@isomorph.ai/cli 0.11.0 → 0.11.1

package/README.md

@@ -28,7 +28,7 @@ The only step you do yourself is the company sign-in: when the agent runs `isomo
 
 ```
 isomorph agent-setup                                        install the `isomorph` skill for Claude Code and Codex; idempotent
-isomorph init --app-root <path> [--adopt] [--upgrade] [--json]   starter app in an empty folder (also runs agent-setup); a folder with an app and no kit is refused with three choices (APP_EXISTS); --adopt adds the kit files to a Vite + React app in place; --upgrade re-pins the kit bundle and runs the checks
+isomorph init --app-root <path> [--adopt] [--upgrade] [--json]   starter app in an empty folder or around data files (also runs agent-setup); a folder with an app and no kit is refused with the choices that can succeed (APP_EXISTS); --adopt adds the kit files to a Vite + React app in place; --upgrade re-pins the kit bundle and runs the checks
 isomorph package --app-root <path> [--out <file>] [--json]  zip an app built without the kit for the console's Upload package (local; .env files included, node_modules/build output/.git left out)
 isomorph dev --app-root <path> [--reset] [--detach] [--json]  run the app locally on one loopback origin; --detach starts it in the background and prints {origin, pid} once it answers
 isomorph stop --app-root <path>                             stop local services, keep data
@@ -47,7 +47,7 @@ isomorph status | retry | promote [--app-root <path>] [--operation <reference>]
 
 `promote` never prompts: `--confirm-tested` is the one flag that means the person has opened the preview and it works. (`productionise`, the command's name until 0.3.4, was accepted as an alias for one release and is no longer a command.)
 
-There are two ways onto Isomorph and `init` is where the folder decides. An empty folder (or one holding only `.git`, a README, a licence or editor and agent files) gets the starter. A folder that already is a kit app (it has `.isomorph/kit.lock.json`) is kept as it is and told its next commands (`dev`, `check`, `deploy`). A folder with an app and no kit is never adopted silently: `init` refuses with exit 2, `APP_EXISTS`, and the three choices — `isomorph init --app-root <dir> --adopt` (add the kit in place; Vite + React only, otherwise `APP_UNSUPPORTED`), `isomorph init --app-root <new-empty-folder>` (start a new kit app), or `isomorph package --app-root <dir>` (package the app as it is for the console import). With `--json` the choices are in `error.details.choices` as `{ id, command, description }`, so an agent relays them and runs the one the person picks. `package` is local (no company, no sign-in): it scans the tree the way `deploy` does, includes the app's `.env` files (the console reads their values into encrypted defaults and never commits the files), refuses private keys and other secret-bearing paths, and writes a deterministic `isomorph-import.zip` (or `--out <file>`) whose result names the path, file count, bytes, sha256 and the one next step: upload it in the console (Add app → Upload package), or connect the repository there instead. A kit app is refused (`KIT_APP`): it deploys with `isomorph deploy`.
+There are two ways onto Isomorph and `init` is where the folder decides. An empty folder (or one holding only `.git`, a README, a licence, `node_modules` or editor and agent files) gets the starter. So does a folder that holds only data — no `package.json`, no `src/`, no index or source file (`.ts`, `.tsx`, `.js`, `.jsx`, `.mjs`, `.html`): the starter is created around the files, none is overwritten, and one line names them (`Kept 2 existing files (data.csv, rows.csv); read them from the app.`). A folder that already is a kit app (it has `.isomorph/kit.lock.json`) is kept as it is and told its next commands (`dev`, `check`, `deploy`). A folder with an app and no kit is never adopted silently: `init` refuses with exit 2, `APP_EXISTS`, and the choices that can succeed, in order — `isomorph init --app-root <dir> --adopt` (add the kit in place; offered only when `package.json` depends on vite and react, otherwise `APP_UNSUPPORTED`), `isomorph init --app-root <new-empty-folder>` (start a new kit app), then `isomorph package --app-root <dir>` (package the app as it is for the console import). With `--json` the choices are in `error.details.choices` as `{ id, command, description }`, so an agent relays them and runs the one the person picks. `package` is local (no company, no sign-in): it scans the tree the way `deploy` does, includes the app's `.env` files (the console reads their values into encrypted defaults and never commits the files), refuses private keys and other secret-bearing paths, and writes a deterministic `isomorph-import.zip` (or `--out <file>`) whose result names the path, file count, bytes, sha256 and the one next step: upload it in the console (Add app → Upload package), or connect the repository there instead. A kit app is refused (`KIT_APP`): it deploys with `isomorph deploy`.
 
 `isomorph --help` prints the full usage. Local commands need no company sign-in; integrations and shipping do.
