crowdtime-cli 0.18.0__tar.gz → 0.19.0__tar.gz

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdtime-cli
-Version: 0.18.0
+Version: 0.19.0
 Summary: AI-powered time tracking CLI — a modern, developer-friendly alternative to Harvest
 Project-URL: Homepage, https://crowdtime.lat
 Project-URL: Documentation, https://crowdtime.lat/docs

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "crowdtime-cli"
-version = "0.18.0"
+version = "0.19.0"
 description = "AI-powered time tracking CLI — a modern, developer-friendly alternative to Harvest"
 readme = "README.md"
 license = {text = "Proprietary"}

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/src/crowdtime_cli/__init__.py

@@ -1,3 +1,3 @@
 """CrowdTime CLI - AI-powered time tracking from the command line."""
 
-__version__ = "0.18.0"
+__version__ = "0.19.0"

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/src/crowdtime_cli/client.py

@@ -133,6 +133,25 @@ class CrowdTimeClient:
         response = self._request("DELETE", url)
         return response
 
+    def current_user_id(self) -> str | None:
+        """The authenticated user's id, cached in the config after the first lookup.
+
+        ``ct auth login`` refreshes the cache and ``ct auth logout`` clears it,
+        so the cached id always belongs to the stored token.
+        """
+        cached = self.config.get("user.id")
+        if cached:
+            return str(cached)
+        try:
+            me = self.get("/auth/me/", org_scoped=False)
+        except APIError:
+            return None
+        user_id = me.get("id") if isinstance(me, dict) else None
+        if not user_id:
+            return None
+        self.config.set("user.id", str(user_id))
+        return str(user_id)
+
     def _request(self, method: str, url: str, **kwargs: Any) -> Any:
         """Execute an HTTP request with error handling."""
         if _DEBUG:

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/auth_cmd.py

@@ -59,6 +59,7 @@ def _login_with_token(token: str, output_json: bool) -> None:
         client = CrowdTimeClient(require_auth=True, require_org=False)
         data = client.get("/api/v1/auth/me/", org_scoped=False)
         user = User(**data)
+        get_config().set("user.id", user.id)  # read back by current_user_id()
 
         if output_json:
             print_json(user)
@@ -118,6 +119,7 @@ def _login_with_browser(output_json: bool) -> None:
         client = CrowdTimeClient(require_auth=True, require_org=False)
         data = client.get("/api/v1/auth/me/", org_scoped=False)
         user = User(**data)
+        config.set("user.id", user.id)  # read back by current_user_id()
 
         if output_json:
             print_json(user)
@@ -140,6 +142,7 @@ def logout() -> None:
         return
 
     clear_token()
+    get_config().set("user.id", "")
     format_success("Logged out. Token removed.")
 
 

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/clients_cmd.py

@@ -84,7 +84,9 @@ def list_clients(
             for c in clients_list:
                 client_id = str(c.get("id", ""))
                 name = c.get("name", "")
-                contact = c.get("contact_name", "") or "-"
+                # The primary contact record; contact_name is a legacy field (CRO-83).
+                primary = c.get("primary_contact") or {}
+                contact = primary.get("name") or c.get("contact_name", "") or "-"
                 project_count = str(c.get("project_count", 0))
                 is_archived = c.get("is_archived", False)
                 status = "[red]Archived[/red]" if is_archived else "[green]Active[/green]"
@@ -117,11 +119,30 @@ def show(
             console.print(f"\n[bold]{data.get('name')}[/bold]")
             console.print(f"  ID:       {data.get('id')}")
             console.print(f"  Currency: {data.get('currency', '-')}")
-            console.print(f"  Contact:  {data.get('contact_name', '-')}")
-            if data.get("contact_email"):
-                console.print(f"  Email:    {data['contact_email']}")
-            if data.get("contact_phone"):
-                console.print(f"  Phone:    {data['contact_phone']}")
+            contacts = data.get("contacts") or []
+            if contacts:
+                for contact in contacts:
+                    line = f"  Contact:  {contact.get('name', '')}"
+                    if contact.get("email"):
+                        line += f" <{contact['email']}>"
+                    if contact.get("phone"):
+                        line += f" {contact['phone']}"
+                    if contact.get("role"):
+                        line += f" — {contact['role']}"
+                    flags = [
+                        label for key, label in (("is_primary", "primary"), ("receives_invoices", "invoices"))
+                        if contact.get(key)
+                    ]
+                    if flags:
+                        line += f" [dim]({', '.join(flags)})[/dim]"
+                    console.print(line)
+            else:
+                # Legacy contact fields, only on clients that never got a contact record.
+                console.print(f"  Contact:  {data.get('contact_name') or '-'}")
+                if data.get("contact_email"):
+                    console.print(f"  Email:    {data['contact_email']}")
+                if data.get("contact_phone"):
+                    console.print(f"  Phone:    {data['contact_phone']}")
             if data.get("address"):
                 console.print(f"  Address:  {data['address']}")
             status = "Archived" if data.get("is_archived") else "Active"
@@ -149,7 +170,7 @@ def create(
     country: Optional[str] = typer.Option(None, "--country", help="Country."),
     output_json: bool = typer.Option(False, "--json", help="Output as JSON."),
 ) -> None:
-    """Create a new client.
+    """Create a new client. --contact/--email add its primary contact.
 
     Examples:
         ct clients create "Acme Corp"
@@ -157,13 +178,13 @@ def create(
     """
     api_client = CrowdTimeClient(require_auth=True, require_org=True)
 
+    if contact_email and not contact_name:
+        format_error("--email needs --contact (the contact's name).")
+        raise typer.Exit(1)
+
     payload: dict = {"name": name}
     if currency:
         payload["currency"] = currency
-    if contact_name:
-        payload["contact_name"] = contact_name
-    if contact_email:
-        payload["contact_email"] = contact_email
     if address_line1:
         payload["address_line1"] = address_line1
     if address_line2:
@@ -180,10 +201,22 @@ def create(
     try:
         data = api_client.post("/clients/", data=payload)
 
+        # Contacts are records of their own, shown on the client page and used
+        # for invoicing — not the legacy contact_* fields on the client (CRO-83).
+        if contact_name:
+            contact = api_client.post(f"/clients/{data.get('id')}/contacts/", data={
+                "name": contact_name,
+                "email": contact_email or "",
+                "is_primary": True,
+            })
+            data["contacts"] = [contact]
+
         if output_json:
             print_json(data)
         else:
             format_success(f"Client '{data.get('name')}' created (ID: {data.get('id')})")
+            if contact_name:
+                console.print(f"  Primary contact: {contact_name}" + (f" <{contact_email}>" if contact_email else ""))
     except APIError as e:
         format_error(e.message)
         raise typer.Exit(1)
@@ -203,7 +236,7 @@ def edit(
     country: Optional[str] = typer.Option(None, "--country", help="Country."),
     output_json: bool = typer.Option(False, "--json", help="Output as JSON."),
 ) -> None:
-    """Edit an existing client.
+    """Edit an existing client. --contact/--email update its primary contact.
 
     Examples:
         ct clients edit <client-id> --name "New Name"
@@ -216,10 +249,6 @@ def edit(
         payload["name"] = name
     if currency is not None:
         payload["currency"] = currency
-    if contact_name is not None:
-        payload["contact_name"] = contact_name
-    if contact_email is not None:
-        payload["contact_email"] = contact_email
     if address_line1 is not None:
         payload["address_line1"] = address_line1
     if city is not None:
@@ -231,12 +260,35 @@ def edit(
     if country is not None:
         payload["country"] = country
 
-    if not payload:
+    contact_payload: dict = {}
+    if contact_name is not None:
+        contact_payload["name"] = contact_name
+    if contact_email is not None:
+        contact_payload["email"] = contact_email
+
+    if not payload and not contact_payload:
         format_error("No changes specified. Use --name, --currency, --contact, etc.")
         raise typer.Exit(1)
 
     try:
-        data = api_client.patch(f"/clients/{client_id}/", data=payload)
+        if payload:
+            data = api_client.patch(f"/clients/{client_id}/", data=payload)
+        else:
+            data = api_client.get(f"/clients/{client_id}/")
+
+        # Contacts are records of their own, shown on the client page and used
+        # for invoicing (CRO-83): update the primary one, or create it.
+        if contact_payload:
+            contacts = extract_results(api_client.get(f"/clients/{client_id}/contacts/"))
+            primary = next((c for c in contacts if c.get("is_primary")), contacts[0] if contacts else None)
+            if primary:
+                api_client.patch(f"/clients/{client_id}/contacts/{primary['id']}/", data=contact_payload)
+            elif contact_payload.get("name"):
+                api_client.post(f"/clients/{client_id}/contacts/", data={**contact_payload, "is_primary": True})
+            else:
+                format_error("This client has no contact yet — pass --contact (the contact's name) with --email.")
+                raise typer.Exit(1)
+            data = api_client.get(f"/clients/{client_id}/")
 
         if output_json:
             print_json(data)

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/log_cmd.py

@@ -381,11 +381,23 @@ def list_entries(
     task: Optional[str] = typer.Option(None, "--task", "-t", help="Filter by task name or ID."),
     billable: Optional[bool] = typer.Option(None, "--billable/--no-billable", "-b/-B",
                                             help="Filter by billable status."),
-    user: Optional[str] = typer.Option(None, "--user", "-u", help="Filter by user ID (manager+ only)."),
+    user: Optional[str] = typer.Option(
+        None, "--user", "-u",
+        help="Filter by user ID. Only people whose time you can see: yourself, your direct "
+             "reports (manager), and anyone on projects you manage (project manager).",
+    ),
+    mine: bool = typer.Option(
+        False, "--mine",
+        help="Only your own entries. Managers and project managers otherwise also see "
+             "the time of the people and projects they manage.",
+    ),
     format_output: str = typer.Option("table", "--format", help="Output format: table, json, csv."),
     output_json: bool = typer.Option(False, "--json", help="Output as JSON."),
 ) -> None:
-    """List time entries with optional filters."""
+    """List time entries with optional filters.
+
+    The table and CSV show a User column whenever an entry isn't yours.
+    """
     effective_date = date
     if today_flag:
         effective_date = "today"
@@ -402,6 +414,7 @@ def list_entries(
         task=task,
         billable=billable,
         user=user,
+        mine=mine,
         format_output=format_output,
         output_json=output_json,
     )
@@ -417,6 +430,7 @@ def _list_entries(
     task: str | None = None,
     billable: bool | None = None,
     user: str | None = None,
+    mine: bool = False,
     format_output: str = "table",
     output_json: bool = False,
 ) -> None:
@@ -425,6 +439,14 @@ def _list_entries(
 
     client = CrowdTimeClient(require_auth=True, require_org=True)
 
+    # Known up front so other people's entries can be told apart (CRO-85).
+    me = client.current_user_id()
+    if mine:
+        if not me:
+            format_error("Could not resolve your user id. Run ct auth login again.")
+            raise typer.Exit(1)
+        user = me
+
     params: dict = {}
 
     if date_str:
@@ -484,7 +506,10 @@ def _list_entries(
         elif format_output == "csv":
             _print_csv(entries)
         else:
-            format_entries_table(entries, show_date=True)
+            # Someone else's entry with no owner column looks like your own;
+            # the column appears as soon as the list holds one (CRO-85).
+            foreign = any(e.user and e.user != me for e in entries)
+            format_entries_table(entries, show_date=True, show_user=bool(user) or foreign)
     except APIError as e:
         format_error(e.message)
         raise typer.Exit(1)
@@ -492,13 +517,14 @@ def _list_entries(
 
 def _print_csv(entries: list[TimeEntry]) -> None:
     """Print entries as CSV (plain output, safe for piping)."""
-    print("id,date,project,task,description,duration,billable,hourly_rate,billable_amount")
+    print("id,date,user,project,task,description,duration,billable,hourly_rate,billable_amount")
     for e in entries:
         desc = (e.description or "").replace('"', '""')
+        user_name = (e.user_name or "").replace('"', '""')
         rate = getattr(e, "hourly_rate", None) or ""
         amount = getattr(e, "billable_amount", None) or ""
         print(
-            f'{e.id},{e.date or ""},'
+            f'{e.id},{e.date or ""},"{user_name}",'
             f'{e.project_name or ""},{e.task_name or ""},'
             f'"{desc}",{e.duration or 0},'
             f'{"yes" if e.is_billable else "no"},'

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/timesheet_cmd.py

@@ -181,22 +181,42 @@ def timesheet_default(ctx: typer.Context) -> None:
 
 @app.command("list")
 def list_timesheets(
-    user: Optional[str] = typer.Option(None, "--user", "-u", help="User ID to view (manager+)."),
+    user: Optional[str] = typer.Option(
+        None, "--user", "-u",
+        help="User ID to view. Only people whose timesheets you can see: yourself, your "
+             "direct reports (manager), and people on projects you manage (project manager).",
+    ),
+    mine: bool = typer.Option(
+        False, "--mine",
+        help="Only your own timesheets. Managers and project managers otherwise also see "
+             "the timesheets of the people and projects they manage.",
+    ),
     status_filter: Optional[str] = typer.Option(
         None, "--status", "-s",
         help="Filter by status: draft, submitted, approved, rejected.",
     ),
     output_json: bool = typer.Option(False, "--json", help="Output as JSON."),
 ) -> None:
-    """List timesheets. Managers can view other users' timesheets.
+    """List timesheets. The table shows a User column whenever one isn't yours.
+
+    A project manager sees a teammate's timesheet trimmed to the projects they
+    manage; a manager sees their direct reports' whole timesheets.
 
     Examples:
         ct timesheet list
+        ct timesheet list --mine
         ct timesheet list --user <user-id>
         ct timesheet list --status submitted
     """
     client = CrowdTimeClient(require_auth=True, require_org=True)
 
+    me = client.current_user_id()
+    if mine:
+        if not me:
+            format_error("Could not resolve your user id. Run ct auth login again.")
+            raise typer.Exit(1)
+        user = me
+
     params: dict = {}
     if user:
         params["user_id"] = user
@@ -210,8 +230,9 @@ def list_timesheets(
         if output_json:
             print_json(results)
         else:
-            # Show user column when filtering by status (manager view) or by user
-            _print_timesheets_table(results, show_user=bool(user or status_filter))
+            # Someone else's timesheet with no owner column looks like yours (CRO-85).
+            foreign = any(ts.get("user") and ts.get("user") != me for ts in results)
+            _print_timesheets_table(results, show_user=bool(user or status_filter) or foreign)
     except APIError as e:
         format_error(e.message)
         raise typer.Exit(1)

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/src/crowdtime_cli/formatters.py

@@ -195,8 +195,14 @@ def format_favorite_detail(fav: FavoriteEntry) -> None:
     console.print(table)
 
 
-def format_entries_table(entries: list[TimeEntry], show_date: bool = True) -> None:
-    """Display time entries in a Rich table."""
+def format_entries_table(
+    entries: list[TimeEntry], show_date: bool = True, show_user: bool = False,
+) -> None:
+    """Display time entries in a Rich table.
+
+    ``show_user`` adds the owner column — needed whenever the list can hold
+    someone else's entries, which otherwise look like your own (CRO-85).
+    """
     if not entries:
         console.print("[dim]No entries found.[/dim]")
         return
@@ -205,6 +211,8 @@ def format_entries_table(entries: list[TimeEntry], show_date: bool = True) -> No
     table.add_column("ID", style="dim")
     if show_date:
         table.add_column("Date", width=12)
+    if show_user:
+        table.add_column("User", width=18)
     table.add_column("Project", style="cyan", width=15)
     table.add_column("Task", style="dim", width=15)
     table.add_column("Description", width=35)
@@ -215,6 +223,8 @@ def format_entries_table(entries: list[TimeEntry], show_date: bool = True) -> No
         row: list[str] = [str(entry.id)]
         if show_date:
             row.append(str(entry.date or ""))
+        if show_user:
+            row.append(entry.user_name or "")
         row.extend([
             entry.project_name or "",
             entry.task_name or "",
@@ -540,16 +550,27 @@ def format_members_table(members: list[dict[str, Any]]) -> None:
     table.add_column("Name", width=20)
     table.add_column("Email", width=25)
     table.add_column("Role", width=18)
+    table.add_column("Projects", width=30)
     table.add_column("Status", width=10)
 
