dailybot-cli 3.19.1__tar.gz → 3.21.0__tar.gz

{dailybot_cli-3.19.1 → dailybot_cli-3.21.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dailybot-cli
-Version: 3.19.1
+Version: 3.21.0
 Summary: Dailybot CLI - The command-line bridge between humans and agents. Progress reports, observability, and workflow automation for modern teams across Slack, Google Chat, Discord, MS Teams, and more.
 Author-email: Dailybot <support@dailybot.com>
 License: MIT
@@ -905,11 +905,13 @@ Replies to agent emails land as messages retrievable via `dailybot agent message
 Projects, boards and tasks. Two groups: **`dailybot tasks`** answers questions about the
 workspace, **`dailybot task`** reads or changes one task.
 
-**Structure changes need a signed-in person (any non-guest member).** Creating, updating,
-archiving or restoring boards, columns, projects and goals, board and project membership,
-and linking goals to projects all work for every non-guest member after `dailybot login`.
-An organization API key can never hold `tasks:admin` and cannot change membership or
-participants — with only `DAILYBOT_API_KEY` those commands stop before sending anything.
+**Your personal API key is you.** A login session (`dailybot login`) and a personal API key
+(one bound to you) can do everything you can do in the web app: create, update, archive and
+restore boards, columns, projects, goals and milestones, manage board and project
+membership, link goals to projects, and work every task. That is every non-guest member, no
+organization-admin prerequisite. Only an agent or organization key, with nobody behind it,
+cannot act as a person: the server refuses it (`actor_required` exit 3, `insufficient_scope`
+exit 4). Guests stay limited by their role.
 **Privacy is membership**, not org role: a `members` project or board is 404 (not visible)
 to anyone without a grant; invite a person or a team to close it.
 A board inside a `members` project follows the project's membership: whoever the project
@@ -954,9 +956,9 @@ humans who own them.
 | `dailybot task comments <uuid>` | List a task's comments |
 | `dailybot task link <a> <b> --type <rel>` | Relate two tasks (`blocks`, `relates_to`, `duplicates`) |
 | `dailybot task labels <uuid> --mode add\|remove\|replace` | Change a task's labels |
-| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); `list` works with a personal API key; add/remove **need `dailybot login`** |
+| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); all need a person: `dailybot login` or a personal API key |
 | `dailybot task watch\|unwatch <task>` | Follow a task privately — **needs a person: `dailybot login` or a personal API key** |
-| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs `dailybot login`** |
+| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot task relations <task>` · `task unlink <task> <relation>` | List links (direction included) / remove one; `unlink` confirms and has `--dry-run` |
 | `dailybot task comment-edit\|comment-delete <task> <comment>` | Edit (`-` reads stdin) or delete a comment; delete blanks the text and keeps the entry |
 | `dailybot task children <task>` · `task events <task>` · `task activity <task>` | Sub-tasks, raw event history, and the readable activity feed (`--updated-since`, `--type`) |
@@ -978,43 +980,46 @@ humans who own them.
 | `dailybot board labels <uuid>` | Labels available on the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board views <uuid>` | Your saved views on the board, plus the ETag a save needs (`--etag` prints only that) |
 | `dailybot board state create\|update\|archive\|restore\|reorder` | Manage columns. `archive` previews first and takes `--migrate-to <state>` to move the column's cards |
-| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login`**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
+| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs a person: `dailybot login` or a personal API key**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
