@descix/cli 1.0.3 → 1.0.4

package/agent-assets/reference/mcp-integration.md

@@ -85,9 +85,11 @@ The broker validates this context and propagates it to downstream services.
 
 ### 3.1 Primary Discovery Mechanism
 
-`tell_me_how` is the **primary entry point** for discovering platform capabilities. Always use it before attempting platform operations.
+**Prerequisite: the developer is signed in.** `tell_me_how` returns caller-specific context (and `kb corpus sync` writes to a KB namespace) — both correctly refuse a credential-free caller, loud: `Authentication required`, exit 1. There is no guest/unauthenticated form of discovery, and that refusal must not be treated as a bug to work around. The step before discovery is `descix login --env dev`: it starts a device-code flow — opens a browser and mints a fresh sign-in code for that one invocation — and completes once the browser confirms it.
 
-**Rule:** Ask `tell_me_how` first, then execute the recommended command.
+Once signed in, `tell_me_how` is the **primary entry point** for discovering platform capabilities. Always use it before attempting platform operations.
+
+**Rule:** Sign in, then ask `tell_me_how` first, then execute the recommended command.
 
 ### 3.2 Three Scopes
 
@@ -100,6 +102,9 @@ The broker validates this context and propagates it to downstream services.
 ### 3.3 CLI Usage
 
 ```bash
+# Sign in first — device-code flow, opens a browser (skip if already authenticated)
+descix login --env dev
+
 # Default (entitlements scope)
 descix tell-me-how "How do I create a new app?"
 
@@ -341,10 +346,11 @@ Custom services integrate with the same pattern:
 
 ### 7.1 For AI Agents
 
-1. **Always use tell_me_how first** - Don't guess at command names
-2. **Use project scope when in a workspace** - More focused results
-3. **Chain operations** - tell_me_how -> execute_remote_command
-4. **Handle errors gracefully** - Show user-friendly messages
+1. **Be signed in before discovery** - `descix login --env dev` (device-code flow) is the step before `tell_me_how`; it refuses loud, not silently, for a credential-free caller
+2. **Always use tell_me_how first (once signed in)** - Don't guess at command names
+3. **Use project scope when in a workspace** - More focused results
+4. **Chain operations** - tell_me_how -> execute_remote_command
+5. **Handle errors gracefully** - Show user-friendly messages
 
 ### 7.2 For Service Developers
 

package/bin/descix.js

@@ -2327,7 +2327,7 @@ corpusCommand
   .option('-k, --kb <name>', 'KB name (syncs specific manifest; default: all)')
   .option('-v, --verbose', 'Show verbose output')
   .option('--ref <ref>', 'Override the git ref for ALL manifest sources (e.g., --ref ws-admin-b1). Precedence: --ref > manifest source.ref > "main".')
-  .option('--rebuild', 'Reconcile Pinecone against the current manifest walk: enumerate remote file_ids, purge any not in the current corpus, then re-sync from scratch. Use to recover from accumulated stale-chunk drift. Prompts before deleting unless --yes is supplied.')
+  .option('--rebuild', 'Reconcile Pinecone against REMOTE state: enumerate remote file_ids, purge any not in the current corpus, then re-sync from scratch. NOT needed to remove deleted files — an ordinary sync already purges them, diffing the walk against sync-state\'s last_sync_commit (measured: a plain sync purged 1962 chunks across 124 stale blob SHAs). Use --rebuild ONLY when that local sync-state cannot be trusted: it is lost, hand-edited, or vectors were orphaned outside the history it tracks. Prompts before deleting unless --yes is supplied.')
   .option('--dry-run', 'Enumerate would-be-purged file_ids and would-be-upserted chunks without ANY Pinecone writes. Exit 0 if no drift, 1 if drift. Read-only.')
   .option('--show-walk', 'Print the resolved ref + the first 50 walked files BEFORE any Pinecone operations. Useful for verifying --ref / manifest source resolution.')
   .option('--yes', 'Skip the interactive purge confirmation in --rebuild mode. Use in scripting/CI.')

package/lib/commands/briefer/sources/entitlements.js

@@ -85,12 +85,23 @@ export async function extract({ env, cliPaths } = {}) {
     relPath: CM_FILE,
     section: `§${SECTION.number} ${SECTION.heading}`
   });
+  // The symbol is matched WITHIN an export list rather than as the list's sole member. The old
+  // pattern anchored on the closing brace immediately after the name, so it broke the moment a
+  // second symbol was re-exported beside it — the extractor reported the re-export missing when
+  // it was present and one token wider.
+  //
+  // HONEST LIMITATION, stated rather than implied: this is still textual matching, so it remains a
+  // derivation of a fact the module itself owns. The robust fix is to consume the owner's actual
+  // exports, but this extractor cannot import communityManagement.js — that would pull the whole
+  // Cloud service graph (config bootstrap, Firestore) into the CLI. Matching the identifier inside
+  // any export list is what survives a re-ordering; a move to `export * from` would still need
+  // this line changed.
   const reExportMatch = findInLines({
     lines: cm.lines,
-    regex: /export\s*\{\s*hydrateCommunityIdFromProducts\s*\}/,
+    regex: /export\s*\{[^}]*\bhydrateCommunityIdFromProducts\b/,
     section: `§${SECTION.number} ${SECTION.heading}`,
     source: `${CM_FILE} (hydrate re-export)`,
-    expected: 'export { hydrateCommunityIdFromProducts }',
+    expected: 'hydrateCommunityIdFromProducts named in an export list',
     recovery: `Verify ${CM_FILE} still re-exports hydrateCommunityIdFromProducts.`
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@descix/cli",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "DeSciX CLI and MCP Server - Unified command-line interface for DeSciX platform",
   "repository": {
     "type": "git",

package/templates/scaffolds/microservice/SERVICE_README_sdk.md

@@ -2,11 +2,11 @@
 
 ## Overview
 
-The DeSciX SDK provides command-line tools and MCP (Model Context Protocol) integration for building applications on the DeSciX platform. The SDK enables developers to authenticate, manage workspaces, create apps, and leverage AI-assisted development through Cursor IDE integration.
+The DeSciX SDK provides command-line tools and MCP (Model Context Protocol) integration for building applications on the DeSciX platform. The SDK enables developers to authenticate, manage workspaces, create apps, and leverage AI-assisted development through editor MCP integration (Claude Code, Copilot, Cursor, Cline).
 
 **Key capabilities:**
 - CLI commands for all platform operations
-- MCP server for Cursor IDE integration
+- MCP server integration for Claude Code, Copilot, Cursor and Cline
 - Intelligent tool discovery via `tell_me_how`
 - Entitlements-driven workspace setup
 - Git-aware project initialization
@@ -28,23 +28,22 @@ npm link
 
 ## CLI Commands
 
-### descix setup
+### descix quickstart
 
-**Description:** One-time workspace configuration wizard
-**Use when:** First time setting up DeSciX in a new workspace or Cursor project
+**Description:** One-command setup: auth → workspace → agent files → MCP config
+**Use when:** First time setting up DeSciX in a new workspace
 **What it does:**
-1. Prompts for API endpoint (production/local/custom)
-2. Runs device authentication (opens browser)
-3. Creates `.cursor/mcp.json` for MCP server
-4. Creates `.cursor/rules/descix_mcp.mdc` for AI agent instructions
-5. Creates `.descix/workspace.json` with initial configuration
+1. Authenticates via device login if no valid session exists
+2. Initializes `.descix/workspace.json` if missing
+3. Generates agent instruction files (`CLAUDE.md`, `.github/copilot-instructions.md`, `.cursorrules`, `.clinerules`) from the workspace's registered app/community
+4. Generates `.vscode/mcp.json` for MCP server config (skipped if the DeSciX VS Code extension already handles MCP)
+5. Copies SDK assets into `.descix/sdk-assets/`
 
 **Example:**
 ```bash
 cd ~/Projects/MyApp
-descix setup
+descix quickstart
 # Follow the prompts
-# Restart Cursor after completion
 ```
 
 ---
@@ -54,8 +53,11 @@ descix setup
 **Description:** Authenticate with the DeSciX platform
 **Use when:** Session expired or first-time authentication
 **Options:**
-- `--device` (default): Opens browser for Powch authentication
-- `--wallet`: Direct wallet signature authentication
+- (default, no flag needed): Device login — opens a browser for Powch authentication
+- `--wallet`: Direct wallet signature authentication (advanced, not yet implemented)
+- `-u, --url <url>`: API URL override
+- `--no-oauth`: Skip the OAuth long-lived token leg (wallet-signature login only)
+- `--scope <scope>`: OAuth scope to request (default: `mcp:read mcp:tools mcp:write mcp:admin`)
 
 **Example:**
 ```bash
@@ -107,41 +109,44 @@ descix tell-me-how --scope discovery "What AI training tools exist?"
 
 ---
 
-### descix app create
+### descix app init
 
-**Description:** Create or hydrate an app using the interactive wizard
-**Use when:** Starting a new project or hydrating an existing app
+**Description:** Create (if needed) and initialize an app: platform record + default KB + local workspace registration and scaffold. Idempotent.
+**Use when:** Starting a new project or hydrating an existing app. This is the single canonical path — the old two-step `app create` then `app init` is deleted; `descix app create` now hard-fails naming this replacement.
 **Options:**
-- `-c, --community <id>`: Community ID
-- `-a, --app <name>`: App name
-- `--wizard`: Interactive wizard mode
-- `--quick`: Skip optional prompts
-
-**Note:** New apps should primarily be provisioned via the PWA. This command can hydrate a local workspace from an existing app or create a skeleton if permitted.
+- `-a, --app <app_id>` (required): App ID. With `-c` this is the app NAME to create.
+- `-c, --community <id>`: Community ID — required to create an app that does not exist yet
+- `-s, --short <short_name>`: Short id segment (no hyphens) used when creating; defaults to `--app`
+- `--overwrite`: When creating, overwrite an existing app record intentionally
+- `--kb <name>`: Knowledge base name (default: `General`)
+- `-p, --path <dir>`: Local app directory (default: auto-detected or cwd)
 
 **Example:**
 ```bash
-# Interactive wizard
-descix app create --wizard
+descix app init -a myapp -c descix
 ```
 
 ---
 
 ### descix kb
 
-**Description:** Manage Knowledge Base content (Git Mode)
-**Use when:** Processing KB documents locally
+**Description:** Manage Knowledge Base registration, corpus sync and per-KB configuration
+**Use when:** Creating a KB, syncing its corpus to Pinecone, or managing per-KB settings
 
 **Subcommands:**
-- `pull`: Download source documents from Drive to `kb/src/`
-- `chunk`: Process source files into chunks in `kb/chunks/`
-- `sync`: Push chunks to the platform (Pinecone)
-- `build`: Run the full pipeline (Pull -> Chunk -> Sync)
+- `create` / `list` / `delete`: Register, list or remove a KB
+- `corpus sync`: The one KB sync surface — walks the corpus manifest, chunks in-memory, pushes to Pinecone
+- `set-override-model` / `clear-override-model`: Pin or clear a per-KB model override
+- `status`: Show corpus sync state (files, chunks, last sync, resolved ref)
+- `doctor`: Detect drift between local sync-state and live Pinecone vector count
+- `records put|query|get|delete`: Structured record CRUD on a KB
+
+**Drive content authoring is a separate command:** `descix drive pull` / `descix drive push` (not under `kb`) move source documents between Drive and the local working tree.
 
 **Example:**
 ```bash
-# Full build pipeline
-descix kb build -c descix -a myapp
+# Sync a KB's corpus manifest to Pinecone
+descix kb corpus sync -a myapp -k General
 ```
 
 ---
@@ -159,8 +164,7 @@ The scaffold reads them via `utils.DEVELOPER_WALLET_ADDRESS` / `utils.DEVELOPER_
 
 **Canonical microservice onboarding sequence:**
 ```bash
-descix app create   -c <community> -a <app>
-descix app init      -a <community>-<app>
+descix app init      -a <app> -c <community>
 descix app set-port  -a <community>-<app> -p <port>
 descix microservice register
 # then: cp dev-overrides.example.json dev-overrides.json  and fill in the developer credential
@@ -200,14 +204,15 @@ descix purchases
 
 ---
 
-## MCP Tools (for Cursor AI)
+## MCP Tools
 
-After running `descix setup` and restarting Cursor, these MCP tools are available to the AI agent:
+After running `descix quickstart` and reloading your editor/session, these MCP tools are available to the AI agent. `descix quickstart` authenticates via device login as its first step (opens a browser device-code flow) before it writes workspace, agent-instruction and MCP config files; there is no unauthenticated form of any of this.
 
 ### tell_me_how
 
 **Description:** Primary discovery tool - finds relevant commands for any task
-**Use first:** Always use this before attempting platform operations
+**Prerequisite:** the caller is signed in — it returns caller-specific context and is refused loud (`Authentication required`, exit 1) for a credential-free caller, never a silent partial answer
+**Use first:** Once signed in, always use this before attempting platform operations
 
 ```javascript
 tell_me_how({ 
@@ -230,7 +235,7 @@ tell_me_how({
 
 ```javascript
 execute_remote_command({
-  command: "create_app",
+  command: "create_app_for_community",
   params: {
     community_id: "descix",
     app_name: "My New App"
@@ -240,90 +245,31 @@ execute_remote_command({
 
 ---
 
-### descix_init
-
-**Description:** Initialize a local project for DeSciX deployment
-**Use when:** Setting up a new project folder
-
-```javascript
-descix_init({
-  projectPath: "/Users/dev/Projects/MyApp",
-  appName: "my-app",
-  communityId: "descix"
-})
-```
-
-**Creates:**
-- `.descix/workspace.json` or `.descix/context.json`
-- `app_description.md` from README if missing
-- Folder structure for knowledge base
-
----
-
-### descix_wizard_step
+### query_knowledge_base
 
-**Description:** Execute multi-step wizard workflows
-**Use when:** Creating apps, communities, or complex operations
+**Description:** Vector-similarity search over a knowledge base — returns raw source chunks with dereferenceable citations (retrieval, no synthesis, stateless)
+**Use when:** You want primary-source passages/citations, or to ground/check an `ask_question_to_app` answer
 
 ```javascript
-descix_wizard_step({
-  wizard_type: "create_app",
-  step: "init",
-  params: {
-    community_id: "descix",
-    app_name: "My App"
-  }
-})
-```
-
-**Wizard types:**
-- `create_app`: App creation with folder setup
-- `create_community`: Community creation with token
-- `publish_kb`: Knowledge base sync and publish
-
----
-
-### git_sync_ops
-
-**Description:** Git operations with auto-generated commit messages
-**Use when:** Committing changes, checking status
-
-```javascript
-git_sync_ops({
-  operation: "status",  // or "commit", "diff", "sync_info"
-  projectPath: "/Users/dev/Projects/MyApp"
-})
-```
-
----
-
-### search_knowledge_base
-
-**Description:** Search a specific knowledge base via RAG
-**Use when:** You know the exact KB to search
-
-```javascript
-search_knowledge_base({
-  communityId: "descix",
-  appId: "docs",
-  kbId: "sdk",
+query_knowledge_base({
+  app_id: "docs",
+  kb_id: "sdk",
   query: "How do I authenticate?"
 })
 ```
 
 ---
 
-### chat_with_kb
+### ask_question_to_app
 
-**Description:** Conversational RAG with knowledge base context
-**Use when:** Complex questions requiring AI reasoning
+**Description:** Ask a natural-language question against an app's knowledge base and get a synthesized, cited answer (stateful — pass `previous_interaction_id` to continue a thread)
+**Use when:** Complex questions requiring AI reasoning over a community's own sources
 
 ```javascript
-chat_with_kb({
-  communityId: "descix",
-  appId: "docs",
-  kbId: "sdk",
-  message: "Explain the authentication flow step by step"
+ask_question_to_app({
+  app_id: "docs",
+  knowledgebase_name: "sdk",
+  user_input: "Explain the authentication flow step by step"
 })
 ```
 
@@ -331,65 +277,44 @@ chat_with_kb({
 
 ## Workspace Configuration
 
-### workspace.json (Monorepo)
+### workspace.json (v2.1 — canonical)
 
-For multi-app workspaces, create `.descix/workspace.json`:
+`.descix/workspace.json` is written and mutated by `descix init` / `descix app init` / `descix app set-*` — never hand-edited. The v2.1 format is `env.platform` (the shell/store app, served at root) plus `env.products[]` (apps hosted inside the shell); the older `communities`-based v1 format is not supported and hard-errors on load ("v1 workspace format is not supported. Migrate to v2.1."):
 
 ```json
 {
-  "version": "2.0",
-  "primaryCommunity": "descix",
-  "directoryMappings": {
-    "frontend": { "communityId": "descix", "appId": "pwa", "kbId": "General" },
-    "backend": { "communityId": "descix", "appId": "cloud", "kbId": "General" },
-    "docs": { "communityId": "descix", "appId": "docs", "kbId": "sdk" }
-  },
-  "defaultContext": {
-    "communityId": "descix",
-    "appId": "docs",
-    "kbId": "sdk"
+  "version": "2.1",
+  "env": {
+    "platform": { "appId": "daita", "communityId": "descix", "localPath": ".", "kbId": "General" },
+    "products": [
+      { "appId": "docs", "communityId": "descix", "kbId": "sdk", "localPath": "descix-docs" }
+    ]
   }
 }
 ```
 
-### context.json (Single App)
-
-For individual app folders, create `.descix/context.json`:
-
-```json
-{
-  "version": "2.0",
-  "type": "app",
-  "community_id": "descix",
-  "app_id": "myapp",
-  "app_name": "My Application",
-  "folders": {
-    "app": { "local_path": ".", "sync_type": "assets" },
-    "kb": { "local_path": "docs", "sync_type": "rag" }
-  }
-}
-```
+A single-app (non-monorepo) workspace uses the same v2.1 shape with only `env.platform` set and an empty (or omitted) `env.products[]` — there is no separate single-app file format.
 
 ---
 
 ## Common Workflows
 
-### New Developer Onboarding (Cursor IDE)
+### New Developer Onboarding
 
 1. Install CLI: `npm install -g @descix/cli`
-2. Run setup: `descix setup`
-3. Restart Cursor (Cmd+Shift+P → "Reload Window")
+2. Run quickstart: `descix quickstart` — authenticates, initializes `.descix/workspace.json`, generates agent instruction files (`CLAUDE.md`, `.github/copilot-instructions.md`, `.cursorrules`, `.clinerules`) for Claude Code, Copilot, Cursor and Cline, and writes `.vscode/mcp.json` (skipped if the DeSciX VS Code extension is installed — it registers MCP natively)
+3. Reload the editor/session so it picks up the generated files
 4. AI agent can now use MCP tools
 5. Ask: "How do I create an app?"
 6. AI uses `tell_me_how` → `execute_remote_command`
 
 ### Entitlements-First App Creation
 
-1. AI calls `execute_remote_command({ command: "fetch_my_purchases" })`
+1. AI calls `fetch_my_purchases()` directly (it is its own MCP tool, not an `execute_remote_command` target)
 2. AI presents user's communities and apps
 3. User selects community (or creates new)
-4. AI calls `descix_wizard_step` for app creation
-5. AI creates local `.descix/context.json`
+4. AI calls `execute_remote_command({ command: "create_app_for_community", params: {...} })` for app creation
+5. AI runs `descix app init` to register the local workspace mapping in `.descix/workspace.json`
 
 ### Monorepo Setup
 
@@ -404,9 +329,9 @@ For individual app folders, create `.descix/context.json`:
 ## Troubleshooting
 
 ### "MCP tools not available"
-1. Run `descix setup` in workspace root
-2. Restart Cursor completely
-3. Check `.cursor/mcp.json` exists with `descix` server
+1. Run `descix quickstart` in workspace root
+2. Reload your editor/session completely
+3. Check `.vscode/mcp.json` exists with a `descix` server (this file is skipped, by design, if the DeSciX VS Code extension is installed — it registers MCP natively)
 
 ### "401 Unauthorized on a loopback / mesh call"
 For the app data plane, your service authenticates AS the developer (wallet_address + signature). A 401 means the
@@ -421,7 +346,7 @@ Run `descix reconnect` or `descix login`
 Service READMEs may not be vectorized. Ask admin to run `descix microservice vectorize` for relevant services.
 
 ### "workspace.json not found" for project scope
-Run `descix init` or let AI create workspace.json via `descix_init` MCP tool.
+Run `descix init` (or `descix quickstart`, which runs it for you if missing).
 
 ---