flowviant 0.52.0 → 0.54.0

package/bin/lib/mcp-cli.mjs

@@ -2,17 +2,18 @@
  * `flowviant mcp` — connect YOUR Claude to Flowviant so you can file work from
  * the terminal ("stick that on the board", "file a task for this TODO").
  *
- * This mints a `cli` credential, which is a different principal from the worker
- * tokens the daemon rotates for builds. That separation is the point, not
- * bookkeeping: a worker reads untrusted repo, PR and issue text all day, so
- * giving THAT principal tools that write to your workspace would mean a hostile
- * string in a README could file work as you. The cli credential sees only the
- * management tools and can never claim or complete work; the worker can never
- * reach create_task.
+ * This mints a `cli` credential, which is a different principal from the
+ * per-session `work` tokens the daemon mints for Workbench tabs. That
+ * separation is the point, not bookkeeping: a session's agent reads untrusted
+ * repo and issue text all day, so giving THAT principal tools that write to
+ * your workspace would mean a hostile string in a README could file work as
+ * you. The cli credential sees only the management tools and can never work or
+ * ship a card; a session token can never reach create_task.
  *
  * There is deliberately no invite capability on it. Invites grant access to a
- * paid workspace and are guarded by a human browser session; you ask Flowvy in
- * the app for those, and approve the card.
+ * paid workspace and are guarded by a human browser session — they are sent
+ * from the workspace card's gear menu in the app, and never from a CLI
+ * credential sitting on a shared machine.
  */
 
 import { FLEET_TOKEN, USER_AGENT, MCP_URL, FLEET_URL } from './config.mjs';
@@ -77,7 +78,7 @@ export async function runMcpCommand(args = []) {
   console.log(`  ${cmd}`);
   console.log('');
   console.log('Then, in any Claude session: "file a task in Flowviant for …".');
-  console.log('Tasks land as drafts — nothing runs until you open one in the');
-  console.log('app and @mention an agent.');
+  console.log('Tasks land as drafts on the board — nothing runs until you open');
+  console.log('a session tab in the Workbench and type in it.');
   console.log('');
 }

package/bin/lib/preflight.mjs

@@ -91,20 +91,23 @@ export async function preflight({ needGit = true } = {}) {
     }
   }
 
-  // gh — needed to open PRs. Offer to fetch the isolated binary (yes-default:
-  // low-risk, no login carried by the install itself).
+  // gh — OPTIONAL. The daemon pushes and merges with plain `git`; nothing in
+  // the product opens a pull request any more, so gh is a convenience for the
+  // agent, not a requirement. Hence the offer no longer defaults to yes: an
+  // install nobody asked for, defaulted on, is how a preflight installs
+  // software on a machine whose operator only wanted a status line.
   if (gh && ghAuthed()) {
     ok('gh authenticated');
   } else if (gh) {
     warn('gh not signed in — run: gh auth login');
   } else {
-    warn('gh NOT found — needed to open PRs.');
-    if (await promptYesNo('Install GitHub CLI (gh) now?', true)) {
+    info('gh not found (optional).');
+    if (await promptYesNo('Install GitHub CLI (gh) now?', false)) {
       if (await installGh((m) => info(m))) gh = present('gh');
     }
     gh
       ? ok('gh installed to ~/.flowviant/bin — authenticate with: flowviant gh-auth')
-      : warn('install gh manually: https://cli.github.com, then run: gh auth login');
+      : info(c.dim('or install it later: https://cli.github.com, then: gh auth login'));
   }
 
   if (needGit) (git ? ok('git installed') : warn('git NOT found — install git'));