@workser/cli 0.6.0 → 0.6.1

package/dist/index.js

@@ -4685,28 +4685,27 @@ real scope, not just a repeat of the task.
   },
   {
     topic: "sdlc-entities",
-    title: "Board cards, decisions and requirements",
-    summary: "Read what this project already tracks and decided, keep the Board honest as you work, and record what a future maintainer will need.",
+    title: "Decisions and requirements",
+    summary: "Read what this project already decided, and record what a future maintainer will need. Phased work itself is subtasks, not board cards \u2014 see `workser help tasks`.",
     commands: ["board", "decision", "requirement"],
     source: "skills/workser/reference/sdlc-entities.md",
-    body: `# Board cards, decisions and requirements
+    body: `# Decisions and requirements
 
 These are the project's memory across sessions. They write to the **same tables**
-the Orbit desktop's Board and Project Memory panels use, so anything here appears
-there too \u2014 and, inside an Orbit-spawned run, as an inline card in the
-conversation. Documents have their own guide: \`workser help docs\`.
+the Orbit desktop's Project Memory panel uses, so anything here appears there too
+\u2014 and, inside an Orbit-spawned run, as an inline card in the conversation.
+Documents have their own guide: \`workser help docs\`. Phased work is tracked as
+subtasks, not here \u2014 see \`workser help tasks\`.
+
+> **The Board (\`workser board ...\`) is deprecated for agent use.** It used to be
+> where a multi-phase plan went, one card per phase \u2014 and the phase was ALSO a
+> subtask the planning turn had just filed for the same piece of work. That gave
+> a task two competing plans, one of which this task's own page never reads and
+> nothing kept in sync with the other. Phases are \`project_tasks\` subtasks now,
+> full stop: \`workser task subtask add\`. Do not run \`workser board create\` for
+> planned work \u2014 see \`workser help tasks\`.
 
 \`\`\`
-workser board list [--status <value>] [--label <value>] [--limit <n>]
-workser board show <id>
-workser board create <title> [--description <text>] [--status <value>]
-                              [--priority <value>] [--label <value>]
-                              [--owner <name>] [--milestone <id>]
-workser board update <id> [--title|--description|--status|--priority
-                           |--label|--owner|--milestone ...]
-workser board move <id> <backlog|in-progress|in-review|done>
-workser board close <id>
-
 workser decision list [--limit <n>]
 workser decision show <id>
 workser decision create <title> --context <text> --decision <text>
@@ -4724,7 +4723,6 @@ workser requirement update <id> [--title <text>] [--body <text>] [--status <text
 Before starting anything beyond a trivial edit:
 
 \`\`\`
-workser board list --json          # what's already tracked (don't re-file it)
 workser decision list --json       # what was already decided (don't reverse it)
 \`\`\`
 
@@ -4734,19 +4732,18 @@ purpose \u2014 \`workser decision show <id>\` gives you the context and conseque
 not just the title. Reach for \`workser doc list\` / \`workser requirement list\`
 the same way when the task touches documented behaviour.
 
-## Work with phases \u2192 cards + a plan doc, before you build
+## Work with phases \u2192 subtasks + a plan doc, before you build
 
 The moment you split a task into more than one phase, file it \u2014 not afterwards,
 and not only in your reply, which is gone once the conversation scrolls.
 
 \`\`\`bash
-# one card per phase; only the one you're doing goes to in-progress
-workser board create "Phase 1 \u2014 schema + migration" \\
-  --description "Add orders/line_items tables and the migration." \\
-  --status in-progress --json
-workser board create "Phase 2 \u2014 checkout API" --description "\u2026" --json
+# the phases themselves \u2014 this task's own subtask list, not the Board
+workser task subtask add "Phase 1 \u2014 schema + migration" --role api \\
+  --note "Add orders/line_items tables and the migration."
+workser task subtask add "Phase 2 \u2014 checkout API" --role api --note "\u2026"
 
-# the plan itself, ONE doc, deliberately NOT linked to a card
+# the plan's narrative, ONE doc, deliberately NOT linked to a subtask
 workser doc create "Checkout \u2014 implementation plan" --markdown "$(cat plan.md)" --json
 
 # the approach, if the plan settled something with real alternatives
@@ -4757,32 +4754,9 @@ workser decision create "Carts live server-side" --context "\u2026" --decision "
 its card and is *hidden* from the Docs panel; a plan spanning three phases
 belongs to the project, not to phase 1.
 
-The bar: if the user closed this conversation now, the Board should still show
-what's left and the doc should still explain the plan to whoever continues it.
-
-## Keep the Board honest while you work
-
-A Board still reading \`backlog\` after the feature shipped tells the user the
-opposite of the truth. Moving the card is part of finishing the work:
-
-\`\`\`
-workser board move <id> in-progress   # you picked it up
-workser board move <id> in-review     # ready for the user to look at
-workser board close <id>              # done and verified
-\`\`\`
-
-\`--status\` is one of \`backlog | in-progress | in-review | done\` (default
-\`backlog\`). \`--priority\` is one of \`low | normal | high | urgent\` (default
-\`normal\`). \`--label\` repeats for more than one label:
-
-\`\`\`
-workser board create "Fix the login bug" --status in-progress --priority high \\
-  --label bug --label auth
-\`\`\`
-
-\`board update\` replaces the labels you pass rather than merging them, and
-touches only the fields you name. There is no \`board delete\`: \`done\` is the
-terminal state, and removing a card the user filed is theirs to do in Orbit.
+The bar: if the user closed this conversation now, the subtask list should still
+show what's left and the doc should still explain the plan to whoever continues
+it.
 
 ## Decisions are append-only
 
@@ -4894,6 +4868,9 @@ below defaults to it and you rarely pass an id at all.
 \`\`\`
 workser task list [--status <value>] [--label <value>] [--limit <n>]
 workser task show [id]                  # the task you are in, with its steps
+workser task create <title> [--note <text>] [--kind <value>]
+                           [--label <value...>] [--app <id...>]
+                           [--infra <ref...>]
 
 workser task subtask add <title> [--role <value>] [--kind <value>]
                                  [--note <text>] [--app <id...>]
@@ -4917,6 +4894,16 @@ Team's own table. Filing your plan on the Board puts it somewhere the owner's
 task page never reads: they see "created work item" and an empty plan. Use
 \`task subtask add\`.
 
+## Opening work from a project channel
+
+When a project-channel conversation produces actionable work, the PM may record
+it with \`workser task create\`. Orbit supplies the channel and source-message IDs;
+the command records them and posts the new task card as a Project Manager message
+automatically. Do not invent or ask for those IDs.
+
+Opening a task does **not** approve it or start implementation. The task remains
+awaiting the owner. Never approve or dispatch a task you opened yourself.
+
 ## Planning a task
 
 Read the project first, then propose. One \`subtask add\` per step:
@@ -5161,11 +5148,11 @@ function registerHelp(program3) {
 var import_picocolors3 = __toESM(require_picocolors(), 1);
 
