description: "Approve a pending action" },
-            { command: "naive approvals deny <id>", description: "Deny a pending action" },
-        ],
+        next_steps: next,
+        hints: queueHints(list, opts.status),
     });
 });
 approvalsCmd
@@ -56,7 +148,20 @@ approvalsCmd
     .action(async (id, opts) => {
     const resp = await apiRequest("GET", `${userPath(opts.user)}/approvals/${id}`, undefined, { userId: opts.user });
     handleApiError("approvals.get", resp);
-    agentOutput({ action: "approvals.get", result: resp.data, next_steps: [] });
+    agentOutput({
+        action: "approvals.get",
+        result: resp.data,
+        // Only a pending approval can be approved, denied or waited on; once it is
+        // resolved the honest next move is back to the queue.
+        next_steps: str(resp.data, "status") === "pending"
+            ? [
+                { command: `naive approvals approve ${aid(resp.data, id)}`, description: "Approve — the API replays the frozen action" },
+                { command: `naive approvals deny ${aid(resp.data, id)}`, description: "Deny — the action never runs" },
+                { command: `naive approvals watch ${aid(resp.data, id)}`, description: "Block until someone resolves it" },
+            ]
+            : [{ command: "naive approvals list --status pending", description: "Back to the actions still awaiting a decision" }],
+        hints: approvalHints(resp.data),
+    });
 });
 approvalsCmd
     .command("approve")
@@ -71,7 +176,11 @@ approvalsCmd
     agentOutput({
         action: "approvals.approve",
         result: resp.data,
-        next_steps: [{ command: `naive approvals get ${id}`, description: "Inspect the execution result" }],
+        next_steps: [
+            { command: `naive approvals get ${aid(resp.data, id)}`, description: "Inspect the execution result" },
+            { command: "naive approvals list --status pending", description: "Continue with the rest of the queue" },
+        ],
+        hints: approvalHints(resp.data),
     });
 });
 approvalsCmd
@@ -83,7 +192,15 @@ approvalsCmd
     .action(async (id, opts) => {
     const resp = await apiRequest("POST", `${userPath(opts.user)}/approvals/${id}/deny`, { reason: opts.reason }, { userId: opts.user });
     handleApiError("approvals.deny", resp);
-    agentOutput({ action: "approvals.deny", result: resp.data, next_steps: [] });
+    agentOutput({
+        action: "approvals.deny",
+        result: resp.data,
+        next_steps: [
+            { command: `naive approvals get ${aid(resp.data, id)}`, description: "Confirm the recorded denial and its reason" },
+            { command: "naive approvals list --status pending", description: "Continue with the rest of the queue" },
+        ],
+        hints: approvalHints(resp.data),
+    });
 });
 approvalsCmd
     .command("watch")
@@ -99,8 +216,24 @@ approvalsCmd
         const resp = await apiRequest("GET", `${userPath(opts.user)}/approvals/${id}`, undefined, { userId: opts.user });
         handleApiError("approvals.watch", resp);
         const status = resp.data.status;
-        if (status !== "pending" || Date.now() >= deadline) {
-            agentOutput({ action: "approvals.watch", result: resp.data, next_steps: [] });
+        const timedOut = Date.now() >= deadline;
+        if (status !== "pending" || timedOut) {
+            // Two very different exits share this return: resolved, or gave up while
+            // still pending. The envelope has to say which one happened.
+            const gaveUp = status === "pending" && timedOut;
+            agentOutput({
+                action: "approvals.watch",
+                result: resp.data,
+                next_steps: gaveUp
+                    ? [
+                        { command: `naive approvals watch ${aid(resp.data, id)}`, description: "Keep waiting — it is still pending" },
+                        { command: `naive approvals approve ${aid(resp.data, id)}`, description: "Stop waiting and approve it now" },
+                    ]
+                    : [{ command: "naive approvals list --status pending", description: "Back to the actions still awaiting a decision" }],
+                hints: gaveUp
+                    ? [...approvalHints(resp.data), `Timed out after ${opts.timeout ?? "300000"}ms while still pending — nothing was decided.`]
+                    : approvalHints(resp.data),
+            });
             return;
         }
         await new Promise((r) => setTimeout(r, interval));

package/dist/commands/approvals.js.map

@@ -1 +1 @@
-{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../src/commands/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,yFAAyF;AACzF,SAAS,QAAQ,CAAC,IAAa;IAC7B,OAAO,aAAa,IAAI,IAAI,YAAY,EAAE,IAAI,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC;KACjD,KAAK,CAAC,UAAU,CAAC;KACjB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;CAqBH,CACE,CAAC;AAEJ,YAAY;KACT,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8CAA8C,CAAC;KAC3D,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAwC,EAAE,EAAE;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACvC,WAAW,CAAC;QACV,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,0BAA0B,EAAE;YACpF,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,uBAAuB,EAAE;SAC/E;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,wBAAwB,CAAC;KACrC,QAAQ,CAAC,MAAM,CAAC;KAChB,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAuB,EAAE,EAAE;IACpD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjH,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,QAAQ,CAAC,MAAM,CAAC;KAChB,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAuB,EAAE,EAAE;IACpD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE;QACjG,MAAM,EAAE,IAAI,CAAC,IAAI;KAClB,CAAC,CAAC;IACH,cAAc,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAC1C,WAAW,CAAC;QACV,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;KACpG,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,2CAA2C,CAAC;KACxD,QAAQ,CAAC,MAAM,CAAC;KAChB,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAwC,EAAE,EAAE;IACrE,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,MAAM,EACN,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAC7C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACvB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CACtB,CAAC;IACF,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8CAA8C,CAAC;KAC3D,QAAQ,CAAC,MAAM,CAAC;KAChB,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,CAAC;KACxD,MAAM,CAAC,gBAAgB,EAAE,4BAA4B,EAAE,QAAQ,CAAC;KAChE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAA4D,EAAE,EAAE;IACzF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC;IAC/D,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjH,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAI,IAAI,CAAC,IAA4B,CAAC,MAAM,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACnD,WAAW,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../src/commands/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C;;;;;;;;;;;;;;;GAeG;AAEH,yFAAyF;AACzF,SAAS,QAAQ,CAAC,IAAa;IAC7B,OAAO,aAAa,IAAI,IAAI,YAAY,EAAE,IAAI,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED,+EAA+E;AAC/E,SAAS,GAAG,CAAC,CAAU,EAAE,CAAS;IAChC,MAAM,CAAC,GAAI,CAAgD,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;iFACiF;AACjF,SAAS,GAAG,CAAC,IAAa,EAAE,KAAc;IACxC,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC;AAC5C,CAAC;AAED,yEAAyE;AACzE,SAAS,IAAI,CAAC,IAAa;IACzB,MAAM,CAAC,GAAI,IAAmD,EAAE,SAAS,CAAC;IAC1E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED,gFAAgF;AAChF,MAAM,MAAM,GAAG,oFAAoF,CAAC;AAEpG,iFAAiF;AACjF,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtC,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IAC9G,IAAI,MAAM,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC1E,+EAA+E;IAC/E,oEAAoE;IACpE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC;AAC5F,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,IAA+B,EAAE,MAAe;IAClE,MAAM,GAAG,GAAa,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,aAAa,CAAC,CAAC;IACxF,IAAI,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,uBAAuB,MAAM,GAAG,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtH,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CACN,gIAAgI,CACjI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC;KACjD,KAAK,CAAC,UAAU,CAAC;KACjB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;CAqBH,CACE,CAAC;AAEJ,YAAY;KACT,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8CAA8C,CAAC;KAC3D,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAwC,EAAE,EAAE;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,0EAA0E;IAC1E,0EAA0E;IAC1E,uDAAuD;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM;QACjB,CAAC,CAAC;YACE,EAAE,OAAO,EAAE,uBAAuB,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE;YACrG,EAAE,OAAO,EAAE,2BAA2B,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE;YAC7G,EAAE,OAAO,EAAE,wBAAwB,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;SACnG;QACH,CAAC,CAAC,IAAI,CAAC,MAAM;YACX,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,kCAAkC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACtG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAC/G,WAAW,CAAC;QACV,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,wBAAwB,CAAC;KACrC,QAAQ,CAAC,MAAM,CAAC;KAChB,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAuB,EAAE,EAAE;IACpD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjH,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC;QACV,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,2EAA2E;QAC3E,sDAAsD;QACtD,UAAU,EACR,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,SAAS;YACpC,CAAC,CAAC;gBACE,EAAE,OAAO,EAAE,2BAA2B,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE;gBACxH,EAAE,OAAO,EAAE,wBAAwB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE;gBACtG,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;aAC3G;YACH,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;QAC1H,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,QAAQ,CAAC,MAAM,CAAC;KAChB,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAuB,EAAE,EAAE;IACpD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE;QACjG,MAAM,EAAE,IAAI,CAAC,IAAI;KAClB,CAAC,CAAC;IACH,cAAc,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAC1C,WAAW,CAAC;QACV,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,uBAAuB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE;YACrG,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,qCAAqC,EAAE;SACzG;QACD,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,2CAA2C,CAAC;KACxD,QAAQ,CAAC,MAAM,CAAC;KAChB,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAwC,EAAE,EAAE;IACrE,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,MAAM,EACN,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAC7C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACvB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CACtB,CAAC;IACF,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACvC,WAAW,CAAC;QACV,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,uBAAuB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE;YACnH,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,qCAAqC,EAAE;SACzG;QACD,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8CAA8C,CAAC;KAC3D,QAAQ,CAAC,MAAM,CAAC;KAChB,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,CAAC;KACxD,MAAM,CAAC,gBAAgB,EAAE,4BAA4B,EAAE,QAAQ,CAAC;KAChE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAA4D,EAAE,EAAE;IACzF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC;IAC/D,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjH,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAI,IAAI,CAAC,IAA4B,CAAC,MAAM,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,EAAE,CAAC;YACrC,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC;YAChD,WAAW,CAAC;gBACV,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,UAAU,EAAE,MAAM;oBAChB,CAAC,CAAC;wBACE,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,oCAAoC,EAAE;wBAC7G,EAAE,OAAO,EAAE,2BAA2B,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;qBAC7G;oBACH,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;gBACxH,KAAK,EAAE,MAAM;oBACX,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,mBAAmB,IAAI,CAAC,OAAO,IAAI,QAAQ,+CAA+C,CAAC;oBAC3H,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/apps.d.ts

@@ -1,2 +1,9 @@
 import { Command } from "commander";
 export declare const appsCmd: Command;
+/**
+ * Parse --body JSON. Agents / shlex often strip quotes from
+ * `{"a":"b"}` → `{a:b}`, and word-split leave `{` `a:b` `}` tokens.
+ * Join tokens, try JSON.parse, then repair unquoted keys/values (including
+ * nested edge-function `files[].content` source strings).
+ */
+export declare function parseJsonBody(raw: string | string[] | undefined, flag: string): Record<string, unknown> | undefined;

package/dist/commands/apps.js

@@ -4,7 +4,7 @@ import { readFileSync, existsSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { apiRequest, apiUploadGzip, handleApiError } from "../client.js";
-import { agentOutput } from "../output.js";
+import { agentError, agentOutput } from "../output.js";
 export const appsCmd = new Command("apps")
     .description("Web apps — create, deploy, manage Vercel-backed web applications with dedicated engineer agents")
     .addHelpText("after", `
@@ -17,7 +17,7 @@ Subcommands:
   naive apps deploy <id> [--dir <path>]        Deploy (local directory upload, or agent workspace inside containers)
   naive apps publish <id> --deployment <id>    Promote a deployment to production
   naive apps deployments <id>                  List deployment history
-  naive apps retry <id>                        Retry failed provisioning
+  naive apps retry <id>                        Retry failed provisioning (noop if healthy)
   naive apps secrets list <id>                 List env variable keys
   naive apps secrets set <id> <KEY> <VALUE>    Set an env variable
   naive apps secrets delete <id> <KEY>         Delete an env variable
@@ -96,15 +96,44 @@ appsCmd
     .command("create")
     .description("Create a new web app with a dedicated engineer agent")
     .requiredOption("--name <name>", "App name")
-    .requiredOption("--type <type>", "App type: frontend_only or fullstack")
+    .option("--type <type>", "App type: frontend_only or fullstack (default: frontend_only)", "frontend_only")
     .option("--variant <variant>", "Template variant: dark-premium, clean-minimal, bold-energetic, warm-human")
-    .option("--description <desc>", "Short description")
+    // <desc...> so unquoted multi-word descriptions are not excess args
+    .option("--description <desc...>", "Short description (unquoted multi-word OK)")
     .action(async (opts) => {
+    const type = String(opts.type ?? "frontend_only").trim() || "frontend_only";
+    if (type !== "frontend_only" && type !== "fullstack") {
+        agentError({
+            action: "apps.create",
+            error: {
+                code: "invalid_input",
+                message: `Invalid --type "${type}". Use frontend_only or fullstack.`,
+            },
+            recovery_steps: [
+                {
+                    command: 'naive apps create --name <name> --type frontend_only',
+                    description: "Create a frontend-only app (default)",
+                },
+                {
+                    command: 'naive apps create --name <name> --type fullstack',
+                    description: "Create a fullstack app with Supabase",
+                },
+            ],
+        });
+    }
+    // `--description <desc...>` is variadic, so commander hands back a string[]
+    // for an unquoted multi-word description and a string for a quoted one.
+    const descriptionRaw = opts.description;
+    const description = Array.isArray(descriptionRaw)
+        ? descriptionRaw.join(" ").trim() || undefined
+        : descriptionRaw
+            ? String(descriptionRaw).trim() || undefined
+            : undefined;
     const resp = await apiRequest("POST", "/v1/apps", {
         name: opts.name,
-        type: opts.type,
+        type,
         ...(opts.variant && { variant: opts.variant }),
-        ...(opts.description && { description: opts.description }),
+        ...(description && { description }),
     });
     handleApiError("apps.create", resp);
     const data = resp.data;
@@ -368,15 +397,38 @@ secretsCmd
 secretsCmd
     .command("reveal <appId> <key>")
     .description("Reveal the value of an environment variable")
-    .requiredOption("--target <target>", "Target: preview or production")
+    .option("--target <target>", "Target: preview or production (default: production)", "production")
     .action(async (appId, key, opts) => {
-    const resp = await apiRequest("GET", `/v1/apps/${appId}/secrets/${encodeURIComponent(key)}/reveal?target=${opts.target}`);
+    // A typo must NOT silently fall through to production. `reveal` is the one
+    // secrets verb with plaintext egress, so `--target prevew` answering with the
+    // PRODUCTION value would hand the caller a secret it did not ask for.
+    const target = String(opts.target ?? "production");
+    if (target !== "preview" && target !== "production") {
+        agentError({
+            action: "apps.secrets.reveal",
+            error: {
+                code: "invalid_input",
+                message: `Invalid --target "${target}". Use preview or production.`,
+            },
+            recovery_steps: [
+                {
+                    command: `naive apps secrets reveal ${appId} ${key} --target production`,
+                    description: "Reveal the production value (default)",
+                },
+                {
+                    command: `naive apps secrets reveal ${appId} ${key} --target preview`,
+                    description: "Reveal the preview value",
+                },
+            ],
+        });
+    }
+    const resp = await apiRequest("GET", `/v1/apps/${appId}/secrets/${encodeURIComponent(key)}/reveal?target=${target}`);
     handleApiError("apps.secrets.reveal", resp);
     agentOutput({
         action: "apps.secrets.reveal",
         result: resp.data,
         next_steps: [
-            { command: `naive apps secrets set ${appId} ${key} <new-value> --target ${opts.target}`, description: "Update this variable" },
+            { command: `naive apps secrets set ${appId} ${key} <new-value> --target ${target}`, description: "Update this variable" },
         ],
     });
 });
@@ -444,6 +496,7 @@ domainsCmd
     const resp = await apiRequest("POST", `/v1/apps/${appId}/connect-domain`, { domainId });
     handleApiError("apps.domains.connect", resp);
     const data = resp.data;
+    const isSystem = /\.usenaive\.ai$/i.test(data.domain ?? "");
     agentOutput({
         action: "apps.domains.connect",
         result: resp.data,
@@ -451,7 +504,9 @@ domainsCmd
             ? [{ command: `naive apps domains verify-dns ${appId} ${domainId}`, description: "Verify DNS after configuring records" }]
             : [{ command: `naive apps show ${appId}`, description: "View updated app" }],
         hints: data.pendingDns
-            ? [`DNS records required for ${data.domain}. Add A and CNAME records, then verify.`]
+            ? isSystem
+                ? [`System domain ${data.domain}: platform writes DNS on usenaive.ai. Retry verify-dns shortly if still pending.`]
+                : [`DNS records required for ${data.domain}. Add A and CNAME records, then verify.`]
             : [`Domain ${data.domain} connected successfully`],
     });
 });
@@ -488,7 +543,7 @@ domainsCmd
 // ─── Retry ──────────────────────────────────────────────────────────────────
 appsCmd
     .command("retry <id>")
-    .description("Retry failed provisioning (Vercel/Supabase setup)")
+    .description("Retry failed provisioning (Vercel/Supabase); no-op success if the app is already healthy")
     .action(async (id) => {
     const resp = await apiRequest("POST", `/v1/apps/${id}/retry`);
     handleApiError("apps.retry", resp);
@@ -522,9 +577,24 @@ dbCmd
     });
 });
 dbCmd
-    .command("query <appId> <sql>")
+    // [sqlParts...] so unquoted multi-word SQL (agents / probe wrappers that
+    // word-split) still reaches the API as one query string.
+    .command("query <appId> [sqlParts...]")
     .description("Run a SQL query against the app's Supabase database")
-    .action(async (appId, sql) => {
+    .action(async (appId, sqlParts) => {
+    const sql = (sqlParts ?? []).join(" ").trim();
+    if (!sql) {
+        agentError({
+            action: "apps.db.query",
+            error: {
+                code: "invalid_input",
+                message: "Missing SQL. Usage: naive apps db query <appId> \"<sql>\"",
+            },
+            recovery_steps: [
+                { command: `naive apps db query ${appId} "SELECT 1"`, description: "Run a quoted SQL query" },
+            ],
+        });
+    }
     const resp = await apiRequest("POST", `/v1/apps/${appId}/db/query`, { sql });
     handleApiError("apps.db.query", resp);
     agentOutput({
@@ -537,11 +607,170 @@ dbCmd
     });
 });
 // ─── Provider Proxies (advanced) ─────────────────────────────────────────────
-function parseJsonBody(raw, flag) {
-    if (!raw)
+/**
+ * Scan an unquoted JSON value that may contain nested `()`, `{}`, `[]` and
+ * embedded quotes (e.g. edge-function `content:Deno.serve(() => …)` after
+ * shlex strips outer quotes — dogfood f877 B64).
+ *
+ * Agents often leave JSON-style `\"` inside the unquoted blob
+ * (`run:\"f877\"`). Treat those as literal `"` in the value — do not enter
+ * string mode on the escaped quote, or brace/paren depth tracking breaks.
+ */
+function scanUnquotedValue(input, start) {
+    let i = start;
+    let depthParen = 0;
+    let depthBrace = 0;
+    let depthBracket = 0;
+    let inStr = null;
+    let escape = false;
+    while (i < input.length) {
+        const c = input[i];
+        if (inStr) {
+            if (escape) {
+                escape = false;
+                i++;
+                continue;
+            }
+            if (c === "\\") {
+                escape = true;
+                i++;
+                continue;
+            }
+            if (c === inStr)
+                inStr = null;
+            i++;
+            continue;
+        }
+        // JSON-escaped quotes left after shlex strip → literal quote chars
+        if (c === "\\" && (input[i + 1] === '"' || input[i + 1] === "'")) {
+            i += 2;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            inStr = c;
+            i++;
+            continue;
+        }
+        if (c === "(") {
+            depthParen++;
+            i++;
+            continue;
+        }
+        if (c === ")") {
+            depthParen--;
+            i++;
+            continue;
+        }
+        if (c === "{") {
+            depthBrace++;
+            i++;
+            continue;
+        }
+        if (c === "}") {
+            if (depthBrace === 0 && depthParen === 0 && depthBracket === 0)
+                break;
+            depthBrace--;
+            i++;
+            continue;
+        }
+        if (c === "[") {
+            depthBracket++;
+            i++;
+            continue;
+        }
+        if (c === "]") {
+            if (depthBrace === 0 && depthParen === 0 && depthBracket === 0)
+                break;
+            depthBracket--;
+            i++;
+            continue;
+        }
+        if (c === "," && depthBrace === 0 && depthParen === 0 && depthBracket === 0)
+            break;
+        i++;
+    }
+    const raw = input.slice(start, i).trimEnd();
+    // Turn leftover `\"` / `\'` into real quotes in the scalar value
+    const value = raw.replace(/\\"/g, '"').replace(/\\'/g, "'");
+    return { value, end: i };
+}
+/**
+ * After quoting keys, quote remaining unquoted scalar values — including
+ * code blobs with parens/braces that the simple `\w` regex cannot match.
+ */
+function quoteUnquotedValues(input) {
+    const out = [];
+    let i = 0;
+    let inString = false;
+    let escape = false;
+    while (i < input.length) {
+        const c = input[i];
+        if (inString) {
+            out.push(c);
+            if (escape)
+                escape = false;
+            else if (c === "\\")
+                escape = true;
+            else if (c === '"')
+                inString = false;
+            i++;
+            continue;
+        }
+        if (c === '"') {
+            inString = true;
+            out.push(c);
+            i++;
+            continue;
+        }
+        if (c === ":") {
+            out.push(c);
+            i++;
+            while (i < input.length && /\s/.test(input[i])) {
+                out.push(input[i]);
+                i++;
+            }
+            if (i >= input.length)
+                break;
+            const rest = input.slice(i);
+            if (rest.startsWith('"') ||
+                rest.startsWith("{") ||
+                rest.startsWith("[") ||
+                /^(true|false|null)(?=[,}\]\s]|$)/.test(rest) ||
+                /^-?\d+(\.\d+)?([eE][+-]?\d+)?(?=[,}\]\s]|$)/.test(rest)) {
+                continue;
+            }
+            const { value, end } = scanUnquotedValue(input, i);
+            out.push(JSON.stringify(value));
+            i = end;
+            continue;
+        }
+        out.push(c);
+        i++;
+    }
+    return out.join("");
+}
+/**
+ * Parse --body JSON. Agents / shlex often strip quotes from
+ * `{"a":"b"}` → `{a:b}`, and word-split leave `{` `a:b` `}` tokens.
+ * Join tokens, try JSON.parse, then repair unquoted keys/values (including
+ * nested edge-function `files[].content` source strings).
+ */
+export function parseJsonBody(raw, flag) {
+    if (raw == null)
         return undefined;
+    const text = (Array.isArray(raw) ? raw.join(" ") : String(raw)).trim();
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        // no-op — try repair below
+    }
     try {
-        return JSON.parse(raw);
+        const withQuotedKeys = text.replace(/([{\[,]\s*)([A-Za-z_][\w]*)(\s*:)/g, '$1"$2"$3');
+        const repaired = quoteUnquotedValues(withQuotedKeys);
+        return JSON.parse(repaired);
     }
     catch {
         console.error(`Invalid JSON passed to ${flag}`);
@@ -551,7 +780,7 @@ function parseJsonBody(raw, flag) {
 appsCmd
     .command("vercel <appId> <method> <path>")
     .description("Call any Vercel REST API operation, scoped to the app's Vercel project (credentials injected by Naive)")
-    .option("--body <json>", "JSON request body")
+    .option("--body <json...>", "JSON request body (unquoted / word-split OK for flat objects)")
     .addHelpText("after", `
 Examples:
   naive apps vercel <id> GET v6/deployments                       List deployments
@@ -579,15 +808,23 @@ blocked — use 'naive apps delete'. See https://vercel.com/docs/rest-api.
 appsCmd
     .command("supabase <appId> <method> <path>")
     .description("Call any Supabase Management API operation, scoped to the app's Supabase project (fullstack apps only)")
-    .option("--body <json>", "JSON request body")
+    .option("--body <json...>", "JSON request body (unquoted / word-split OK for flat objects)")
     .addHelpText("after", `
 Examples:
   naive apps supabase <id> GET "v1/projects/<ref>"                       Project details
   naive apps supabase <id> GET "v1/projects/<ref>/config/auth"           Auth config
   naive apps supabase <id> PATCH "v1/projects/<ref>/config/auth" --body '{"site_url":"https://example.com"}'
   naive apps supabase <id> GET "v1/projects/<ref>/functions"             List edge functions
+  naive apps supabase <id> POST "v1/projects/<ref>/functions" --body '{"slug":"hello","name":"hello","verify_jwt":false,"body":"Deno.serve(() => new Response(\\"ok\\"))"}'
+  naive apps supabase <id> POST "v1/projects/<ref>/functions/deploy?slug=hello" --body '{"name":"hello","verify_jwt":false,"files":[{"name":"index.ts","content":"Deno.serve(() => new Response(\\"ok\\"))"}]}'
   naive apps supabase <id> POST "v1/projects/<ref>/database/query" --body '{"query":"select * from users limit 10"}'
 
+Edge functions:
+  - Create (JSON): POST …/functions with slug, name, and a source \`body\` string.
+  - Deploy/update (preferred): POST …/functions/deploy?slug=<slug> with files:[{name,content}].
+    The proxy converts that JSON into multipart file parts (one per source file).
+  Docs: /docs/api-reference/functions/overview
+
 Scope: only this app's project (v1/projects/{ref}/**) is reachable. Deleting
 the project itself is blocked — use 'naive apps delete'. See
 https://supabase.com/docs/reference/api.