@catalyst-cloud/cli 0.15.2 → 0.15.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.15.3
+
+- Setup can finish once the steps needed to run work are ready. It lists optional next steps and keeps your first-ticket choice when you resume.
+- Setup shows one progress display with numbered steps and the reason a step needs attention.
+- When the Connect accounts page is available, setup uses it to finish account connections. Any usable AI account counts without a test request.
+- Setup offers API keys by default. Subscription account options appear only when your workspace enables them.
+
 ## 0.15.2
 
 - `catalyst setup` is the command to set up Catalyst. It runs the same steps as `catalyst onboard`, which still works.

package/README.md

@@ -111,7 +111,7 @@ The command is `catalyst`. `catalyst-skills` still works as a deprecated alias,
 
 ## What this is
 
-A set of skills that let your coding agent run your own Catalyst Cloud account (https://staging.catalystcloud.dev) from your seat: what is happening, what needs you, and what to do about it. They read your account through the Catalyst Cloud SDK, write to it through the account's agent proxy, and never compose a URL or run a tool of their own; every read, write and subscription is a `catalyst` verb with `--help`. Every skill is plain Markdown under `skills/<name>/SKILL.md` in this repository, and your own login — a keyless device-code session, or a personal key — is the only credential. Your agent acts as you: the asks it raises and the comments it posts carry your name, and "what needs me" means you.
+A set of skills that let your coding agent run your own Catalyst Cloud account (https://staging.catalystcloud.dev) from your seat: what is happening, what needs you, and what to do about it. They read your account through the Catalyst Cloud SDK, write to it through the account's agent proxy, and never compose a URL or run a tool of their own; every read, write and live watch is a `catalyst` verb with `--help`. Every skill is plain Markdown under `skills/<name>/SKILL.md` in this repository, and your own login — a keyless device-code session, or a personal key — is the only credential. Your agent acts as you: the asks it raises and the comments it posts carry your name, and "what needs me" means you.
 
 ## What connecting does
 
@@ -231,7 +231,7 @@ Some of these only read, and some write: a comment, a card move, an ask, a relea
 
 ## What a key cannot see yet
 
-Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst accounts`: provider, declared and observed state, window usage, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`). It also releases a parked or held ticket once its cause is fixed: `catalyst release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst environment` reads the account-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-onboard` already reports on, is a separate thing. `catalyst env inventory` lists the environment variable names a repository needs — never a value; `env check` checks the TOML syntax and environment variable table in `.catalyst/catalyst.toml` offline; `env migrate [catalyst.env.json]` prints a TOML environment table from a legacy declaration, with all names optional and values omitted. These commands need no login (the `what-this-repo-needs` skill walks through them). Two things it cannot do, and the skills say so by name rather than guess:
+Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst accounts`: provider, declared and observed state, usage limits, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`). It also releases a parked or held ticket once its cause is fixed: `catalyst release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst environment` reads the account-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-onboard` already reports on, is a separate thing. `catalyst env inventory` lists the environment variable names a repository needs — never a value; `env check` checks the TOML syntax and environment variable table in `.catalyst/catalyst.toml` offline; `env migrate [catalyst.env.json]` prints a TOML environment table from a legacy declaration, with all names optional and values omitted. These commands need no login (the `what-this-repo-needs` skill walks through them). Two things it cannot do, and the skills say so by name rather than guess:
 
 - Read pull-request labels or the reviewer's reaction. The mirror does not carry them; GitHub's own page does.
 - Compute a flow number — cycle time, throughput, or how long pull requests have been open. Nothing serves those yet, so say they are not computed rather than counting something else and calling it that.

package/dist/cli.js

@@ -44,12 +44,12 @@ import { cmdRepo } from "./repo.js";
 import { cmdLegacy } from "./legacy.js";
 import { cmdIdentity } from "./identity.js";
 import { cmdConnections } from "./connections.js";
-import { cmdOnboard, onboardErrorJournal, onboardRequiredStepsWaiting, } from "./onboard.js";
+import { cmdOnboard, onboardErrorJournal, } from "./onboard.js";
 import { createClackOnboardUi, shouldUseOnboardUi, } from "./onboard-ui.js";
 import { createOnboardRuntime } from "./onboard-runtime.js";
 import { argvRequestsHeadless, headlessOnboardDeps, headlessUsageRefusal, onboardHeadlessRequested, runOnboardHeadless, } from "./onboard-headless.js";
 import { savedOnboardBaseUrl } from "./onboard-next.js";
-import { onboardingReadyReport, observeCloudOnboarding, } from "./onboard-ready.js";
+import { onboardingReadyReport, onboardReadyStep, observeCloudOnboarding, } from "./onboard-ready.js";
 import { selectedOnboardTeam } from "./onboard-existing.js";
 export { CONFIG_MODE, DEFAULT_BASE_URL, FIRST_STAMPED_VERSION, LEGACY_PACKAGE_NAME, PACKAGE_NAME, PROVENANCE_MARKER, CliError, MeError, UsageError, configPathFor, contractPathFor, defaultCtx, defaultReplicaDbFor, defaultSkillsDirFor, fetchMe, formatMode, installedBundleVersion, installSkills, loadConfig, modernCliPath, normalizeBaseUrl, parseArgs, parseChangelogEntry, parseProvenanceVersion, readChangelog, readManifest, resolveSkillsDir, saveConfig, skillsSourceDir, updateNoticeLine, writeConfig, };
 export const CUSTOMER_SKILLS = [
@@ -306,6 +306,7 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                                     renderer: createSetupRenderer(process.stdout, ctx.env),
                                     disposeRenderer: true,
                                     signinTimeoutMs: deps.onboardSigninTimeoutMs,
+                                    version: manifest.version,
                                 });
                             }
                             catch (error) {
@@ -328,6 +329,7 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                             renderer: createSetupRenderer(output, ctx.env),
                             disposeRenderer: true,
                             signinTimeoutMs: deps.onboardSigninTimeoutMs,
+                            version: manifest.version,
                             interactive: false,
                             verbose: args.flags.verbose === true,
                         });
@@ -395,21 +397,7 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                                         localSync: journal?.localSync ?? args.flags["local-sync"] === true,
                                         observe: observeCloudOnboarding,
                                     });
-                                    const failed = report.checks.some((check) => check.required && check.state === "fail") && !onboardRequiredStepsWaiting(journal);
-                                    return {
-                                        state: report.state === "complete"
-                                            ? "done"
-                                            : failed
-                                                ? "failed"
-                                                : "waiting",
-                                        reason: report.state === "complete"
-                                            ? undefined
-                                            : "onboarding_checks_pending",
-                                        evidence: {
-                                            checks: report.checks.length,
-                                            passed: report.checks.filter((check) => check.state === "pass").length,
-                                        },
-                                    };
+                                    return onboardReadyStep(report, journal);
                                 },
                                 legacy: deps.legacy,
                                 openBrowser: deps.openBrowser,

package/dist/oauth.js

@@ -156,7 +156,7 @@ export async function deviceFlowLogin(ctx, baseUrl, deps = {}) {
                         throw new Error("browser-unavailable");
                     await deps.openBrowser(auth.verification_uri_complete ?? auth.verification_uri);
                     browserOpened = true;
-                    ctx.stdout("Opened your browser to that page — approve there, or use the code above.");
+                    ctx.stdout("Opened your browser to that page. Approve there, or use the code above.");
                 }
                 catch {
                     // a browser that will not open is not a failure; the code and URL still work

package/dist/onboard-accounts.js

@@ -3,7 +3,6 @@ import { readExistingOnboardJson } from "./onboard-existing.js";
 import { pollConsent } from "./onboard-consent.js";
 import { verifyOnboardRoutes } from "./onboard-capabilities.js";
 const listPath = "/api/v1/coding-accounts";
-const validatePath = "/api/v1/coding-accounts/:slot/validate";
 const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
     ? value
     : null;
@@ -94,195 +93,92 @@ async function inventory(ctx, journal, signal) {
     }
     return { slots, identity };
 }
-/** Verify one existing Claude slot per run. A stored login, cached poll or Codex shape is not
- * fresh provider access. Enrollment and a phase's actual lease eligibility remain separate. */
+/** Why one account cannot take work, or null when it can. The Connect page's AI-account rule
+ * (the server's isUsableCodingAccount): any provider, any member's account, and a canceled
+ * subscription keeps working until its paid access ends. */
+function unusableCause(row, now) {
+    if (row.declaredState !== "active")
+        return "coding_account_inactive";
+    if (row.revokedAtMs !== null ||
+        (row.accessEndsAtMs !== null && row.accessEndsAtMs <= now))
+        return "coding_account_ended";
+    if (row.needsCredential)
+        return "coding_account_needs_login";
+    if (row.quarantined)
+        return "coding_account_quarantined";
+    if (row.walled)
+        return "coding_account_walled";
+    return null;
+}
+export function usableAiAccount(row, now) {
+    return unusableCause(row, now) === null;
+}
+/** CTC-4680: the step is done when the workspace has at least one usable AI account, from any
+ * provider. With --coding-account, that named account is the one that must be usable. */
 export function onboardAccountsAdapter(input = {}) {
-    let proof = null;
-    let attempted = false;
-    const candidate = (slots, now) => slots
+    const usable = (slots, now) => slots
         .filter((row) => (input.slot === undefined || row.accountSlot === input.slot) &&
-        row.provider === "claude" &&
-        row.declaredState === "active" &&
-        row.ownedByMe &&
-        !row.needsCredential &&
-        !row.walled &&
-        !row.quarantined &&
-        row.renewalStatus !== "canceled" &&
-        row.revokedAtMs === null &&
-        (row.accessEndsAtMs === null || row.accessEndsAtMs > now))
+        usableAiAccount(row, now))
         .sort((a, b) => a.accountSlot.localeCompare(b.accountSlot))[0];
     const check = async (ctx, journal, signal) => {
         const live = await inventory(ctx, journal, signal);
         if ("reason" in live)
             return waiting(live.reason);
-        const selected = candidate(live.slots, ctx.now().getTime());
-        if (proof &&
-            equal(live.identity, proof) &&
-            live.slots.some((row) => row.accountSlot === proof.slot &&
-                row.provider === proof.provider &&
-                row.declaredState === "active" &&
-                row.ownedByMe &&
-                !row.needsCredential &&
-                !row.walled &&
-                !row.quarantined &&
-                row.renewalStatus !== "canceled" &&
-                row.revokedAtMs === null &&
-                (row.accessEndsAtMs === null ||
-                    row.accessEndsAtMs > ctx.now().getTime())) &&
-            proof.checkedAtMs <= ctx.now().getTime() + 5000 &&
-            proof.checkedAtMs >= ctx.now().getTime() - 30000)
+        const selected = usable(live.slots, ctx.now().getTime());
+        if (selected)
             return {
                 state: "done",
                 evidence: {
-                    accountSlot: proof.slot,
-                    provider: proof.provider,
-                    checkedAt: new Date(proof.checkedAtMs).toISOString(),
+                    provider: selected.provider,
+                    checkedAt: ctx.now().toISOString(),
                 },
             };
-        proof = null;
-        if (!live.slots.length)
-            return input.waitForAccount &&
-                ["owner", "admin"].includes(live.identity.role)
-                ? { state: "pending" }
-                : waiting("account_enrollment_required");
-        if (input.slot !== undefined &&
-            !live.slots.some((row) => row.accountSlot === input.slot))
-            return waiting("coding_account_not_found");
-        if (!selected)
-            return waiting(live.slots.some((row) => row.provider === "codex")
-                ? "codex_provider_access_unverified"
-                : "account_provider_access_unverified");
-        if (attempted)
-            return waiting("account_provider_access_unverified");
-        const cfg = loadConfig(ctx.home);
-        if (!cfg?.user || !["owner", "admin"].includes(cfg.user.role))
-            return waiting("account_validation_admin_required");
-        return { state: "pending" };
+        if (input.slot !== undefined) {
+            const named = live.slots.find((row) => row.accountSlot === input.slot);
+            // A named account speaks for itself: other accounts in the workspace may be fine.
+            return waiting(named
+                ? (unusableCause(named, ctx.now().getTime()) ?? "coding_account_not_found")
+                : "coding_account_not_found");
+        }
+        if (input.waitForAccount &&
+            ["owner", "admin"].includes(live.identity.role))
+            return { state: "pending" };
+        return waiting(live.slots.length ? "ai_account_not_usable" : "account_enrollment_required");
     };
     return {
         check,
         act: async (ctx, journal, external) => {
-            if (attempted)
-                return waiting("account_provider_access_unverified");
             const initial = await inventory(ctx, journal, external);
             if ("reason" in initial)
                 return waiting(initial.reason);
-            let live = initial;
-            if (!live.slots.length &&
-                input.waitForAccount &&
-                ["owner", "admin"].includes(live.identity.role)) {
-                const result = await input.waitForAccount(() => pollConsent({
-                    timeoutMs: input.accountWaitMs,
-                    signal: external,
-                    sleep: input.sleep,
-                    readStatus: async (signal) => {
-                        const current = await inventory(ctx, journal, signal);
-                        if ("reason" in current)
-                            return { outcome: "waiting", reason: current.reason };
-                        live = current;
-                        return { outcome: current.slots.length ? "connected" : "absent" };
-                    },
-                }));
-                if (result.state !== "done")
-                    return waiting(result.reason === "consent_timeout"
-                        ? "account_enrollment_required"
-                        : (result.reason ?? "account_enrollment_required"));
-            }
-            const selected = candidate(live.slots, ctx.now().getTime());
-            if (!selected)
-                return waiting("account_provider_access_unverified");
-            const support = await verifyOnboardRoutes(ctx, journal, [{ method: "POST", path: validatePath }], external);
-            if ("reason" in support)
-                return waiting(support.reason);
-            const cfg = loadConfig(ctx.home);
-            if (!equal(binding(ctx, journal), live.identity) ||
-                !cfg?.user ||
-                !["owner", "admin"].includes(cfg.user.role))
-                return waiting("account_identity_unverified");
-            const expiry = cfg.auth
-                ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
-                : 0;
-            const bearer = cfg.key ||
-                (cfg.auth && Number.isFinite(expiry) && expiry > 30000
-                    ? cfg.auth.accessToken
-                    : undefined);
-            if (!bearer)
-                return waiting("account_login_refresh_required");
-            input.message?.("Checking one stored Claude account with a one-token provider request. This may use Claude quota. Codex credentials are not refreshed. Phase eligibility is checked separately.");
-            // A display callback must not be able to switch the identity used for this request.
-            if (!equal(binding(ctx, journal), live.identity))
-                return waiting("account_identity_unverified");
-            const deadline = new AbortController();
-            const signal = external
-                ? AbortSignal.any([external, deadline.signal])
-                : deadline.signal;
-            const timer = setTimeout(() => deadline.abort(), 15000);
-            let remove = () => { };
-            try {
-                return await new Promise((resolve) => {
-                    const stopped = () => resolve(waiting(external?.aborted
-                        ? "interrupted"
-                        : "account_validation_unavailable"));
-                    if (signal.aborted) {
-                        stopped();
-                        return;
-                    }
-                    signal.addEventListener("abort", stopped, { once: true });
-                    remove = () => signal.removeEventListener("abort", stopped);
-                    Promise.resolve()
-                        .then(async () => {
-                        if (signal.aborted)
-                            return waiting("interrupted");
-                        // UI callbacks can queue a config change before this deferred send executes.
-                        if (!equal(binding(ctx, journal), live.identity))
-                            return waiting("account_identity_unverified");
-                        attempted = true;
-                        const response = await ctx.fetch(`${support.origin}/api/v1/coding-accounts/${encodeURIComponent(selected.accountSlot)}/validate`, {
-                            method: "POST",
-                            redirect: "error",
-                            signal,
-                            headers: {
-                                authorization: `Bearer ${bearer}`,
-                                accept: "application/json",
-                            },
-                        });
-                        if (response.status !== 200)
-                            return waiting("account_validation_unavailable");
-                        const body = object(await response.json());
-                        if (signal.aborted ||
-                            !equal(binding(ctx, journal), live.identity))
-                            return waiting("account_identity_unverified");
-                        const now = ctx.now().getTime();
-                        if (!body ||
-                            body.provider !== selected.provider ||
-                            typeof body.checkedAtMs !== "number" ||
-                            !Number.isSafeInteger(body.checkedAtMs) ||
-                            body.checkedAtMs > now + 5000 ||
-                            body.checkedAtMs < now - 30000 ||
-                            !["working", "walled", "rejected", "inconclusive"].includes(String(body.result)))
-                            return waiting("account_validation_unverified");
-                        if (body.result !== "working")
-                            return waiting(body.result === "walled"
-                                ? "account_provider_walled"
-                                : body.result === "rejected"
-                                    ? "account_provider_rejected"
-                                    : "account_provider_access_unverified");
-                        proof = {
-                            ...live.identity,
-                            slot: selected.accountSlot,
-                            provider: selected.provider,
-                            checkedAtMs: body.checkedAtMs,
-                        };
-                        input.message?.("Claude provider access was verified. This does not reserve a runner or prove that a phase can start.");
-                        return check(ctx, journal, signal);
-                    })
-                        .then((result) => (signal.aborted ? stopped() : resolve(result)), () => stopped());
-                });
-            }
-            finally {
-                clearTimeout(timer);
-                remove();
-            }
+            if (!input.waitForAccount ||
+                !["owner", "admin"].includes(initial.identity.role))
+                return check(ctx, journal, external);
+            let enrolled = initial.slots.length > 0;
+            const result = await input.waitForAccount(() => pollConsent({
+                timeoutMs: input.accountWaitMs,
+                signal: external,
+                sleep: input.sleep,
+                readStatus: async (signal) => {
+                    const current = await inventory(ctx, journal, signal);
+                    if ("reason" in current)
+                        return { outcome: "waiting", reason: current.reason };
+                    enrolled = current.slots.length > 0;
+                    return {
+                        outcome: usable(current.slots, ctx.now().getTime())
+                            ? "connected"
+                            : "absent",
+                    };
+                },
+            }));
+            if (result.state === "done")
+                return check(ctx, journal, external);
+            // A wait that ran out holds the step and offers another try (round 5).
+            return waiting(result.reason !== "consent_timeout"
+                ? (result.reason ?? "account_enrollment_required")
+                : enrolled
+                    ? "ai_account_not_usable"
+                    : "account_enrollment_required");
         },
     };
 }