@withandeo/cli 0.19.15 → 0.19.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withandeo/cli",
-  "version": "0.19.15",
+  "version": "0.19.17",
   "description": "Developer CLI for Andeo applications",
   "type": "module",
   "license": "UNLICENSED",
@@ -40,7 +40,7 @@
     "jsonc-parser": "3.3.1",
     "miniflare": "5.20260918.0-alpha",
     "semver": "^7.8.5",
-    "smol-toml": "1.8.0"
+    "smol-toml": "1.9.0"
   },
   "exports": {
     "./cli": "./dist/main.js",

package/skill/publication.json

@@ -1,3 +1,3 @@
 {
-  "minimumCliVersion": "0.19.15"
+  "minimumCliVersion": "0.19.17"
 }

package/skill/tender-accounts/SKILL.md

@@ -98,6 +98,17 @@ artifact or bypass the isolation gate. Reopen with the returned `sbl_` ID while
 the run and derived preview remain authorized. Expiry requires a fresh task and
 its own assigned branch/preview, not reuse of the old bearer.
 
+With explicitly enrolled `preview.share`, the same preview command automatically
+resolves the published gateway and returns a separately revocable handoff lasting
+up to seven days, capped by ancestor authority. It survives normal run completion
+and issuing-token expiry. The gateway uses normal customer authentication and
+production APIs; sharing does not log in a customer or authorize additional
+provider mutations. Inspect the returned entry, selection, exact source and
+expiry before handing it over. Use `preview entries` and optional `--through`
+only when entry selection is ambiguous. Existing grants do not gain sharing
+from a task scope override. The stateless preview Worker receives no provider
+credentials, customer cookies, resources or outbound network access.
+
 `source.merge` delegates approval for the run's validated source. Keep
 `review.prepare` when requesting an implicit source review through merge.
 Use the existing merge command for the assigned branch or exact permitted
@@ -108,6 +119,16 @@ separately. Existing grants must be explicitly replaced to add these capabilitie
 editing `ANDEO_AGENT_SCOPE` cannot expand a grant. Persistent preview logs remain
 unavailable.
 
+Cloud setup needs the `ANDEO_CLOUD_BOOTSTRAP` network secret, restricted to
+`agent-auth.withandeo.com`. Scope and installation identity default server-side
+from the grant; run duration defaults to 30 minutes capped by tenant policy and
+parent expiry. `ANDEO_AGENT_SCOPE`, `ANDEO_AGENT_RUN_SECONDS`,
+`ANDEO_AGENT_ENVIRONMENT_ID` and the standard URL settings are optional.
+Invalid explicit overrides fail rather than silently selecting defaults.
+Task startup still supplies a unique `ANDEO_AGENT_TASK_ID` and a private
+`ANDEO_AGENT_STATE_DIR` outside all checkouts, reused only within that task.
+Proxy routing, when required by the host, belongs in the setup script.
+
 Read the delivery reference for commands and recovery. Run app checks and artifact dry-run before delivery. Preserve exact source, digest, release, delivery and composition identities.
 
 Distinguish local check, retained upload, ready preview, administrator approval, production activation and live acceptance. None substitutes for the next. Prove the intended combined composition for connected changes, not two unrelated releases.

package/skill/tender-accounts/references/authentication.md

@@ -1,5 +1,7 @@
 # Authentication and project scope
 
+For Cloud installations using CLI 0.19.16 or newer, configure the secret `ANDEO_CLOUD_BOOTSTRAP`. Standard Andeo origins, the installation identity, and the effective grant scope are resolved automatically. `ANDEO_AGENT_SCOPE` optionally narrows that scope; `ANDEO_AGENT_RUN_SECONDS` optionally requests a different bounded lifetime. Omitted lifetime defaults to 30 minutes, capped by tenant policy and credential expiry. At task startup set a unique `ANDEO_AGENT_TASK_ID` and private `ANDEO_AGENT_STATE_DIR` outside the checkout. Set `NODE_USE_ENV_PROXY=1` only when the runtime requires its network proxy. Explicit invalid overrides fail rather than falling back to defaults.
+
 If authentication is missing, start the agent-safe device flow:
 
 ```sh

package/skill/tender-accounts/references/delivery.md

@@ -133,6 +133,13 @@ npx @withandeo/cli preview open --from sbl_EXAMPLE --return-path /account --json
 
 Preview entry selection follows published app connections automatically. When the response requires a choice, select an eligible app using `--through prj_ENTRY`. Only the previewed app's developer grant is needed. Private apps cannot open directly; a connection administrator must enable an eligible entry. Preserve the exact `from` ID when recovering from a session error and use `preview open` instead of rebuilding. Opening replaces the browser's previous preview selection and preserves sign-in.
 
+Persistent Cloud agents need separately consented `preview.share` for this gateway
+handoff. With it, the same `preview` and `preview open` commands resolve the entry
+server-side and return a link lasting at most seven days independently of normal
+run completion/token expiry. Parent deadlines, revocation, cancellation, current
+connection policy and exact preview retirement remain enforced on public and
+bound requests. Without it, the direct stateless preview remains run-bound.
+
 `<delivery-id>` is the `dly_` value returned by `preview`. A `dwf_` value is a production workflow ID and must not be passed to developer-delivery commands. If a merchant administrator sees a `dwf_` publish waiting with zero attempts, the supported recovery is **Activity → Resume exact publish**; it resumes the stored exact composition without rebuilding. Use the error code, request ID, and suggested command from the CLI. Do not retry with altered IDs, another project, or raw HTTP requests.
 
 When runtime evidence is needed, stream only the linked project and exact target: