fullstackgtm 0.14.0 → 0.14.1

package/CHANGELOG.md

@@ -5,6 +5,26 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and the project adheres to [Semantic Versioning](https://semver.org/).
 The path to 1.0 is planned in [docs/roadmap-to-1.0.md](./docs/roadmap-to-1.0.md).
 
+## [0.14.1] — 2026-06-11
+
+Fixes from the 0.14.0 journey verification (4 agents, 21 checks).
+
+### Fixed
+
+- **`call score` no longer suggests a flag it rejects**: the keyless error
+  said "pass --deterministic" but score has no non-LLM mode — its error now
+  says exactly that. Rubric files are also validated *before* the
+  credential check (keyless users see rubric errors), and a non-JSON rubric
+  names the file and the expected shape instead of a raw parse error.
+- **NDJSON rows carry `extractor`** — LLM and deterministic rows were
+  per-row indistinguishable in warehouse loads, contradicting the
+  provenance claim. (Docs wording was right at the parse-result and
+  evidence level; now it is true per-row too.)
+- **`call … --help` prints help** instead of being shadowed by argument
+  and credential checks.
+- `login anthropic|openai` gets the same explicit argv-secret rejection
+  (`--token`/`--key`/`--api-key`) as the CRM providers.
+
 ## [0.14.0] — 2026-06-11
 
 LLM-powered call intelligence, bring-your-own-key. The dry-run replications

package/dist/cli.js

@@ -418,6 +418,17 @@ function parseValueOverrides(args) {
 }
 async function callCommand(args) {
     const [subcommand, ...rest] = args;
+    if (args.includes("--help") || args.includes("-h")) {
+        console.log(`call parse --transcript <file> [--title t] [--source s] [--model m] [--deterministic] [--json|--ndjson] [--out <path>]
+call score --transcript <file>|--call <parsed.json> [--rubric <rubric.json>] [--model m] [--json|--out <path>]
+call link --attendees <a@x.com,...> | --domain <x.com>  [source options] [--json]
+call plan --transcript <file>|--call <parsed.json> --deal <id> [source options] [--save|--json]
+
+parse/score default to LLM extraction (Anthropic or OpenAI key via env,
+\`login anthropic|openai\`, or a one-time prompt). parse --deterministic is
+the free keyword baseline; score always needs a key (scoring is LLM work).`);
+        return;
+    }
     const loadParsedCall = async () => {
         const callPath = option(rest, "--call");
         if (callPath) {
@@ -462,6 +473,7 @@ async function callCommand(args) {
                     call_id: parsed.id,
                     call_title: parsed.title ?? null,
                     source_system: parsed.sourceSystem,
+                    extractor: parsed.extractor,
                     type: insight.type,
                     title: insight.title,
                     text: insight.text,
@@ -534,11 +546,19 @@ async function callCommand(args) {
         return;
     }
     if (subcommand === "score") {
-        const credential = await requireLlmCredential();
+        // Rubric problems surface before any credential or API work.
         const rubricPath = option(rest, "--rubric");
-        const rubric = rubricPath
-            ? parseRubric(readFileSync(resolve(process.cwd(), rubricPath), "utf8"))
-            : DEFAULT_RUBRIC;
+        let rubric = DEFAULT_RUBRIC;
+        if (rubricPath) {
+            const rubricRaw = readFileSync(resolve(process.cwd(), rubricPath), "utf8");
+            try {
+                rubric = parseRubric(rubricRaw);
+            }
+            catch (error) {
+                throw new Error(`${rubricPath} is not a valid rubric: ${error instanceof Error ? error.message : String(error)} Expected JSON like { "scale": 5, "dimensions": [{ "name": "...", "weight": 1, "rubric": "..." }] }.`);
+            }
+        }
+        const credential = await requireLlmCredential("score");
         const transcriptPath = option(rest, "--transcript");
         let transcriptText;
         let title = option(rest, "--title") ?? undefined;
@@ -577,12 +597,14 @@ async function callCommand(args) {
  * TTY a missing key is captured once (validated, stored 0600 like provider
  * logins). Non-interactive contexts get an actionable error instead.
  */
-async function requireLlmCredential() {
+async function requireLlmCredential(command = "parse") {
     const resolved = resolveLlmCredential();
     if (resolved)
         return resolved;
+    // Scoring is inherently LLM work — there is no keyword fallback to suggest.
+    const fallbackHint = command === "parse" ? ", or pass --deterministic for the free keyword baseline" : " (call score has no non-LLM mode)";
     if (!process.stdin.isTTY) {
-        throw new Error("LLM extraction needs an API key. Set ANTHROPIC_API_KEY or OPENAI_API_KEY, run `echo \"$KEY\" | fullstackgtm login anthropic` (or `login openai`) once, or pass --deterministic for the free keyword baseline.");
+        throw new Error(`LLM ${command === "score" ? "scoring" : "extraction"} needs an API key. Set ANTHROPIC_API_KEY or OPENAI_API_KEY, or run \`echo "$KEY" | fullstackgtm login anthropic\` (or \`login openai\`) once${fallbackHint}.`);
     }
     console.error("LLM parsing needs an API key (Anthropic or OpenAI) — yours, used directly with the provider.");
     console.error(`Paste it once; it is validated and stored at ${credentialsPath()} (file mode 0600), like CRM logins.`);
@@ -1177,6 +1199,7 @@ async function login(args) {
         return;
     }
     if (provider === "anthropic" || provider === "openai") {
+        rejectArgvSecret(args, "--token", "--key", "--api-key");
         const key = await readSecret(`${provider} API key (${provider === "anthropic" ? "sk-ant-..." : "sk-..."})`);
         if (!key)
             throw new Error(`No ${provider} key provided.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM",

