aui-agent-builder 0.4.0-alpha.0 → 0.4.0

package/dist/commands/version.js

@@ -2,11 +2,12 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { render } from "ink";
 import { Box, Text } from "ink";
 import inquirer from "inquirer";
-import chalk from "chalk";
-import { getConfig, loadSession, loadProjectConfig, findProjectRoot, } from "../config/index.js";
+import { getConfig, loadSession, loadProjectConfig, saveProjectConfig, findProjectRoot, } from "../config/index.js";
 import { AUIClient } from "../api-client/index.js";
-import { AuthenticationError } from "../errors/index.js";
-import { isJsonMode, outputJson, outputJsonError, stderrLog } from "../utils/json-output.js";
+import { AuthenticationError, CLIError } from "../errors/index.js";
+import { isJsonMode, isInteractiveSession, outputJson, outputJsonError, stderrLog, } from "../utils/json-output.js";
+import { resolveAgentManagementInfo } from "./util/agent-resolve.js";
+import { detectAgentBundleMode } from "./util/agent-mode.js";
 import { Header, StatusLine, Spinner, ErrorDisplay, Divider, KeyValueGroup, } from "../ui/components/index.js";
 import { colors } from "../ui/theme.js";
 import { loadAgentSettingsApiKey } from "../config/index.js";
@@ -37,7 +38,7 @@ function startSpinner(label) {
 }
 // ─── Helpers ───
 function vLabel(v) {
-    return `v${v.version_number}.${v.version_revision_number}`;
+    return `v${v.version_number}`;
 }
 function statusColor(status) {
     if (status === "published")
@@ -49,6 +50,28 @@ function statusColor(status) {
 function statsLabel(stats) {
     return `total:${stats.total ?? "?"} W:${stats.workflows} P:${stats.policies} I:${stats.integrations ?? 0} Pr:${stats.parameters ?? 0}`;
 }
+/**
+ * Does the resolved agent correspond to the agent this project's `.auirc`
+ * already tracks? Used to decide whether `version create` may repoint the
+ * `.auirc` at the freshly created draft. When no explicit `--agent-id` is
+ * passed the agent is resolved FROM the `.auirc`, so it matches by
+ * construction; this guard only matters when `--agent-id` targets a
+ * different agent than the project folder is checked out for. A `.auirc`
+ * with no agent identifiers at all is treated as a match (nothing to
+ * conflict with).
+ */
+function agentMatchesProject(agent, projectConfig) {
+    if (!projectConfig.agent_management_id && !projectConfig.agent_id)
+        return true;
+    if (projectConfig.agent_management_id &&
+        projectConfig.agent_management_id === agent.id)
+        return true;
+    if (projectConfig.agent_id &&
+        (projectConfig.agent_id === agent.scope?.network_id ||
+            projectConfig.agent_id === agent.id))
+        return true;
+    return false;
+}
 function getAuthenticatedClient() {
     const config = getConfig();
     if (!config.isAuthenticated) {
@@ -72,32 +95,41 @@ async function resolveAgentId(client, agentIdArg) {
         return client.agentManagement.getAgent(agentIdArg);
     }
     const session = loadSession();
-    // Try direct lookup by agent_management_id from session
-    if (session.agent_management_id) {
-        try {
-            return await client.agentManagement.getAgent(session.agent_management_id);
-        }
-        catch {
-            // ID might be stale, fall through
-        }
-    }
-    // Check project config (.auirc) — if we're inside an imported project,
-    // use its agent_id to find the agent-management record
+    // Project config (.auirc) takes priority over session — if you're inside a
+    // project, that's the agent you mean. Resolve from the PROJECT's own ids
+    // (preferring `agent_management_id`, the canonical agent-management UUID,
+    // exactly like `aui push`). Crucially, if the project's ids don't resolve
+    // we throw a clear error instead of silently falling through to the
+    // session's "current" agent — that silent fallthrough is what caused
+    // `version create` to write drafts on the wrong agent and to repoint a
+    // foreign `.auirc` at them.
