@withandeo/cli 0.19.5 → 0.19.7

package/skill/tender-accounts/references/managed-source.md

@@ -15,6 +15,32 @@ exact `--cwd`. `source connect` derives the project working directory and build
 contract from Git plus `tender-accounts.json`; do not recreate that contract by
 hand in the admin. New connections default to preview-only. Both gateways and services support `--publication default-branch` when a merchant administrator explicitly enables automatic publication. For an existing connection use `source policy show`, then `source policy set --repository SRC_ID --publication default-branch --expected-revision N --idempotency-key KEY`. Saving the policy affects future source builds; it does not publish an existing build. Reconnecting never changes the policy.
 
+Select a local commit independently from the destination branch, including from a GitButler workspace:
+
+```sh
+andeo source push --source chore/andeo-agent-guidance --branch main --json
+```
+
+`--source` accepts a resolvable local branch, ref or commit SHA and defaults to `HEAD`.
+The CLI resolves it once to a full commit SHA; both the push and any reviewed
+bundle use that exact commit even if the local ref moves. `--branch` remains the
+remote destination and keeps its existing default (current checkout branch,
+or the repository default when detached); selecting `--source` does not change it.
+Always specify `--branch` from a GitButler workspace. Uncommitted, staged and
+untracked files are excluded. JSON reports `source`, `sourceRevision` and
+`sourceDiffersFromHead`; a different source uses that commit's tree and ancestry,
+not the current workspace. Invalid or non-commit sources fail before obtaining
+a repository credential.
+
+The example targeting `main` applies only to unprotected repositories. Reviewed
+repositories still require a non-default destination and administrator review;
+`--source` does not bypass protection or allow a force push. Explicit sources
+also work from detached HEAD; omitting `--source` preserves the existing reviewed
+detached-HEAD rejection. Legacy pushes retain normal non-fast-forward rejection
+and the existing guarded `--expected-current` rules. Reconnect seeding accepts
+`--source` with `--reconnection ID --branch NAME`, defaults to `HEAD`, and reports
+the resolved SHA for `source reconnect complete --expected-sha`.
+
 `source push` includes only the committed revision. On a reviewed repository it
 uploads a bounded Git bundle through Andeo; the trusted runner verifies the
 exact commit and may update only the named non-default branch. The developer
@@ -165,7 +191,7 @@ andeo source push --reconnection RECONNECT_ID --branch main --json
 andeo source reconnect complete --reconnection RECONNECT_ID --expected-sha EXACT_DEFAULT_BRANCH_SHA --json
 ```
 
-Use the actual default branch instead of `main`. The push sends local `HEAD` to the explicit destination branch, without force and without changing your managed remote. Push any other required branches from the corresponding commits before completion. The commands do not assume your checkout contains every remote branch or tag.
+Use the actual default branch instead of `main`. The push sends local `HEAD` by default, or the exact commit selected by `--source REF_OR_COMMIT`, to the explicit destination branch, without force and without changing your managed remote. Push any other required branches using their corresponding `--source` refs before completion. The commands do not assume your checkout contains every remote branch or tag.
 
 Preparation pauses the old connection and revokes its write credentials; deployed production continues serving. The destination is not a connected source while it is being seeded, so seed events do not build or publish. Reviewed repositories use this administrator-only seeding path too.
 

package/skill/tender-accounts/references/workflows.md

@@ -37,7 +37,22 @@ export class CustomerActivity extends WorkflowEntrypoint<{}, { runId: string }>
 // return Response.json({ runId: await run.id }, { status: 202 });
 ```
 
-The CLI packages code for Andeo's Dynamic Workflow hosts. Do not deploy a separate Cloudflare workflow. Global `fetch()` works inside durable steps; a service is not required merely for HTTP. Pin approved destinations, validate variable URLs, bound timeouts/redirects, and make external effects idempotent because steps retry. A callback that only knows a run ID is a demo receipt, not sender authentication; use secret-backed verification for trusted callbacks.
+The CLI packages code for Andeo's Dynamic Workflow hosts. Do not deploy a separate Cloudflare workflow. Public network is denied by default. To permit direct HTTPS, create `andeo.workflow-egress.json` beside the Wrangler configuration with schema `andeo.workflow-egress/v1` and one entry for every declared logical workflow:
+
+```json
+{
+  "schema": "andeo.workflow-egress/v1",
+  "workflows": {
+    "customer-activity": {
+      "https": [{ "hostname": "gateway.example.com", "port": 443 }]
+    }
+  }
+}
+```
+
+An omitted file gives every workflow an empty allowlist. When the file exists, every declared workflow name must be present; use `"https": []` for workflows with no direct public fetches. Destinations are exact HTTPS hostname/443 pairs—never wildcards, IP literals, internal names, credentials, or alternate ports. Redirected GET/HEAD requests are revalidated against the same policy; redirects for mutations are denied. Keep variable URLs constrained to the retained allowlist and bound timeouts and response sizes.
+
+The allowlist covers only direct global `fetch()` from workflow code. It does not list connected service bindings. Put secret-backed provider calls, provider SDKs, and operations needing credentials behind an approved service contract; do not add that provider's public hostname unless the workflow itself fetches it directly. Make external effects idempotent because durable steps retry. A callback that only knows a run ID is a demo receipt, not sender authentication; use secret-backed verification for trusted callbacks.
 
 ## Environment and services