@openwop/cli 1.2.3 → 1.4.0

package/README.md

@@ -10,7 +10,7 @@ The CLI is a host-agnostic **control plane**: every group drives one protocol su
 
 | Area | Groups |
 |---|---|
-| **Setup & health** | `onboard` · `doctor` · `demo` · `health` · `capabilities` · `config` · `completion` · `upgrade` |
+| **Setup & health** | `onboard` · `login` · `logout` · `doctor` · `demo` · `health` · `capabilities` · `config` · `completion` · `upgrade` |
 | **Run lifecycle** | `runs` · `chat` · `interrupts` · `workflows` · `catalog` · `media` |
 | **Agents & orchestration** | `agents` · `roster` · `org-chart` · `kanban` (`boards`) · `workforces` (`fleet`) · `agent-profile` · `agent-packs` · `agent-allowlists` · `agent-ops` · `evals` · `twin` · `reviews` |
 | **Governance & safety** | `approvals` · `governance` (`policy`) · `consent` · `toggles` |
@@ -120,6 +120,7 @@ Or directly: `npm i -g @openwop/cli` (needs Node 22+), then `openwop onboard`.
 openwop --help
 openwop doctor                 # check prerequisites
 openwop onboard                # guided setup (host + provider + key + model)
+openwop login                  # sign this terminal in to an openwop-app host by a code (no key to copy)
 openwop demo start             # boot local backend + frontend (from inside an openwop checkout)
 openwop demo status
 openwop catalog nodes --search ai
@@ -211,18 +212,24 @@ only the returned reference.
 ```bash
 openwop packs search ads                                   # filter the catalog
 openwop packs info community.openwop-team.demo             # metadata + versions
-openwop packs install community.openwop-team.demo@0.1.0    # download + verify
+openwop packs install community.openwop-team.demo@0.1.2    # download + verify (exact pin)
+openwop packs install core.openwop.ai@^1.3.0               # highest unyanked match
 openwop packs publish ./my-pack --key ~/key.pem --key-id me-1
 openwop packs yank community.openwop-team.demo@0.1.0       # local registry edit
 ```
 
 These talk to the signed node-pack registry — a **separate surface** from the host `--base-url`. The default registry is `https://packs.openwop.dev`; override with `--registry-url` or `OPENWOP_REGISTRY_URL`.
 
-- **search** reads `/v1/index.json` and filters the catalog client-side (the dynamic host `/v1/packs/-/search` only knows in-process nodes, not the published catalog).
-- **info** reads `/v1/packs/{name}/index.json`; `--version v` also fetches that version's manifest.
-- **install** downloads `/v1/packs/{name}/-/{version}.tgz`, checks its `sha256` against the manifest `integrity`, and verifies the detached Ed25519 `.sig` against the publisher key at `/keys/{keyId}.pub` (matching `signing.method` — `ed25519` signs the tarball, `manual` signs the in-tarball `pack.json`). Skip verification with `--no-verify`. Artifacts land under `~/.openwop/packs/{name}/{version}/` (override with `--dir`). Yanked versions are refused.
-- **publish** — the reference registry has **no write API** (`writeApi.supported=false`; publish is a GitHub pull request). This command performs the local **packaging + Ed25519 signing** flow (mirrors `scripts/build-pack-tarball.mjs --signed`): it emits a deterministic signed `.tgz`, a 64-byte `.sig`, and a sidecar manifest into `dist/packs/` (override with `--out`), ready to commit and PR. The private key comes from `--key <pem>`, else `~/.openwop-keys/{keyId}.private.pem`; if neither exists an ephemeral key is generated and its public half printed for pre-registration.
-- **yank** edits a **local registry checkout** — flips `"yanked": true` in the version manifest (`--undo` reverses), so the change is ready to commit, rerun `registry/scripts/build-index.mjs`, and PR. Run it from inside the repo.
+Every registry path is resolved through the registry's `/.well-known/openwop-registry.json` `endpoints` map (`spec/v2/core/packs.md` §"The registry tree"). The CLI prefers the v2 tree (`endpoints.v2`). It uses the v1 tree only when the registry names no v2 tree or publishes no discovery document, or when you pass `--tree v1`.
+
+- **search** reads the registry index (`/v2/index.json` on packs.openwop.dev) and filters the catalog client-side. The dynamic host `/v1/packs/-/search` only knows in-process nodes, not the published catalog.
+- **info** reads the pack index. `--version v` also fetches that version's manifest.
+- **install** resolves the version, downloads the tarball, checks its `sha256` against the manifest `integrity`, and verifies the signature. Skip verification with `--no-verify`. Artifacts land under `~/.openwop/packs/{name}/{version}/` (override with `--dir`).
+  - **v2 signature check:** `signing` must be exactly `{ keyId, scheme: "ed25519-canonical-json" }`. The detached 64-byte `.sig` must verify over the in-tarball `pack.json`, which must be RFC 8785 canonical JSON. The key is the registry's `signingKeys[]` entry for `keyId`, and its `permittedNamespaces` must cover the pack name. A key that is no longer `active` still verifies what it signed.
+  - **v1 signature check:** follows `signing.method` (`ed25519` signs the tarball, `manual` signs the in-tarball `pack.json`).
+  - **Lifecycle (RFC 0222):** no version means the latest *unyanked* version. A range (`^1.2.0`, `~1.2.0`, `1.x`, `>=1.0.0 <2.0.0`) means the highest unyanked match. An exact version is a pin and may install a yanked version, with a warning. A deprecated version installs with a warning.
+- **publish** — the reference registry has **no write API** (`writeApi.supported=false`; you publish by opening a pull request against `openwop/openwop-registry`). This command does the local **packaging + Ed25519 signing** step: it writes a deterministic signed `.tgz`, a 64-byte `.sig`, and a sidecar manifest into `dist/packs/` (override with `--out`), ready to commit and PR. By default it writes the v2 signing block `{ keyId, scheme: "ed25519-canonical-json" }`; `--tree v1` writes the legacy block. The private key comes from `--key <pem>`, else `~/.openwop-keys/{keyId}.private.pem`. If neither exists, it generates an ephemeral key and prints its public half for pre-registration.
+- **yank** edits a **local registry checkout**: it flips `"yanked": true` in the version manifest under `registry/v2/` (`--tree v1` for the frozen v1 tree; `--undo` reverses). Then run `registry/scripts/build-index.mjs --tree v2`, commit, and PR. Run it from inside the repo.
 
 ## Messaging & relay
 
@@ -621,7 +628,7 @@ openwop orgs decide --principal user:jo --action runs:read      # exit 0 allowed
 openwop users me security
 openwop vault list
 openwop vault set billing:stripe-key --scope host --value-file ./stripe.key
-openwop developer-keys create --name "CI deploy" --scope runs:write
+openwop developer-keys create --name "CI deploy" --scope runs:create --scope runs:read
 openwop environments promote --from dev                          # exit 3 when queued for approval
 openwop billing portal                                           # a Stripe-hosted URL; no card data
 openwop governance egress-rules set --mode allowlist --host api.stripe.com