drafted 1.25.2 → 1.25.4

package/cli/drafted.mjs

@@ -2244,6 +2244,79 @@ async function minionSetEnabled(id, enabled, format) {
   emitMinionResult(format, { status: 'ok', id: c.id, slug: c.slug, name: c.name });
 }
 
+// ── Actions: propose an outward effect and read its decision ─────────────
+// The seam a Causeway automation's approval@1 step uses (Approvals inbox, A5/C4):
+// propose, then poll status until a person decides in the org's Approvals inbox.
+// Approving stays a browser-only act in Drafted; nothing here can approve.
+const actionCmd = program.command('action').description('Propose an outward effect for a person to approve, and read its decision');
+
+function actionState(actions) {
+  const st = (actions || []).map((a) => a.status);
+  if (!st.length) return 'unknown';
+  if (st.every((s) => s === 'proposed')) return 'waiting';
+  if (st.includes('rejected')) return 'rejected';
+  if (st.includes('failed')) return 'failed';
+  if (st.every((s) => s === 'executed')) return 'executed';
+  return 'approved';
+}
+
+async function actionApi(method, apiPath, org, body) {
+  requireLogin();
+  const server = getServerUrl().replace(/\/$/, '');
+  const headers = { ...(org ? { 'X-Drafted-Org': org } : {}), ...(body ? { 'Content-Type': 'application/json' } : {}) };
+  const res = await authFetch(`${server}${apiPath}`, { method, headers, body: body ? JSON.stringify(body) : undefined });
+  const data = await res.json().catch(() => ({}));
+  return { ok: res.ok, status: res.status, data };
+}
+
+actionCmd
+  .command('propose')
+  .description('Propose from JSON {type,payload} or {actions:[{type,payload}...]}, plus optional reason and assignee (an org member email or user id; default you). Reads --file or stdin.')
+  .option('--file <path>', 'JSON file (default: stdin)')
+  .option('--org <org>', 'org (id or slug) to propose in')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    let req;
+    try { req = opts.file ? JSON.parse(readFileSync(opts.file, 'utf8')) : readStdinJSON(); }
+    catch { console.error('invalid JSON request'); process.exit(1); }
+    const body = Array.isArray(req.actions) ? { actions: req.actions } : { actions: [{ type: req.type, payload: req.payload || {} }] };
+    if (req.reason) body.reason = String(req.reason);
+    if (req.assignee) body.assignee = String(req.assignee);
+    const r = await actionApi('POST', '/api/actions', opts.org, body);
+    const out = r.ok
+      ? { status: 'ok', groupId: r.data.groupId, url: r.data.receipt && r.data.receipt.url, assignee: r.data.assignee || null }
+      : { status: 'error', error: r.data.detail || r.data.error || `HTTP ${r.status}`, code: r.data.error || null };
+    if (opts.format === 'json') console.log(JSON.stringify(out));
+    else console.log(r.ok ? `${out.groupId}\t${out.url || ''}` : `error\t${out.error}`);
+    if (!r.ok) process.exit(1);
+  });
+
+actionCmd
+  .command('status <groupId>')
+  .description('A proposal\'s decision: waiting, approved, executed, failed or rejected, with who decided and why')
+  .option('--org <org>', 'org (id or slug) it was proposed in')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (groupId, opts) => {
+    const r = await actionApi('GET', `/api/actions/groups/${encodeURIComponent(groupId)}`, opts.org);
+    if (!r.ok) {
+      const out = { status: 'error', error: r.data.detail || r.data.error || `HTTP ${r.status}`, code: r.data.error || null };
+      if (opts.format === 'json') console.log(JSON.stringify(out)); else console.log(`error\t${out.error}`);
+      process.exit(1);
+    }
+    const acts = r.data.actions || [];
+    const out = {
+      status: 'ok',
+      groupId,
+      state: actionState(acts),
+      decidedBy: r.data.decidedBy ? r.data.decidedBy.name : null,
+      note: r.data.decisionNote || null,
+      assignee: r.data.assignee ? r.data.assignee.name : null,
+      steps: acts.map((a) => ({ seq: a.seq, type: a.type, status: a.status, error: (a.result && a.result.error) || null })),
+    };
+    if (opts.format === 'json') console.log(JSON.stringify(out));
+    else console.log(`${out.state}\t${out.decidedBy || ''}\t${out.note || ''}`);
+  });
+
 const minionCmd = program.command('minion').description('Minion management (checklist-driven intake surfaces). Requires the agent allowlist.');
 
