@stackbone/cli 0.1.0-alpha.2 → 0.1.0-alpha.3

package/CHANGELOG.md

@@ -7,6 +7,51 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.0-alpha.3] - 2026-05-15
+
+### Added
+
+- `stackbone dev` sessions are now first-class `installation` rows
+  (`kind='local'`). The CLI registers the row via
+  `POST /api/v1/installations/local-dev` during `init`/`link`, `PATCH`es
+  `local_tunnel_url` on dev start, and nulls it on Ctrl-C. The dev
+  boot banner emits a path-aware deeplink
+  (`app.stackbone.ai/app/<orgSlug>/installations/<id>?stackbone-dev=<tunnel>`)
+  consumed in one shot by the `stackboneDevBootstrapGuard` so Studio
+  opens straight on the local installation. Local-dev rows skip the
+  provisioning saga and the tier-quota gate by construction and are
+  garbage-collected after 7 days of inactivity.
+
+### Changed
+
+- Unified agent runtime env contract under `STACKBONE_*`. The dev
+  emulator now injects `STACKBONE_AGENT_ID` (the agent slug) plus
+  `STACKBONE_S3_ACCESS_KEY` / `STACKBONE_S3_SECRET_KEY` /
+  `STACKBONE_S3_ENDPOINT` / `STACKBONE_S3_BUCKET` /
+  `STACKBONE_S3_REGION` / `STACKBONE_POSTGRES_URL` into the agent
+  process, replacing the previous mix of `AWS_*` / `S3_*` /
+  `DATABASE_URL` names. Agents that still read the legacy names must
+  migrate.
+- Emulator `/api/schema` now returns `{ input: null, output: null }`
+  (200) when the manifest declares neither schema or the agent is
+  unreachable — was 502 before. Mirrors the cloud `/studio/schema`
+  shape so the Studio Playground UI can boot before the agent is
+  healthy.
+- `dev/fixtures-store.ts` persists JSONL records using the canonical
+  `Fixture` wire schema (camelCase `createdAt`, typed as `Fixture`) so
+  list/create return the wire type directly.
+
+### Fixed
+
+- `protectedCommand` no longer triggers the device-code flow on the
+  user's behalf. When no valid session exists it fails fast with
+  `code: 'auth'` and the standard "Run stackbone login" hint, and it
+  no longer retries on a mid-flight 401. Reason: the HTTP adapter
+  caches `tokenStore.activeSession()` once per process, so the
+  pre-login `POST /api/auth/device/code` poisoned the cache with
+  `null` and every subsequent request from the same process went out
+  without an Authorization header.
+
 ## [0.1.0-alpha.2] - 2026-05-12
 
 ### Added

package/main.js

@@ -82,6 +82,7 @@ var installationStatusSchema = z.enum([
 	"deprovisioning",
 	"deprovisioned"
 ]);
+var installationKindSchema = z.enum(["cloud", "local"]);
 var installationProviderSchema = z.enum([
 	"neon",
 	"r2",
@@ -109,17 +110,30 @@ z.object({
 	slug: organizationSlugSchema,
 	id: z.uuid()
 });
-z.object({
+var installationResponseSchema = z.object({
 	id: z.uuid(),
 	organizationId: z.uuid(),
 	agentId: z.uuid(),
 	agentVersion: z.string(),
 	status: installationStatusSchema,
+	kind: installationKindSchema.default("cloud"),
+	localTunnelUrl: z.url().nullable().optional(),
+	lastActiveAt: z.iso.datetime().nullable().optional(),
 	config: jsonObject(),
 	createdByUserId: z.uuid(),
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
 });
+z.object({
+	creatorOrganizationSlug: organizationSlugSchema,
+	agentTemplateSlug: z.string().min(1).max(80),
+	endUserOrganizationSlug: organizationSlugSchema.optional()
+});
+z.object({ localTunnelUrl: z.url().nullable() });
+var localDevInstallationResponseSchema = installationResponseSchema.extend({
+	organizationSlug: organizationSlugSchema,
+	agentSlug: z.string().min(1).max(80)
+});
 z.object({
 	id: z.uuid(),
 	installationId: z.uuid(),
@@ -468,6 +482,11 @@ z.object({
 	nextCursor: z.string().nullable(),
 	prevCursor: z.string().nullable()
 });
+z.object({ fxtId: z.uuid() });
+z.object({
+	input: jsonObject().nullable(),
+	output: jsonObject().nullable()
+});
 //#endregion
 //#region ../../libs/validators/src/lib/auth/session.ts
 var sessionUserSchema = z.object({
@@ -931,12 +950,22 @@ var credentialsSchema = z.object({
 * Project-local config is written by `stackbone init`/`link` to
 * `<cwd>/.stackbone/project.json`. Tracks which agent in which organization this
 * directory points at. Excluded from git by the same `.gitignore` patch.
+*
+* Feature 42: `localDevInstallationId` + `organizationSlug` + `agentSlug` are
+* captured at `init`/`link` time so `stackbone dev` can build the path-aware
+* deeplink (`/app/<orgSlug>/installations/<id>?stackbone-dev=…`) and patch
+* the tunnel URL without a separate `GET` round-trip. They are optional so
+* old project.json files continue to load — a future `stackbone dev` against
+* a pre-feature-42 directory simply re-registers the local-dev row.
 */
 var projectConfigSchema = z.object({
 	schemaVersion: z.literal(1),
 	organizationId: z.uuid(),
 	agentId: z.uuid(),
-	controlPlaneUrl: z.url()
+	controlPlaneUrl: z.url(),
+	localDevInstallationId: z.uuid().optional(),
+	organizationSlug: z.string().optional(),
+	agentSlug: z.string().optional()
 });
 /**
 * Project-shared config at `<cwd>/stackbone.config.json` (committable, unlike
@@ -1263,7 +1292,8 @@ var createHttpAdapter = (opts) => {
 	};
 	return {
 		get: (path) => request("GET", path),
-		post: (path, body) => request("POST", path, body)
+		post: (path, body) => request("POST", path, body),
+		patch: (path, body) => request("PATCH", path, body)
 	};
 };
 //#endregion
@@ -1361,7 +1391,6 @@ var flagValue = (argv, flag) => {
 var parseFlags = (argv, env) => ({
 	json: detectJsonMode(argv, env),
 	yes: flagPresent(argv, "-y") || flagPresent(argv, "--yes"),
-	autoLogin: env["STACKBONE_AUTO_LOGIN"] !== "0" && !flagPresent(argv, "--no-auto-login"),
 	apiUrlOverride: flagValue(argv, "--api-url") ?? env["STACKBONE_API_URL"] ?? null,
 	verbose: flagPresent(argv, "--verbose") || env["STACKBONE_VERBOSE"] === "1"
 });
@@ -1422,7 +1451,7 @@ var isVersionFlag = (rawArgs) => rawArgs.length === 1 && VERSION_FLAGS.has(rawAr
 var formatVersionOutput = (input) => `stackbone-cli ${input.cliVersion}\ncontract ${input.contractVersion}`;
 //#endregion
 //#region src/dev/contract.ts
-var STACKBONE_CLI_BUILD_VERSION = "0.1.0-alpha.2";
+var STACKBONE_CLI_BUILD_VERSION = "0.1.0-alpha.3";
 /**
 * Capabilities the local emulator advertises on `GET /api/contract`. Typed as
 * `readonly Capability[]` so the compiler refuses any string outside the
@@ -1743,55 +1772,25 @@ var clearSession = async (ctx) => {
 };
 //#endregion
 //#region src/commands/_shared/protected.ts
-var isAuthError = (err) => isStackboneCliError(err) && err.code === "auth";
-var refuseWithAuthError = () => {
-	throw new StackboneCliError({
-		code: "auth",
-		message: "Not authenticated",
-		suggestion: "Run `stackbone login`"
-	});
-};
-var ensureSession = async (ctx) => {
-	const existing = await getCurrentSession(ctx);
-	if (existing) return existing;
-	if (!ctx.flags.autoLogin) refuseWithAuthError();
-	await runLoginFlow(ctx);
-	return await getCurrentSession(ctx) ?? refuseWithAuthError();
-};
 /**
 * Wraps a command handler so it always receives a non-null `Session`.
 *
-* If the credentials store is empty or the session expired:
-*   - With auto-login enabled (default): runs the device-code flow inline,
-*     reloads the session, and runs the handler.
-*   - With auto-login disabled (`STACKBONE_AUTO_LOGIN=0` or `--no-auto-login`):
-*     refuses immediately with `code: 'auth'` and exit 2.
-*
-* Retries once if the handler itself throws an auth error mid-flight
-* (token expired between the pre-check and the request). If the retry
-* also fails with auth, the corrupt credentials are dropped from disk so
-* the next invocation does not loop through the same broken session.
+* If the credentials store is empty or the session has expired, refuses
+* immediately with `code: 'auth'` (exit 2) and points the user at
+* `stackbone login`. Auth flow and command flow are kept strictly separate
+* — protected commands never trigger the device-code dance on the user's
+* behalf, and a 401 mid-flight propagates as-is so the same `stackbone
+* login` instruction is the only path back.
 */
 var protectedCommand = (handler) => {
 	return async (ctx) => {
-		const session = await ensureSession(ctx);
-		try {
-			await handler(ctx, session);
-		} catch (err) {
-			if (!isAuthError(err) || !ctx.flags.autoLogin) throw err;
-			ctx.logger.debug("auth error mid-flight, retrying after re-login");
-			await runLoginFlow(ctx);
-			const refreshed = await getCurrentSession(ctx) ?? refuseWithAuthError();
-			try {
-				await handler(ctx, refreshed);
-			} catch (retryErr) {
-				if (isAuthError(retryErr)) {
-					ctx.logger.warn("auth still failing after re-login, clearing the stored session");
-					await clearSession(ctx);
-				}
-				throw retryErr;
-			}
-		}
+		const session = await getCurrentSession(ctx);
+		if (!session) throw new StackboneCliError({
+			code: "auth",
+			message: "Not authenticated",
+			suggestion: "Run `stackbone login`"
+		});
+		await handler(ctx, session);
 	};
 };
 //#endregion
@@ -2614,7 +2613,7 @@ var buildMigrateStatusCommand = (ctx) => defineCommand({
 			env: ctx.env,
 			json: ctx.flags.json
 		});
-	})({})
+	})()
 });
 /**
 * Pure handler for `stackbone db migrate add-rag`. Reads `agent.yaml` to
@@ -2702,7 +2701,7 @@ var buildStudioCommand = (ctx) => defineCommand({
 			env: ctx.env,
 			json: ctx.flags.json
 		});
-	})({})
+	})()
 });
 var createDbCommand = (ctx) => defineCommand({
 	meta: {
@@ -2747,7 +2746,6 @@ var createDeployCommand = (ctx) => buildStubCommand(ctx, {
 });
 //#endregion
 //#region src/dev/boot-banner.ts
-var STUDIO_CLOUD_BASE_URL = "https://app.stackbone.ai/app";
 var ANSI = {
 	reset: "\x1B[0m",
 	bold: "\x1B[1m",
@@ -2757,7 +2755,6 @@ var ANSI = {
 };
 var ANSI_RE = /\x1b\[[0-9;]*m/g;
 var visibleLength = (s) => s.replace(ANSI_RE, "").length;
-var buildDeeplink = (tunnelUrl) => `${STUDIO_CLOUD_BASE_URL}?stackbone-dev=${encodeURIComponent(tunnelUrl)}`;
 var LABEL_WIDTH = 11;
 var renderRow = (row, colors) => {
 	const marker = colors && row.marker.trim() ? `${ANSI.cyan}${row.marker}${ANSI.reset}` : row.marker;
@@ -2768,11 +2765,11 @@ var TITLE = "stackbone studio";
 var formatBootBanner = (input) => {
 	const colors = input.colors ?? false;
 	const rows = [];
-	if (input.tunnelUrl) {
+	if (input.deeplink && input.tunnelUrl) {
 		rows.push({
 			marker: "▸",
 			label: "Open Studio",
-			value: buildDeeplink(input.tunnelUrl),
+			value: input.deeplink,
 			primary: true
 		});
 		rows.push({
@@ -2790,6 +2787,23 @@ var formatBootBanner = (input) => {
 			label: "Local",
 			value: input.localUrl
 		});
+	} else if (input.tunnelUrl) {
+		rows.push({
+			marker: "▸",
+			label: "Tunnel",
+			value: input.tunnelUrl,
+			primary: true
+		});
+		rows.push({
+			marker: " ",
+			label: "",
+			value: ""
+		});
+		rows.push({
+			marker: " ",
+			label: "Local",
+			value: input.localUrl
+		});
 	} else rows.push({
 		marker: "▸",
 		label: "Local",
@@ -2973,6 +2987,7 @@ var fetchActiveConfigValue = async (client) => {
 //#region src/dev/connections.ts
 var STACKBONE_ENV_KEYS = {
 	contractVersion: "STACKBONE_CONTRACT_VERSION",
+	agentId: "STACKBONE_AGENT_ID",
 	postgresUrl: "STACKBONE_POSTGRES_URL",
 	queueUrl: "STACKBONE_QUEUE_URL",
 	s3Endpoint: "STACKBONE_S3_ENDPOINT",
@@ -2987,6 +3002,7 @@ var buildAgentEnv = (base, injection, options = {}) => {
 	const env = {
 		...base,
 		[STACKBONE_ENV_KEYS.contractVersion]: String(10),
+		[STACKBONE_ENV_KEYS.agentId]: injection.agentId,
 		[STACKBONE_ENV_KEYS.postgresUrl]: injection.services.postgresUrl,
 		[STACKBONE_ENV_KEYS.queueUrl]: injection.services.queueUrl,
 		[STACKBONE_ENV_KEYS.s3Endpoint]: injection.services.s3Endpoint,
@@ -4142,7 +4158,7 @@ var quoteIdent = (raw) => `"${raw.replace(/"/g, "\"\"")}"`;
 //#region src/dev/fixtures-store.ts
 var defaultFixturesDir = () => resolve(homedir(), ".stackbone", "dev", "fixtures");
 var filenameFor = (baseDir, agentSlug) => resolve(baseDir, `${agentSlug}.jsonl`);
-var isSerializedFixture = (value) => !!value && typeof value === "object" && typeof value.id === "string" && typeof value.name === "string" && typeof value.created_at === "string";
+var isSerializedFixture = (value) => !!value && typeof value === "object" && typeof value.id === "string" && typeof value.name === "string" && typeof value.createdAt === "string";
 var readJsonl = async (path) => {
 	let raw;
 	try {
@@ -4169,7 +4185,7 @@ var createFixturesStore = (opts) => {
 	};
 	return {
 		async list() {
-			return (await readJsonl(path)).sort((a, b) => a.created_at < b.created_at ? 1 : -1);
+			return (await readJsonl(path)).sort((a, b) => a.createdAt < b.createdAt ? 1 : -1);
 		},
 		async create(input) {
 			await ensureDir();
@@ -4179,7 +4195,7 @@ var createFixturesStore = (opts) => {
 				name: input.name,
 				input: input.input,
 				description: input.description ?? null,
-				created_at: (/* @__PURE__ */ new Date()).toISOString()
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			};
 			await appendFile(path, `${JSON.stringify(fixture)}\n`, "utf8");
 			return fixture;
@@ -5426,22 +5442,25 @@ var buildEmulatorApp = (opts) => {
 	app.get("/api/logs/stream", (c) => streamSSE(c, (stream) => {
 		return runLogTail(stream, parseLogFilters(new URL(c.req.url).searchParams), (emit) => tailJsonlDirectory(logsDir, emit));
 	}));
-	const proxyAgentJson = async (path) => {
+	app.get("/api/schema", async (c) => {
 		try {
-			const resp = await fetch(`${agentBaseUrl}${path}`);
-			const body = await resp.text();
-			return new Response(body, {
-				status: resp.status,
-				headers: { "content-type": "application/json" }
+			const resp = await fetch(`${agentBaseUrl}/schema`);
+			if (!resp.ok) return c.json({
+				input: null,
+				output: null
+			});
+			const raw = await resp.json().catch(() => null);
+			return c.json({
+				input: extractSchemaField(raw, "input"),
+				output: extractSchemaField(raw, "output")
 			});
 		} catch {
-			return new Response(JSON.stringify({ error: "agent_unreachable" }), {
-				status: 502,
-				headers: { "content-type": "application/json" }
+			return c.json({
+				input: null,
+				output: null
 			});
 		}
-	};
-	app.get("/api/schema", () => proxyAgentJson("/schema"));
+	});
 	const dbExplorerOptions = { connectionString: opts.injection.services.postgresUrl };
 	app.get("/api/db/schemas", async (c) => {
 		const response = await listSchemas(dbExplorerOptions);
@@ -6044,6 +6063,12 @@ var buildEmulatorApp = (opts) => {
 	}));
 	return app;
 };
+var extractSchemaField = (raw, field) => {
+	if (!raw) return null;
+	const value = raw[field];
+	if (value && typeof value === "object" && !Array.isArray(value)) return value;
+	return null;
+};
 var eventMatchesRunId = (event, runId) => {
 	const data = event.data;
 	if (!data || typeof data["run_id"] === "undefined") return true;
@@ -7176,6 +7201,7 @@ var startDevSession = async (input) => {
 	const bus = createEventBus();
 	const agentPort = await pickFreePort();
 	const injection = {
+		agentId: input.agent.slug,
 		agentPort,
 		services: DEFAULT_DEV_SERVICES
 	};
@@ -7503,6 +7529,24 @@ var startDevSession = async (input) => {
 	}
 };
 //#endregion
+//#region src/services/local-dev-installations.service.ts
+var parse$1 = (raw, context) => {
+	const parsed = localDevInstallationResponseSchema.safeParse(raw);
+	if (!parsed.success) throw new StackboneCliError({
+		code: "generic",
+		message: `Unexpected response shape from ${context}`,
+		cause: parsed.error
+	});
+	return parsed.data;
+};
+var upsertLocalDevInstallation = async (ctx, body) => {
+	return parse$1(await ctx.http.post("/api/v1/installations/local-dev", body), "POST /api/v1/installations/local-dev");
+};
+var patchLocalDevInstallation = async (ctx, id, body) => {
+	const path = `/api/v1/installations/local-dev/${encodeURIComponent(id)}`;
+	return parse$1(await ctx.http.patch(path, body), `PATCH ${path}`);
+};
+//#endregion
 //#region src/commands/dev/print-contract.ts
 var defaultWriteStdout = (chunk) => {
 	process.stdout.write(chunk);
@@ -7599,15 +7643,37 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 			name: agent.name
 		},
 		emulatorPort: flags.port,
-		tunnel: flags.tunnel,
+		tunnel: true,
 		listen: flags.listen,
 		verbose: flags.verbose,
 		...renderStage ? { onStage: renderStage } : {}
 	});
+	const activeOrg = await getActiveOrganization(innerCtx);
+	let localDevId = config.localDevInstallationId;
+	let installationOrgSlug = config.organizationSlug ?? activeOrg.slug;
+	if (!localDevId) {
+		const upserted = await upsertLocalDevInstallation(innerCtx, {
+			creatorOrganizationSlug: activeOrg.slug,
+			agentTemplateSlug: agent.slug
+		});
+		localDevId = upserted.id;
+		installationOrgSlug = upserted.organizationSlug;
+	}
+	if (session.publicUrl) {
+		const patched = await patchLocalDevInstallation(innerCtx, localDevId, { localTunnelUrl: session.publicUrl }).catch((err) => {
+			innerCtx.logger.warn({ err: err.message }, "failed to PATCH local-dev tunnel URL (continuing)");
+			return null;
+		});
+		if (patched) installationOrgSlug = patched.organizationSlug;
+	}
+	const studioBaseUrl = innerCtx.apiUrl.includes("localhost") ? "http://localhost:4200/app" : "https://app.stackbone.ai/app";
+	const deeplink = session.publicUrl ? `${studioBaseUrl}/${installationOrgSlug}/installations/${localDevId}?stackbone-dev=${encodeURIComponent(session.publicUrl)}` : null;
 	if (innerCtx.flags.json) emit(innerCtx.flags, () => "", {
 		emulator_url: session.emulatorUrl,
 		agent_url: session.agentUrl,
 		public_url: session.publicUrl,
+		deeplink,
+		local_dev_installation_id: localDevId,
 		services: {
 			postgres_url: session.injection.services.postgresUrl,
 			queue_url: session.injection.services.queueUrl,
@@ -7619,6 +7685,7 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 		const inlineLines = formatBootBanner({
 			tunnelUrl: session.publicUrl,
 			localUrl: session.emulatorUrl,
+			deeplink,
 			contractVersion: 10,
 			capabilityCount: EMULATOR_CAPABILITIES.length,
 			agentName: agent.name,
@@ -7630,7 +7697,13 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 		log.step("Press Ctrl-C to stop");
 	}
 	const sigintHandler = () => {
-		session.stop();
+		(async () => {
+			if (localDevId) await patchLocalDevInstallation(innerCtx, localDevId, { localTunnelUrl: null }).catch((err) => {
+				innerCtx.logger.debug({ err: err.message }, "failed to null local-dev tunnel URL on exit (safety net will catch up)");
+				return null;
+			});
+			await session.stop();
+		})();
 	};
 	process.once("SIGINT", sigintHandler);
 	process.once("SIGTERM", sigintHandler);
@@ -7648,12 +7721,6 @@ var createDevCommand = (ctx) => defineCommand({
 			description: `Emulator port. Defaults to ${DEFAULT_EMULATOR_PORT}.`,
 			default: String(DEFAULT_EMULATOR_PORT)
 		},
-		tunnel: {
-			type: "boolean",
-			description: "Open a public tunnel to the emulator (default: on).",
-			negativeDescription: "Skip the public tunnel and serve the emulator only on localhost.",
-			default: true
-		},
 		listen: {
 			type: "boolean",
 			description: "Bind the HTTP server to 0.0.0.0 (reachable from your LAN). Default binds to 127.0.0.1 only.",
@@ -7683,7 +7750,6 @@ var createDevCommand = (ctx) => defineCommand({
 		});
 		await buildHandler$2(ctx, {
 			port,
-			tunnel: Boolean(a.tunnel),
 			listen: Boolean(a.listen),
 			verbose: Boolean(a.verbose)
 		});
@@ -7720,10 +7786,6 @@ several exploratory calls.
 - \`-y, --yes\`
   Skip every confirmation prompt. Required in CI / non-TTY contexts.
 
-- \`--no-auto-login\` (or \`STACKBONE_AUTO_LOGIN=0\`)
-  When a protected command finds no valid session, fail fast with exit
-  code 2 instead of triggering the device-code flow inline.
-
 ## Exit codes
 
 - \`0\` ok
@@ -8016,7 +8078,6 @@ Branch on these instead of parsing stack traces.
 
 - \`STACKBONE_JSON=1\` — same as \`--json\`
 - \`STACKBONE_API_URL\` — same as \`--api-url <url>\`
-- \`STACKBONE_AUTO_LOGIN=0\` — same as \`--no-auto-login\`
 - \`STACKBONE_LOG_LEVEL\` — \`debug\`, \`info\`, \`warn\`, \`error\` (logger goes
   to stderr, never pollutes the JSON payload on stdout)
 
@@ -8161,12 +8222,15 @@ var writeTemplateFiles = async (files, input) => {
 var writeAgentManifest = async (agentName, input) => {
 	await writeFileSafe(join(input.root, "agent.yaml"), renderAgentYaml({ name: agentName }), input.force);
 };
-var writeProjectConfig = async (ctx, agent, input) => {
+var writeProjectConfig = async (ctx, agent, input, extras = {}) => {
 	const config = {
 		schemaVersion: 1,
 		organizationId: agent.organizationId,
 		agentId: agent.id,
-		controlPlaneUrl: ctx.apiUrl
+		controlPlaneUrl: ctx.apiUrl,
+		...extras.localDevInstallationId !== void 0 ? { localDevInstallationId: extras.localDevInstallationId } : {},
+		...extras.organizationSlug !== void 0 ? { organizationSlug: extras.organizationSlug } : {},
+		...extras.agentSlug !== void 0 ? { agentSlug: extras.agentSlug } : {}
 	};
 	await mkdir(join(input.root, ".stackbone"), { recursive: true });
 	await writeFile(join(input.root, ".stackbone", "project.json"), JSON.stringify(config, null, 2));
@@ -8500,7 +8564,7 @@ var resolveInputs = async (ctx, flags, namePositional) => {
 		targetDir
 	};
 };
-var writeProject = async (ctx, resolved, agent, force) => {
+var writeProject = async (ctx, resolved, agent, force, localDev) => {
 	const writeInput = {
 		root: resolved.targetDir,
 		force
@@ -8512,7 +8576,11 @@ var writeProject = async (ctx, resolved, agent, force) => {
 	});
 	await writeTemplateFiles(templateFiles, writeInput);
 	await writeAgentManifest(resolved.agentName, writeInput);
-	const projectConfig = await writeProjectConfig(ctx, agent, writeInput);
+	const projectConfig = await writeProjectConfig(ctx, agent, writeInput, {
+		localDevInstallationId: localDev.id,
+		organizationSlug: localDev.organizationSlug,
+		agentSlug: localDev.agentSlug
+	});
 	await ensureGitignore(resolved.targetDir);
 	const skillFiles = await writeSkillFiles(ctx, agent, projectConfig, writeInput);
 	return { filesWritten: [
@@ -8535,13 +8603,22 @@ var buildHandler$1 = (ctx, args) => protectedCommand(async (innerCtx) => {
 	const resolved = await resolveInputs(innerCtx, flags, args.name);
 	await ensureEmptyOrForce(resolved.targetDir, flags.force);
 	if (!innerCtx.flags.json) log.step(`Creating "${resolved.agentName}" (template: ${resolved.templateId})`);
+	const activeOrg = await getActiveOrganization(innerCtx);
 	const agent = await createAgent(innerCtx, {
-		organizationSlug: (await getActiveOrganization(innerCtx)).slug,
+		organizationSlug: activeOrg.slug,
 		name: resolved.agentName,
 		...resolved.agentSlug !== void 0 ? { slug: resolved.agentSlug } : {},
 		...resolved.description !== void 0 ? { description: resolved.description } : {}
 	});
-	const { filesWritten } = await writeProject(innerCtx, resolved, agent, flags.force);
+	const localDev = await upsertLocalDevInstallation(innerCtx, {
+		creatorOrganizationSlug: activeOrg.slug,
+		agentTemplateSlug: agent.slug
+	});
+	const { filesWritten } = await writeProject(innerCtx, resolved, agent, flags.force, {
+		id: localDev.id,
+		organizationSlug: localDev.organizationSlug,
+		agentSlug: localDev.agentSlug
+	});
 	emit(innerCtx.flags, () => "", {
 		agent: {
 			id: agent.id,
@@ -8549,6 +8626,10 @@ var buildHandler$1 = (ctx, args) => protectedCommand(async (innerCtx) => {
 			name: agent.name
 		},
 		organization_id: agent.organizationId,
+		local_dev_installation: {
+			id: localDev.id,
+			organization_slug: localDev.organizationSlug
+		},
 		target_dir: resolved.targetDir,
 		template: resolved.templateId,
 		files_written: filesWritten
@@ -8637,11 +8718,20 @@ var buildHandler = (ctx, args) => protectedCommand(async (innerCtx) => {
 		}
 		chosenSlug = value;
 	}
-	const agent = await getAgentByOwnerAndSlug(innerCtx, (await getActiveOrganization(innerCtx)).slug, chosenSlug);
+	const activeOrg = await getActiveOrganization(innerCtx);
+	const agent = await getAgentByOwnerAndSlug(innerCtx, activeOrg.slug, chosenSlug);
 	if (!innerCtx.flags.json) log.step(`Linking ${targetDir} to ${agent.slug}`);
+	const localDev = await upsertLocalDevInstallation(innerCtx, {
+		creatorOrganizationSlug: activeOrg.slug,
+		agentTemplateSlug: agent.slug
+	});
 	const projectConfig = await writeProjectConfig(innerCtx, agent, {
 		root: targetDir,
 		force: true
+	}, {
+		localDevInstallationId: localDev.id,
+		organizationSlug: localDev.organizationSlug,
+		agentSlug: localDev.agentSlug
 	});
 	await ensureGitignore(targetDir);
 	const skillFiles = await writeSkillFiles(innerCtx, agent, projectConfig, {
@@ -8655,6 +8745,10 @@ var buildHandler = (ctx, args) => protectedCommand(async (innerCtx) => {
 			name: agent.name
 		},
 		organization_id: agent.organizationId,
+		local_dev_installation: {
+			id: localDev.id,
+			organization_slug: localDev.organizationSlug
+		},
 		target_dir: targetDir,
 		files_written: [
 			".stackbone/project.json",
@@ -8883,11 +8977,6 @@ var buildRootCommand = async () => {
 			"api-url": {
 				type: "string",
 				description: "Override the control plane URL."
-			},
-			"no-auto-login": {
-				type: "boolean",
-				description: "Refuse to start the device-code flow when no session exists.",
-				default: false
 			}
 		},
 		subCommands: {

package/migrations/0009_rename_runs_partial_index.sql

@@ -0,0 +1,22 @@
+-- 0004_rename_runs_partial_index.sql — clarify semantics of the is_playground partial index.
+-- ADR: docs/adr/2026-05-14-playground-runs-bill-like-real-invocations.md.
+--
+-- Migration 0003 created the partial index `runs_billable_workspace_started_idx`
+-- on `stackbone_platform.runs (workspace_id, started_at DESC NULLS LAST)
+-- WHERE is_playground = false`. Its name and accompanying comments framed the
+-- predicate as the "billable" set — that framing is wrong.
+--
+-- Playground runs DO bill: invoking from Studio consumes real LLM tokens, real
+-- DB queries and real compute, and the creator's organization is charged for
+-- it like any other invocation (otherwise a malicious client could mark all
+-- production traffic with `X-Stackbone-Playground: 1` and dodge billing). The
+-- predicate `WHERE is_playground = false` actually identifies the rows that
+-- count toward Trust Layer / public marketplace aggregations (p50 latency,
+-- success rate, median cost) — a slow demo run from Studio must not lower
+-- the public stats of an `agent_template`.
+--
+-- This migration renames the index so the next reader gets the semantics
+-- right. The index definition (table, columns, predicate) is unchanged.
+
+ALTER INDEX IF EXISTS stackbone_platform.runs_billable_workspace_started_idx
+  RENAME TO runs_public_metrics_workspace_started_idx;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackbone/cli",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {