octwin-cli 0.7.1 → 0.7.3

package/CHANGELOG.md

@@ -5,6 +5,69 @@ Format: [Keep a Changelog](https://keepachangelog.com/) — newest first, bucket
 **Added · Changed · Deprecated · Removed · Fixed · Security**. The platform-wide view lives in the
 repo root [`CHANGELOG.md`](../../CHANGELOG.md); this file is the CLI-only cut that ships with the package.
 
+## [0.7.3] - 2026-08-26
+
+### Changed
+- **A marketplace listing request is now OPT-IN: `octwin deploy --request-listing`.** A plain
+  `octwin deploy` says nothing about the public marketplace — it neither asks for a listing nor
+  gives one up. `--withdraw-listing` retracts, including an approved listing.
+  **Why:** the request was read from the manifest's `listing.public` on every deploy, and deploying
+  is how you *test*. 17 of the 23 published packs carry that key, so an edit-deploy-chat loop filed
+  a review request every time round. Worse, the *absence* of the key meant **retract** — so an
+  ordinary deploy of a pack whose manifest you had not yet annotated could wipe a listing you
+  already had. `--request-listing` still requires `listing.public: true` in the manifest (the
+  manifest states that the pack is a product; the flag is you choosing to ask), and the flag
+  without the key is a clean error rather than a silent no-op.
+- **The listing verdict distinguishes "you submitted this" from "your approval expired".** They are
+  both `pending` and they mean opposite things to an author. A deploy that changes the content of an
+  approved pack now says so in those words — an approval covers only the content it was made
+  against, so it cannot survive an edit.
+
+### Added
+- **A one-line nudge when your manifest asks and your deploy did not.** A pack carrying
+  `listing.public: true` that has never been submitted now prints the flag to use, so an opt-in
+  default cannot turn into waiting for a review nobody requested.
+
+### Fixed
+- **The "newer CLI" and "KB drifted" notices now print when a command FAILS.** All three nudges
+  (CLI upgrade · KB drift · unread memos) were awaited at the very end of `main()`, which silently
+  meant *only on success* — `die()` is a hard exit, so a failed deploy, an auth error or a bad
+  manifest printed none of them. That is backwards: a stale capability reference is a leading cause
+  of the failure an author is staring at, so the run that most needed the nudge was the only one
+  that never got it. They are now computed before the command and printed however it ends.
+- **The CLI-upgrade notice is no longer hidden from piped output.** It began with
+  `if (!process.stdout.isTTY) return`, so every agent-driven and CI run — the readers that cannot
+  notice an outdated CLI on their own — was the one audience never told. Its two siblings had
+  already dropped that gate for exactly this reason; now all three agree. Still skipped under
+  `npx`, where there is nothing to upgrade.
+- **`octwin login` now reports KB drift too.** It is networked and usually the first command of a
+  session, i.e. the best possible moment to say the reference moved, and it was excluded.
+- **A memo poll can no longer fail the command it was annotating.** It went through `apiGet` →
+  `fetchOrDie`, whose job is to `die` on a network failure — so an unreachable platform turned an
+  observer into a command failure. It now uses a plain, timed, fail-silent fetch.
+- **A failing command reports its real exit code again on Windows.** Moving the polls before the
+  command made `process.exit()` abort with `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)`
+  and return **127** instead of 1 — so CI saw neither success nor the documented failure code. The
+  CLI now unwinds through a `CliExit` and lets the event loop drain, which is the only teardown
+  that is clean once the polls have opened sockets. `--check`'s exit 2 and the streaming commands
+  were re-verified.
+
+## [0.7.2] - 2026-08-20
+
+### Fixed
+- **`octwin feedback` now tells you what is already waiting, on stdout.** It discarded the submit
+  response entirely — destructuring `{ status, json }`, checking the status and never reading the
+  body — then printed *"a reply arrives as a memo, this CLI will tell you when one is waiting"*. The
+  platform started returning the unread counts on that response (2026-08-20), so the answer was
+  there to print and was being thrown away.
+  **Why it matters more than it sounds:** `notifyIfMemosWaiting` already covers this command and was
+  firing correctly — but it writes to **stderr**, and the authors driving this CLI are agents reading
+  stdout. The one signal that mattered was addressed to a channel nobody was listening on. On
+  2026-08-19 an author submitted two reports two hours after three replies were published and
+  re-reported five findings those replies had already closed. Now the count prints in the same block
+  as the acknowledgement, naming the command, and says outright when a reply may already answer what
+  you just sent. Against an older platform the field is absent and the previous line stands.
+
 ## [0.7.1] - 2026-08-19
 
 ### Fixed

package/README.md

@@ -67,7 +67,7 @@ octwin status               # "✓ live and current" once it's warm
 | `octwin validate` | Check the pack locally (structure + pure-YAML rules). `--remote` runs **the same validation the platform runs to load your pack** — every declaration file (`xrm.yaml`, `scheduling.yaml`, `worklist.yaml`, `roles.yaml`, `automation.yaml`, `integrations.yaml`, `surveys.yaml`, `taps.yaml`, `commands.yaml`, `journeys/`, `messages.<lang>.yaml`), the cross-file checks between them, and the **flow lint** — conventions the schema can't express, like an `assign:` whose value is a quoted literal or a `$t()` key with no namespace. These need template expansion and the platform's own schemas, which only the server has, so a local ✓ does not cover them. A `--remote` ✓ and a successful deploy are now the same answer by construction, not by convention. |
 | `octwin login` | Save a deploy token for a platform URL **and make that URL the default target** (both stored in `~/.octwin/credentials.json`). `--url`, `--token`. |
 | `octwin whoami` | Verify the saved/passed token is valid for a tenant. `--url`, `--tenant`. |
-| `octwin deploy` | Upload + install the pack onto your tenant's project. `--seed` also runs the pack's demo seed. Reports the **marketplace-listing verdict** when the manifest carries `listing.public: true`. |
+| `octwin deploy` | Upload + install the pack onto your tenant's project. `--seed` also runs the pack's demo seed. Says **nothing** about the public marketplace unless asked: `--request-listing` submits the pack for operator review (needs `listing.public: true` in the manifest too), `--withdraw-listing` retracts. Reports the **listing verdict** whenever one exists. |
 | `octwin status` | Report what the platform has live for this pack — installed version, the **content sha** the instance loaded vs. the one the catalog holds (a redeploy of the *same* version changes it), its flows, and whether it is live on the public marketplace. |
 | `octwin pull <packId>` | Write a **deployed** pack's source back to disk — the inverse of `deploy`, and how a pack pushed from one machine is recovered. Defaults to the version installed on the target project; `--version` overrides, `--dir` defaults to `./<packId>`, a non-empty dir needs `--force`. You may pull a pack your tenant **owns**. |
 | `octwin chat "msg"` | Drive a turn through the dev web channel and print **every render with its tap ids**. `--as <handle>` picks the test user; `--tap "<tap-id>"` presses a rendered button/list row; `--json` dumps the raw envelopes. |

package/dist/index.js

@@ -14,6 +14,7 @@
  *   octwin whoami  [--url <url>] [--tenant <slug>]
  *   octwin projects [--archived]    # the --project slugs this token can name
  *   octwin deploy  [--dir .] [--url <url>] [--tenant <slug>] [--project <slug>] [--token <t>] [--seed]
+ *                  [--request-listing | --withdraw-listing]   # marketplace listing — opt-in, see `deploy` help
  *   octwin pull    <packId> [--dir <out>] [--version v] [--force]  # write a DEPLOYED pack's source back to disk
  *   octwin status  [<packId>]       # did my deploy land? which version is live?
  *   octwin records [entity] [id]    # inspect the pack's XRM data (records:read token)
@@ -52,7 +53,7 @@
  * operator's GitHub repo import applies. The platform re-validates it
  * (pure-YAML enforcement + manifest/flow Zod) and installs it onto the project.
  */
-import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, statSync, cpSync, rmSync } from 'node:fs';
+import { readFileSync, writeFileSync, writeSync, mkdirSync, existsSync, readdirSync, statSync, cpSync, rmSync } from 'node:fs';
 import { join, resolve, dirname, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -155,7 +156,7 @@ function parseFlags(argv) {
 }
 function die(msg) {
     console.error(`✗ ${msg}`);
-    process.exit(1);
+    exitNow(1);
 }
 // ── network helpers ─────────────────────────────────────────────────────────
 /** `fetch` that dies with the TARGET URL on a network failure — a bare
@@ -460,8 +461,10 @@ async function latestPublishedVersion() {
         const timer = setTimeout(() => ctrl.abort(), 1500);
         const res = await fetch('https://registry.npmjs.org/octwin-cli/latest', { signal: ctrl.signal });
         clearTimeout(timer);
-        if (!res.ok)
+        if (!res.ok) {
+            await res.arrayBuffer().catch(() => undefined);
             return null;
+        } // drain — see `fetchKbMeta`
         const latest = (await res.json()).version;
         if (typeof latest !== 'string')
             return null;
@@ -488,19 +491,30 @@ function isNpx() {
         return false;
     }
 }
-/** Print a one-line upgrade notice (to stderr) when a newer octwin-cli is published.
- *  Skipped when piped/CI (not a TTY) or run via npx (nothing to upgrade). Never throws. */
-async function notifyIfOutdated() {
-    if (!process.stdout.isTTY || isNpx())
-        return;
+/** A one-line upgrade notice when a newer octwin-cli is published, or [] when current.
+ *
+ *  Skipped only under npx, where there is genuinely nothing to upgrade. It USED to bail on
+ *  `!process.stdout.isTTY` as well, which silently made this the one notice a piped reader never
+ *  saw — the opposite of the rule its two siblings already carry in their docblocks, and measured
+ *  2026-08-26: with a newer version cached, `octwin whoami | tail` printed the KB nudge and not
+ *  this one. An agent driving the CLI cannot notice an outdated CLI on its own, so it is exactly
+ *  the reader that needs telling. One line on stderr, so piped stdout stays clean either way.
