alexandr 0.2.0 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexandr",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Run the alexandr workspace runtime locally — a thin Docker front door (npx alexandr up). Pulls + boots the published kernel image.",
   "type": "module",
   "bin": {

package/src/commands.js

@@ -258,13 +258,46 @@ export async function destroy(flags) {
   ensureDocker();
   const inst = resolveInstance(flags);
   if (!isMaterialized(inst.dir)) fail("No alexandr instance here.", EXIT.NO_INSTANCE);
-  const wipe = Boolean(flags.volumes || flags.data);
-  if (wipe && !confirmed(flags)) {
+  let wipe = Boolean(flags.volumes || flags.data);
+  let unlink = Boolean(flags.unlink);
+
+  // Interactive teardown (owner feedback, 2026-08-14): a destructive verb should ASK about
+  // everything it could take, not hide the data behind a flag you learn about afterwards.
+  // On a TTY without --yes, walk the choices; flags pre-answer their question. Non-TTY
+  // keeps the strict behavior: destructive combinations demand --yes (exit 8), scripts
+  // stay explicit.
+  const interactive = !confirmed(flags) && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (interactive) {
+    if (!wipe) {
+      wipe = await select("Also delete the workspace data (the /data volume)?", [
+        { label: "Keep the data", hint: "containers go, /data stays — `alexandr up` resumes it", value: false },
+        { label: "Delete everything", hint: "workspace DB, apps, files — irreversible", value: true },
+      ]);
+    }
+    if (!unlink && isLinked(inst.dir)) {
+      unlink = await select("Also remove this runtime from your alexandr account?", [
+        { label: "Keep the account link", hint: "the workspace stays listed in your hub", value: false },
+        { label: "Remove it", hint: "sign-in required — the hub entry disappears", value: true },
+      ]);
+    }
+    const go = await select(
+      wipe ? "Destroy this runtime AND its data?" : "Destroy this runtime (data preserved)?",
+      [
+        { label: "Cancel", value: false },
+        { label: wipe ? "Yes, destroy everything" : "Yes, destroy it", value: true },
+      ],
+    );
+    if (!go) {
+      log(dim("Nothing touched."));
+      return;
+    }
+  } else if (wipe && !confirmed(flags)) {
     fail("`destroy --volumes` deletes /data (workspace DB, apps, blobs) irreversibly. Re-run with --yes to confirm.", EXIT.CONFIRMATION);
   }
+
   // Optional account-side cleanup: sign in and remove the workspace record too, so the hub
   // doesn't keep a phantom entry. Off by default — destroying the containers never needs it.
-  if (flags.unlink && isLinked(inst.dir)) {
+  if (unlink && isLinked(inst.dir)) {
     if (await unlinkFromAccount(inst, flags)) ok("Removed from your account.");
     else warn("Couldn't remove it from your account — remove it from your account page instead.");
   }

package/src/link.js

@@ -258,7 +258,14 @@ async function registryLogin(sessionToken) {
     {},
     { authorization: `Bearer ${sessionToken}` },
   );
-  if (!r.data?.token || !r.data?.username) return;
+  if (!r.data?.token || !r.data?.username) {
+    // LOUD on purpose (the silent skip hid a dead prod credential on the first real
+    // install, 2026-08-14): the image is private, so no credential = the pull WILL fail.
+    warn(
+      `The control plane couldn't provide the runtime-image credential (${r.error ?? "malformed response"}) — the image pull will fail. Retry later, or contact your operator.`,
+    );
+    return;
+  }
   pendingPullCred = r.data;
   applyRegistryLogin();
 }