amorphous-cli 0.3.10 → 0.3.12

package/lib/agent-contract.test.mjs

@@ -54,6 +54,8 @@ test('setup copies the skill, and an edited contract is left alone', () => {
   assert.match(skill, /View members can open the live abstract and load its guides/)
   assert.match(skill, /Use members can use the live abstract and submit source recommendations/)
   assert.match(skill, /Only owners and editors can pull and edit source/)
+  assert.match(skill, /Only push, preview, publish, invite, or notify when the person asks for that action/i)
+  assert.match(skill, /Use `publish --live` only when they explicitly ask to make the version live/i)
   assert.match(skill, /visibility anyone/i)
   assert.match(skill, /anyone can add shared records/i)
   assert.match(skill, /Do not run context again during this task/)

package/lib/commands.mjs

@@ -395,7 +395,7 @@ function listRow(row) {
     row.archived ? 'archived' : null,
     row.collection_path ? `in ${row.collection_path}` : null,
     tags ? `#${tags.replace(/,\s*/g, ' #')}` : null,
-    row.live_open ? 'open' : 'closed',
+    row.live_open ? 'Anyone with the link' : 'Members only',
   ]
     .filter(Boolean)
     .join(' · ')

package/lib/help.mjs

@@ -51,10 +51,11 @@ Open the browser and finish sign-in there.
 
 Start the local MCP server on stdio.`,
 
-  list: `list [--view recents|all|starred|archive] [--folder <name>] [--tag <name>] [--search <q>] [--json]
+  list: `list [--view recents|all|starred|archive] [--folder <name>] [--tag <name>] [--search <q>] [--open|--closed] [--json]
 
 List abstracts. Default view is all (All Abstracts).
---folder filters to a folder. --tag filters to a tag.`,
+--folder filters to a folder. --tag filters to a tag.
+Human output ends with the live link audience: “Anyone with the link” or “Members only”. --open and --closed filter that audience; JSON reports it as open.`,
 
   create: `create [--name <name>] [--folder <name>] [--template blank|list|board|landing] [--recipe-config <file>] [--json]
 

package/lib/help.test.mjs

@@ -54,3 +54,18 @@ test('visibility help explains public shared-record writes', () => {
 test('root help does not hide the write effect of public visibility', () => {
   assert.match(ROOT_HELP, /anyone can view; app may accept shared-record writes/i)
 })
+
+test('list help explains that open and closed describe the live link audience', () => {
+  let output = ''
+  const originalLog = console.log
+  console.log = (message) => { output = String(message) }
+  try {
+    printHelp('list')
+  } finally {
+    console.log = originalLog
+  }
+
+  assert.match(output, /anyone with the link/i)
+  assert.match(output, /members only/i)
+  assert.match(output, /--open.*--closed/i)
+})

package/lib/list-command.test.mjs

@@ -0,0 +1,83 @@
+import assert from 'node:assert/strict'
+import { createServer } from 'node:http'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+import { runCommand } from './commands.mjs'
+import { saveSession } from './session.mjs'
+
+const userId = '10000000-0000-4000-8000-000000000001'
+const payload = (value) => Buffer.from(JSON.stringify(value)).toString('base64url')
+const accessToken = `header.${payload({ sub: userId, exp: Math.floor(Date.now() / 1000) + 3600 })}.signature`
+
+test('list says who can open a live abstract instead of calling it closed', async (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'am-list-command-'))
+  const env = {
+    credentials: process.env.AMORPHOUS_CREDENTIALS,
+    appUrl: process.env.AMORPHOUS_CLI_APP_URL,
+    appOrigin: process.env.APP_ORIGIN,
+  }
+  process.env.AMORPHOUS_CREDENTIALS = join(root, 'credentials.json')
+  process.env.APP_ORIGIN = 'https://amorphous.test'
+  saveSession({
+    access_token: accessToken,
+    refresh_token: 'unused',
+    expires_at: Math.floor(Date.now() / 1000) + 3600,
+  })
+  const rows = [
+    {
+      id: '20000000-0000-4000-8000-000000000001',
+      name: 'Members-only app',
+      role: 'use',
+      starred: false,
+      archived: false,
+      tags: [],
+      collection_path: null,
+      live_open: false,
+      updated_at: '2026-10-22T00:00:00.000Z',
+    },
+    {
+      id: '20000000-0000-4000-8000-000000000002',
+      name: 'Public app',
+      role: 'owner',
+      starred: false,
+      archived: false,
+      tags: [],
+      collection_path: null,
+      live_open: true,
+      updated_at: '2026-10-22T00:00:00.000Z',
+    },
+  ]
+  const server = createServer((req, res) => {
+    res.writeHead(200, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ abstracts: rows }))
+  })
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
+  process.env.AMORPHOUS_CLI_APP_URL = `http://127.0.0.1:${server.address().port}`
+  t.after(async () => {
+    server.closeAllConnections?.()
+    await new Promise((resolve) => server.close(resolve))
+    rmSync(root, { recursive: true, force: true })
+    if (env.credentials === undefined) delete process.env.AMORPHOUS_CREDENTIALS
+    else process.env.AMORPHOUS_CREDENTIALS = env.credentials
+    if (env.appUrl === undefined) delete process.env.AMORPHOUS_CLI_APP_URL
+    else process.env.AMORPHOUS_CLI_APP_URL = env.appUrl
+    if (env.appOrigin === undefined) delete process.env.APP_ORIGIN
+    else process.env.APP_ORIGIN = env.appOrigin
+  })
+
+  const output = []
+  const originalLog = console.log
+  console.log = (message) => output.push(String(message))
+  try {
+    await runCommand(['list', '--view', 'all'])
+  } finally {
+    console.log = originalLog
+  }
+
+  assert.deepEqual(output, [
+    'Members-only app · 20000000-0000-4000-8000-000000000001 · Can use · Members only',
+    'Public app · 20000000-0000-4000-8000-000000000002 · Owner · Anyone with the link',
+  ])
+})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amorphous-cli",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "mcpName": "io.github.amorphous-one/amorphous",
   "description": "Make whatever you want, yourself, with your own agent, or with others.",
   "type": "module",

package/skill/amorphous/SKILL.md

@@ -36,7 +36,7 @@ A private record belongs to the signed-in person who wrote it. The abstract does
 
 After `setup`, invite them to describe what they want made. Build it for them.
 Prefer `amorphous-cli serve` while you edit. Open the URL and leave it running. It reloads when the files change, and it is the easiest way for them to look at the work.
-They tell you when to push, preview, publish, or invite. Do those when they ask.
+Only push, preview, publish, invite, or notify when the person asks for that action. Use `publish --live` only when they explicitly ask to make the version live.
 
 ## Start
 
@@ -61,7 +61,7 @@ When they ask:
 - `amorphous-cli push` sends the source. `amorphous-cli push --data` also sends the records in this folder.
 - `amorphous-cli guide save abstract` explicitly saves changes to the shared guide (owner/editor only). `amorphous-cli guide save private` explicitly saves this signed-in person's private guide. A stale revision is refused; reload context and resolve the conflict before saving. Ordinary `push`, `recommend`, and `publish` never save or include either guide.
 - `amorphous-cli preview` and open that URL.
-- `amorphous-cli publish --live`
+- `amorphous-cli publish` creates a version. Add `--live` only when they explicitly ask to make that version live.
 - Collaborators who should propose source for the owner to review can use `amorphous-cli recommend --note "..."`. It does not change the live abstract; the owner reviews and chooses Publish live or Decline.
 - `amorphous-cli invite <email> use` or `edit` or `view`. It emails them a link and prints that link. They open it and sign in with that email.
 - `amorphous-cli notify` emails members that the published version changed. It does not publish. Do that only when they ask.