 minionCmd

package/mcp/server.mjs

@@ -2829,7 +2829,10 @@ tool('trigger', {
   dailyLimit: z.number().optional().describe('[create|update] max deliveries per UTC day (default 50) — the cost cap.'),
   enabled: z.boolean().optional().describe('[update] enable/disable the trigger (the kill switch). Re-enabling resets the failure counter.'),
   payload: z.object({}).passthrough().optional().describe('[test] synthetic payload for the test delivery (default { test: true }).'),
-  executor: z.enum(['minion', 'queue']).optional().describe('[create|update] who runs deliveries: "minion" (default) runs the server-side agent immediately; "queue" parks deliveries for a LOCAL agent to poll via pending/claim/complete — use this to relay webhooks to yourself or a scheduled Causeway session.'),
+  executor: z.enum(['minion', 'queue', 'automation']).optional().describe('[create|update] who runs deliveries: "minion" (default) runs the server-side agent immediately; "queue" parks deliveries for a LOCAL agent to poll via pending/claim/complete — use this to relay webhooks to yourself or a scheduled Causeway session; "automation" runs a skill\'s chain (automationSkill) at a pinned version in Drafted for each delivery, payload as the untrusted input trigger.json — only an org OWNER can create one or move its pin, and the chain must use built-ins Drafted runs (template@1, approval@1, when:).'),
+  automationSkill: z.string().optional().describe('[create|update, executor=automation] the skill whose chain runs: its slug or id, in the project\'s org.'),
+  automationChain: z.string().optional().describe('[create|update, executor=automation] which named chain (default "default").'),
+  automationSkillVersion: z.number().optional().describe('[create|update, executor=automation] the pinned skill version to run (default: the skill\'s current version). Moving the pin is publishing: owner only.'),
   deliveryId: z.string().optional().describe('[complete] delivery ID returned by claim'),
   ok: z.boolean().optional().describe('[complete] whether the claimed work succeeded (default true)'),
   error: z.string().optional().describe('[complete] error note when ok=false'),
@@ -2846,9 +2849,10 @@ tool('trigger', {
     const scoped = (fn) => project ? withProjectOverride(project, fn) : fn();
     switch (action) {
       case 'create': {
-        if (!args.name || !args.promptTemplate) throw new Error('name and promptTemplate required for action=create');
-        const body = { name: args.name, promptTemplate: args.promptTemplate, projectId: project.id };
+        if (!args.name || (!args.promptTemplate && args.executor !== 'automation')) throw new Error('name and promptTemplate required for action=create (an automation needs automationSkill instead of a prompt)');
+        const body = { name: args.name, promptTemplate: args.promptTemplate || '', projectId: project.id };
         if (args.executor) body.executor = args.executor;
+        for (const k of ['automationSkill', 'automationChain', 'automationSkillVersion']) if (args[k] !== undefined) body[k] = args[k];
         if (args.signingSecret) body.signingSecret = args.signingSecret;
         if (args.dailyLimit !== undefined) body.dailyLimit = args.dailyLimit;
         const created = await scoped(() => api('POST', '/api/triggers', body));
@@ -2874,6 +2878,7 @@ tool('trigger', {
         if (args.dailyLimit !== undefined) body.dailyLimit = args.dailyLimit;
         if (args.signingSecret !== undefined) body.signingSecret = args.signingSecret || null;
         if (args.executor) body.executor = args.executor;
+        for (const k of ['automationSkill', 'automationChain', 'automationSkillVersion']) if (args[k] !== undefined) body[k] = args[k];
         if (Object.keys(body).length === 0) throw new Error('At least one field is required for action=update');
         return ok(await api('PATCH', `/api/triggers/${args.triggerId}`, body));
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.25.2",
+  "version": "1.25.4",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "bin": {