@isomorph.ai/cli 0.3.0 → 0.3.1-rc.1

package/README.md

@@ -36,12 +36,14 @@ isomorph integrations catalog --app-root <path> [--json]   the company's connect
 isomorph integrations request <connection> --app-root <path> [--reason <text>]   one request per connection; IT approves it once for every environment (`isomorph dev` and `isomorph productionise` file it for you)
 isomorph integrations status --app-root <path> [--json]
 isomorph connect <work-email | company-start-url>                 once per company; then isomorph login | logout
-isomorph productionise --app-root <path> [--wait] [--json]  save + preview deployment, prints the protected link
-isomorph status | retry | promote | setup | profile | audience | secrets … --operation <reference>
+isomorph productionise --app-root <path> [--confirm-save] [--json]  save + preview deployment, prints the protected link
+isomorph status | retry | promote | setup | profile | audience | secrets … --operation <reference>   (promote: [--confirm-tested])
 ```
 
 `productionise`, `status --wait`, `retry` and `promote` follow the deployment for up to `--max-wait <seconds>` (default 30 minutes). Past that they exit 0 with `status: "RUNNING"` and the `isomorph status --operation <reference> --wait --max-wait 120 --json` that continues the same deployment — a bounded wait is not a failure, and never a reason to start another deploy.
 
+`productionise` and `promote` each stop for a typed reply — `Approved.` before the app files are copied to the company code system, `Tested.` before the preview is released. `--confirm-save` and `--confirm-tested` give that same reply on the command line when nobody can type it.
+
 `isomorph --help` prints the full usage. Local commands need no company sign-in; integrations and shipping do.
 
 ## Apps set up by the old `harbour` CLI

package/dist/packages/harbour-cli/src/agent-setup.js

@@ -220,8 +220,8 @@ The kit's rules are the files beside this one: \`core.md\` before the first edit
 - "does it work?", and before you report anything as working → open the dev link in your own browser, press the control you built or changed, and read what the app shows. A green \`isomorph check\` is not that proof: fixtures answer AI and company systems, so their refusals appear only when the control is really pressed. Test rendering, navigation, fixtures and approved reads automatically; a Send in development is real: reuse explicit authorization for that bounded test, or ask once if none exists (IT approval alone is not permission to send). If you have no browser, say that the button itself is untested.
 - "I need Slack / Gmail / the warehouse / company data" → read \`integrations.md\` beside this skill first; then, in the same turn, read the catalog, declare only what the app calls, submit the access request yourself, and say READY or PENDING in one line.
 - "summarise", "draft", "explain", "AI" → read \`ai.md\` beside this skill first; then one call behind a control they press.
-- "ship it", "put it online", "let my team try it" → \`isomorph check --app-root . --json\` first, unasked, and fix everything it finds: the same gates run again in the cloud, minutes per attempt. Before sharing or deploying the private preview, show the exact proposed app name, description and audience that will be passed to Isomorph (say "only you" when the audience is empty) and ask for one confirmation or correction covering all three; do not run \`productionise\` until they confirm. Then \`isomorph productionise --app-root . --name "<app name>" --description "<description>" --emails "<comma-separated audience>" --wait --json\` (omit \`--emails\` for "only you"). It records the confirmed setup before uploading or deploying the app, files the access request for each declared connection itself and refuses with \`INTEGRATIONS_NOT_READY\` naming what IT still has to approve, or with \`AI_NOT_READY\` and the one IT step — say that line and nothing more; the app works without them until then. \`result.deployment.protectedUrl\` is the private preview, for them and the confirmed audience after company sign-in. If your tool cuts it off, \`${continueCommand("<ref>")}\` continues the same deployment — never start another one to find out what happened; \`TRANSFORMING\` means building and checking.
-- "make it live for everyone", "go to production" → only after they have tried the preview. Before \`isomorph promote --operation <ref> --json\`, show the exact app name, description and production audience again and ask for one confirmation or correction covering all three; never promote a profile or audience the person has not just seen and confirmed. Report the production link, or that an operator approval is pending.
+- "ship it", "put it online", "let my team try it" → \`isomorph check --app-root . --json\` first, unasked; fix everything it finds: the same gates rerun in the cloud, minutes per attempt. Before sharing or deploying the private preview, show the exact proposed app name, description and audience that will be passed to Isomorph (say "only you" when the audience is empty); ask for one confirmation or correction covering all three; do not run \`productionise\` until they confirm. \`isomorph productionise --app-root . --name "<app name>" --description "<description>" --emails "<comma-separated audience>" --confirm-save --json\` (omit \`--emails\` for "only you"; \`--confirm-save\` is the approval they just gave). It records the confirmed setup before uploading or deploying the app, files the access request for each declared connection itself and refuses with \`INTEGRATIONS_NOT_READY\` naming what IT still has to approve, or \`AI_NOT_READY\` and the one IT step: relay that line only; the app works without them until then. \`result.deployment.protectedUrl\` is the private preview, for them and the confirmed audience after company sign-in. If your tool cuts it off, \`${continueCommand("<ref>")}\` continues the same deployment; never start another one to find out what happened; \`TRANSFORMING\` means building and checking.
+- "make it live for everyone", "go to production" → only after they have tried the preview, which \`--confirm-tested\` states. Before \`isomorph promote --operation <ref> --confirm-tested --json\`, show the exact app name, description and production audience again; ask for one confirmation or correction covering all three; never promote a profile or audience the person has not just seen and confirmed. Report the production link, or that operator approval is pending.
 - "stop it" → \`isomorph stop --app-root .\` (data kept); \`isomorph dev --reset --app-root .\` deletes local data, only when they ask to start over.
 - "every day at 2pm", "run this on a schedule", "send this automatically" → read \`jobs.md\` beside this skill first; then write the job, run it once with \`isomorph jobs run\`, and say the sentence it gives you.
 

package/dist/packages/harbour-cli/src/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { RemoteMcpClient } from "./remote-mcp-client.js";
-import { appCallsAi, productionise } from "./productionise.js";
-import { confirmAudience, confirmProfile, continueCommand, dismissSecret, fetchStatus, follow, getAppSetup, listSecrets, promoteToProduction, readSecretFromStdin, readSecretFromTerminal, retryDeployment, setSecret, summarize } from "./operations.js";
+import { appCallsAi, productionise, SAVE_APPROVAL } from "./productionise.js";
+import { confirmAudience, confirmProfile, continueCommand, dismissSecret, fetchStatus, follow, getAppSetup, listSecrets, promoteToProduction, PROMOTION_CONFIRMATION, readSecretFromStdin, readSecretFromTerminal, retryDeployment, setSecret, summarize } from "./operations.js";
 import { CliError, failureEnvelope, operationEnvelope, renderFailure, renderSummary } from "./output.js";
 import { CLI_VERSION } from "./version.js";
 import { connectedAccount, login, logout, refreshStoredToken } from "./auth.js";
@@ -28,6 +28,9 @@ const profileDescription = optionValue("--description");
 const audienceEmails = optionValue("--emails");
 const personal = args.includes("--personal");
 const valueStdin = args.includes("--value-stdin");
+/** The reply the save and promote prompts would otherwise wait to have typed, for a caller with no terminal. */
+const confirmSave = args.includes("--confirm-save");
+const confirmTested = args.includes("--confirm-tested");
 const subcommand = args[1] && !args[1].startsWith("--") ? args[1] : undefined;
 const wait = args.includes("--wait");
 const reset = args.includes("--reset");
@@ -62,10 +65,10 @@ const usage = [
     "Usage:",
     "  isomorph connect <work-email | company-start-url>",
     "  isomorph login | logout",
-    "  isomorph productionise --app-root <path> [--include <relative-path>]... [--name <text> --description <text> [--emails a@co,b@co]] [--no-wait] [--max-wait <seconds>] [--json]",
+    "  isomorph productionise --app-root <path> [--include <relative-path>]... [--name <text> --description <text> [--emails a@co,b@co]] [--confirm-save] [--no-wait] [--max-wait <seconds>] [--json]",
     "  isomorph status --operation <reference> [--wait] [--max-wait <seconds>] [--json]",
     "  isomorph retry --operation <reference> [--no-wait] [--max-wait <seconds>] [--json]",
-    "  isomorph promote --operation <reference> [--app-root <path>] [--no-wait] [--max-wait <seconds>] [--json]   (--app-root: also confirm the company's AI setup for production when the app calls governed AI)",
+    "  isomorph promote --operation <reference> [--app-root <path>] [--confirm-tested] [--no-wait] [--max-wait <seconds>] [--json]   (--app-root: also confirm the company's AI setup for production when the app calls governed AI)",
     "  isomorph setup --operation <reference> [--json]            what the app still needs (name, audience, secrets)",
     "  isomorph profile --operation <reference> [--name <text>] [--description <text>] [--json]",
     "  isomorph audience --operation <reference> [--emails a@co,b@co] [--json]   (no --emails = only you)",
@@ -83,6 +86,7 @@ const usage = [
     "  isomorph integrations catalog --app-root <path> [--json]   the company's connections as .isomorph/integrations.json names them: identifiers, allowed operations, approved channels/tables/views/mailboxes per environment (no app needed)",
     "Run `isomorph connect <work-email>` once; sign in with `isomorph login` when Isomorph asks.",
     "productionise saves the app, follows its deployment, and prints the protected preview link; promote sends a tested preview to production.",
+    "productionise stops for a typed `Approved.` before it copies the app files to the company code system, and promote for a typed `Tested.` before it releases the preview. --confirm-save and --confirm-tested give that same reply on the command line when nobody can type it; the approval recorded is the one made by whoever ran the command.",
     `--max-wait bounds how long productionise, status --wait, retry and promote follow the deployment (default 30 minutes). When it passes the command exits 0 with status RUNNING, the last known deployment state, and the \`${continueCommand("<reference>")}\` that continues the same deployment: a bounded wait is not a failure and never means start another one.`,
     "For kit apps, productionise first files the access request for every connection in .isomorph/integrations.json (one per connection; IT approves it once for every environment) and exits 2 (INTEGRATIONS_NOT_READY) naming what IT still has to approve, asks governance whether the company's AI setup is ready when the app calls governed AI (exit 2, AI_NOT_READY, with the IT step), then runs the pipeline's kit gate in the local session and refuses (KIT_GATE_FAILED) what CodeBuild would refuse. promote asks the same AI question for production when --app-root names the app.",
     "secrets set reads the value from your terminal with echo off (or from stdin with --value-stdin); it is never printed or passed to any other program.",
@@ -95,6 +99,14 @@ const progress = (message) => { process.stderr.write(`${message}\n`); };
 const summaryEnvelope = (result) => ({ schema: "isomorph.cli-result/1.0", cliVersion: CLI_VERSION, status: "SUCCEEDED", operationStarted: false, result });
 /** `line` is the human form for a command whose result is a sentence, not a summary. */
 const emit = (value, line) => { process.stdout.write(json ? `${JSON.stringify(value)}\n` : line ?? renderSummary(value)); process.exitCode = 0; };
+/**
+ * The command's last bytes, then its exit code. Every non-zero exit goes through
+ * here: `process.exitCode` is not ours alone — a dependency's `beforeExit` hook
+ * overwrites it (see local-runtime.ts) — and `process.exit` on its own truncates
+ * a write still in flight when the stream is a pipe rather than a terminal,
+ * which is how an agent or a CI job reads this CLI. Both writes flush first.
+ */
+const exitAfterWriting = (code, out, err = "") => { process.stderr.write(err, () => process.stdout.write(out, () => process.exit(code))); };
 /** Exit 2, like a usage error: nothing started and the fix is a command the maker runs. */
 const USAGE_REFUSALS = ["INTEGRATIONS_NOT_READY", "AI_NOT_READY", "NOT_A_MEMBER", "TENANT_AMBIGUOUS", "NOT_A_START_LINK", "PLATFORM_UNREACHABLE"];
 if (command === "--version" || command === "version") {
@@ -127,10 +139,7 @@ else if (!["connect", "login", "logout", "productionise", "integrations", ...LOC
     || (command === "integrations" && (!root || !subcommand || !["request", "status", "catalog"].includes(subcommand) || (subcommand === "request" && (!args[2] || args[2].startsWith("--")))))
     || (OPERATION_COMMANDS.includes(command) && !operationRef)
     || (command === "secrets" && (!subcommand || !["list", "set", "dismiss"].includes(subcommand) || (subcommand !== "list" && !secretName)))) {
-    if (optionError)
-        process.stderr.write(`${optionError}\n`);
-    process.stderr.write(usage);
-    process.exit(2);
+    exitAfterWriting(2, "", `${optionError ? `${optionError}\n` : ""}${usage}`);
 }
 else {
     try {
@@ -192,10 +201,8 @@ else {
                     governance = new GovernanceClient(config.apiUrl, token, config.tenantId);
                 }
                 const report = await runChecks(target, { run: runCommand, bundle, output: progress, governance });
-                if (!report.passed) {
-                    process.stdout.write(json ? `${JSON.stringify({ ...summaryEnvelope(report), status: "FAILED", error: { code: "CHECKS_FAILED", message: "One or more checks failed; see .isomorph/local/check-report.json." } })}\n` : "Checks failed; see .isomorph/local/check-report.json.\n");
-                    process.exitCode = 1;
-                }
+                if (!report.passed)
+                    exitAfterWriting(1, json ? `${JSON.stringify({ ...summaryEnvelope(report), status: "FAILED", error: { code: "CHECKS_FAILED", message: "One or more checks failed; see .isomorph/local/check-report.json." } })}\n` : "Checks failed; see .isomorph/local/check-report.json.\n");
                 else
                     emit(summaryEnvelope(report));
             }
@@ -257,7 +264,7 @@ else {
                         ? { displayName: profileName, description: profileDescription, audienceEmails: audienceEmails ? audienceEmails.split(",").map(value => value.trim()).filter(Boolean) : [] }
                         : undefined;
