@isomorph.ai/cli 0.2.1 → 0.2.2-rc.1

package/README.md

@@ -50,6 +50,6 @@ Before 0.2.0 the CLI was published as `@fourier-labs/harbour` with the command `
 
 ## Development
 
-Built from the [governance control plane](https://github.com/Fourier-Labs-AI/harbour-governance-control-plane) repository: `npm ci`, `npm run build --prefix packages/harbour-cli`, tests in `tests/cli-kit.test.ts` and `tests/cli-packaging-contract.test.ts`. Releases are tagged `cli-v<version>` (a `-rc.N` candidate first, then the stable tag).
+Built from the [governance control plane](https://github.com/Fourier-Labs-AI/harbour-governance-control-plane) repository: `npm ci`, `npm run build --prefix packages/harbour-cli`, tests in `tests/cli-kit.test.ts` and `tests/cli-packaging-contract.test.ts`. Releases are tagged `cli-v<version>` by the release automation the moment `packages/harbour-cli/package.json` changes on `main`, so bump to a candidate first (`X.Y.Z-rc.1`, published under the `candidate` dist-tag through npm trusted publishing) and promote it with the `CLI release automation` workflow's `candidate` input; a final version on `main` without an accepted candidate is refused by the release job. 0.2.0 and 0.2.1 (the rename) were published by hand from their merge commits before the trusted publisher existed for `@isomorph.ai/cli`, which is why their `cli-v` release runs show red.
 
 Connect with `isomorph connect name@getlokal.com`: the CLI tries `https://platform.isomorph.ai/start/getlokal.json` and validates the profile before saving it. This uses the first domain label as a guess, not a domain registry; subdomains or companies whose tenant name differs should use their company setup link. Only the guessed tenant name is sent, not the email. Company sign-in and access checks still apply.

package/dist/packages/harbour-cli/src/productionise.js

@@ -85,10 +85,16 @@ export async function productionise(rootArg, client, output, tenantId, includePa
     const gate = options.kitGate === false ? undefined : options.kitGate ?? (options.integrations ? { bundle: options.integrations.bundle } : undefined);
     if (gate && !pending?.uploaded)
         await preflightKitGate(root, gate.bundle, output, gate.run);
+    // A `CliError` is Isomorph's own answer (`AUTH_REQUIRED` after two 401s, a
+    // JSON-RPC refusal) and reaches the builder as it is; only a plain Error from
+    // the transport — Isomorph out of reach — is "not started". Reporting a
+    // refused sign-in as unreachable sent an agent down a worse path (2026-09-14).
     try {
         await client.initialize();
     }
-    catch {
+    catch (error) {
+        if (error instanceof CliError)
+            throw error;
         throw new CliError("NOT_STARTED", "Isomorph could not be reached before the operation started.");
     }
     let start;

package/dist/packages/harbour-cli/src/remote-mcp-client.js

@@ -37,6 +37,20 @@ function rpcRefusal(error, status) {
     const code = labelled?.[1] ?? (typeof error.code === "number" ? `ISOMORPH_RPC_${error.code}` : `ISOMORPH_HTTP_${status}`);
     return new CliError(code, (labelled?.[2] ?? text) || `Isomorph refused the request (HTTP ${status}).`);
 }
+/**
+ * A second 401 in a row: the sign-in itself is gone, or this company does not
+ * admit the signed-in account. The server says which in `error_description`
+ * (plain English, no URL or token); an older server sends only the code, and
+ * the fixed sentence stands in. Both fixes are named because the builder cannot
+ * tell the two causes apart: on 2026-09-14 a `productionise` 14 seconds after a
+ * successful `isomorph login` was refused by a company the account was not a
+ * member of, and "run login again" would only have repeated it.
+ */
+async function signInRefused(response) {
+    const body = await response.json().catch(() => undefined);
+    const said = typeof body?.error_description === "string" ? body.error_description.trim() : "";
+    return new CliError("AUTH_REQUIRED", `${said || "Isomorph sign-in expired or was revoked."} Run \`isomorph login\` again, or \`isomorph connect <work-email-or-start-url>\` if this is the wrong company.`);
+}
 async function readRpc(response) {
     try {
         return await response.json();
@@ -76,11 +90,11 @@ export class RemoteMcpClient {
         let response = await this.post(body);
         // A 401 mid-command usually means the stored token was rotated by another
         // process; re-resolve (which reloads the store) and retry once. A second
-        // 401 means the sign-in itself is gone.
+        // 401 is Isomorph refusing the sign-in, and `signInRefused` says why.
         if (response.status === 401)
             response = await this.post(body);
         if (response.status === 401)
-            throw new CliError("AUTH_REQUIRED", "Isomorph sign-in expired or was revoked. Run `isomorph login` again.");
+            throw await signInRefused(response);
         if (!expectResponse)
             return undefined;
         const parsed = await readRpc(response);

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.2.1";
+export const CLI_VERSION = "0.2.2-rc.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.2.1",
+  "version": "0.2.2-rc.1",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {