@pachca/cli 2026.3.8 → 2026.3.9

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026.3.9  (19 марта 2026)
+
+- **Изменено** (all): Убрана клиентская валидация скоупов — проверка разрешений теперь только на стороне API (403)
+- **Изменено** (auth login): Профиль больше не сохраняет список скоупов — только тип, имя и email
+- **Удалено** (auth refresh): Команда удалена — кеширование скоупов больше не используется
+
 ## 2026.3.8  (17 марта 2026)
 
 - **Добавлено** (upgrade): Команда pachca upgrade — обновление CLI до последней версии

package/dist/base-command.js

@@ -1,5 +1,5 @@
 import { Command, Flags } from '@oclif/core';
-import { resolveToken, TokenNotFoundError, ProfileNotFoundError, getDefaults, getActiveProfile, invalidateScopes, } from './profiles.js';
+import { resolveToken, TokenNotFoundError, ProfileNotFoundError, getDefaults, } from './profiles.js';
 import { ApiError, getExitCode, formatDryRun, request } from './client.js';
 import { outputData, outputError, outputSuccess } from './output.js';
 import { defaultOutputFormat, isInteractive } from './utils.js';
@@ -170,38 +170,6 @@ export class BaseCommand extends Command {
             profile: this.parsedFlags.profile,
         });
     }
-    /**
-     * Check if the current profile has the required scope.
-     * Exits with error if scope is missing.
-     */
-    checkScope(requiredScope) {
-        const { profileName, profile } = this.resolveAuth();
-        if (!profile || !profile.scopes || profile.scopes.length === 0)
-            return;
-        if (!profile.scopes.includes(requiredScope)) {
-            const format = this.getOutputFormat();
-            if (format === 'json' || !process.stderr.isTTY) {
-                outputError({
-                    error: 'Insufficient scope',
-                    code: null,
-                    type: 'PACHCA_SCOPE_ERROR',
-                    profile: profileName,
-                    required_scope: requiredScope,
-                    current_scopes: profile.scopes,
-                }, format);
-            }
-            else {
-                process.stderr.write(`✗ Токен профиля ${profileName} не имеет скоупа ${requiredScope}\n\n`);
-                process.stderr.write(`  Текущие скоупы: ${profile.scopes.join(', ')}\n`);
-                process.stderr.write(`  Требуется:      ${requiredScope}\n\n`);
-                process.stderr.write(`  Используйте другой профиль:\n`);
-                process.stderr.write(`    pachca auth switch <profile>\n`);
-                process.stderr.write(`  Или проверьте актуальные скоупы:\n`);
-                process.stderr.write(`    pachca auth refresh ${profileName}\n`);
-            }
-            this.exit(3);
-        }
-    }
     /**
      * Make an authenticated API request.
      */
@@ -249,16 +217,6 @@ export class BaseCommand extends Command {
      */
     async catch(err) {
         if (err instanceof ApiError) {
-            // Invalidate cached scopes on 403 insufficient_scope
-            if (err.details.code === 403 && err.details.type === 'PACHCA_AUTH_ERROR' && err.details.message === 'insufficient_scope') {
-                const profileName = this.parsedFlags?.profile || process.env.PACHCA_PROFILE || getActiveProfile();
-                if (profileName) {
-                    invalidateScopes(profileName);
-                }
-                err.details.hint = profileName
-                    ? `pachca auth refresh ${profileName}`
-                    : 'pachca auth refresh';
-            }
             outputError(err.details, this.getOutputFormat());
             this.exit(getExitCode(err));
         }

package/dist/commands/auth/list.js

@@ -20,7 +20,6 @@ export default class AuthList extends BaseCommand {
             type: profile.type,
             user: profile.user,
             email: profile.email || null,
-            scopes_count: profile.scopes?.length ?? 0,
             active: name === activeProfile,
         }));
         if (entries.length === 0) {

package/dist/commands/auth/login.js

@@ -99,8 +99,6 @@ export default class AuthLogin extends BaseCommand {
         catch {
             // profile:read scope not available — use user_id from token info
         }
-        // Determine scopes
-        const scopes = tokenInfo.scopes || [];
         const profileType = isBot ? 'bot' : 'user';
         // Save profile
         const profile = {
@@ -108,8 +106,6 @@ export default class AuthLogin extends BaseCommand {
             token,
             user: isBot ? `${userName} (бот)` : userName,
             email: userEmail,
-            scopes,
-            ...(isBot ? { scopes_refreshed_at: new Date().toISOString() } : {}),
         };
         setProfile(profileName, profile);
         // Set as active if no active profile
@@ -123,18 +119,13 @@ export default class AuthLogin extends BaseCommand {
                 type: profileType,
                 user: profile.user,
                 email: userEmail,
-                scopes,
             });
         }
         else if (!flags.quiet) {
             const typeLabel = profileType === 'bot' ? 'bot' : 'user';
             const emailStr = userEmail ? ` (${userEmail})` : '';
             process.stderr.write(`✔ Подключён как: ${profile.user}${emailStr}  [${typeLabel}]\n`);
-            process.stderr.write(`  Скоупы (${scopes.length}): ${scopes.join(' ')}\n`);
             process.stderr.write(`  Профиль сохранён [${profileName}]\n`);
-            if (isBot) {
-                process.stderr.write(`  ℹ Скоупы бота обновляются автоматически раз в сутки (синхронно при запуске команды)\n`);
-            }
         }
     }
 }

package/dist/commands/auth/status.js

@@ -30,21 +30,11 @@ export default class AuthStatus extends BaseCommand {
                 type: profile.type,
                 user: profile.user,
                 email: profile.email || null,
-                scopes: profile.scopes || [],
             });
         }
         else {
             const emailStr = profile.email ? ` (${profile.email})` : '';
             process.stderr.write(`  Подключён как: ${profile.user}${emailStr}  [${profile.type}, profile: ${profileName}]\n`);
-            if (profile.scopes?.length) {
-                process.stderr.write(`  Скоупы:\n`);
-                // Print scopes in rows of 3
-                const scopes = profile.scopes;
-                for (let i = 0; i < scopes.length; i += 3) {
-                    const row = scopes.slice(i, i + 3).map((s) => s.padEnd(20)).join(' ');
-                    process.stderr.write(`    ${row}\n`);
-                }
-            }
         }
     }
 }

package/dist/commands/bots/list-events.js

@@ -27,7 +27,6 @@ export default class BotsListEvents extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(BotsListEvents);
         this.parsedFlags = flags;
-        this.checkScope("webhooks:events:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/bots/remove-event.js

@@ -36,7 +36,6 @@ export default class BotsRemoveEvent extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("webhooks:events:delete");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/webhooks/events/${args.id}`,

package/dist/commands/bots/update.js

@@ -53,7 +53,6 @@ export default class BotsUpdate extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --webhook <string>. pachca introspect bots update" });
             }
         }
-        this.checkScope("bots:write");
         const body = { bot: {
                 webhook: flags['webhook'] ? this.parseJSON(flags['webhook'], 'webhook') : undefined,
             } };

package/dist/commands/chats/archive.js

@@ -22,7 +22,6 @@ export default class ChatsArchive extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ChatsArchive);
         this.parsedFlags = flags;
-        this.checkScope("chats:archive");
         const { data } = await this.apiRequest({
             method: 'PUT',
             path: `/chats/${args.id}/archive`,

package/dist/commands/chats/create.js

@@ -64,7 +64,6 @@ export default class ChatsCreate extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --name <string>. pachca introspect chats create" });
             }
         }
-        this.checkScope("chats:create");
         const body = { chat: {
                 name: flags['name'],
                 member_ids: flags['member-ids'] ? this.parseJSON(flags['member-ids'], 'member-ids') : undefined,

package/dist/commands/chats/get.js

@@ -22,7 +22,6 @@ export default class ChatsGet extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ChatsGet);
         this.parsedFlags = flags;
-        this.checkScope("chats:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: `/chats/${args.id}`,

package/dist/commands/chats/list.js

@@ -48,7 +48,6 @@ export default class ChatsList extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ChatsList);
         this.parsedFlags = flags;
-        this.checkScope("chats:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/chats/unarchive.js

@@ -21,7 +21,6 @@ export default class ChatsUnarchive extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ChatsUnarchive);
         this.parsedFlags = flags;
-        this.checkScope("chats:archive");
         const { data } = await this.apiRequest({
             method: 'PUT',
             path: `/chats/${args.id}/unarchive`,

package/dist/commands/chats/update.js

@@ -29,7 +29,6 @@ export default class ChatsUpdate extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ChatsUpdate);
         this.parsedFlags = flags;
-        this.checkScope("chats:update");
         const body = { chat: {
                 name: flags['name'],
                 public: flags['public'],

package/dist/commands/commands.js

@@ -39,20 +39,13 @@ export default class Commands extends BaseCommand {
             this.output(commandList.map(({ command, summary }) => ({ command, summary })));
             return;
         }
-        // --available: check token scopes
+        // --available: check token scopes via API
         let tokenScopes = [];
         try {
-            const { token, profile } = resolveToken({ token: flags.token, profile: flags.profile });
-            // Use cached scopes if available
-            if (profile?.scopes) {
-                tokenScopes = profile.scopes;
-            }
-            else {
-                // Fetch from API
-                const response = await request({ method: 'GET', path: '/oauth/token/info', token }, { quiet: true });
-                const wrapper = response.data;
-                tokenScopes = wrapper.data.scopes || [];
-            }
+            const { token } = resolveToken({ token: flags.token, profile: flags.profile });
+            const response = await request({ method: 'GET', path: '/oauth/token/info', token }, { quiet: true });
+            const wrapper = response.data;
+            tokenScopes = wrapper.data.scopes || [];
         }
         catch (error) {
             if (error instanceof TokenNotFoundError) {

package/dist/commands/common/custom-properties.js

@@ -49,7 +49,6 @@ export default class CommonCustomProperties extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --entity-type <string>. pachca introspect common custom-properties" });
             }
         }
-        this.checkScope("custom_properties:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: '/custom_properties',

package/dist/commands/common/get-exports.js

@@ -27,7 +27,6 @@ export default class CommonGetExports extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(CommonGetExports);
         this.parsedFlags = flags;
-        this.checkScope("chat_exports:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: `/chats/exports/${args.id}`,

package/dist/commands/common/request-export.js

@@ -63,7 +63,6 @@ export default class CommonRequestExport extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --start-at <string>, --end-at <string>, --webhook-url <string>. pachca introspect common request-export" });
             }
         }
-        this.checkScope("chat_exports:write");
         const body = {
             start_at: flags['start-at'],
             end_at: flags['end-at'],

package/dist/commands/common/uploads.js

@@ -15,7 +15,6 @@ export default class CommonUploads extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(CommonUploads);
         this.parsedFlags = flags;
-        this.checkScope("uploads:write");
         const { data } = await this.apiRequest({
             method: 'POST',
             path: '/uploads',

package/dist/commands/group-tags/create.js

@@ -49,7 +49,6 @@ export default class GroupTagsCreate extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --name <string>. pachca introspect group-tags create" });
             }
         }
-        this.checkScope("group_tags:write");
         const body = { group_tag: {
                 name: flags['name'],
             } };

package/dist/commands/group-tags/delete.js

@@ -33,7 +33,6 @@ export default class GroupTagsDelete extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("group_tags:write");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/group_tags/${args.id}`,

package/dist/commands/group-tags/get.js

@@ -19,7 +19,6 @@ export default class GroupTagsGet extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(GroupTagsGet);
         this.parsedFlags = flags;
-        this.checkScope("group_tags:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: `/group_tags/${args.id}`,

package/dist/commands/group-tags/list-users.js

@@ -32,7 +32,6 @@ export default class GroupTagsListUsers extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(GroupTagsListUsers);
         this.parsedFlags = flags;
-        this.checkScope("group_tags:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/group-tags/list.js

@@ -31,7 +31,6 @@ export default class GroupTagsList extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(GroupTagsList);
         this.parsedFlags = flags;
-        this.checkScope("group_tags:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/group-tags/update.js

@@ -50,7 +50,6 @@ export default class GroupTagsUpdate extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --name <string>. pachca introspect group-tags update" });
             }
         }
-        this.checkScope("group_tags:write");
         const body = { group_tag: {
                 name: flags['name'],
             } };

package/dist/commands/link-previews/add.js

@@ -52,7 +52,6 @@ export default class LinkPreviewsAdd extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --link-previews <string>. pachca introspect link-previews add" });
             }
         }
-        this.checkScope("link_previews:write");
         const body = {
             link_previews: flags['link-previews'] ? this.parseJSON(flags['link-previews'], 'link-previews') : undefined,
         };

package/dist/commands/members/add-group-tags.js

@@ -49,7 +49,6 @@ export default class MembersAddGroupTags extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --group-tag-ids <string>. pachca introspect members add-group-tags" });
             }
         }
-        this.checkScope("chat_members:write");
         const body = {
             group_tag_ids: flags['group-tag-ids'] ? this.parseJSON(flags['group-tag-ids'], 'group-tag-ids') : undefined,
         };

package/dist/commands/members/add.js

@@ -58,7 +58,6 @@ export default class MembersAdd extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --member-ids <string>. pachca introspect members add" });
             }
         }
-        this.checkScope("chat_members:write");
         const body = {
             member_ids: flags['member-ids'] ? this.parseJSON(flags['member-ids'], 'member-ids') : undefined,
             silent: flags['silent'],

package/dist/commands/members/leave.js

@@ -36,7 +36,6 @@ export default class MembersLeave extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("chats:leave");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/chats/${args.id}/leave`,

package/dist/commands/members/list.js

@@ -37,7 +37,6 @@ export default class MembersList extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(MembersList);
         this.parsedFlags = flags;
-        this.checkScope("chat_members:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/members/remove-group-tag.js

@@ -37,7 +37,6 @@ export default class MembersRemoveGroupTag extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("chat_members:write");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/chats/${args.id}/group_tags/${args.tag_id}`,

package/dist/commands/members/remove.js

@@ -41,7 +41,6 @@ export default class MembersRemove extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("chat_members:write");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/chats/${args.id}/members/${args.user_id}`,

package/dist/commands/members/update.js

@@ -57,7 +57,6 @@ export default class MembersUpdate extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --role <string>. pachca introspect members update" });
             }
         }
-        this.checkScope("chat_members:write");
         const body = {
             role: flags['role'],
         };

package/dist/commands/messages/create.js

@@ -98,7 +98,6 @@ export default class MessagesCreate extends BaseCommand {
         if (validationErrors.length > 0) {
             this.validationError(validationErrors);
         }
-        this.checkScope("messages:create");
         const body = { message: {
                 entity_type: flags['entity-type'],
                 entity_id: flags['entity-id'],

package/dist/commands/messages/delete.js

@@ -38,7 +38,6 @@ export default class MessagesDelete extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("messages:delete");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/messages/${args.id}`,

package/dist/commands/messages/get.js

@@ -24,7 +24,6 @@ export default class MessagesGet extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(MessagesGet);
         this.parsedFlags = flags;
-        this.checkScope("messages:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: `/messages/${args.id}`,

package/dist/commands/messages/list.js

@@ -63,7 +63,6 @@ export default class MessagesList extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --chat-id <integer>. pachca introspect messages list" });
             }
         }
-        this.checkScope("messages:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/messages/pin.js

@@ -22,7 +22,6 @@ export default class MessagesPin extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(MessagesPin);
         this.parsedFlags = flags;
-        this.checkScope("pins:write");
         const { data } = await this.apiRequest({
             method: 'POST',
             path: `/messages/${args.id}/pin`,

package/dist/commands/messages/unpin.js

@@ -37,7 +37,6 @@ export default class MessagesUnpin extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("pins:write");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/messages/${args.id}/pin`,

package/dist/commands/messages/update.js

@@ -47,7 +47,6 @@ export default class MessagesUpdate extends BaseCommand {
             }
             flags['content'] = Buffer.concat(chunks).toString('utf-8').trimEnd();
         }
-        this.checkScope("messages:update");
         const body = { message: {
                 content: flags['content'],
                 files: flags['files'] ? this.parseJSON(flags['files'], 'files') : undefined,

package/dist/commands/profile/delete-status.js

@@ -32,7 +32,6 @@ export default class ProfileDeleteStatus extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("profile_status:write");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: '/profile/status',

package/dist/commands/profile/get-status.js

@@ -16,7 +16,6 @@ export default class ProfileGetStatus extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ProfileGetStatus);
         this.parsedFlags = flags;
-        this.checkScope("profile_status:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: '/profile/status',

package/dist/commands/profile/get.js

@@ -16,7 +16,6 @@ export default class ProfileGet extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ProfileGet);
         this.parsedFlags = flags;
-        this.checkScope("profile:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: '/profile',

package/dist/commands/profile/update-status.js

@@ -70,7 +70,6 @@ export default class ProfileUpdateStatus extends BaseCommand {
         if (validationErrors.length > 0) {
             this.validationError(validationErrors);
         }
-        this.checkScope("profile_status:write");
         const body = { status: {
                 emoji: flags['emoji'],
                 title: flags['title'],

package/dist/commands/reactions/add.js

@@ -57,7 +57,6 @@ export default class ReactionsAdd extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --code <string>. pachca introspect reactions add" });
             }
         }
-        this.checkScope("reactions:write");
         const body = {
             code: flags['code'],
             name: flags['name'],

package/dist/commands/reactions/list.js

@@ -33,7 +33,6 @@ export default class ReactionsList extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ReactionsList);
         this.parsedFlags = flags;
-        this.checkScope("reactions:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/reactions/remove.js

@@ -70,7 +70,6 @@ export default class ReactionsRemove extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("reactions:write");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/messages/${args.id}/reactions`,

package/dist/commands/read-member/list-readers.js

@@ -31,7 +31,6 @@ export default class ReadMemberListReaders extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ReadMemberListReaders);
         this.parsedFlags = flags;
-        this.checkScope("messages:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/search/list-chats.js

@@ -53,7 +53,6 @@ export default class SearchListChats extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(SearchListChats);
         this.parsedFlags = flags;
-        this.checkScope("search:chats");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/search/list-messages.js

@@ -50,7 +50,6 @@ export default class SearchListMessages extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(SearchListMessages);
         this.parsedFlags = flags;
-        this.checkScope("search:messages");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/search/list-users.js

@@ -49,7 +49,6 @@ export default class SearchListUsers extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(SearchListUsers);
         this.parsedFlags = flags;
-        this.checkScope("search:users");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/security/list.js

@@ -81,7 +81,6 @@ export default class SecurityList extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --start-time <string>, --end-time <string>. pachca introspect security list" });
             }
         }
-        this.checkScope("audit_events:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/tasks/create.js

@@ -80,7 +80,6 @@ export default class TasksCreate extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --kind <string>. pachca introspect tasks create" });
             }
         }
-        this.checkScope("tasks:create");
         const body = { task: {
                 kind: flags['kind'],
                 content: flags['content'],

package/dist/commands/tasks/delete.js

@@ -38,7 +38,6 @@ export default class TasksDelete extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("tasks:delete");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/tasks/${args.id}`,

package/dist/commands/tasks/get.js

@@ -24,7 +24,6 @@ export default class TasksGet extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(TasksGet);
         this.parsedFlags = flags;
-        this.checkScope("tasks:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: `/tasks/${args.id}`,

package/dist/commands/tasks/list.js

@@ -29,7 +29,6 @@ export default class TasksList extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(TasksList);
         this.parsedFlags = flags;
-        this.checkScope("tasks:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/tasks/update.js

@@ -60,7 +60,6 @@ export default class TasksUpdate extends BaseCommand {
             }
             flags['content'] = Buffer.concat(chunks).toString('utf-8').trimEnd();
         }
-        this.checkScope("tasks:update");
         const body = { task: {
                 kind: flags['kind'],
                 content: flags['content'],

package/dist/commands/threads/add.js

@@ -23,7 +23,6 @@ export default class ThreadsAdd extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ThreadsAdd);
         this.parsedFlags = flags;
-        this.checkScope("threads:create");
         const { data } = await this.apiRequest({
             method: 'POST',
             path: `/messages/${args.id}/thread`,

package/dist/commands/threads/get.js

@@ -19,7 +19,6 @@ export default class ThreadsGet extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(ThreadsGet);
         this.parsedFlags = flags;
-        this.checkScope("threads:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: `/threads/${args.id}`,

package/dist/commands/upload.js

@@ -21,7 +21,6 @@ export default class Upload extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(Upload);
         this.parsedFlags = flags;
-        this.checkScope('uploads:write');
         // Step 1: Get upload params
         const { data: uploadData } = await this.apiRequest({
             method: 'POST',

package/dist/commands/users/create.js

@@ -85,7 +85,6 @@ export default class UsersCreate extends BaseCommand {
                 this.validationError(missingRequired.map((f) => ({ message: `Обязательный флаг --${f.flag} не передан`, flag: f.flag })), { hint: "Обязательные: --email <string>. pachca introspect users create" });
             }
         }
-        this.checkScope("users:create");
         const body = {
             user: {
                 first_name: flags['first-name'],

package/dist/commands/users/delete.js

@@ -38,7 +38,6 @@ export default class UsersDelete extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("users:delete");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/users/${args.id}`,

package/dist/commands/users/get-status.js

@@ -24,7 +24,6 @@ export default class UsersGetStatus extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(UsersGetStatus);
         this.parsedFlags = flags;
-        this.checkScope("user_status:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: `/users/${args.user_id}/status`,

package/dist/commands/users/get.js

@@ -24,7 +24,6 @@ export default class UsersGet extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(UsersGet);
         this.parsedFlags = flags;
-        this.checkScope("users:read");
         const { data } = await this.apiRequest({
             method: 'GET',
             path: `/users/${args.id}`,

package/dist/commands/users/list.js

@@ -32,7 +32,6 @@ export default class UsersList extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(UsersList);
         this.parsedFlags = flags;
-        this.checkScope("users:read");
         if (flags.all) {
             // Auto-pagination
             const allData = [];

package/dist/commands/users/remove-status.js

@@ -38,7 +38,6 @@ export default class UsersRemoveStatus extends BaseCommand {
                 this.exit(0);
             }
         }
-        this.checkScope("user_status:write");
         const { data } = await this.apiRequest({
             method: 'DELETE',
             path: `/users/${args.user_id}/status`,

package/dist/commands/users/update-status.js

@@ -76,7 +76,6 @@ export default class UsersUpdateStatus extends BaseCommand {
         if (validationErrors.length > 0) {
             this.validationError(validationErrors);
         }
-        this.checkScope("user_status:write");
         const body = { status: {
                 emoji: flags['emoji'],
                 title: flags['title'],

package/dist/commands/users/update.js

@@ -58,7 +58,6 @@ export default class UsersUpdate extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(UsersUpdate);
         this.parsedFlags = flags;
-        this.checkScope("users:update");
         const body = { user: {
                 first_name: flags['first-name'],
                 last_name: flags['last-name'],

package/dist/commands/views/open.js

@@ -96,7 +96,6 @@ export default class ViewsOpen extends BaseCommand {
         if (validationErrors.length > 0) {
             this.validationError(validationErrors);
         }
-        this.checkScope("views:write");
         const body = {
             view: {
                 title: flags['title'],

package/dist/data/changelog.json

@@ -1,4 +1,25 @@
 [
+    {
+        "version": "2026.3.9",
+        "date": "19 марта 2026",
+        "changes": [
+            {
+                "type": "~",
+                "command": "all",
+                "description": "Убрана клиентская валидация скоупов — проверка разрешений теперь только на стороне API (403)"
+            },
+            {
+                "type": "~",
+                "command": "auth login",
+                "description": "Профиль больше не сохраняет список скоупов — только тип, имя и email"
+            },
+            {
+                "type": "-",
+                "command": "auth refresh",
+                "description": "Команда удалена — кеширование скоупов больше не используется"
+            }
+        ]
+    },
     {
         "version": "2026.3.8",
         "date": "17 марта 2026",

package/dist/hooks/init.js

@@ -4,8 +4,7 @@ import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import semver from 'semver';
 import ansis from 'ansis';
-import { setProfile, getDefaults, resolveToken, TokenNotFoundError, ProfileNotFoundError, } from '../profiles.js';
-import { request } from '../client.js';
+import { getDefaults, resolveToken, TokenNotFoundError, ProfileNotFoundError, } from '../profiles.js';
 import { outputError } from '../output.js';
 import { defaultOutputFormat, isInteractive } from '../utils.js';
 /**
@@ -131,24 +130,6 @@ const hook = async function (opts) {
     // Verify auth exists
     try {
         const { profileName, profile } = resolveToken({ token: argvToken, profile: argvProfile });
-        // Refresh bot scopes if stale (>24h)
-        if (profileName && profile?.type === 'bot' && profile.scopes_refreshed_at) {
-            const refreshedAt = new Date(profile.scopes_refreshed_at).getTime();
-            const now = Date.now();
-            const twentyFourHours = 24 * 60 * 60 * 1000;
-            if (now - refreshedAt > twentyFourHours) {
-                try {
-                    const response = await request({ method: 'GET', path: '/oauth/token/info', token: profile.token }, { quiet: true });
-                    const wrapper = response.data;
-                    profile.scopes = wrapper.data.scopes || [];
-                    profile.scopes_refreshed_at = new Date().toISOString();
-                    setProfile(profileName, profile);
-                }
-                catch {
-                    // Silently ignore refresh errors — use cached scopes
-                }
-            }
-        }
     }
     catch (error) {
         if (error instanceof TokenNotFoundError) {

package/dist/profiles.js

@@ -171,14 +171,6 @@ export function getConfigFilePermissions() {
     const stat = fs.statSync(configPath);
     return (stat.mode & 0o777).toString(8);
 }
-export function invalidateScopes(profileName) {
-    const config = readConfig();
-    if (config.profiles?.[profileName]) {
-        config.profiles[profileName].scopes = [];
-        config.profiles[profileName].scopes_refreshed_at = undefined;
-        writeConfig(config);
-    }
-}
 export class TokenNotFoundError extends Error {
     constructor() {
         super('Token not found');

package/oclif.manifest.json

@@ -1598,139 +1598,6 @@
         "logout.js"
       ]
     },
-    "auth:refresh": {
-      "aliases": [],
-      "args": {
-        "profile": {
-          "description": "Profile name to refresh",
-          "name": "profile",
-          "required": false
-        }
-      },
-      "description": "Обновление кешированных разрешений профиля",
-      "examples": [
-        "<%= config.bin %> auth refresh bot-support",
-        "<%= config.bin %> auth refresh"
-      ],
-      "flags": {
-        "output": {
-          "char": "o",
-          "description": "Output format: table, json, yaml, csv",
-          "name": "output",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "options": [
-            "table",
-            "json",
-            "yaml",
-            "csv"
-          ],
-          "type": "option"
-        },
-        "columns": {
-          "char": "c",
-          "description": "Columns to display (comma-separated)",
-          "name": "columns",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "no-header": {
-          "description": "Hide table header",
-          "name": "no-header",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "no-truncate": {
-          "description": "Do not truncate values in table",
-          "name": "no-truncate",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "profile": {
-          "char": "p",
-          "description": "Profile to use for this command",
-          "name": "profile",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "token": {
-          "description": "Bearer token for this call (not saved)",
-          "name": "token",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "quiet": {
-          "char": "q",
-          "description": "Suppress output except errors",
-          "name": "quiet",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "no-color": {
-          "description": "Disable color output",
-          "name": "no-color",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "verbose": {
-          "char": "v",
-          "description": "Show HTTP request/response details",
-          "name": "verbose",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "no-input": {
-          "description": "Disable interactive prompts",
-          "name": "no-input",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "dry-run": {
-          "description": "Show HTTP request without sending",
-          "name": "dry-run",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "timeout": {
-          "description": "Request timeout in seconds",
-          "name": "timeout",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "no-retry": {
-          "description": "Disable auto-retry on 429/503",
-          "name": "no-retry",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "json": {
-          "description": "Output as JSON (alias for --output json)",
-          "hidden": true,
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "auth:refresh",
-      "pluginAlias": "@pachca/cli",
-      "pluginName": "@pachca/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": true,
-      "relativePath": [
-        "dist",
-        "commands",
-        "auth",
-        "refresh.js"
-      ]
-    },
     "auth:status": {
       "aliases": [],
       "args": {},
@@ -12705,5 +12572,5 @@
       ]
     }
   },
-  "version": "2026.3.8"
+  "version": "2026.3.9"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pachca/cli",
-  "version": "2026.3.8",
+  "version": "2026.3.9",
   "description": "CLI для Pachca API",
   "type": "module",
   "bin": {

package/dist/commands/auth/refresh.js

@@ -1,67 +0,0 @@
-import { Args } from '@oclif/core';
-import { BaseCommand } from '../../base-command.js';
-import { getActiveProfile, getProfile, setProfile } from '../../profiles.js';
-import { request } from '../../client.js';
-import { outputError } from '../../output.js';
-export default class AuthRefresh extends BaseCommand {
-    static description = 'Обновление кешированных разрешений профиля';
-    static examples = [
-        '<%= config.bin %> auth refresh bot-support',
-        '<%= config.bin %> auth refresh',
-    ];
-    static args = {
-        profile: Args.string({
-            description: 'Profile name to refresh',
-            required: false,
-        }),
-    };
-    static flags = {
-        ...BaseCommand.baseFlags,
-    };
-    async run() {
-        const { args, flags } = await this.parse(AuthRefresh);
-        this.parsedFlags = flags;
-        const profileName = args.profile || flags.profile || process.env.PACHCA_PROFILE || getActiveProfile();
-        const format = this.getOutputFormat();
-        if (!profileName) {
-            outputError({ error: 'No profile specified. Run: pachca auth refresh <profile>', type: 'PACHCA_USAGE_ERROR', code: null }, format);
-            this.exit(2);
-        }
-        const profile = getProfile(profileName);
-        if (!profile) {
-            outputError({ error: `Profile "${profileName}" not found`, type: 'PACHCA_USAGE_ERROR', code: null }, format);
-            this.exit(2);
-        }
-        // Fetch fresh scopes
-        const response = await request({ method: 'GET', path: '/oauth/token/info', token: profile.token }, { quiet: flags.quiet });
-        const wrapper = response.data;
-        const newScopes = wrapper.data.scopes || [];
-        const oldScopes = profile.scopes || [];
-        // Update profile
-        profile.scopes = newScopes;
-        profile.scopes_refreshed_at = new Date().toISOString();
-        setProfile(profileName, profile);
-        // Calculate diff
-        const added = newScopes.filter((s) => !oldScopes.includes(s));
-        const removed = oldScopes.filter((s) => !newScopes.includes(s));
-        if (format === 'json') {
-            this.output({
-                profile: profileName,
-                scopes_before: oldScopes,
-                scopes_after: newScopes,
-                added,
-                removed,
-            });
-        }
-        else if (!flags.quiet) {
-            this.success(`Скоупы обновлены  [${profileName}]`);
-            if (added.length || removed.length) {
-                process.stderr.write(`  Было: ${oldScopes.join(', ')}\n`);
-                process.stderr.write(`  Стало: ${newScopes.join(', ')}`);
-                if (added.length)
-                    process.stderr.write(`  (+${added.length} новых)`);
-                process.stderr.write('\n');
-            }
-        }
-    }
-}