Teach agent capabilities and bundle the CLI

Author: gersham

components.lock.json

@@ -6,7 +6,7 @@
     "commit": "b55296d2019f343fbc0bbcc3237eb35943528c73",
     "artifact": {
       "file": "screenrig-cli.tgz",
-      "sha256": "cac3047920e94720269050ecf290ccc27290b0686edf5668158dfc1eae8b677c"
+      "sha256": "cd4bec4b5d2986d3cd31c5a474db0cce69c6d3f6ecdcac24fae458bd1d5033d9"
     }
   }
 }

plugins/screenrig/cli/README.md

@@ -759,6 +759,39 @@ Without `--wait`, `--timeout` can shorten but never extend the one-second
 snapshot budget. Approval requests expire after 24 hours. Terminal denial,
 cancellation, and expiry remain errors.
 
+### Agent credential capabilities
+
+`agent enroll` grants its first agent all six capabilities. For an existing
+project, request only what this installation needs:
+
+```sh
+screenrig agent connect --capability advertising --print-url
+screenrig agent connect --capability content --capability playlists --capability screens --print-url
+screenrig agent status
+```
+
+`--capability` is repeatable. Valid names, in canonical order, are `screens`,
+`content`, `playlists`, `advertising`, `reports`, and `project`. Omit the flag to
+request all six; unknown, empty, or duplicate names fail locally. The dashboard
+approver can grant a non-empty subset of the requested set. Resume without
+changing capabilities; `agent status` and enrollment/connection results show
+the granted `agent.capabilities`.
+
+The area capabilities permit their area's reads and writes. `content` covers
+media, applications and operation cancellation; `project` covers project
+changes, browser-link claims, webhooks, invitations and billing. `reports`
+permits area reads and is required for events and playback reports. Basic
+project, current-agent and operation-status reads remain available to any
+active credential. These permissions are distinct from project feature
+entitlements (`project capabilities`); both must allow an operation.
+
+Capabilities cannot be changed on a credential. A capability refusal is HTTP
+403 `forbidden`, with `This agent credential lacks the <name> capability.`
+Follow the CLI's `error.next` guidance: connect a new agent with the needed
+capabilities using a separate private `--config` path, obtain dashboard
+approval, verify it with `agent status`, then disconnect the old agent. Do not
+retry the denied write unchanged or broaden permissions without authorization.
+
 ### Recovering writes
 
 Ordinary application uploads/updates, playlist creates/updates/deletes, screen

plugins/screenrig/cli/assets/playlist-write-v2.schema.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Generated by screenrig-protocol-gen from api/openapi.yaml; sha256=422df6fb4da39573702d8e6e182b11b722f4e2358386048af0cc38f2bd763deb. Shape validation for the adslot page union. Run canonical playlist-write-semantics.ts next. At most 16 adslot pages and one ordinary page with no visibility remain server checks.",
+  "$comment": "Generated by screenrig-protocol-gen from api/openapi.yaml; sha256=748fbac08592b462d8f69b375f9f6a8d1f22343b297b67e8dc8a3b0d9d232fd8. Shape validation for the adslot page union. Run canonical playlist-write-semantics.ts next. At most 16 adslot pages and one ordinary page with no visibility remain server checks.",
   "$defs": {
     "AdslotPageWrite": {
       "additionalProperties": false,

plugins/screenrig/cli/assets/playlist-write.schema.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Generated by screenrig-protocol-gen from api/openapi.yaml; sha256=422df6fb4da39573702d8e6e182b11b722f4e2358386048af0cc38f2bd763deb. Shape validation only; run canonical playlist-write-semantics.ts next. Reference resolution and DNS remain server checks.",
+  "$comment": "Generated by screenrig-protocol-gen from api/openapi.yaml; sha256=748fbac08592b462d8f69b375f9f6a8d1f22343b297b67e8dc8a3b0d9d232fd8. Shape validation only; run canonical playlist-write-semantics.ts next. Reference resolution and DNS remain server checks.",
   "$defs": {
     "CanvasBackground": {
       "description": "Solid canonical uppercase #RRGGBBAA, or a top-to-bottom linear gradient.",

plugins/screenrig/cli/dist/adapters/protocol.d.ts

@@ -111,9 +111,12 @@ export interface CLIEnrollmentRequest {
     platform?: string;
     version?: string;
 }
+export declare const AGENT_CAPABILITIES: readonly ["screens", "content", "playlists", "advertising", "reports", "project"];
+export type AgentCapability = typeof AGENT_CAPABILITIES[number];
 export interface Agent {
     agent_type: string;
     authenticated_requests: number;
+    capabilities: AgentCapability[];
     connected_at?: string;
     created_at: string;
     id: string;
@@ -137,6 +140,7 @@ export interface X25519PublicJWK {
 }
 export interface AgentConnectionRequest {
     agent_type?: string;
+    capabilities?: AgentCapability[];
     name?: string;
     platform?: string;
     recipient_public_key: X25519PublicJWK;
@@ -150,6 +154,7 @@ export interface AgentConnectionStart {
 }
 export interface AgentConnection {
     agent_type: string;
+    capabilities: AgentCapability[];
     connection_id: string;
     created_at: string;
     expires_at: string;