     for m in members:
+        # The API nests the user; older callers passed flattened user_* keys.
+        user = m.get("user") if isinstance(m.get("user"), dict) else {}
+        name = m.get("user_name") or user.get("full_name") or user.get("email", "")
+        email = m.get("user_email") or user.get("email", "")
         status = "[green]Active[/green]" if m.get("is_active", True) else "[dim]Inactive[/dim]"
         role = m.get("role", "member")
         role_label = ROLE_LABELS.get(role, role)
+        # Project assignments, the ones they run marked (CRO-84).
+        projects = ", ".join(
+            p.get("name", "") + (" (PM)" if p.get("project_role") == "project_manager" else "")
+            for p in (m.get("projects") or [])
+        )
         table.add_row(
-            m.get("user_name", ""),
-            m.get("user_email", ""),
+            name,
+            email,
             role_label,
+            truncate(projects, 30) if projects else "[dim]-[/dim]",
             status,
         )
 

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/src/crowdtime_cli/skills/crowdtime/SKILL.md

@@ -183,9 +183,13 @@ IDs — it lists every active org member not already on the project. Do not use
 a different and narrower set.
 
 **Per-project roles:** setting `--role project_manager` on a project member
-grants them management of *that project only* (adding members, editing it,
-managing its tasks), whatever their organization role is. That is the way to
-let a member run one project without making them an org-wide project manager.
+makes them run *that project only* — editing it, adding members, managing its
+tasks, seeing everyone's time on it and approving its timesheet portions —
+whatever their organization role is (an org `member` included). It is also
+the **only** way an org-level `project_manager` gets any of that on a project:
+being added as a plain member grants nothing beyond logging time there
+(CRO-85). Whole-timesheet review, team overviews and leave approval stay with
+org-level managers and project managers.
 
 #### Bulk Task Assignment
 ```bash
@@ -488,7 +492,7 @@ All mutating commands (`assign`, `unassign`, `set`) hit the atomic `bulk-set` en
 
 **Visibility rule** — what a `manager` or `project_manager` sees of other people:
 1. **Direct reports** (assigned via `ct team assign`) — everything: all their time entries on any project, their whole timesheets, utilization, compliance and anomalies.
-2. **Projects they manage** (`project_role = project_manager`, or an org-level manager/PM who is a member of the project) — every entry logged on those projects, by anyone, and that project's portion of each person's timesheet. **Not** the rest of those people's work: time a teammate logged on other projects or clients is hidden, and people-level reports (`ct report team`, `ct insights team|allocations`, `ct timesheet compliance`) leave them out.
+2. **Projects they run** (set as `project_role = project_manager` on the project explicitly — whatever their org role, an org `member` included — or an org-level manager/admin who is a member of it; an org-level `project_manager` added as a plain member does **not** count) — every entry logged on those projects, by anyone, and that project's portion of each person's timesheet. **Not** the rest of those people's work: time a teammate logged on other projects or clients is hidden, and people-level reports (`ct report team`, `ct insights team|allocations`, `ct timesheet compliance`) leave them out.
 3. **Time off** is the exception: a project manager still sees, creates and approves PTO for the people on their projects (see PTO).
 
 A `manager` with **zero** direct reports and **zero** managed projects sees only their own entries. `admin` and `owner` always see everything. `member` sees only their own data. `viewer` sees entries on their assigned projects, but nobody else's timesheets or expenses. To give someone cross-project visibility of a person, make that person their direct report; for project-scoped visibility, make them PM of the project.

{crowdtime_cli-0.18.0 → crowdtime_cli-0.19.0}/src/crowdtime_cli/skills/crowdtime/references/commands.md

@@ -300,6 +300,8 @@ ct l -p crowdtime-dev -t "Design" 1:30 "wireframes"
 | Days | `0.25d` | 2.0 hours (1d = 8h) |
 | Decimal | `2.5` | 2.5 hours |
 
+Any precision is accepted and rounded half-up to 2 decimals (`1:20` → 1.33h). `0` is valid and logs a zero-hour entry; negative durations are refused.
+
 **Date formats:**
 | Format | Example |
 |--------|---------|
@@ -382,10 +384,13 @@ ct log list [options]
 | `--project`, `-p` | string | Filter by project |
 | `--task`, `-t` | string | Filter by task name or ID |
 | `--billable/-B` | flag | Filter billable / non-billable entries |
-| `--user`, `-u` | string | Filter by user ID (manager+ only) |
+| `--user`, `-u` | string | Filter by user ID. Only people whose time you can see: yourself, your direct reports (manager), anyone on projects you manage (explicit project manager) |
+| `--mine` | flag | Only your own entries |
 | `--format` | string | Output: `table`, `json`, `csv` |
 | `--json` | flag | JSON output |
 
+**Whose entries come back.** `member` and `viewer`-free lists are your own. A `manager` also gets their direct reports' entries; a project manager also gets everything logged on the projects where they are set as `project_manager` explicitly; `admin`/`owner` get everyone's. Every row carries `user` / `user_name` in JSON, the table adds a **User** column as soon as one row isn't yours, and CSV always has a `user` column (`id,date,user,project,task,description,duration,billable,hourly_rate,billable_amount`). Never assume a listed entry is the caller's — check `user`, or pass `--mine`.
+
 CSV output includes financial columns: `hourly_rate`, `billable_amount`. They are empty for viewers, members and project managers (rates and amounts are manager+ only).
 
 Endpoint: `GET /time/`
@@ -435,7 +440,7 @@ ct clients list [--archived/-a] [--json]
 | `--archived`, `-a` | flag | Include archived clients |
 | `--json` | flag | JSON output |
 
-Shows: ID, Name, Contact, Projects count, Status.
+Shows: ID, Name, Contact, Projects count, Status. The Contact column is the client's primary contact record (`primary_contact` in JSON: `{id, name, email}` or `null`); the `contact_name` field is legacy and no longer edited anywhere.
 Endpoint: `GET /clients/`
 
 ### ct clients show
@@ -444,7 +449,7 @@ Endpoint: `GET /clients/`
 ct clients show CLIENT_ID [--json]
 ```
 
-Shows: ID, name, currency, contact info, status.
+Shows: ID, name, currency, every contact (`contacts[]` in JSON, with `is_primary` / `receives_invoices`), address, status. Contacts are managed with `ct clients contacts ...`.
 Endpoint: `GET /clients/{id}/`
 
 ### ct clients create
@@ -456,8 +461,8 @@ ct clients create NAME [options]
 | Option | Type | Description |
 |--------|------|-------------|
 | `--currency` | string | Currency code (e.g. USD) |
-| `--contact` | string | Contact person name |
-| `--email` | string | Contact email |
+| `--contact` | string | Name of the primary contact — created as a contact record (`POST /clients/{id}/contacts/`) |
+| `--email` | string | Email of that contact (needs `--contact`) |
 | `--address-line1` | string | Street address |
 | `--address-line2` | string | Suite, unit, etc. |
 | `--city` | string | City |
@@ -478,8 +483,8 @@ ct clients edit CLIENT_ID [options]
 |--------|------|-------------|
 | `--name` | string | New client name |
 | `--currency` | string | Currency code (e.g. EUR) |
-| `--contact` | string | Contact person name |
-| `--email` | string | Contact email |
+| `--contact` | string | Primary contact's name — updates the primary contact record, or creates it |
+| `--email` | string | Primary contact's email (with `--contact` when the client has no contact yet) |
 | `--address-line1` | string | Street address |
 | `--city` | string | City |
 | `--state` | string | State or province |
@@ -1115,7 +1120,7 @@ ct projects update-member PROJECT_ID USER_ID [options]
 | `--rate` | float | Hourly rate override for this project member (manager+; ignored for other roles) |
 | `--json` | flag | JSON output |
 
-Updates a member's project-specific role and/or rate. The `--role` sets a `project_role` that overrides the member's org-level role for this project only. Response includes `effective_role`, `org_role`, and `org_hourly_rate` for context.
+Updates a member's project-specific role and/or rate. The `--role` sets a `project_role` that overrides the member's org-level role for this project only. An org-level `project_manager` manages (and sees other people's time on) only the projects where this is set to `project_manager` explicitly — without it they are a plain member of the project. Response includes `effective_role`, `org_role`, and `org_hourly_rate` for context.
 
 **Usage examples:**
 ```bash
@@ -1137,7 +1142,7 @@ ct projects assignable-users PROJECT_ID [--json]
 
 Lists every **active organization member not already on the project**, with their user IDs and org roles. This is the correct source for the user IDs that `ct projects add-members` needs.
 
-It is deliberately not filtered by review visibility — `ct team list` and the timesheet endpoints answer "whose time can I review", which is a narrower set and the wrong question when staffing a project. Requires permission to manage the project (org project_manager+ assigned to it, an account manager or above, or a per-project `project_role` of `project_manager`). Endpoint: `GET /projects/<id>/assignable-users/`
+It is deliberately not filtered by review visibility — `ct team list` and the timesheet endpoints answer "whose time can I review", which is a narrower set and the wrong question when staffing a project. Requires permission to manage the project (an account manager or above, or a per-project `project_role` of `project_manager` — an org-level project manager needs that explicit role too). Endpoint: `GET /projects/<id>/assignable-users/`
 
 ### ct projects add-members
 
@@ -1557,7 +1562,7 @@ Switches active organization. Saves to config `defaults.organization`.
 ct org members [--json]
 ```
 
-Shows: Name, Email, Role, Status. Requires manager+ role. Endpoint: `GET /members/`
+Shows: Name, Email, Role, Projects, Status. Requires manager+ role. Each member carries `projects[]` in JSON — `{id, name, code, status, project_role}` for every project they are on; `project_role` is `"project_manager"` when they run it (shown as "(PM)" in the table). Endpoint: `GET /members/`
 
 ### ct org invite
 
@@ -1589,7 +1594,7 @@ ct org update-member USER_ID [options]
 | `USER_ID` | string (required) | User UUID |
 | `--role`, `-r` | string | New org role: admin, manager, project_manager, member, viewer |
 | `--rate` | string | Hourly rate |
-| `--capacity` | float | Weekly capacity hours |
+| `--capacity` | float | Weekly capacity hours (0–168, rounded to 1 decimal; 0 is allowed) |
 | `--json` | flag | Output as JSON |
 
 Updates an organization member's role, hourly rate, or weekly capacity (admin+). Nobody can grant a role above their own or edit someone who outranks them (`403`); the `owner` role cannot be assigned and the owner's role cannot be changed (`400`); only the owner can change the owner's membership at all. Deactivating a member this way also revokes their API tokens and pending invitations.
@@ -1715,16 +1720,17 @@ compact = false
 ### ct timesheet list
 
 ```
-ct timesheet list [--user USER_ID] [--status STATUS] [--json]
+ct timesheet list [--user USER_ID] [--mine] [--status STATUS] [--json]
 ```
 
 | Option | Type | Description |
 |--------|------|-------------|
-| `--user`, `-u` | string | User ID to view (manager+) |
+| `--user`, `-u` | string | User ID to view. Only people whose timesheets you can see: yourself, your direct reports (manager), people on projects you manage (explicit project manager) |
+| `--mine` | flag | Only your own timesheets |
 | `--status`, `-s` | string | Filter: `draft`, `submitted`, `approved`, `rejected` |
 | `--json` | flag | JSON output |
 
-Lists your timesheets (or all viewable timesheets for managers). Endpoint: `GET /timesheets/`
+Lists your timesheets, plus — for managers and project managers — the timesheets of the people they manage. A project manager sees a teammate's timesheet trimmed to the projects they manage (`project_approvals`, `total_hours`, `entry_count` cover only those). Rows carry `user` / `user_name`; the table adds a **User** column as soon as one row isn't yours. Never assume a listed timesheet is the caller's — check `user`, or pass `--mine`. Endpoint: `GET /timesheets/`
 
 ### ct timesheet submit
 
@@ -2658,7 +2664,7 @@ Endpoint: `POST /manager-assignments/bulk-set/` with both `add` and `remove` com
 A `manager` or `project_manager` sees time entries, timesheets, and team reports only for users in their **visible set**, which is the union of:
 
 1. **Direct reports** — members in `ct team list --manager me`.
-2. **PM-project members** — users of projects where the caller holds `project_role = project_manager` (see `ct projects update-member`).
+2. **PM-project members** — users of projects where the caller holds `project_role = project_manager` (see `ct projects update-member`). This works for any org role — an org `member` promoted on one project sees its time and approves its portions (`ct timesheet approve --project`) — and being on a project without that explicit role grants nothing, whatever the org role (CRO-85).
 
 A `manager` with **zero** assignments and **zero** PM projects sees only their own entries. `admin` and `owner` always see everything.