 | `dailybot board label create <board> -n <name>` | Create an organization label from the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board view save <board> -f views.json --if-match <etag>` | Replace your saved views (the whole list) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board snapshot <uuid>` | The whole board in one request; carries the `delta_cursor` that `tasks changes` consumes |
 | `dailybot board update <uuid>` | Name, key (the old key stays reserved), visibility, estimate scale, auto-archive, project |
-| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login`** (any non-guest member) |
+| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs a person: `dailybot login` or a personal API key** (any non-guest member) |
 | `dailybot board archive <uuid>` | Archive a board. **Cascade-archives its live tasks**, and restoring does not bring them back |
 | `dailybot board restore <uuid>` | Restore a board (cascaded tasks stay archived) |
 | `dailybot project list` | List projects (`--include progress`) |
 | `dailybot project get <uuid>` | Show one project |
 | `dailybot project updates [<project>]` | Batched update digest, or one project's feed |
 | `dailybot project update-post <uuid> <body>` | **Post a project update** — how the team sees what was done (`--health`; sends an idempotency key) |
+| `dailybot project update-get\|update-edit\|update-delete <project> <update>` | Read one update (author, `via <agent>`, health, files); edit its text or health (author only); delete it (author or org admin; `--dry-run`) |
+| `dailybot project update-attach\|update-attachments <project> <update>` · `update-attachment get\|rename\|delete` | Files on an update (≤5 MiB). Attach and rename: author only; delete: author or an organization admin. For an inline image, attach it, then `update-edit` the body with `attachment:<uuid>` |
 | `dailybot project milestones [<uuid>]` | List milestones |
 | `dailybot project milestone-complete <p> <m>` | Complete a milestone. **Its open tasks stay open** |
 | `dailybot project milestone-reopen <p> <m>` | Reopen a milestone |
-| `dailybot project create --name <n>` | Create a project — **needs `dailybot login`** |
+| `dailybot project create --name <n>` | Create a project — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project update <uuid>` | Name, description, lead, health, dates, visibility |
 | `dailybot project restore <uuid>` | Restore an archived project (its boards and tasks stay archived) |
-| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs `dailybot login`** |
-| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs `dailybot login`** |
+| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs a person: `dailybot login` or a personal API key** |
+| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project milestone-create\|milestone-update\|milestone-delete` | Dated milestones; delete retires it (tasks keep pointing at it) |
+| `dailybot project milestone-attach\|milestone-attachments <project> <milestone>` · `milestone-attachment get\|rename\|delete` | Files on a milestone (≤5 MiB); reference one in the description with `attachment:<uuid>`. `project milestone-restore` brings a retired milestone back |
 | `dailybot project archive <uuid>` | Archive a project |
-| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 | `dailybot goal list` | List goals (`--include` is repeatable: `--include progress --include projects`) |
 | `dailybot goal get <uuid>` | Show one goal, with its progress and linked projects (always included) |
-| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs `dailybot login`** |
+| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot goal update <uuid>` | Name, period, owner, team, and the declared `--status` (not_started, on_track, at_risk, off_track, achieved, missed) |
 | `dailybot goal restore <uuid>` | Restore an archived goal |
 | `dailybot goal link\|unlink <goal> <project>` | Make a project count toward a goal (or stop it) |
 | `dailybot goal archive <uuid>` | Archive a goal (its projects are not archived) |
-| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 
 **Three things worth knowing before you script against this:**
 