 

package/dist/packages/harbour-cli/src/agent-setup.js

@@ -108,7 +108,7 @@ Rules live beside this file: \`core.md\` before the first edit; \`integrations.m
 
 ## Getting ready
 
-- No \`.isomorph/\` yet: \`isomorph init --app-root .\` (empty folder → starter; an existing app → three choices to relay). Node 22+, no Docker. Then write the app's \`name\` and \`description\` into \`.isomorph/app.json\` from what they asked and tell them both: IT sees the app under exactly these, once, on its first approval.
+- No \`.isomorph/\` yet: \`isomorph init --app-root .\` (an existing app: relay its choices and ask; never run \`package\` unasked). Node 22+, no Docker. The starter is a notes-and-files placeholder: before the first \`dev\`, replace \`src/App.tsx\`, \`index.html\`'s title and \`migrations/0001_notes.sql\` with what they asked, and say so in one line (applied migrations freeze after the first deploy). Then propose a \`name\` and one-sentence \`description\` from the request, write them into \`.isomorph/app.json\`, and show both in your next reply asking for corrections: IT sees the app under exactly these, once, on its first approval.
 - Sign-in, only when a command answers \`CONFIG_REQUIRED\` or \`AUTH_REQUIRED\` (most machines already are): \`isomorph connect <work-email>\`, then \`isomorph login\` — the browser opens and the person finishes there (their one step; say so).
 
 ## Intent → command
@@ -120,7 +120,7 @@ Rules live beside this file: \`core.md\` before the first edit; \`integrations.m
 | "does it work?" (and before reporting anything as working) | open the dev link in your own browser, press the control you built or changed, read what the app shows; a green \`isomorph check\` is not that proof (fixtures answer AI and company systems). A Send in development is real: reuse explicit authorization or ask once. No browser: say the button is untested. |
 | "I need Slack / Gmail / the warehouse" | read \`integrations.md\` beside this skill first; then: catalog, write the call (literals only), \`isomorph check\`, then submit the request; say READY or PENDING in one line. |
 | "summarise", "draft", "AI" | read \`ai.md\` beside this skill first; then one call behind a control they press. |
-| "ship it", "let my team try it" | show the person the three values in \`.isomorph/app.json\` (name, description, audience — "only you" when empty) and correct the file as they say; then \`isomorph deploy --app-root . --json\` (it runs the checks when needed and refuses once naming every blocker and its fix: relay that line; the app works meanwhile). To give someone access later: add their email to \`audience\`, then \`isomorph share --app-root . --json\`, never \`deploy\`. Give them \`result.deployment.protectedUrl\` and \`result.consoleUrl\` (its live checks). \`--session-notes\`: what cost you time in Isomorph, or \`""\`. |
+| "ship it", "let my team try it" | show the person the three values in \`.isomorph/app.json\` (name, description, audience — "only you" when empty), ask who else should be able to open it (colleagues' work emails only; no groups or whole company yet) and correct the file as they say; then \`isomorph deploy --app-root . --json\` (it runs the checks when needed and refuses once naming every blocker and its fix: relay that line; the app works meanwhile). To give someone access later: add their email to \`audience\`, then \`isomorph share --app-root . --json\`, never \`deploy\`. Give them \`result.deployment.protectedUrl\` as "your app, a private preview — open it and try it" and \`result.consoleUrl\` as "the Isomorph console page for this deployment: its checks and status". If \`result.ai\` is present, relay it in one line. \`--session-notes\`: what cost you time in Isomorph, or \`""\`. |
 | "make it live" | only after they have tried the preview: \`isomorph promote --operation <ref> --app-root . --confirm-tested --json\`. Report the production link, or that operator approval is pending. |
 | "stop it" | \`isomorph stop --app-root .\` (data kept); \`isomorph dev --app-root . --reset\` only when they ask to start over. |
 | "every day at 2pm", "send this automatically" | read \`jobs.md\` beside this skill first (follow its in-conversation owner approval steps); write the job, run it once with \`isomorph jobs run\`, and report what was verified. |

package/dist/packages/harbour-cli/src/check.js

@@ -57,6 +57,13 @@ export async function runChecks(root, options) {
     const gate = await runKitGate(root, { run, bundle, output, ...(options.fetch ? { fetch: options.fetch } : {}), ...(options.runtime ? { runtime: options.runtime } : {}), ...(options.pollMs ? { pollMs: options.pollMs } : {}) });
     for (const check of gate.checks)
         record(check);
+    // A green ai journey reads as "AI works here" unless it is said what answered
+    // it (a builder was told the check "simulated the AI reply" and could not
+    // tell whether AI was integrated, 2026-09-26). The gate's own detail names
+    // the canned reply; this is the one plain line that says what that means.