     const projectRoot = findProjectRoot();
     if (projectRoot) {
         const projectConfig = loadProjectConfig(projectRoot);
-        if (projectConfig?.agent_id) {
-            try {
-                const resp = await client.agentManagement.listAgents(client.getOrganizationId(), 1, 50, { network_id: projectConfig.agent_id });
-                const match = resp.items.find((a) => a.scope.network_id === projectConfig.agent_id || a.id === projectConfig.agent_id);
-                if (match)
-                    return match;
-            }
-            catch {
-                // listing failed
-            }
+        if (projectConfig?.agent_management_id || projectConfig?.agent_id) {
+            const { agentInfo, errors } = await resolveAgentManagementInfo(client, {
+                projectAgentManagementId: projectConfig.agent_management_id,
+                projectNetworkId: projectConfig.agent_id,
+            });
+            if (agentInfo)
+                return agentInfo;
+            throw new CLIError("Could not resolve the agent for this project (.auirc).", {
+                code: "API_CLIENT_ERROR",
+                suggestion: "Pass --agent-id <agentManagementId> explicitly, or re-run `aui import` / `aui pull` to refresh .auirc." +
+                    (errors.length ? ` Attempts: ${errors.join("; ")}` : ""),
+            });
         }
     }
+    // No project context (.auirc): fall back to the session's agent. Same
+    // shared resolver, session inputs only.
+    {
+        const { agentInfo } = await resolveAgentManagementInfo(client, {
+            sessionAgentManagementId: session.agent_management_id,
+            sessionNetworkId: session.network_id,
+        });
+        if (agentInfo)
+            return agentInfo;
+    }
     const allAgents = [];
     let page = 1;
     let hasMore = true;
@@ -154,6 +186,15 @@ async function resolveAgentId(client, agentIdArg) {
     if (allAgents.length === 1) {
         return allAgents[0];
     }
+    // Multiple candidates and nothing pinned by project/session. Only an
+    // interactive TTY can disambiguate — a non-TTY caller (Claude Code,
+    // sandbox, pipe) must pass --agent-id rather than hang on the picker.
+    if (!isInteractiveSession()) {
+        throw new CLIError("Multiple agents found and none is selected for this context.", {
+            code: "API_CLIENT_ERROR",
+            suggestion: "Pass --agent-id <agentManagementId> to choose one, or run `aui agents --switch` in an interactive terminal first.",
+        });
+    }
     const { selected } = await inquirer.prompt([
         {
             type: "list",
@@ -168,6 +209,97 @@ async function resolveAgentId(client, agentIdArg) {
     ]);
     return selected;
 }
+/**
+ * STRICT agent resolver for the mutating version ops (publish / activate /
+ * archive). Unlike `resolveAgentId`, it NEVER falls back to the session and
+ * NEVER prompts — the agent comes from an explicit `--agent-id` or the
+ * project's `.auirc`, and nothing else. Run outside an agent directory with no
+ * `--agent-id`, it throws so the command can say "you're not in an agent
+ * directory" instead of silently mutating whatever the session last pointed
+ * at. This is the safety guarantee behind CLI-4: publish/activate/archive can
+ * only ever touch the agent the current folder tracks (or one you name).
+ *
+ * `--agent-id` is resolved network-id-tolerantly: the value is passed as BOTH
+ * the management id and the network id, so an id that is actually a network id
+ * still resolves to the canonical agent-management record. The same OR'd
+ * lookup covers the mis-synced `.auirc` case where `agent_id` holds a network
+ * id rather than the management id.
+ */
+async function resolveStrictAgent(client, agentIdArg) {
+    if (agentIdArg) {
+        const { agentInfo, errors } = await resolveAgentManagementInfo(client, {
+            projectAgentManagementId: agentIdArg,
+            projectNetworkId: agentIdArg,
+        });
+        if (agentInfo)
+            return agentInfo;
+        throw new CLIError(`Could not resolve --agent-id ${agentIdArg}.`, {
+            code: "API_CLIENT_ERROR",
+            suggestion: "Pass a valid agent-management id or network id." +
+                (errors.length ? ` Attempts: ${errors.join("; ")}` : ""),
+        });
+    }
+    const projectRoot = findProjectRoot();
+    const projectConfig = projectRoot ? loadProjectConfig(projectRoot) : null;
+    if (!projectRoot ||
+        !projectConfig ||
+        (!projectConfig.agent_management_id && !projectConfig.agent_id)) {
+        throw new CLIError("Not in an agent directory (no .auirc tracking an agent).", {
+            code: "API_CLIENT_ERROR",
+            suggestion: "cd into the agent's project folder, or pass --agent-id <id> together with the version id explicitly.",
+        });
+    }
+    const { agentInfo, errors } = await resolveAgentManagementInfo(client, {
+        projectAgentManagementId: projectConfig.agent_management_id,
+        projectNetworkId: projectConfig.agent_id,
+    });
+    if (agentInfo)
+        return agentInfo;
+    throw new CLIError("Could not resolve the agent for this project (.auirc).", {
+        code: "API_CLIENT_ERROR",
+        suggestion: "Pass --agent-id <agentManagementId> explicitly, or re-run `aui import` / `aui pull` to refresh .auirc." +
+            (errors.length ? ` Attempts: ${errors.join("; ")}` : ""),
+    });
+}
+/**
+ * Resolve the version a mutating op targets. Precedence: explicit
+ * `versionIdArg` → the `version_id` tracked in this project's `.auirc`. There
+ * is NO interactive picker — if neither yields an id we throw. The id is then
+ * fetched scoped to `agent.id`, so a version that belongs to a different agent
+ * fails with a clear ownership error instead of a raw 404 (the version-vs-agent
+ * guard from CLI-4).
+ */
+async function resolveStrictVersion(client, agent, versionIdArg) {
+    let versionId = versionIdArg;
+    if (!versionId) {
+        const projectRoot = findProjectRoot();
+        const projectConfig = projectRoot ? loadProjectConfig(projectRoot) : null;
+        versionId = projectConfig?.version_id;
+    }
+    if (!versionId) {
+        throw new CLIError("No version id to act on.", {
+            code: "API_CLIENT_ERROR",
+            suggestion: "Pass the version id (e.g. `aui version publish <id>`), or set version_id in .auirc (e.g. via `aui version create`).",
+        });
+    }
+    let version;
+    try {
+        version = await client.agentManagement.getVersion(agent.id, versionId);
+    }
+    catch {
+        throw new CLIError(`Version ${versionId} was not found on agent "${agent.name}" (${agent.id}).`, {
+            code: "API_CLIENT_ERROR",
+            suggestion: "Confirm the version id belongs to this agent (`aui version list`), or pass --agent-id for the agent that owns it.",
+        });
+    }
+    if (version.agent_id && version.agent_id !== agent.id) {
+        throw new CLIError(`Version ${versionId} belongs to agent ${version.agent_id}, not "${agent.name}" (${agent.id}).`, {
+            code: "API_CLIENT_ERROR",
+            suggestion: "Run from that agent's directory, or pass --agent-id for the owning agent.",
+        });
+    }
+    return version;
+}
 async function fetchAllVersions(client, agentId, filters) {
     const all = [];
     let page = 1;
@@ -183,9 +315,18 @@ async function fetchAllVersions(client, agentId, filters) {
 // ─── Interactive Menu ───
 export async function versionMenu() {
     const { client } = getAuthenticatedClient();
-    const session = loadSession();
     log(_jsx(Header, { title: "Version Management" }));
-    log(_jsx(StatusLine, { kind: "info", label: `Agent: ${session.network_name || session.network_id || "none"}` }));
+    // Resolve agent properly (project context takes priority over session)
+    let agentLabel;
+    try {
+        const agent = await resolveAgentId(client);
+        agentLabel = agent.name;
+    }
+    catch {
+        const session = loadSession();
+        agentLabel = session.network_name || session.network_id || "none";
+    }
+    log(_jsx(StatusLine, { kind: "info", label: `Agent: ${agentLabel}` }));
     const { action } = await inquirer.prompt([
         {
             type: "list",
@@ -200,6 +341,8 @@ export async function versionMenu() {
                 { name: "Activate a version", value: "activate" },
                 { name: "Archive a version", value: "archive" },
                 new inquirer.Separator(),
+                { name: "Browse snapshots", value: "snapshot" },
+                new inquirer.Separator(),
                 { name: "Back", value: "back" },
             ],
         },
@@ -225,6 +368,11 @@ export async function versionMenu() {
         case "archive":
             await versionArchive();
             break;
+        case "snapshot": {
+            const { versionSnapshotMenu } = await import("./version-snapshot.js");
+            await versionSnapshotMenu();
+            break;
+        }
     }
 }
 export async function versionList(agentIdArg, options) {
@@ -306,105 +454,230 @@ export async function versionList(agentIdArg, options) {
     }
 }
 export async function versionCreate(options) {
+    const json = isJsonMode();
     const { client, userId } = getAuthenticatedClient();
-    const agentSpinner = startSpinner("Resolving agent...");
     let agent;
     try {
+        if (json)
+            stderrLog("Resolving agent...");
+        const agentSpinner = json ? null : startSpinner("Resolving agent...");
         agent = await resolveAgentId(client, options.agentId);
-        agentSpinner.succeed(`Agent: ${agent.name}`);
+        if (agentSpinner)
+            agentSpinner.succeed(`Agent: ${agent.name}`);
+        else
+            stderrLog(`Agent: ${agent.name}`);
     }
     catch (error) {
-        agentSpinner.fail("Failed to resolve agent");
-        log(_jsx(ErrorDisplay, { error: error }));
+        if (json) {
+            outputJsonError({
+                code: "AGENT_RESOLVE_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+        else {
+            log(_jsx(ErrorDisplay, { error: error }));
+        }
         return null;
     }
-    let source = options.source;
+    const source = options.source;
     let fromVersion = options.from;
-    let bumpMode = options.bump;
-    let label = options.label;
-    let tags = options.tags?.split(",").map((t) => t.trim()).filter(Boolean);
-    let notes = options.notes;
-    if (!source) {
-        const versions = await fetchAllVersions(client, agent.id);
-        const { sourceChoice } = await inquirer.prompt([
-            {
-                type: "list",
-                name: "sourceChoice",
-                message: "How to create the new version?",
-                choices: [
-                    { name: "Snapshot from current scope", value: "agent-scope" },
-                    ...(versions.length > 0
-                        ? [{ name: "Clone from existing version", value: "version" }]
-                        : []),
-                ],
-            },
-        ]);
-        source = sourceChoice;
-        if (source === "version") {
-            const { selectedVersion } = await inquirer.prompt([
-                {
-                    type: "list",
-                    name: "selectedVersion",
-                    message: "Clone from which version?",
-                    choices: versions.map((v) => ({
-                        name: `${vLabel(v)} [${v.status}] ${v.label || ""} — ${statsLabel(v.stats)}`,
-                        value: v.id,
-                    })),
-                    pageSize: 15,
-                },
-            ]);
-            fromVersion = selectedVersion;
+    const fromTemplate = options.fromTemplate;
+    const label = options.label;
+    const tags = options.tags?.split(",").map((t) => t.trim()).filter(Boolean);
+    const notes = options.notes;
+    // ─── Mode-aware, single-step creation (no prompts) ─────────────────
+    // `aui version create` is intentionally non-interactive: it inspects the
+    // agent's storage mode (the same `detectAgentBundleMode` switch push /
+    // pull / import use — honours `AUI_FORCE_AGENT_MODE` and defaults to
+    // records on older backends) and creates the draft directly:
+    //
+    //   - bundle-mode  → source="version", from_version=<active version>
+    //     (blob-mode agents have no per-entity records to snapshot, so
+    //      `agent-scope` would 422). Falls back to --from when given.
+    //   - records-mode → source="agent-scope".
+    //
+    // Optional `--source` / `--from` / `--from-template` / `--label` /
+    // `--tags` / `--notes` still override; with no flags it "just works".
+    const { mode } = await detectAgentBundleMode(client, agent.id, agent);
+    const isBundleMode = mode === "bundle";
+    const defaultSource = isBundleMode
+        ? "version"
+        : "agent-scope";
+    // Validate source/arg combinations BEFORE the spinner so the user
+    // sees the actionable error instead of "Failed to create draft".
+    const resolvedSource = (source || defaultSource);
+    if (resolvedSource === "version" && !fromVersion) {
+        // Auto-pick the agent's active version. If the agent has none
+        // (brand-new bundle-mode agent), error with a clear hint.
+        if (agent.active_version_id) {
+            fromVersion = agent.active_version_id;
         }
-        if (fromVersion) {
-            const { bump } = await inquirer.prompt([
-                {
-                    type: "list",
-                    name: "bump",
-                    message: "Create as:",
-                    choices: [
-                        { name: "New version number (e.g. v3.0 → v4.0)", value: "version_number" },
-                        { name: "Revision of source (e.g. v3.0 → v3.1)", value: "version_revision_number" },
-                    ],
-                },
-            ]);
-            bumpMode = bump;
+        else {
+            const errMsg = "source=version requires --from <versionId> (this agent has no active version to clone from).";
+            if (json) {
+                outputJsonError({ code: "VERSION_CREATE_FROM_REQUIRED", message: errMsg });
+            }
+            else {
+                log(_jsx(ErrorDisplay, { message: errMsg, suggestion: "Pass --from <versionId>, or run `aui version list` to see available versions." }));
+            }
+            return null;
         }
-        const meta = await inquirer.prompt([
-            { type: "input", name: "label", message: "Label (optional):", default: "" },
-            { type: "input", name: "tags", message: "Tags (comma-separated, optional):", default: "" },
-            { type: "input", name: "notes", message: "Notes (optional):", default: "" },
-        ]);
-        if (meta.label)
-            label = meta.label;
-        if (meta.tags)
-            tags = meta.tags.split(",").map((t) => t.trim()).filter(Boolean);
-        if (meta.notes)
-            notes = meta.notes;
-    }
-    const spinner = startSpinner("Creating draft version...");
+    }
+    if (resolvedSource === "template" && !fromTemplate) {
+        const errMsg = "source=template requires --from-template <templateAgentId>.";
+        if (json) {
+            outputJsonError({
+                code: "VERSION_CREATE_FROM_TEMPLATE_REQUIRED",
+                message: errMsg,
+            });
+        }
+        else {
+            log(_jsx(ErrorDisplay, { message: errMsg, suggestion: "Pass --from-template <agentManagementId> pointing at a kind=template agent." }));
+        }
+        return null;
+    }
+    if (resolvedSource === "agent-scope" && isBundleMode) {
+        const errMsg = "source=agent-scope is records-mode only. This agent is in blob-mode (bundle_mode=true).";
+        if (json) {
+            outputJsonError({ code: "VERSION_CREATE_SOURCE_MODE_MISMATCH", message: errMsg });
+        }
+        else {
+            log(_jsx(ErrorDisplay, { message: errMsg, suggestion: "Use --source version --from <versionId> or --source template --from-template <templateAgentId>." }));
+        }
+        return null;
+    }
+    if (resolvedSource === "template" && !isBundleMode) {
+        const errMsg = "source=template is blob-mode only. This agent is in records-mode (bundle_mode=false).";
+        if (json) {
+            outputJsonError({ code: "VERSION_CREATE_SOURCE_MODE_MISMATCH", message: errMsg });
+        }
+        else {
+            log(_jsx(ErrorDisplay, { message: errMsg, suggestion: "Use --source version --from <versionId> or --source agent-scope (records mode default)." }));
+        }
+        return null;
+    }
+    if (json)
+        stderrLog("Creating draft version...");
+    const spinner = json ? null : startSpinner("Creating draft version...");
     try {
         const draft = await client.agentManagement.createDraft(agent.id, {
-            source: source || "agent-scope",
-            ...(fromVersion ? { from_version: fromVersion } : {}),
-            bump_mode: bumpMode || (fromVersion ? "version_revision_number" : "version_number"),
+            source: resolvedSource,
+            // `from_version` is only meaningful for source=version. A stray `--from`
+            // on a records agent (source=agent-scope) used to leak through and 422
+            // server-side ("from_version must not be set when source=agent-scope").
+            ...(resolvedSource === "version" && fromVersion
+                ? { from_version: fromVersion }
+                : {}),
+            ...(fromTemplate ? { from_template: fromTemplate } : {}),
+            bump_mode: "version_number",
             created_by: userId,
             ...(label ? { label } : {}),
             ...(tags && tags.length > 0 ? { tags } : {}),
             ...(notes ? { notes } : {}),
         });
-        spinner.succeed(`Draft created: ${vLabel(draft)} [${draft.status}]`);
+        if (spinner)
+            spinner.succeed(`Draft created: ${vLabel(draft)} [${draft.status}]`);
+        // ─── Repoint .auirc at the new draft (default behaviour) ───
+        // Every `version create` now updates the project's `.auirc` so the very
+        // next `aui push` / `aui pull` targets the draft you just made — no
+        // separate `--use` step. We write three fields:
+        //   • `version_id`    → the new draft's id.
+        //   • `version_label` → the draft's custom label if given, else `v{version_number}`.
+        //   • `version_tag`   → the draft's revision tag in the canonical
+        //                       `v{version_number}.{version_revision_number}` form
+        //                       (e.g. `v15.0`) — the same format `aui push` / `pull`
+        //                       persist — preferring a server-returned `version_tag`
+        //                       when the create response carries one.
+        //
+        // Guard: ONLY repoint a `.auirc` that actually belongs to THIS agent —
+        // i.e. the draft was created inside this agent's own project folder.
+        // Checked unconditionally (not just when `--agent-id` is passed): if the
+        // nearest `.auirc` up the tree tracks a different agent, we leave it
+        // alone rather than silently overwriting an unrelated project's
+        // `version_id`. Without `--agent-id` the agent was resolved from this
+        // `.auirc` so it matches by construction; a `.auirc` with no agent
+        // identifiers is treated as a match (nothing to conflict with).
+        const newVersionLabel = draft.label || vLabel(draft);
+        // Prefer a server-supplied `version_tag` if the create response carries one
+        // (not in the typed shape, so probe defensively); otherwise derive the
+        // canonical `v{number}.{revision}` tag from the draft's numbers.
+        const draftWithTag = draft;
+        const newVersionTag = typeof draftWithTag.version_tag === "string" && draftWithTag.version_tag
+            ? draftWithTag.version_tag
+            : `v${draft.version_number}.${draft.version_revision_number}`;
+        let auircUpdated = false;
+        let auircPath;
+        let auircSkippedReason;
+        const projectRoot = findProjectRoot();
+        if (!projectRoot) {
+            auircSkippedReason = "no-auirc";
+        }
+        else {
+            const projectConfig = loadProjectConfig(projectRoot);
+            if (!projectConfig) {
+                auircSkippedReason = "no-auirc";
+            }
+            else if (!agentMatchesProject(agent, projectConfig)) {
+                auircSkippedReason = "foreign-agent";
+            }
+            else {
+                const updated = {
+                    ...projectConfig,
+                    version_id: draft.id,
+                    version_label: newVersionLabel,
+                    version_tag: newVersionTag,
+                };
+                saveProjectConfig(updated, projectRoot);
+                auircUpdated = true;
+                auircPath = `${projectRoot}/.auirc`;
+            }
+        }
+        if (json) {
+            outputJson({
+                agent: { id: agent.id, name: agent.name },
+                draft: {
+                    id: draft.id,
+                    version: vLabel(draft),
+                    version_number: draft.version_number,
+                    version_revision_number: draft.version_revision_number,
+                    version_tag: newVersionTag,
+                    status: draft.status,
+                    label: draft.label,
+                    tags: draft.tags,
+                    notes: draft.notes,
+                    parent_version_id: draft.parent_version_id,
+                    stats: draft.stats,
+                    created_at: draft.created_at,
+                    created_by: draft.created_by,
+                },
+                auirc_updated: auircUpdated,
+                ...(auircPath ? { auirc_path: auircPath } : {}),
+                ...(auircSkippedReason ? { auirc_skipped_reason: auircSkippedReason } : {}),
+            });
+            return draft;
+        }
         log(_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(KeyValueGroup, { items: [
                         { label: "Version ID:", value: draft.id },
                         { label: "Version:", value: vLabel(draft) },
+                        { label: "Tag:", value: newVersionTag },
                         { label: "Status:", value: draft.status },
                         ...(draft.label ? [{ label: "Label:", value: draft.label }] : []),
                         { label: "Entities:", value: String(draft.stats?.total ?? 0) },
-                    ] }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "cyan", bold: true, children: "\u2192 " }), _jsx(Text, { children: "Next: " }), _jsx(Text, { bold: true, children: "aui version publish" }), _jsx(Text, { color: "gray", children: " to lock this version" })] }), _jsxs(Box, { children: [_jsx(Text, { color: "gray", children: "  Use " }), _jsx(Text, { bold: true, children: "aui version list" }), _jsx(Text, { color: "gray", children: " to see all versions and their status" })] })] }));
+                    ] }), auircUpdated && (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "green", bold: true, children: "\u2713 " }), _jsx(Text, { color: "gray", children: ".auirc updated \u2192 " }), _jsx(Text, { bold: true, children: newVersionLabel }), _jsx(Text, { color: "gray", children: " \u2014 " }), _jsx(Text, { bold: true, children: "aui push" }), _jsx(Text, { color: "gray", children: " / " }), _jsx(Text, { bold: true, children: "aui pull" }), _jsx(Text, { color: "gray", children: " now target this draft" })] })), auircSkippedReason === "foreign-agent" && (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "yellow", bold: true, children: "! " }), _jsx(Text, { color: "gray", children: ".auirc left unchanged \u2014 it tracks a different agent than the one this draft belongs to." })] })), auircSkippedReason === "no-auirc" && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", children: "  No .auirc in this directory \u2014 skipped project update." }) })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "cyan", bold: true, children: "\u2192 " }), _jsx(Text, { children: "Next: " }), _jsx(Text, { bold: true, children: "aui version publish" }), _jsx(Text, { color: "gray", children: " to lock this version" })] }), _jsxs(Box, { children: [_jsx(Text, { color: "gray", children: "  Use " }), _jsx(Text, { bold: true, children: "aui version list" }), _jsx(Text, { color: "gray", children: " to see all versions and their status" })] })] }));
         return draft;
     }
     catch (error) {
-        spinner.fail("Failed to create draft");
-        log(_jsx(ErrorDisplay, { error: error }));
+        if (spinner)
+            spinner.fail("Failed to create draft");
+        if (json) {
+            outputJsonError({
+                code: "VERSION_CREATE_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+        else {
+            log(_jsx(ErrorDisplay, { error: error }));
+        }
         return null;
     }
 }
@@ -469,46 +742,33 @@ export async function versionGet(versionIdArg, agentIdArg) {
 // ─── Publish Version ───
 export async function versionPublish(versionIdArg, agentIdArg) {
     const { client, userId } = getAuthenticatedClient();
-    const agent = await resolveWithSpinner(client, agentIdArg);
-    if (!agent)
-        return;
-    let versionId = versionIdArg;
-    if (!versionId) {
-        const versions = await fetchAllVersions(client, agent.id);
-        const drafts = versions.filter((v) => v.status === "draft");
-        if (drafts.length === 0) {
-            log(_jsx(StatusLine, { kind: "warning", label: "No draft versions to publish." }));
-            return;
-        }
-        const { selected } = await inquirer.prompt([
-            {
-                type: "list",
-                name: "selected",
-                message: "Select draft to publish:",
-                choices: drafts.map((v) => ({
-                    name: `${vLabel(v)} — ${statsLabel(v.stats)} ${v.label || ""}`,
-                    value: v.id,
-                })),
-                pageSize: 15,
-            },
-        ]);
-        versionId = selected;
+    // Strict, non-interactive resolution: agent + version come from --agent-id /
+    // <version-id> or the project's .auirc, never the session and never a picker.