package/src/cli.ts

@@ -490,6 +490,17 @@ function parseValueOverrides(args: string[]) {
 
 async function callCommand(args: string[]) {
   const [subcommand, ...rest] = args;
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`call parse --transcript <file> [--title t] [--source s] [--model m] [--deterministic] [--json|--ndjson] [--out <path>]
+call score --transcript <file>|--call <parsed.json> [--rubric <rubric.json>] [--model m] [--json|--out <path>]
+call link --attendees <a@x.com,...> | --domain <x.com>  [source options] [--json]
+call plan --transcript <file>|--call <parsed.json> --deal <id> [source options] [--save|--json]
+
+parse/score default to LLM extraction (Anthropic or OpenAI key via env,
+\`login anthropic|openai\`, or a one-time prompt). parse --deterministic is
+the free keyword baseline; score always needs a key (scoring is LLM work).`);
+    return;
+  }
 
   const loadParsedCall = async (): Promise<ParsedCall> => {
     const callPath = option(rest, "--call");
@@ -535,6 +546,7 @@ async function callCommand(args: string[]) {
             call_id: parsed.id,
             call_title: parsed.title ?? null,
             source_system: parsed.sourceSystem,
+            extractor: parsed.extractor,
             type: insight.type,
             title: insight.title,
             text: insight.text,
@@ -609,11 +621,20 @@ async function callCommand(args: string[]) {
   }
 
   if (subcommand === "score") {
-    const credential = await requireLlmCredential();
+    // Rubric problems surface before any credential or API work.
     const rubricPath = option(rest, "--rubric");
-    const rubric = rubricPath
-      ? parseRubric(readFileSync(resolve(process.cwd(), rubricPath), "utf8"))
-      : DEFAULT_RUBRIC;
+    let rubric = DEFAULT_RUBRIC;
+    if (rubricPath) {
+      const rubricRaw = readFileSync(resolve(process.cwd(), rubricPath), "utf8");
+      try {
+        rubric = parseRubric(rubricRaw);
+      } catch (error) {
+        throw new Error(
+          `${rubricPath} is not a valid rubric: ${error instanceof Error ? error.message : String(error)} Expected JSON like { "scale": 5, "dimensions": [{ "name": "...", "weight": 1, "rubric": "..." }] }.`,
+        );
+      }
+    }
+    const credential = await requireLlmCredential("score");
     const transcriptPath = option(rest, "--transcript");
     let transcriptText: string;
     let title = option(rest, "--title") ?? undefined;
@@ -651,12 +672,15 @@ async function callCommand(args: string[]) {
  * TTY a missing key is captured once (validated, stored 0600 like provider
  * logins). Non-interactive contexts get an actionable error instead.
  */
-async function requireLlmCredential(): Promise<{ provider: LlmProvider; apiKey: string }> {
+async function requireLlmCredential(command: "parse" | "score" = "parse"): Promise<{ provider: LlmProvider; apiKey: string }> {
   const resolved = resolveLlmCredential();
   if (resolved) return resolved;
+  // Scoring is inherently LLM work — there is no keyword fallback to suggest.
+  const fallbackHint =
+    command === "parse" ? ", or pass --deterministic for the free keyword baseline" : " (call score has no non-LLM mode)";
   if (!process.stdin.isTTY) {
     throw new Error(
-      "LLM extraction needs an API key. Set ANTHROPIC_API_KEY or OPENAI_API_KEY, run `echo \"$KEY\" | fullstackgtm login anthropic` (or `login openai`) once, or pass --deterministic for the free keyword baseline.",
+      `LLM ${command === "score" ? "scoring" : "extraction"} needs an API key. Set ANTHROPIC_API_KEY or OPENAI_API_KEY, or run \`echo "$KEY" | fullstackgtm login anthropic\` (or \`login openai\`) once${fallbackHint}.`,
     );
   }
   console.error("LLM parsing needs an API key (Anthropic or OpenAI) — yours, used directly with the provider.");
@@ -1325,6 +1349,7 @@ async function login(args: string[]) {
     return;
   }
   if (provider === "anthropic" || provider === "openai") {
+    rejectArgvSecret(args, "--token", "--key", "--api-key");
     const key = await readSecret(`${provider} API key (${provider === "anthropic" ? "sk-ant-..." : "sk-..."})`);
     if (!key) throw new Error(`No ${provider} key provided.`);
     if (!args.includes("--no-validate")) {