@distributionos/cli 0.1.15 → 0.1.17

package/README.md

@@ -1,18 +1,18 @@
 # DistributionOS CLI
 
-Installer for connecting an app repo to DistributionOS.
+Installer for connecting an app repo to DistributionOS.
 
 ```bash
 npx @distributionos/cli setup --app <appId>
 ```
 
-Default setup opens the DistributionOS MCP OAuth approval flow when needed, then prints a setup review first. In an interactive terminal, approve the plan to apply the managed setup changes. In non-interactive agent runs, use `--apply` only after reviewing the setup output.
+Default setup opens the DistributionOS MCP OAuth approval flow when needed, then prints a setup review first. In an interactive terminal, approve the plan to apply the managed setup changes. In non-interactive agent runs, use `--apply` only after reviewing the setup output.
 
-Agents that support installable skills can also load the public DistributionOS agent skill before using the CLI:
-
-https://github.com/lawfan1026/distributionos-agent-skill
-
-The CLI remains the default setup path. The skill is a public agent-readable guide for when to use the CLI, MCP, API fallback, analytics install, verification, and implementation reporting.
+Agents that support installable skills can also load the public DistributionOS agent skill before using the CLI:
+
+https://github.com/lawfan1026/distributionos-agent-skill
+
+The CLI remains the default setup path. The skill is a public agent-readable guide for when to use the CLI, MCP, API fallback, analytics install, verification, and implementation reporting.
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@distributionos/cli",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "DistributionOS repo setup CLI for agent onboarding and first-party analytics.",
   "homepage": "https://distributionos.dev",
   "repository": {

package/src/api.js

@@ -1,21 +1,21 @@
 import { DEFAULT_API_BASE, TOKEN_ENV_NAMES } from './constants.js';
-import { getStoredCredential } from './auth-store.js';
-import { isCredentialFresh, refreshOAuthCredential } from './oauth.js';
-
-export class DistributionOsApiError extends Error {
-  constructor(message, { status = 0, code = null } = {}) {
-    super(message);
-    this.name = 'DistributionOsApiError';
-    this.status = status;
-    this.code = code;
-  }
-}
-
-export function resolveEnvToken(env) {
-  for (const name of TOKEN_ENV_NAMES) {
-    const value = env?.[name]?.trim();
-    if (value) return { source: 'env', name, value };
-  }
+import { getStoredCredential } from './auth-store.js';
+import { isCredentialFresh, refreshOAuthCredential } from './oauth.js';
+
+export class DistributionOsApiError extends Error {
+  constructor(message, { status = 0, code = null } = {}) {
+    super(message);
+    this.name = 'DistributionOsApiError';
+    this.status = status;
+    this.code = code;
+  }
+}
+
+export function resolveEnvToken(env) {
+  for (const name of TOKEN_ENV_NAMES) {
+    const value = env?.[name]?.trim();
+    if (value) return { source: 'env', name, value };
+  }
   return null;
 }
 
@@ -42,111 +42,111 @@ export async function resolveAuthToken({ env, apiBase, appId, fetchImpl }) {
     : null;
 }
 
-export async function fetchDistributionOsSetupContext(input) {
+export async function fetchDistributionOsSetupContext(input) {
+  const token = await resolveAuthToken({
+    env: input.env,
+    apiBase: input.apiBase ?? DEFAULT_API_BASE,
+    appId: input.appId,
+    fetchImpl: input.fetch,
+  });
+  if (!token || input.noFetch) {
+    return {
+      status: input.noFetch ? 'skipped' : 'not_authenticated',
+      tokenName: token?.name ?? null,
+      access: {
+        allowed: false,
+        reason: input.noFetch ? 'remote_fetch_skipped' : 'not_authenticated',
+        billingUrl: `${normalizeApiBase(input.apiBase ?? DEFAULT_API_BASE)}/dashboard/account/billing`,
+      },
+      usage: null,
+      instructions: null,
+      analyticsContract: null,
+      setupContract: null,
+      errors: [],
+    };
+  }
+
+  const apiBase = normalizeApiBase(input.apiBase ?? DEFAULT_API_BASE);
+  const errors = [];
+  let subscriptionRequired = false;
+  const capture = (label) => (error) => {
+    if (error instanceof DistributionOsApiError && (error.status === 402 || error.code === 'SUBSCRIPTION_REQUIRED')) {
+      subscriptionRequired = true;
+    }
+    errors.push(`${label} failed: ${error.message}`);
+    return null;
+  };
+
+  const [instructions, analyticsContract, usage, setupContract] = await Promise.all([
+    fetchJson({
+      fetchImpl: input.fetch,
+      apiBase,
+      token: token.value,
+      path: `/api/v1/apps/${encodeURIComponent(input.appId)}/agent/instructions`,
+    }).catch(capture('Agent instructions fetch')),
+    fetchJson({
+      fetchImpl: input.fetch,
+      apiBase,
+      token: token.value,
+      path: `/api/v1/apps/${encodeURIComponent(input.appId)}/analytics/contract`,
+    }).catch(capture('Analytics contract fetch')),
+    fetchJson({
+      fetchImpl: input.fetch,
+      apiBase,
+      token: token.value,
+      path: `/api/v1/apps/${encodeURIComponent(input.appId)}/usage`,
+    }).catch(capture('Usage fetch')),
+    fetchJson({
+      fetchImpl: input.fetch,
+      apiBase,
+      token: token.value,
+      path: `/api/v1/apps/${encodeURIComponent(input.appId)}/setup/contract`,
+    }).catch(capture('Setup contract fetch')),
+  ]);
+
+  return {
+    status: errors.length === 0 ? 'fetched' : 'partial',
+    tokenName: token.name,
+    access: {
+      allowed: !subscriptionRequired,
+      reason: subscriptionRequired ? 'subscription_required' : errors.length === 0 ? 'active' : 'partial',
+      billingUrl: `${apiBase}/dashboard/account/billing`,
+    },
+    usage,
+    instructions,
+    analyticsContract,
+    setupContract,
+    errors,
+  };
+}
+
+export async function reportSetupInstallation(input) {
   const token = await resolveAuthToken({
     env: input.env,
     apiBase: input.apiBase ?? DEFAULT_API_BASE,
     appId: input.appId,
     fetchImpl: input.fetch,
-  });
-  if (!token || input.noFetch) {
-    return {
-      status: input.noFetch ? 'skipped' : 'not_authenticated',
-      tokenName: token?.name ?? null,
-      access: {
-        allowed: false,
-        reason: input.noFetch ? 'remote_fetch_skipped' : 'not_authenticated',
-        billingUrl: `${normalizeApiBase(input.apiBase ?? DEFAULT_API_BASE)}/dashboard/account/billing`,
-      },
-      usage: null,
-      instructions: null,
-      analyticsContract: null,
-      setupContract: null,
-      errors: [],
-    };
-  }
-
-  const apiBase = normalizeApiBase(input.apiBase ?? DEFAULT_API_BASE);
-  const errors = [];
-  let subscriptionRequired = false;
-  const capture = (label) => (error) => {
-    if (error instanceof DistributionOsApiError && (error.status === 402 || error.code === 'SUBSCRIPTION_REQUIRED')) {
-      subscriptionRequired = true;
-    }
-    errors.push(`${label} failed: ${error.message}`);
-    return null;
-  };
-
-  const [instructions, analyticsContract, usage, setupContract] = await Promise.all([
-    fetchJson({
-      fetchImpl: input.fetch,
-      apiBase,
-      token: token.value,
-      path: `/api/v1/apps/${encodeURIComponent(input.appId)}/agent/instructions`,
-    }).catch(capture('Agent instructions fetch')),
-    fetchJson({
-      fetchImpl: input.fetch,
-      apiBase,
-      token: token.value,
-      path: `/api/v1/apps/${encodeURIComponent(input.appId)}/analytics/contract`,
-    }).catch(capture('Analytics contract fetch')),
-    fetchJson({
-      fetchImpl: input.fetch,
-      apiBase,
-      token: token.value,
-      path: `/api/v1/apps/${encodeURIComponent(input.appId)}/usage`,
-    }).catch(capture('Usage fetch')),
-    fetchJson({
-      fetchImpl: input.fetch,
-      apiBase,
-      token: token.value,
-      path: `/api/v1/apps/${encodeURIComponent(input.appId)}/setup/contract`,
-    }).catch(capture('Setup contract fetch')),
-  ]);
-
-  return {
-    status: errors.length === 0 ? 'fetched' : 'partial',
-    tokenName: token.name,
-    access: {
-      allowed: !subscriptionRequired,
-      reason: subscriptionRequired ? 'subscription_required' : errors.length === 0 ? 'active' : 'partial',
-      billingUrl: `${apiBase}/dashboard/account/billing`,
-    },
-    usage,
-    instructions,
-    analyticsContract,
-    setupContract,
-    errors,
-  };
-}
-
-export async function reportSetupInstallation(input) {
-  const token = await resolveAuthToken({
-    env: input.env,
-    apiBase: input.apiBase ?? DEFAULT_API_BASE,
-    appId: input.appId,
-    fetchImpl: input.fetch,
-  });
-  if (!token) {
-    throw new Error('No stored OAuth token or env token was available.');
-  }
-
-  const apiBase = normalizeApiBase(input.apiBase ?? DEFAULT_API_BASE);
-  const response = await input.fetch(`${apiBase}/api/v1/apps/${encodeURIComponent(input.appId)}/setup/report`, {
-    method: 'POST',
-    headers: {
-      Authorization: `Bearer ${token.value}`,
-      'Content-Type': 'application/json',
-      Accept: 'application/json',
-    },
-    body: JSON.stringify(input.report),
-  });
-  const body = await response.json().catch(() => null);
-  if (!response.ok || body?.success === false) {
-    throw new Error(body?.error || `Setup report failed with HTTP ${response.status}`);
-  }
-  return body?.data ?? body;
-}
+  });
+  if (!token) {
+    throw new Error('No stored OAuth token or env token was available.');
+  }
+
+  const apiBase = normalizeApiBase(input.apiBase ?? DEFAULT_API_BASE);
+  const response = await input.fetch(`${apiBase}/api/v1/apps/${encodeURIComponent(input.appId)}/setup/report`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${token.value}`,
+      'Content-Type': 'application/json',
+      Accept: 'application/json',
+    },
+    body: JSON.stringify(input.report),
+  });
+  const body = await response.json().catch(() => null);
+  if (!response.ok || body?.success === false) {
+    throw new Error(body?.error || `Setup report failed with HTTP ${response.status}`);
+  }
+  return body?.data ?? body;
+}
 
 export async function ensureAnalyticsSite(input) {
   const token = await resolveAuthToken({
@@ -264,14 +264,14 @@ async function fetchJson({ fetchImpl, apiBase, token, path }) {
     },
   });
   const body = await response.json().catch(() => null);
-  if (!response.ok || body?.success === false) {
-    throw new DistributionOsApiError(body?.error || `HTTP ${response.status}`, {
-      status: response.status,
-      code: body?.code ?? null,
-    });
-  }
-  return body?.data ?? body;
-}
+  if (!response.ok || body?.success === false) {
+    throw new DistributionOsApiError(body?.error || `HTTP ${response.status}`, {
+      status: response.status,
+      code: body?.code ?? null,
+    });
+  }
+  return body?.data ?? body;
+}
 
 function normalizeApiBase(value) {
   return String(value || DEFAULT_API_BASE).replace(/\/+$/, '');

package/src/bootstrap.js

@@ -7,10 +7,10 @@ import {
 const BOOTSTRAP_BLOCK_RE =
   /<!--\s*DISTRIBUTIONOS:START[\s\S]*?DISTRIBUTIONOS:END\s*-->/i;
 
-export function buildSetupCommand(appId, packageName = CLI_PACKAGE_NAME) {
-  const packageSpec = packageName === CLI_PACKAGE_NAME ? `${packageName}@latest` : packageName;
-  return `npx --yes ${packageSpec} setup --app ${shellToken(appId)}`;
-}
+export function buildSetupCommand(appId, packageName = CLI_PACKAGE_NAME) {
+  const packageSpec = packageName === CLI_PACKAGE_NAME ? `${packageName}@latest` : packageName;
+  return `npx --yes ${packageSpec} setup --app ${shellToken(appId)}`;
+}
 
 export function buildLocalBootstrapBlock(version = CURRENT_BOOTSTRAP_VERSION, appId) {
   const appIdAttribute = appId ? ` appId=${appId}` : '';
@@ -24,25 +24,27 @@ export function buildLocalBootstrapBlock(version = CURRENT_BOOTSTRAP_VERSION, ap
     '',
     'This repo is linked to DistributionOS.',
     '',
-    'Hard preflight: before editing files, creating assets, generating images, or changing copy for SEO, blog, launch, content, visual asset, competitor, social, email, or growth work, fetch the current instructions from DistributionOS:',
+    'Hard preflight: before editing files, creating assets, generating images, creating HyperFrames launch/demo videos, or changing copy for SEO, blog, launch, content, visual asset, competitor, social, email, or growth work, fetch the current instructions from DistributionOS:',
+    '',
+    instructionCall,
+    '',
+    'This preflight applies even when the user does not mention DistributionOS by name. Do not start from local repo files alone for those tasks.',
+    '',
+    'If the user asks about DistributionOS analytics, context, setup state, or connection checks and DistributionOS tools are not visible, do not inspect unrelated dashboards or repos. Tell the user to restart or reconnect the agent session from this app repo and approve the DistributionOS MCP server.',
     '',
-    instructionCall,
-    '',
-    'This preflight applies even when the user does not mention DistributionOS by name. Do not start from local repo files alone for those tasks.',
-    '',
-    'If the user asks about DistributionOS analytics, context, setup state, or connection checks and DistributionOS tools are not visible, do not inspect unrelated dashboards or repos. Tell the user to restart or reconnect the agent session from this app repo and approve the DistributionOS MCP server.',
-    '',
-    'If only DistributionOS authentication tools are visible, authenticate first, wait for the user to approve OAuth in the browser, complete authentication, then call check_distributionos_connection, get_agent_instructions, and the task-specific tool such as get_analytics_summary.',
-    '',
-    'If MCP remains unavailable, ask before using an API-key fallback. Never write API keys into tracked files, repo instructions, committed MCP config, README, or logs.',
-    '',
-    'For existing blog posts or DistributionOS artifacts, fetch the artifact/context first. Use DistributionOS image/media workflows before local image tools.',
+    'If only DistributionOS authentication tools are visible, authenticate first, wait for the user to approve OAuth in the browser, complete authentication, then call check_distributionos_connection, get_agent_instructions, and the task-specific tool such as get_analytics_summary.',
+    '',
+    'If MCP remains unavailable, ask before using an API-key fallback. Never write API keys into tracked files, repo instructions, committed MCP config, README, or logs.',
+    '',
+    'For existing blog posts or DistributionOS artifacts, fetch the artifact/context first. Use DistributionOS image/media workflows before local image tools.',
+    '',
+    'For HyperFrames launch/demo/feature video work, use DistributionOS to decide what video is worth making: fetch app context, Brain Doc/context pack, Opportunity Map, and existing artifacts; create or fetch a video_brief with safe claims, CTA, tracking plan, starter frame.md, storyboard, asset checklist, and HyperFrames handoff. Then use the local HyperFrames skill or CLI for composition/rendering, and report the final render/URL back as a linked video_asset.',
     '',
     'When you create a plan, strategy, roadmap, campaign, content ideas, keyword priorities, or next-step recommendations, save it to DistributionOS as proposed work for review before executing.',
     '',
     'When you publish, ship, schedule, or implement a DistributionOS artifact, report the implementation back to DistributionOS before your final response.',
     '',
-    'If analytics is enabled, public blog posts, landing pages, CTAs, email links, social links, launch links, paid links, and campaigns must use the DistributionOS analytics contract by default: call get_analytics_install_instructions, add page/link markers, use create_tracked_link for campaign links, verify_analytics_install after deploy, or report a specific analyticsOptOutReason.',
+    'If analytics is enabled, public blog posts, landing pages, CTAs, email links, social links, launch links, paid links, and campaigns must use the DistributionOS analytics contract by default: call get_analytics_install_instructions, add page/link markers, use create_tracked_link for campaign links, wire public checkout_started/signup/waitlist/email success events where safe, verify_analytics_install after deploy, or report a specific analyticsOptOutReason.',
     '',
     'For SEO blog/page publishes, verify 200, canonical, sitemap inclusion, robots/indexability, one H1, meta description, and schema before reporting.',
     '',
@@ -100,14 +102,14 @@ export function getBootstrapAction(instructionFiles, recommendedBlock) {
 
 export function buildFallbackMcpInstructions(appId) {
   return [
-    `App ID: ${appId}`,
-    `DistributionOS MCP server: ${MCP_SERVER_URL}`,
-    'Use OAuth sign-in when prompted, then call get_agent_instructions and submit_initialization_context.',
-    'If only DistributionOS authentication tools appear, authenticate first, wait for the user to approve OAuth, then complete authentication before calling any other DistributionOS tool.',
-    'If OAuth is unavailable, create an app-scoped write API key in DistributionOS and expose it only as DISTRIBUTIONOS_API_KEY for the command invocation.',
-    'Never write the API key into AGENTS.md, CLAUDE.md, README, committed MCP config, or any tracked file.',
-  ];
-}
+    `App ID: ${appId}`,
+    `DistributionOS MCP server: ${MCP_SERVER_URL}`,
+    'Use OAuth sign-in when prompted, then call get_agent_instructions and submit_initialization_context.',
+    'If only DistributionOS authentication tools appear, authenticate first, wait for the user to approve OAuth, then complete authentication before calling any other DistributionOS tool.',
+    'If OAuth is unavailable, create an app-scoped write API key in DistributionOS and expose it only as DISTRIBUTIONOS_API_KEY for the command invocation.',
+    'Never write the API key into AGENTS.md, CLAUDE.md, README, committed MCP config, or any tracked file.',
+  ];
+}
 
 function shellToken(value) {
   if (/^[a-zA-Z0-9._:-]+$/.test(value)) return value;