@withandeo/cli 0.19.14 → 0.19.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withandeo/cli",
-  "version": "0.19.14",
+  "version": "0.19.16",
   "description": "Developer CLI for Andeo applications",
   "type": "module",
   "license": "UNLICENSED",

package/skill/publication.json

@@ -1,3 +1,3 @@
 {
-  "minimumCliVersion": "0.19.12"
+  "minimumCliVersion": "0.19.16"
 }

package/skill/tender-accounts/SKILL.md

@@ -89,6 +89,35 @@ agent merge grant, verify the exact branch preview, read the managed-source refe
 to request hosted landing and follow the saved publication policy. Inspect required
 human review, deployment and cleanup outcomes separately; do not push main to bypass them.
 
+For persistent Cloud runs, inspect the current project's capabilities. Preview
+requires explicit `preview.build`/`preview.open`, repository scope and the
+`preview` environment. Commit and push the assigned branch, then run
+`andeo preview --json`: Andeo builds that exact managed source in its isolated
+builder. Unsupported bindings/test graphs must fail; do not upload a local
+artifact or bypass the isolation gate. Reopen with the returned `sbl_` ID while
+the run and derived preview remain authorized. Expiry requires a fresh task and
+its own assigned branch/preview, not reuse of the old bearer.
+
+`source.merge` delegates approval for the run's validated source. Keep
+`review.prepare` when requesting an implicit source review through merge.
+Use the existing merge command for the assigned branch or exact permitted
+`--change`; no new human receipt is required. Follow the user's release
+instructions before requesting landing. Saved publication policy determines
+whether landing also deploys. Report exact main readback and verified production
+separately. Existing grants must be explicitly replaced to add these capabilities;
+editing `ANDEO_AGENT_SCOPE` cannot expand a grant. Persistent preview logs remain
+unavailable.
+
+Cloud setup needs the `ANDEO_CLOUD_BOOTSTRAP` network secret, restricted to
+`agent-auth.withandeo.com`. Scope and installation identity default server-side
+from the grant; run duration defaults to 30 minutes capped by tenant policy and
+parent expiry. `ANDEO_AGENT_SCOPE`, `ANDEO_AGENT_RUN_SECONDS`,
+`ANDEO_AGENT_ENVIRONMENT_ID` and the standard URL settings are optional.
+Invalid explicit overrides fail rather than silently selecting defaults.
+Task startup still supplies a unique `ANDEO_AGENT_TASK_ID` and a private
+`ANDEO_AGENT_STATE_DIR` outside all checkouts, reused only within that task.
+Proxy routing, when required by the host, belongs in the setup script.
+
 Read the delivery reference for commands and recovery. Run app checks and artifact dry-run before delivery. Preserve exact source, digest, release, delivery and composition identities.
 
 Distinguish local check, retained upload, ready preview, administrator approval, production activation and live acceptance. None substitutes for the next. Prove the intended combined composition for connected changes, not two unrelated releases.

package/skill/tender-accounts/references/authentication.md

@@ -1,5 +1,7 @@
 # Authentication and project scope
 
+For Cloud installations using CLI 0.19.16 or newer, configure the secret `ANDEO_CLOUD_BOOTSTRAP`. Standard Andeo origins, the installation identity, and the effective grant scope are resolved automatically. `ANDEO_AGENT_SCOPE` optionally narrows that scope; `ANDEO_AGENT_RUN_SECONDS` optionally requests a different bounded lifetime. Omitted lifetime defaults to 30 minutes, capped by tenant policy and credential expiry. At task startup set a unique `ANDEO_AGENT_TASK_ID` and private `ANDEO_AGENT_STATE_DIR` outside the checkout. Set `NODE_USE_ENV_PROXY=1` only when the runtime requires its network proxy. Explicit invalid overrides fail rather than falling back to defaults.
+
 If authentication is missing, start the agent-safe device flow:
 
 ```sh

package/skill/tender-accounts/references/delivery.md

@@ -41,6 +41,25 @@ evidence. Continue to honor explicit production approval from the user.
 
 ## Create an exact preview
 
+Persistent Codex Cloud agents use a managed-source broker instead of the local
+artifact upload path. Check current `preview.build` and `preview.open`, explicit
+repository scope, and `environments: ["preview"]`. Commit, validate locally and
+push the assigned `agent/<runId>` branch, then use `andeo preview --json`.
+Andeo checks the exact pushed SHA and executes checkout/build in separate
+credentialed and isolated phases. The first supported profile uses stateless
+fixtures; D1/KV/R2, services, secrets, workflows, database bootstrap and Flagship
+bindings are unsupported. Production secrets/data/service fallbacks are denied. A connected
+customer journey requires a supported isolated test graph and separate proof.
+
+The result returns the exact source-build `sbl_` ID, release, composition and
+preview link. `--no-wait` returns the accepted operation for later inspection;
+`andeo preview open --from sbl_... --json` opens that same result. Preview/run
+lifetimes remain finite; reopening cannot extend the parent authority.
+`source.merge` delegates validated source approval and, with `review.prepare`,
+uses the existing source merge command. It follows the saved publication policy;
+it does not enable publication or grant direct production writes. An accepted
+merge and verified production are separate results.
+
 After local validation succeeds, preview each changed application. For a portal-only change, run:
 
 ```sh

package/skill/tender-accounts/references/managed-source.md

@@ -2,6 +2,18 @@
 
 ## Request merge and deployment
 
+Persistent Cloud runs use explicitly granted `source.merge` on their assigned
+repository/branch. Include `review.prepare` to create the implicit exact review.
+After pushing and verifying the isolated preview, request merge with the same
+command below using `agent/<runId>` as the head. The capability delegates source
+approval without a per-change human receipt or legacy principal allowlist.
+Protected transport and successful exact preview/checks remain required.
+Inspect `capabilities`, `source status` and `source merge-policy show`;
+persistent actors cannot edit merge/publication policy to expand permission. Existing saved
+publication policy controls deployment after landing. Do not push main directly.
+An old run's source or preview cannot be transferred by changing local scope;
+a fresh task receives its own branch and bounded authority.
+
 On a managed repository, push the committed feature branch and verify its exact
 native preview, then request one hosted merge. Read `capabilities`,
 `source merge-policy show` and `source policy show` first. Exercise the changed
@@ -22,7 +34,7 @@ and review a new snapshot. The command does not integrate Git in the local check
 Use `--change scr_...` instead of `--head` and `--title` to attach to an existing
 review; `--expected-snapshot N` pins the inspected snapshot.
 
-Human review remains the default. A merchant administrator may explicitly grant
+For human-owned legacy credentials, human review remains the default. A merchant administrator may explicitly grant
 stable principal IDs with `source merge-policy set --mode agent --principals IDS
 --expected-revision N --idempotency-key KEY [--execution-seconds 300..86400]`.
 This native-preview grant works with source protection enabled or disabled;