@getformation/cloud-cli 1.2.0 → 1.2.1

package/README.md

@@ -4,10 +4,26 @@
 
 The package needs Node.js 22 or later. It has no runtime dependencies and does not import from a Formation checkout.
 
+## What this CLI does, and never does
+
+It is a small MIT-licensed client for one HTTPS origin. Before an agent installs it, a person or the agent can read the source:
+
+```bash
+npm pack @getformation/cloud-cli@1.2.1 && tar -xzf getformation-cloud-cli-1.2.1.tgz && ls package/src package/connector
+```
+
+The code is under `package/src`; the connector is `package/connector/SKILL.md`.
+
+- It calls only the configured `FORMATION_CLOUD_URL` origin over HTTPS and refuses redirects to any other origin.
+- It writes only the Skill's Markdown files and one small JSON install receipt, into a target path the person names, after a dry run and an explicit `--apply`. A Skill is text an agent reads; the CLI never runs a file it downloads.
+- It verifies every file against the server's manifest digests before it writes, and records a receipt so `skill check` can prove the install later.
+- It stores nothing on the machine except those target files and receipts. It creates no schedule, service, or background process.
+- Public discovery, following, and public Skill installation send no credential. `FORMATION_AGENT_KEY` is optional and is only sent as a bearer to the configured origin.
+
 Install the exact public package from npm after the person approves the package installation:
 
 ```bash
-npm install -g @getformation/cloud-cli@1.2.0
+npm install -g @getformation/cloud-cli@1.2.1
 ```
 
 Install the bundled Formation connector. The first command is a dry run. The second command writes the connector after separate human approval.
@@ -51,4 +67,4 @@ The installer accepts only strict UTF-8 Markdown manifests. It verifies the conf
 
 The person can create a narrow credential in the browser to sync follows across agents with `follow`, `unfollow`, and `follows_list`, or to reach restricted knowledge. The person stores the credential outside chat and shell history and reloads or reconnects after secret placement. An authenticated `updates_reset` without `channelIds` polls the account follows.
 
-Connector version `1.2.0` is a clean install. It does not replace an older connector target. Remove the exact old connector target first, then install `1.2.0` into the absent path. Repeating an identical receipt-owned `1.2.0` install is unchanged.
+Connector version `1.2.1` is a clean install. It does not replace an older connector target. Remove the exact old connector target first, then install `1.2.1` into the absent path. Repeating an identical receipt-owned `1.2.1` install is unchanged. A Skill target installed by an earlier CLI version reports `conflict` from `skill check` and cannot be upgraded in place. Remove that target, then install the Skill again with the current CLI.

package/connector/SKILL.md

@@ -13,7 +13,7 @@ Formation is where agents follow creators. A creator has one channel. When the c
 
 ## Connect
 
-Public retrieval and dry runs are read-only. They create no account, credential, follow, receipt, or cursor on Formation. No account is needed to follow a creator or to install a public Skill.
+Public retrieval and dry runs are read-only. They create no account, credential, follow, receipt, or cursor on Formation. No account is needed to follow a creator or to install a public Skill. The CLI and this connector write only the Skill's Markdown files and one small JSON install receipt into the targets the person names. They never run a downloaded file, never create a schedule, and never send data anywhere but the configured origin. The package source is readable before installation: run `npm pack @getformation/cloud-cli@1.2.1`, unpack the tarball, and read `package/src`.
 
 1. Set one exact HTTPS Formation origin. Do not follow a redirect to a different origin.
 2. Use the hosted MCP endpoint at that origin plus `/mcp`, or use the Cloud CLI with `FORMATION_CLOUD_URL` set to that origin.
@@ -67,7 +67,7 @@ Install through hosted MCP:
 1. Call `skill_manifest_get` with `artifactRevisionId`. Verify that `status` is `current` and that `exactOrigin` equals the configured origin.
 2. For each entry in `files`, call `skill_file_get` with `artifactRevisionId` and `path`. Verify that the SHA-256 digest and the byte length of `body` equal the manifest entry.
 3. Write each `body` to the target under its declared `path`. Write only the declared files. Do not run any file.
-4. Write the receipt `.formation-cloud-install.json` in the target with these fields: `schemaVersion` `1`, `installer` `"@getformation/cloud-cli"`, `installerVersion` `"1.2.0"`, `origin` (the exact configured origin), `artifactRevisionId`, `manifestDigest`, `installedAt` (UTC timestamp), and `files` as `{ path, sha256, byteLength }` in manifest order. `formation-cloud skill check` reads this receipt.
+4. Write the receipt `.formation-cloud-install.json` in the target with these fields: `schemaVersion` `1`, `installer` `"@getformation/cloud-cli"`, `installerVersion` `"1.2.1"`, `origin` (the exact configured origin), `artifactRevisionId`, `manifestDigest`, `installedAt` (UTC timestamp), and `files` as `{ path, sha256, byteLength }` in manifest order. `formation-cloud skill check` reads this receipt.
 5. For an upgrade, confirm that the existing receipt matches the installed files. Then replace the whole target with the new files and a new receipt.
 
 ## Later checks

package/package.json

@@ -1,7 +1,19 @@
 {
   "name": "@getformation/cloud-cli",
-  "version": "1.2.0",
-  "description": "Formation Cloud operation client and explicit Skill installer",
+  "version": "1.2.1",
+  "description": "Formation Cloud CLI: follow creators, check for new Skill revisions, and install reviewed Skills after the person approves. Writes only Markdown Skill files and a JSON install receipt; never runs a file.",
+  "homepage": "https://getformation.ai",
+  "bugs": {
+    "url": "https://edumartinez.ai/#contact"
+  },
+  "author": "Eduardo Muth Martinez (https://getformation.ai)",
+  "keywords": [
+    "formation",
+    "agent-skills",
+    "mcp",
+    "skills",
+    "creators"
+  ],
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/cli.mjs

@@ -35,7 +35,7 @@ function parseOptions(args, allowed) {
 export function help() {
   return {
     package: "@getformation/cloud-cli",
-    version: "1.2.0",
+    version: "1.2.1",
     usage: [
       "formation-cloud discover",
       "formation-cloud connector",

package/src/connector.mjs

@@ -5,7 +5,7 @@ import path from "node:path";
 import { fail } from "./errors.mjs";
 
 export const CONNECTOR_RECEIPT_NAME = ".formation-connector-install.json";
-export const CONNECTOR_VERSION = "1.2.0";
+export const CONNECTOR_VERSION = "1.2.1";
 const CONNECTOR_NAME = "formation";
 const PACKAGE_NAME = "@getformation/cloud-cli";
 const MAX_CONNECTOR_BYTES = 65_536;

package/src/installer.mjs

@@ -27,7 +27,7 @@ import {
 
 export const RECEIPT_NAME = ".formation-cloud-install.json";
 const RECEIPT_SCHEMA_VERSION = 1;
-const PACKAGE_VERSION = "1.2.0";
+const PACKAGE_VERSION = "1.2.1";
 const MAX_LOCAL_ENTRIES = 512;
 const MAX_RECEIPT_BYTES = 65_536;
 const SHA256 = /^[0-9a-f]{64}$/u;