-- **Some doors need a person.** An organization API key has no answer for "my tasks" or
-  "my inbox", can never hold `tasks:admin`, and cannot change membership or participants —
-  so container creates and invites need `dailybot login` as a non-guest member. A 404 means
+- **Some doors need a person.** A login session or a personal API key is a person; an agent
+  or organization key has no answer for "my tasks" or "my inbox", can never hold
+  `tasks:admin`, and cannot change membership or participants. A 404 means
   not visible (wrong id, private without a grant, or another org) — never "not allowed".
 - **Roll-ups are opt-in.** A field you did not request with `--include` is **absent** from
   the payload. Absent, `null` and `0` are three different answers, and the CLI renders them

{dailybot_cli-3.19.1 → dailybot_cli-3.21.0}/README.md

@@ -866,11 +866,13 @@ Replies to agent emails land as messages retrievable via `dailybot agent message
 Projects, boards and tasks. Two groups: **`dailybot tasks`** answers questions about the
 workspace, **`dailybot task`** reads or changes one task.
 
-**Structure changes need a signed-in person (any non-guest member).** Creating, updating,
-archiving or restoring boards, columns, projects and goals, board and project membership,
-and linking goals to projects all work for every non-guest member after `dailybot login`.
-An organization API key can never hold `tasks:admin` and cannot change membership or
-participants — with only `DAILYBOT_API_KEY` those commands stop before sending anything.
+**Your personal API key is you.** A login session (`dailybot login`) and a personal API key
+(one bound to you) can do everything you can do in the web app: create, update, archive and
+restore boards, columns, projects, goals and milestones, manage board and project
+membership, link goals to projects, and work every task. That is every non-guest member, no
+organization-admin prerequisite. Only an agent or organization key, with nobody behind it,
+cannot act as a person: the server refuses it (`actor_required` exit 3, `insufficient_scope`
+exit 4). Guests stay limited by their role.
 **Privacy is membership**, not org role: a `members` project or board is 404 (not visible)
 to anyone without a grant; invite a person or a team to close it.
 A board inside a `members` project follows the project's membership: whoever the project
@@ -915,9 +917,9 @@ humans who own them.
 | `dailybot task comments <uuid>` | List a task's comments |
 | `dailybot task link <a> <b> --type <rel>` | Relate two tasks (`blocks`, `relates_to`, `duplicates`) |
 | `dailybot task labels <uuid> --mode add\|remove\|replace` | Change a task's labels |
-| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); `list` works with a personal API key; add/remove **need `dailybot login`** |
+| `dailybot task participants add\|list\|remove <task>` | Who is on a task (`--role participant\|watcher`); all need a person: `dailybot login` or a personal API key |
 | `dailybot task watch\|unwatch <task>` | Follow a task privately — **needs a person: `dailybot login` or a personal API key** |
-| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs `dailybot login`** |
+| `dailybot task mute\|unmute <task>` | Silence a task and stay on it (leaving is `participants remove`) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot task relations <task>` · `task unlink <task> <relation>` | List links (direction included) / remove one; `unlink` confirms and has `--dry-run` |
 | `dailybot task comment-edit\|comment-delete <task> <comment>` | Edit (`-` reads stdin) or delete a comment; delete blanks the text and keeps the entry |
 | `dailybot task children <task>` · `task events <task>` · `task activity <task>` | Sub-tasks, raw event history, and the readable activity feed (`--updated-since`, `--type`) |
@@ -939,43 +941,46 @@ humans who own them.
 | `dailybot board labels <uuid>` | Labels available on the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board views <uuid>` | Your saved views on the board, plus the ETag a save needs (`--etag` prints only that) |
 | `dailybot board state create\|update\|archive\|restore\|reorder` | Manage columns. `archive` previews first and takes `--migrate-to <state>` to move the column's cards |
-| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs `dailybot login`**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
+| `dailybot board member add <board> <user>` (or `--team <team>`) · `board member remove <board> <user>` | Who can see the board — **needs a person: `dailybot login` or a personal API key**. Membership is the privacy control (not org role). A team grant follows the team live. Last grant on a private board stays (`last_grant_cannot_be_removed`) |
