@descix/cli 1.0.0 → 1.0.3

package/lib/commands/update.js

@@ -24,7 +24,7 @@ import crypto from 'crypto';
 import { DeSciXApiClient } from '../api-client.js';
 import { requireAuth } from '../auth-guard.js';
 import { WorkspaceConfig } from '../workspace-config.js';
-import { runKbChunk, runKbSync } from './kb.js';
+import { refuseRetiredKbSync } from './retired-kb-sync.js';
 
 /**
  * Helper to load workspace context with options override
@@ -36,26 +36,13 @@ async function loadWorkspaceContext(options = {}) {
   const workspaceConfig = await WorkspaceConfig.load();
   const ctx = workspaceConfig.requireContext(options);
 
-  // Prefer getAppByAppId (env.platform/products, Unified Registry)
-  let appConfig = workspaceConfig.getAppByAppId(ctx.appId);
-  if (!appConfig && ctx.communityId) {
-    appConfig = workspaceConfig.getApp(ctx.communityId, ctx.appId);
-    if (appConfig) {
-      appConfig = {
-        localPath: appConfig.localPath,
-        absolutePath: appConfig.absolutePath || (workspaceConfig.workspaceRoot && appConfig.localPath
-          ? path.join(workspaceConfig.workspaceRoot, appConfig.localPath)
-          : null),
-        communityId: ctx.communityId,
-        kbId: appConfig.kbId || 'General'
-      };
-    }
-  }
+  // Unified Registry: getAppByAppId only — v1 community-keyed fallback removed
+  const appConfig = workspaceConfig.getAppByAppId(ctx.appId);
 
   if (!appConfig) {
     throw new Error(
       `App "${ctx.appId}" not found in workspace.json.\n` +
-      'Run "npx descix init" or ensure env.platform/env.products maps app_id to localPath.'
+      'Use `descix app init` to register, or `descix app set-localpath -a <id> -p <path>` to repoint.'
     );
   }
 
@@ -183,11 +170,17 @@ export async function updateAuto(options = {}) {
       case 'app':
         return await updateApp(options);
       case 'kb':
-        return await updateKB(options);
+        // kb sync has exactly ONE surface. Auto-detect lands here whenever the user is
+        // standing in the app's kb/ directory, so this path is REACHED in normal use —
+        // it is the single most likely way someone still tries to sync a KB via `update`.
+        // Refuses through the one owner so this branch and the explicit `update kb`
+        // branch cannot drift apart.
+        spinner.stop();
+        return refuseRetiredKbSync('descix update kb', chalk.red);
       case 'site':
         return await updateSite(options);
       case 'microservice':
-        console.log(chalk.yellow('  Microservice deployment not supported via update. Use \'descix deploy\'.\n'));
+        console.log(chalk.yellow('  Microservice deployment not supported via update. Use \'descix microservice deploy\'.\n'));
         return { success: false, reason: 'use_deploy' };
       default:
         console.log(chalk.yellow(`  Unknown sync type: ${syncType}. Use 'descix update app/kb/site' explicitly.\n`));
@@ -278,12 +271,17 @@ export async function updateApp(options = {}) {
     let baseFolderId = ctx.workspaceConfig.driveConfig?.base_folder_id;
     
     if (!baseFolderId) {
-      const userInfo = await apiClient.invoke('get_my_profile', {});
-      baseFolderId = userInfo.message?.base_folder_id;
+      // `get_my_profile` was a call to a verb NOTHING SERVES: it is absent from Cloud's command
+      // registry and had zero references anywhere in DeSciX_Cloud, DeSciX_Core or DeSciX_Powch
+      // outside this one call site (measured 2026-08-29). `get_folder_info` is the served,
+      // AUTHENTICATED verb that owns this fact — registry.js maps it to appCommands.js, and for
+      // entity_type 'user' it returns the caller's own base_folder_id as `folder_id`.
+      const folderInfo = await apiClient.invoke('get_folder_info', { entity_type: 'user' });
+      baseFolderId = folderInfo.message?.folder_id;
     }
     
     if (!baseFolderId) {
-      throw new Error('No base Drive folder configured. Run descix login --setup first.');
+      throw new Error('No base Drive folder configured: set driveConfig.base_folder_id in .descix/workspace.json.');
     }
     
     // Navigate to assets folder: {base}/{community}/{app}/assets
@@ -359,61 +357,8 @@ export async function updateApp(options = {}) {
   }
 }
 
-/**
- * Update knowledge base (Git Mode: local chunk → kb_sync_chunks → Pinecone)
- *
- * Drive Mode (Drive → GCS → Pinecone) is server-side only for PWA users.
- * CLI mandates Git Mode: local files are chunked locally and upserted directly.
- *
- * Convention: KB files are in {appPath}/kb/{kbId}/
- */
-export async function updateKB(options = {}) {
-  const apiClient = new DeSciXApiClient();
-  await requireAuth(apiClient);
-
-  const spinner = ora('Loading context...').start();
-
-  try {
-    const ctx = await loadWorkspaceContext(options);
-    const kbId = ctx.kbId;
-
-    spinner.succeed(`KB: ${ctx.appId}/${kbId}`);
-
-    // Resolve community_id from Products when missing (Unified Registry - app_id only)
-    if (!ctx.communityId) {
-      try {
-        const productCtx = await apiClient.invoke('get_product_context', { app_id: ctx.appId });
-        ctx.communityId = productCtx?.community_id || productCtx?.message?.community_id;
-        if (!ctx.communityId) {
-          throw new Error(`Product "${ctx.appId}" not found in Products registry. Run bootstrap.`);
-        }
-      } catch (err) {
-        if (err.message?.includes('not found')) throw err;
-        throw new Error(`Could not resolve community for app "${ctx.appId}". Run bootstrap.`);
-      }
-    }
-
-    console.log(chalk.cyan('\n📤 Updating Knowledge Base\n'));
-    console.log(chalk.gray(`  Community: ${ctx.communityId}`));
-    console.log(chalk.gray(`  App: ${ctx.appId}`));
-    console.log(chalk.gray(`  KB: ${kbId}`));
-    console.log(chalk.gray(`  Source: ${path.join(ctx.appPath, 'kb', kbId)}\n`));
-
-    // Git Mode: chunk local files → kb_sync_chunks → Pinecone
-    // (Drive → GCS → Pinecone is server-side only for PWA users)
-    const kbOptions = { ...options, app: ctx.appId, community: ctx.communityId, kb: kbId, quiet: true };
-    await runKbChunk(kbOptions);
-    await runKbSync(apiClient, kbOptions);
-
-    console.log(chalk.green('\n✓ Knowledge base updated successfully\n'));
-    return { success: true };
-
-  } catch (error) {
-    spinner.fail('Update failed');
-    console.error(chalk.red(`\n❌ ${error.message}\n`));
-    throw error;
-  }
-}
+// updateKB is DELETED. `update kb` refuses and names `descix kb corpus sync`; `update all`
+// and `update auto` no longer touch the KB. No exported symbol survives without a caller.
 
 /**
  * Update site (deploy to GCS)
@@ -431,25 +376,12 @@ export async function updateSite(options = {}) {
     // Convention: site folder path
     const siteDir = path.join(ctx.appPath, 'site');
     
-    // Handle local port registration
+    // Handle local port registration — setSitePort mutates the live env entry and saves
     if (options.port) {
       spinner.text = `Registering local port: ${options.port}`;
       try {
-        const appConfig = ctx.workspaceConfig.getApp(ctx.communityId, ctx.appId);
-        
-        if (appConfig) {
-          if (!appConfig.site) appConfig.site = {};
-          appConfig.site.port = options.port;
-          // Also set devCommand if not present (default guess)
-          if (!appConfig.site.devCommand) {
-             appConfig.site.devCommand = 'npm run dev';
-          }
-          
-          await ctx.workspaceConfig.save();
-          console.log(chalk.green(`\n✅ Local port ${options.port} registered in workspace.json`));
-        } else {
-          console.log(chalk.yellow(`\n⚠️  App not found in workspace.json. Run 'descix init' first.`));
-        }
+        await ctx.workspaceConfig.setSitePort(ctx.appId, options.port);
+        console.log(chalk.green(`\n✅ Local port ${options.port} registered in workspace.json`));
       } catch (err) {
         console.log(chalk.yellow(`\n⚠️  Could not register port: ${err.message}`));
       }
@@ -512,7 +444,7 @@ export async function updateSite(options = {}) {
       preview: options.preview || false
     });
     
-    const { signed_urls, existing_manifest, token_id, site_url } = tokenResponse.message;
+    const { signed_urls, upload_headers, existing_manifest, token_id, site_url } = tokenResponse.message;
     
     // Determine delta
     let filesToUpload = fileList;
@@ -543,10 +475,15 @@ export async function updateSite(options = {}) {
       if (!signedUrl) continue;
       
       const content = await fs.readFile(path.join(siteDir, file.path));
-      
+
+      // Canonical contract (WS-DEPLOY-HARDENING item 4): the server binds Cache-Control into
+      // the v4 signed URL signature (generateSiteUploadUrls/siteAssetCacheControl). Ferry the
+      // exact header bag the server minted — never re-derive the policy client-side, and never
+      // send a header the signature doesn't expect (GCS returns 403 signature-mismatch).
+      const headers = (upload_headers && upload_headers[file.path]) || { 'Content-Type': file.content_type };
       const response = await fetch(signedUrl, {
         method: 'PUT',
-        headers: { 'Content-Type': file.content_type },
+        headers,
         body: content
       });
       
@@ -613,16 +550,9 @@ export async function updateAll(options = {}) {
       // assets folder doesn't exist, skip
     }
     
-    // Check for KB folder and update if exists
-    const kbDir = path.join(ctx.appPath, 'kb');
-    try {
-      await fs.access(kbDir);
-      console.log(chalk.white('\n─── Knowledge Base ───\n'));
-      results.kb = await updateKB(options);
-    } catch {
-      // kb folder doesn't exist, skip
-    }
-    
+    // Knowledge bases are NOT part of `update all`. The one KB sync surface is
+    // `descix kb corpus sync` (git-manifest); this composite keeps doing app and site.
+
     // Check for site folder and update if exists
     const siteDir = path.join(ctx.appPath, 'site');
     try {
@@ -647,7 +577,6 @@ export async function updateAll(options = {}) {
 export default {
   updateAuto,
   updateApp,
-  updateKB,
   updateSite,
   updateAll
 };