socialcli 0.3.0__tar.gz → 0.3.2__tar.gz

{socialcli-0.3.0 → socialcli-0.3.2}/.gitignore

@@ -36,3 +36,6 @@ build/
 **/service.env
 **/auth.env
 **/database.env
+
+# Private server artifacts must never enter public release uploads.
+private-dist/

socialcli-0.3.2/LICENSE

@@ -0,0 +1,48 @@
+SocialCli Proprietary Software License
+Version 1 — October 24, 2026
+Copyright (c) 2026 Engels Florentino. All rights reserved.
+SocialCli is operated by Florentino.pro.
+
+1. Scope
+This license applies to SocialCli releases beginning with version 0.3.2 and
+subsequent releases that include this license. It does not revoke or restrict
+rights already granted for earlier MIT-licensed releases. The historical MIT
+notice is preserved in LICENSE-MIT-LEGACY. Third-party components remain subject
+to their own licenses; this license does not replace those terms.
+
+2. Authorized client use
+You may download, install, run and make necessary backup copies of the official
+SocialCli client to access the SocialCli hosted service through an authorized
+account. You may use it for your personal or business social accounts, including
+accounts you are authorized to manage for clients. You may let your authorized
+AI agents operate the client under your supervision and the same account terms.
+Service access requires an eligible trial, subscription or other access expressly
+granted by Florentino.pro. Installing the client does not grant service access,
+provider credentials, unlimited usage or ownership of the software.
+
+3. Reserved rights
+Except as expressly allowed above, required by applicable law, or separately
+agreed in writing by the copyright holder, you may not redistribute, sublicense,
+sell, rent or offer this software as a service; modify or use it to build or run
+a competing product or hosted service; bypass access, subscription or security
+controls; or remove copyright, license or attribution notices. No license to the
+private server implementation is granted to customers. No trademark rights in
+SocialCli or Florentino.pro are granted. You retain your rights in your content
+and data. These restrictions do not limit rights separately granted under the
+legacy MIT license or a third-party license.
+
+4. Service terms
+Use of the hosted service is also subject to https://socialcli.app/terms.html.
+Your subscription pays for service access, not ownership of or redistribution
+rights to the software. Account eligibility and access are determined by the
+service, not by a local client setting.
+
+5. Warranty and liability
+To the maximum extent permitted by applicable law, this software is provided
+"AS IS", without warranties of any kind, including merchantability, fitness
+for a particular purpose and noninfringement. The copyright holder and operator
+are not liable for indirect, incidental, special or consequential damages
+arising from use of the software. Nothing in this license excludes or limits
+rights, remedies or liabilities that cannot lawfully be excluded or limited.
+
+For additional permissions, contact admin@socialcli.app.

{socialcli-0.3.0 → socialcli-0.3.2}/PKG-INFO

@@ -1,22 +1,19 @@
 Metadata-Version: 2.5
 Name: socialcli
-Version: 0.3.0
+Version: 0.3.2
 Summary: SocialCli: publish and manage creator-owned social content from the terminal.
 Project-URL: Homepage, https://socialcli.app
-Project-URL: Repository, https://github.com/engels-florentino/SocialCli
-Project-URL: Issues, https://github.com/engels-florentino/SocialCli/issues
-License-Expression: MIT
+Project-URL: Documentation, https://socialcli.app/ai-agents.html
+Project-URL: Terms, https://socialcli.app/terms.html
+License-Expression: LicenseRef-SocialCli-Proprietary
 License-File: LICENSE
+License-File: LICENSE-MIT-LEGACY
 Requires-Python: >=3.11
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: keyring>=25.0
 Requires-Dist: pydantic>=2.13.5
 Requires-Dist: pyyaml>=6.0.3
 Requires-Dist: typer>=0.27.2
-Provides-Extra: connection-server
-Requires-Dist: cryptography>=43; extra == 'connection-server'
-Requires-Dist: fastapi>=0.115; extra == 'connection-server'
-Requires-Dist: uvicorn>=0.30; extra == 'connection-server'
 Provides-Extra: headless-credentials
 Requires-Dist: cryptography>=43; extra == 'headless-credentials'
 Description-Content-Type: text/markdown
@@ -25,7 +22,7 @@ Description-Content-Type: text/markdown
 
 # SocialCli
 
-**Current source version: 0.3.0.** SocialCli SaaS is the current SocialCli
+**Current stable version: 0.3.1 (published on PyPI). Source preparation: 0.3.2.** SocialCli SaaS is the current SocialCli
 product. The repository root on `main` is its single development workspace;
 the CLI, hosted connection service and account/billing components live together
 here. Earlier versions remain in Git history for reference and migration.
@@ -61,9 +58,9 @@ Stripe uses test mode. Planned access costs
 USD 10/month after 14 free days from the first successful connection. No real
 subscriptions are collected in this pilot.
 
-The current client release target is **0.3.0** (published first to TestPyPI and
-then to PyPI through the reviewed release workflow). The compatible hosted
-runtime is `socialcli-saas-candidate:45fda63`. The client's wheel and
+The current stable client is **0.3.1**, published on TestPyPI and PyPI after
+reviewed CI, matching artifact hashes and clean-install verification.
+The hosted service is managed and verified separately from the CLI release. The client's wheel and
 source archive are verified against the
 reviewed build hashes before publication. Provider commercial approvals and live
 billing cutover remain separate from package publication. See the
@@ -141,7 +138,9 @@ Metrics and management permissions are separate from publishing permissions. A v
 
 Read [CONTRIBUTING.md](CONTRIBUTING.md). For questions or bugs, open an [issue](https://github.com/engels-florentino/SocialCli/issues) without tokens, keys, `.env` files or private logs. Report vulnerabilities through the private channel described in [SECURITY.md](SECURITY.md).
 
-[MIT license](LICENSE). SocialCli is not affiliated with the platforms it integrates.
+[Proprietary license](LICENSE) for 0.3.2 and later. Earlier releases retain their
+[MIT license](LICENSE-MIT-LEGACY). The hosted server is private and is not included
+in public client distributions. SocialCli is not affiliated with the platforms it integrates.
 
 ## Account, media and scheduling
 

{socialcli-0.3.0 → socialcli-0.3.2}/README.md

@@ -2,7 +2,7 @@
 
 # SocialCli
 
-**Current source version: 0.3.0.** SocialCli SaaS is the current SocialCli
+**Current stable version: 0.3.1 (published on PyPI). Source preparation: 0.3.2.** SocialCli SaaS is the current SocialCli
 product. The repository root on `main` is its single development workspace;
 the CLI, hosted connection service and account/billing components live together
 here. Earlier versions remain in Git history for reference and migration.
@@ -38,9 +38,9 @@ Stripe uses test mode. Planned access costs
 USD 10/month after 14 free days from the first successful connection. No real
 subscriptions are collected in this pilot.
 
-The current client release target is **0.3.0** (published first to TestPyPI and
-then to PyPI through the reviewed release workflow). The compatible hosted
-runtime is `socialcli-saas-candidate:45fda63`. The client's wheel and
+The current stable client is **0.3.1**, published on TestPyPI and PyPI after
+reviewed CI, matching artifact hashes and clean-install verification.
+The hosted service is managed and verified separately from the CLI release. The client's wheel and
 source archive are verified against the
 reviewed build hashes before publication. Provider commercial approvals and live
 billing cutover remain separate from package publication. See the
@@ -118,7 +118,9 @@ Metrics and management permissions are separate from publishing permissions. A v
 
 Read [CONTRIBUTING.md](CONTRIBUTING.md). For questions or bugs, open an [issue](https://github.com/engels-florentino/SocialCli/issues) without tokens, keys, `.env` files or private logs. Report vulnerabilities through the private channel described in [SECURITY.md](SECURITY.md).
 
-[MIT license](LICENSE). SocialCli is not affiliated with the platforms it integrates.
+[Proprietary license](LICENSE) for 0.3.2 and later. Earlier releases retain their
+[MIT license](LICENSE-MIT-LEGACY). The hosted server is private and is not included
+in public client distributions. SocialCli is not affiliated with the platforms it integrates.
 
 ## Account, media and scheduling
 

socialcli-0.3.2/pyproject.toml

@@ -0,0 +1,183 @@
+[project]
+name = "socialcli"
+version = "0.3.2"
+description = "SocialCli: publish and manage creator-owned social content from the terminal."
+readme = "README.md"
+license = "LicenseRef-SocialCli-Proprietary"
+license-files = ["LICENSE", "LICENSE-MIT-LEGACY"]
+requires-python = ">=3.11"
+dependencies = [
+    "httpx>=0.28.1",
+    "keyring>=25.0",
+    "pydantic>=2.13.5",
+    "pyyaml>=6.0.3",
+    "typer>=0.27.2",
+]
+
+[project.scripts]
+socialcli = "socialctl.cli:app"
+socialctl = "socialctl.cli:app"
+
+[project.urls]
+Homepage = "https://socialcli.app"
+Documentation = "https://socialcli.app/ai-agents.html"
+Terms = "https://socialcli.app/terms.html"
+
+[project.optional-dependencies]
+headless-credentials = ["cryptography>=43"]
+
+[dependency-groups]
+dev = [
+    "cryptography>=43",
+    "fastapi>=0.115",
+    "pytest>=9.1.1",
+    "respx>=0.23.1",
+]
+
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+
+# Public client boundary. New modules require explicit review before distribution.
+[tool.hatch.build]
+only-include = [
+    "socialctl/__init__.py",
+    "socialctl/__main__.py",
+    "socialctl/agent_errors.py",
+    "socialctl/agent_guide.py",
+    "socialctl/approval_cli.py",
+    "socialctl/auth.py",
+    "socialctl/authflow.py",
+    "socialctl/brands.py",
+    "socialctl/capabilities.py",
+    "socialctl/cli.py",
+    "socialctl/delivery_options.py",
+    "socialctl/engagement.py",
+    "socialctl/engagement_cli.py",
+    "socialctl/executor.py",
+    "socialctl/formatter.py",
+    "socialctl/hosted_media.py",
+    "socialctl/identity.py",
+    "socialctl/inbox.py",
+    "socialctl/inbox_cli.py",
+    "socialctl/inventory.py",
+    "socialctl/inventory_cli.py",
+    "socialctl/inventory_sources.py",
+    "socialctl/media.py",
+    "socialctl/media_cli.py",
+    "socialctl/media_ingress.py",
+    "socialctl/media_preflight.py",
+    "socialctl/media_registry.py",
+    "socialctl/media_requirements.py",
+    "socialctl/migration_cli.py",
+    "socialctl/migration_files.py",
+    "socialctl/models.py",
+    "socialctl/operation_output.py",
+    "socialctl/postfile.py",
+    "socialctl/preflight.py",
+    "socialctl/publication_policy.py",
+    "socialctl/publication_status.py",
+    "socialctl/publication_steps.py",
+    "socialctl/publish_output.py",
+    "socialctl/publisher.py",
+    "socialctl/queue_migration.py",
+    "socialctl/read_budget.py",
+    "socialctl/read_reports.py",
+    "socialctl/rutas.py",
+    "socialctl/schedule_remote.py",
+    "socialctl/schedule_sqlite.py",
+    "socialctl/scheduler.py",
+    "socialctl/scheduler_launchd.py",
+    "socialctl/scheduler_systemd.py",
+    "socialctl/source_links.py",
+    "socialctl/upload_consent.py",
+    "socialctl/workspace.py",
+    "socialctl/youtube_data.py",
+    "socialctl/youtube_data_service.py",
+    "socialctl/adapters",
+    "socialctl/connections",
+    "socialctl/management",
+    "socialctl/metricas",
+    "socialctl/native_schedule",
+    "socialctl/plantillas",
+    "socialctl/capabilities.yml",
+    "socialctl/ui/__init__.py",
+    "socialctl/ui/assets/agents.md",
+    "socialctl/ui/assets/agent-manual.md"
+]
+exclude = ["**/.env", "**/.env.*", "**/*.env", "**/.secrets/**", "**/__pycache__/**", "**/*.pyc", "**/*.key", "**/*.pem", "**/*.sqlite3*"]
+
+[tool.hatch.build.targets.wheel]
+dev-mode-dirs = ["."]
+
+[tool.hatch.build.targets.sdist]
+only-include = [
+    "socialctl/__init__.py",
+    "socialctl/__main__.py",
+    "socialctl/agent_errors.py",
+    "socialctl/agent_guide.py",
+    "socialctl/approval_cli.py",
+    "socialctl/auth.py",
+    "socialctl/authflow.py",
+    "socialctl/brands.py",
+    "socialctl/capabilities.py",
+    "socialctl/cli.py",
+    "socialctl/delivery_options.py",
+    "socialctl/engagement.py",
+    "socialctl/engagement_cli.py",
+    "socialctl/executor.py",
+    "socialctl/formatter.py",
+    "socialctl/hosted_media.py",
+    "socialctl/identity.py",
+    "socialctl/inbox.py",
+    "socialctl/inbox_cli.py",
+    "socialctl/inventory.py",
+    "socialctl/inventory_cli.py",
+    "socialctl/inventory_sources.py",
+    "socialctl/media.py",
+    "socialctl/media_cli.py",
+    "socialctl/media_ingress.py",
+    "socialctl/media_preflight.py",
+    "socialctl/media_registry.py",
+    "socialctl/media_requirements.py",
+    "socialctl/migration_cli.py",
+    "socialctl/migration_files.py",
+    "socialctl/models.py",
+    "socialctl/operation_output.py",
+    "socialctl/postfile.py",
+    "socialctl/preflight.py",
+    "socialctl/publication_policy.py",
+    "socialctl/publication_status.py",
+    "socialctl/publication_steps.py",
+    "socialctl/publish_output.py",
+    "socialctl/publisher.py",
+    "socialctl/queue_migration.py",
+    "socialctl/read_budget.py",
+    "socialctl/read_reports.py",
+    "socialctl/rutas.py",
+    "socialctl/schedule_remote.py",
+    "socialctl/schedule_sqlite.py",
+    "socialctl/scheduler.py",
+    "socialctl/scheduler_launchd.py",
+    "socialctl/scheduler_systemd.py",
+    "socialctl/source_links.py",
+    "socialctl/upload_consent.py",
+    "socialctl/workspace.py",
+    "socialctl/youtube_data.py",
+    "socialctl/youtube_data_service.py",
+    "socialctl/adapters",
+    "socialctl/connections",
+    "socialctl/management",
+    "socialctl/metricas",
+    "socialctl/native_schedule",
+    "socialctl/plantillas",
+    "socialctl/capabilities.yml",
+    "socialctl/ui/__init__.py",
+    "socialctl/ui/assets/agents.md",
+    "socialctl/ui/assets/agent-manual.md",
+    "pyproject.toml",
+    "README.md",
+    "LICENSE",
+    "LICENSE-MIT-LEGACY"
+]

{socialcli-0.3.0 → socialcli-0.3.2}/socialctl/agent_errors.py

@@ -32,6 +32,10 @@ _ACTIONS = {
 # Only fixed internal codes acquire action semantics. Provider text is diagnostic,
 # never a command, an expiry signal or evidence that a write was not accepted.
 _CATALOG = {
+    'reply_history_purged': ('user_action', 'Prior reply evidence was removed by retention. Review the preserved journal and platform before any new draft. Do not delete replay-blocking markers or repeat an uncertain write.'),
+    'dry_run_required': ('correct_input', 'inbox-draft requires --dry-run to prepare a preview. No provider content write was started.'),
+    'reply_input_invalid': ('correct_input', 'Use a version 1 reply file with a nonempty replies list (1–100 items). Each reply requires platform, account_id, comment_id and text. media_id is read from the inbox, not supplied in this file.'),
+    'target_validation_failed': ('inspect', 'Local target verification failed. Inspect the diagnostic reason; this does not establish a provider rejection or invalid credentials.'),
     'approval_mismatch': ('user_action', 'The supplied approval does not match this exact preview. Obtain the owner approval before applying.'),
     'approval_required': ('user_action', 'Show the complete preview and obtain explicit approval of its exact fingerprint.'),
     'operation_cancelled': ('inspect', 'Approval was cancelled. No write was started by this command.'),
@@ -108,6 +112,7 @@ def error_document(exc: BaseException, *, read_only: bool) -> dict:
     from socialctl.management.meta_schema import MetaError, MetaUncertain
     from socialctl.metricas.base import SinPermiso
     from socialctl.youtube_data import YouTubeDataBusy, YouTubeDataCleanupError
+    from socialctl.identity import ReadError
 
     # A read flow may refresh a token via POST. A lost response to that operation
     # cannot be classified as a harmless GET retry merely from the CLI command.
@@ -124,7 +129,7 @@ def error_document(exc: BaseException, *, read_only: bool) -> dict:
             429:'rate_limited',503:'provider_unavailable'}.get(exc.status,'service_rejected')
     elif isinstance(exc, (ResourceUncertain, YouTubeUpdateUncertain, CommentUncertain, MetaUncertain)):
         code = 'operation_uncertain'
-    elif isinstance(exc, (AuthError, YouTubeManagementError, ResourceError, CommentError, MetaError)) and getattr(exc, '_socialcli_error_code', None) is not None:
+    elif isinstance(exc, (AuthError, YouTubeManagementError, ChangeError, ResourceError, CommentError, MetaError, ReadError)) and getattr(exc, '_socialcli_error_code', None) is not None:
         code = exc._socialcli_error_code
     elif isinstance(exc, ReadDeadlineExceeded): code = 'read_deadline'
     elif isinstance(exc, ReadResponseTooLarge): code = 'response_too_large'
@@ -144,21 +149,66 @@ def error_document(exc: BaseException, *, read_only: bool) -> dict:
                 429:'rate_limited'}.get(status,'provider_unavailable' if status>=500 else 'request_rejected')
                 if type(status) is int else 'operation_rejected')
     elif isinstance(exc, httpx.RequestError): code = 'provider_response_invalid'
+    elif isinstance(exc, ReadError):
+        code = {'credentials_missing': 'authorization_unavailable', 'credentials_expired': 'authorization_unavailable',
+                'permission_denied': 'permissions_required', 'rate_limited': 'rate_limited',
+                'timeout': 'transport_failure', 'transport_error': 'transport_failure',
+                'invalid_response': 'provider_response_invalid', 'provider_error': 'provider_unavailable',
+                'configuration_missing': 'account_not_configured'}.get(exc.code, 'target_validation_failed')
+    elif isinstance(exc, ResourceError): code = 'target_validation_failed'
     elif isinstance(exc, ChangeError): code = 'operation_rejected'
     elif isinstance(exc, YouTubeDataBusy): code = 'local_data_busy'
     elif isinstance(exc, (OSError, YouTubeDataCleanupError)): code = 'storage_failure'
     elif isinstance(exc, ValueError): code = 'invalid_local_state'
     else: code = 'operation_failed'
-    return error_for_code(code,read_only=read_only)
+    result = error_for_code(code,read_only=read_only)
+    # Local validation is not evidence of a rejection by the hosted service.
+    if code == 'operation_rejected' and not isinstance(exc, ServiceRejected):
+        result['message'] = _CATALOG[code][1]
+    diagnostic = safe_diagnostic(getattr(exc, '_socialcli_diagnostic', None))
+    if isinstance(exc, ChangeError) and not diagnostic:
+        diagnostic = {'source': 'local'}
+    if isinstance(exc, ServiceRejected):
+        diagnostic.update(source='socialcli', http_status=exc.status)
+    elif isinstance(exc, httpx.HTTPStatusError):
+        diagnostic.update(http_status=exc.response.status_code, request_method=exc.request.method)
+    if diagnostic:
+        result['diagnostic'] = safe_diagnostic(diagnostic)
+    return result
+
+
+def safe_diagnostic(value):
+    """Allow only fixed machine labels, never URLs, bodies, headers or prose."""
+    if not isinstance(value, dict):
+        return {}
+    allowed = {
+        'source': {'local', 'socialcli', 'youtube'},
+        'stage': {'input_validation', 'workspace_read', 'file_read', 'credential_read', 'identity_read', 'provider_read', 'provider_write', 'target_read', 'reply_coverage', 'proposal_preparation', 'baseline_check', 'readback'},
+        'request_method': {'GET', 'HEAD', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE'},
+        'operation': {'channels', 'videos', 'comments', 'commentThreads', 'playlistItems'},
+        'write_state': {'not_started', 'unknown', 'accepted'},
+        'content_write_state': {'not_started'},
+        'reason': {'thread_unverifiable', 'thread_identity_mismatch', 'thread_total_unverifiable', 'comment_binding_mismatch', 'parent_mismatch', 'replies_not_allowed', 'incomplete_reply_list', 'readback_mismatch'},
+        'provider_reason': {'commentsDisabled', 'quotaExceeded', 'dailyLimitExceeded', 'rateLimitExceeded', 'userRateLimitExceeded', 'insufficientPermissions', 'forbidden', 'authError', 'invalidValue', 'videoNotFound', 'commentNotFound', 'commentThreadNotFound', 'processingFailure', 'operationNotSupported'},
+    }
+    clean = {key: val for key, val in value.items()
+             if key in allowed and isinstance(val, str) and val in allowed[key]}
+    status = value.get('http_status')
+    if type(status) is int and 100 <= status <= 599:
+        clean['http_status'] = status
+    return clean
 
 
 def with_error_code(wrapper: Exception, cause: BaseException, *, read_only: bool,
                     fallback: str | None = None) -> Exception:
     """Keep only a fixed code across a sanitized wrapper, never raw exception data."""
-    code = error_document(cause, read_only=read_only)['code']
+    detail = error_document(cause, read_only=read_only)
+    code = detail['code']
     if code == 'operation_failed' and fallback is not None:
         code = error_for_code(fallback, read_only=read_only)['code']
     wrapper._socialcli_error_code = code
+    if detail.get('diagnostic'):
+        wrapper._socialcli_diagnostic = detail['diagnostic']
     return wrapper
 
 
@@ -166,7 +216,28 @@ def with_http_error_code(wrapper: Exception, response, *, read_only: bool) -> Ex
     import httpx
     cause = httpx.HTTPStatusError('Provider request rejected', request=response.request,
                                   response=response)
-    return with_error_code(wrapper, cause, read_only=read_only)
+    wrapper = with_error_code(wrapper, cause, read_only=read_only)
+    if response.request.url.host == 'www.googleapis.com':
+        diagnostic = {'source': 'youtube', 'http_status': response.status_code,
+            'request_method': response.request.method,
+            'stage': 'provider_read' if read_only else 'provider_write',
+            'operation': response.request.url.path.rsplit('/', 1)[-1],
+            'write_state': 'not_started' if read_only else 'unknown'}
+        try:
+            reasons = response.json().get('error', {}).get('errors', [])
+            for row in reasons[:16]:
+                reason = safe_diagnostic({'provider_reason': row.get('reason')}) if isinstance(row, dict) else {}
+                if reason:
+                    diagnostic.update(reason)
+                    if reason['provider_reason'] in {'quotaExceeded', 'dailyLimitExceeded', 'rateLimitExceeded', 'userRateLimitExceeded'}:
+                        wrapper._socialcli_error_code = 'rate_limited' if read_only else 'operation_uncertain'
+                    elif reason['provider_reason'] == 'commentsDisabled' and read_only:
+                        wrapper._socialcli_error_code = 'comments_disabled'
+                    break
+        except (ValueError, TypeError, AttributeError):
+            pass
+        wrapper._socialcli_diagnostic = safe_diagnostic(diagnostic)
+    return wrapper
 
 
 def emit_error(exc: Exception, *, read_only: bool) -> None:

{socialcli-0.3.0 → socialcli-0.3.2}/socialctl/agent_guide.py

@@ -3,11 +3,11 @@ from importlib.resources import files
 import re
 
 TOPICS={
-    'setup':('Install the reviewed candidate','Authorize the installation, then the social account','Persist and recover','Publication gate','Explicit approval and preflight'),
+    'setup':('What agents can do','Install the reviewed release','Authorize the installation, then the social account','Persist and recover','Publication gate','Explicit approval and preflight'),
     'publish':('Publication gate','Temporary Instagram media','Canonical publishing workflow','Check supplied media locally','Explicit approval and preflight'),
     'schedule':('Publication gate','Temporary Instagram media','Scheduling and temporary media','Native scheduling input examples (offline)','Explicit approval and preflight'),
-    'inbox':('Publication gate','Read metrics and prepare engagement','Read diagnostics','Comment API corrections','Explicit approval and preflight','Resumable batches and reply context'),
-    'errors':('Persist and recover','Recovery and error actions','Read diagnostics','Comment API corrections','Explicit approval and preflight','Resumable batches and reply context'),
+    'inbox':('Publication gate','Read metrics and prepare engagement','Read diagnostics','Comment API evidence and limits','Explicit approval and preflight','Resumable batches and reply context','Purged reply history'),
+    'errors':('Persist and recover','Recovery and error actions','Read diagnostics','Comment API evidence and limits','Explicit approval and preflight','Resumable batches and reply context','Purged reply history'),
     'permissions':('Installation connection access',),
 }
 
@@ -20,4 +20,4 @@ def guide(topic):
     sections=re.split(r'(?=^## )',full,flags=re.MULTILINE)
     chosen=[section for section in sections if any(section.startswith('## '+heading) for heading in TOPICS[topic])]
     return ('# SocialCli agent guide: '+topic+'\n\n'+''.join(chosen)+
-            '\nNext: socialcli agent-guide publish; socialcli agent-guide schedule; socialcli agent-guide inbox; socialcli agent-guide errors.\n')
+            '\nNext: socialcli agent-guide publish; socialcli agent-guide schedule; socialcli agent-guide inbox; socialcli agent-guide errors; socialcli agent-guide permissions; socialcli agent-guide all.\n')