 | `dailybot board label create <board> -n <name>` | Create an organization label from the board — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board view save <board> -f views.json --if-match <etag>` | Replace your saved views (the whole list) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot board snapshot <uuid>` | The whole board in one request; carries the `delta_cursor` that `tasks changes` consumes |
 | `dailybot board update <uuid>` | Name, key (the old key stays reserved), visibility, estimate scale, auto-archive, project |
-| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs `dailybot login`** (any non-guest member) |
+| `dailybot board create --name <n> --project <uuid> --key <KEY>` | Create a board in a project; the key prefixes its tasks (`DSN-1`) — **needs a person: `dailybot login` or a personal API key** (any non-guest member) |
 | `dailybot board archive <uuid>` | Archive a board. **Cascade-archives its live tasks**, and restoring does not bring them back |
 | `dailybot board restore <uuid>` | Restore a board (cascaded tasks stay archived) |
 | `dailybot project list` | List projects (`--include progress`) |
 | `dailybot project get <uuid>` | Show one project |
 | `dailybot project updates [<project>]` | Batched update digest, or one project's feed |
 | `dailybot project update-post <uuid> <body>` | **Post a project update** — how the team sees what was done (`--health`; sends an idempotency key) |
+| `dailybot project update-get\|update-edit\|update-delete <project> <update>` | Read one update (author, `via <agent>`, health, files); edit its text or health (author only); delete it (author or org admin; `--dry-run`) |
+| `dailybot project update-attach\|update-attachments <project> <update>` · `update-attachment get\|rename\|delete` | Files on an update (≤5 MiB). Attach and rename: author only; delete: author or an organization admin. For an inline image, attach it, then `update-edit` the body with `attachment:<uuid>` |
 | `dailybot project milestones [<uuid>]` | List milestones |
 | `dailybot project milestone-complete <p> <m>` | Complete a milestone. **Its open tasks stay open** |
 | `dailybot project milestone-reopen <p> <m>` | Reopen a milestone |
-| `dailybot project create --name <n>` | Create a project — **needs `dailybot login`** |
+| `dailybot project create --name <n>` | Create a project — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project update <uuid>` | Name, description, lead, health, dates, visibility |
 | `dailybot project restore <uuid>` | Restore an archived project (its boards and tasks stay archived) |
-| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs `dailybot login`** |
-| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs `dailybot login`** |
+| `dailybot project members <uuid>` · `project member add\|remove` | Who can see the project — people or whole teams (`--team`) — `members` works with a personal API key; `member add\|remove` **needs a person: `dailybot login` or a personal API key** |
+| `dailybot project views <uuid>` · `project view save` | Your saved views; save replaces the list and requires the ETag — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot project milestone-create\|milestone-update\|milestone-delete` | Dated milestones; delete retires it (tasks keep pointing at it) |
+| `dailybot project milestone-attach\|milestone-attachments <project> <milestone>` · `milestone-attachment get\|rename\|delete` | Files on a milestone (≤5 MiB); reference one in the description with `attachment:<uuid>`. `project milestone-restore` brings a retired milestone back |
 | `dailybot project archive <uuid>` | Archive a project |
-| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot project attach <uuid> <file>` · `project attachments` · `project attachment get\|delete` | Files on a project (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 | `dailybot goal list` | List goals (`--include` is repeatable: `--include progress --include projects`) |
 | `dailybot goal get <uuid>` | Show one goal, with its progress and linked projects (always included) |
-| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs `dailybot login`** |
+| `dailybot goal create --name <n> --period-start <d> --period-end <d>` | Create a goal (a dated commitment) — **needs a person: `dailybot login` or a personal API key** |
 | `dailybot goal update <uuid>` | Name, period, owner, team, and the declared `--status` (not_started, on_track, at_risk, off_track, achieved, missed) |
 | `dailybot goal restore <uuid>` | Restore an archived goal |
 | `dailybot goal link\|unlink <goal> <project>` | Make a project count toward a goal (or stop it) |
 | `dailybot goal archive <uuid>` | Archive a goal (its projects are not archived) |
-| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need `dailybot login` |
+| `dailybot goal attach <uuid> <file>` · `goal attachments` · `goal attachment get\|delete` | Files on a goal (≤5 MiB, one request). Attaching and deleting need a person (`dailybot login` or a personal API key) |
 
 **Three things worth knowing before you script against this:**
 
-- **Some doors need a person.** An organization API key has no answer for "my tasks" or
-  "my inbox", can never hold `tasks:admin`, and cannot change membership or participants —
-  so container creates and invites need `dailybot login` as a non-guest member. A 404 means
+- **Some doors need a person.** A login session or a personal API key is a person; an agent
+  or organization key has no answer for "my tasks" or "my inbox", can never hold
+  `tasks:admin`, and cannot change membership or participants. A 404 means
   not visible (wrong id, private without a grant, or another org) — never "not allowed".
 - **Roll-ups are opt-in.** A field you did not request with `--include` is **absent** from
   the payload. Absent, `null` and `0` are three different answers, and the CLI renders them

{dailybot_cli-3.19.1 → dailybot_cli-3.21.0}/dailybot_cli/api_client.py

@@ -100,6 +100,8 @@ SAME_ORIGIN_UPLOAD_METHODS: frozenset[str] = frozenset({"PUT", "POST"})
 # BLAST_RADIUS.md records this as THE volume guard for unattended destructive
 # loops — the CLI adds no second ceiling of its own.
 TASKS_BULK_MAX_ITEMS: int = 100
+# Body field an attachment rename (PATCH …/attachments/<uuid>/) carries.
+ATTACHMENT_RENAME_FIELD: str = "filename"
 # Collections the task detail door can embed in one read (first page each).
 TASK_BRIEFING_INCLUDES: tuple[str, ...] = (
     "relations",
@@ -2885,7 +2887,7 @@ class DailyBotClient:
         return self._tasks_write(
             "POST",
             f"tasks/{_path_segment(task_uuid)}/labels/batch/",
-            json={"mode": mode, "labels": labels},
+            json={"mode": mode, "label_uuids": labels},
             idempotent=True,
             idempotency_key=idempotency_key,
         )
@@ -3321,6 +3323,143 @@ class DailyBotClient:
         """GET /v1/tasks/projects/<p>/attachments/<a>/content/."""
         return self._download_attachment_of(self._project_parent(project_uuid), attachment_uuid)
 
+    # Milestone and project-update attachments: the same row shape as project ones.
+    @staticmethod
+    def _milestone_parent(project_uuid: str, milestone_uuid: str) -> str:
+        return f"projects/{_path_segment(project_uuid)}/milestones/{_path_segment(milestone_uuid)}"
+
+    @staticmethod
+    def _update_parent(project_uuid: str, update_uuid: str) -> str:
+        return f"projects/{_path_segment(project_uuid)}/updates/{_path_segment(update_uuid)}"
+
+    def _rename_attachment_of(self, parent: str, attachment_uuid: str, *, filename: str) -> Any:
+        """PATCH <parent>/attachments/<uuid>/ — rename the file."""
+        return self._tasks_write(
+            "PATCH",
+            f"{parent}/attachments/{_path_segment(attachment_uuid)}/",
+            json={ATTACHMENT_RENAME_FIELD: filename},
+        )
+
+    def upload_milestone_attachment(
+        self,
+        project_uuid: str,
+        milestone_uuid: str,
+        *,
+        filename: str,
+        content_type: str,
+        data: bytes,
+        caption: str | None = None,
+    ) -> dict[str, Any]:
+        """POST …/milestones/<m>/attachments/ as multipart (≤5 MiB)."""
+        return self._upload_attachment_to(
+            self._milestone_parent(project_uuid, milestone_uuid),
+            filename=filename,
+            content_type=content_type,
+            data=data,
+            caption=caption,
+        )
+
+    def list_milestone_attachments(self, project_uuid: str, milestone_uuid: str) -> Any:
+        """GET …/milestones/<m>/attachments/."""
+        return self._list_attachments_of(self._milestone_parent(project_uuid, milestone_uuid))
+
+    def download_milestone_attachment(
+        self, project_uuid: str, milestone_uuid: str, attachment_uuid: str
+    ) -> bytes:
+        """GET …/milestones/<m>/attachments/<a>/content/."""
+        return self._download_attachment_of(
+            self._milestone_parent(project_uuid, milestone_uuid), attachment_uuid
+        )
+
+    def rename_milestone_attachment(
+        self, project_uuid: str, milestone_uuid: str, attachment_uuid: str, *, filename: str
+    ) -> Any:
+        """PATCH …/milestones/<m>/attachments/<a>/."""
+        return self._rename_attachment_of(
+            self._milestone_parent(project_uuid, milestone_uuid), attachment_uuid, filename=filename
+        )
+
+    def delete_milestone_attachment(
+        self, project_uuid: str, milestone_uuid: str, attachment_uuid: str
+    ) -> Any:
+        """DELETE …/milestones/<m>/attachments/<a>/."""
+        return self._delete_attachment_of(
+            self._milestone_parent(project_uuid, milestone_uuid), attachment_uuid
+        )
+
+    def get_project_update(self, project_uuid: str, update_uuid: str) -> dict[str, Any]:
+        """GET /v1/tasks/projects/<p>/updates/<u>/."""
+        return self._tasks_read(f"{self._update_parent(project_uuid, update_uuid)}/")
+
+    def edit_project_update(
+        self,
+        project_uuid: str,
+        update_uuid: str,
+        *,
+        body: str | None = None,
+        health: str | None = None,
+    ) -> Any:
+        """PATCH /v1/tasks/projects/<p>/updates/<u>/ — author only (`update_not_author`)."""
+        payload: dict[str, Any] = {}
+        if body is not None:
+            payload["body"] = body
+        if health is not None:
+            payload["health"] = health
+        return self._tasks_write(
+            "PATCH", f"{self._update_parent(project_uuid, update_uuid)}/", json=payload
+        )
+
+    def delete_project_update(self, project_uuid: str, update_uuid: str) -> Any:
+        """DELETE /v1/tasks/projects/<p>/updates/<u>/ — the author or an org admin."""
+        return self._tasks_write("DELETE", f"{self._update_parent(project_uuid, update_uuid)}/")
+
+    def upload_update_attachment(
+        self,
+        project_uuid: str,
+        update_uuid: str,
+        *,
+        filename: str,
+        content_type: str,
+        data: bytes,
+        caption: str | None = None,
+    ) -> dict[str, Any]:
+        """POST …/updates/<u>/attachments/ as multipart (≤5 MiB) — author only."""
+        return self._upload_attachment_to(
+            self._update_parent(project_uuid, update_uuid),
+            filename=filename,
+            content_type=content_type,
+            data=data,
+            caption=caption,
+        )
+
+    def list_update_attachments(self, project_uuid: str, update_uuid: str) -> Any:
+        """GET …/updates/<u>/attachments/."""
+        return self._list_attachments_of(self._update_parent(project_uuid, update_uuid))
+
+    def download_update_attachment(
+        self, project_uuid: str, update_uuid: str, attachment_uuid: str
+    ) -> bytes:
+        """GET …/updates/<u>/attachments/<a>/content/."""
+        return self._download_attachment_of(
+            self._update_parent(project_uuid, update_uuid), attachment_uuid
+        )
+
+    def rename_update_attachment(
+        self, project_uuid: str, update_uuid: str, attachment_uuid: str, *, filename: str
+    ) -> Any:
+        """PATCH …/updates/<u>/attachments/<a>/."""
+        return self._rename_attachment_of(
+            self._update_parent(project_uuid, update_uuid), attachment_uuid, filename=filename
+        )
+
+    def delete_update_attachment(
+        self, project_uuid: str, update_uuid: str, attachment_uuid: str
+    ) -> Any:
+        """DELETE …/updates/<u>/attachments/<a>/."""
+        return self._delete_attachment_of(
+            self._update_parent(project_uuid, update_uuid), attachment_uuid
+        )
+
     # Goal attachments (POST / DELETE: signed-in person; reads: anyone who can see it)
     def upload_goal_attachment(
         self,
@@ -3599,6 +3738,14 @@ class DailyBotClient:
             json={k: v for k, v in fields.items() if v is not None},
         )
 
+    def restore_milestone(self, project_uuid: str, milestone_uuid: str) -> dict[str, Any]:
+        """POST …/milestones/<uuid>/restore/ — bring a retired milestone back (idempotent)."""
+        return self._tasks_write(
+            "POST",
+            f"projects/{_path_segment(project_uuid)}/milestones/{_path_segment(milestone_uuid)}/"
+            "restore/",
+        )
+
     def delete_milestone(self, project_uuid: str, milestone_uuid: str) -> Any:
         """DELETE …/milestones/<uuid>/ — retires (archives); tasks keep pointing at it."""
         return self._tasks_write(

{dailybot_cli-3.19.1 → dailybot_cli-3.21.0}/dailybot_cli/commands/_attachments.py

@@ -1,9 +1,10 @@
-"""Shared attachment flows for tasks, comments, projects and goals.
+"""Shared attachment flows for tasks, comments, projects, goals, milestones and updates.
 
-Four parents own an `attachments/` collection with the same row shape, so the
+Six parents own an `attachments/` collection with the same row shape, so the
 commands share one implementation of each step: read the local file under a
 hard limit, upload, list, download to a path that is never overwritten by
-surprise, and delete with a stated consequence. Each command supplies only the
+surprise, rename within the server's bounds, and delete with a stated
+consequence. Each command supplies only the
 client call for its parent.
 """
 
@@ -190,6 +191,34 @@ def run_get(
     print_success(f"Saved {len(content)} bytes to {output}.")
 
 
+ATTACHMENT_NAME_MAX_CHARS: int = 255
+
+
+def run_rename(
+    rename: Callable[[Any, str], Any],
+    filename: str,
+    *,
+    json_mode: bool,
+    require_auth: Callable[[], Any],
+) -> None:
+    """Rename one attachment. The name is checked locally against the server's bounds."""
+    cleaned: str = filename.strip()
+    if not cleaned or len(cleaned) > ATTACHMENT_NAME_MAX_CHARS:
+        raise click.UsageError(
+            f"The new name must be 1 to {ATTACHMENT_NAME_MAX_CHARS} characters. Nothing was sent."
+        )
+    client: Any = require_auth()
+    try:
+        with console.status("Renaming the attachment..."):
+            data: Any = rename(client, cleaned)
+    except APIError as exc:
+        exit_for_tasks_error(exc, json_mode)
+    if json_mode:
+        emit_json(data)
+        return
+    print_success(f"Attachment renamed to {cleaned}.")
+
+
 def run_delete(
     delete: Callable[[Any], Any],
     consequence: str,

{dailybot_cli-3.19.1 → dailybot_cli-3.21.0}/dailybot_cli/commands/board.py

@@ -21,7 +21,6 @@ from dailybot_cli.commands.public_api_helpers import (
     emit_json,
     exit_for_tasks_error,
     load_json_input,
-    refuse_without_person,
     require_auth,
     rows_of,
 )
@@ -32,7 +31,6 @@ from dailybot_cli.commands.query_options import (
     query_options,
     resolve_fetch_all,
 )
-from dailybot_cli.config import get_person_token
 from dailybot_cli.display import (
     console,
     print_board_snapshot,
@@ -479,7 +477,6 @@ def board_state_create(
       dailybot board state create <board-uuid> -n "In review" --category in_progress
       dailybot board state create <board-uuid> -n Blocked --category todo --position 2 --json
     """
-    _require_person_for_admin("board state create", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Adding the column..."):
@@ -528,7 +525,6 @@ def board_state_update(
       dailybot board state update <board-uuid> <state-uuid> --name "Shipped"
       dailybot board state update <board-uuid> <state-uuid> --position 1 --json
     """
-    _require_person_for_admin("board state update", json_mode=json_mode)
     fields: dict[str, Any] = {
         k: v
         for k, v in {"name": name, "color": color, "position": position}.items()
@@ -578,7 +574,6 @@ def board_state_archive(
       dailybot board state archive <board-uuid> <state-uuid> --dry-run
       dailybot board state archive <board-uuid> <state-uuid> --migrate-to <other-state> --yes
     """
-    _require_person_for_admin("board state archive", json_mode=json_mode)
     client = require_auth()
     if not preview_then_confirm(
         lambda: client.archive_board_state(
@@ -613,7 +608,6 @@ def board_state_restore(board_uuid: str, state_uuid: str, json_mode: bool) -> No
     Examples:
       dailybot board state restore <board-uuid> <state-uuid>
     """
-    _require_person_for_admin("board state restore", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Restoring the column..."):
@@ -642,7 +636,6 @@ def board_state_reorder(board_uuid: str, state_uuids: tuple[str, ...], json_mode
     Examples:
       dailybot board state reorder <board-uuid> <backlog> <todo> <doing> <done>
     """
-    _require_person_for_admin("board state reorder", json_mode=json_mode)
     if len(set(state_uuids)) != len(state_uuids):
         raise click.UsageError("A column appears twice. List each live column exactly once.")
     client = require_auth()
@@ -669,7 +662,7 @@ _MEMBER_WRITE_REASON: str = (
 
 @board.group("member")
 def board_member() -> None:
-    """Invite or remove who can see a board. Needs `dailybot login`.
+    """Invite or remove who can see a board. Needs a person: `dailybot login` or a personal API key.
 
     \b
     Membership is the privacy control: a `members` board is invisible (404) to
@@ -713,7 +706,6 @@ def board_member_add(
       dailybot board member add <board-uuid> <user-uuid>
       dailybot board member add <board-uuid> --team <team-uuid> --json
     """
-    _require_person_for_admin("board member add", json_mode=json_mode)
     if (user_uuid is None) == (team_uuid is None):
         raise click.UsageError("Pass exactly one of USER or --team.")
     client = require_auth()
@@ -751,7 +743,6 @@ def board_member_remove(
       dailybot board member remove <board-uuid> <user-uuid> --dry-run
       dailybot board member remove <board-uuid> <user-uuid> --yes
     """
-    _require_person_for_admin("board member remove", json_mode=json_mode)
     if not confirm_without_preview(
         f"remove user {user_uuid} from board {board_uuid}; they lose sight of it if it is private.",
         assume_yes=assume_yes,
@@ -930,26 +921,6 @@ def board_snapshot(board_uuid: str, json_mode: bool) -> None:
     print_board_snapshot(data)
 
 
-def _require_person_for_admin(action: str, *, json_mode: bool) -> None:
-    """Refuse an organization API key on a structure or membership door.
-
-    Open-org Tasks: every non-guest member holds `tasks:admin` on a person session,
-    so the CLI never asks for an organization-admin role. An organization API key
-    still cannot store that scope (or change membership / participants), so the
-    message blames the **credential kind** — run `dailybot login` as a member.
-    """
-    # Gate on the absence of a person token, not on the presence of a key: both
-    # can be configured at once, and Bearer is sent first when it exists.
-    if get_person_token() is None:
-        refuse_without_person(
-            f"`{action}` needs a signed-in person. An organization API key can never hold "
-            "the `tasks:admin` scope (it cannot even be stored on one), and keys cannot "
-            "change membership. Run `dailybot login` and retry as a non-guest member.",
-            json_mode=json_mode,
-            admin=True,
-        )
-
-
 @board.command("create")
 @click.option("-n", "--name", required=True, help="Board name.")
 # Boards have no description field (BoardWrite declares none), so the flag the CLI
@@ -977,11 +948,11 @@ def board_create(
     idempotency_key: str | None,
     json_mode: bool,
 ) -> None:
-    """Create a board in a project. Needs a signed-in person (any non-guest member).
+    """Create a board in a project. Needs a person (any non-guest member): `dailybot login` or a personal API key.
 
     \b
-    An organization API key cannot do this — run `dailybot login` first. Visibility
-    and who can see the board are controlled by invite/remove, not by org role.
+    An agent or organization key cannot do this. Visibility and who can see the
+    board are controlled by invite/remove, not by org role.
 
     \b
     Examples:
@@ -992,7 +963,6 @@ def board_create(
             "Boards have no description. Put the context in a project "
             "(`dailybot project create -d ...`) and create the board under it."
         )
-    _require_person_for_admin("board create", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Creating the board..."):
@@ -1054,7 +1024,6 @@ def board_update(
       dailybot board update <board-uuid> --name "Design (Q4)"
       dailybot board update <board-uuid> --key DSN --visibility members --json
     """
-    _require_person_for_admin("board update", json_mode=json_mode)
     fields: dict[str, Any] = {
         k: v
         for k, v in {
@@ -1105,7 +1074,6 @@ def board_archive(
     Examples:
       dailybot board archive <board-uuid> --dry-run
     """
-    _require_person_for_admin("board archive", json_mode=json_mode)
     client = require_auth()
     if not preview_then_confirm(
         lambda: client.archive_board(board_uuid, dry_run=True),
@@ -1146,7 +1114,6 @@ def board_restore(board_uuid: str, idempotency_key: str | None, json_mode: bool)
     Examples:
       dailybot board restore <board-uuid>
     """
-    _require_person_for_admin("board restore", json_mode=json_mode)
     client = require_auth()
     try:
         with console.status("Restoring the board..."):