 // src/context.ts
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 
 // src/config.ts
 import { homedir } from "os";
-import { join } from "path";
+import { dirname, join, resolve } from "path";
 import {
   chmodSync,
   existsSync,
@@ -5173,6 +5160,8 @@ import {
   readFileSync,
   writeFileSync
 } from "fs";
+var PROJECT_MARKER = ".workser-project";
+var APP_MARKER = ".workser-app";
 var GLOBAL_DIR = join(homedir(), ".workser");
 var SESSION_FILE = join(GLOBAL_DIR, "session.json");
 function readSession() {
@@ -5203,10 +5192,82 @@ function projectLinkPath(cwd) {
   return join(cwd, ".workser", "project.json");
 }
 function readProjectLink(cwd) {
+  const found = readFolderIdentity(cwd);
+  if (!found) return null;
+  return {
+    projectId: found.projectId,
+    name: found.projectName,
+    orgId: found.orgId,
+    root: found.projectRoot
+  };
+}
+function readFolderIdentity(cwd) {
+  let app = null;
+  for (const dir of ancestors(cwd)) {
+    if (!app) {
+      const marker2 = readJson(join(dir, APP_MARKER));
+      if (marker2 && typeof marker2.appId === "string") {
+        app = { marker: marker2, root: dir };
+      }
+    }
+    const link = readJson(projectLinkPath(dir));
+    if (link && typeof link.projectId === "string") {
+      return {
+        projectRoot: dir,
+        projectId: link.projectId,
+        projectName: link.name,
+        orgId: link.orgId,
+        ...appFields(app)
+      };
+    }
+    const marker = readJson(join(dir, PROJECT_MARKER));
+    if (marker && typeof marker.projectId === "string") {
+      return {
+        projectRoot: dir,
+        projectId: marker.projectId,
+        projectName: marker.projectName ?? void 0,
+        orgId: marker.orgId ?? void 0,
+        ...appFields(app)
+      };
+    }
+  }
+  if (app && typeof app.marker.projectId === "string") {
+    return {
+      projectRoot: app.root,
+      projectId: app.marker.projectId,
+      projectName: app.marker.projectName ?? void 0,
+      orgId: app.marker.orgId ?? void 0,
+      ...appFields(app)
+    };
+  }
+  return null;
+}
+function appFields(app) {
+  if (!app) return {};
+  return {
+    appId: app.marker.appId,
+    appName: app.marker.appName ?? void 0,
+    appRoot: app.root
+  };
+}
+function ancestors(cwd) {
+  const out = [];
+  const home = homedir();
+  let dir = resolve(cwd);
+  for (let i = 0; i < 64; i++) {
+    out.push(dir);
+    if (dir === home) break;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return out;
+}
+function readJson(file) {
   try {
-    const p = projectLinkPath(cwd);
-    if (!existsSync(p)) return null;
-    return JSON.parse(readFileSync(p, "utf8"));
+    if (!existsSync(file)) return null;
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
   }
@@ -5245,7 +5306,7 @@ function cloudBaseUrl() {
 // src/context.ts
 function buildContext(opts) {
   const session = readSession();
-  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
+  const cwd = opts.cwd ? resolve2(opts.cwd) : process.cwd();
   const token = opts.token || process.env.WORKSER_TOKEN || session.token;
   const overridden = Boolean(
     opts.endpoint || opts.token || process.env.WORKSER_DAEMON_URL || process.env.WORKSER_TOKEN
@@ -5254,11 +5315,18 @@ function buildContext(opts) {
   const endpointRaw = socketPath ? "http://localhost" : opts.endpoint || process.env.WORKSER_DAEMON_URL || session.endpoint || cloudBaseUrl();
   const endpoint = endpointRaw.replace(/\/+$/, "");
   const mode2 = socketPath ? "daemon" : /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:|\/|$)/i.test(endpoint) ? "daemon" : "cloud";
-  const link = readProjectLink(cwd);
-  const projectId = opts.project || process.env.WORKSER_PROJECT_ID || link?.projectId || session.defaultProjectId;
+  const folder = readFolderIdentity(cwd);
+  const projectId = opts.project || process.env.WORKSER_PROJECT_ID || folder?.projectId || session.defaultProjectId;
+  const inThisProject = folder?.projectId === projectId;
   const runId = process.env.WORKSER_RUN_ID || void 0;
   const conversationId = process.env.WORKSER_CONVERSATION_ID || void 0;
   const projectTaskId = process.env.WORKSER_PROJECT_TASK_ID || void 0;
+  const parentTaskId = process.env.WORKSER_PARENT_TASK_ID || void 0;
+  const projectChannelId = process.env.WORKSER_PROJECT_CHANNEL_ID || void 0;
+  const projectChannelMessageId = process.env.WORKSER_PROJECT_CHANNEL_MESSAGE_ID || void 0;
+  const agentRole = process.env.WORKSER_AGENT_ROLE || void 0;
+  const agentType = process.env.WORKSER_AGENT_TYPE || void 0;
+  const agentModel = process.env.WORKSER_AGENT_MODEL || void 0;
   return {
     endpoint,
     socketPath,
@@ -5266,9 +5334,18 @@ function buildContext(opts) {
     mode: mode2,
     cwd,
     projectId,
+    projectRoot: inThisProject ? folder?.projectRoot : void 0,
+    appId: inThisProject ? folder?.appId : void 0,
+    appName: inThisProject ? folder?.appName : void 0,
     runId,
     conversationId,
-    projectTaskId
+    projectTaskId,
+    parentTaskId,
+    projectChannelId,
+    projectChannelMessageId,
+    agentRole,
+    agentType,
+    agentModel
   };
 }
 function runTarget(ctx) {
@@ -5304,7 +5381,7 @@ This shell is talking to ${ctx.endpoint} instead of a local app.
 function requireProject(ctx) {
   if (!ctx.projectId) {
     throw new WorkserError(
-      "No project selected. Run `workser project use <id>` or pass --project <id>.",
+      "No project selected.\n\nWorkser keeps each project in its own folder \u2014 `~/workser/<org>/<project>/`,\nwith that project's apps inside it. Running from anywhere in that tree is\nenough; this shell is not in one.\n\n  \u2022 cd into the project's folder (Workser Orbit's Files tab shows where it is), or\n  \u2022 pass --project <id> for a one-off.",
       { code: "no_project" }
     );
   }
@@ -5329,7 +5406,7 @@ function action(fn) {
 // src/client.ts
 import * as http from "http";
 function requestOverSocket(socketPath, pathWithQuery, init) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const req = http.request(
       { socketPath, path: pathWithQuery, method: init.method, headers: init.headers },
       (res) => {
@@ -5338,7 +5415,7 @@ function requestOverSocket(socketPath, pathWithQuery, init) {
         res.on("data", (c) => text += c);
         res.on(
           "end",
-          () => resolve4({
+          () => resolve5({
             ok: (res.statusCode ?? 0) >= 200 && (res.statusCode ?? 0) < 300,
             status: res.statusCode ?? 0,
             statusText: res.statusMessage ?? "",
@@ -5435,13 +5512,28 @@ function registerStatus(program3) {
   program3.command("status").description("Show connection, current workspace/project, and latest deploy").action(
     action(async ({ ctx }) => {
       const data = await api(ctx, "/v1/status", { query: { project: ctx.projectId } });
-      ok(data, () => {
+      const merged = {
+        ...data,
+        folder: {
