ente-cli 0.4.71 → 0.4.73

package/README.md

@@ -423,3 +423,24 @@ JSON failures use stdout `{ "error": { "message": "..." } }` with a nonzero
 exit. REST status and structured error fields survive. Check the exit before
 parsing; see [Retrieve bounded context](playbooks/retrieve-bounded-context.md).
 The unsupported `entity show` spelling gives a targeted `entity get` correction.
+
+### Granted incident diagnostics
+
+`ente diagnostics page --source toolMessages --since <epoch-ms> --until <epoch-ms> --profile ente-operator --json`
+reads fixed global content-free aggregates using the existing bound agent REST
+credential. Access is off unless a current human platform admin explicitly grants
+this exact owned Personal agent diagnostics with expiry. Installation grants no
+access. No grant/revoke or arbitrary admin executor is exposed to agents.
+
+Sources/flags match `health page`: toolMessages, threads with `--status
+idle|running|error`, recordings with its processing status; `--limit` 1–100,
+`--cursor`, and `--stale-after-ms` 60000–86400000. Keep source/since/until fixed
+across pages. Results put aggregates and continuation under `data.page`, with
+window/observation/coverage alongside. Read every page before claiming complete
+counts; terminal recording history excludes missing progress timestamps. No
+message bodies or customer identifiers. The legacy `health page` remains a
+separate human-admin JWT surface and never serves as a fallback.
+
+Diagnostics is unavailable inside Ente-hosted chats, recordings and automations.
+Use the external operator command. Whole-history panel sharing does not grant
+access to diagnostics, and diagnostic reads do not append to chat history.

package/dist/SKILL.md

@@ -157,6 +157,8 @@ ente query "QM system export" [--space <name>] [--entity <name>] [--since <epoch
 # Entities
 ente entity list [--query <text>] [--type person|org|project|topic|place|object] [--space <name>] [--limit 50] [--archived] [--json]
 ente entity create "Jane Doe" --type person [--pin "Acme Corp"] [--share-parents --parent-space-grant-fingerprint <token>] [--alias "JD"] [--attr email=jane@acme.com] [--tag vip] [--description "CTO at Acme"] [--json]
+ente entity create "Leistungsphase 1" --type topic --space "Studio" --parent "Building A" --exclusive-parent [--json]
+ente entity duplicate <name-or-id> --space <space> [--name "New project"] [--include-exclusive-children] [--json]
 ente entity get "Jane Doe" [--json]
 ente entity update "Jane Doe" [--name "Jane A. Doe"] [--alias-add "Jane"] [--alias-remove "JD"] [--attr role=CEO] [--tag vip] [--description "…"] [--json]
 ente entity rename "Lorey Georg" "Georg Lorey"        # change display name
@@ -523,6 +525,12 @@ Optional schedules accept `intervalHours: 1 | 24` and
 Published threads are native, durable, read-only activities. Their messages
 appear individually in the timeline; graph content reads include bounded email
 blocks. Use existing activity controls to correct thread space/owners.
+## Entity creation and duplication
+
+Entity duplication copies the type, name, description, email addresses and icon into the selected source space. It never copies activities or existing parents. `--include-exclusive-children` recursively recreates exclusive branches already in that space with exact child names, order and aggregation settings. Shared and archived children are excluded. The operation fails atomically above 100 entities including the root. Use parent context or an ID to distinguish same-named phases across projects.
+
+`entity create --parent` atomically creates and attaches a child. Add `--exclusive-parent` to restrict it to that parent. The parent must already belong to the destination space; this path never shares it or its ancestors. Resolve same-named phases by parent context or ID. Do not combine `--parent` with `--pin`; `--pin` retains the older separate-link behavior.
+
 ## Reviewed space changes
 
 `ente space change COMMAND --json` supports `prepare`, `status`, `items`,
@@ -583,3 +591,26 @@ assignees and preserves humans. `--clear-agent-assignees` removes the agent assi
 Assignment requires the agent to have write access in the task space; it grants no access.
 
 Scheduled runs also accept `runCondition: "new_chats"`: skip model execution unless this agent has new manual or recording chats since its previous scheduled check. Scheduled/reflection chats do not trigger it; explicit Run now bypasses the condition.
+
+## Explicit incident diagnostics
+
+Use `ente diagnostics page --source toolMessages --since <epoch-ms> --until
+<epoch-ms> --profile <bound-profile> --json` only within the requested incident.
+A current human platform admin must explicitly grant the exact owned Personal
+agent read-only global health aggregates with expiry in its agent editor. An
+admin owner, company billing role, settings delegation or mailbox grant alone
+is insufficient. Do not grant or renew access yourself, change credentials, or
+fall back to `health page` after denial. Installation enables no grant.
+
+Source/window flags match `health page`; rows 1–100, read budget 1 MiB, tool-message
+and terminal recording windows at most 7 days. Active recordings require `since=0`;
+terminal recordings require positive since and exclude legacy missing timestamps.
+Responses contain window/observation/coverage and `data.page` aggregates. Continue
+with `--cursor <data.page.continueCursor>` while `isDone=false`, keeping the
+window/source fixed. Only sum completed pages; partial/unavailable is not zero
+failures. These live state pages are not an atomic or immutable incident history.
+No customer bodies, arbitrary account lookup, settings writes or mailbox retries.
+
+Diagnostics is unavailable inside Ente-hosted chats, recordings and automations.
+Use the external operator command. Whole-history panel sharing does not grant
+access to diagnostics, and diagnostic reads do not append to chat history.

package/dist/cli.mjs

@@ -3800,7 +3800,7 @@ async function runCli(cli2, argv, context) {
 }
 
 // ente/version.ts
-var VERSION = "0.4.71";
+var VERSION = "0.4.73";
 
 // ente/branding.ts
 var NPM_REGISTRY = "https://registry.npmjs.org";
@@ -4275,6 +4275,9 @@ var EnteClient = class _EnteClient {
       body
     );
   }
+  diagnostics(body) {
+    return this.rest.post("/api/external/agent/diagnostics", body);
+  }
   agentTasks(body) {
     return this.rest.post("/api/external/agent/tasks", body);
   }
@@ -11248,6 +11251,10 @@ var AuthProfiles = class extends BaseCommand {
 };
 var AUTH_COMMANDS = [AuthLogin, AuthPair, AuthStatus, AuthLogout, AuthProfiles];
 
+// ../packages/shared/src/entity-duplication.ts
+var MAX_DUPLICATED_ENTITIES = 100;
+var ENTITY_DUPLICATION_DESCRIPTION = `Duplicate an entity shell in a selected space it already belongs to. Copies type, name, description, email addresses and icon, without activities or existing parent links. Optionally recreates exclusive child branches in that same space with exact child names, order and aggregation settings. Shared and archived children are excluded. At most ${MAX_DUPLICATED_ENTITIES} entities including the root; oversized copies fail atomically.`;
+
 // ../packages/shared/src/entity-types.ts
 var ENTITY_TYPE_VALUES = [
   "person",
@@ -11730,6 +11737,7 @@ var PinsList = class extends ProfileCommand {
 var PINS_COMMANDS = [PinsList];
 
 // ente/commands/entity.ts
+var entitiesDuplicate = makeFunctionReference("entities:duplicate");
 var entitiesCreate = makeFunctionReference("entities:create");
 var entitiesFindById = makeFunctionReference(
   "entities:findById"
@@ -11784,6 +11792,26 @@ function toActivityView(rich) {
     shortId: rich.shortId
   };
 }
+var EntityDuplicate = class extends ProfileCommand {
+  static paths = [["entity", "duplicate"]];
+  static usage = Command.Usage({ category: "Entity", description: `Duplicate a shell without activities; optionally copy exclusive child branches (up to ${MAX_DUPLICATED_ENTITIES} entities)` });
+  nameOrId = options_exports.String();
+  space = options_exports.String("--space", { required: true, description: "Source and destination space (name or ID)" });
+  name = options_exports.String("--name", { description: "Root copy name; children keep their exact names" });
+  includeExclusiveChildren = options_exports.Boolean("--include-exclusive-children", false, { description: "Copy nested exclusive children in the selected space" });
+  async run() {
+    const caller = await resolveCaller();
+    const entityId = await resolveEntityC(caller, this.nameOrId);
+    const spaceId = await resolveSpaceByNameC(caller, this.space);
+    const data = await caller.mutation(entitiesDuplicate, {
+      entityId,
+      spaceId,
+      name: this.name,
+      includeExclusiveChildren: this.includeExclusiveChildren
+    });
+    this.emitText({ data }, () => `Duplicated ${data.duplicatedCount} entities (${data.entityId})`);
+  }
+};
 var EntityList = class extends ClientCommand {
   static paths = [["entity", "list"]];
   static usage = Command.Usage({ category: "Entity", description: "List or search entities" });
@@ -11810,6 +11838,8 @@ var EntityCreate = class extends ProfileCommand {
   name = options_exports.String();
   type = options_exports.String("--type", { required: true, description: `Entity type (${ENTITY_TYPE_VALUES.join(", ")})` });
   space = options_exports.String("--space", { required: true, description: "Space to create in (name or ID)" });
+  parent = options_exports.String("--parent", { description: "Create and attach to this parent atomically (name or ID)" });
+  exclusiveParent = options_exports.Boolean("--exclusive-parent", false, { description: "Restrict the new child to --parent" });
   pin = options_exports.Array("--pin", { description: "Pin to other entities (resolved by name)" });
   shareParents = options_exports.Boolean("--share-parents", false, {
     description: "Share pinned parents and ancestors into this entity's space when required"
@@ -11824,11 +11854,15 @@ var EntityCreate = class extends ProfileCommand {
   async run() {
     const caller = await resolveCaller();
     const spaceId = await resolveSpaceByNameC(caller, this.space);
+    if (this.exclusiveParent && !this.parent) throw new Error("--exclusive-parent requires --parent.");
+    if (this.parent && this.pin?.length) throw new Error("Use --parent for atomic child creation, or --pin for legacy parent linking, not both.");
+    const parentEntityId = this.parent ? await resolveEntityC(caller, this.parent) : void 0;
     const attributes = parseAttrs(this.attr);
     const entityId = await caller.mutation(entitiesCreate, {
       spaceId,
       name: this.name,
-      type: this.type
+      type: this.type,
+      ...parentEntityId ? { parentEntityId, exclusiveParent: this.exclusiveParent } : {}
     });
     if (this.alias) for (const a of this.alias) await caller.mutation(entitiesAddAlias, { id: entityId, alias: a });
     if (this.tag) for (const t of this.tag) await caller.mutation(entitiesAddTag, { id: entityId, tag: t });
@@ -12274,6 +12308,7 @@ var ENTITY_COMMANDS = [
   EntityShowCorrection,
   EntityList,
   EntityCreate,
+  EntityDuplicate,
   EntityGet,
   EntityUpdate,
   EntityRename,
@@ -13974,11 +14009,15 @@ var ListShow = class extends ClientCommand {
 };
 var LIST_COMMANDS = [ListCreate, ListAdd, ListColumnAdd, ListColumnRemove, ListShow];
 
+// ente/diagnosticContract.ts
+var DIAGNOSTICS_LIMITS = { rows: 100, bytes: 1048576, windowMs: 6048e5, cursorChars: 8192, grantHours: 24 };
+
 // ente/commands/health.ts
 var healthPage = makeFunctionReference("admin/health:page");
-var HealthRead = class extends ProfileCommand {
+var HealthRead = class extends ClientCommand {
   static paths = [["health", "page"]];
   static usage = Command.Usage({ category: "Admin", description: "Read one content-free operational health page (global admin only)" });
+  agentDiagnostics = false;
   source = options_exports.String("--source", { required: true });
   status = options_exports.String("--status");
   since = options_exports.String("--since", { required: true, description: "Inclusive epoch milliseconds (use 0 for active jobs; positive window for terminal recordings)" });
@@ -13994,18 +14033,25 @@ var HealthRead = class extends ProfileCommand {
     } else if (this.source === "recordings" && ["pending", "transcribing", "structuring", "reflecting", "done", "error"].includes(this.status ?? "")) {
       source = { kind: "recordings", status: this.status };
     } else throw new Error("Use toolMessages without --status, threads with idle/running/error, or recordings with a processing status.");
-    const data = await (await resolveCaller()).query(healthPage, {
+    const args = {
       source,
       since: Number(this.since),
       until: Number(this.until),
       staleAfterMs: Number(this.staleAfter),
       limit: Number(this.limit),
       cursor: this.cursor ?? null
-    });
+    };
+    if (![args.since, args.until, args.staleAfterMs, args.limit].every(Number.isSafeInteger) || args.since < 0 || args.until <= args.since || args.staleAfterMs < 6e4 || args.staleAfterMs > 864e5 || args.limit < 1 || args.limit > DIAGNOSTICS_LIMITS.rows || (args.cursor?.length ?? 0) > DIAGNOSTICS_LIMITS.cursorChars || source.kind === "recordings" && !["done", "error"].includes(source.status) && args.since !== 0 || source.kind === "recordings" && ["done", "error"].includes(source.status) && args.since === 0 || (source.kind === "toolMessages" || source.kind === "recordings" && ["done", "error"].includes(source.status)) && args.until - args.since > DIAGNOSTICS_LIMITS.windowMs) throw new Error("Invalid diagnostics window or limits");
+    const data = this.agentDiagnostics ? (await this.client().diagnostics({ operation: "health", ...args })).data : await (await resolveCaller()).query(healthPage, args);
     this.emitText({ data }, () => JSON.stringify(data, null, 2));
   }
 };
-var HEALTH_COMMANDS = [HealthRead];
+var AgentDiagnosticsRead = class extends HealthRead {
+  static paths = [["diagnostics", "page"]];
+  static usage = Command.Usage({ category: "Diagnostics", description: "Read one explicitly granted content-free health page as the bound personal agent", details: "Default denied. A current human platform admin must grant this exact owned agent read-only diagnostics with expiry. No production grant is enabled by installing or upgrading the CLI. Keep source/window fixed across cursors. Counts are partial until every page has been read; terminal recordings exclude legacy missing timestamps." });
+  agentDiagnostics = true;
+};
+var HEALTH_COMMANDS = [HealthRead, AgentDiagnosticsRead];
 
 // ente/commands/users.ts
 var MANAGED_PLANS = ["free", "sponsored", "company_managed", "own_models"];
@@ -15981,7 +16027,7 @@ Commands:
   ente search <query>          Fuzzy search entities
   ente ask <question>          Natural-language answer (AI synthesis + citations)
   ente query <question>        Deterministic evidence retrieval (no synthesis)
-  ente entity create|get|update|rename|archive|restore|pin|unpin
+  ente entity create|get|update|duplicate|rename|archive|restore|pin|unpin
   ente entity list [--archived]
   ente pins list <entity>      List pins for an entity
   ente task list|get|create|update|done|assign|unassign|set-assignees|clear-assignees
@@ -16012,6 +16058,10 @@ Run \`ente guide <topic>\` for deep dives: entities, tasks, activities, search,
 Create an entity when its identity or relationships will be useful later.
 
 Creating entities:
+  ente entity create "Leistungsphase 1" --type topic --space "Studio" --parent "Building A" --exclusive-parent
+  Creates and attaches an exclusive child atomically; the parent must already be in that space.
+  ente entity duplicate "Building A" --space "Studio" --name "Building B" --include-exclusive-children
+  Copies shells and exclusive child branches without activities (maximum 100 entities).
   ente entity create "Jane Doe" --type person --pin "Acme Corp" --alias "JD"
   # Add --share-parents when the parent is not already in the new entity's space.