+    const ai = gate.checks.some(cannedAi) ? "canned" : "not tested";
+    if (ai === "canned")
+        output(AI_CANNED_LINE);
     let integrations = "not tested";
     if (options.governance) {
         // Reads that could not run are one check the report carries as not_run with
@@ -96,12 +103,16 @@ export async function runChecks(root, options) {
         checks,
         gate,
         integrations,
-        ai: "not tested",
+        ai,
         passed: checks.every(check => check.status !== "fail") && (integrations === "not tested" || integrations.every(item => item.status !== "fail"))
     };
     await writeFile(kitPaths(root).report, `${JSON.stringify(report, null, 2)}\n`).catch(() => undefined);
     return report;
 }
+/** What the check's canned AI reply means, in the builder's terms, printed once after the gate. */
+export const AI_CANNED_LINE = "AI in this check: answered by a canned reply (call shape checked, not a real model). Real AI runs when you use the app from `isomorph dev` or the preview link.";
+/** The gate's own wording for a journey whose governed AI call the canned fixture answered (data plane kit_gate.go `fixtureAnsweredDetail`). */
+const cannedAi = (check) => check.name.startsWith("journey:") && check.status === "pass" && (check.detail ?? "").includes("governed AI was answered by the gate's canned completion");
 function renderCheck(check) {
     const mark = check.status === "pass" ? "ok  " : check.status === "fail" ? "FAIL" : "skip";
     return `${mark} ${check.name}${check.detail ? ` — ${indentLines(check.detail)}` : ""}`;

package/dist/packages/harbour-cli/src/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { appCallsAi, deploy, readDeployNote } from "./deploy.js";
+import { appCallsAi, deploy, describeAi, readDeployNote } from "./deploy.js";
 import { continueCommand, follow, promoteToProduction, retryDeployment, statusFetch, summarize } from "./operations.js";
 import { CliError, failureEnvelope, operationEnvelope, renderFailure, renderSummary } from "./output.js";
 import { CLI_VERSION } from "./version.js";
@@ -7,7 +7,7 @@ import { alreadySignedIn, connectedAccount, loadStoredToken, login, logout, open
 import { assertCliCurrent, CLI_INSTALL_COMMAND, cliStaleness, companyLabel, connect, loadConfig, resolveConfig } from "./config.js";
 import { EMBEDDED_KIT_BUNDLE } from "./kit-bundle.js";
 import { appRoot, assertLockCompany, readAppProfile, readKitLock, requestResourceName } from "./kit.js";
-import { initKit } from "./starter.js";
+import { initKit, keptDataLine } from "./starter.js";
 import { packageApp } from "./package.js";
 import { agentPaths, agentSetup } from "./agent-setup.js";
 import { detachDev, startDev } from "./dev.js";
@@ -33,7 +33,7 @@ const reset = args.includes("--reset");
 /** `dev --detach`: start the services, print the origin, exit while they keep running. */
 const detach = args.includes("--detach");
 const upgrade = args.includes("--upgrade");
-/** `init --adopt`: add the kit to the app already in the folder (Vite + React only). Without it a folder with an app and no kit is refused with its three choices. */
+/** `init --adopt`: add the kit to the app already in the folder (Vite + React only). Without it a folder with an app and no kit is refused with its choices. */
 const adopt = args.includes("--adopt");
 /** `package --out`: where the console import package is written (default `<app-root>/isomorph-import.zip`). */
 const out = optionValue("--out");
@@ -57,7 +57,7 @@ const usage = [
     "  isomorph connect <work-email | company-start-url>",
     "  isomorph login | logout",
     "  isomorph agent-setup [--json]                               install the plain-English Isomorph skill for Claude Code (~/.claude/skills/isomorph) and Codex (~/.codex/skills/isomorph)",
-    "  isomorph init --app-root <path> [--adopt] [--upgrade] [--json]   create the starter in an empty folder (also runs agent-setup); a folder with an app and no kit is refused with three choices; --adopt adds the kit files to a Vite + React app in place; --upgrade re-pins the kit bundle and runs the checks",
+    "  isomorph init --app-root <path> [--adopt] [--upgrade] [--json]   create the starter in an empty folder, or around data files (CSVs and the like are kept and named; also runs agent-setup); a folder with an app (package.json or source files) and no kit is refused with the choices that can succeed; --adopt adds the kit files to a Vite + React app in place; --upgrade re-pins the kit bundle and runs the checks",
     "  isomorph package --app-root <path> [--out <file>] [--json]  zip an app built without the kit for the Isomorph console's Upload package (local, no sign-in; .env files included, node_modules/build output/.git left out; kit apps use deploy)",
     "  isomorph dev --app-root <path> [--reset] [--detach] [--json]  run the app locally on one loopback origin (--reset deletes this app's local data; --detach starts it in the background and prints the origin and pid once it answers)",
     "  isomorph stop --app-root <path>                             stop this app's local services, keeping its database and files",
@@ -150,7 +150,9 @@ else {
                     progress(line);
                 // The SDK is a normal dependency: one plain `npm install` when node_modules lacks it or holds one outside the range init wrote.
                 await installDependencies(target, bundle, runCommand, progress);
-                progress(result.mode === "starter" ? "Starter created. Next: `isomorph dev --app-root <path>`. Both agents read the Isomorph block in CLAUDE.md / AGENTS.md and the `isomorph` skill installed by agent-setup."
+                if (result.dataFiles.length)
+                    progress(keptDataLine(result.dataFiles));
+                progress(result.mode === "starter" ? "Starter created. Next: `isomorph dev --app-root <path>`. Both agents read the Isomorph block in CLAUDE.md / AGENTS.md and the `isomorph` skill installed by agent-setup. The starter page is a placeholder for the app you asked for."
                     : upgrade ? (result.bundleChanges.length ? "Kit bundle upgraded; running checks." : "Kit bundle already current; running checks.")
                         : result.mode === "kit" ? `This folder is already an Isomorph kit app (any missing kit file was added; nothing else was changed). Next: \`isomorph dev --app-root ${root}\`, \`isomorph check --app-root ${root}\`, \`isomorph deploy --app-root ${root}\`.`
                             : "Kit files added; existing files were kept.");
@@ -298,17 +300,21 @@ else {
                     if (!ref)
                         throw new CliError("OPERATION_REQUIRED", "No deployment has been started from this folder yet.", undefined, "Run `isomorph deploy --app-root .`, or pass --operation <reference>.");
                     let summary;
+                    let ai;
                     if (command === "status")
                         summary = wait ? await follow(statusFetch(governance, appId, ref), ref, progress, waitOptions) : summarize(await governance.deploymentStatus(appId, ref));
                     else if (command === "retry")
                         summary = await retryDeployment(governance, appId, ref, progress, { wait: !noWait, waitOptions });
                     else {
                         // Production has its own lane and its own AI mode: the same one-call pre-flight runs for production before promoting.
-                        await assertDeployReady(target, governance, tenant, EMBEDDED_KIT_BUNDLE, "production", progress, await appCallsAi(target));
+                        const callsAi = await appCallsAi(target);
+                        await assertDeployReady(target, governance, tenant, EMBEDDED_KIT_BUNDLE, "production", progress, callsAi);
+                        if (callsAi)
+                            ai = await describeAi(governance, appId, "production", progress);
                         const profile = await readAppProfile(target);
                         summary = await promoteToProduction(governance, appId, ref, { name: profile.name, description: profile.description, audience: profile.audience }, progress, { wait: !noWait, waitOptions, confirmedTested: confirmTested });
                     }
-                    envelope = operationEnvelope(summary, ref, CLI_VERSION);
+                    envelope = operationEnvelope({ ...summary, ...(ai ? { ai } : {}) }, ref, CLI_VERSION);
                 }
                 emit(envelope, line);
             }

package/dist/packages/harbour-cli/src/deploy.js

@@ -124,15 +124,22 @@ async function runDeploy(rootArg, governance, output, tenantId, options) {
         throw error;
     }
     const { operationRef } = opened;
+    // The preflight passed, so a company whose AI setup is not ready has already
+    // been refused; what the builder never heard is the affirmative. Said once, here.
+    const ai = body.callsAi ? await describeAi(governance, appId, "preview", output) : undefined;
     await writeDeployNote(root, { schema: "isomorph.deploy-note/1.0", tenantId, operationRef, sha256: archive.digest });
     if (opened.resumed && note?.sha256 !== archive.digest)
         output(`Isomorph is continuing operation ${operationRef}; no new deployment was started.`);
     output(`Isomorph operation saved. Continue with ${continueCommand(operationRef)}.`);
     // Everything Isomorph checks, fixes and provisions for this version is shown
-    // live in the console; the builder is sent there the moment it starts.
+    // live in the console. The browser is opened only on the app's first deploy
+    // from this folder for this company (no deploy note yet): in an agent's
+    // build loop nearly every deploy is a new operation — any edit, even a re-run
+    // of `check`, changes the package digest — and a tab per operation left a
+    // builder with four in one day. Later deploys print the link only.
     const consoleUrl = consoleOperationUrl(tenantId, appId, operationRef);
     output(`Watch Isomorph check, secure and deploy this app: ${consoleUrl}`);
-    if (!opened.resumed) {
+    if (!opened.resumed && !note) {
         try {
             options.openConsole?.(consoleUrl);
         }
@@ -167,7 +174,7 @@ async function runDeploy(rootArg, governance, output, tenantId, options) {
             }
             output(outcomeLine(summary));
         }
-        return { cliVersion: CLI_VERSION, operationRef, result: { ...summary, consoleUrl } };
+        return { cliVersion: CLI_VERSION, operationRef, result: { ...summary, consoleUrl, ...(ai ? { ai } : {}) } };
     }
     catch (error) {
         throw await operationFailure(fetch, operationRef, error);
@@ -355,6 +362,34 @@ export async function appCallsAi(root) {
     const callsites = report?.gate?.inventory?.aiCallsites;
     return Array.isArray(callsites) && callsites.length > 0;
 }
+/**
+ * One plain line on whether this app's AI calls are real once it is deployed
+ * to the environment, printed for an app that calls governed AI. A builder was
+ * told by their agent that the check "simulated the AI reply" and could not
+ * tell whether AI was integrated (2026-09-26): the check's journey is answered
+ * by a canned reply, `deploy` refused a company without AI (`AI_NOT_READY`)
+ * but said nothing when the setup was fine. Grounded in governance's readiness
+ * route, which answers the same question the preflight asked and its
+ * `plainEnglish` when the answer is no. The readiness call is best-effort: a
+ * platform without the route, or a transport fault, falls back to what the
+ * passed preflight already established, and says that it is inferred.
+ */
+export async function describeAi(governance, appId, environment, output) {
+    const link = environment === "preview" ? "the preview link" : "the production link";
+    let readiness;
+    try {
+        readiness = await governance.aiReadiness(appId, environment);
+    }
+    catch {
+        readiness = undefined;
+    }
+    if (readiness && !readiness.ready) {
+        output(`AI: not enabled for this company's ${environment} apps — ${readiness.plainEnglish}`);
+        return { enabled: false, environment, reason: readiness.plainEnglish };
+    }
+    output(`AI: enabled for this company's ${environment} apps${readiness ? "" : " (inferred: the deploy pre-flight passed)"} — this app's AI calls are real from ${link}.`);
+    return { enabled: true, environment };
+}
 /** The three values as the command prints them before it starts. */
 export function describeProfile(profile) {
     return [`App name: ${profile.name}`, `Description: ${profile.description || "(none yet)"}`, `Audience: ${profile.audience.length ? profile.audience.join(", ") : "only you"}`];

package/dist/packages/harbour-cli/src/guide.js

@@ -88,7 +88,7 @@ AI goes through \`isomorph.ai\` only: one \`isomorph.ai.chat({ messages, maxToke
 const reply = await isomorph.ai.chat({ messages: [{ role: "user", content: \`Summarise these notes in three lines:\\n\${notes.map(n => n.title).join("\\n")}\` }], maxTokens: 200 });
 \`\`\`
 
-The starter calls no AI; add the one call when the person asks. The check's generated ai journey makes a real governed call locally through the development route with your \`isomorph login\`; in the pipeline it is answered by a canned completion and reported as not tested.`,
+The starter calls no AI; add the one call when the person asks. The check's generated ai journey is answered by a canned reply everywhere (locally and in the pipeline): it proves the call shape, never a model. Real AI runs from the app under \`isomorph dev\` and from the preview link.`,
     jobs: `# Scheduled jobs
 
 Jobs run as the app. Gmail and user-mode Slack require the current owner's connected account, an approved integration grant and explicit background permission in each environment. App-mode Slack needs no personal background consent.

package/dist/packages/harbour-cli/src/integrations.js

@@ -47,6 +47,10 @@ export class GovernanceClient {
     deployPreflight(appId, body) {
         return this.call("POST", `/v1/development/apps/${encodeURIComponent(appId)}/deploy-preflight`, body);
     }
+    /** Read-only: would the company's AI setup let this app's deployment PLAN pass for the environment? The same seam the deploy preflight asks beside the other blockers; `deploy` and `promote` read it to say in plain words whether the app's AI calls are real once deployed. */
+    aiReadiness(appId, environment) {
+        return this.call("POST", `/v1/development/apps/${encodeURIComponent(appId)}/ai/readiness`, { environment });
+    }
     /**
      * What the building agent says cost it time in Isomorph itself. Never blocks a
      * deployment: the caller discards every failure, and an empty note files nothing.

package/dist/packages/harbour-cli/src/kit-bundle.manifest.js

@@ -1,6 +1,6 @@
 export const PUBLISHED_KIT_BUNDLE = {
     "schema": "isomorph.kit-bundle/1.0",
-    "kitVersion": "0.10.6",
+    "kitVersion": "0.11.1",
     "sdk": {
         "package": "@isomorph.ai/app-sdk",
         "version": "1.4.3",
@@ -8,21 +8,21 @@ export const PUBLISHED_KIT_BUNDLE = {
         "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:56489ae64e0765e0576172c5f0997230a3663cbe033608239de232c11aab0791"
     },
     "images": {
-        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:0b9c97b37eee8fa9cf3b1edac148efd521a4a68ce32f66e821ab3bc72fbe55c1",
-        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:11e88e41b526b3ad7a9a7271ed13bef7c171301e05c55ca5f93c7bffd9523103"
+        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:a22dfa2b2ff5780e0e2ea7e949216c1703123442f8e2d1e519d5a8493bb5a450",
+        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:9ad3a92fed4584bc2b43ebb5819ae729d333f8ed8c9930faabeaf8c0d15924ce"
     },
     "nativeRuntime": {
         "darwinArm64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:5f0cd4de0d4e82817c89857b411ef56d926851d96f64a3bf6ef0ce86317b1933",
-            "sha256": "5f0cd4de0d4e82817c89857b411ef56d926851d96f64a3bf6ef0ce86317b1933"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:f753062e2cf21f52f7010152fbcb1d46d1d4e9cf819c608f0e66afaa39e61cd0",
+            "sha256": "f753062e2cf21f52f7010152fbcb1d46d1d4e9cf819c608f0e66afaa39e61cd0"
         },
         "linuxX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:782d93aafc712f8d7c5994d78f5b282a9a6f43c9b8ff0812f6904034495d584f",
-            "sha256": "782d93aafc712f8d7c5994d78f5b282a9a6f43c9b8ff0812f6904034495d584f"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:1938c28a92fd3fe5054c6b732bc6fe1a6a31728f9a0e416d653db1ef3726317f",
+            "sha256": "1938c28a92fd3fe5054c6b732bc6fe1a6a31728f9a0e416d653db1ef3726317f"
         },
         "windowsX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:ea1b013f842c0a01291f0b6a1241117ebf3f1385e97c0ee447f1e04fa576b7dd",
-            "sha256": "ea1b013f842c0a01291f0b6a1241117ebf3f1385e97c0ee447f1e04fa576b7dd"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:244a255159a0c641875b22aa550622ff5345e5c129c40802d7609bf375245c1b",
+            "sha256": "244a255159a0c641875b22aa550622ff5345e5c129c40802d7609bf375245c1b"
         }
     },
     "brief": {

package/dist/packages/harbour-cli/src/operations.js

@@ -197,11 +197,31 @@ function activity(status) {
         return "deploying the app";
     return saveInFlight(status) ? "saving the app" : "preparing the deployment";
 }
+/**
+ * The deployment as a builder reads it: which of four steps is running and
+ * roughly how long it takes. Keyed by `deployment.status`, the data plane's
+ * version state (`deploymentStatuses` in governance); the control plane's own
+ * phase sentence rides along in parentheses so an agent, and anyone debugging,
+ * still sees the finer phase. A status outside the table — LIVE, FAILED,
+ * WAITING_INPUT, or none at all — keeps the plain line.
+ */
+const DEPLOYMENT_STEPS = [
+    [["QUEUED", "ANALYZING"], "Step 1 of 4: Isomorph is getting a build slot ready, usually under a minute"],
+    [["TRANSFORMING", "VALIDATING", "BUILDING"], "Step 2 of 4: Isomorph is building the app and re-running its checks in the cloud, about 3–5 minutes"],
+    [["VERIFYING"], "Step 3 of 4: Isomorph is setting up the app's database, files and sign-in"],
+    [["GATING"], "Step 4 of 4: final security check, then the preview link switches on"]
+];
+/** One line for a deployment in flight: the builder's step when the status names one, then the server's phase in parentheses. */
+export function deploymentProgressLine(deployment) {
+    const step = DEPLOYMENT_STEPS.find(([statuses]) => statuses.includes(deployment.status ?? ""))?.[1] ?? "Isomorph is deploying the app";
+    return `${step}${deployment.message ? ` (${deployment.message})` : ""}.`;
+}
 /** What the server is doing right now, as one line; printed when it changes. */
 function progressLine(status) {
-    const stage = status.production ?? status.deployment;
-    if (stage)
-        return `Isomorph is ${activity(status)}${stage.message ? ` (${stage.message})` : ""}.`;
+    if (status.production)
+        return `Isomorph is ${activity(status)}${status.production.message ? ` (${status.production.message})` : ""}.`;
+    if (status.deployment)
+        return deploymentProgressLine(status.deployment);
     switch (status.operation?.stage) {
         case "inspection": return "Isomorph is inspecting the app package.";
         case "verification": return "Isomorph is verifying the saved app.";

package/dist/packages/harbour-cli/src/starter.js

@@ -1,51 +1,75 @@
 import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { dirname, extname, join } from "node:path";
 import { bundleDiff, sdkDependencyRange } from "./kit-bundle.js";
 import { agentSetup, MANAGED_END, MANAGED_START, upsertManagedBlock } from "./agent-setup.js";
 import { defaultAppProfile, emptyDeclaration, newKitLock, readKitLock, renderAppProfile, writeKitLock } from "./kit.js";
 import { CliError } from "./output.js";
 export { MANAGED_END, MANAGED_START };
 /**
- * Files and folders that do not make a folder "an app": what an editor, git or an
- * agent leaves in an otherwise empty folder. Anything else is content, and content
- * without a kit lock is an app that was built without the kit.
+ * Files and folders that do not make a folder "an app": what an editor, git, npm or
+ * an agent leaves in an otherwise empty folder.
  */
-const IGNORABLE_ENTRIES = new Set([".git", ".DS_Store", ".gitignore", "README.md", "LICENSE", "CLAUDE.md", "AGENTS.md", ".claude", ".codex", ".vscode", ".idea"]);
-/** The three ways forward for a folder with an app and no kit, as the `APP_EXISTS` refusal carries them (`details.choices`). */
-export function appExistsChoices(dir) {
+const IGNORABLE_ENTRIES = new Set([".git", ".DS_Store", ".gitignore", "README.md", "LICENSE", "CLAUDE.md", "AGENTS.md", ".claude", ".codex", ".vscode", ".idea", "node_modules"]);
+const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".html"]);
+/**
+ * Whether a top-level entry makes the folder "an app that was built without the
+ * kit": a package manifest, a `src/` folder, an index file or a source file. Anything
+ * else (CSVs, JSON, images, notes) is data the starter is created around.
+ */
+function isAppEntry(name) {
+    return name === "package.json" || name === "src" || /^index\./.test(name) || SOURCE_EXTENSIONS.has(extname(name));
+}
+/**
+ * The ways forward for a folder with an app and no kit, as the `APP_EXISTS` refusal
+ * carries them (`details.choices`), in the order they can succeed: `adopt` only when
+ * the app is one the kit can be added to (package.json depends on vite and react),
+ * then a new kit app in a new folder, then the console import of the app as it is.
+ */
+export function appExistsChoices(dir, adoptable) {
     return [
-        { id: "adopt", command: `isomorph init --app-root ${dir} --adopt`, description: "add the kit to this app in place; Vite + React only" },
+        ...(adoptable ? [{ id: "adopt", command: `isomorph init --app-root ${dir} --adopt`, description: "add the kit to this Vite + React app in place" }] : []),
         { id: "new", command: "isomorph init --app-root <new-empty-folder>", description: "start a new kit app in a new empty folder" },
         { id: "package", command: `isomorph package --app-root ${dir}`, description: "package this app as it is for import in the Isomorph console" }
     ];
 }
+/** The one line `init` prints for a starter created around existing data files, so the person and the agent know they are there. */
+export function keptDataLine(dataFiles) {
+    return `Kept ${dataFiles.length} existing file${dataFiles.length === 1 ? "" : "s"} (${dataFiles.join(", ")}); read them from the app.`;
+}
 /**
- * Creates the starter in an empty directory, adds the missing kit files to an
- * existing Vite + React app (`adopt`), or keeps a kit app as it is. A folder
- * with an app and no kit is never adopted silently: the refusal names the
- * three choices and the agent relays them to the person. User files are never
- * overwritten: a path that exists is reported as kept. Instruction files get a
- * managed block that points at the rules, and the user-level agent guide (the
- * rules themselves) is installed so the agents know the kit from any folder.
+ * Creates the starter in an empty directory or one that holds only data (no
+ * package.json, no source: the data stays and is named), adds the missing kit
+ * files to an existing Vite + React app (`adopt`), or keeps a kit app as it is.
+ * A folder with an app and no kit is never adopted silently: the refusal names
+ * the choices that can succeed and the agent relays them to the person. User
+ * files are never overwritten: a path that exists is reported as kept.
+ * Instruction files get a managed block that points at the rules, and the
+ * user-level agent guide (the rules themselves) is installed so the agents know
+ * the kit from any folder.
  */
 export async function initKit(root, bundle, options = {}) {
     await mkdir(root, { recursive: true });
     const existingPackage = await readJson(join(root, "package.json"));
     const previous = await readKitLock(root);
-    const emptyDir = (await readdir(root)).every(name => IGNORABLE_ENTRIES.has(name));
+    const entries = (await readdir(root)).filter(name => !IGNORABLE_ENTRIES.has(name)).sort();
+    const appHere = entries.some(isAppEntry);
+    // No app and no kit here: the starter is created, around whatever data the folder holds.
+    const starter = !previous && !appHere;
     const unsupported = () => new CliError("APP_UNSUPPORTED", "isomorph init supports an empty directory or an existing Vite + React app (package.json must depend on vite and react).", undefined, "Run `isomorph init --app-root <new-empty-folder>` to start a Vite + React app, then move this app's code into it.");
-    if (!emptyDir && !previous && !options.upgrade) {
+    const adoptable = Boolean(existingPackage && isSupportedApp(existingPackage));
+    if (appHere && !previous && !options.upgrade) {
         // Refused before anything is written, here or in the person's home: the choice is theirs.
-        const dir = options.displayRoot ?? root;
-        const choices = appExistsChoices(dir);
+        const choices = appExistsChoices(options.displayRoot ?? root, adoptable);
         if (!options.adopt)
-            throw new CliError("APP_EXISTS", "This folder already has an app and no Isomorph kit.", undefined, "Choose one of the three commands below: add the kit to this app in place (--adopt, Vite + React only), start a new kit app in an empty folder, or package this app as it is for the console import.", undefined, { details: { choices } });
-        if (!existingPackage || !isSupportedApp(existingPackage))
+            throw new CliError("APP_EXISTS", "This folder already has an app and no Isomorph kit.", undefined, adoptable
+                ? "Choose one of the three commands below: add the kit to this app in place (--adopt), start a new kit app in an empty folder, or package this app as it is for the console import."
+                : "Choose one of the two commands below: start a new kit app in an empty folder, or package this app as it is for the console import. --adopt does not apply: it needs a package.json that depends on vite and react.", undefined, { details: { choices } });
+        if (!adoptable)
             throw unsupported();
     }
-    else if (existingPackage && !isSupportedApp(existingPackage))
+    else if (existingPackage && !adoptable)
         throw unsupported();
-    const result = { root, created: [], kept: [], updated: [], mode: options.upgrade ? "upgrade" : previous ? "kit" : emptyDir ? "starter" : "existing", bundleChanges: [], agents: options.env ? await agentSetup(options.env) : { created: [], updated: [], kept: [], removed: [] } };
+    const result = { root, created: [], kept: [], updated: [], mode: options.upgrade ? "upgrade" : previous ? "kit" : starter ? "starter" : "existing", bundleChanges: [], dataFiles: starter ? entries : [], agents: options.env ? await agentSetup(options.env) : { created: [], updated: [], kept: [], removed: [] } };
     const write = async (path, content) => {
         const absolute = join(root, path);
         if (await exists(absolute)) {
@@ -58,7 +82,7 @@ export async function initKit(root, bundle, options = {}) {
     };
     // The starter (its source and schema) is created only when there is no app here
     // yet; kit infrastructure is written on every path, including `--upgrade`.
-    const appFiles = emptyDir ? starterFiles(bundle) : {};
+    const appFiles = starter ? starterFiles(bundle) : {};
     for (const [path, content] of Object.entries({ ...appFiles, ...kitFiles(root) }))
         await write(path, content);
     await appendManaged(root, ".gitignore", GITIGNORE_LINES, result, "\n");
@@ -199,12 +223,14 @@ function starterFiles(bundle) {
 /** The starter's README, for the people who open the folder: what it is, the three commands, and where the rules are. Rule text lives in the `isomorph` skill only. */
 export const STARTER_README = `# Isomorph app
 
+The first page — a notes list and a private-files card — is a placeholder the agent replaces with the app you asked for.
+
 Created by \`isomorph init\`: a Vite + React app that runs on Isomorph. Sign-in, data, files and company systems come from the platform through \`@isomorph.ai/app-sdk\`, so the app has no backend of its own.
 
 ## Three commands
 
 - \`isomorph dev --app-root . --detach --json\` — starts the app on this machine with a local database, file store and gateway; open the printed link.
-- \`isomorph check --app-root . --json\` — the same gates the deployment pipeline runs (types, build, schema, journeys); the output is the report.
+- \`isomorph check --app-root . --json\` — the same gates the deployment pipeline runs (types, build, schema, journeys).
 - \`isomorph deploy --app-root . --json\` — deploys a private preview for the people named in \`.isomorph/app.json\`; \`isomorph promote\` makes it live for everyone once they have tried it.
 
 ## Where the rules are
@@ -213,7 +239,7 @@ The kit's rules are in the \`isomorph\` skill that \`isomorph agent-setup\` inst
 
 ## Look and feel
 
-\`src/styles.css\` is the whole look: plain CSS, no UI library, light and dark. Change it freely — the starter is a readable floor, not a design.
+\`src/styles.css\` is the whole look: plain CSS, no UI library, light and dark. Change it freely.
 
 \`.isomorph/checks/\` is regenerated on each check and gitignored — put your own checks in \`tests/<name>.mjs\`. \`.isomorph/integrations.json\` is derived by \`isomorph check\` from the app's \`isomorph.integrations.execute\` calls and committed, never edited. \`.isomorph/app.json\` holds the app's name, description and audience.
 `;
@@ -289,8 +315,9 @@ export function App() {
   return (
     <main className="app">
       <header className="app-header">
-        <h1>Isomorph starter</h1>
-        <p className="muted">Signed in as <strong>{user ? user.email : "…"}</strong> (identity from Isomorph; locally the fixture user).</p>
+        <h1>Isomorph starter (placeholder)</h1>
+        <p className="muted">This page is a placeholder; your app replaces it.</p>
+        <p className="muted">Signed in as <strong>{user ? user.email : "…"}</strong> (a test user while running locally).</p>
       </header>
       {error && <p role="alert" className="alert">{error}</p>}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {
@@ -39,7 +39,7 @@
   "harbour": {
     "kitBundle": {
       "repository": "public.ecr.aws/y6t4p3i8/harbour-kit-bundle",
-      "version": "0.10.6"
+      "version": "0.11.1"
     }
   }
 }