@nodii/dev 0.4.0 → 0.5.0

package/README.md

@@ -12,42 +12,45 @@ Linux only (the launcher is a POSIX shell script).
 nodii-dev login                      # opens the approval page in your browser
 nodii-dev login --no-browser         # prints the link and code instead
 nodii-dev login --scope devops.issues.read,devops.issues.write   # narrower grant
-nodii-dev agent register --name my-agent --service nodii-planning-hub
-
-# Temporary compatibility path:
-printf '%s' "$PLANNING_HUB_HMAC_SECRET" | nodii-dev login --person PERSON_ID --secret-stdin
-nodii-dev login --hmac --person PERSON_ID --from-aws
+nodii-dev agent register --name my-agent
 ```
 
-OAuth is the default: the CLI signs in as the platform tenant's nodii-dev app
-(`NODII_DEV_OAUTH_CLIENT_ID` or `--client-id` overrides the built-in public
-client id). With no `--scope`, auth grants the app's full ceiling: every live
-`devops.*` key except `devops.releases.promote`, which is never granted. Pass
-`--hmac` to keep the interim path. Login uses RFC 8628 and
-opens the verification page on an interactive terminal unless `--no-browser`
-is passed. Refresh tokens are stored only in macOS Keychain or Linux Secret
-Service (`secret-tool`); the CLI refuses plaintext fallback. Access tokens stay
-in memory. OAuth API calls use the platform edge `/devops` route and send the
-registered `x-agent-id`. `logout` revokes the refresh chain before erasing local
+`nodii-dev` talks only to Dev, through the platform edge
+(`https://platform.nucleus-cloud.in/devops/*`), signed in as the platform
+tenant's nodii-dev OAuth app (D1368). There is no other host and no other way
+to sign in. `NODII_DEV_OAUTH_CLIENT_ID` or `--client-id` overrides the built-in
+public client id. With no `--scope`, auth grants the app's full ceiling: every
+live `devops.*` key except `devops.releases.promote`, which is never granted.
+Login uses the RFC 8628 device flow and opens the verification page on an
+interactive terminal unless `--no-browser` is passed. Refresh tokens are
+stored only in macOS Keychain or Linux Secret Service (`secret-tool`); the CLI
+refuses plaintext fallback. Access tokens stay in memory. Every API call goes
+to the edge's `/devops` prefix with the OAuth bearer and the registered
+`x-agent-id`. `logout` revokes the refresh chain before erasing local
 credentials. `--auth-url`, `--edge-url`, and `--tenant-hint` select another real
 deployment.
 
+Upgrading from 0.4.x: the shared-secret login (`login --hmac`, `--person`,
+`--secret-stdin`, `--from-aws`, `--hub-url`) was removed in 0.5.0, and `login`
+refuses those flags. The first command you run after upgrading deletes the old
+config and its stored secret (Keychain item or file) without printing it, then
+asks you to run `nodii-dev login`.
+
 Every command accepts `--json`; without it, output is formatted for humans.
-Hub failures print the hub error code to stderr and exit non-zero.
+Dev failures print Dev's error code to stderr and exit non-zero.
 
 ## Commands
 
 ```text
-nodii-dev login [--no-browser]
-nodii-dev login --hmac --person ID (--secret-stdin | --from-aws)
+nodii-dev login [--no-browser] [--scope KEYS]
 nodii-dev logout
-nodii-dev whoami
+nodii-dev whoami                   # OAuth identity plus the registered agent
 nodii-dev config show
 
 nodii-dev api list [--tag TAG] [--json]
 nodii-dev api OPERATION_ID [--param name=value ...] [--body @file|-|JSON]
 
-nodii-dev agent register --name NAME [--service SERVICE] [--session ID]
+nodii-dev agent register --name NAME [--session ID]   # staff bind the agent to a service on the Dev Agents page
 nodii-dev agent heartbeat
 nodii-dev agents spawn SERVICE [--repo-root DIR]
 nodii-dev agents cowork-tick [--json]
@@ -140,11 +143,11 @@ nodii-dev setup --check            # exit non-zero when it has drifted
 
 `lane start` creates and starts a lane. It infers the repository, branch and
 worktree from git unless overridden, and resolves `--issue` keys to the UUIDs
-required by the hub. Lane keys are passed directly to every lane and Built
+required by Dev. Lane keys are passed directly to every lane and Built
 acknowledgement route. `next` reads the lane's generated
 API steps and prints the exact next `lane step` command. Server refusals,
 including operator-only actions, workflow blocks, lane limits and Built items
-that are not on dev, retain the hub error code/message and exit non-zero.
+that are not on dev, retain Dev's error code/message and exit non-zero.
 
 `setup` installs the Claude Code workflow harness in the current repository.
 It writes `.claude/skills/nodii-build-workflow/SKILL.md`, merges SessionStart,
@@ -152,15 +155,16 @@ Stop and Bash PostToolUse hooks into `.claude/settings.json`, and maintains one
 marked section in an existing `CLAUDE.md` or `AGENTS.md` (creating `CLAUDE.md`
 when neither exists). Existing settings and hooks are preserved. The default
 is a read-only preview; `--yes` applies, and `--check` is suitable for drift
-checks. Setup also checks `whoami` and prints `nodii-dev login` guidance without
-exposing credential details.
+checks. Setup also checks the OAuth login (a token refresh, then the registered
+agent) and prints `nodii-dev login` guidance without exposing credential
+details.
 
-Heartbeat notes are optional and limited by the hub to 500 characters.
+Heartbeat notes are optional and limited by Dev to 500 characters.
 Prioritize and deprioritize require a 1–500 character reason, which the CLI
-sends to the hub. `lane review` records the review gate.
+sends to Dev. `lane review` records the review gate.
 
 The CLI does not duplicate authorization policy. It sends requests and prints
-the hub's refusal unchanged. Stop, Built acknowledgement, and machine
+Dev's refusal unchanged. Stop, Built acknowledgement, and machine
 create/update/coordinator changes require a staff person login. Machine agent
 assignment is for coordinators; lane-limit and repository-grant changes are for
 the target agent's coordinator or staff. Agent registration does not accept
@@ -177,10 +181,12 @@ nodii-dev requests resolve UUID --commit-sha abc1234 --resolution-md "shipped"
 nodii-dev open-questions answer UUID --decision-id D1420
 ```
 
-The first-class resource families cover every live OpenAPI tag: services,
+The CLI bundles Dev's OpenAPI document as the edge routes it (the edge does not
+serve Dev's own document), so `api list` works offline and lists only
+operations the edge exposes. The first-class resource families cover every tag: services,
 feature docs, contracts (gRPC, REST, outbox, sagas, tables), libraries,
 workers, projects, slices, SQL lookups, issues, backlogs, builds, changes,
-deploy reports, runtime, people, agents, inbox/gates, design, runbooks,
+runtime, people, agents, inbox/gates, design, runbooks,
 doctrine and exceptions, changelog, health verdicts, approval kinds,
 notification registry, skills, questions, decisions, drift, requests,
 pipelines, runners, routing, usage, audit, reconciliation, cron, composite
@@ -189,7 +195,7 @@ surfaces, service edges, lanes, swaps, ideas, and terminology. `api list` is the
 
 `figma check` exits `0` when allowed and `3` when denied. The pre-hook permits
 non-Figma tools and allowlisted Figma reads, but defaults to denying every
-Figma write if the file key is absent, the hub cannot be reached, or the lock
+Figma write if the file key is absent, Dev cannot be reached, or the lock
 is denied. It exits `2`, which makes Claude Code block the call. The post-hook
 best-effort logs the write and never blocks. Per D1433, Codex remains read-only
 for Figma; this package does not write to Figma itself.

package/dist/api.js

@@ -1,13 +1,14 @@
 import { readFile } from "node:fs/promises";
 import { stdin } from "node:process";
-import { CliError, encode, hubRawRequest, readConfig } from "./core.js";
+import { CliError, devRawRequest, encode } from "./core.js";
 
 const methods = new Set(["get", "post", "put", "patch", "delete", "head", "options"]);
-export async function loadOpenApi(fetcher = fetch) {
-  const { hubUrl } = await readConfig();
-  const response = await fetcher(`${hubUrl.replace(/\/$/, "")}/openapi.json`, { headers: { accept: "application/json" } });
-  if (!response.ok) throw new CliError("OPENAPI_UNAVAILABLE", `Cannot load OpenAPI: HTTP ${response.status}`);
-  return response.json();
+// The Dev API as the platform edge routes it, bundled with the package (the
+// edge does not serve Dev's own document). Refresh: `npm run openapi:snapshot`.
+let bundled;
+export async function loadOpenApi() {
+  bundled ??= JSON.parse(await readFile(new URL("./devops-openapi.json", import.meta.url), "utf8"));
+  return bundled;
 }
 
 export function operationsFrom(spec) {
@@ -86,13 +87,13 @@ export function flagsToOperation(entry, positional, flags) {
 
 export async function callOperation(entry, params, body) {
   const request = buildOperationRequest(entry, params, body);
-  return hubRawRequest(request.method, request.path, body === undefined ? undefined : JSON.stringify(body));
+  return devRawRequest(request.method, request.path, body === undefined ? undefined : JSON.stringify(body));
 }
 
 export const GROUPS = {
   services: "Services", "feature-docs": "FeatureDocs", contracts: ["GrpcInterfaces", "RestInterfaces", "Outbox", "OutboxTopics", "Sagas", "Tables"],
   sagas: "Sagas", "outbox-topics": ["Outbox", "OutboxTopics"], tables: "Tables", libraries: "Libraries", workers: "Workers",
-  projects: "Projects", issues: "Issues", backlog: "Backlogs", backlogs: "Backlogs", builds: "Delivery", changes: "Delivery", "deploy-reports": "Runtime",
+  projects: "Projects", issues: "Issues", backlog: "Backlogs", backlogs: "Backlogs", builds: "Delivery", changes: "Delivery",
   runtime: "Runtime", people: "People", agents: "Agents", inbox: "Inbox", gate: "Inbox", design: "Design", runbooks: "Runbooks",
   doctrine: ["Doctrine", "DoctrineExceptions"], rulebook: "Doctrine", changelog: "Changelog", "health-verdicts": "HealthVerdicts",
   "approval-kinds": "ApprovalKinds", "notification-registry": "Notification registry", skills: "Skills", "open-questions": "OpenQuestions",
@@ -123,7 +124,7 @@ export const ALIASES = {
   "projects:list": "listServiceProjects", "projects:show": "getProject", "projects:create": "createProject", "projects:update": "updateProject",
   "builds:list": "listBuilds", "builds:show": "getBuild", "builds:report": "reportBuild",
   "changes:list": "listChanges", "changes:show": "getChange", "changes:mark": "markChange",
-  "deploy-reports:report": "reportDeployment", "runtime:list": "listRuntimeInventory", "runtime:show": "getServiceRuntime",
+  "runtime:list": "listRuntimeInventory", "runtime:show": "getServiceRuntime",
   "people:list": "listPeople", "people:show": "getPerson", "agents:list": "listAgents", "agents:show": "getAgent",
   "gate:fleet": "getFleetGate", "gate:service": "getServiceGate", "gate:dry-run": "getGateDryRun",
   "runbooks:list": "listRunbooks", "runbooks:show": "getRunbook", "runbooks:create": "registerRunbook", "runbooks:update": "updateRunbook",