@isomorph.ai/cli 0.7.0 → 0.7.1

package/dist/packages/harbour-cli/src/cli.js

@@ -6,7 +6,7 @@ import { CLI_VERSION } from "./version.js";
 import { connectedAccount, login, logout, refreshStoredToken } from "./auth.js";
 import { assertCliCurrent, companyLabel, connect, loadConfig, resolveConfig } from "./config.js";
 import { EMBEDDED_KIT_BUNDLE } from "./kit-bundle.js";
-import { appRoot, readAppProfile, readKitLock, requestResourceName } from "./kit.js";
+import { appRoot, assertLockCompany, readAppProfile, readKitLock, requestResourceName } from "./kit.js";
 import { initKit } from "./starter.js";
 import { packageApp } from "./package.js";
 import { agentPaths, agentSetup } from "./agent-setup.js";
@@ -252,7 +252,9 @@ else {
                     // from the folder (the current one unless --app-root says otherwise) and,
                     // without --operation, follow the deployment last started from it.
                     const target = appRoot(root ?? ".");
-                    const appId = (await readKitLock(target))?.appId;
+                    const lock = await readKitLock(target);
+                    assertLockCompany(lock, tenant);
+                    const appId = lock?.appId;
                     if (!appId)
                         throw new CliError("KIT_REQUIRED", `${root ? "That folder" : "The current folder"} is not a deployed Isomorph app: it has no .isomorph/kit.lock.json with an app identity.`, undefined, "Run this from the app's folder, or pass --app-root <path>.");
                     const ref = operationRef ?? (await readDeployNote(target, tenant))?.operationRef;

package/dist/packages/harbour-cli/src/deploy.js

@@ -7,7 +7,7 @@ import { continueCommand, follow, outcomeFor, pickSourceFailure, recordedRefusal
 import { CLI_VERSION } from "./version.js";
 import { assertSafeAppRoot, readAppTree } from "./package.js";
 import { deployBlocked, ensureLinkedApp, kitLockBody } from "./integrations.js";
-import { describeSourceChange, kitPaths, readAppProfile, readDeclaration, readKitLock, sourceDigest } from "./kit.js";
+import { assertLockCompany, describeSourceChange, kitPaths, readAppProfile, readDeclaration, readKitLock, sourceDigest } from "./kit.js";
 import { CHECKS_FAILED_HINT, checksFailedMessage, FLOW_CHECK, readReport, runChecks } from "./check.js";
 import { runCommand } from "./local-runtime.js";
 import { EMBEDDED_KIT_BUNDLE } from "./kit-bundle.js";
@@ -53,6 +53,7 @@ async function runDeploy(rootArg, governance, output, tenantId, options) {
     const lock = await readKitLock(root);
     if (!lock)
         throw new CliError("KIT_REQUIRED", "This folder is not an Isomorph app: it has no .isomorph/kit.lock.json.", undefined, "Run `isomorph init --app-root .` first.");
+    assertLockCompany(lock, tenantId);
     // The three values the person confirmed, printed so the transcript shows what
     // was recorded; recorded on the operation before anything is uploaded.
     const profile = await readAppProfile(root);

package/dist/packages/harbour-cli/src/dev.js

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { createForwarder } from "./forwarder.js";
 import { readKitLock } from "./kit.js";
 import { GovernanceClient, ensureLinkedApp, fileDeclaredRequests, IDENTITY_WORDS, renderGrantGroup } from "./integrations.js";
-import { acquireDevLock, allocatePorts, installDependencies, LocalRuntime, nodePackageCommand, pidAlive, readDevLock, recordDevChildren, releaseDevLock, runCommand } from "./local-runtime.js";
+import { acquireDevLock, allocatePorts, assertMigrationNames, installDependencies, LocalRuntime, nodePackageCommand, pidAlive, readDevLock, recordDevChildren, releaseDevLock, runCommand } from "./local-runtime.js";
 import { kitPaths } from "./kit.js";
 import { CliError, safeError } from "./output.js";
 /**
@@ -40,6 +40,7 @@ export async function startDev(root, options) {
     const run = options.run ?? runCommand;
     const env = options.env ?? process.env;
     const runtime = new LocalRuntime(root, run);
+    await assertMigrationNames(root);
     if (options.reset)
         await runtime.reset(options.output);
     const ports = await allocatePorts();
@@ -161,6 +162,10 @@ export async function detachDev(root, options) {
         const linked = await appId();
         return { origin: running.origin, pid: running.pid, ...(linked ? { appId: linked } : {}) };
     }
+    // Refused here, not in the child: the child's refusal would come back as
+    // "dev stopped before the app answered … read dev.log", one wrap away from
+    // the reason. `--detach` is the shape every agent runs.
+    await assertMigrationNames(root);
     await mkdir(kitPaths(root).local, { recursive: true });
     const logFd = openSync(devLogPath(root), "w");
     let exited;

package/dist/packages/harbour-cli/src/guide.js

@@ -21,7 +21,7 @@ Isomorph SSO signs everyone in: no login forms, browser-trusted roles or public
 
 ## Data
 
-SQL files in \`migrations/\`; applied migrations are frozen after the first deploy (add the next file). Every table: RLS on, one policy; ownership decided in SQL (the gate names any privilege a table still lacks):
+SQL files \`migrations/NNNN_name.sql\` (four digits, lowercase); applied migrations are frozen after the first deploy (add the next file). Every table: RLS on, one policy; ownership decided in SQL (the gate names any privilege a table still lacks):
 
 \`\`\`sql
 ALTER TABLE notes ENABLE ROW LEVEL SECURITY;
@@ -50,7 +50,7 @@ Shared-read, owner-write: the same, plus \`CREATE POLICY posts_read ON posts FOR
 - \`CHECKS_FAILED\`: fix what \`isomorph check\` reports, then rerun.
 - \`DEPLOY_BLOCKED\`, \`INTEGRATIONS_NOT_READY\`, \`AI_NOT_READY\`: IT's step is in the refusal; the app works meanwhile.
 - \`CLI_UPGRADE_REQUIRED\`: \`npm i -g @isomorph.ai/cli\`.
-- \`APP_NOT_FOUND\`: clear \`appId\` and \`tenantId\` in \`.isomorph/kit.lock.json\` to relink.`,
+- \`APP_NOT_FOUND\`: set \`appId\` and \`tenantId\` to \`""\` in \`.isomorph/kit.lock.json\` to relink.`,
     integrations: `# Company systems (Slack, Gmail, warehouse)
 
 ## Call shape

package/dist/packages/harbour-cli/src/kit-bundle.manifest.js

@@ -1,6 +1,6 @@
 export const PUBLISHED_KIT_BUNDLE = {
     "schema": "isomorph.kit-bundle/1.0",
-    "kitVersion": "0.7.0",
+    "kitVersion": "0.7.1",
     "sdk": {
         "package": "@isomorph.ai/app-sdk",
         "version": "1.2.2",
@@ -8,21 +8,21 @@ export const PUBLISHED_KIT_BUNDLE = {
         "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:8953bb7eb6846bcddf48fd5407c098a13c8ad2cf249d702c35b5666d5af0ad53"
     },
     "images": {
-        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:3669ac07c51d5160463ba9985dbdca035b6944ae4ebbaea57ea02eeed83fb8ee",
-        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:67650669576642104b03afd97bd1463d507bc9e1e83fb7314693ce7d3bdfe373"
+        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:9d5510db8396cc27c509047f668b63a85ec3892db83cb658c045b2db2d7bddeb",
+        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:aec4aa7dfc5128e31448f50088f15550846836ec7ef920368ca2d82b31dbf486"
     },
     "nativeRuntime": {
         "darwinArm64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:aa7c6b1da2a51c6c3ff98582ed3f34959a8081c6af005961f0d4737da83402cf",
-            "sha256": "aa7c6b1da2a51c6c3ff98582ed3f34959a8081c6af005961f0d4737da83402cf"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:3f4bbf08b814888f7ff64ff968362a944dfba742668927f04a331f8c4850da21",
+            "sha256": "3f4bbf08b814888f7ff64ff968362a944dfba742668927f04a331f8c4850da21"
         },
         "linuxX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:2c20bb1f3ad39917e6514aef77f1588efb433996079d3e844ef2a2cb28fabde4",
-            "sha256": "2c20bb1f3ad39917e6514aef77f1588efb433996079d3e844ef2a2cb28fabde4"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:eea2faf265666cfe46c168d42b60cd0fc5431b43a72b3f409aa63dab7fee8524",
+            "sha256": "eea2faf265666cfe46c168d42b60cd0fc5431b43a72b3f409aa63dab7fee8524"
         },
         "windowsX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:892199c64f47d1ade017e2f5c78750f0cad01516fd0bd191490a6b79c1af9ff8",
-            "sha256": "892199c64f47d1ade017e2f5c78750f0cad01516fd0bd191490a6b79c1af9ff8"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:3e1876f0ba701b838a707aa45e6cf4620e06f40aa8c855ce2a65437c752c369a",
+            "sha256": "3e1876f0ba701b838a707aa45e6cf4620e06f40aa8c855ce2a65437c752c369a"
         }
     },
     "brief": {

package/dist/packages/harbour-cli/src/kit.js

@@ -46,8 +46,29 @@ export async function readDeclaration(root) {
     return { schema: record.schema, connections };
 }
 export function isKitLock(value) {
+    return kitLockProblem(value) === undefined;
+}
+/**
+ * The first thing wrong with a lock, named, or undefined for a valid one. A
+ * builder told to relink by clearing `appId` and `tenantId` wrote `null`, then
+ * deleted the keys, and got "does not match isomorph.kit-lock/1.0" twice
+ * (bench, 2026-09-16); the refusal now says which field and what it takes.
+ */
+export function kitLockProblem(value) {
     const record = value;
-    return Boolean(record && typeof record === "object" && record.schema === "isomorph.kit-lock/1.0" && typeof record.appId === "string" && typeof record.tenantId === "string" && isKitBundle(record.bundle) && typeof record.createdAt === "string" && typeof record.updatedAt === "string");
+    if (!record || typeof record !== "object")
+        return "it is not a JSON object";
+    if (record.schema !== "isomorph.kit-lock/1.0")
+        return "`schema` must be \"isomorph.kit-lock/1.0\"";
+    for (const field of ["appId", "tenantId"])
+        if (typeof record[field] !== "string")
+            return `\`${field}\` must be a string (\"\" to relink the app, never null or absent)`;
+    if (!isKitBundle(record.bundle))
+        return "`bundle` is not a kit bundle manifest";
+    for (const field of ["createdAt", "updatedAt"])
+        if (typeof record[field] !== "string")
+            return `\`${field}\` must be a string`;
+    return undefined;
 }
 export async function readKitLock(root) {
     let raw;
@@ -64,10 +85,22 @@ export async function readKitLock(root) {
     catch {
         throw new CliError("KIT_LOCK_INVALID", ".isomorph/kit.lock.json is not valid JSON.");
     }
-    if (!isKitLock(parsed))
-        throw new CliError("KIT_LOCK_INVALID", ".isomorph/kit.lock.json does not match isomorph.kit-lock/1.0.");
+    const problem = kitLockProblem(parsed);
+    if (problem !== undefined)
+        throw new CliError("KIT_LOCK_INVALID", `.isomorph/kit.lock.json does not match isomorph.kit-lock/1.0: ${problem}.`, undefined, "Fix that field, or delete the file and run `isomorph init --app-root .` to write a fresh one.");
     return parsed;
 }
+/**
+ * A lock naming another company is refused before any request is made:
+ * governance would answer `APP_NOT_FOUND` for an app it never registered, and
+ * that reads as a lost app when it is a person connected to the wrong one of
+ * their companies (`isomorph connect` lists them as `TENANT_AMBIGUOUS`).
+ */
+export function assertLockCompany(lock, tenantId) {
+    if (!lock?.appId || !lock.tenantId || lock.tenantId === tenantId)
+        return;
+    throw new CliError("APP_NOT_FOUND", `This app is linked to company "${lock.tenantId}" (.isomorph/kit.lock.json), but you are connected to "${tenantId}".`, undefined, `Run \`isomorph connect\` for "${lock.tenantId}" to work on the app there, or set "appId" and "tenantId" to "" in .isomorph/kit.lock.json to link it to "${tenantId}" as a new app.`, undefined, { paths: [".isomorph/kit.lock.json"] });
+}
 export async function writeKitLock(root, lock) {
     const next = { ...lock, updatedAt: new Date().toISOString() };
     await mkdir(dirname(kitPaths(root).lock), { recursive: true });

package/dist/packages/harbour-cli/src/local-runtime.js

@@ -102,6 +102,21 @@ export function nativeGatewayConfig(project, ports, stateDir) {
 async function migrationNames(root) {
     return (await readdir(join(root, "migrations")).catch(() => [])).filter(name => name.endsWith(".sql")).sort();
 }
+/** The kit gate's rule for a migration file name (data plane kit_lane.go migrationNameRE), enforced here so `dev` and `check` agree. */
+const MIGRATION_NAME = /^\d{4}_[a-z0-9][a-z0-9_-]{0,95}\.sql$/;
+/**
+ * Refuses a migration the gate would refuse, before anything starts. `dev`
+ * used to apply `001_init.sql` happily and `check` then refused the same
+ * file (bench 2026-09-16, two imported prototypes): the rule is the gate's,
+ * stated in its words, at the first command that reads the folder.
+ */
+export async function assertMigrationNames(root) {
+    for (const name of await migrationNames(root)) {
+        if (MIGRATION_NAME.test(name))
+            continue;
+        throw new CliError("DEV_FAILED", `migrations/${name} must be a regular file named NNNN_name.sql (four digits, then lowercase letters, digits, _ or -).`, undefined, "Rename the file, then run this again.", undefined, { paths: [`migrations/${name}`] });
+    }
+}
 export function internalDatabaseUrl(user = LOCAL.dbUser) { return `postgresql://${user}:${LOCAL.dbPassword}@127.0.0.1/${LOCAL.database}?sslmode=disable`; }
 function uploadKey(project) { return createHash("sha256").update(`upload-key:${project}`).digest("base64"); }
 // ---- Ports and lock ------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
   "harbour": {
     "kitBundle": {
       "repository": "public.ecr.aws/y6t4p3i8/harbour-kit-bundle",
-      "version": "0.7.0"
+      "version": "0.7.1"
     }
   }
 }