@stackbone/cli 0.5.4 → 0.6.1

package/CHANGELOG.md

@@ -7,6 +7,96 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.1] - 2026-10-08
+
+### Added
+
+- **`stackbone dev` says so when the organization's trial has ended.** The
+  control plane refuses the tunnel grant and the local registration of an
+  organization whose trial is over with `trial_expired`. The CLI prints that
+  the trial ended, that nothing was deleted and how to continue, exits `5`, and
+  does not retry. `stackbone init` reads the same refusal the same way. A
+  session that was already running keeps running (PLA-2036).
+- **`stackbone link` stops at an ended trial too.** The control plane now also
+  refuses `trial_expired` when an organization whose trial is over registers a
+  box (`link`) or creates a workspace (`init`), so both commands print the same
+  trial-ended message and exit `5` (PLA-2037).
+
+### Security
+
+- **A `stackbone dev` box no longer verifies connector calls with a key from
+  the public repo.** Every dev box signed `/api/connect/*` with the same
+  constant and encrypted connected accounts under the same key, so anyone
+  holding a tunnel URL could mint tokens for the creator's Gmail, Slack or
+  HubSpot. Each dev box now mints its own pair on its first boot and keeps it
+  in its own dev Postgres, next to the connections it protects. Connections
+  made with an older CLI are moved onto the new key at boot and keep working;
+  one that no known key can open is removed with a warning, and you reconnect
+  it in Studio (PLA-1866).
+
+## [0.6.0] - 2026-10-06
+
+### Added
+
+- **A workflow's `export const description` reaches the Catalog.** The build
+  reads it next to `inputSchema`, `outputSchema` and `schedules`, and Studio's
+  Catalog card and entry header show it. No stage carried a workflow description
+  before, so every workflow card was blank. A value that is not a string is
+  ignored with a warning, never a failed build (PLA-1811).
+
+- **`--agent` takes the agent slug.** Every surface that targets an
+  installation resolves `--agent astex-agent` to its installation id, the same
+  slug `agents list` prints first and `agents get` accepts. A slug with no agent
+  behind it says so and points at `agents list`, instead of the control plane's
+  "Internal server error" (PLA-1904).
+
+- **`stackbone runs list --trigger <trigger>`.** Filters runs by what started
+  them, with the same vocabulary `runs get` prints (PLA-1717).
+
+### Changed
+
+- **`stackbone dev` against a control plane on your machine opens no tunnel.**
+  When the control plane URL is loopback (`localhost`, `127.0.0.1`, `[::1]` or
+  a `*.localhost` name), the box registers its own `http://127.0.0.1:<port>`
+  URL on its local-dev installation and Studio's "Open Studio" link pins it.
+  No grant is minted and frpc does not start, so a local stack no longer needs
+  `STACKBONE_TUNNEL_TICKET_SIGNING_KEY`. Stopping the session clears the URL.
+  Any other control plane opens the tunnel as before (PLA-1989). The
+  "`frpc` is not installed" and `tunnel_relay_unhealthy` suggestions now say
+  the tunnel is mandatory against a deployed control plane, not everywhere
+  (PLA-1992).
+
+- **A `stackbone dev` box behind the tunnel requires the identity token.** It
+  used to check no credential, so anyone holding the tunnel URL could reveal
+  secrets, run SQL and decide approvals. The box now verifies the control
+  plane's identity JWT, as a deployed box does, on REST, SSE, the vendor wires
+  (`/agui`, `/openai`, `/anthropic`) and `/mcp`. The CLI mints the token for its
+  own calls to the box (`secrets`, `db`, connector codegen) and Studio sends it
+  to the install's tunnel URL. `/`, `/api/contract` and health stay open.
+  Connector codegen refused with 401 or 403 leaves `connect.d.ts` untouched
+  (PLA-1864, PLA-1868, PLA-1869).
+
+- **Workflow runs record the gate that started them.** A run's `trigger` is now
+  `manual`, `cron`, `event` (with the Connect link in `triggerRef`), `workflow`
+  for a parent workflow's child, or `platform` for the box's own errands, where
+  every workflow run used to read `workflow`. A start no gate stamped reads
+  `unknown`. `runs list` and `runs get` validate the trigger strictly, so a CLI
+  older than this release fails on a box that returns `platform` or `unknown`
+  (PLA-1717).
+
+### Fixed
+
+- **A control plane with no tunnel configured says so.** `stackbone dev` used
+  to read it as a relay outage: three retries, then a pointer at
+  status.stackbone.ai for an outage that did not exist. The control plane now
+  answers `tunnel_not_configured`, and the CLI stops on the first one, with no
+  retry and no status page, and says that the control plane's operator has to
+  set the tunnel up. Exit code `1`, as for `tunnel_relay_unhealthy` (PLA-1991).
+
+- **`stackbone logs --since 5` read the number as a date in 2001 and filtered
+  nothing.** A bare number is a duration with the unit forgotten; `--since`
+  and `--until` now reject it and suggest one, e.g. `5m` (PLA-1796).
+
 ## [0.5.4] - 2026-10-01
 
 ### Added

package/README.md

@@ -2,20 +2,21 @@
 
 The CLI for [Stackbone](https://stackbone.ai): scaffold, run and deploy agents and workflows written in TypeScript, on Stackbone Cloud or your own infrastructure.
 
-> **Status:** `alpha`. The contract may break between releases. Pin a version or rely on the `alpha` dist-tag.
+> **Status:** `alpha`. The contract may break between releases. Pin a version or stay on the `latest` dist-tag.
 
 ## Quick start
 
-No install required — invoke the CLI through `npx`:
+Install the CLI once, globally. The same command updates it:
 
 ```bash
-npx @stackbone/cli login
-npx @stackbone/cli init my-workspace
-cd my-workspace && npm install
-npx @stackbone/cli dev
+pnpm add -g @stackbone/cli@latest
+stackbone login
+stackbone init my-workspace
+cd my-workspace
+stackbone dev
 ```
 
-That's it. `init` scaffolds a new workspace shell (agents + workflows + coding-agent skills) and links it to your organization, so you sign in first; `dev` boots the whole workspace locally (Postgres, Redis, MinIO and Stackbone Studio at `http://localhost:4242`) so you can iterate before you deploy.
+That's it. `init` scaffolds a new workspace shell (agents + workflows + coding-agent skills), installs its dependencies with `pnpm install` and links it to your organization, so you sign in first; `dev` boots the whole workspace locally (Postgres, Redis, MinIO and Stackbone Studio at `http://localhost:4242`) so you can iterate before you deploy.
 
 ## Commands