                     await assertKitCurrent(appRoot(root));
-                    const result = await productionise(root, client, progress, tenant, includePaths, { waitForDeployment: !noWait, waitOptions, integrations: { governance: new GovernanceClient(config.apiUrl, token, tenant), bundle: EMBEDDED_KIT_BUNDLE }, ...(confirmedAppSetup ? { confirmedAppSetup } : {}) });
+                    const result = await productionise(root, client, progress, tenant, includePaths, { waitForDeployment: !noWait, waitOptions, integrations: { governance: new GovernanceClient(config.apiUrl, token, tenant), bundle: EMBEDDED_KIT_BUNDLE }, ...(confirmSave ? { readApproval: async () => SAVE_APPROVAL } : {}), ...(confirmedAppSetup ? { confirmedAppSetup } : {}) });
                     envelope = operationEnvelope(result.result, result.operationRef, CLI_VERSION);
                 }
                 else {
@@ -273,7 +280,7 @@ else {
                             if (lock?.appId)
                                 await assertAiReady(lock.appId, "production", new GovernanceClient(config.apiUrl, token, tenant), progress);
                         }
-                        summary = await promoteToProduction(client, operationRef, progress, { wait: !noWait, waitOptions });
+                        summary = await promoteToProduction(client, operationRef, progress, { wait: !noWait, waitOptions, ...(confirmTested ? { readConfirmation: async () => PROMOTION_CONFIRMATION } : {}) });
                     }
                     else if (command === "setup")
                         summary = { setup: await getAppSetup(client, operationRef) };
@@ -295,10 +302,7 @@ else {
     }
     catch (error) {
         const envelope = failureEnvelope(error, CLI_VERSION);
-        process.stderr.write(renderFailure(envelope));
-        if (json || command === "productionise")
-            process.stdout.write(`${JSON.stringify(envelope)}\n`);
-        process.exit(USAGE_REFUSALS.includes(envelope.error?.code ?? "") ? 2 : 1);
+        exitAfterWriting(USAGE_REFUSALS.includes(envelope.error?.code ?? "") ? 2 : 1, json || command === "productionise" ? `${JSON.stringify(envelope)}\n` : "", renderFailure(envelope));
     }
 }
 /** One line per (connection, identity): the three lanes are one approval, so they are read together. */

package/dist/packages/harbour-cli/src/local-runtime.js

@@ -4,7 +4,6 @@ import { copyFile, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promi
 import { createServer } from "node:net";
 import { dirname, join, relative, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
-import EmbeddedPostgres from "embedded-postgres";
 import { kitPaths, projectName } from "./kit.js";
 import { CliError } from "./output.js";
 export function nodePackageCommand(tool, args, platform = process.platform, execPath = process.execPath) {
@@ -209,6 +208,7 @@ export class LocalRuntime {
         const paths = kitPaths(this.root);
         const postgresBinaries = await hydrateEmbeddedPostgres(this.run);
         const postgresMessages = [];
+        const { default: EmbeddedPostgres } = await import("embedded-postgres");
         this.postgres = new EmbeddedPostgres({ databaseDir: join(paths.state, "postgres"), port: this.ports.postgres, user: LOCAL.dbUser, password: LOCAL.dbPassword, persistent: true, onLog: message => postgresMessages.push(String(message).trim()), onError: error => postgresMessages.push(String(error)) });
         try {
             if (!(await readdir(join(paths.state, "postgres")).catch(() => [])).length)

package/dist/packages/harbour-cli/src/operations.js

@@ -250,6 +250,10 @@ export async function retryDeployment(client, operationRef, output, options = {}
         return summarize(await fetchStatus(client, operationRef));
     return follow(client, operationRef, output, options.waitOptions);
 }
+/** What the maker types at the promote prompt. `--confirm-tested` supplies this same literal through
+ * `readConfirmation`, so governance receives the attestation it receives today, byte for byte — the
+ * claim is unchanged, only reachable where no terminal can answer the prompt. */
+export const PROMOTION_CONFIRMATION = "Tested.";
 /**
  * Promotion mirrors the console's "I tested this version" button: the maker
  * must have opened the live preview and say so, and the version they tested
@@ -268,8 +272,8 @@ export async function promoteToProduction(client, operationRef, output, options
     output(`Open the protected preview and test it: ${deployment.protectedUrl}`);
     output("When it works as expected, type Tested. then press Enter to promote it to production.");
     const reply = await (options.readConfirmation ?? readLine)();
-    if (reply !== "Tested.")
-        throw new CliError("PROMOTION_NOT_CONFIRMED", "The production promotion was not confirmed.", operationRef);
+    if (reply !== PROMOTION_CONFIRMATION)
+        throw new CliError("PROMOTION_NOT_CONFIRMED", "The production promotion was not confirmed. Confirm the tested preview with --confirm-tested instead.", operationRef);
     const result = structured(await client.call("isomorph_promote_to_production", {
         operationId: operationRef,
         expectedPreviewVersionId: deployment.versionId,

package/dist/packages/harbour-cli/src/productionise.js

@@ -12,6 +12,9 @@ import { isProhibitedSecretPath } from "../../../src/secret-paths.js";
 import { assertAiReady, assertPreviewIntegrationsReady } from "./integrations.js";
 import { kitPaths, readKitLock, recordKitAppId, sourceDigest } from "./kit.js";
 import { FLOW_CHECK, preflightKitGate, readReport } from "./check.js";
+/** What the maker types at the save prompt; `--confirm-save` supplies this same literal, so the
+ * `isomorph.stage-approval/1.0` attestation governance receives is unchanged, byte for byte. */
+export const SAVE_APPROVAL = "Approved.";
 export async function productionise(rootArg, client, output, tenantId, includePaths = [], options = {}) {
     const root = resolve(rootArg);
     output(`Isomorph is checking ${basename(root)}.`);
@@ -159,9 +162,9 @@ export async function productionise(rootArg, client, output, tenantId, includePa
         let execution = prior?.sourceSave?.status && prior.sourceSave.status !== "AWAITING_APPROVAL" ? { status: prior.sourceSave.status } : await execute(client, operationRef, appId, graph);
         if (execution.status === "APPROVAL_REQUIRED" || execution.approvalRequiredBeforeExternalAction === true) {
             output(`Approval required: Isomorph can copy ${graph.deploymentScope.includedFiles.length} app files to the approved company code system. Nothing will be deployed or released. Type Approved. then press Enter.`);
-            const approval = await readApproval();
-            if (approval !== "Approved.")
-                throw new CliError("APPROVAL_NOT_GRANTED", "The Isomorph save was not approved.", operationRef);
+            const approval = await (options.readApproval ?? readLine)();
+            if (approval !== SAVE_APPROVAL)
+                throw new CliError("APPROVAL_NOT_GRANTED", "The Isomorph save was not approved. Approve copying the app files with --confirm-save instead.", operationRef);
             execution = await execute(client, operationRef, appId, graph, { schema: "isomorph.stage-approval/1.0", step: "save_source_baseline", approved: true, approvedByUser: true, userApprovalText: approval, userVisibleProgress: "Approved.", nextStepSummary: "Isomorph can safely save the app.", dataOrActions: ["Save the app in the company code system."] });
         }
         if (execution.status === "ADMIN_SETUP_REQUIRED")
@@ -437,7 +440,6 @@ function outcomeLine(summary) {
         default: return summary.nextStep ?? "Isomorph saved the app; deployment has not started.";
     }
 }
-const readApproval = readLine;
 /**
  * Whether the app really calls governed AI: the gate's inventory of
  * `isomorph.ai.*` call sites (`.isomorph/local/check-report.json`,

package/dist/packages/harbour-cli/src/starter.js

@@ -421,8 +421,11 @@ export function App() {
       {error && <p role="alert" style={{ color: "crimson" }}>{error}</p>}
 
       {/* Notes — paired with .isomorph/checks/notes-journey.mjs and notes-cross-user.mjs, generated
-          from this section and migrations/0001_notes.sql; replace the table and \`isomorph check\`
-          rewrites both. Rules: core.md in the isomorph skill (data). */}
+          from this section and migrations/0001_notes.sql; \`isomorph check\` rewrites both whenever
+          either one changes. Edit 0001_notes.sql in place only until this app's first deploy: an
+          applied migration is frozen, so after that the schema changes by adding the next
+          migrations/000N_*.sql — never by editing or deleting an applied file, and never by
+          dropping a deployed table. Rules: core.md in the isomorph skill (data). */}
       <section>
         <h2>Notes</h2>
         <form onSubmit={event => { event.preventDefault(); void addNote(); }}>

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.3.0";
+export const CLI_VERSION = "0.3.1-rc.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.3.0",
+  "version": "0.3.1-rc.1",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {