@stackbone/cli 0.5.3 → 0.6.0

package/CHANGELOG.md

@@ -7,6 +7,105 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-10-06
+
+### Added
+
+- **A workflow's `export const description` reaches the Catalog.** The build
+  reads it next to `inputSchema`, `outputSchema` and `schedules`, and Studio's
+  Catalog card and entry header show it. No stage carried a workflow description
+  before, so every workflow card was blank. A value that is not a string is
+  ignored with a warning, never a failed build (PLA-1811).
+
+- **`--agent` takes the agent slug.** Every surface that targets an
+  installation resolves `--agent astex-agent` to its installation id, the same
+  slug `agents list` prints first and `agents get` accepts. A slug with no agent
+  behind it says so and points at `agents list`, instead of the control plane's
+  "Internal server error" (PLA-1904).
+
+- **`stackbone runs list --trigger <trigger>`.** Filters runs by what started
+  them, with the same vocabulary `runs get` prints (PLA-1717).
+
+### Changed
+
+- **`stackbone dev` against a control plane on your machine opens no tunnel.**
+  When the control plane URL is loopback (`localhost`, `127.0.0.1`, `[::1]` or
+  a `*.localhost` name), the box registers its own `http://127.0.0.1:<port>`
+  URL on its local-dev installation and Studio's "Open Studio" link pins it.
+  No grant is minted and frpc does not start, so a local stack no longer needs
+  `STACKBONE_TUNNEL_TICKET_SIGNING_KEY`. Stopping the session clears the URL.
+  Any other control plane opens the tunnel as before (PLA-1989). The
+  "`frpc` is not installed" and `tunnel_relay_unhealthy` suggestions now say
+  the tunnel is mandatory against a deployed control plane, not everywhere
+  (PLA-1992).
+
+- **A `stackbone dev` box behind the tunnel requires the identity token.** It
+  used to check no credential, so anyone holding the tunnel URL could reveal
+  secrets, run SQL and decide approvals. The box now verifies the control
+  plane's identity JWT, as a deployed box does, on REST, SSE, the vendor wires
+  (`/agui`, `/openai`, `/anthropic`) and `/mcp`. The CLI mints the token for its
+  own calls to the box (`secrets`, `db`, connector codegen) and Studio sends it
+  to the install's tunnel URL. `/`, `/api/contract` and health stay open.
+  Connector codegen refused with 401 or 403 leaves `connect.d.ts` untouched
+  (PLA-1864, PLA-1868, PLA-1869).
+
+- **Workflow runs record the gate that started them.** A run's `trigger` is now
+  `manual`, `cron`, `event` (with the Connect link in `triggerRef`), `workflow`
+  for a parent workflow's child, or `platform` for the box's own errands, where
+  every workflow run used to read `workflow`. A start no gate stamped reads
+  `unknown`. `runs list` and `runs get` validate the trigger strictly, so a CLI
+  older than this release fails on a box that returns `platform` or `unknown`
+  (PLA-1717).
+
+### Fixed
+
+- **A control plane with no tunnel configured says so.** `stackbone dev` used
+  to read it as a relay outage: three retries, then a pointer at
+  status.stackbone.ai for an outage that did not exist. The control plane now
+  answers `tunnel_not_configured`, and the CLI stops on the first one, with no
+  retry and no status page, and says that the control plane's operator has to
+  set the tunnel up. Exit code `1`, as for `tunnel_relay_unhealthy` (PLA-1991).
+
+- **`stackbone logs --since 5` read the number as a date in 2001 and filtered
+  nothing.** A bare number is a duration with the unit forgotten; `--since`
+  and `--until` now reject it and suggest one, e.g. `5m` (PLA-1796).
+
+## [0.5.4] - 2026-10-01
+
+### Added
+
+- **`stackbone dev` says why the tunnel closed.** When `frpc` stops after the
+  tunnel came up, `stackbone dev` keeps running and prints the cause: the
+  ticket reached its 8-hour limit, the control plane revoked the grant, or
+  another cause, with the last lines `frpc` printed. Each message says to
+  restart `stackbone dev` for a new URL. Before, the tunnel closed without a
+  word (PLA-1892).
+
+### Changed
+
+- **`frpc` now sends the grant's signed ticket to the relay.** The ticket is
+  written to the `frpc` config as global metadata, with a heartbeat every 30
+  seconds so the relay sees it on every ping as well as on login. The shared
+  token is still sent. A control plane that mints no ticket still opens the
+  tunnel on the shared token alone (PLA-1892).
+
+### Fixed
+
+- **An expired tunnel grant could clear the tunnel URL of an unrelated
+  `stackbone dev` session.** The control plane matched a lapsed grant to local
+  installations by searching their URL text for its subdomain, so one grant
+  could null another session's URL, in any organization. `stackbone dev` now
+  registers its local-dev installation before the tunnel opens, or registers it
+  again when the id in `.stackbone/project.json` no longer resolves, and sends
+  that id with the grant request. The control plane writes the tunnel URL when
+  it mints the grant and clears it on revoke or expiry, so the CLI no longer
+  PATCHes the URL on start or on Ctrl-C. If no installation can be registered,
+  the tunnel still opens, with an unbound grant (PLA-1691).
+
+- **`stackbone logs --since 5` read the number as a date in 2001 and filtered
+  nothing.** A bare number is a duration with the unit forgotten; `--since`
+  and `--until` now reject it and suggest one, e.g. `5m` (PLA-1796).
+
 ## [0.5.3] - 2026-09-25
 
 ### Fixed

package/README.md

@@ -1,21 +1,22 @@
 # @stackbone/cli
 
-The CLI for [Stackbone](https://stackbone.ai) — the marketplace and runtime for containerized AI agents.
+The CLI for [Stackbone](https://stackbone.ai): scaffold, run and deploy agents and workflows written in TypeScript, on Stackbone Cloud or your own infrastructure.
 
-> **Status:** `alpha`. The contract may break between releases. Pin a version or rely on the `alpha` dist-tag.
+> **Status:** `alpha`. The contract may break between releases. Pin a version or stay on the `latest` dist-tag.
 
 ## Quick start
 
-No install required — invoke the CLI through `npx`:
+Install the CLI once, globally. The same command updates it:
 
 ```bash
-npx @stackbone/cli login
-npx @stackbone/cli init my-workspace
-cd my-workspace && npm install
-npx @stackbone/cli dev
+pnpm add -g @stackbone/cli@latest
+stackbone login
+stackbone init my-workspace
+cd my-workspace
+stackbone dev
 ```
 
-That's it. `init` scaffolds a new workspace shell (agents + workflows + coding-agent skills) and links it to your organization, so you sign in first; `dev` boots the whole workspace locally — Postgres, Redis, MinIO and Stackbone Studio at `http://localhost:4242` — so you can iterate without publishing.
+That's it. `init` scaffolds a new workspace shell (agents + workflows + coding-agent skills), installs its dependencies with `pnpm install` and links it to your organization, so you sign in first; `dev` boots the whole workspace locally (Postgres, Redis, MinIO and Stackbone Studio at `http://localhost:4242`) so you can iterate before you deploy.
 
 ## Commands
 
@@ -45,7 +46,7 @@ Run any command with `--help` for the full flag reference. The full documentatio
 ## Links
 
 - Documentation: <https://docs.stackbone.ai>
-- Marketplace: <https://stackbone.ai>
+- Website: <https://stackbone.ai>
 - Issues & feedback: contact the team directly.
 
 ## License