@tinycloud/cli 1.3.0 → 1.3.1-beta.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/cli",
-  "version": "1.3.0",
+  "version": "1.3.1-beta.0",
   "description": "TinyCloud CLI - manage data, delegations, and nodes from the terminal",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",

package/skills/tc-cli/AUTH.md

@@ -126,7 +126,7 @@ Login covers one space. Request further spaces on the logged-in profile:
 
 `auth request --device` defaults to a 7-day lifetime (`--expiry` to change it, at most `30d`). Without `--device`, `--grant` opens the OpenKey browser flow. Each space's request adds `tinycloud.capabilities/read` on that space's root, which OpenKey requires; a request of only raw decrypt is placed in the profile's primary space. Browser grants require a signed proof for the profile's session key and owner. Only the permissions and expiry in that proof can be activated and stored; an older space-nested decrypt proof, missing or foreign-owner proof, broader grant, wrong space, or too-long expiry is refused without storing a delegation.
 
-`auth request --preset apps-agent [--app APP_ID]...` is a named request for an agent that picks up the user's tiny apps. By default it is read-only: `tinycloud.kv` get, list and `tinycloud.sql` read on the `applications` space, up to 7 days. `--app` (repeatable, at most 5) narrows every entry to `APP_ID/`. `--write` (needs `--app`, never for the whole space) adds `tinycloud.kv` put on each app's `knowledge/` and `prefs/` folders only, and `tinycloud.sql` write for those apps, which adds, changes and deletes rows. Creating, changing and dropping tables also needs `tinycloud.sql/schema`, which the preset adds only for an app's catalog database: `xyz.tinycloud.sample.healthlog` gets `healthlog`, at the exact path `APP_ID/healthlog` (no trailing slash). Other apps get no schema grant, and the scope notice says so. Every other file under `APP_ID/` stays read-only, including the code and the stored `APP_ID/app/manifest.json` and `APP_ID/app/install.json` (the root-level `APP_ID/manifest.json` and `APP_ID/install.json` are refused too). CREATE, ALTER and DROP need `tinycloud.sql/schema`, which SQL write alone does not carry; nodes before 1.21.6 do not enforce that split, so there SQL write can run them too. Neither variant carries KV delete, SQL admin, schema on any database other than the catalog one, any other service or space, or secrets. The scope is printed in plain words to stderr before any approval link or artifact. `auth grant` prints a scope for every request it signs, built from the request file as it will be signed: the preset wording only when the permissions, the owner's own `applications` space and the 7-day lifetime all match; otherwise one line per entry (service, space, path, actions in words; an unknown service or action is printed raw and marked "unrecognised"; delegation abilities in plain words such as "can give other people or agents access on your behalf") and the requested lifetime. The request file is resolved once, the way the signer reads it (an entry with no `space` is in your `applications` space and is described as that; an empty space is refused; entries with the same service, space and path are merged), and that one list is printed, gated and signed. Each entry is printed once. A request that carries the `tinycloud.vault` shorthand (the signer turns it into KV access on `vault/` for the vault actions you listed, which the printed list would not show), a service the signer cannot sign, or more than one space is refused with exit 2 before anything is printed or signed. The request's `sessionDid` and `requestedExpiry` are checked first. Text from the request is escaped, in error messages too (on a terminal every error message and hint is escaped, and JSON output writes control, bidi, zero-width and separator characters as `\uXXXX` escapes, which parse to the same text, so a redirected stdout with a terminal stderr is safe too), and refusal messages show at most 5 items of 80 characters each. When the request touches an `applications` space and holds any entry the preset could never grant, those entries are marked `!` and listed first under "MORE than the apps-agent preset" and signing needs `--yes` or an interactive confirmation; without a terminal it exits 2 and signs nothing. The preset replaces `--cap`, `--permission`, `--manifest` and `--expiry` (combining them is a usage error), and `--device` is refused because device approval cannot grant SQL. An empty path in `--cap` (`tinycloud.kv:applications::get,list`) covers the whole service in that space; a path ending in `/` covers the prefix. The agent's key can pass on access inside its own grant, so a grant is as private as the agent's profile. The owner revokes a grant made through the request, grant, import flow with `tinycloud delegation revoke CID`. A profile whose first grant was revoked or expired has a dead session; import the new grant into a new profile. See the `tc-cli` skill, "Pick up a user's apps".
+`auth request --preset apps-agent [--app APP_ID]...` is a named request for an agent that picks up the user's tiny apps. By default it is read-only: `tinycloud.kv` get, list and `tinycloud.sql` read on the `applications` space, up to 7 days. `--app` (repeatable, at most 5) narrows every entry to `APP_ID/`. `--write` (needs `--app`, never for the whole space) adds `tinycloud.kv` put on each app's `knowledge/` and `prefs/` folders only, and `tinycloud.sql` write for those apps, which adds, changes and deletes rows. Creating, changing and dropping tables also needs `tinycloud.sql/schema`, which the preset adds only for an app's catalog database: `xyz.tinycloud.sample.healthlog` gets `healthlog`, at the exact path `APP_ID/healthlog` (no trailing slash). Other apps get no schema grant, and the scope notice says so. Every other file under `APP_ID/` stays read-only, including the code and the stored `APP_ID/app/manifest.json` and `APP_ID/app/install.json` (the root-level `APP_ID/manifest.json` and `APP_ID/install.json` are refused too). CREATE, ALTER and DROP need `tinycloud.sql/schema`, which SQL write alone does not carry; nodes before 1.21.6 do not enforce that split, so there SQL write can run them too. Neither variant carries KV delete, SQL admin, schema on any database other than the catalog one, any other service or space, or secrets. The scope is printed in plain words to stderr before any approval link or artifact. `auth grant` prints a scope for every request it signs, built from the request file as it will be signed: the preset wording only when the permissions, the owner's own `applications` space and the 7-day lifetime all match; otherwise one line per entry (service, space, path, actions in words; an unknown service or action is printed raw and marked "unrecognised"; delegation abilities in plain words such as "can give other people or agents access on your behalf") and the requested lifetime. The request file is resolved once, the way the signer reads it (an entry with no `space` is in your `applications` space and is described as that; an empty space is refused; entries with the same service, space and path are merged), and that one list is printed, gated and signed. Each entry is printed once. A request that carries the `tinycloud.vault` shorthand (the signer turns it into KV access on `vault/` for the vault actions you listed, which the printed list would not show), a service the signer cannot sign, or more than one space is refused with exit 2 before anything is printed or signed. The request's `sessionDid` and `requestedExpiry` are checked first. Text from the request is escaped, in error messages too (on a terminal every error message and hint is escaped, and JSON output writes control, bidi, zero-width and separator characters as `\uXXXX` escapes, which parse to the same text, so a redirected stdout with a terminal stderr is safe too), and refusal messages show at most 5 items of 80 characters each. When the request touches an `applications` space and holds any entry the preset could never grant, those entries are marked `!` and listed first under "MORE than the apps-agent preset" and signing needs `--yes` or an interactive confirmation. The question is written to stderr and answered on stdin, so it is still asked when stdout is redirected to a file; when stdin or stderr is not a terminal it exits 2 (`CONFIRMATION_REQUIRED`) and signs nothing, and an answer piped into stdin is not accepted. The preset replaces `--cap`, `--permission`, `--manifest` and `--expiry` (combining them is a usage error), and `--device` is refused because device approval cannot grant SQL. An empty path in `--cap` (`tinycloud.kv:applications::get,list`) covers the whole service in that space; a path ending in `/` covers the prefix. The agent's key can pass on access inside its own grant, so a grant is as private as the agent's profile. The owner revokes a grant made through the request, grant, import flow with `tinycloud delegation revoke CID`. A profile whose first grant was revoked or expired has a dead session; import the new grant into a new profile. See the `tc-cli` skill, "Pick up a user's apps".
 
 The owner approves each agent grant in OpenKey. `--yes` does not skip that screen. Before writing the grant file, the owner CLI checks the approval's owner, space and scope, and the grant lasts as long as the approval allows. An approval that unchecks any requested ability is refused with `OPENKEY_APPROVAL_NARROWER`, and nothing is stored. Without a browser, the CLI prints the approval link and waits for the browser flow to finish. The grant JSON reports `"prompted": true`, because the owner approved it on that screen.
 

package/skills/tc-cli/SKILL.md

@@ -78,7 +78,7 @@ Ask for the narrowest grant that does the job. The default is read-only, and one
 - With `--write`, the agent can add and change that app's data: it writes files under `APP_ID/knowledge/` and `APP_ID/prefs/` and adds, changes and deletes its table rows. It can create, change or drop tables only in the catalog database of a catalog app (for example `xyz.tinycloud.sample.healthlog/healthlog`), and the grant names no other database for that; nodes before 1.21.6 do not enforce this limit, so an ad-hoc CREATE, ALTER or DROP needs the owner's confirmation first. It cannot change the app's code, its manifest or its install record, and every other file under `APP_ID/` stays read-only. It cannot touch other apps, other spaces or secrets.
 - For a catalog app's write access, go straight to `auth request`: the owner's one OpenKey approval is the consent, so do not ask the owner again before requesting. The grant covers one named app: never ask for the whole space, and never a write without `--app`.
 - The preset cannot be combined with `--cap`, `--permission`, `--manifest` or `--expiry`, and device approval cannot grant it (SQL needs browser or `--paste`). The owner ends the grant with `tinycloud delegation revoke GRANT_CID`; the CID is in the `auth grant` output. Within its own grant the agent's key could pass the same access on to someone else, so keep the key and the grant file private.
-- The owner's `auth grant` prints every permission it is about to sign, built from the request file. A request that holds anything the preset could never grant (another service or space, KV delete, SQL admin, a schema entry outside the full `--write --app` variant of a catalog app, delegation, a write without a named app, a KV put outside `APP_ID/knowledge/` and `APP_ID/prefs/`) is listed first, marked `!`, under "MORE than the apps-agent preset" and is signed only after `--yes` or an interactive confirmation; without a terminal it exits 2 and signs nothing. If the text shows a different lifetime or scope than the one you asked for, the request file was edited.
+- The owner's `auth grant` prints every permission it is about to sign, built from the request file. A request that holds anything the preset could never grant (another service or space, KV delete, SQL admin, a schema entry outside the full `--write --app` variant of a catalog app, delegation, a write without a named app, a KV put outside `APP_ID/knowledge/` and `APP_ID/prefs/`) is listed first, marked `!`, under "MORE than the apps-agent preset" and is signed only after `--yes` or an interactive confirmation. The question is written to stderr and answered on stdin, so it is still asked when stdout is redirected (for example to capture the grant file); when stdin or stderr is not a terminal it exits 2 (`CONFIRMATION_REQUIRED`) and signs nothing, and an answer piped into stdin is not accepted. If the text shows a different lifetime or scope than the one you asked for, the request file was edited.
 - Every `auth grant` on an OpenKey owner profile goes to OpenKey approval, including a plain apps-agent request with no extra entries. `--yes` never skips OpenKey approval; it skips only the extras list confirmation.
 - **A revoked or expired grant cannot be replaced in the same profile.** A delegate profile's session is its first imported grant; a later `auth import` succeeds but invocations keep using the first one, so `knowledge list` answers `AUTH_REQUIRED`. Create a new profile (`profile create`), make a new request from it and import the new grant there.