dailybot-cli 3.14.3__tar.gz → 3.15.0__tar.gz

{dailybot_cli-3.14.3 → dailybot_cli-3.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dailybot-cli
-Version: 3.14.3
+Version: 3.15.0
 Summary: Dailybot CLI - The command-line bridge between humans and agents. Progress reports, observability, and workflow automation for modern teams across Slack, Google Chat, Discord, MS Teams, and more.
 Author-email: Dailybot <support@dailybot.com>
 License: MIT
@@ -905,11 +905,13 @@ Replies to agent emails land as messages retrievable via `dailybot agent message
 Projects, boards and tasks. Two groups: **`dailybot tasks`** answers questions about the
 workspace, **`dailybot task`** reads or changes one task.
 
-**Structure changes need a signed-in organization admin.** Creating, updating, archiving or
-restoring boards, columns, projects and goals, board and project membership, and linking
-goals to projects all need the `tasks:admin` scope, which an organization API key can never
-hold. With only `DAILYBOT_API_KEY` those commands stop before sending anything; run
-`dailybot login` first.
+**Structure changes need a signed-in person (any non-guest member).** Creating, updating,
+archiving or restoring boards, columns, projects and goals, board and project membership,
+and linking goals to projects all work for every non-guest member after `dailybot login`.
+An organization API key can never hold `tasks:admin` and cannot change membership or
+participants — with only `DAILYBOT_API_KEY` those commands stop before sending anything.
+**Privacy is membership**, not org role: a `members` project or board is 404 (not visible)
+to anyone without a grant; invite a person or a team to close it.
 
 The command an agent should reach for first is **`dailybot project update-post`** — it is
 how the team sees what was done. An agent that moves tasks silently is invisible to the
@@ -964,12 +966,12 @@ humans who own them.
 | `dailybot board labels <uuid>` | Labels available on the board — **needs `dailybot login`** |
 | `dailybot board views <uuid>` | Your saved views on the board, plus the ETag a save needs (`--etag` prints only that) |
 | `dailybot board state create\|update\|archive\|restore\|reorder` | Manage columns. `archive` previews first and takes `--migrate-to <state>` to move the column's cards |
-| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login` as an admin**. A team grant follows the team live. There is no board role to edit |
+| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login`**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
 | `dailybot board label create <board> -n <name>` | Create an organization label from the board — **needs `dailybot login`** |
 | `dailybot board view save <board> -f views.json --if-match <etag>` | Replace your saved views (the whole list) — **needs `dailybot login`** |
 | `dailybot board snapshot <uuid>` | The whole board in one request; carries the `delta_cursor` that `tasks changes` consumes |
 | `dailybot board update <uuid>` | Name, key (the old key stays reserved), visibility, estimate scale, auto-archive, project |
-| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login` as an admin** |
+| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login`** (any non-guest member) |
 | `dailybot board archive <uuid>` | Archive a board. **Cascade-archives its live tasks**, and restoring does not bring them back |
 | `dailybot board restore <uuid>` | Restore a board (cascaded tasks stay archived) |
 | `dailybot project list` | List projects (`--include progress`) |
@@ -986,7 +988,7 @@ humans who own them.
 | `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs `dailybot login`** |
 | `dailybot project milestone-create\|milestone-update\|milestone-delete` | Dated milestones; delete retires it (tasks keep pointing at it) |
 | `dailybot project archive <uuid>` | Archive a project |
-| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need a signed-in admin |
+| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
 | `dailybot goal list` | List goals (`--include` is repeatable: `--include progress --include projects`) |
 | `dailybot goal get <uuid>` | Show one goal, with its progress and linked projects (always included) |
 | `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs `dailybot login`** |
@@ -994,13 +996,14 @@ humans who own them.
 | `dailybot goal restore <uuid>` | Restore an archived goal |
 | `dailybot goal link\|unlink <goal> <project>` | Make a project count toward a goal (or stop it) |
 | `dailybot goal archive <uuid>` | Archive a goal (its projects are not archived) |
-| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need a signed-in admin |
+| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
 
 **Three things worth knowing before you script against this:**
 
 - **Some doors need a person.** An organization API key has no answer for "my tasks" or
-  "my inbox", and it can never hold `tasks:admin` — so container creates need
-  `dailybot login`. This is true even for an organization admin's own key.
+  "my inbox", can never hold `tasks:admin`, and cannot change membership or participants —
+  so container creates and invites need `dailybot login` as a non-guest member. A 404 means
+  not visible (wrong id, private without a grant, or another org) — never "not allowed".
 - **Roll-ups are opt-in.** A field you did not request with `--include` is **absent** from
   the payload. Absent, `null` and `0` are three different answers, and the CLI renders them
   as three different things.

{dailybot_cli-3.14.3 → dailybot_cli-3.15.0}/README.md

@@ -866,11 +866,13 @@ Replies to agent emails land as messages retrievable via `dailybot agent message
 Projects, boards and tasks. Two groups: **`dailybot tasks`** answers questions about the
 workspace, **`dailybot task`** reads or changes one task.
 
-**Structure changes need a signed-in organization admin.** Creating, updating, archiving or
-restoring boards, columns, projects and goals, board and project membership, and linking
-goals to projects all need the `tasks:admin` scope, which an organization API key can never
-hold. With only `DAILYBOT_API_KEY` those commands stop before sending anything; run
-`dailybot login` first.
+**Structure changes need a signed-in person (any non-guest member).** Creating, updating,
+archiving or restoring boards, columns, projects and goals, board and project membership,
+and linking goals to projects all work for every non-guest member after `dailybot login`.
+An organization API key can never hold `tasks:admin` and cannot change membership or
+participants — with only `DAILYBOT_API_KEY` those commands stop before sending anything.
+**Privacy is membership**, not org role: a `members` project or board is 404 (not visible)
+to anyone without a grant; invite a person or a team to close it.
 
 The command an agent should reach for first is **`dailybot project update-post`** — it is
 how the team sees what was done. An agent that moves tasks silently is invisible to the
@@ -925,12 +927,12 @@ humans who own them.
 | `dailybot board labels <uuid>` | Labels available on the board — **needs `dailybot login`** |
 | `dailybot board views <uuid>` | Your saved views on the board, plus the ETag a save needs (`--etag` prints only that) |
 | `dailybot board state create\|update\|archive\|restore\|reorder` | Manage columns. `archive` previews first and takes `--migrate-to <state>` to move the column's cards |
-| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login` as an admin**. A team grant follows the team live. There is no board role to edit |
+| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login`**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
 | `dailybot board label create <board> -n <name>` | Create an organization label from the board — **needs `dailybot login`** |
 | `dailybot board view save <board> -f views.json --if-match <etag>` | Replace your saved views (the whole list) — **needs `dailybot login`** |
 | `dailybot board snapshot <uuid>` | The whole board in one request; carries the `delta_cursor` that `tasks changes` consumes |
 | `dailybot board update <uuid>` | Name, key (the old key stays reserved), visibility, estimate scale, auto-archive, project |
-| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login` as an admin** |
+| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login`** (any non-guest member) |
 | `dailybot board archive <uuid>` | Archive a board. **Cascade-archives its live tasks**, and restoring does not bring them back |
 | `dailybot board restore <uuid>` | Restore a board (cascaded tasks stay archived) |
 | `dailybot project list` | List projects (`--include progress`) |
@@ -947,7 +949,7 @@ humans who own them.
 | `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs `dailybot login`** |
 | `dailybot project milestone-create\|milestone-update\|milestone-delete` | Dated milestones; delete retires it (tasks keep pointing at it) |
 | `dailybot project archive <uuid>` | Archive a project |
-| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need a signed-in admin |
+| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
 | `dailybot goal list` | List goals (`--include` is repeatable: `--include progress --include projects`) |
 | `dailybot goal get <uuid>` | Show one goal, with its progress and linked projects (always included) |
 | `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs `dailybot login`** |
@@ -955,13 +957,14 @@ humans who own them.
 | `dailybot goal restore <uuid>` | Restore an archived goal |
 | `dailybot goal link\|unlink <goal> <project>` | Make a project count toward a goal (or stop it) |
 | `dailybot goal archive <uuid>` | Archive a goal (its projects are not archived) |
-| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need a signed-in admin |
+| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
 
 **Three things worth knowing before you script against this:**
 
 - **Some doors need a person.** An organization API key has no answer for "my tasks" or
-  "my inbox", and it can never hold `tasks:admin` — so container creates need
-  `dailybot login`. This is true even for an organization admin's own key.
+  "my inbox", can never hold `tasks:admin`, and cannot change membership or participants —
+  so container creates and invites need `dailybot login` as a non-guest member. A 404 means
+  not visible (wrong id, private without a grant, or another org) — never "not allowed".
 - **Roll-ups are opt-in.** A field you did not request with `--include` is **absent** from
   the payload. Absent, `null` and `0` are three different answers, and the CLI renders them
   as three different things.

{dailybot_cli-3.14.3 → dailybot_cli-3.15.0}/dailybot_cli/api_client.py

@@ -2574,7 +2574,7 @@ class DailyBotClient:
         team_uuid: str | None = None,
         idempotency_key: str | None = None,
     ) -> Any:
-        """POST …/members/ — `tasks:admin`; a person OR a whole team; 200 when already in.
+        """POST …/members/ — person session (keys cannot change membership); 200 when already in.
 
         The body carries exactly one of `user_uuid` / `team_uuid` (both or neither is
         a 400 `invalid_filter_value`).
@@ -3212,7 +3212,7 @@ class DailyBotClient:
             self._comment_parent(task_uuid, comment_uuid), attachment_uuid
         )
 
-    # Project (POST / DELETE: tasks:admin, a signed-in person; reads: anyone who can see it)
+    # Project attachments (POST / DELETE: signed-in person; reads: anyone who can see it)
     def upload_project_attachment(
         self,
         project_uuid: str,
@@ -3222,7 +3222,7 @@ class DailyBotClient:
         data: bytes,
         caption: str | None = None,
     ) -> dict[str, Any]:
-        """POST /v1/tasks/projects/<p>/attachments/ — multipart, ≤5 MiB, tasks:admin."""
+        """POST /v1/tasks/projects/<p>/attachments/ — multipart, ≤5 MiB, person session."""
         return self._upload_attachment_to(
             self._project_parent(project_uuid),
             filename=filename,
@@ -3236,14 +3236,14 @@ class DailyBotClient:
         return self._list_attachments_of(self._project_parent(project_uuid))
 
     def delete_project_attachment(self, project_uuid: str, attachment_uuid: str) -> Any:
-        """DELETE /v1/tasks/projects/<p>/attachments/<a>/ — tasks:admin."""
+        """DELETE /v1/tasks/projects/<p>/attachments/<a>/ — person session."""
         return self._delete_attachment_of(self._project_parent(project_uuid), attachment_uuid)
 
     def download_project_attachment(self, project_uuid: str, attachment_uuid: str) -> bytes:
         """GET /v1/tasks/projects/<p>/attachments/<a>/content/."""
         return self._download_attachment_of(self._project_parent(project_uuid), attachment_uuid)
 
-    # Goal (POST / DELETE: tasks:admin, a signed-in person; reads: anyone who can see it)
+    # Goal attachments (POST / DELETE: signed-in person; reads: anyone who can see it)
     def upload_goal_attachment(
         self,
         goal_uuid: str,
@@ -3253,7 +3253,7 @@ class DailyBotClient:
         data: bytes,
         caption: str | None = None,
     ) -> dict[str, Any]:
-        """POST /v1/tasks/goals/<g>/attachments/ — multipart, ≤5 MiB, tasks:admin."""
+        """POST /v1/tasks/goals/<g>/attachments/ — multipart, ≤5 MiB, person session."""
         return self._upload_attachment_to(
             self._goal_parent(goal_uuid),
             filename=filename,
@@ -3267,7 +3267,7 @@ class DailyBotClient:
         return self._list_attachments_of(self._goal_parent(goal_uuid))
 
     def delete_goal_attachment(self, goal_uuid: str, attachment_uuid: str) -> Any:
-        """DELETE /v1/tasks/goals/<g>/attachments/<a>/ — tasks:admin."""
+        """DELETE /v1/tasks/goals/<g>/attachments/<a>/ — person session."""
         return self._delete_attachment_of(self._goal_parent(goal_uuid), attachment_uuid)
 
     def download_goal_attachment(self, goal_uuid: str, attachment_uuid: str) -> bytes:
@@ -3446,7 +3446,7 @@ class DailyBotClient:
     def update_project(
         self, project_uuid: str, *, idempotency_key: str | None = None, **fields: Any
     ) -> dict[str, Any]:
-        """PATCH /v1/tasks/projects/<uuid>/ — partial; `tasks:admin`; accepts a key."""
+        """PATCH /v1/tasks/projects/<uuid>/ — partial; person session. Visibility persists; privatizing auto-grants the actor."""
         result: dict[str, Any] = self._tasks_write(
             "PATCH",
             f"projects/{_path_segment(project_uuid)}/",
@@ -3617,15 +3617,15 @@ class DailyBotClient:
 
     # --- Container writes (board / project / goal) ---
     #
-    # These need `tasks:admin`, which an organization API key can NEVER hold: the
-    # validator refuses to store it and the door refuses it independently. The
-    # plan's live probe measured an ADMIN_ORG *owner* refused identically, so the
-    # CLI must blame the credential kind rather than the user's role.
+    # Open-org Tasks: every non-guest member holds `tasks:admin` on a person
+    # session. An organization API key can NEVER store that scope, so the CLI
+    # refuses a key before the request and blames the credential kind. Membership
+    # and participant writes stay person-only too.
 
     def create_board(
         self, *, name: str, idempotency_key: str | None = None, **fields: Any
     ) -> dict[str, Any]:
-        """POST /v1/tasks/boards/ — accepts a key header; needs tasks:admin."""
+        """POST /v1/tasks/boards/ — person session; keys lack tasks:admin."""
         payload: dict[str, Any] = {
             "name": name,
             **{k: v for k, v in fields.items() if v is not None},
@@ -3677,7 +3677,7 @@ class DailyBotClient:
     def create_project(
         self, *, name: str, idempotency_key: str | None = None, **fields: Any
     ) -> dict[str, Any]:
-        """POST /v1/tasks/projects/ — accepts a key header; needs tasks:admin."""
+        """POST /v1/tasks/projects/ — person session; keys lack tasks:admin."""
         payload: dict[str, Any] = {
             "name": name,
             **{k: v for k, v in fields.items() if v is not None},
@@ -3701,7 +3701,7 @@ class DailyBotClient:
     def create_goal(
         self, *, name: str, idempotency_key: str | None = None, **fields: Any
     ) -> dict[str, Any]:
-        """POST /v1/tasks/goals/ — accepts a key header; needs tasks:admin."""
+        """POST /v1/tasks/goals/ — person session; keys lack tasks:admin."""
         payload: dict[str, Any] = {
             "name": name,
             **{k: v for k, v in fields.items() if v is not None},

{dailybot_cli-3.14.3 → dailybot_cli-3.15.0}/dailybot_cli/commands/board.py

@@ -695,11 +695,13 @@ _MEMBER_WRITE_REASON: str = (
 
 @board.group("member")
 def board_member() -> None:
-    """Add or remove the people who can see a board. Needs `dailybot login`.
+    """Invite or remove who can see a board. Needs `dailybot login`.
 
     \b
-    There is no board-level role: organization roles plus board visibility are the
-    whole access model, so a membership can be added or removed but not edited.
+    Membership is the privacy control: a `members` board is invisible (404) to
+    anyone without a grant. Org-wide boards are a shared workspace. There is no
+    board-level role to edit — invite or remove only. An organization API key
+    cannot change membership.
 
     \b
     Examples:
@@ -965,20 +967,19 @@ def board_snapshot(board_uuid: str, json_mode: bool) -> None:
 
 
 def _require_person_for_admin(action: str, *, json_mode: bool) -> None:
-    """Refuse a key on a door that needs `tasks:admin`.
+    """Refuse an organization API key on a structure or membership door.
 
-    The scope cannot be granted to an API key at all — the validator refuses to
-    store it, and the door refuses it independently. The plan's live probe measured
-    an `ADMIN_ORG` **owner** refused exactly like a member, so the message must
-    blame the **credential kind**. Telling an organization admin they "need to be an
-    admin" would send them looking for a setting that cannot exist.
+    Open-org Tasks: every non-guest member holds `tasks:admin` on a person session,
+    so the CLI never asks for an organization-admin role. An organization API key
+    still cannot store that scope (or change membership / participants), so the
+    message blames the **credential kind** — run `dailybot login` as a member.
     """
     # See tasks.py `_require_person`: gate on the absence of a person token.
     if get_token() is None:
         refuse_without_person(
-            f"`{action}` needs the `tasks:admin` scope, which an organization API key can "
-            "never hold — it cannot even be stored on one. Run `dailybot login` and retry "
-            "as a signed-in person.",
+            f"`{action}` needs a signed-in person. An organization API key can never hold "
+            "the `tasks:admin` scope (it cannot even be stored on one), and keys cannot "
+            "change membership. Run `dailybot login` and retry as a non-guest member.",
             json_mode=json_mode,
             admin=True,
         )
@@ -1011,11 +1012,11 @@ def board_create(
     idempotency_key: str | None,
     json_mode: bool,
 ) -> None:
-    """Create a board in a project. Needs a signed-in organization admin.
+    """Create a board in a project. Needs a signed-in person (any non-guest member).
 
     \b
-    An organization API key cannot do this: the `tasks:admin` scope it requires can
-    never be held by a key. Run `dailybot login` first.
+    An organization API key cannot do this — run `dailybot login` first. Visibility
+    and who can see the board are controlled by invite/remove, not by org role.
 
     \b
     Examples:

{dailybot_cli-3.14.3 → dailybot_cli-3.15.0}/dailybot_cli/commands/goal.py

@@ -429,7 +429,7 @@ def goal_unlink(
 
 # ---------------------------------------------------------------------------
 # Attachments. Reading needs only visibility; attaching and deleting are
-# `tasks:admin` doors, which refuse an organization API key before any request.
+# Structure doors: refuse an organization API key before any request (keys lack tasks:admin).
 # ---------------------------------------------------------------------------
 
 
@@ -443,7 +443,7 @@ def goal_unlink(
 @click.option("--caption", default=None, help="Short caption shown with the file.")
 @click.option("--json", "json_mode", is_flag=True, help="Emit machine-readable JSON to stdout.")
 def goal_attach(goal_uuid: str, file_path: Path, caption: str | None, json_mode: bool) -> None:
-    """Attach a file to a goal. Needs a signed-in organization admin.
+    """Attach a file to a goal. Needs a signed-in person (any non-guest member).
 
     \b
     One request, up to 5 MiB. Your Dailybot credentials go only to the API.
@@ -535,7 +535,7 @@ def goal_attachment_get(
 def goal_attachment_delete(
     goal_uuid: str, attachment_uuid: str, dry_run: bool, assume_yes: bool, json_mode: bool
 ) -> None:
-    """Remove an attachment from a goal. This cannot be undone. Needs an admin.
+    """Remove an attachment from a goal. This cannot be undone. Needs a signed-in person.
 
     \b
     Examples:

{dailybot_cli-3.14.3 → dailybot_cli-3.15.0}/dailybot_cli/commands/project.py

@@ -382,13 +382,17 @@ def project_milestone_reopen(
 
 
 def _require_person_for_admin(action: str, *, json_mode: bool) -> None:
-    """Refuse a key on a `tasks:admin` door — see board.py for the full reasoning."""
+    """Refuse an organization API key on a structure or membership door.
+
+    See board.py: open-org Tasks gives every non-guest member structure access on
+    a person session; keys still cannot store `tasks:admin` or change membership.
+    """
     # See tasks.py `_require_person`: gate on the absence of a person token.
     if get_token() is None:
         refuse_without_person(
-            f"`{action}` needs the `tasks:admin` scope, which an organization API key can "
-            "never hold — it cannot even be stored on one. Run `dailybot login` and retry "
-            "as a signed-in person.",
+            f"`{action}` needs a signed-in person. An organization API key can never hold "
+            "the `tasks:admin` scope (it cannot even be stored on one), and keys cannot "
+            "change membership. Run `dailybot login` and retry as a non-guest member.",
             json_mode=json_mode,
             admin=True,
         )
@@ -538,8 +542,10 @@ def project_update(
     """Change a project's name, lead, health, dates or visibility.
 
     \b
-    Only the fields you pass are sent. Needs the `tasks:admin` scope. To post a
-    status note for the team, use `dailybot project update-post` instead.
+    Only the fields you pass are sent. Any signed-in non-guest member can update;
+    an organization API key cannot. Setting `--visibility members` privatizes the
+    project and auto-grants you; invite others with `project member add`. To post
+    a status note for the team, use `dailybot project update-post` instead.
 
     \b
     Examples:
@@ -657,8 +663,11 @@ def project_member() -> None:
     """Invite or remove people and teams on a project. Needs `dailybot login`.
 
     \b
-    There is no project role to edit: organization roles plus visibility are the
-    access model.
+    Membership is the privacy control: a `members` project is not visible (404)
+    to anyone without a grant. Org-wide projects are a shared workspace. Invite a
+    person or a team to close a private project; the last grant cannot be removed
+    (`last_grant_cannot_be_removed`). There is no project role to edit. An
+    organization API key cannot change membership.
 
     \b
     Examples:
@@ -970,7 +979,7 @@ def project_milestone_delete(
 
 # ---------------------------------------------------------------------------
 # Attachments. Reading needs only visibility; attaching and deleting are
-# `tasks:admin` doors, which refuse an organization API key before any request.
+# Structure doors: refuse an organization API key before any request (keys lack tasks:admin).
 # ---------------------------------------------------------------------------
 
 
@@ -986,7 +995,7 @@ def project_milestone_delete(
 def project_attach(
     project_uuid: str, file_path: Path, caption: str | None, json_mode: bool
 ) -> None:
-    """Attach a file to a project. Needs a signed-in organization admin.
+    """Attach a file to a project. Needs a signed-in person (any non-guest member).
 
     \b
     One request, up to 5 MiB. Your Dailybot credentials go only to the API.
@@ -1078,7 +1087,7 @@ def project_attachment_get(
 def project_attachment_delete(
     project_uuid: str, attachment_uuid: str, dry_run: bool, assume_yes: bool, json_mode: bool
 ) -> None:
-    """Remove an attachment from a project. This cannot be undone. Needs an admin.
+    """Remove an attachment from a project. This cannot be undone. Needs a signed-in person.
 
     \b
     Examples:

{dailybot_cli-3.14.3 → dailybot_cli-3.15.0}/dailybot_cli/commands/public_api_helpers.py

@@ -165,8 +165,12 @@ ERROR_CODE_MESSAGES: dict[str, str] = {
         "there — do not send this one again."
     ),
     # Isolation: 404 for anything invisible, never 403. Saying "permission" here
-    # would both mislead and disclose that the object exists.
-    "not_found": "Not found. Check the identifier, or it may belong to another organization.",
+    # would both mislead and disclose that the object exists. Membership-private
+    # projects/boards report the same way — treat 404 as not visible, not not allowed.
+    "not_found": (
+        "Not found or not visible to you. Check the identifier, invite status, or it may "
+        "belong to another organization."
+    ),
     "form_response_change_state_forbidden": (
         "You don't have permission to change the state of this submission. "
         "The form's audience may restrict transitions to specific users / teams. "
@@ -579,10 +583,13 @@ _PERSON_SHAPED_GUIDANCE: str = (
     "to be. Run `dailybot login` and retry."
 )
 
+# Keys still cannot store `tasks:admin`. Every non-guest member holds it on a
+# person session, so structure creates/updates go through `dailybot login` — not
+# an organization-admin role check in the CLI.
 _ADMIN_SCOPE_GUIDANCE: str = (
-    "This action needs the `tasks:admin` scope, which an organization API key can never "
-    "hold — it cannot even be stored on one. Run `dailybot login` and retry as a signed-in "
-    "person."
+    "This action needs a signed-in person: an organization API key can never hold the "
+    "`tasks:admin` scope (it cannot even be stored on one). Run `dailybot login` and retry "
+    "as a non-guest member. Membership and participant changes stay person-only too."
 )
 
 
@@ -686,14 +693,16 @@ def resolve_error_message(
     if exc.code == "insufficient_scope":
         required: Any = (exc.extra or {}).get("required_scope")
         if required == "tasks:admin":
-            # The "a key can never hold this" sentence is only true of a key. A
-            # signed-in member hitting the same refusal needs a role, not another
-            # login — telling them to `dailybot login` sends them in a circle.
+            # Open-org Tasks: every non-guest member already holds tasks:admin.
+            # A signed-in refusal is almost always a guest (or another role without
+            # structure access) — never "ask an admin to grant admin". Keys still
+            # cannot store the scope at all.
             if get_token() is not None:
                 return (
-                    "This action needs the `tasks:admin` scope and your account does not "
-                    "hold it. This is a role limit, not a credential problem — ask an "
-                    "organization admin to grant it. Signing in again will not change it."
+                    "Your account cannot change Tasks structure. Guests are refused; every "
+                    "non-guest member can create and manage goals, projects, boards and "
+                    "memberships. This is a role limit, not a credential problem — signing "
+                    "in again will not change it."
                 )
             return _ADMIN_SCOPE_GUIDANCE
         if tasks_surface and get_token() is None:

{dailybot_cli-3.14.3 → dailybot_cli-3.15.0}/dailybot_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dailybot-cli
-Version: 3.14.3
+Version: 3.15.0
 Summary: Dailybot CLI - The command-line bridge between humans and agents. Progress reports, observability, and workflow automation for modern teams across Slack, Google Chat, Discord, MS Teams, and more.
 Author-email: Dailybot <support@dailybot.com>
 License: MIT
@@ -905,11 +905,13 @@ Replies to agent emails land as messages retrievable via `dailybot agent message
 Projects, boards and tasks. Two groups: **`dailybot tasks`** answers questions about the
 workspace, **`dailybot task`** reads or changes one task.
 
-**Structure changes need a signed-in organization admin.** Creating, updating, archiving or
-restoring boards, columns, projects and goals, board and project membership, and linking
-goals to projects all need the `tasks:admin` scope, which an organization API key can never
-hold. With only `DAILYBOT_API_KEY` those commands stop before sending anything; run
-`dailybot login` first.
+**Structure changes need a signed-in person (any non-guest member).** Creating, updating,
+archiving or restoring boards, columns, projects and goals, board and project membership,
+and linking goals to projects all work for every non-guest member after `dailybot login`.
+An organization API key can never hold `tasks:admin` and cannot change membership or
+participants — with only `DAILYBOT_API_KEY` those commands stop before sending anything.
+**Privacy is membership**, not org role: a `members` project or board is 404 (not visible)
+to anyone without a grant; invite a person or a team to close it.
 
 The command an agent should reach for first is **`dailybot project update-post`** — it is
 how the team sees what was done. An agent that moves tasks silently is invisible to the
@@ -964,12 +966,12 @@ humans who own them.
 | `dailybot board labels <uuid>` | Labels available on the board — **needs `dailybot login`** |
 | `dailybot board views <uuid>` | Your saved views on the board, plus the ETag a save needs (`--etag` prints only that) |
 | `dailybot board state create\|update\|archive\|restore\|reorder` | Manage columns. `archive` previews first and takes `--migrate-to <state>` to move the column's cards |
-| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login` as an admin**. A team grant follows the team live. There is no board role to edit |
+| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login`**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
 | `dailybot board label create <board> -n <name>` | Create an organization label from the board — **needs `dailybot login`** |
 | `dailybot board view save <board> -f views.json --if-match <etag>` | Replace your saved views (the whole list) — **needs `dailybot login`** |
 | `dailybot board snapshot <uuid>` | The whole board in one request; carries the `delta_cursor` that `tasks changes` consumes |
 | `dailybot board update <uuid>` | Name, key (the old key stays reserved), visibility, estimate scale, auto-archive, project |
-| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login` as an admin** |
+| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login`** (any non-guest member) |
 | `dailybot board archive <uuid>` | Archive a board. **Cascade-archives its live tasks**, and restoring does not bring them back |
 | `dailybot board restore <uuid>` | Restore a board (cascaded tasks stay archived) |
 | `dailybot project list` | List projects (`--include progress`) |
@@ -986,7 +988,7 @@ humans who own them.
 | `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs `dailybot login`** |
 | `dailybot project milestone-create\|milestone-update\|milestone-delete` | Dated milestones; delete retires it (tasks keep pointing at it) |
 | `dailybot project archive <uuid>` | Archive a project |
-| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need a signed-in admin |
+| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
 | `dailybot goal list` | List goals (`--include` is repeatable: `--include progress --include projects`) |
 | `dailybot goal get <uuid>` | Show one goal, with its progress and linked projects (always included) |
 | `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs `dailybot login`** |
@@ -994,13 +996,14 @@ humans who own them.
 | `dailybot goal restore <uuid>` | Restore an archived goal |
 | `dailybot goal link\|unlink <goal> <project>` | Make a project count toward a goal (or stop it) |
 | `dailybot goal archive <uuid>` | Archive a goal (its projects are not archived) |
-| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need a signed-in admin |
+| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
 
 **Three things worth knowing before you script against this:**
 
 - **Some doors need a person.** An organization API key has no answer for "my tasks" or
-  "my inbox", and it can never hold `tasks:admin` — so container creates need
-  `dailybot login`. This is true even for an organization admin's own key.
+  "my inbox", can never hold `tasks:admin`, and cannot change membership or participants —
+  so container creates and invites need `dailybot login` as a non-guest member. A 404 means
+  not visible (wrong id, private without a grant, or another org) — never "not allowed".
 - **Roll-ups are opt-in.** A field you did not request with `--include` is **absent** from
   the payload. Absent, `null` and `0` are three different answers, and the CLI renders them
   as three different things.

{dailybot_cli-3.14.3 → dailybot_cli-3.15.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dailybot-cli"
-version = "3.14.3"
+version = "3.15.0"
 description = "Dailybot CLI - The command-line bridge between humans and agents. Progress reports, observability, and workflow automation for modern teams across Slack, Google Chat, Discord, MS Teams, and more."
 readme = "README.md"
 license = {text = "MIT"}