+    let agent;
+    let version;
+    const resolveSpinner = startSpinner("Resolving agent and version...");
+    try {
+        agent = await resolveStrictAgent(client, agentIdArg);
+        version = await resolveStrictVersion(client, agent, versionIdArg);
+        resolveSpinner.succeed(`Target: ${agent.name} → ${vLabel(version)} [${version.status}]`);
     }
-    const { confirm } = await inquirer.prompt([
-        {
-            type: "confirm",
-            name: "confirm",
-            message: "Publishing locks this version permanently. Continue?",
-            default: false,
-        },
-    ]);
-    if (!confirm) {
-        log(_jsx(StatusLine, { kind: "muted", label: "Cancelled." }));
+    catch (error) {
+        // Strict-resolution failures (not in an agent dir, unknown/foreign version)
+        // propagate so `handleError` renders them and exits non-zero — automation
+        // must be able to tell a refused mutation from a successful one.
+        resolveSpinner.stop();
+        throw error;
+    }
+    if (version.status.toLowerCase() !== "draft") {
+        log(_jsx(StatusLine, { kind: "warning", label: `${vLabel(version)} is ${version.status}, not a draft — only drafts can be published.` }));
         return;
     }
+    // No confirmation prompt: the target was resolved deterministically from
+    // --agent-id / <version-id> / .auirc and echoed above. These commands act on
+    // exactly that target, always non-interactively.
     const spinner = startSpinner("Publishing version...");
     try {
-        const published = await client.agentManagement.publishVersion(agent.id, versionId, userId);
+        const published = await client.agentManagement.publishVersion(agent.id, version.id, userId);
         spinner.succeed(`Published: ${vLabel(published)} [${published.status}]`);
         log(_jsxs(Box, { paddingX: 1, children: [_jsx(Text, { color: "cyan", bold: true, children: "\u2192 " }), _jsx(Text, { children: "Next: " }), _jsx(Text, { bold: true, children: "aui version activate" }), _jsx(Text, { color: "gray", children: " to make this the live configuration" })] }));
     }
@@ -520,49 +780,34 @@ export async function versionPublish(versionIdArg, agentIdArg) {
 // ─── Activate Version ───
 export async function versionActivate(versionIdArg, agentIdArg) {
     const { client } = getAuthenticatedClient();
-    const agent = await resolveWithSpinner(client, agentIdArg);
-    if (!agent)
+    // Strict, non-interactive resolution (see versionPublish).
+    let agent;
+    let version;
+    const resolveSpinner = startSpinner("Resolving agent and version...");
+    try {
+        agent = await resolveStrictAgent(client, agentIdArg);
+        version = await resolveStrictVersion(client, agent, versionIdArg);
+        resolveSpinner.succeed(`Target: ${agent.name} → ${vLabel(version)} [${version.status}]`);
+    }
+    catch (error) {
+        // Strict-resolution failures (not in an agent dir, unknown/foreign version)
+        // propagate so `handleError` renders them and exits non-zero — automation
+        // must be able to tell a refused mutation from a successful one.
+        resolveSpinner.stop();
+        throw error;
+    }
+    if (version.status.toLowerCase() !== "published") {
+        log(_jsx(StatusLine, { kind: "warning", label: `${vLabel(version)} is ${version.status} — only published versions can be activated.` }));
         return;
-    let versionId = versionIdArg;
-    if (!versionId) {
-        const versions = await fetchAllVersions(client, agent.id);
-        const published = versions.filter((v) => v.status === "published");
-        if (published.length === 0) {
-            log(_jsx(StatusLine, { kind: "warning", label: "No published versions to activate." }));
-            return;
-        }
-        const { selected } = await inquirer.prompt([
-            {
-                type: "list",
-                name: "selected",
-                message: "Select version to activate:",
-                choices: published.map((v) => {
-                    const isActive = v.id === agent.active_version_id;
-                    return {
-                        name: `${vLabel(v)} ${isActive ? chalk.green("← active") : ""} — ${statsLabel(v.stats)}`,
-                        value: v.id,
-                    };
-                }),
-                pageSize: 15,
-            },
-        ]);
-        versionId = selected;
     }
-    const { confirm } = await inquirer.prompt([
-        {
-            type: "confirm",
-            name: "confirm",
-            message: `Activate this version as the live configuration?`,
-            default: true,
-        },
-    ]);
-    if (!confirm) {
-        log(_jsx(StatusLine, { kind: "muted", label: "Cancelled." }));
+    if (version.id === agent.active_version_id) {
+        log(_jsx(StatusLine, { kind: "info", label: `${vLabel(version)} is already the live version. Nothing to do.` }));
         return;
     }
+    // No confirmation prompt — act on the resolved target directly (see publish).
     const spinner = startSpinner("Activating version...");
     try {
-        await client.agentManagement.activateVersion(agent.id, versionId);
+        await client.agentManagement.activateVersion(agent.id, version.id);
         spinner.succeed(`Version activated successfully`);
         log(_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsxs(Box, { children: [_jsx(Text, { color: "green", bold: true, children: "\u2713 " }), _jsx(Text, { children: "This version is now live in production" })] }), _jsxs(Box, { children: [_jsx(Text, { color: "gray", children: "  Use " }), _jsx(Text, { bold: true, children: "aui version list" }), _jsx(Text, { color: "gray", children: " to see all versions and their status" })] })] }));
     }
@@ -574,46 +819,34 @@ export async function versionActivate(versionIdArg, agentIdArg) {
 // ─── Archive Version ───
 export async function versionArchive(versionIdArg, agentIdArg) {
     const { client } = getAuthenticatedClient();
-    const agent = await resolveWithSpinner(client, agentIdArg);
-    if (!agent)
+    // Strict, non-interactive resolution (see versionPublish).
+    let agent;
+    let version;
+    const resolveSpinner = startSpinner("Resolving agent and version...");
+    try {
+        agent = await resolveStrictAgent(client, agentIdArg);
+        version = await resolveStrictVersion(client, agent, versionIdArg);
+        resolveSpinner.succeed(`Target: ${agent.name} → ${vLabel(version)} [${version.status}]`);
+    }
+    catch (error) {
+        // Strict-resolution failures (not in an agent dir, unknown/foreign version)
+        // propagate so `handleError` renders them and exits non-zero — automation
+        // must be able to tell a refused mutation from a successful one.
+        resolveSpinner.stop();
+        throw error;
+    }
+    if (version.status.toLowerCase() !== "published") {
+        log(_jsx(StatusLine, { kind: "warning", label: `${vLabel(version)} is ${version.status} — only published versions can be archived.` }));
         return;
-    let versionId = versionIdArg;
-    if (!versionId) {
-        const versions = await fetchAllVersions(client, agent.id);
-        const archivable = versions.filter((v) => v.status === "published" && v.id !== agent.active_version_id);
-        if (archivable.length === 0) {
-            log(_jsx(StatusLine, { kind: "warning", label: "No versions available to archive (must be published and not active)." }));
-            return;
-        }
-        const { selected } = await inquirer.prompt([
-            {
-                type: "list",
-                name: "selected",
-                message: "Select version to archive:",
-                choices: archivable.map((v) => ({
-                    name: `${vLabel(v)} — ${statsLabel(v.stats)} ${v.label || ""}`,
-                    value: v.id,
-                })),
-                pageSize: 15,
-            },
-        ]);
-        versionId = selected;
     }
-    const { confirm } = await inquirer.prompt([
-        {
-            type: "confirm",
-            name: "confirm",
-            message: "Archived versions cannot be activated. They can still be viewed and cloned. Continue?",
-            default: false,
-        },
-    ]);
-    if (!confirm) {
-        log(_jsx(StatusLine, { kind: "muted", label: "Cancelled." }));
+    if (version.id === agent.active_version_id) {
+        log(_jsx(StatusLine, { kind: "warning", label: `${vLabel(version)} is the live version — activate another version before archiving it.` }));
         return;
     }
+    // No confirmation prompt — act on the resolved target directly (see publish).
     const spinner = startSpinner("Archiving version...");
     try {
-        const archived = await client.agentManagement.archiveVersion(agent.id, versionId);
+        const archived = await client.agentManagement.archiveVersion(agent.id, version.id);
         spinner.succeed(`Archived: ${vLabel(archived)} [${archived.status}]`);
     }
     catch (error) {