Bump hraness-cli-kit from v0.8.1 to v1.1.2

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps hraness-cli-kit from v0.8.1 to v1.1.2.

Release notes

Sourced from hraness-cli-kit's releases.

desktop-foundation v1.1.2

The Rust CLI kit can now be published separately to crates.io. Its runtime API and behavior are unchanged from 1.1.1.

Changes

• Made hraness-cli-kit publishable with its source, README, and MIT license.
• Added crates.io trusted publishing after the existing release checks. It stays disabled until the first publication and registry setup are complete; later releases use GitHub OIDC without a stored token or human approval.

Install

npm install https://github.com/hraness/desktop-foundation/releases/download/v1.1.2/hraness-desktop-foundation-1.1.2.tgz

Rust products pin the tag: desktop-foundation = { git = "https://github.com/hraness/desktop-foundation", tag = "v1.1.2" }.

Verify

Checksums for every asset are in SHA256SUMS. The source commit is c6003c05a86ab9a188b8bc20dd4de5fe459affab. Each asset has a GitHub build attestation: gh attestation verify <file> --repo hraness/desktop-foundation. See the installation guide.

desktop-foundation v1.1.1

Fixes from the review of 1.1.0. Exit codes, schema ids, error codes and the envelope shape are unchanged. Some behaviour, message text and helper signatures did change, and every change is listed below.

Changes

• help is a command only as the first word (after --json at most). In 1.1.0 runCli removed the first help anywhere in the command line, so approvals decide a1 --digest help deny lost its --digest value, and -- help printed help. Now a flag's value and every word after -- are left alone.
• --debug works like HRANESS_DEBUG=1, as CLI_MENU_STYLE.md D5 says: a text error adds the code and detail. runCli takes --debug (before any --) out of the command line, unless one of the product's verbs declares its own debug flag, in which case it stays that verb's flag and the other verbs reject it as before. 1.1.0 answered --debug with an unknown-option error.
• An undeclared code no longer shows its code to a person. The internal error reads The command failed with an error it did not declare., and the code moved to detail as Undeclared code <code>., which text mode shows only with --debug or HRANESS_DEBUG=1. In 1.1.0 the message was The command answered an undeclared code <code>. This changes --json error.message and adds error.detail.
• A wrong or expired code points at the same command. gate-failed and gate-expired from runCli now have one next step for a person, the same command again, so the → line re-runs it. In 1.1.0 they had no next, and the → line pointed at --help. This adds error.next to those --json envelopes. T3 unsupported-platform still points at --help, since running it again cannot succeed in this release.
• help commands --json lists one descriptor for commands in data.verbs instead of an empty list.
• error.permission is built the same way by both kits. In 1.1.0 TypeScript kept only the known System Settings panes, while Rust kept any x-apple.systempreferences: link.
  • Both now keep only the twelve panes in contract/names.json settingsUrls. Rust exports them as SETTINGS_URLS.
  • Both leave permission out for a kind outside ^[a-z][a-z0-9-]*$ (validPermissionKind, valid_permission_kind).
  • contract/golden/error-permission-cases.json checks that both kits print the same bytes.
  • errorPermission now returns ErrorPermission | undefined. TypeScript code that assigns its result to an ErrorPermission must handle undefined.
  • Rust ErrorPermission::with_settings_url drops a link that is not one of the twelve panes, and ErrorBody::with_permission drops a permission with an invalid kind.
  • The Rust reader now rejects a permission whose kind or link the schema rejects. 1.1.0 accepted it.
  • permissionErrorJson keeps its 1.0 shape. Its error.permission is now tested to hold the same kind and link as errorPermission and to pass the schema.
• Documented from 1.1.0: an agent that runs a decide verb without --json gets human-required (exit 3) and no prompt. In 1.0 only --json did that, and an agent without it was prompted at /dev/tty. The 1.1.0 notes left this out. A person who wants to decide runs the command at their own terminal, as the next step says.

Install

npm install https://github.com/hraness/desktop-foundation/releases/download/v1.1.1/hraness-desktop-foundation-1.1.1.tgz

... (truncated)

Changelog

Sourced from hraness-cli-kit's changelog.

1.1.2 - 2026-09-29

The Rust CLI kit can now be published separately to crates.io. Its runtime API and behavior are unchanged from 1.1.1.

Changes

• Made hraness-cli-kit publishable with its source, README, and MIT license.
• Added crates.io trusted publishing after the existing release checks. It stays disabled until the first publication and registry setup are complete; later releases use GitHub OIDC without a stored token or human approval.

1.1.1 - 2026-09-29

Fixes from the review of 1.1.0. Exit codes, schema ids, error codes and the envelope shape are unchanged. Some behaviour, message text and helper signatures did change, and every change is listed below.

Changes

• help is a command only as the first word (after --json at most). In 1.1.0 runCli removed the first help anywhere in the command line, so approvals decide a1 --digest help deny lost its --digest value, and -- help printed help. Now a flag's value and every word after -- are left alone.
• --debug works like HRANESS_DEBUG=1, as CLI_MENU_STYLE.md D5 says: a text error adds the code and detail. runCli takes --debug (before any --) out of the command line, unless one of the product's verbs declares its own debug flag, in which case it stays that verb's flag and the other verbs reject it as before. 1.1.0 answered --debug with an unknown-option error.
• An undeclared code no longer shows its code to a person. The internal error reads The command failed with an error it did not declare., and the code moved to detail as Undeclared code <code>., which text mode shows only with --debug or HRANESS_DEBUG=1. In 1.1.0 the message was The command answered an undeclared code <code>. This changes --json error.message and adds error.detail.
• A wrong or expired code points at the same command. gate-failed and gate-expired from runCli now have one next step for a person, the same command again, so the → line re-runs it. In 1.1.0 they had no next, and the → line pointed at --help. This adds error.next to those --json envelopes. T3 unsupported-platform still points at --help, since running it again cannot succeed in this release.
• help commands --json lists one descriptor for commands in data.verbs instead of an empty list.
• error.permission is built the same way by both kits. In 1.1.0 TypeScript kept only the known System Settings panes, while Rust kept any x-apple.systempreferences: link.
  • Both now keep only the twelve panes in contract/names.json settingsUrls. Rust exports them as SETTINGS_URLS.
  • Both leave permission out for a kind outside ^[a-z][a-z0-9-]*$ (validPermissionKind, valid_permission_kind).
  • contract/golden/error-permission-cases.json checks that both kits print the same bytes.
  • errorPermission now returns ErrorPermission | undefined. TypeScript code that assigns its result to an ErrorPermission must handle undefined.
  • Rust ErrorPermission::with_settings_url drops a link that is not one of the twelve panes, and ErrorBody::with_permission drops a permission with an invalid kind.
  • The Rust reader now rejects a permission whose kind or link the schema rejects. 1.1.0 accepted it.
  • permissionErrorJson keeps its 1.0 shape. Its error.permission is now tested to hold the same kind and link as errorPermission and to pass the schema.
• Documented from 1.1.0: an agent that runs a decide verb without --json gets human-required (exit 3) and no prompt. In 1.0 only --json did that, and an agent without it was prompted at /dev/tty. The 1.1.0 notes left this out. A person who wants to decide runs the command at their own terminal, as the next step says.

1.1.0 - 2026-09-29

Command-line errors and help from ./registry now follow CLI_MENU_STYLE.md, agents get JSON without asking for it, and an error can name the macOS permission behind it. Exit codes, schema ids, error codes, the envelope shape and the order of next are unchanged. Some message text did change, and every change is listed below.

Changes

• A person at a terminal sees a text error as two lines on stderr: ✗ and one sentence, then → and the one command to run next (FAIL and -> without UTF-8). A mistyped command adds Did you mean "status"?, and HRANESS_DEBUG=1 adds the error code.
• Help starts with Usage:. It says in plain words when a person has to decide, instead of the [decide T1T2] tags. <product> help <command> works like <command> --help, and help help prints the root help. User-facing text no longer says "gate".
• When detectAudience reports an agent, runCli prints the JSON envelope even without --json. Raw verbs still see only the --json the caller passed.
• A single-dash option such as -x, before or after the command, is a usage error (exit 2), and the command does not run. In 1.0 it reached the verb as a word. After --, and for a bare - or -5, it is still a word.
• error.permission is new and optional: { kind, settingsUrl }, the macOS permission behind the failure and the System Settings pane that fixes it.
  • It is in contract/envelope.schema.json, the TypeScript ErrorBody and HranessError, and the Rust ErrorBody.
  • New helpers: errorPermission(kind, settingsUrl) in TypeScript, and ErrorPermission::new(kind).with_settings_url(url) with ErrorBody::with_permission in Rust. Both drop a link outside System Settings; TypeScript also keeps only the known panes, and Rust checks the x-apple.systempreferences: prefix.
  • permissionErrorJson keeps its 1.0 shape.
• Scripts (the quiet audience: no terminal, no agent) get what 1.0 gave them. A failure still prints the error envelope on stdout. The stderr line carries code: message after a plain FAIL , in ASCII whatever the locale: FAIL usage: Unknown command "x". then -> example --help. A grep anchored at the line start (^human-required:) must allow for the FAIL prefix. The 1.0 next: lines are gone.
• --json output has the same shape, with these message changes:
  • An unknown command reads Unknown command "x". instead of Unknown command: x., adds Did you mean …? when there is a close match, and has two next steps (agent first, as before, then <product> --help for a person).

... (truncated)

Commits

• c6003c0 Prepare CLI kit crates.io publishing in desktop-foundation 1.1.2 (#46)
• 5a76ba9 desktop-foundation 1.1.1: review fixes for 1.1.0 (#45)
• 5e9202c desktop-foundation 1.1.0: CLI_MENU_STYLE errors and help, agent JSON, error.p...
• 878bfae desktop-foundation 1.0.0: remove the menu bar (#43)
• bff81f2 Scope the native matrix on pull requests; full matrix nightly, on main and ta...
• f552013 Faster, cheaper CI (velocity sweep) (#37)
• 55f64e3 chore(deps): bump dorny/paths-filter from 3 to 4 (#13)
• 6174033 Land PR #35 review fixes before v0.9.0 (#36)
• 15f6227 chore(deps): bump actions/download-artifact from 4 to 8 (#15)
• 107b4a8 Add headless control kit, human gate, TUI and helper split (v0.9.0) (#35)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
xcb	Ignored	Preview	Oct 7, 2026 12:35am UTC