…ty + inbox + sent) (#28)

Closes the cueapi-cli #25 manifest gap on the messaging primitive's identity
surface (POST /v1/agents + 8 sibling endpoints). v1 of the messaging-primitive
CLI work; the `cueapi messages` group (send/get/read/ack) ships in a follow-up
PR for review-burden reasons.

Commands shipped (9 total):

- `cueapi agents create --display-name X [--slug Y] [--webhook-url Z]
  [--metadata '{...}']` — POST /v1/agents. Webhook secret is shown ONLY in
  this response when --webhook-url is set; subsequent reads omit it. UI
  copy explicitly says "save now — only shown once."
- `cueapi agents list [--status online/offline/away] [--include-deleted]
  [--limit N] [--offset N]` — GET /v1/agents.
- `cueapi agents get <ref> [--include-deleted]` — GET /v1/agents/{ref}.
  Renders metadata pretty-printed; null webhook_url is rendered as
  "— (poll-only)" so the user sees push vs poll at a glance.
- `cueapi agents update <ref> [--display-name] [--webhook-url |
  --clear-webhook-url] [--status] [--metadata]` — PATCH /v1/agents/{ref}.
  --webhook-url and --clear-webhook-url are mutually exclusive; the latter
  sends literal JSON null, matching the server's model_fields_set
  disambiguation (omit = no change vs explicit-null = clear).
- `cueapi agents delete <ref> [--yes]` — DELETE /v1/agents/{ref}. Soft
  delete. Confirmation prompt unless --yes.
- `cueapi agents webhook-secret get <ref>` — reveals the current secret
  (200 path).
- `cueapi agents webhook-secret regenerate <ref> [--yes]` — POST
  /v1/agents/{ref}/webhook-secret/regenerate. Confirmation prompt warns
  the current secret will be revoked immediately. Returns the new secret
  one-time, same UI copy as create.
- `cueapi agents inbox <ref> [--state queued/delivered/etc] [--limit]
  [--offset]` — GET /v1/agents/{ref}/inbox. Polling endpoint.
- `cueapi agents sent <ref> [--limit] [--offset]` — GET /v1/agents/{ref}/sent.

Tests: 24 new (36 → 60 total). Mock-based body / params capture mirroring
PR #26 + #27's _FakeClient pattern. Pinned behaviors:

- --include-deleted only sent when True (omits when False) — same pattern
  as `executions list --has-evidence`.
- --clear-webhook-url sends `webhook_url: null` literally (not omits).
- --webhook-url + --clear-webhook-url mutex enforced at click.UsageError.
- Confirmation prompt path on delete + webhook-secret regenerate.
- Webhook-secret one-time-view UI copy is rendered.

No hosted-PR dependency — all 9 endpoints already shipped on prod (Phase
12.1 messaging primitive). Pure CLI catch-up to existing server surface.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…et/regenerate`

Drains 3 entries from cueapi-cli #25's `endpoints_missing` plus a bonus
DELETE that wasn't in the manifest:

- GET /v1/workers → `cueapi workers list`
- DELETE /v1/workers/{id} → `cueapi workers delete <id>`
- GET /v1/auth/webhook-secret → `cueapi key webhook-secret get`
- POST /v1/auth/webhook-secret/regenerate → `cueapi key webhook-secret regenerate`

Two new / extended groups: `cueapi workers` (top-level) + `cueapi key
webhook-secret` (nested under existing `key`).

`regenerate` automatically sends `X-Confirm-Destructive: true` header
(server-required); pinned by test_key_webhook_secret_regenerate_sends_destructive_header.
404 on `key webhook-secret get` produces a helpful error pointing
messaging-primitive-only users at the per-agent path.

Tests: 11 new (60 → 71 total). Reuses _FakeResp from agents tests added in #28; adds
_WSClient capture class for header-sensitive tests.

Skipped from manifest: POST /v1/worker/heartbeat (manifest itself notes
it's redundant with cueapi-worker package).

No hosted-PR dependency.

Rebased against main 2026-05-04 (post-#28 agents-group merge).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…et/regenerate` (#33)

Drains 3 entries from cueapi-cli #25's `endpoints_missing` plus a bonus
DELETE that wasn't in the manifest:

- GET /v1/workers → `cueapi workers list`
- DELETE /v1/workers/{id} → `cueapi workers delete <id>`
- GET /v1/auth/webhook-secret → `cueapi key webhook-secret get`
- POST /v1/auth/webhook-secret/regenerate → `cueapi key webhook-secret regenerate`

Two new / extended groups: `cueapi workers` (top-level) + `cueapi key
webhook-secret` (nested under existing `key`).

`regenerate` automatically sends `X-Confirm-Destructive: true` header
(server-required); pinned by test_key_webhook_secret_regenerate_sends_destructive_header.
404 on `key webhook-secret get` produces a helpful error pointing
messaging-primitive-only users at the per-agent path.

Tests: 11 new (60 → 71 total). Reuses _FakeResp from agents tests added in #28; adds
_WSClient capture class for header-sensitive tests.

Skipped from manifest: POST /v1/worker/heartbeat (manifest itself notes
it's redundant with cueapi-worker package).

No hosted-PR dependency.

Rebased against main 2026-05-04 (post-#28 agents-group merge).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…age lifecycle)

Closes the messages portion of cueapi-cli #25's `Messaging primitive`
endpoints_missing entry. Pairs with the already-merged #28 (agents group).

Commands shipped:

- `cueapi messages send` — POST /v1/messages with X-Cueapi-From-Agent +
  Idempotency-Key headers. Surfaces dedup-hit (200) and priority-downgrade
  signal explicitly.
- `cueapi messages get` — GET /v1/messages/{id}.
- `cueapi messages read` — POST /v1/messages/{id}/read (idempotent).
- `cueapi messages ack` — POST /v1/messages/{id}/ack (terminal).

Pinned by tests:
- --from goes in HEADER, not body (server's MessageCreate is extra="forbid")
- --expects-reply flag only sent when True
- --priority validated by click.IntRange(1, 5)
- --idempotency-key max 255 chars enforced client-side
- 409 idempotency-key-conflict produces helpful guidance

Tests: 18 new (60 → 78 total).

No hosted-PR dependency.

Rebased against main 2026-05-04 (post-#28 agents-group merge).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…, verification, on-success-fire, status)

Drains `cueapi create` + `cueapi update` `command_drift.missing_flags`
entries from cueapi-cli #25's parity manifest. JSON-pass-through flags
mapping to existing CueCreate / CueUpdate schema fields.

Both `create` and `update`:
- --delivery (JSON) / --alerts (JSON) / --verification (JSON)
- --catch-up (Click choice: run_once_if_missed / skip_missed / replay_all)
- --on-success-fire (cue ID for 1:1 chaining)

`update` only:
- --status (Click choice: active / paused; alternative to pause/resume)
- --clear-on-success-fire (sends literal JSON null; mutually exclusive with --on-success-fire)

Click Choice flags fail fast client-side (no HTTP round-trip on bad
values). --clear-on-success-fire pinned to send null literally (server's
model_fields_set sentinel pattern).

Tests: 12 new (60 → 72 total). Mock-based body capture.

No hosted-PR dependency.

Rebased against main 2026-05-04 (post-#28 agents-group merge).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Drains 3 entries from cueapi-cli #25's `endpoints_missing`:

- POST /v1/executions/{id}/replay → `cueapi executions replay <id>`
- POST /v1/executions/{id}/verification-pending → `cueapi executions verification-pending <id>`
- POST /v1/executions/{id}/verify → `cueapi executions verify <id> [--valid|--invalid] [--reason "..."]`

`verify` is tri-state: `--valid` sends True, `--invalid` sends False,
neither sends empty body (matches server's pre-schema legacy callers).
`--reason` length capped at 500 chars client-side.

Tests: 12 new (60 → 72 total).

No hosted-PR dependency.

Rebased against main 2026-05-04 (post-#28 agents-group merge).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…-evidence / triggered-by

Closes the cueapi-cli #25 manifest gap on `cueapi executions list`.
Server-side already supports all four filters (`app/routers/executions.py`);
this exposes them in the CLI.

- --outcome-state: reported_success / reported_failure / verified_success /
  verification_pending / verification_failed / unknown
- --result-type: filter by evidence result_type
- --has-evidence: flag — only sent when present (omit-when-default to keep
  URLs clean)
- --triggered-by: scheduled / manual_fire / chain

Tests: 6 new (60 → 66 total).

No hosted-PR dependency — server already supports the filters.

Rebased against main 2026-05-04 (post-#28 agents-group merge).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…-evidence / triggered-by

Closes cueapi-cli #25 manifest gap on executions list. Server-side already
supports all 4 filters. --has-evidence flag only sent when present.

Tests: 6 new (71 → 77 total).
No hosted-PR dependency.
Rebased against main 2026-05-04 (post-#28, #33).

🤖 Generated with [Claude Code](https://claude.com/claude-code)