@workser/cli 0.6.7 → 0.6.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workser/cli",
-  "version": "0.6.7",
+  "version": "0.6.9",
   "description": "Workser CLI — give your local AI agent native DevOps & infrastructure on Workser. The agent runs `workser …` to provision, deploy, and manage real apps.",
   "license": "MIT",
   "type": "module",

package/skills/workser/SKILL.md

@@ -75,12 +75,11 @@ pick or switch it.
    reverse it), and `workser design show --json` before writing UI. This project
    outlives your session; that context is how you don't start from zero.
 3. **A phased plan goes on the subtask list, never the Board.** Phases are
-   `workser task subtask add` (`workser help tasks`) — not `board create`,
-   which makes a second, driftable "the plan" the task page never reads.
-   Write the narrative once as `doc create` (no `--work-item`, or it's hidden
-   from the Docs panel), plus `decision create` for a real tradeoff. A plan
-   in your reply alone is gone when the conversation scrolls. Details:
-   `workser help sdlc-entities`.
+   `workser task subtask add` — not `board create`, which makes a second,
+   driftable "the plan" the task page never reads. Write the narrative once as
+   `doc create`, plus `decision create` for a real tradeoff. A plan in your
+   reply alone is gone when the conversation scrolls. How to correct a wrong
+   row, and what not to link: `workser help sdlc-entities`.
 4. **Stay in your lane.** `error.code = "owner_only"` (exit 6) means the action is
    reserved for the owner in Orbit. Don't retry or look for a workaround — tell the
    user, then continue. Provisioning the *pinned project's own* db / bucket / auth is

package/skills/workser/reference/key.md

@@ -0,0 +1,40 @@
+---
+topic: key
+title: Managed keys — list and rotate this app's Workser-issued credentials
+summary: See this app's AI Gateway and auth keys (redacted), and rotate one without opening Orbit.
+commands: [key]
+---
+
+# Managed keys — list and rotate this app's Workser-issued credentials
+
+```
+workser key list [--app <webAppId>]
+workser key rotate <key> [--app <webAppId>] [--env production|preview]
+```
+
+App-scoped, not project-scoped: run from the app's own folder and `--app` is
+picked up automatically; from anywhere else, pass `--app <webAppId>` — a
+mistake here is the wrong app's key, so there is no "primary app" default the
+way `env` has one.
+
+## What's rotatable
+
+Only credentials with a real rotation handler:
+
+- `AI_GATEWAY_API_KEY` — the deployed agent's key into the Workser AI
+  Gateway. Split by environment (`--env production` or `--env preview`
+  required), so rotating one never touches the other.
+- `BETTER_AUTH_SECRET` — a single value, no `--env` needed.
+
+Every other Workser-managed value (`DATABASE_URL`, the internal service
+keys) has no rotation handler yet — each belongs to a different subsystem
+with its own cutover semantics, and `key rotate` refuses rather than fake
+one.
+
+## After rotating
+
+The old value stops authorizing immediately, server-side. An already-running
+deployment keeps using whatever it was built with until it's redeployed —
+run `workser deploy` (`--prod` for the production key) to pick up the new
+value. `key rotate` prints the new secret exactly once; it is never shown
+again or stored anywhere in the clear.

package/skills/workser/reference/sdlc-entities.md

@@ -66,6 +66,17 @@ workser doc create "Checkout — implementation plan" --markdown "$(cat plan.md)
 workser decision create "Carts live server-side" --context "…" --decision "…" --json
 ```
 
+**A wrong row is edited, not replaced.** If a subtask's title, teammate, note or
+scope is wrong after you created it, fix that same row:
+
+```bash
+workser task subtask update <id> --title "…" --role api --note "…" --scope "src/api"
+```
+
+Never tell the user a subtask is locked, and never file a second one alongside
+the wrong one — a plan with a duplicate phase in it is a plan nobody can read
+the progress of.
+
 **Don't pass `--work-item` for a multi-phase plan.** A linked document renders on
 its card and is *hidden* from the Docs panel; a plan spanning three phases
 belongs to the project, not to phase 1.