@catalyst-cloud/cli 0.16.4 → 0.16.7

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.16.7
+
+Setup can update an existing installation that still runs its saved, older image version. Headless setup names which key input Catalyst rejected and shows how to try a saved personal login when one is available. Installer checks leave existing skill files in place until the installer updates them.
+
+## 0.16.6
+
+On macOS, setup verifies access to your workspace files before starting work and gives a repair step when that check fails.
+
 ## 0.16.4
 
 Setup keeps this computer's saved disk limits when it updates the service that runs your work.

package/dist/config.js

@@ -118,10 +118,12 @@ export function normalizeBaseUrl(url) {
 export function apiBase(cfg) {
     return `${normalizeBaseUrl(cfg.baseUrl)}/api/v1`;
 }
-/** True when the Catalyst installer owns skill placement on this machine: it exports
- *  CATALYST_SKILLS_DIR, or it wrote the machine paths file (every v1 record carries a skills role).
+/** True when the Catalyst installer owns skill placement on this machine: it marks the current
+ *  install, exports CATALYST_SKILLS_DIR, or wrote the machine paths file (every v1 record carries a skills role).
  *  The CLI then never refreshes skill folders itself; the installer's own refresh does. */
 export function installerOwnsSkills(home, env = {}) {
+    if (env.CATALYST_INSTALL_SKILLS_OWNER === "1")
+        return true;
     if (env.CATALYST_SKILLS_DIR !== undefined && env.CATALYST_SKILLS_DIR !== "")
         return true;
     try {

package/dist/onboard-headless.js

@@ -403,14 +403,14 @@ function contractCode(code) {
         : EXIT_FAILED;
 }
 const notPersonal = (keys) => keyItem("account_key_not_personal", `This is the account's host key. Onboarding acts as a person: mint a personal key at ${keys} and supply that instead.`, keys);
-function loginItem(error, baseUrl) {
+function loginItem(error, baseUrl, source, keyFileFlag, savedPersonalLogin) {
     const url = pages(baseUrl);
     if (error instanceof CliError && error.code === "onboard-person-required")
         return { code: EXIT_REFUSED, item: notPersonal(url.keys) };
     if (error instanceof MeError && error.kind === "http" && (error.status === 401 || error.status === 403))
         return {
             code: EXIT_WAITING,
-            item: keyItem("account_key_rejected", `Catalyst did not accept the supplied key. Mint a personal key at ${url.keys} and supply it again.`, url.keys),
+            item: keyItem("account_key_rejected", `Catalyst did not accept the key from ${source === "env" ? "CATALYST_CLOUD_TOKEN" : keyFileFlag ? "the file named by --key-file" : "the file named by CATALYST_CLOUD_TOKEN_FILE"}. ${savedPersonalLogin ? `This machine has a saved personal login for ${baseUrl}. ${source === "env" ? "Unset CATALYST_CLOUD_TOKEN" : keyFileFlag ? "Remove --key-file" : "Unset CATALYST_CLOUD_TOKEN_FILE"} and run the same command to try it.` : `Mint a personal key at ${url.keys} and supply it again.`}`, url.keys),
         };
     return {
         code: EXIT_FAILED,
@@ -494,6 +494,7 @@ export async function runOnboardHeadless(args, ctx, hooks, cliVersion) {
         catch {
             saved = null;
         }
+        const savedPersonalLogin = Boolean(saved?.user && normalizeBaseUrl(saved.baseUrl) === baseUrl);
         const current = saved?.key === plan.key && normalizeBaseUrl(saved.baseUrl) === baseUrl;
         if (!current) {
             let me;
@@ -501,7 +502,7 @@ export async function runOnboardHeadless(args, ctx, hooks, cliVersion) {
                 me = await fetchMe(baseUrl, plan.key, ctx.fetch);
             }
             catch (error) {
-                const { item, code } = loginItem(error, baseUrl);
+                const { item, code } = loginItem(error, baseUrl, report.inputs.accountKey === "file" ? "file" : "env", typeof args.flags["key-file"] === "string", savedPersonalLogin);
                 return early(code, item);
             }
             if (!me.user)
@@ -529,7 +530,7 @@ export async function runOnboardHeadless(args, ctx, hooks, cliVersion) {
                     throw new CliError("key login failed", "key-login-failed", EXIT_FAILED);
             }
             catch (error) {
-                const { item, code } = loginItem(error, baseUrl);
+                const { item, code } = loginItem(error, baseUrl, report.inputs.accountKey === "file" ? "file" : "env", typeof args.flags["key-file"] === "string", savedPersonalLogin);
                 return early(code, item);
             }
         }

package/dist/onboard-next.js

@@ -128,6 +128,7 @@ const REASONS = {
     runner_container_host_unreachable: "A container could not reach this Mac. Enable container-to-host networking in your Docker VM and allow the setup process through the Mac firewall, then run catalyst onboard --runner.",
     runner_container_network_unreachable: "A container could not reach Catalyst's health endpoint. Check the Docker VM's DNS, proxy and outbound HTTPS access, then run catalyst onboard --runner.",
     runner_engine_probe_unavailable: "Setup could not complete the container capability probe. Check Docker access and the pinned supervisor image, then run catalyst onboard --runner. Setup has not enrolled or started this machine.",
+    runner_thoughts_custody_unavailable: "Setup could not verify protected access to this Mac's shared work files. Keep their ownership and permissions. Check Docker access, then run catalyst onboard --runner. If the check still fails, ask Catalyst support to inspect it.",
     runner_installation_unverified: "Setup found a possible existing machine installation but could not verify its Compose files and identity. Keep its files and credentials. Run docker compose -p catalyst-host logs supervisor to check it, then run catalyst setup --runner again.",
     runner_enrollment_unavailable: "Setup could not read this workspace's runner hosts. Run catalyst onboard again to retry.",
     runner_enrolled_for_other_team: "This runner is enrolled for another Linear team. Keep using that team, or ask your administrator to revoke the old enrollment before setting up this machine for the selected team.",