+          cwd: ctx.cwd,
+          projectRoot: ctx.projectRoot ?? null,
+          appId: ctx.appId ?? null,
+          appName: ctx.appName ?? null
+        }
+      };
+      ok(merged, () => {
         line(import_picocolors3.default.bold("Workser") + import_picocolors3.default.dim(`  (${ctx.mode} \xB7 ${ctx.endpoint})`));
         line(`  user:      ${data.user?.email ?? "\u2014"}`);
         line(`  workspace: ${data.workspace?.name ?? "\u2014"}`);
         line(
           `  project:   ${data.project?.name ?? "\u2014"}` + (data.project?.id ? import_picocolors3.default.dim(`  (${data.project.id})`) : "")
         );
+        if (ctx.projectRoot) line(`  folder:    ${import_picocolors3.default.dim(ctx.projectRoot)}`);
+        if (ctx.appId) {
+          line(
+            `  app:       ${ctx.appName ?? "\u2014"}` + import_picocolors3.default.dim(`  (${ctx.appId})`)
+          );
+        }
         if (data.latestDeploy) {
           line(
             `  deploy:    ${colorStatus(data.latestDeploy.status)}` + (data.latestDeploy.url ? `  ${import_picocolors3.default.cyan(data.latestDeploy.url)}` : "")
@@ -5778,7 +5870,7 @@ function registerAuth(program3) {
 // src/commands/storage.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
 import { readFile, writeFile } from "fs/promises";
-import { basename, dirname } from "path";
+import { basename, dirname as dirname2 } from "path";
 function registerStorage(program3) {
   const storage = program3.command("storage").description("Provision and work with the project's object storage (Cloudflare R2)");
   storage.command("create [name]").description("Provision a storage bucket for the project (idempotent)").action(
@@ -5824,7 +5916,7 @@ function registerStorage(program3) {
       const bytes = await readFile(localPath).catch(() => {
         throw new WorkserError(`Can't read local file: ${localPath}`, { code: "bad_input" });
       });
-      const dir = dirname(key);
+      const dir = dirname2(key);
       const res = await api(ctx, `/v1/projects/${projectId}/storage/upload-base64`, {
         body: {
           filename: basename(key),
@@ -6980,7 +7072,10 @@ function registerAgent(program3) {
   ).option("--role <label>", "display label for this run (default: <agent>)").option(
     "--instructions <text>",
     "system prompt for this one run \u2014 this teammate's expertise/scope"
-  ).option("--model <model>", "model override for the backing CLI").option("--effort <level>", "reasoning effort, where the backing CLI supports it").action(
+  ).option("--model <model>", "model override for the backing CLI").option("--effort <level>", "reasoning effort, where the backing CLI supports it").option(
+    "--read-only",
+    "inspection only \u2014 the teammate runs in the CLI's read-only sandbox and cannot change anything"
+  ).action(
     action(async ({ ctx, args, opts }) => {
       const spawnAgent = args[0];
       const task = args[1].join(" ");
@@ -6991,7 +7086,10 @@ function registerAgent(program3) {
           role: opts.role,
           instructions: opts.instructions,
           model: opts.model,
-          effort: opts.effort
+          effort: opts.effort,
+          // Enforced by the backing CLI's own sandbox, not by asking the
+          // spawned agent to behave — see the daemon's `/agents/run`.
+          readOnly: opts.readOnly === true
         }
       });
       const exitCode = res?.exitCode ?? 0;
@@ -7517,7 +7615,7 @@ function businessPath(projectId, resource, subpath) {
 // src/commands/artifact.ts
 var import_picocolors24 = __toESM(require_picocolors(), 1);
 import { existsSync as existsSync2, statSync } from "fs";
-import { resolve as resolve2, basename as basename3 } from "path";
+import { resolve as resolve3, basename as basename3 } from "path";
 var KINDS = [
   "file",
   "folder",
@@ -7566,7 +7664,7 @@ function registerArtifact(program3) {
       let absPath;
       let kind = opts.kind;
       if (rawPath) {
-        absPath = resolve2(ctx.cwd, rawPath);
+        absPath = resolve3(ctx.cwd, rawPath);
         if (!existsSync2(absPath)) {
           throw new WorkserError(
             `Nothing at ${absPath}. Register the file after you've written it.`,
@@ -7617,6 +7715,30 @@ function registerArtifact(program3) {
       );
     })
   );
+  artifact.command("list").description("What this task's steps have produced so far").option("--task <id>", "a specific task (default: the plan this run is in)").option("--step <id>", "one step's output alone, across every attempt").option("--mine", "only what THIS step has produced").action(
+    action(async ({ ctx, opts }) => {
+      const stepId = opts.step || (opts.mine ? ctx.projectTaskId : void 0);
+      if (opts.mine && !stepId) {
+        throw new WorkserError(
+          "--mine needs a step: this run isn't inside one (WORKSER_PROJECT_TASK_ID is unset)."
+        );
+      }
+      let path;
+      if (stepId) {
+        path = `/v1/project-subtasks/${encodeURIComponent(stepId)}/artifacts`;
+      } else {
+        const taskId = opts.task || ctx.parentTaskId || ctx.projectTaskId;
+        if (!taskId) {
+          throw new WorkserError(
+            "No task. This run isn't inside one, so pass --task <id> or --step <id>."
+          );
+        }
+        path = `/v1/project-tasks/${encodeURIComponent(taskId)}/artifacts?scope=all`;
+      }
+      const rows = await api(ctx, path) ?? [];
+      ok(rows, () => printArtifacts(rows));
+    })
+  );
   artifact.command("run").description("Show the task/conversation this agent run is attached to").action(
     action(async ({ ctx }) => {
       const res = await api(ctx, `/v1/runs/${runTarget(ctx)}`);
@@ -7624,6 +7746,31 @@ function registerArtifact(program3) {
     })
   );
 }
+function printArtifacts(rows) {
+  if (!rows.length) {
+    line(import_picocolors24.default.dim("Nothing produced yet."));
+    return;
+  }
+  const byStep = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const list = byStep.get(r.subtask_id) ?? [];
+    list.push(r);
+    byStep.set(r.subtask_id, list);
+  }
+  for (const [stepId, items] of byStep) {
+    line(import_picocolors24.default.bold(`step ${stepId}`));
+    for (const a of items) {
+      const flag = a.promoted_at ? import_picocolors24.default.green(" *") : "  ";
+      const where = a.local_path || a.cloud_url || "";
+      line(
+        `${flag} ${import_picocolors24.default.dim(`[${a.kind}]`)} ${a.title ?? "(untitled)"}` + (where ? import_picocolors24.default.dim(`  ${where}`) : "")
+      );
+      if (a.description) line(import_picocolors24.default.dim(`     ${a.description}`));
+    }
+    line("");
+  }
+  line(import_picocolors24.default.dim("* = handed over as a deliverable; the rest is working material."));
+}
 function printRun(run) {
   if (!run) return;
   line(`  run      ${import_picocolors24.default.bold(run.runId)}`);
@@ -7635,7 +7782,7 @@ function printRun(run) {
 
 // src/commands/image.ts
 import { writeFile as writeFile4, mkdir } from "fs/promises";
-import { dirname as dirname2, resolve as resolve3 } from "path";
+import { dirname as dirname3, resolve as resolve4 } from "path";
 function registerImage(program3) {
   const image = program3.command("image").description("Generate images from a text prompt");
   image.command("generate <prompt>").alias("gen").description("Generate an image and return its public URL").option(
@@ -7690,7 +7837,7 @@ function registerImage(program3) {
   );
 }
 async function download(url, output) {
-  const target = resolve3(output);
+  const target = resolve4(output);
   const res = await fetch(url);
   if (!res.ok) {
     throw new WorkserError(
@@ -7698,7 +7845,7 @@ async function download(url, output) {
       { code: "download_failed" }
     );
   }
-  await mkdir(dirname2(target), { recursive: true });
+  await mkdir(dirname3(target), { recursive: true });
   await writeFile4(target, Buffer.from(await res.arrayBuffer()));
   return target;
 }
@@ -8051,18 +8198,86 @@ function registerTask(program3) {
     })
   );
   task.command("show [id]").description(
-    "Show one task with its subtasks. Defaults to the task this run is inside."
+    "Show a task with its subtasks, what each one did, and what they produced. Defaults to the plan this run is part of."
   ).action(
     action(async ({ ctx, args }) => {
-      const id = resolveTaskId(ctx, args[0]);
+      const id = args[0] || ctx.parentTaskId || resolveTaskId(ctx);
       const row = await api(ctx, `/v1/project-tasks/${encodeURIComponent(id)}`);
       ok(row, () => printTask(row));
     })
   );
+  task.command("create <title>").description("Open a new root task for the project team").option("--note <text>", "context, constraints and expected outcome").option("--kind <value>", `what it produces (${KINDS2.join(" | ")})`).option("--label <value...>", "labels to put on the task").option("--app <id...>", "apps the task touches").option("--infra <ref...>", "shared setup it touches").action(
+    action(async ({ ctx, args, opts }) => {
+      requireProject(ctx);
+      if (opts.kind !== void 0) assertOneOf("--kind", opts.kind, KINDS2);
+      const hasChannelOrigin = Boolean(
+        ctx.projectChannelId && ctx.projectChannelMessageId
+      );
+      const row = await api(ctx, "/v1/project-tasks", {
+        body: {
+          title: args[0],
+          summary: opts.note,
+          category: opts.kind,
+          labels: opts.label,
+          targets: [
+            ...(opts.app ?? []).map((appId) => ({ kind: "app", appId })),
+            ...(opts.infra ?? []).map((ref) => ({ kind: "infra", ref }))
+          ],
+          ...hasChannelOrigin ? {
+            channelId: ctx.projectChannelId,
+            createdFromMessageId: ctx.projectChannelMessageId,
+            createdByKind: "agent"
+          } : {}
+        }
+      });
+      let channelMessage;
+      let channelMessageError;
+      if (hasChannelOrigin && ctx.projectChannelId && ctx.projectChannelMessageId) {
+        try {
+          channelMessage = await api(
+            ctx,
+            `/v1/project-channels/${encodeURIComponent(ctx.projectChannelId)}/messages`,
+            {
+              body: {
+                content: "",
+                agentRole: ctx.agentRole ?? "pm",
+                agentType: ctx.agentType ?? "workser",
+                agentModel: ctx.agentModel ?? "Agent default",
+                attachments: [{ resourceType: "task", resourceId: row.id }]
+              }
+            }
+          );
+        } catch (error) {
+          const failure = error instanceof WorkserError ? error : new WorkserError(String(error));
+          channelMessageError = {
+            code: failure.code,
+            message: failure.message
+          };
+        }
+      }
+      const result = {
+        ...row,
+        ...channelMessage ? { channelMessage } : {},
+        ...channelMessageError ? { channelMessageError } : {}
+      };
+      ok(result, () => {
+        line(`${import_picocolors28.default.green("opened")} ${import_picocolors28.default.bold(row.title)}  ${import_picocolors28.default.dim(row.key ?? row.id)}`);
+        if (channelMessage) line(import_picocolors28.default.dim("posted to the channel as Project Manager"));
+        if (channelMessageError) {
+          warn(
+            `Task opened, but its Project Manager card could not be posted: ${channelMessageError.message}`
+          );
+        }
+      });
+    })
+  );
   const subtask = task.command("subtask").description("The steps a task is broken into");
   subtask.command("add <title>").description(
     'Add one step, e.g. `workser task subtask add "Build the upload screen" --role web`'
-  ).option("--task <id>", "the parent task (defaults to the task this run is inside)").option("--role <value>", `who does it (${ROLES.join(" | ")})`).option("--kind <value>", `what it produces (${KINDS2.join(" | ")})`).option("--note <text>", "one sentence on what this step does").option("--app <id...>", "app ids this step touches").option("--infra <ref...>", "shared setup it touches (database | storage | auth | hosting | jobs)").option("--scope <path...>", "files or folders THIS step owns").option("--depends-on <id...>", "steps that must finish first (key or id)").action(
+  ).option("--task <id>", "the parent task (defaults to the task this run is inside)").option("--role <value>", `who does it (${ROLES.join(" | ")})`).option("--kind <value>", `what it produces (${KINDS2.join(" | ")})`).option("--note <text>", "one sentence on what this step does").option(
+    "--app <id...>",
+    "the app this step is for \u2014 one id runs the step inside that app's folder; leave it off and the step runs at the project, seeing every app"
+  ).option("--infra <ref...>", "shared setup it touches (database | storage | auth | hosting | jobs)").option("--scope <path...>", "files or folders THIS step owns").option("--depends-on <id...>", "steps that must finish first (key or id)").action(
     action(async ({ ctx, args, opts }) => {
       const parent = resolveTaskId(ctx, opts.task);
       if (opts.role !== void 0) assertOneOf("--role", opts.role, ROLES);
@@ -8143,6 +8358,24 @@ function registerTask(program3) {
       ok(row, () => line(`${import_picocolors28.default.green("moved")} ${import_picocolors28.default.bold(row.title)} \u2192 ${args[1]}`));
     })
   );
+  task.command("resume [id]").description(
+    "Put a step the owner stopped back in the queue \u2014 only when they ask you to carry on"
+  ).action(
+    action(async ({ ctx, args }) => {
+      const id = resolveTaskId(ctx, args[0]);
+      const row = await api(
+        ctx,
+        `/v1/project-tasks/${encodeURIComponent(id)}/retry`,
+        { method: "POST" }
+      );
+      ok(
+        row,
+        () => line(
+          row?.queued ? `${import_picocolors28.default.green("resumed")} \u2014 it is back in the queue and will start on the next dispatch` : import_picocolors28.default.yellow("could not resume it \u2014 check the step id")
+        )
+      );
+    })
+  );
   subtask.command("send-back <id>").description("Send a finished step back to be done again, with the reason").requiredOption("--note <text>", "what was wrong with it").action(
     action(async ({ ctx, args, opts }) => {
       const row = await api(
@@ -8275,7 +8508,12 @@ function formatSubtask(r, index) {
   const n = import_picocolors28.default.dim(String(index).padStart(2, "0"));
   const role = r.role ? import_picocolors28.default.dim(` [${r.role}]`) : "";
   const scope = r.scope_paths?.length ? import_picocolors28.default.dim(`  owns: ${r.scope_paths.join(", ")}`) : "";
-  return `${n} ${statusTag2(r.status)} ${r.title}${role}${scope}`;
+  const head = `${n} ${statusTag2(r.status)} ${r.title}${role}${scope}`;
+  const summary = (r.result_summary ?? "").trim();
+  if (!summary) return head;
+  const wrapped = summary.split("\n").map((l) => `      ${l}`).join("\n");
+  return `${head}
+${import_picocolors28.default.dim(wrapped)}`;
 }
 function printTask(row) {
   line(`${import_picocolors28.default.bold(row.title)}  ${import_picocolors28.default.dim(row.key ?? row.id)}`);
@@ -8292,6 +8530,17 @@ touches: ${row.targets.map((t) => t.appName ?? t.ref ?? t.kind).join(", ")}`
     line(`
 ${import_picocolors28.default.bold("steps")}`);
     row.subtasks.forEach((s, i) => line(formatSubtask(s, i + 1)));
+    line(
+      import_picocolors28.default.dim(
+        `
+Run \`workser artifact list\` to see what these steps produced,`
+      )
+    );
+    line(
+      import_picocolors28.default.dim(
+        `or \`workser artifact list --step <id>\` for one step's output alone.`
+      )
+    );
   } else {
     line(import_picocolors28.default.dim("\nNo steps yet."));
   }
@@ -8315,10 +8564,15 @@ function statusTag2(status) {
 
 // src/role-guard.ts
 var READS = [
+  // `requirement` sits beside `doc` and `decision` because it is the same kind
+  // of thing and was simply forgotten: the verb shipped, no role could run it,
+  // and on 2026-08-23 a channel PM reported to the owner that "requirements are
+  // not readable by this PM role" — which was exactly true, for every role.
   "task",
   "board",
   "doc",
   "decision",
+  "requirement",
   "memory",
   "search",
   "verify",
@@ -8393,10 +8647,11 @@ var NEVER = {
 function assertRoleMayRun(argv) {
   const role = (process.env.WORKSER_ROLE ?? "").trim();
   if (!role) return;
-  const verb = argv[0];
+  const commandArgv = stripLeadingGlobalOptions(argv);
+  const verb = commandArgv[0];
   if (!verb) return;
-  const pair = `${argv[0]} ${argv[1] ?? ""}`.trim();
-  if (NEVER[pair] && !(pair === "task approval" && (argv[2] === "request" || !argv[2]))) {
+  const pair = `${commandArgv[0]} ${commandArgv[1] ?? ""}`.trim();
+  if (NEVER[pair] && !(pair === "task approval" && (commandArgv[2] === "request" || !commandArgv[2]))) {
     throw new WorkserError(NEVER[pair], { code: "role_forbidden" });
   }
   const allowed = ROLE_VERBS[role];
@@ -8408,6 +8663,35 @@ function assertRoleMayRun(argv) {
     );
   }
 }
+function stripLeadingGlobalOptions(argv) {
+  const takesValue = /* @__PURE__ */ new Set([
+    "-p",
+    "--project",
+    "-C",
+    "--cwd",
+    "--endpoint",
+    "--token"
+  ]);
+  const flags = /* @__PURE__ */ new Set(["--json", "-q", "--quiet", "-v", "--version"]);
+  let index = 0;
+  while (index < argv.length) {
+    const token = argv[index];
+    if (flags.has(token)) {
+      index += 1;
+      continue;
+    }
+    if (takesValue.has(token)) {
+      index += 2;
+      continue;
+    }
+    if (token.startsWith("--project=") || token.startsWith("--cwd=") || token.startsWith("--endpoint=") || token.startsWith("--token=")) {
+      index += 1;
+      continue;
+    }
+    break;
+  }
+  return argv.slice(index);
+}
 
 // src/commands/decision.ts
 var import_picocolors29 = __toESM(require_picocolors(), 1);
@@ -9856,7 +10140,7 @@ function colour(d) {
 
 // src/index.ts
 var pkg = {
-  version: true ? "0.6.0" : "0.0.0-dev"
+  version: true ? "0.6.1" : "0.0.0-dev"
 };
 var program2 = new Command();
 program2.name("workser").description(
@@ -9912,6 +10196,10 @@ registerTask(program2);
 registerDecision(program2);
 registerDoc(program2);
 registerDesign(program2);
+configureOutput({
+  json: process.argv.includes("--json"),
+  quiet: process.argv.includes("--quiet") || process.argv.includes("-q")
+});
 try {
   assertRoleMayRun(process.argv.slice(2));
 } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workser/cli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Workser CLI — give your local AI agent native DevOps & infrastructure on Workser. The agent runs `workser …` to provision, deploy, and manage real apps.",
   "license": "MIT",
   "type": "module",

package/skills/workser/SKILL.md

@@ -18,7 +18,7 @@ load.
 
 | You need to… | Commands | Run |
 | --- | --- | --- |
-| See what's tracked, decided, or written down for this project | `board …`, `decision …`, `requirement …`, `doc …` | `workser help sdlc-entities` |
+| See what was decided or written down for this project | `decision …`, `requirement …`, `doc …` | `workser help sdlc-entities` |
 | Follow the project's brand — colours, fonts, logo | `design …` | `workser help brand` |
 | Provision or query Postgres; list end users | `db …`, `auth …` | `workser help database` |
 | Deploy, set env vars, read logs, check a domain | `deploy`, `env …`, `logs`, `versions`, `domain`, `open` | `workser help deploy` |
@@ -70,15 +70,16 @@ pick or switch it.
 2. **Orient first.** Run `workser status --json` to see the connection, the pinned
    project, and the latest deploy before acting. You don't pick or switch projects.
    For anything beyond a trivial edit, also read what the project already knows:
-   `workser board list --json` (what's tracked), `workser decision list --json`
-   (what was already decided, so you don't quietly reverse it), and
-   `workser design show --json` before writing UI. This project outlives your
-   session; that context is how you don't start from zero.
-3. **A phased plan goes on the Board before you build it.** One `board create`
-   card per phase, the plan itself as one `doc create` (no `--work-item`, or it's
-   hidden from the Docs panel), and a `decision create` if it settled a real
-   tradeoff. A plan that lives only in your reply is gone when the conversation
-   scrolls. Details: `workser help sdlc-entities`.
+   `workser decision list --json` (what was already decided, so you don't quietly
+   reverse it), and `workser design show --json` before writing UI. This project
+   outlives your session; that context is how you don't start from zero.
+3. **A phased plan goes on the subtask list, never the Board.** Phases are
+   `workser task subtask add` (`workser help tasks`) — not `board create`,
+   which makes a second, driftable "the plan" the task page never reads.
+   Write the narrative once as `doc create` (no `--work-item`, or it's hidden
+   from the Docs panel), plus `decision create` for a real tradeoff. A plan
+   in your reply alone is gone when the conversation scrolls. Details:
+   `workser help sdlc-entities`.
 4. **Stay in your lane.** `error.code = "owner_only"` (exit 6) means the action is
    reserved for the owner in Orbit. Don't retry or look for a workaround — tell the
    user, then continue. Provisioning the *pinned project's own* db / bucket / auth is
@@ -98,17 +99,15 @@ pick or switch it.
 ## Typical flow: build → ship
 
 ```bash
-workser status --json                       # 1. orient (project is already pinned)
-workser board list --json                   # 2. what's already tracked
-workser decision list --json                #    …and already decided
-workser board create "Phase 2 — …" --json   # 3. phases? file them + the plan doc
-workser board move <id> in-progress --json  # 4. claim the card you're doing
-workser db create --json                    # 5. provision infra the app needs (idempotent)
-workser env set STRIPE_KEY=sk_live_… --json # 6. configure it
+workser status --json                            # 1. orient (project is already pinned)
+workser decision list --json                     # 2. what's already decided
+workser task subtask add "Phase 2 — …" --json     # 3. phases? file them as subtasks
+workser doc create "Plan" --markdown "…" --json   # 4. the plan's narrative, once
+workser db create --json                          # 5. provision infra the app needs (idempotent)
+workser env set STRIPE_KEY=sk_live_… --json      # 6. configure it
 # … you write the app code with your normal tools …
-workser verify --json                       # 7. green build is the bar for "done"
-workser deploy --prod --watch --json        # 8. ship; returns the stable *.workser.app URL
-workser board close <id> --json             # 9. the Board now matches reality
+workser verify --json                             # 7. green build is the bar for "done"
+workser deploy --prod --watch --json              # 8. ship; returns the stable *.workser.app URL
 ```
 
 ## Reading results

package/skills/workser/reference/sdlc-entities.md

@@ -1,28 +1,27 @@
 ---
 topic: sdlc-entities
-title: Board cards, decisions and requirements
-summary: Read what this project already tracks and decided, keep the Board honest as you work, and record what a future maintainer will need.
+title: Decisions and requirements
+summary: Read what this project already decided, and record what a future maintainer will need. Phased work itself is subtasks, not board cards — see `workser help tasks`.
 commands: [board, decision, requirement]
 ---
 
-# Board cards, decisions and requirements
+# Decisions and requirements
 
 These are the project's memory across sessions. They write to the **same tables**
-the Orbit desktop's Board and Project Memory panels use, so anything here appears
-there too — and, inside an Orbit-spawned run, as an inline card in the
-conversation. Documents have their own guide: `workser help docs`.
+the Orbit desktop's Project Memory panel uses, so anything here appears there too
+— and, inside an Orbit-spawned run, as an inline card in the conversation.
+Documents have their own guide: `workser help docs`. Phased work is tracked as
+subtasks, not here — see `workser help tasks`.
+
+> **The Board (`workser board ...`) is deprecated for agent use.** It used to be
+> where a multi-phase plan went, one card per phase — and the phase was ALSO a
+> subtask the planning turn had just filed for the same piece of work. That gave
+> a task two competing plans, one of which this task's own page never reads and
+> nothing kept in sync with the other. Phases are `project_tasks` subtasks now,
+> full stop: `workser task subtask add`. Do not run `workser board create` for
+> planned work — see `workser help tasks`.
 
 ```
-workser board list [--status <value>] [--label <value>] [--limit <n>]
-workser board show <id>
-workser board create <title> [--description <text>] [--status <value>]
-                              [--priority <value>] [--label <value>]
-                              [--owner <name>] [--milestone <id>]
-workser board update <id> [--title|--description|--status|--priority
-                           |--label|--owner|--milestone ...]
-workser board move <id> <backlog|in-progress|in-review|done>
-workser board close <id>
-
 workser decision list [--limit <n>]
 workser decision show <id>
 workser decision create <title> --context <text> --decision <text>
@@ -40,7 +39,6 @@ workser requirement update <id> [--title <text>] [--body <text>] [--status <text
 Before starting anything beyond a trivial edit:
 
 ```
-workser board list --json          # what's already tracked (don't re-file it)
 workser decision list --json       # what was already decided (don't reverse it)
 ```
 
@@ -50,19 +48,18 @@ purpose — `workser decision show <id>` gives you the context and consequences,
 not just the title. Reach for `workser doc list` / `workser requirement list`
 the same way when the task touches documented behaviour.
 
-## Work with phases → cards + a plan doc, before you build
+## Work with phases → subtasks + a plan doc, before you build
 
 The moment you split a task into more than one phase, file it — not afterwards,
 and not only in your reply, which is gone once the conversation scrolls.
 
 ```bash
-# one card per phase; only the one you're doing goes to in-progress
-workser board create "Phase 1 — schema + migration" \
-  --description "Add orders/line_items tables and the migration." \
-  --status in-progress --json
-workser board create "Phase 2 — checkout API" --description "…" --json
+# the phases themselves — this task's own subtask list, not the Board
+workser task subtask add "Phase 1 — schema + migration" --role api \
+  --note "Add orders/line_items tables and the migration."
+workser task subtask add "Phase 2 — checkout API" --role api --note "…"
 
-# the plan itself, ONE doc, deliberately NOT linked to a card
+# the plan's narrative, ONE doc, deliberately NOT linked to a subtask
 workser doc create "Checkout — implementation plan" --markdown "$(cat plan.md)" --json
 
 # the approach, if the plan settled something with real alternatives
@@ -73,32 +70,9 @@ workser decision create "Carts live server-side" --context "…" --decision "…
 its card and is *hidden* from the Docs panel; a plan spanning three phases
 belongs to the project, not to phase 1.
 
-The bar: if the user closed this conversation now, the Board should still show
-what's left and the doc should still explain the plan to whoever continues it.
-
-## Keep the Board honest while you work
-
-A Board still reading `backlog` after the feature shipped tells the user the
-opposite of the truth. Moving the card is part of finishing the work:
-
-```
-workser board move <id> in-progress   # you picked it up
-workser board move <id> in-review     # ready for the user to look at
-workser board close <id>              # done and verified
-```
-
-`--status` is one of `backlog | in-progress | in-review | done` (default
-`backlog`). `--priority` is one of `low | normal | high | urgent` (default
-`normal`). `--label` repeats for more than one label:
-
-```
-workser board create "Fix the login bug" --status in-progress --priority high \
-  --label bug --label auth
-```
-
-`board update` replaces the labels you pass rather than merging them, and
-touches only the fields you name. There is no `board delete`: `done` is the
-terminal state, and removing a card the user filed is theirs to do in Orbit.
+The bar: if the user closed this conversation now, the subtask list should still
+show what's left and the doc should still explain the plan to whoever continues
+it.
 
 ## Decisions are append-only
 

package/skills/workser/reference/tasks.md

@@ -14,6 +14,9 @@ below defaults to it and you rarely pass an id at all.
 ```
 workser task list [--status <value>] [--label <value>] [--limit <n>]
 workser task show [id]                  # the task you are in, with its steps
+workser task create <title> [--note <text>] [--kind <value>]
+                           [--label <value...>] [--app <id...>]
+                           [--infra <ref...>]
 
 workser task subtask add <title> [--role <value>] [--kind <value>]
                                  [--note <text>] [--app <id...>]
@@ -37,6 +40,16 @@ Team's own table. Filing your plan on the Board puts it somewhere the owner's
 task page never reads: they see "created work item" and an empty plan. Use
 `task subtask add`.
 
+## Opening work from a project channel
+
+When a project-channel conversation produces actionable work, the PM may record
+it with `workser task create`. Orbit supplies the channel and source-message IDs;
+the command records them and posts the new task card as a Project Manager message
+automatically. Do not invent or ask for those IDs.
+
+Opening a task does **not** approve it or start implementation. The task remains
+awaiting the owner. Never approve or dispatch a task you opened yourself.
+
 ## Planning a task
 
 Read the project first, then propose. One `subtask add` per step: