@cloudgrid-io/mcp 0.21.17 → 0.21.19

package/src/corpus/templates/status-page/cloudgrid.yaml

@@ -19,7 +19,7 @@
 
 # Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
 # Must start and end with a letter or digit.
-# Becomes part of your public URL: <name>-<4hex>--<org>.cloudgrid.io
+# Becomes part of your public URL: <name>-<4hex>--<grid>.cloudgrid.io
 name: status-page
 
 # One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
@@ -54,7 +54,7 @@ name: status-page
 
 # ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
 
-# Slack notification to the org's default channel on deploy failure.
+# Slack notification to the grid's default channel on deploy failure.
 # true = notify (default), false = silent.
 # notify: true
 
@@ -104,20 +104,20 @@ name: status-page
 
 # Entities this app calls (outbound). Service-account token injected per pair.
 # calls:
-#   - org:atomic/billing-api
+#   - atomic/billing-api
 
 # Inbound caller policy — who can call YOUR entity.
 # callers:
 #   policy: auto                 # 'auto' | 'manual' (default).
-#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   scope: org                   # 'org' (the whole grid; default) | 'space' | 'explicit'.
 #   fallback: deny               # 'deny' (default) | 'warn'.
 #   # allowed_apps:              # required only when scope: explicit
-#   #   - org:atomic/frontend
+#   #   - atomic/frontend
 
 
 # ─── VAULT ──────────────────────────────────────────────────────────────────
 
-# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Map grid vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
 # vault:
 #   STRIPE_KEY: stripe-live-key
 #   SENDGRID_API_KEY: sendgrid-key
@@ -127,7 +127,7 @@ name: status-page
 
 # connectors:
 #   - id: team-slack
-#     target: org                # 'system' | 'org'.
+#     target: org                # 'system' | 'org' (your grid).
 #     channel: "#deploys"
 # hooks:
 #   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created

package/src/corpus/templates/subscription-management/cloudgrid.yaml

@@ -19,7 +19,7 @@
 
 # Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
 # Must start and end with a letter or digit.
-# Becomes part of your public URL: <name>-<4hex>--<org>.cloudgrid.io
+# Becomes part of your public URL: <name>-<4hex>--<grid>.cloudgrid.io
 name: subscription-management
 
 # One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
@@ -54,7 +54,7 @@ name: subscription-management
 
 # ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
 
-# Slack notification to the org's default channel on deploy failure.
+# Slack notification to the grid's default channel on deploy failure.
 # true = notify (default), false = silent.
 # notify: true
 
@@ -104,20 +104,20 @@ name: subscription-management
 
 # Entities this app calls (outbound). Service-account token injected per pair.
 # calls:
-#   - org:atomic/billing-api
+#   - atomic/billing-api
 
 # Inbound caller policy — who can call YOUR entity.
 # callers:
 #   policy: auto                 # 'auto' | 'manual' (default).
-#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   scope: org                   # 'org' (the whole grid; default) | 'space' | 'explicit'.
 #   fallback: deny               # 'deny' (default) | 'warn'.
 #   # allowed_apps:              # required only when scope: explicit
-#   #   - org:atomic/frontend
+#   #   - atomic/frontend
 
 
 # ─── VAULT ──────────────────────────────────────────────────────────────────
 
-# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Map grid vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
 # Self-serve subscription management needs Stripe secrets injected as env vars —
 # this is the CloudGrid-correct way. Set the vault items once (grid secrets set),
 # then the deployer injects each as the named env var at runtime and under
@@ -131,7 +131,7 @@ vault:
 
 # connectors:
 #   - id: team-slack
-#     target: org                # 'system' | 'org'.
+#     target: org                # 'system' | 'org' (your grid).
 #     channel: "#deploys"
 # hooks:
 #   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created

package/src/corpus/templates/task-manager/cloudgrid.yaml

@@ -19,7 +19,7 @@
 
 # Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
 # Must start and end with a letter or digit.
-# Becomes part of your public URL: <name>-<4hex>--<org>.cloudgrid.io
+# Becomes part of your public URL: <name>-<4hex>--<grid>.cloudgrid.io
 name: my-tasks
 
 # One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
@@ -54,7 +54,7 @@ name: my-tasks
 
 # ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
 
-# Slack notification to the org's default channel on deploy failure.
+# Slack notification to the grid's default channel on deploy failure.
 # true = notify (default), false = silent.
 # notify: true
 
@@ -104,20 +104,20 @@ name: my-tasks
 
 # Entities this app calls (outbound). Service-account token injected per pair.
 # calls:
-#   - org:atomic/billing-api
+#   - atomic/billing-api
 
 # Inbound caller policy — who can call YOUR entity.
 # callers:
 #   policy: auto                 # 'auto' | 'manual' (default).
-#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   scope: org                   # 'org' (the whole grid; default) | 'space' | 'explicit'.
 #   fallback: deny               # 'deny' (default) | 'warn'.
 #   # allowed_apps:              # required only when scope: explicit
-#   #   - org:atomic/frontend
+#   #   - atomic/frontend
 
 
 # ─── VAULT ──────────────────────────────────────────────────────────────────
 
-# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Map grid vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
 # vault:
 #   STRIPE_KEY: stripe-live-key
 #   SENDGRID_API_KEY: sendgrid-key
@@ -127,7 +127,7 @@ name: my-tasks
 
 # connectors:
 #   - id: team-slack
-#     target: org                # 'system' | 'org'.
+#     target: org                # 'system' | 'org' (your grid).
 #     channel: "#deploys"
 # hooks:
 #   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created

package/src/corpus/templates/ticket-system/cloudgrid.yaml

@@ -19,7 +19,7 @@
 
 # Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
 # Must start and end with a letter or digit.
-# Becomes part of your public URL: <name>-<4hex>--<org>.cloudgrid.io
+# Becomes part of your public URL: <name>-<4hex>--<grid>.cloudgrid.io
 name: my-tickets
 
 # One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
@@ -54,7 +54,7 @@ name: my-tickets
 
 # ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
 
-# Slack notification to the org's default channel on deploy failure.
+# Slack notification to the grid's default channel on deploy failure.
 # true = notify (default), false = silent.
 # notify: true
 
@@ -104,20 +104,20 @@ name: my-tickets
 
 # Entities this app calls (outbound). Service-account token injected per pair.
 # calls:
-#   - org:atomic/billing-api
+#   - atomic/billing-api
 
 # Inbound caller policy — who can call YOUR entity.
 # callers:
 #   policy: auto                 # 'auto' | 'manual' (default).
-#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   scope: org                   # 'org' (the whole grid; default) | 'space' | 'explicit'.
 #   fallback: deny               # 'deny' (default) | 'warn'.
 #   # allowed_apps:              # required only when scope: explicit
-#   #   - org:atomic/frontend
+#   #   - atomic/frontend
 
 
 # ─── VAULT ──────────────────────────────────────────────────────────────────
 
-# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Map grid vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
 # vault:
 #   STRIPE_KEY: stripe-live-key
 #   SENDGRID_API_KEY: sendgrid-key
@@ -127,7 +127,7 @@ name: my-tickets
 
 # connectors:
 #   - id: team-slack
-#     target: org                # 'system' | 'org'.
+#     target: org                # 'system' | 'org' (your grid).
 #     channel: "#deploys"
 # hooks:
 #   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created

package/src/corpus/templates/time-tracking/cloudgrid.yaml

@@ -19,7 +19,7 @@
 
 # Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
 # Must start and end with a letter or digit.
-# Becomes part of your public URL: <name>-<4hex>--<org>.cloudgrid.io
+# Becomes part of your public URL: <name>-<4hex>--<grid>.cloudgrid.io
 name: time-tracking
 
 # One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
@@ -54,7 +54,7 @@ name: time-tracking
 
 # ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
 
-# Slack notification to the org's default channel on deploy failure.
+# Slack notification to the grid's default channel on deploy failure.
 # true = notify (default), false = silent.
 # notify: true
 
@@ -104,20 +104,20 @@ name: time-tracking
 
 # Entities this app calls (outbound). Service-account token injected per pair.
 # calls:
-#   - org:atomic/billing-api
+#   - atomic/billing-api
 
 # Inbound caller policy — who can call YOUR entity.
 # callers:
 #   policy: auto                 # 'auto' | 'manual' (default).
-#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   scope: org                   # 'org' (the whole grid; default) | 'space' | 'explicit'.
 #   fallback: deny               # 'deny' (default) | 'warn'.
 #   # allowed_apps:              # required only when scope: explicit
-#   #   - org:atomic/frontend
+#   #   - atomic/frontend
 
 
 # ─── VAULT ──────────────────────────────────────────────────────────────────
 
-# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Map grid vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
 # vault:
 #   STRIPE_KEY: stripe-live-key
 #   SENDGRID_API_KEY: sendgrid-key
@@ -127,7 +127,7 @@ name: time-tracking
 
 # connectors:
 #   - id: team-slack
-#     target: org                # 'system' | 'org'.
+#     target: org                # 'system' | 'org' (your grid).
 #     channel: "#deploys"
 # hooks:
 #   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created

package/src/corpus/templates/travel-booking/cloudgrid.yaml

@@ -19,7 +19,7 @@
 
 # Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
 # Must start and end with a letter or digit.
-# Becomes part of your public URL: <name>-<4hex>--<org>.cloudgrid.io
+# Becomes part of your public URL: <name>-<4hex>--<grid>.cloudgrid.io
 name: travel-booking
 
 # One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
@@ -54,7 +54,7 @@ name: travel-booking
 
 # ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
 
-# Slack notification to the org's default channel on deploy failure.
+# Slack notification to the grid's default channel on deploy failure.
 # true = notify (default), false = silent.
 # notify: true
 
@@ -104,20 +104,20 @@ name: travel-booking
 
 # Entities this app calls (outbound). Service-account token injected per pair.
 # calls:
-#   - org:atomic/billing-api
+#   - atomic/billing-api
 
 # Inbound caller policy — who can call YOUR entity.
 # callers:
 #   policy: auto                 # 'auto' | 'manual' (default).
-#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   scope: org                   # 'org' (the whole grid; default) | 'space' | 'explicit'.
 #   fallback: deny               # 'deny' (default) | 'warn'.
 #   # allowed_apps:              # required only when scope: explicit
-#   #   - org:atomic/frontend
+#   #   - atomic/frontend
 
 
 # ─── VAULT ──────────────────────────────────────────────────────────────────
 #
-# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Map grid vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
 # A travel-booking portal needs payment + auth provider secrets. These are the
 # CloudGrid-correct way to inject them — the platform resolves each vault item and
 # sets the named env var at runtime. Add the vault items with `grid secrets set`
@@ -132,7 +132,7 @@ vault:
 
 # connectors:
 #   - id: team-slack
-#     target: org                # 'system' | 'org'.
+#     target: org                # 'system' | 'org' (your grid).
 #     channel: "#deploys"
 # hooks:
 #   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created

package/src/corpus/templates/waitlist/cloudgrid.yaml

@@ -19,7 +19,7 @@
 
 # Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
 # Must start and end with a letter or digit.
-# Becomes part of your public URL: <name>-<4hex>--<org>.cloudgrid.io
+# Becomes part of your public URL: <name>-<4hex>--<grid>.cloudgrid.io
 name: waitlist
 
 # One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
@@ -54,7 +54,7 @@ name: waitlist
 
 # ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
 
-# Slack notification to the org's default channel on deploy failure.
+# Slack notification to the grid's default channel on deploy failure.
 # true = notify (default), false = silent.
 # notify: true
 
@@ -104,20 +104,20 @@ name: waitlist
 
 # Entities this app calls (outbound). Service-account token injected per pair.
 # calls:
-#   - org:atomic/billing-api
+#   - atomic/billing-api
 
 # Inbound caller policy — who can call YOUR entity.
 # callers:
 #   policy: auto                 # 'auto' | 'manual' (default).
-#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   scope: org                   # 'org' (the whole grid; default) | 'space' | 'explicit'.
 #   fallback: deny               # 'deny' (default) | 'warn'.
 #   # allowed_apps:              # required only when scope: explicit
-#   #   - org:atomic/frontend
+#   #   - atomic/frontend
 
 
 # ─── VAULT ──────────────────────────────────────────────────────────────────
 
-# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Map grid vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
 # vault:
 #   STRIPE_KEY: stripe-live-key
 #   SENDGRID_API_KEY: sendgrid-key
@@ -127,7 +127,7 @@ name: waitlist
 
 # connectors:
 #   - id: team-slack
-#     target: org                # 'system' | 'org'.
+#     target: org                # 'system' | 'org' (your grid).
 #     channel: "#deploys"
 # hooks:
 #   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created

package/src/corpus/templates/web-app/cloudgrid.yaml

@@ -25,7 +25,7 @@
 
 # Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
 # Must start and end with a letter or digit.
-# Becomes part of your public URL: <name>-<4hex>--<org>.cloudgrid.io
+# Becomes part of your public URL: <name>-<4hex>--<grid>.cloudgrid.io
 name: web-app
 
 # One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
@@ -60,7 +60,7 @@ name: web-app
 
 # ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
 
-# Slack notification to the org's default channel on deploy failure.
+# Slack notification to the grid's default channel on deploy failure.
 # true = notify (default), false = silent.
 # notify: true
 
@@ -110,20 +110,20 @@ name: web-app
 
 # Entities this app calls (outbound). Service-account token injected per pair.
 # calls:
-#   - org:atomic/billing-api
+#   - atomic/billing-api
 
 # Inbound caller policy — who can call YOUR entity.
 # callers:
 #   policy: auto                 # 'auto' | 'manual' (default).
-#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   scope: org                   # 'org' (the whole grid; default) | 'space' | 'explicit'.
 #   fallback: deny               # 'deny' (default) | 'warn'.
 #   # allowed_apps:              # required only when scope: explicit
-#   #   - org:atomic/frontend
+#   #   - atomic/frontend
 
 
 # ─── VAULT ──────────────────────────────────────────────────────────────────
 
-# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Map grid vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
 # vault:
 #   STRIPE_KEY: stripe-live-key
 #   SENDGRID_API_KEY: sendgrid-key
@@ -133,7 +133,7 @@ name: web-app
 
 # connectors:
 #   - id: team-slack
-#     target: org                # 'system' | 'org'.
+#     target: org                # 'system' | 'org' (your grid).
 #     channel: "#deploys"
 # hooks:
 #   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created

package/src/corpus/workflows/forum.md

@@ -8,7 +8,7 @@ kind: blueprint
 capabilities_note: >-
   persistent — needs a database (Mongo). Runtime app, async build, local edition
   only. Sign-in-to-post auth via a hosted provider (Clerk/Auth0) with keys from
-  the org vault (vault block maps items to env vars). Declare the canonical needs
+  the grid vault (vault block maps items to env vars). Declare the canonical needs
   database=true; the deployer injects DATABASE_MONGODB_URL (+legacy MONGODB_URL).
   BLUEPRINT — ships structure + cloudgrid.yaml, not app code.
 summary: >-

package/src/corpus/workflows/simple-semantic-search.md

@@ -52,7 +52,7 @@ grid plug                      # first plug registers the entity from cloudgrid.
 grid visibility set <slug> link
 ```
 
-`.cloudgrid/link.json` (entity_id / org / slug binding) is WRITTEN BY THE CLI on
+`.cloudgrid/link.json` (entity_id / grid / slug binding) is WRITTEN BY THE CLI on
 the first `grid plug` — never hand-author it. If the folder was copied from someone else's project,
 `rm -rf .cloudgrid` first so `grid plug` doesn't update THEIR app.
 

package/src/tools/constants.js

@@ -27,7 +27,10 @@ export const ANON_HTML_MAX_BYTES = 2_000_000;
 // ~6x stricter by design — a normal page is well under 1 MB, and past
 // 25 MB the right shape is a folder plug (multipart, see deploy.js:756).
 export const AUTHED_HTML_MAX_BYTES = 25_000_000;
-export const CONSOLE_URL = "https://console.cloudgrid.io/";
+// The Console's canonical host is my.cloudgrid.io (cloudgrid-io/cloudgrid#4135).
+// console.cloudgrid.io stays as a permanent redirect, so links printed by
+// earlier releases still land.
+export const CONSOLE_URL = "https://my.cloudgrid.io/";
 
 // The console link handed to a user AFTER a plug. When the grid slug is known it
 // points at THAT grid (verified live: /home?grid=<slug> -> 200) instead of the

package/src/tools/deploy.js

@@ -20,6 +20,23 @@ import {
 } from "./constants.js";
 import { okResult } from "./util.js";
 import { runCloudgrid } from "./cli.js";
+import { decodeJwt } from "../auth.js";
+import { logSafe } from "../web-observability.js";
+
+// Publisher attribution (#395): on a signed-in CREATE, record WHO published, into
+// WHICH grid, and whether the entity is ephemeral. Log a STABLE account id (the
+// JWT `sub`) only — NEVER an email or token. Logs are not a private surface
+// (redaction standard, #347/#353): identifiers and presence, never a value
+// sensitive on its own. logSafe flattens control chars so the id cannot forge a
+// log line. The emit is read from console.error at call time so tests can
+// capture it.
+export function logCreatePublisher(claims, grid, ephemeral, emit = (m) => console.error(m)) {
+  const sub = claims && typeof claims.sub === "string" && claims.sub.length > 0 ? claims.sub : null;
+  emit(
+    `cloudgrid-mcp: grid_plug create publisher user_id=${sub ? logSafe(sub) : "-"} ` +
+      `grid=${logSafe(grid || "-")} ephemeral=${ephemeral ? "true" : "false"}`,
+  );
+}
 
 /**
  * The API refuses an infra-dependent write while a grid is still provisioning.
@@ -2211,6 +2228,18 @@ export async function runPlug(ctx, input, deps = {}) {
     ctx.state.lastAnonClaim = null;
   }
 
+  // Publisher attribution (#395): every successful authed CREATE is logged with
+  // the publisher's stable account id so the guest-drop blind spot is closed —
+  // CREATE only (an edit re-plug keeps the owner's identity on the existing
+  // entity) and the authed wire only (the owner-token guest wire is out of
+  // scope). An inspiration is ephemeral (expires unless pinned); a runtime
+  // app/agent is not.
+  if (!isEdit && !useAnonWire) {
+    const kind = data.detection?.kind ?? data.kind ?? null;
+    const ephemeral = kind !== "app" && kind !== "agent";
+    logCreatePublisher(decodeJwt(authToken), data.grid ?? orgSlug ?? grid ?? null, ephemeral);
+  }
+
   // Confirm-before-claiming-live: a runtime build is async (status "building" +
   // poll_url). Rather than returning immediately — which trained models to
   // promise URLs that then 502'd — poll the deploy trace server-side for a short
@@ -2538,7 +2567,6 @@ export async function runVisibility(ctx, { target, visibility, inside, outside,
   const normSpaces = [...new Set((spaces || []).map((s) => String(s).trim().toLowerCase()).filter(Boolean))];
   const useAxes = inside !== undefined || outside !== undefined;
   let body;
-  let requested; // for the result text when the response is sparse
   if (useAxes) {
     if (visibility) throw new Error("Pass either `visibility` or the `inside`/`outside` axes, not both.");
     if (!inside || !outside) {
@@ -2566,7 +2594,6 @@ export async function runVisibility(ctx, { target, visibility, inside, outside,
       ...(require_signin === true ? { require_signin: true } : {}),
       ...(inside === "spaces" ? { visibility_spaces: normSpaces } : {}),
     };
-    requested = `inside: ${inside}${inside === "spaces" ? ` (${normSpaces.join(", ")})` : ""}, outside: ${outside}${require_signin === true ? " (sign-in required)" : ""}`;
   } else {
     let mode = String(visibility || "").trim().toLowerCase();
     if (!mode) throw new Error("Pass a visibility mode (private | grid | link), or the inside/outside axes.");
@@ -2586,7 +2613,6 @@ export async function runVisibility(ctx, { target, visibility, inside, outside,
         throw new Error("`spaces` only applies with visibility: grid (or inside: spaces).");
       }
       body = { share_scope: "private", external_access: "link", require_signin: true };
-      requested = "link with sign-in required (the retired 'authenticated')";
     } else if (mode === "space") {
       // `space` is a pure internal audience (share_scope: spaces, external_access:
       // none). require_signin/indexed are external-link concerns — they have no
@@ -2601,7 +2627,6 @@ export async function runVisibility(ctx, { target, visibility, inside, outside,
         throw new Error("'space' visibility needs the `spaces` list (which space slugs can see it) — or use inside: spaces with outside: none.");
       }
       body = { share_scope: "spaces", external_access: "none", visibility_spaces: normSpaces };
-      requested = `selected spaces (${normSpaces.join(", ")})`;
     } else if (mode === "private" || mode === "grid" || mode === "link") {
       if (require_signin === true && mode !== "link") {
         throw new Error("require_signin only applies with visibility: link (or outside: link).");
@@ -2627,12 +2652,10 @@ export async function runVisibility(ctx, { target, visibility, inside, outside,
           throw new Error("require_signin cannot combine with indexed: a sign-in-gated link cannot be search-indexed.");
         }
         body = { share_scope: "private", external_access: "link", require_signin: true };
-        requested = "link with sign-in required";
       } else {
         body = { visibility: mode };
         if (mode === "grid" && normSpaces.length > 0) body.visibility_spaces = normSpaces;
         if (mode === "link") body.link_indexed = indexed === true;
-        requested = mode + (mode === "link" && indexed === true ? " (search-indexed)" : "");
       }
     } else {
       throw new Error(`Unknown visibility '${visibility}'. Use private | grid | link (public = link alias), or the inside/outside axes.`);
@@ -2679,8 +2702,10 @@ export async function runVisibility(ctx, { target, visibility, inside, outside,
     last = await patch(route === "runtime" ? runtimePath : inspirationPath);
     if (last.res.ok) {
       const d = last.data || {};
-      // Prefer the server's stored axes (stored axes are authoritative on
-      // the wire); fall back to what we asked for.
+      // The confirmation is always derived from the server's echo: stored
+      // axes first, the legacy enum otherwise. Never the request (#372), so
+      // a sparse echo says it is unconfirmed instead of repeating what was
+      // asked for (the CLI's rule: a confirmation is never the typed value).
       const lines = [];
       if (d.share_scope || d.external_access) {
         const insideLine =
@@ -2692,14 +2717,16 @@ export async function runVisibility(ctx, { target, visibility, inside, outside,
           d.external_access === "link" ? `anyone with the link${d.require_signin ? " (signed-in accounts only)" : ""}${d.link_indexed ? ", search-indexed" : ""}` :
           d.external_access === "public" ? "anyone, findable by search engines" : d.external_access;
         lines.push(`Visibility set — inside the grid: ${insideLine}; outside: ${outsideLine}.`);
+      } else if (d.visibility) {
+        lines.push(`Visibility is now ${d.visibility}.`);
       } else {
-        lines.push(`Visibility is now ${d.visibility || requested}.`);
+        lines.push("The change was accepted, but the server did not report the stored visibility, so it is not confirmed here. Check it in the Console before telling the user it changed.");
       }
       if (d.url) lines.push(d.url);
       return {
         text: lines.join("\n"),
         structured: {
-          visibility: d.visibility || (useAxes ? undefined : String(visibility || "").trim().toLowerCase() || undefined),
+          visibility: d.visibility || undefined,
           ...(d.share_scope ? { share_scope: d.share_scope } : {}),
           ...(d.external_access ? { external_access: d.external_access } : {}),
           ...(d.require_signin !== undefined ? { require_signin: d.require_signin === true } : {}),