dailybot-cli 3.19.0__tar.gz → 3.20.0__tar.gz

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dailybot-cli
-Version: 3.19.0
+Version: 3.20.0
 Summary: Dailybot CLI - The command-line bridge between humans and agents. Progress reports, observability, and workflow automation for modern teams across Slack, Google Chat, Discord, MS Teams, and more.
 Author-email: Dailybot <support@dailybot.com>
 License: MIT
@@ -905,11 +905,13 @@ Replies to agent emails land as messages retrievable via `dailybot agent message
 Projects, boards and tasks. Two groups: **`dailybot tasks`** answers questions about the
 workspace, **`dailybot task`** reads or changes one task.
 
-**Structure changes need a signed-in person (any non-guest member).** Creating, updating,
-archiving or restoring boards, columns, projects and goals, board and project membership,
-and linking goals to projects all work for every non-guest member after `dailybot login`.
-An organization API key can never hold `tasks:admin` and cannot change membership or
-participants — with only `DAILYBOT_API_KEY` those commands stop before sending anything.
+**Your personal API key is you.** A login session (`dailybot login`) and a personal API key
+(one bound to you) can do everything you can do in the web app: create, update, archive and
+restore boards, columns, projects, goals and milestones, manage board and project
+membership, link goals to projects, and work every task. That is every non-guest member, no
+organization-admin prerequisite. Only an agent or organization key, with nobody behind it,
+cannot act as a person: the server refuses it (`actor_required` exit 3, `insufficient_scope`
+exit 4). Guests stay limited by their role.
 **Privacy is membership**, not org role: a `members` project or board is 404 (not visible)
 to anyone without a grant; invite a person or a team to close it.
 A board inside a `members` project follows the project's membership: whoever the project
@@ -954,9 +956,9 @@ humans who own them.
 | `dailybot task comments <uuid>` | List a task's comments |
 | `dailybot task link <a> <b> --type <rel>` | Relate two tasks (`blocks`, `relates_to`, `duplicates`) |
 | `dailybot task labels <uuid> --mode add\|remove\|replace` | Change a task's labels |
-| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); `list` works with a personal API key; add/remove **need `dailybot login`** |
+| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); all need a person: `dailybot login` or a personal API key |
 | `dailybot task watch\|unwatch <task>` | Follow a task privately — **needs a person: `dailybot login` or a personal API key** |
-| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs `dailybot login`** |
+| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot task relations <task>` · `task unlink <task> <relation>` | List links (direction included) / remove one; `unlink` confirms and has `--dry-run` |
 | `dailybot task comment-edit\|comment-delete <task> <comment>` | Edit (`-` reads stdin) or delete a comment; delete blanks the text and keeps the entry |
 | `dailybot task children <task>` · `task events <task>` · `task activity <task>` | Sub-tasks, raw event history, and the readable activity feed (`--updated-since`, `--type`) |
@@ -978,12 +980,12 @@ humans who own them.
 | `dailybot board labels <uuid>` | Labels available on the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board views <uuid>` | Your saved views on the board, plus the ETag a save needs (`--etag` prints only that) |
 | `dailybot board state create\|update\|archive\|restore\|reorder` | Manage columns. `archive` previews first and takes `--migrate-to <state>` to move the column's cards |
-| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login`**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
+| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs a person: `dailybot login` or a personal API key**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
 | `dailybot board label create <board> -n <name>` | Create an organization label from the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board view save <board> -f views.json --if-match <etag>` | Replace your saved views (the whole list) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board snapshot <uuid>` | The whole board in one request; carries the `delta_cursor` that `tasks changes` consumes |
 | `dailybot board update <uuid>` | Name, key (the old key stays reserved), visibility, estimate scale, auto-archive, project |
-| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login`** (any non-guest member) |
+| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs a person: `dailybot login` or a personal API key** (any non-guest member) |
 | `dailybot board archive <uuid>` | Archive a board. **Cascade-archives its live tasks**, and restoring does not bring them back |
 | `dailybot board restore <uuid>` | Restore a board (cascaded tasks stay archived) |
 | `dailybot project list` | List projects (`--include progress`) |
@@ -993,28 +995,28 @@ humans who own them.
 | `dailybot project milestones [<uuid>]` | List milestones |
 | `dailybot project milestone-complete <p> <m>` | Complete a milestone. **Its open tasks stay open** |
 | `dailybot project milestone-reopen <p> <m>` | Reopen a milestone |
-| `dailybot project create --name <n>` | Create a project — **needs `dailybot login`** |
+| `dailybot project create --name <n>` | Create a project — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project update <uuid>` | Name, description, lead, health, dates, visibility |
 | `dailybot project restore <uuid>` | Restore an archived project (its boards and tasks stay archived) |
-| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs `dailybot login`** |
-| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs `dailybot login`** |
+| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs a person: `dailybot login` or a personal API key** |
+| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project milestone-create\|milestone-update\|milestone-delete` | Dated milestones; delete retires it (tasks keep pointing at it) |
 | `dailybot project archive <uuid>` | Archive a project |
-| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 | `dailybot goal list` | List goals (`--include` is repeatable: `--include progress --include projects`) |
 | `dailybot goal get <uuid>` | Show one goal, with its progress and linked projects (always included) |
-| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs `dailybot login`** |
+| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot goal update <uuid>` | Name, period, owner, team, and the declared `--status` (not_started, on_track, at_risk, off_track, achieved, missed) |
 | `dailybot goal restore <uuid>` | Restore an archived goal |
 | `dailybot goal link\|unlink <goal> <project>` | Make a project count toward a goal (or stop it) |
 | `dailybot goal archive <uuid>` | Archive a goal (its projects are not archived) |
-| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 
 **Three things worth knowing before you script against this:**
 
-- **Some doors need a person.** An organization API key has no answer for "my tasks" or
-  "my inbox", can never hold `tasks:admin`, and cannot change membership or participants —
-  so container creates and invites need `dailybot login` as a non-guest member. A 404 means
+- **Some doors need a person.** A login session or a personal API key is a person; an agent
+  or organization key has no answer for "my tasks" or "my inbox", can never hold
+  `tasks:admin`, and cannot change membership or participants. A 404 means
   not visible (wrong id, private without a grant, or another org) — never "not allowed".
 - **Roll-ups are opt-in.** A field you did not request with `--include` is **absent** from
   the payload. Absent, `null` and `0` are three different answers, and the CLI renders them

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/README.md

@@ -866,11 +866,13 @@ Replies to agent emails land as messages retrievable via `dailybot agent message
 Projects, boards and tasks. Two groups: **`dailybot tasks`** answers questions about the
 workspace, **`dailybot task`** reads or changes one task.
 
-**Structure changes need a signed-in person (any non-guest member).** Creating, updating,
-archiving or restoring boards, columns, projects and goals, board and project membership,
-and linking goals to projects all work for every non-guest member after `dailybot login`.
-An organization API key can never hold `tasks:admin` and cannot change membership or
-participants — with only `DAILYBOT_API_KEY` those commands stop before sending anything.
+**Your personal API key is you.** A login session (`dailybot login`) and a personal API key
+(one bound to you) can do everything you can do in the web app: create, update, archive and
+restore boards, columns, projects, goals and milestones, manage board and project
+membership, link goals to projects, and work every task. That is every non-guest member, no
+organization-admin prerequisite. Only an agent or organization key, with nobody behind it,
+cannot act as a person: the server refuses it (`actor_required` exit 3, `insufficient_scope`
+exit 4). Guests stay limited by their role.
 **Privacy is membership**, not org role: a `members` project or board is 404 (not visible)
 to anyone without a grant; invite a person or a team to close it.
 A board inside a `members` project follows the project's membership: whoever the project
@@ -915,9 +917,9 @@ humans who own them.
 | `dailybot task comments <uuid>` | List a task's comments |
 | `dailybot task link <a> <b> --type <rel>` | Relate two tasks (`blocks`, `relates_to`, `duplicates`) |
 | `dailybot task labels <uuid> --mode add\|remove\|replace` | Change a task's labels |
-| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); `list` works with a personal API key; add/remove **need `dailybot login`** |
+| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); all need a person: `dailybot login` or a personal API key |
 | `dailybot task watch\|unwatch <task>` | Follow a task privately — **needs a person: `dailybot login` or a personal API key** |
-| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs `dailybot login`** |
+| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot task relations <task>` · `task unlink <task> <relation>` | List links (direction included) / remove one; `unlink` confirms and has `--dry-run` |
 | `dailybot task comment-edit\|comment-delete <task> <comment>` | Edit (`-` reads stdin) or delete a comment; delete blanks the text and keeps the entry |
 | `dailybot task children <task>` · `task events <task>` · `task activity <task>` | Sub-tasks, raw event history, and the readable activity feed (`--updated-since`, `--type`) |
@@ -939,12 +941,12 @@ humans who own them.
 | `dailybot board labels <uuid>` | Labels available on the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board views <uuid>` | Your saved views on the board, plus the ETag a save needs (`--etag` prints only that) |
 | `dailybot board state create\|update\|archive\|restore\|reorder` | Manage columns. `archive` previews first and takes `--migrate-to <state>` to move the column's cards |
-| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login`**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
+| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs a person: `dailybot login` or a personal API key**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
 | `dailybot board label create <board> -n <name>` | Create an organization label from the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board view save <board> -f views.json --if-match <etag>` | Replace your saved views (the whole list) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board snapshot <uuid>` | The whole board in one request; carries the `delta_cursor` that `tasks changes` consumes |
 | `dailybot board update <uuid>` | Name, key (the old key stays reserved), visibility, estimate scale, auto-archive, project |
-| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login`** (any non-guest member) |
+| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs a person: `dailybot login` or a personal API key** (any non-guest member) |
 | `dailybot board archive <uuid>` | Archive a board. **Cascade-archives its live tasks**, and restoring does not bring them back |
 | `dailybot board restore <uuid>` | Restore a board (cascaded tasks stay archived) |
 | `dailybot project list` | List projects (`--include progress`) |
@@ -954,28 +956,28 @@ humans who own them.
 | `dailybot project milestones [<uuid>]` | List milestones |
 | `dailybot project milestone-complete <p> <m>` | Complete a milestone. **Its open tasks stay open** |
 | `dailybot project milestone-reopen <p> <m>` | Reopen a milestone |
-| `dailybot project create --name <n>` | Create a project — **needs `dailybot login`** |
+| `dailybot project create --name <n>` | Create a project — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project update <uuid>` | Name, description, lead, health, dates, visibility |
 | `dailybot project restore <uuid>` | Restore an archived project (its boards and tasks stay archived) |
-| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs `dailybot login`** |
-| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs `dailybot login`** |
+| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs a person: `dailybot login` or a personal API key** |
+| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project milestone-create\|milestone-update\|milestone-delete` | Dated milestones; delete retires it (tasks keep pointing at it) |
 | `dailybot project archive <uuid>` | Archive a project |
-| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 | `dailybot goal list` | List goals (`--include` is repeatable: `--include progress --include projects`) |
 | `dailybot goal get <uuid>` | Show one goal, with its progress and linked projects (always included) |
-| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs `dailybot login`** |
+| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot goal update <uuid>` | Name, period, owner, team, and the declared `--status` (not_started, on_track, at_risk, off_track, achieved, missed) |
 | `dailybot goal restore <uuid>` | Restore an archived goal |
 | `dailybot goal link\|unlink <goal> <project>` | Make a project count toward a goal (or stop it) |
 | `dailybot goal archive <uuid>` | Archive a goal (its projects are not archived) |
-| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 
 **Three things worth knowing before you script against this:**
 
-- **Some doors need a person.** An organization API key has no answer for "my tasks" or
-  "my inbox", can never hold `tasks:admin`, and cannot change membership or participants —
-  so container creates and invites need `dailybot login` as a non-guest member. A 404 means
+- **Some doors need a person.** A login session or a personal API key is a person; an agent
+  or organization key has no answer for "my tasks" or "my inbox", can never hold
+  `tasks:admin`, and cannot change membership or participants. A 404 means
   not visible (wrong id, private without a grant, or another org) — never "not allowed".
 - **Roll-ups are opt-in.** A field you did not request with `--include` is **absent** from
   the payload. Absent, `null` and `0` are three different answers, and the CLI renders them

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/dailybot_cli/api_client.py

@@ -2885,7 +2885,7 @@ class DailyBotClient:
         return self._tasks_write(
             "POST",
             f"tasks/{_path_segment(task_uuid)}/labels/batch/",
-            json={"mode": mode, "labels": labels},
+            json={"mode": mode, "label_uuids": labels},
             idempotent=True,
             idempotency_key=idempotency_key,
         )

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/dailybot_cli/commands/board.py

@@ -21,7 +21,6 @@ from dailybot_cli.commands.public_api_helpers import (
     emit_json,
     exit_for_tasks_error,
     load_json_input,
-    refuse_without_person,
     require_auth,
     rows_of,
 )
@@ -32,7 +31,6 @@ from dailybot_cli.commands.query_options import (
     query_options,
     resolve_fetch_all,
 )
-from dailybot_cli.config import get_person_token
 from dailybot_cli.display import (
     console,
     print_board_snapshot,
@@ -479,7 +477,6 @@ def board_state_create(
       dailybot board state create <board-uuid> -n "In review" --category in_progress
       dailybot board state create <board-uuid> -n Blocked --category todo --position 2 --json
     """
-    _require_person_for_admin("board state create", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Adding the column..."):
@@ -528,7 +525,6 @@ def board_state_update(
       dailybot board state update <board-uuid> <state-uuid> --name "Shipped"
       dailybot board state update <board-uuid> <state-uuid> --position 1 --json
     """
-    _require_person_for_admin("board state update", json_mode=json_mode)
     fields: dict[str, Any] = {
         k: v
         for k, v in {"name": name, "color": color, "position": position}.items()
@@ -578,7 +574,6 @@ def board_state_archive(
       dailybot board state archive <board-uuid> <state-uuid> --dry-run
       dailybot board state archive <board-uuid> <state-uuid> --migrate-to <other-state> --yes
     """
-    _require_person_for_admin("board state archive", json_mode=json_mode)
     client = require_auth()
     if not preview_then_confirm(
         lambda: client.archive_board_state(
@@ -613,7 +608,6 @@ def board_state_restore(board_uuid: str, state_uuid: str, json_mode: bool) -> No
     Examples:
       dailybot board state restore <board-uuid> <state-uuid>
     """
-    _require_person_for_admin("board state restore", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Restoring the column..."):
@@ -642,7 +636,6 @@ def board_state_reorder(board_uuid: str, state_uuids: tuple[str, ...], json_mode
     Examples:
       dailybot board state reorder <board-uuid> <backlog> <todo> <doing> <done>
     """
-    _require_person_for_admin("board state reorder", json_mode=json_mode)
     if len(set(state_uuids)) != len(state_uuids):
         raise click.UsageError("A column appears twice. List each live column exactly once.")
     client = require_auth()
@@ -669,7 +662,7 @@ _MEMBER_WRITE_REASON: str = (
 
 @board.group("member")
 def board_member() -> None:
-    """Invite or remove who can see a board. Needs `dailybot login`.
+    """Invite or remove who can see a board. Needs a person: `dailybot login` or a personal API key.
 
     \b
     Membership is the privacy control: a `members` board is invisible (404) to
@@ -713,7 +706,6 @@ def board_member_add(
       dailybot board member add <board-uuid> <user-uuid>
       dailybot board member add <board-uuid> --team <team-uuid> --json
     """
-    _require_person_for_admin("board member add", json_mode=json_mode)
     if (user_uuid is None) == (team_uuid is None):
         raise click.UsageError("Pass exactly one of USER or --team.")
     client = require_auth()
@@ -751,7 +743,6 @@ def board_member_remove(
       dailybot board member remove <board-uuid> <user-uuid> --dry-run
       dailybot board member remove <board-uuid> <user-uuid> --yes
     """
-    _require_person_for_admin("board member remove", json_mode=json_mode)
     if not confirm_without_preview(
         f"remove user {user_uuid} from board {board_uuid}; they lose sight of it if it is private.",
         assume_yes=assume_yes,
@@ -930,26 +921,6 @@ def board_snapshot(board_uuid: str, json_mode: bool) -> None:
     print_board_snapshot(data)
 
 
-def _require_person_for_admin(action: str, *, json_mode: bool) -> None:
-    """Refuse an organization API key on a structure or membership door.
-
-    Open-org Tasks: every non-guest member holds `tasks:admin` on a person session,
-    so the CLI never asks for an organization-admin role. An organization API key
-    still cannot store that scope (or change membership / participants), so the
-    message blames the **credential kind** — run `dailybot login` as a member.
-    """
-    # Gate on the absence of a person token, not on the presence of a key: both
-    # can be configured at once, and Bearer is sent first when it exists.
-    if get_person_token() is None:
-        refuse_without_person(
-            f"`{action}` needs a signed-in person. An organization API key can never hold "
-            "the `tasks:admin` scope (it cannot even be stored on one), and keys cannot "
-            "change membership. Run `dailybot login` and retry as a non-guest member.",
-            json_mode=json_mode,
-            admin=True,
-        )
-
-
 @board.command("create")
 @click.option("-n", "--name", required=True, help="Board name.")
 # Boards have no description field (BoardWrite declares none), so the flag the CLI
@@ -977,11 +948,11 @@ def board_create(
     idempotency_key: str | None,
     json_mode: bool,
 ) -> None:
-    """Create a board in a project. Needs a signed-in person (any non-guest member).
+    """Create a board in a project. Needs a person (any non-guest member): `dailybot login` or a personal API key.
 
     \b
-    An organization API key cannot do this — run `dailybot login` first. Visibility
-    and who can see the board are controlled by invite/remove, not by org role.
+    An agent or organization key cannot do this. Visibility and who can see the
+    board are controlled by invite/remove, not by org role.
 
     \b
     Examples:
@@ -992,7 +963,6 @@ def board_create(
             "Boards have no description. Put the context in a project "
             "(`dailybot project create -d ...`) and create the board under it."
         )
-    _require_person_for_admin("board create", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Creating the board..."):
@@ -1054,7 +1024,6 @@ def board_update(
       dailybot board update <board-uuid> --name "Design (Q4)"
       dailybot board update <board-uuid> --key DSN --visibility members --json
     """
-    _require_person_for_admin("board update", json_mode=json_mode)
     fields: dict[str, Any] = {
         k: v
         for k, v in {
@@ -1105,7 +1074,6 @@ def board_archive(
     Examples:
       dailybot board archive <board-uuid> --dry-run
     """
-    _require_person_for_admin("board archive", json_mode=json_mode)
     client = require_auth()
     if not preview_then_confirm(
         lambda: client.archive_board(board_uuid, dry_run=True),
@@ -1146,7 +1114,6 @@ def board_restore(board_uuid: str, idempotency_key: str | None, json_mode: bool)
     Examples:
       dailybot board restore <board-uuid>
     """
-    _require_person_for_admin("board restore", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Restoring the board..."):

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/dailybot_cli/commands/goal.py

@@ -16,7 +16,6 @@ from dailybot_cli.commands.project import (
     GOAL_INCLUDE_VALUES,
     _envelope,
     _include_list,
-    _require_person_for_admin,
 )
 from dailybot_cli.commands.public_api_helpers import (
     emit_json,
@@ -186,7 +185,7 @@ def goal_create(
     idempotency_key: str | None,
     json_mode: bool,
 ) -> None:
-    """Create a goal. Needs a signed-in person (any non-guest member).
+    """Create a goal. Needs a person (any non-guest member): `dailybot login` or a personal API key.
 
     \b
     A goal is a dated commitment, so both ends of its period are required. It starts
@@ -198,7 +197,6 @@ def goal_create(
     """
     if period_end < period_start:
         raise click.UsageError("--period-end is before --period-start.")
-    _require_person_for_admin("goal create", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Creating the goal..."):
@@ -234,7 +232,6 @@ def goal_archive(
     Examples:
       dailybot goal archive <goal-uuid> --dry-run
     """
-    _require_person_for_admin("goal archive", json_mode=json_mode)
     client = require_auth()
     if not preview_then_confirm(
         lambda: client.archive_goal(goal_uuid, dry_run=True),
@@ -305,7 +302,6 @@ def goal_update(
       dailybot goal update <goal-uuid> --status at_risk
       dailybot goal update <goal-uuid> --period-end 2027-01-31 --owner <user-uuid> --json
     """
-    _require_person_for_admin("goal update", json_mode=json_mode)
     if period_start and period_end and period_end < period_start:
         raise click.UsageError("--period-end is before --period-start.")
     fields: dict[str, Any] = {
@@ -349,7 +345,6 @@ def goal_restore(goal_uuid: str, json_mode: bool) -> None:
     Examples:
       dailybot goal restore <goal-uuid>
     """
-    _require_person_for_admin("goal restore", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Restoring the goal..."):
@@ -377,7 +372,6 @@ def goal_link(goal_uuid: str, project_uuid: str, json_mode: bool) -> None:
     Examples:
       dailybot goal link <goal-uuid> <project-uuid>
     """
-    _require_person_for_admin("goal link", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Linking the project..."):
@@ -406,7 +400,6 @@ def goal_unlink(
       dailybot goal unlink <goal-uuid> <project-uuid> --dry-run
       dailybot goal unlink <goal-uuid> <project-uuid> --yes
     """
-    _require_person_for_admin("goal unlink", json_mode=json_mode)
     if not confirm_without_preview(
         f"unlink project {project_uuid} from goal {goal_uuid}; its work stops counting toward "
         "the goal.",
@@ -443,7 +436,7 @@ def goal_unlink(
 @click.option("--caption", default=None, help="Short caption shown with the file.")
 @click.option("--json", "json_mode", is_flag=True, help="Emit machine-readable JSON to stdout.")
 def goal_attach(goal_uuid: str, file_path: Path, caption: str | None, json_mode: bool) -> None:
-    """Attach a file to a goal. Needs a signed-in person (any non-guest member).
+    """Attach a file to a goal. Needs a person (any non-guest member): `dailybot login` or a personal API key.
 
     \b
     One request, up to 5 MiB. Your Dailybot credentials go only to the API.
@@ -453,7 +446,6 @@ def goal_attach(goal_uuid: str, file_path: Path, caption: str | None, json_mode:
       dailybot goal attach <goal-uuid> ./plan.pdf
       dailybot goal attach <goal-uuid> ./roadmap.png --caption "Q4 roadmap" --json
     """
-    _require_person_for_admin("goal attach", json_mode=json_mode)
     run_attach(
         lambda client, **file: client.upload_goal_attachment(goal_uuid, **file),
         file_path,
@@ -535,14 +527,13 @@ def goal_attachment_get(
 def goal_attachment_delete(
     goal_uuid: str, attachment_uuid: str, dry_run: bool, assume_yes: bool, json_mode: bool
 ) -> None:
-    """Remove an attachment from a goal. This cannot be undone. Needs a signed-in person.
+    """Remove an attachment from a goal. This cannot be undone. Needs a person: `dailybot login` or a personal API key.
 
     \b
     Examples:
       dailybot goal attachment delete <goal-uuid> <attachment-uuid> --dry-run
       dailybot goal attachment delete <goal-uuid> <attachment-uuid> --yes
     """
-    _require_person_for_admin("goal attachment delete", json_mode=json_mode)
     run_delete(
         lambda client: client.delete_goal_attachment(goal_uuid, attachment_uuid),
         f"delete attachment {attachment_uuid} from goal {goal_uuid}.",

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/dailybot_cli/commands/project.py

@@ -16,12 +16,10 @@ from dailybot_cli.commands.public_api_helpers import (
     emit_json,
     exit_for_tasks_error,
     load_json_input,
-    refuse_without_person,
     require_auth,
     rows_of,
 )
 from dailybot_cli.commands.query_options import build_query_params, query_options, resolve_fetch_all
-from dailybot_cli.config import get_person_token
 from dailybot_cli.display import (
     console,
     present_untrusted,
@@ -381,24 +379,6 @@ def project_milestone_reopen(
     report_write(data, "Milestone reopened")
 
 
-def _require_person_for_admin(action: str, *, json_mode: bool) -> None:
-    """Refuse an organization API key on a structure or membership door.
-
-    See board.py: open-org Tasks gives every non-guest member structure access on
-    a person session; keys still cannot store `tasks:admin` or change membership.
-    """
-    # Gate on the absence of a person token, not on the presence of a key: both
-    # can be configured at once, and Bearer is sent first when it exists.
-    if get_person_token() is None:
-        refuse_without_person(
-            f"`{action}` needs a signed-in person. An organization API key can never hold "
-            "the `tasks:admin` scope (it cannot even be stored on one), and keys cannot "
-            "change membership. Run `dailybot login` and retry as a non-guest member.",
-            json_mode=json_mode,
-            admin=True,
-        )
-
-
 def _project_fields(
     visibility: str | None,
     lead: str | None,
@@ -461,7 +441,7 @@ def project_create(
     idempotency_key: str | None,
     json_mode: bool,
 ) -> None:
-    """Create a project. Needs a signed-in person (any non-guest member).
+    """Create a project. Needs a person (any non-guest member): `dailybot login` or a personal API key.
 
     \b
     Examples:
@@ -469,7 +449,6 @@ def project_create(
       dailybot project create -n "Apollo" --lead <user-uuid> --target-date 2026-12-15 --json
     """
     extra: dict[str, Any] = _project_fields(visibility, lead, health, start_date, target_date)
-    _require_person_for_admin("project create", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Creating the project..."):
@@ -499,7 +478,6 @@ def project_archive(
     Examples:
       dailybot project archive <project-uuid> --dry-run
     """
-    _require_person_for_admin("project archive", json_mode=json_mode)
     client = require_auth()
     if not preview_then_confirm(
         lambda: client.archive_project(project_uuid, dry_run=True),
@@ -543,8 +521,8 @@ def project_update(
     """Change a project's name, lead, health, dates or visibility.
 
     \b
-    Only the fields you pass are sent. Any signed-in non-guest member can update;
-    an organization API key cannot. Setting `--visibility members` privatizes the
+    Only the fields you pass are sent. Any non-guest member can update, with
+    `dailybot login` or a personal API key; an agent or organization key cannot. Setting `--visibility members` privatizes the
     project and auto-grants you; invite others with `project member add`. To post
     a status note for the team, use `dailybot project update-post` instead.
 
@@ -553,7 +531,6 @@ def project_update(
       dailybot project update <project-uuid> --health at_risk
       dailybot project update <project-uuid> --target-date 2027-01-15 --lead <user-uuid> --json
     """
-    _require_person_for_admin("project update", json_mode=json_mode)
     fields: dict[str, Any] = _project_fields(visibility, lead, health, start_date, target_date)
     if name is not None:
         fields["name"] = name
@@ -590,7 +567,6 @@ def project_restore(project_uuid: str, idempotency_key: str | None, json_mode: b
     Examples:
       dailybot project restore <project-uuid>
     """
-    _require_person_for_admin("project restore", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Restoring the project..."):
@@ -606,13 +582,9 @@ def project_restore(project_uuid: str, idempotency_key: str | None, json_mode: b
 
 
 # ---------------------------------------------------------------------------
-# Members and saved views — person-only
+# Members and saved views
 # ---------------------------------------------------------------------------
 
-_MEMBER_REASON: str = (
-    "changes or reveals who can see a private project, and no organization API key may do "
-    "that — there is no person behind it to be accountable."
-)
 _MEMBER_COLUMNS: list[tuple[str, str, bool]] = [
     ("Kind", "subject_type", True),
     ("Name", "name", False),
@@ -627,15 +599,6 @@ _VIEW_COLUMNS: list[tuple[str, str, bool]] = [
 ]
 
 
-def _require_person(action: str, reason: str, *, json_mode: bool) -> None:
-    """Refuse an API key on a person-only project door, before any request."""
-    if get_person_token() is None:
-        refuse_without_person(
-            f"`{action}` {reason} Run `dailybot login` and retry as a signed-in person.",
-            json_mode=json_mode,
-        )
-
-
 @project.command("members")
 @click.argument("project_uuid", metavar="PROJECT")
 @click.option("--json", "json_mode", is_flag=True, help="Emit machine-readable JSON to stdout.")
@@ -660,14 +623,14 @@ def project_members(project_uuid: str, json_mode: bool) -> None:
 
 @project.group("member")
 def project_member() -> None:
-    """Invite or remove people and teams on a project. Needs `dailybot login`.
+    """Invite or remove people and teams on a project. Needs a person: `dailybot login` or a personal API key.
 
     \b
     Membership is the privacy control: a `members` project is not visible (404)
     to anyone without a grant. Org-wide projects are a shared workspace. Invite a
     person or a team to close a private project; the last grant cannot be removed
-    (`last_grant_cannot_be_removed`). There is no project role to edit. An
-    organization API key cannot change membership.
+    (`last_grant_cannot_be_removed`). There is no project role to edit. An agent or
+    organization key cannot change membership.
 
     \b
     Examples:
@@ -696,7 +659,6 @@ def project_member_add(
       dailybot project member add <project-uuid> --user <user-uuid>
       dailybot project member add <project-uuid> --team <team-uuid> --json
     """
-    _require_person_for_admin("project member add", json_mode=json_mode)
     if (user_uuid is None) == (team_uuid is None):
         raise click.UsageError("Pass exactly one of --user or --team.")
     client = require_auth()
@@ -729,7 +691,6 @@ def project_member_remove(
       dailybot project member remove <project-uuid> <user-uuid> --dry-run
       dailybot project member remove <project-uuid> <user-uuid> --yes
     """
-    _require_person_for_admin("project member remove", json_mode=json_mode)
     if not confirm_without_preview(
         f"remove user {user_uuid} from project {project_uuid}; they lose sight of it if it "
         "is private.",
@@ -767,11 +728,6 @@ def project_views(project_uuid: str, etag_only: bool, json_mode: bool) -> None:
       dailybot project views <project-uuid>
       ETAG=$(dailybot project views <project-uuid> --etag)
     """
-    _require_person(
-        "project views",
-        "lists saved views, which belong to a person, and an organization API key is not one.",
-        json_mode=json_mode,
-    )
     client = require_auth()
     try:
         with console.status("Reading the views..."):
@@ -791,7 +747,7 @@ def project_views(project_uuid: str, etag_only: bool, json_mode: bool) -> None:
 
 @project.group("view")
 def project_view() -> None:
-    """Save your views of a project. Needs `dailybot login`.
+    """Save your views of a project. Needs a person: `dailybot login` or a personal API key.
 
     \b
     Examples:
@@ -834,11 +790,6 @@ def project_view_save(
         raise click.BadParameter(f"not valid JSON: {exc}", param_hint="--file") from exc
     if not isinstance(views, list):
         raise click.BadParameter("must be a JSON array of views.", param_hint="--file")
-    _require_person(
-        "project view save",
-        "saves views that belong to a person, and an organization API key is not one.",
-        json_mode=json_mode,
-    )
     client = require_auth()
     try:
         etag: str | None = if_match
@@ -995,7 +946,7 @@ def project_milestone_delete(
 def project_attach(
     project_uuid: str, file_path: Path, caption: str | None, json_mode: bool
 ) -> None:
-    """Attach a file to a project. Needs a signed-in person (any non-guest member).
+    """Attach a file to a project. Needs a person (any non-guest member): `dailybot login` or a personal API key.
 
     \b
     One request, up to 5 MiB. Your Dailybot credentials go only to the API.
@@ -1005,7 +956,6 @@ def project_attach(
       dailybot project attach <project-uuid> ./plan.pdf
       dailybot project attach <project-uuid> ./roadmap.png --caption "Q4 roadmap" --json
     """
-    _require_person_for_admin("project attach", json_mode=json_mode)
     run_attach(
         lambda client, **file: client.upload_project_attachment(project_uuid, **file),
         file_path,
@@ -1087,14 +1037,13 @@ def project_attachment_get(
 def project_attachment_delete(
     project_uuid: str, attachment_uuid: str, dry_run: bool, assume_yes: bool, json_mode: bool
 ) -> None:
-    """Remove an attachment from a project. This cannot be undone. Needs a signed-in person.
+    """Remove an attachment from a project. This cannot be undone. Needs a person: `dailybot login` or a personal API key.
 
     \b
     Examples:
       dailybot project attachment delete <project-uuid> <attachment-uuid> --dry-run
       dailybot project attachment delete <project-uuid> <attachment-uuid> --yes
     """
-    _require_person_for_admin("project attachment delete", json_mode=json_mode)
     run_delete(
         lambda client: client.delete_project_attachment(project_uuid, attachment_uuid),
         f"delete attachment {attachment_uuid} from project {project_uuid}.",

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/dailybot_cli/commands/public_api_helpers.py

@@ -58,10 +58,11 @@ ERROR_CODE_MESSAGES: dict[str, str] = {
     #
     # Agent attribution (--agent-name / DAILYBOT_AGENT_NAME)
     "invalid_agent_attribution": (
-        "The agent name was refused. It must be 128 characters or fewer, and it "
-        "only works with a credential that belongs to a person (a login session "
-        "or a personal API key), not an agent key. Shorten --agent-name, or drop "
-        "it when using an agent key."
+        "The agent name was refused. Use a plain name of 128 characters or fewer: "
+        "letters, numbers, spaces and . - _ ( ) ' # + / & , : only. The name must "
+        "not belong to a deactivated agent, and it only works with a credential that "
+        "belongs to a person (a login session or a personal API key), not an agent "
+        "key. Fix --agent-name / DAILYBOT_AGENT_NAME, or drop it."
     ),
     # Auth taxonomy
     "credential_absent": (
@@ -592,54 +593,18 @@ _PERSON_SHAPED_GUIDANCE: str = (
     "that belongs to you, and retry."
 )
 
-# Keys still cannot store `tasks:admin`. Every non-guest member holds it on a
-# person session, so structure creates/updates go through `dailybot login` — not
-# an organization-admin role check in the CLI.
+# Every non-guest member holds `tasks:admin`, on a login session and on their own
+# personal API key alike. Only a credential with nobody behind it (an agent or
+# organization key) cannot — so the fix is a person, never an admin grant.
 _ADMIN_SCOPE_GUIDANCE: str = (
-    "This action needs a signed-in person: an organization API key can never hold the "
-    "`tasks:admin` scope (it cannot even be stored on one). Run `dailybot login` and retry "
-    "as a non-guest member. Membership and participant changes stay person-only too."
+    "This key cannot change Tasks structure. Either it is an agent or organization key, "
+    "which can never hold `tasks:admin` (use `dailybot login` or a personal API key that "
+    "belongs to you), or it is a personal key whose own scopes are narrower (for example "
+    "read-only); widen or remove that key's Tasks scopes, or use `dailybot login`. Guests are "
+    "refused either way; that is a role limit."
 )
 
 
-# Machine-readable codes for the two client-side preflight refusals. They match
-# what the server would answer for the same condition, so a caller branching on
-# `code` cannot tell whether the request was spent — and does not need to.
-PREFLIGHT_ACTOR_REQUIRED_CODE: str = "actor_required"
-PREFLIGHT_ADMIN_SCOPE_CODE: str = "insufficient_scope"
-
-
-def refuse_without_person(message: str, *, json_mode: bool, admin: bool = False) -> NoReturn:
-    """End a command that a bare API key can never satisfy.
-
-    One helper, four call sites. Each module used to carry its own copy, and every
-    copy ignored ``--json`` — so `dailybot board create --json` with a key-only
-    session exited 3 with **empty stdout** while `exit_for_tasks_error` promised a
-    parseable document on every refusal path. A caller that parses stdout on any
-    non-zero exit read that as a crash rather than a credential problem.
-
-    ``admin`` selects the code the server would have used for the same condition.
-    """
-    if json_mode:
-        emit_json(
-            {
-                "status": "error",
-                "code": (PREFLIGHT_ADMIN_SCOPE_CODE if admin else PREFLIGHT_ACTOR_REQUIRED_CODE),
-                "detail": message,
-                "message": message,
-            }
-        )
-    else:
-        print_error(message)
-    # The exit must match what the SERVER would return for the same condition, or
-    # the pre-flight becomes observable: an agent branching "3 → re-login,
-    # 4 → permission" saw 3 from the pre-flight and 4 from the server for one
-    # condition. A `tasks:admin` refusal is a 403 on the wire, so it is 4 here too;
-    # a person-shaped door answers `actor_required`, which is a credential problem
-    # and stays 3.
-    raise SystemExit(EXIT_PERMISSION_DENIED if admin else EXIT_NOT_AUTHENTICATED)
-
-
 def is_person_shaped_refusal(exc: APIError, *, door: str | None = None) -> bool:
     """Is this refusal the "you are not a person" condition, in either shape?
 
@@ -658,9 +623,10 @@ def is_person_shaped_refusal(exc: APIError, *, door: str | None = None) -> bool:
 # New organization API keys start with no Tasks scopes; they are granted to the key
 # itself. Said once here so every Tasks refusal on a key reads the same.
 _KEY_WITHOUT_TASKS_SCOPES_GUIDANCE: str = (
-    "This API key has no Tasks scopes for this action{scope} — new keys start with none. "
-    "Ask an organization admin to grant Tasks scopes to the key, or write to "
-    "support@dailybot.com. Signing in with `dailybot login` also works for your own account."
+    "This API key has no Tasks scopes for this action{scope}. A personal API key acts as "
+    "you and needs no grant; an agent or organization key starts with none, and an "
+    "organization admin grants them to the key (or write to support@dailybot.com). Signing "
+    "in with `dailybot login` also works for your own account."
 )
 
 

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/dailybot_cli/commands/task.py

@@ -49,7 +49,6 @@ from dailybot_cli.commands.public_api_helpers import (
     emit_json,
     exit_for_tasks_error,
     load_json_input,
-    refuse_without_person,
     require_auth,
     rows_of,
 )
@@ -60,7 +59,6 @@ from dailybot_cli.commands.query_options import (
     query_options,
     resolve_fetch_all,
 )
-from dailybot_cli.config import get_person_token
 from dailybot_cli.display import (
     console,
     error_console,
@@ -724,22 +722,6 @@ def task_assign(task_ref: str, owner: str, idempotency_key: str | None, json_mod
     _set_owner(task_ref, owner, idempotency_key, json_mode)
 
 
-def _require_person_for(action: str, *, json_mode: bool) -> None:
-    """Refuse a key on a person-only door.
-
-    Published policy: two writes no organization API key may ever make — changing
-    who can see, and changing who is notified. Participants are the second.
-    """
-    # Gate on the absence of a person token, not on the presence of a key: both
-    # can be configured at once, and Bearer is sent first when it exists.
-    if get_person_token() is None:
-        refuse_without_person(
-            f"`{action}` changes who is notified, and no organization API key may do that — "
-            "there is no person behind it to be accountable. Run `dailybot login` and retry.",
-            json_mode=json_mode,
-        )
-
-
 def _read_body(value: str) -> str:
     """Read a body argument, or stdin when it is `-`."""
     if value == "-":
@@ -928,7 +910,6 @@ def participants_add(
     Examples:
       dailybot task participants add ENG-142 --user <user-uuid>
     """
-    _require_person_for("task participants add", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Adding the participant..."):
@@ -1003,7 +984,6 @@ def participants_remove(
       dailybot task participants remove ENG-142 <user-uuid> --dry-run
       dailybot task participants remove ENG-142 <user-uuid> --yes
     """
-    _require_person_for("task participants remove", json_mode=json_mode)
     if not confirm_without_preview(
         f"take user {user_uuid} off task {task_uuid}; they stop being notified about it.",
         assume_yes=assume_yes,
@@ -1025,8 +1005,6 @@ def participants_remove(
 
 def _set_own_mute(task_uuid: str, muted: bool, json_mode: bool) -> None:
     """Record the caller's mute on a task: POST participants/ for yourself with `is_muted`."""
-    action: str = "task mute" if muted else "task unmute"
-    _require_person_for(action, json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Reading who you are..."):
@@ -1050,7 +1028,7 @@ def _set_own_mute(task_uuid: str, muted: bool, json_mode: bool) -> None:
 @click.argument("task_uuid", metavar="TASK")
 @click.option("--json", "json_mode", is_flag=True, help="Emit machine-readable JSON to stdout.")
 def task_mute(task_uuid: str, json_mode: bool) -> None:
-    """Stop notifications from a task while staying on it. Needs `dailybot login`.
+    """Stop notifications from a task while staying on it. Needs a person: `dailybot login` or a personal API key.
 
     \b
     Examples:
@@ -1063,7 +1041,7 @@ def task_mute(task_uuid: str, json_mode: bool) -> None:
 @click.argument("task_uuid", metavar="TASK")
 @click.option("--json", "json_mode", is_flag=True, help="Emit machine-readable JSON to stdout.")
 def task_unmute(task_uuid: str, json_mode: bool) -> None:
-    """Resume notifications from a task you muted. Needs `dailybot login`.
+    """Resume notifications from a task you muted. Needs a person: `dailybot login` or a personal API key.
 
     \b
     Examples:

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/dailybot_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dailybot-cli
-Version: 3.19.0
+Version: 3.20.0
 Summary: Dailybot CLI - The command-line bridge between humans and agents. Progress reports, observability, and workflow automation for modern teams across Slack, Google Chat, Discord, MS Teams, and more.
 Author-email: Dailybot <support@dailybot.com>
 License: MIT
@@ -905,11 +905,13 @@ Replies to agent emails land as messages retrievable via `dailybot agent message
 Projects, boards and tasks. Two groups: **`dailybot tasks`** answers questions about the
 workspace, **`dailybot task`** reads or changes one task.
 
-**Structure changes need a signed-in person (any non-guest member).** Creating, updating,
-archiving or restoring boards, columns, projects and goals, board and project membership,
-and linking goals to projects all work for every non-guest member after `dailybot login`.
-An organization API key can never hold `tasks:admin` and cannot change membership or
-participants — with only `DAILYBOT_API_KEY` those commands stop before sending anything.
+**Your personal API key is you.** A login session (`dailybot login`) and a personal API key
+(one bound to you) can do everything you can do in the web app: create, update, archive and
+restore boards, columns, projects, goals and milestones, manage board and project
+membership, link goals to projects, and work every task. That is every non-guest member, no
+organization-admin prerequisite. Only an agent or organization key, with nobody behind it,
+cannot act as a person: the server refuses it (`actor_required` exit 3, `insufficient_scope`
+exit 4). Guests stay limited by their role.
 **Privacy is membership**, not org role: a `members` project or board is 404 (not visible)
 to anyone without a grant; invite a person or a team to close it.
 A board inside a `members` project follows the project's membership: whoever the project
@@ -954,9 +956,9 @@ humans who own them.
 | `dailybot task comments <uuid>` | List a task's comments |
 | `dailybot task link <a> <b> --type <rel>` | Relate two tasks (`blocks`, `relates_to`, `duplicates`) |
 | `dailybot task labels <uuid> --mode add\|remove\|replace` | Change a task's labels |
-| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); `list` works with a personal API key; add/remove **need `dailybot login`** |
+| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); all need a person: `dailybot login` or a personal API key |
 | `dailybot task watch\|unwatch <task>` | Follow a task privately — **needs a person: `dailybot login` or a personal API key** |
-| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs `dailybot login`** |
+| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot task relations <task>` · `task unlink <task> <relation>` | List links (direction included) / remove one; `unlink` confirms and has `--dry-run` |
 | `dailybot task comment-edit\|comment-delete <task> <comment>` | Edit (`-` reads stdin) or delete a comment; delete blanks the text and keeps the entry |
 | `dailybot task children <task>` · `task events <task>` · `task activity <task>` | Sub-tasks, raw event history, and the readable activity feed (`--updated-since`, `--type`) |
@@ -978,12 +980,12 @@ humans who own them.
 | `dailybot board labels <uuid>` | Labels available on the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board views <uuid>` | Your saved views on the board, plus the ETag a save needs (`--etag` prints only that) |
 | `dailybot board state create\|update\|archive\|restore\|reorder` | Manage columns. `archive` previews first and takes `--migrate-to <state>` to move the column's cards |
-| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login`**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
+| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs a person: `dailybot login` or a personal API key**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
 | `dailybot board label create <board> -n <name>` | Create an organization label from the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board view save <board> -f views.json --if-match <etag>` | Replace your saved views (the whole list) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board snapshot <uuid>` | The whole board in one request; carries the `delta_cursor` that `tasks changes` consumes |
 | `dailybot board update <uuid>` | Name, key (the old key stays reserved), visibility, estimate scale, auto-archive, project |
-| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login`** (any non-guest member) |
+| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs a person: `dailybot login` or a personal API key** (any non-guest member) |
 | `dailybot board archive <uuid>` | Archive a board. **Cascade-archives its live tasks**, and restoring does not bring them back |
 | `dailybot board restore <uuid>` | Restore a board (cascaded tasks stay archived) |
 | `dailybot project list` | List projects (`--include progress`) |
@@ -993,28 +995,28 @@ humans who own them.
 | `dailybot project milestones [<uuid>]` | List milestones |
 | `dailybot project milestone-complete <p> <m>` | Complete a milestone. **Its open tasks stay open** |
 | `dailybot project milestone-reopen <p> <m>` | Reopen a milestone |
-| `dailybot project create --name <n>` | Create a project — **needs `dailybot login`** |
+| `dailybot project create --name <n>` | Create a project — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project update <uuid>` | Name, description, lead, health, dates, visibility |
 | `dailybot project restore <uuid>` | Restore an archived project (its boards and tasks stay archived) |
-| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs `dailybot login`** |
-| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs `dailybot login`** |
+| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs a person: `dailybot login` or a personal API key** |
+| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project milestone-create\|milestone-update\|milestone-delete` | Dated milestones; delete retires it (tasks keep pointing at it) |
 | `dailybot project archive <uuid>` | Archive a project |
-| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 | `dailybot goal list` | List goals (`--include` is repeatable: `--include progress --include projects`) |
 | `dailybot goal get <uuid>` | Show one goal, with its progress and linked projects (always included) |
-| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs `dailybot login`** |
+| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot goal update <uuid>` | Name, period, owner, team, and the declared `--status` (not_started, on_track, at_risk, off_track, achieved, missed) |
 | `dailybot goal restore <uuid>` | Restore an archived goal |
 | `dailybot goal link\|unlink <goal> <project>` | Make a project count toward a goal (or stop it) |
 | `dailybot goal archive <uuid>` | Archive a goal (its projects are not archived) |
-| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 
 **Three things worth knowing before you script against this:**
 
-- **Some doors need a person.** An organization API key has no answer for "my tasks" or
-  "my inbox", can never hold `tasks:admin`, and cannot change membership or participants —
-  so container creates and invites need `dailybot login` as a non-guest member. A 404 means
+- **Some doors need a person.** A login session or a personal API key is a person; an agent
+  or organization key has no answer for "my tasks" or "my inbox", can never hold
+  `tasks:admin`, and cannot change membership or participants. A 404 means
   not visible (wrong id, private without a grant, or another org) — never "not allowed".
 - **Roll-ups are opt-in.** A field you did not request with `--include` is **absent** from
   the payload. Absent, `null` and `0` are three different answers, and the CLI renders them

{dailybot_cli-3.19.0 → dailybot_cli-3.20.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dailybot-cli"
-version = "3.19.0"
+version = "3.20.0"
 description = "Dailybot CLI - The command-line bridge between humans and agents. Progress reports, observability, and workflow automation for modern teams across Slack, Google Chat, Discord, MS Teams, and more."
 readme = "README.md"
 license = {text = "MIT"}