+ *
+ *  Never throws — a version check must never break a command. */
+async function outdatedNotice() {
+    if (isNpx())
+        return [];
     try {
         const latest = await latestPublishedVersion();
         if (latest && isNewer(latest, VERSION)) {
-            console.error(`\n⬆ octwin-cli ${latest} is available (you have ${VERSION}).`);
-            console.error('  Upgrade: npm i -g octwin-cli@latest   (or just use npx octwin-cli@latest)');
+            return [
+                `\n⬆ octwin-cli ${latest} is available (you have ${VERSION}).`,
+                '  Upgrade: npm i -g octwin-cli@latest   (or just use npx octwin-cli@latest)',
+            ];
         }
     }
     catch { /* a version check must never break the CLI */ }
+    return [];
 }
 // ── platform-KB drift check (observe the pulled reference, fail-silent) ──
 //
@@ -550,20 +564,20 @@ function diffKbIndex(prev, next) {
  */
 async function fetchKbMeta(t, timeoutMs = 2_000) {
     const ep = kbEndpoint(t);
-    const ctrl = new AbortController();
-    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
     try {
-        const res = await fetch(`${ep.url}?meta=1`, { headers: ep.headers, signal: ctrl.signal });
-        if (!res.ok)
+        const res = await fetch(`${ep.url}?meta=1`, { headers: ep.headers, signal: AbortSignal.timeout(timeoutMs) });
+        if (!res.ok) {
+            // Drain the body even though we do not want it. An unread `Response` body keeps its undici
+            // socket checked out of the pool, and this poll runs on the way to a possible `exitNow` —
+            // a held socket at exit is a pending libuv handle.
+            await res.arrayBuffer().catch(() => undefined);
             return { ok: false, notAuthorized: res.status === 401 || res.status === 403 };
+        }
         return { ok: true, meta: await res.json() };
     }
     catch {
         return { ok: false, notAuthorized: false };
     }
-    finally {
-        clearTimeout(timer);
-    }
 }
 /** Nudge (to stderr) when the platform's capability KB has changed since the last
  *  `octwin platform-kb pull`. The sibling of `notifyIfOutdated`, for the KB instead
@@ -577,15 +591,15 @@ async function fetchKbMeta(t, timeoutMs = 2_000) {
  *  authoring agent whose output is piped, and gating on `isTTY` meant the one
  *  reader that CANNOT notice a stale reference on its own was the only one never
  *  told. It is a single line on stderr, so piped stdout stays clean either way. */
-async function notifyIfKbStale(flags) {
+async function kbStaleNotice(flags) {
     try {
         const packDir = resolve(flags.dir ?? '.');
         const local = readLocalKb(packDir);
         if (!local?.content_hash)
-            return; // never pulled → the skill already says to pull
+            return []; // never pulled → the skill already says to pull
         const t = resolveTargetOrNull(flags);
         if (!t)
-            return;
+            return [];
         const polled = await fetchKbMeta(t);
         if (!polled.ok) {
             // The tenant-scoped meta poll needs `pack:deploy`, but this nudge rides on every
@@ -594,10 +608,12 @@ async function notifyIfKbStale(flags) {
             // makes an author invent a primitive from memory. Say so once; stay silent for every
             // other failure (offline, timeout, a platform without the route).
             if (polled.notAuthorized) {
-                console.error('\nⓘ can\'t check whether the platform capability reference drifted — that token lacks `pack:deploy`.');
-                console.error('  Check it without a token: octwin platform-kb --check   (or refresh: octwin platform-kb --token oct_…)');
+                return [
+                    '\nⓘ can\'t check whether the platform capability reference drifted — that token lacks `pack:deploy`.',
+                    '  Check it without a token: octwin platform-kb --check   (or refresh: octwin platform-kb --token oct_…)',
+                ];
             }
-            return;
+            return [];
         }
         const meta = polled.meta;
         if (meta.content_hash && meta.content_hash !== local.content_hash) {
@@ -614,11 +630,14 @@ async function notifyIfKbStale(flags) {
                 if (parts.length)
                     summary = ` (${parts.join(' · ')})`;
             }
-            console.error(`\n⬆ the platform capability reference changed since you last pulled it${summary}.`);
-            console.error('  Refresh it: octwin platform-kb --if-stale');
+            return [
+                `\n⬆ the platform capability reference changed since you last pulled it${summary}.`,
+                '  Refresh it: octwin platform-kb --if-stale',
+            ];
         }
     }
     catch { /* a KB check must never break the CLI */ }
+    return [];
 }
 /**
  * Nudge (to stderr) when the platform has memos this workspace has not read — a reply to
@@ -642,33 +661,107 @@ async function notifyIfKbStale(flags) {
  * platform, so an agent on a fresh machine or in a fresh container still learns about an
  * unread memo. That is the whole reason it is not a local marker file.
  */
-async function notifyIfMemosWaiting(flags) {
+async function memosWaitingNotice(flags) {
     try {
         const t = resolveTargetOrNull(flags);
         if (!t)
-            return;
-        const { status, json } = await apiGet(`${t.url}/api/self/p/memos?meta=1`, t);
+            return [];
+        // A PLAIN fetch, not `apiGet` — which goes through `fetchOrDie`, whose whole job is to `die`
+        // on a network failure. An observer that can terminate the CLI is not an observer: with an
+        // unreachable platform this nudge would have failed the command it was only meant to annotate,
+        // and now that the polls run BEFORE the command it would have failed it before it even ran.
+        const res = await fetch(`${t.url}/api/self/p/memos?meta=1`, {
+            headers: authHeaders(t), signal: AbortSignal.timeout(2_000),
+        });
+        const status = res.status;
+        const json = await res.json().catch(() => null);
         // Silent on ANY failure — an older platform has no such route, and a nudge is never
         // worth a diagnostic of its own. Unlike the KB poll there is no scope to explain: the
         // route is gated on tenant access precisely so every token can answer it.
         if (status !== 200 || !json || typeof json !== 'object')
-            return;
+            return [];
         const unread = Number(json.unread ?? 0);
         if (!Number.isFinite(unread) || unread <= 0)
-            return;
+            return [];
         const actionable = Number(json.unread_actionable ?? 0);
         const what = unread === 1 ? '1 memo' : `${unread} memos`;
         const tail = actionable > 0 ? ` (${actionable} needing action)` : '';
-        console.error(`\n✉ ${what} from the platform${tail} — read them: octwin memos`);
+        const lines = [`\n✉ ${what} from the platform${tail} — read them: octwin memos`];
         if (actionable > 0) {
             // Said separately, because the whole point of the severity axis is that an agent
             // mid-build should stop and read rather than finish first.
-            console.error('  One or more may change what you are building — read before continuing.');
+            lines.push('  One or more may change what you are building — read before continuing.');
         }
+        return lines;
     }
     catch { /* a memo check must never break the CLI */ }
+    return [];
 }
-/** Which commands already made a platform call, so the trailing KB-drift poll
+// ── the notice channel: computed BEFORE the command, printed however it ends ──
+//
+// These three nudges used to be awaited at the very END of `main()`, and that placement quietly
+// meant "only when the command SUCCEEDS": `die()` is `process.exit(1)`, so a failed deploy, an
+// auth error or a bad manifest skipped all three. Measured 2026-08-26 — a failing command printed
+// nothing while the same command succeeding printed the KB nudge. That is backwards. A stale
+// capability reference is a LEADING CAUSE of the failure an author is staring at, so the one run
+// that most needs the nudge was the only one that never got it.
+//
+// So: compute the lines up front (async, needs the network), then print them through a SYNCHRONOUS
+// flush that also runs from `process.on('exit')`. The strings already exist by then, so the exit
+// hook has nothing to await — which is what makes `die()`'s hard exit safe. `die` itself is left
+// alone deliberately: making it throw instead would have to survive 30 broad `catch` blocks in
+// this file, any one of which would turn a hard failure into a silent continue.
+let PENDING_NOTICES = [];
+let NOTICES_FLUSHED = false;
+/** Print the computed notices exactly once. */
+function flushNotices() {
+    if (NOTICES_FLUSHED)
+        return;
+    NOTICES_FLUSHED = true;
+    if (PENDING_NOTICES.length === 0)
+        return;
+    try {
+        writeSync(2, `${PENDING_NOTICES.join('\n')}\n`);
+    }
+    catch { /* a nudge is never worth a crash */ }
+}
+/** Thrown by `exitNow` to unwind to `main` instead of calling `process.exit`. */
+class CliExit extends Error {
+    code;
+    constructor(code) {
+        super('cli-exit');
+        this.code = code;
+    }
+}
+/**
+ * The ONE way this CLI ends non-zero: flush the notices, then unwind.
+ *
+ * ## Why this throws instead of calling `process.exit`
+ *
+ * Because `process.exit()` is not safe here, measured 2026-08-26 on Windows. Once the notice polls
+ * moved to BEFORE the command (so a failing run still gets its nudge), a hard exit began aborting
+ * with `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\\win\\async.c` — and, far worse
+ * than the noise, it replaced the real exit code with **127**, so a failing `octwin deploy` in CI
+ * reported neither 0 nor 1. Ruled out one at a time: it is not the notice I/O (a no-fetch failure
+ * exits 1 cleanly), not an `exit` handler (removing it changed nothing), not an unread response
+ * body, not the `AbortController`, and not concurrency (serialising them changed nothing). It
+ * reproduces on **two** pre-command fetches and not on one, which points at undici's pooled
+ * sockets — not something this CLI can reach in to close.
+ *
+ * A NATURAL exit has none of these problems: the same two fetches on the success path exit 0
+ * cleanly, because Node tears the pool down itself when the event loop drains. So `main` catches
+ * `CliExit`, sets `process.exitCode`, and returns.
+ *
+ * Safe to throw rather than exit because every `catch` in this file was audited for it: all but a
+ * handful guard a single `JSON.parse` / `readFileSync`, and in the three with real bodies (plus
+ * `fetchOrDie` and `--fields-json`) the `die()` sits in the **catch handler**, never inside the
+ * `try` — so nothing swallows this.
+ */
+function exitNow(code) {
+    flushNotices();
+    throw new CliExit(code);
+}
+/** Which commands already made a platform call, so the KB-drift poll
  *  rides on existing network work (never on offline `validate` / `init`;
  *  `platform-kb` refreshes the reference itself, so it needs no nudge). */
 function commandTouchesPlatform(command, flags) {
@@ -683,6 +776,11 @@ function commandTouchesPlatform(command, flags) {
         // `memos` is networked but needs NO memo nudge — it just read them. It still gets the
         // KB drift check, which is a different question.
         case 'memos': return true;
+        // `login` verifies the token over the network and is usually the FIRST command of a session —
+        // the best possible moment to say the reference drifted. It reads the target from the FLAGS
+        // (`--url`/`--token`), which is what the notices resolve too, so it does not depend on the
+        // credentials this command is about to save.
+        case 'login':
         case 'records':
         case 'work':
         case 'logs':
@@ -991,7 +1089,7 @@ async function cmdValidate(flags) {
         console.error(`✗ remote validate failed (HTTP ${res.status})`);
         printAuthHint(res.status, url);
         console.error(typeof json === 'string' ? json : JSON.stringify(json, null, 2));
-        process.exit(1);
+        exitNow(1);
     }
     const warnings = (json?.warnings ?? []);
     if (warnings.length) {
@@ -1016,7 +1114,7 @@ async function cmdValidate(flags) {
         for (const m of msgs)
             console.error(`    • ${m}`);
     }
-    process.exit(1);
+    exitNow(1);
 }
 async function cmdLogin(flags) {
     const rawUrl = flags.url ?? process.env.PACK_PLATFORM_URL ?? die('usage: octwin login --url <platformUrl> --token <t>');
@@ -1157,7 +1255,7 @@ async function cmdPull(flags) {
             console.error('  → a pack is pullable by the tenant that OWNS it (deployed it), or by an operator.');
         }
         console.error(typeof json === 'string' ? json : JSON.stringify(json, null, 2));
-        process.exit(1);
+        exitNow(1);
     }
     const files = json.files ?? {};
     const blobs = json.blobs ?? {};
@@ -1230,23 +1328,68 @@ async function readDeployProgress(body) {
     }
     return { terminal, stepErrors };
 }
+/** What a `--request-listing` / `--withdraw-listing` deploy says it is doing, for the header line. */
+const LISTING_LABEL = {
+    submit: 'requesting a public marketplace listing',
+    withdraw: 'withdrawing the public marketplace listing',
+};
+/**
+ * Which marketplace act this deploy is, from the two mutually-exclusive flags.
+ *
+ * Returns undefined for the common case — an ordinary deploy asks for nothing. Both flags at once
+ * is a `die` rather than a precedence rule: the two are opposites, and guessing which one the
+ * author meant is exactly the silent-wrong-thing this opt-in default exists to prevent.
+ */
+function resolveListingFlags(flags) {
+    const submit = flags['request-listing'] === true;
+    const withdraw = flags['withdraw-listing'] === true;
+    if (submit && withdraw) {
+        die('--request-listing and --withdraw-listing are opposites — pass one, not both');
+    }
+    return submit ? 'submit' : withdraw ? 'withdraw' : undefined;
+}
+/**
+ * Nudge the author whose manifest asks to be public but whose deploy did not submit it.
+ *
+ * The listing request is OPT-IN (`--request-listing`), because the CLI is overwhelmingly an
+ * edit-deploy-chat test loop and reading the manifest alone filed a review request on every
+ * single deploy. But a silent default has its own failure: an author who wrote
+ * `listing.public: true` months ago and waits for a review that was never requested. One line,
+ * only when the manifest actually declares it, so a pack that never asked stays silent.
+ */
+function printListingNotAsked(packDir) {
+    let declared = false;
+    try {
+        const raw = readFileSync(join(packDir, 'manifest.yaml'), 'utf8');
+        declared = parseYaml(raw)?.listing?.public === true;
+    }
+    catch {
+        return;
+    } // unreadable/unparseable is the deploy's to report
+    if (!declared)
+        return;
+    console.log('  ⓘ your manifest declares listing.public — this deploy did NOT submit it for review.');
+    console.log('    Ask for a public marketplace listing with: octwin deploy --request-listing');
+}
 /**
  * The anonymous-marketplace verdict, for `deploy` and `status` alike.
  *
- * `listing.public: true` in the manifest puts a pack into an operator review queue, and the
- * state lived only in the console — so an author working from the CLI got no acknowledgement
- * that the request had registered, and no sight of a rejection note (which the platform
- * REQUIRES precisely because it is their only feedback). Silent for `none`/absent, so a pack
- * that never asked prints nothing.
+ * The state lived only in the console — so an author working from the CLI got no acknowledgement
+ * that a request had registered, and no sight of a rejection note (which the platform REQUIRES
+ * precisely because it is their only feedback). Silent for `none`/absent, so a pack that never
+ * asked prints nothing.
  *
- * `pending` after a redeploy is normal rather than a regression: an approval pins the sha it
- * reviewed, so any content edit returns the pack to the queue on its own.
+ * `justAsked` separates the two ways a pack lands in the queue, which read as the same state and
+ * mean opposite things to the author: they submitted it, or a content edit invalidated an approval
+ * they already had (an approval pins the sha it reviewed, so it cannot survive a content change).
  */
-function printPublicListing(state, note, live) {
+function printPublicListing(state, note, live, justAsked = false) {
     const n = typeof note === 'string' && note ? ` — operator note: ${note}` : '';
     switch (state) {
         case 'pending':
-            console.log('  ⓘ marketplace listing: PENDING operator review (any content edit re-queues it — the approval pins a content sha).');
+            console.log(justAsked
+                ? '  ⓘ marketplace listing: SUBMITTED — now pending operator review.'
+                : '  ⓘ marketplace listing: back to PENDING review — this deploy changed the content, and an approval only covers the content it was made against.');
             break;
         case 'approved':
             console.log(live === false
@@ -1260,7 +1403,7 @@ function printPublicListing(state, note, live) {
             break;
     }
 }
-function printDeploySuccess(id, version, t, r) {
+function printDeploySuccess(id, version, t, r, listing) {
     console.log(`✓ Deployed ${id}@${version} and installed onto ${targetLabel(t)}`);
     if (r?.warning)
         console.log(`  ⚠ ${r.warning}`);
@@ -1285,7 +1428,12 @@ function printDeploySuccess(id, version, t, r) {
     if (dropped > 0) {
         console.log(`  ⓘ ${dropped} suspended run(s) invalidated — a tap on any card rendered before this deploy will report a stale run. Start those conversations again.`);
     }
-    printPublicListing(r?.public_listing, r?.public_review_note);
+    printPublicListing(r?.public_listing, r?.public_review_note, undefined, listing?.intent === 'submit');
+    // Only when the deploy asked for nothing AND the row says nothing: a pack sitting at `none`
+    // with `listing.public` in its manifest is an author waiting for a review nobody requested.
+    if (listing && !listing.intent && (r?.public_listing == null || r.public_listing === 'none')) {
+        printListingNotAsked(listing.packDir);
+    }
     console.log(`\nChat with it: octwin chat "hi" --as tester   (or the web widget / console test page).`);
 }
 /**
@@ -1326,7 +1474,7 @@ async function cmdSeed(flags) {
 ⚠ ${stepErrors.length} step${stepErrors.length === 1 ? '' : 's'} failed — data may be incomplete:`);
             for (const e of stepErrors)
                 console.error(`   • ${e}`);
-            process.exit(1);
+            exitNow(1);
         }
         return;
     }
@@ -1341,7 +1489,7 @@ async function cmdSeed(flags) {
     if (!res.ok) {
         console.error(`✗ seed failed (HTTP ${res.status})${errDetail(json)}`);
         printAuthHint(res.status, url);
-        process.exit(1);
+        exitNow(1);
     }
     console.log('✓ seed complete');
     printSeedCounts(json?.seeded);
@@ -1360,13 +1508,17 @@ async function cmdDeploy(flags) {
     const { id, version, files, blobs } = localValidate(packDir);
     const endpoint = `${url}/api/self/p/packs/deploy`;
     const seed = flags.seed === true;
-    console.log(`→ Deploying ${id}@${version} (${Object.keys(files).length} files) to ${targetLabel(t)}${seed ? ' — with demo seed' : ''} …`);
+    const listing = resolveListingFlags(flags);
+    const extras = [seed ? 'with demo seed' : null, listing ? LISTING_LABEL[listing] : null].filter(Boolean);
+    console.log(`→ Deploying ${id}@${version} (${Object.keys(files).length} files) to ${targetLabel(t)}${extras.length ? ` — ${extras.join(', ')}` : ''} …`);
     const res = await fetchOrDie(endpoint, {
         method: 'POST',
         // Ask for a progress stream; the platform falls back to plain JSON if it
         // (or an error before any progress) can't stream — handled below.
         headers: { 'content-type': 'application/json', accept: 'text/event-stream', ...authHeaders(t) },
-        body: JSON.stringify({ files, blobs, seed }),
+        // `listing` is omitted entirely unless asked for: an ordinary deploy says NOTHING about the
+        // marketplace, which is what keeps a test loop out of the operator review queue.
+        body: JSON.stringify({ files, blobs, seed, ...(listing ? { listing } : {}) }),
     }, 'deploy');
     // Streaming path — live install + seed progress (image generation can take a
     // while, so `--seed` prints per-record / per-image lines as they happen).
@@ -1374,7 +1526,7 @@ async function cmdDeploy(flags) {
         const { terminal: final, stepErrors } = await readDeployProgress(res.body);
         if (!final || final.stage === 'error')
             die(`deploy failed${final?.message ? `: ${final.message}` : ' (stream ended early)'}`);
-        printDeploySuccess(id, version, t, final);
+        printDeploySuccess(id, version, t, final, { intent: listing, packDir });
         if (stepErrors.length) {
             // The pack IS installed, but a step (e.g. the demo seed) failed — say so
             // plainly and exit non-zero so CI / a `deploy && chat` chain doesn't treat
@@ -1382,7 +1534,7 @@ async function cmdDeploy(flags) {
             console.error(`\n⚠ Deployed with ${stepErrors.length} warning${stepErrors.length === 1 ? '' : 's'} — data may be incomplete:`);
             for (const e of stepErrors)
                 console.error(`   • ${e}`);
-            process.exit(1);
+            exitNow(1);
         }
         return;
     }
@@ -1400,9 +1552,9 @@ async function cmdDeploy(flags) {
         console.error(`✗ deploy failed (HTTP ${res.status})`);
         printAuthHint(res.status, url);
         console.error(typeof json === 'string' ? json : JSON.stringify(json, null, 2));
-        process.exit(1);
+        exitNow(1);
     }
-    printDeploySuccess(id, version, t, json);
+    printDeploySuccess(id, version, t, json, { intent: listing, packDir });
 }
 /**
  * The QUALIFIED pack id (`<owner>.<name>`) for a manifest's bare name.
@@ -1472,7 +1624,7 @@ async function cmdStatus(flags) {
         console.error(`✗ status check failed (HTTP ${res.status})`);
         printAuthHint(res.status, url);
         console.error(typeof json === 'string' ? json : JSON.stringify(json, null, 2));
-        process.exit(1);
+        exitNow(1);
     }
     console.log(`${id} on ${targetLabel(t)} @ ${url}`);
     console.log(`  installed version : ${json.installed_version}`);
@@ -1571,16 +1723,16 @@ async function cmdPlatformKb(flags) {
             console.error(polled.notAuthorized
                 ? '✗ cannot check — the platform refused the token, and this instance serves no anonymous reference.'
                 : `✗ cannot check — ${url} did not answer.`);
-            process.exit(1);
+            exitNow(1);
         }
         const remote = polled.meta.content_hash;
         if (!local?.content_hash) {
             console.log(`⬆ no reference pulled yet (platform is at ${remote ?? '?'}) — run \`octwin platform-kb pull\`.`);
-            process.exit(2);
+            exitNow(2);
         }
         if (remote && remote !== local.content_hash) {
             console.log(`⬆ stale: local ${local.content_hash} → platform ${remote}. Run \`octwin platform-kb pull\`.`);
-            process.exit(2);
+            exitNow(2);
         }
         console.log(`✓ current (${local.content_hash}).`);
         return;
@@ -1612,7 +1764,7 @@ async function cmdPlatformKb(flags) {
         }
         console.error(`✗ platform-kb pull failed (HTTP ${res.status})`);
         console.error(typeof j === 'string' ? j : JSON.stringify(j, null, 2));
-        process.exit(1);
+        exitNow(1);
     }
     const bundle = JSON.parse(text);
     // Snapshot the prior pull's index BEFORE overwriting it, so we can show the
@@ -1998,7 +2150,7 @@ async function cmdRecordsWrite(flags) {
             // useful thing to show, so don't bury it in the generic error line.
             console.error(`✗ '${to}' is not a legal move from this record's stage.`);
             console.error(`  → allowed: ${json.allowed.join(', ') || '(none — terminal stage)'}`);
-            process.exit(1);
+            exitNow(1);
         }
         if (status !== 200)
             writeFail(`move record ${id} to '${to}'`, status, json, url, true);
@@ -2109,7 +2261,33 @@ async function cmdFeedback(flags) {
         console.log('  ⓘ no local capability reference found, so the report carries no KB version.');
         console.log('    Pull it before your next session: octwin platform-kb');
     }
-    console.log('  A reply arrives as a memo — this CLI will tell you when one is waiting.');
+    // WHAT IS ALREADY WAITING, said here rather than promised for later.
+    //
+    // The submit response carries the same counts `notifyIfMemosWaiting` polls. That nudge
+    // fires on this command too — but it writes to STDERR, and the authors driving this CLI
+    // are agents reading stdout, so the one signal that mattered was addressed to a channel
+    // nobody was listening on. On 2026-08-19 an author sent two reports two hours after
+    // three replies were published and re-reported five already-fixed findings; the nudge
+    // had run correctly both times.
+    //
+    // So it goes on STDOUT, at the moment they are certainly reading, in the same block as
+    // the acknowledgement. `memos` is absent against an older platform — then the old line
+    // stands, which is the honest thing to say when we cannot know.
+    const memos = json?.memos;
+    const unread = Number(memos?.unread ?? 0);
+    const actionable = Number(memos?.unread_actionable ?? 0);
+    if (Number.isFinite(unread) && unread > 0) {
+        const what = unread === 1 ? '1 reply is' : `${unread} replies are`;
+        const tail = Number.isFinite(actionable) && actionable > 0 ? ` (${actionable} needing action)` : '';
+        console.log(`  ✉ ${what} already waiting for you${tail} — read them BEFORE your next change: octwin memos`);
+        if (actionable > 0) {
+            // The severity axis exists so an agent mid-build stops instead of finishing first.
+            console.log('    One or more may already answer what you just reported.');
+        }
+    }
+    else {
+        console.log('  A reply arrives as a memo — this CLI will tell you when one is waiting.');
+    }
 }
 /**
  * `octwin memos [--json] [--all]` — read what the platform has told you.
@@ -2571,13 +2749,13 @@ async function cmdChat(flags) {
             // isn't answering — the remaining turns would land out of context.
             await cancel();
             console.error(`  turn ${i + 1} produced no render after ${Math.round(REPLY_TIMEOUT_MS / 1000)}s — stopping the script here.`);
-            process.exit(1);
+            exitNow(1);
         }
     }
     await cancel();
     if (totalRenders === 0) {
         console.error(`  no reply after ${Math.round(REPLY_TIMEOUT_MS / 1000)}s — the pack may not be warm yet, or the turn produced no render.`);
-        process.exit(1);
+        exitNow(1);
     }
     console.log(`\n(same --as '${from}' continues this conversation — timeline: octwin logs --as ${from})`);
 }
@@ -2619,7 +2797,7 @@ async function cmdMedia(flags) {
         }
         console.error(`✗ media generate failed (HTTP ${res.status})${errDetail(j)}`);
         printAuthHint(res.status, url);
-        process.exit(1);
+        exitNow(1);
     }
     const r = JSON.parse(text);
     const absUrl = /^https?:/i.test(r.url) ? r.url : `${url}${r.url}`;
@@ -3290,7 +3468,7 @@ async function cmdOrdersWrite(flags) {
                 console.error(`  → allowed: ${allowed.join(', ')}`);
             else
                 console.error(`  → see the allowed set: octwin orders ${ref}`);
-            process.exit(1);
+            exitNow(1);
         }
         if (status !== 200)
             writeFail(`move order ${ref} to '${to}'`, status, json, url);
@@ -3325,7 +3503,7 @@ async function cmdOrdersWrite(flags) {
         console.log(`  gateway      : ${gw.status ?? (gw.ok === false ? 'failed' : 'ok')}${gw.error || gw.message ? ` — ${gw.error ?? gw.message}` : ''}`);
     if (refused) {
         console.error('\n✗ the PAYMENT GATEWAY refused the refund — the order was updated but no money moved.');
-        process.exit(1);
+        exitNow(1);
     }
     console.log('✓ Refund accepted.');
 }
@@ -3848,6 +4026,7 @@ function help() {
   octwin whoami  [--url <url>] [--tenant <slug>]         # verify the token works
   octwin projects [--archived] [--json]                  # the --project slugs this token can name
   octwin deploy  [--dir .] [--url <url>] [--tenant <slug>] [--project <slug>] [--token <t>] [--seed]
+                 [--request-listing | --withdraw-listing]   # public marketplace — opt-in, see: octwin help deploy
   octwin status  [<packId>] [--dir .] [--url <url>] [--tenant <slug>] [--project <slug>] [--token <t>]
   octwin pull    <packId> [--dir <out>] [--version <v>] [--force]  # write a DEPLOYED pack's source back to disk (the inverse of deploy)
   octwin records [entity] [id]                           # inspect the pack's XRM data (needs a records:read token)
@@ -3923,8 +4102,21 @@ octwin projects rm <slug> [--yes]
     octwin projects rm scratch --yes
   Both verbs need the \`projects:write\` scope — a pack:deploy token does NOT confer it.`,
     deploy: `octwin deploy [--dir .] [--url <url>] [--tenant <slug>] [--project <slug>] [--token <t>] [--seed]
+                [--request-listing | --withdraw-listing]
   Upload the pack bundle, validate server-side, install onto the project.
-  --seed additionally applies the pack's demo seed (streams progress).`,
+  --seed additionally applies the pack's demo seed (streams progress).
+
+  A plain deploy says NOTHING about the public marketplace — it is a test loop, so it
+  neither asks for a listing nor gives one up. The marketplace flags are opt-in:
+
+  --request-listing    ask an operator to review this pack for the public marketplace
+                       (the pre-signup storefront at /packs). Requires 'public: true'
+                       under 'listing:' in manifest.yaml — the manifest states that the
+                       pack is a product, the flag is you choosing to ask.
+  --withdraw-listing   retract the request, including an approved listing.
+
+  An approval covers the CONTENT it was made against, so a later deploy that changes the
+  pack returns it to the review queue on its own — no flag needed, and the CLI says so.`,
     seed: `octwin seed [--pack <packId>]
   Apply the pack's demo/reference data to the project it is installed on, without
   redeploying: xrm \`demo:\` records + scheduling availability, the commerce catalog,
@@ -4126,6 +4318,23 @@ async function main() {
         console.log(COMMAND_HELP[command]);
         return;
     }
+    // Compute the trailing nudges BEFORE the command runs, so they survive a `die()` — see the
+    // notice-channel block above. They are PRINTED after the command, by `flushNotices` here on the
+    // success path and by `exitNow` on every failure path. Fail-silent by construction (each helper
+    // swallows and returns []), and the KB + memo polls still ride only on commands that were
+    // already going to hit the network.
+    // SEQUENTIAL, not `Promise.all`. Two concurrent polls to the same host leave a socket checked
+    // out of undici's pool, and `exitNow`'s `process.exit` then aborts on Windows with
+    // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c` — replacing the real
+    // exit code with 127, so a failing `octwin deploy` in CI reported the wrong thing. Measured
+    // 2026-08-26: one pre-command poll exits 1 cleanly, two concurrent ones abort. Awaiting them in
+    // turn costs one extra round-trip on an already-networked command and keeps the exit code true.
+    const networked = commandTouchesPlatform(command, flags);
+    if (networked) {
+        PENDING_NOTICES.push(...await kbStaleNotice(flags));
+        PENDING_NOTICES.push(...await memosWaitingNotice(flags));
+    }
+    PENDING_NOTICES.push(...await outdatedNotice());
     switch (command) {
         case 'init':
             cmdInit(flags);
@@ -4209,13 +4418,18 @@ async function main() {
             break;
         default: die(`unknown command '${command}' — run \`octwin help\``);
     }
-    // Trailing, fail-silent, TTY-only notices. KB-drift only after commands that
-    // already hit the platform (so it's one extra tiny GET, never a new call on
-    // offline paths); CLI-upgrade always.
-    if (commandTouchesPlatform(command, flags))
-        await notifyIfKbStale(flags);
-    if (commandTouchesPlatform(command, flags))
-        await notifyIfMemosWaiting(flags);
-    await notifyIfOutdated();
+    flushNotices();
 }
-main().catch((err) => die(err?.message ?? String(err)));
+main().catch((err) => {
+    // `CliExit` is our own controlled stop — the message is already printed and the notices already
+    // flushed. Setting `exitCode` rather than calling `process.exit` is the whole point: the process
+    // ends when the event loop drains, which is the only teardown that does not abort on Windows
+    // after the notice polls have opened sockets. See `exitNow`.
+    if (err instanceof CliExit) {
+        process.exitCode = err.code;
+        return;
+    }
+    console.error(`✗ ${err?.message ?? String(err)}`);
+    flushNotices();
+    process.exitCode = 1;
+});

package/dist/lib/render-check.js

@@ -58,6 +58,23 @@ export function loadAllowedRenderKeys(packDir) {
     }
     return { lookup, keys: out, nested };
 }
+/** The tap verbs, in the order the platform's compiler picks them. */
+const ON_SELECT_VERBS = ['invoke', 'resume', 'reply', 'agent'];
+/**
+ * `{ if, then, else }` — mirrors `isIfFragment` in the platform's
+ * `interpreter/render-resolver.ts` and `schemas/render.ts`. Three copies is two too
+ * many, but this package is deliberately dependency-free from `src/platform`; the
+ * predicate is identical and `render-check.parity.test.ts` is what keeps it so.
+ */
+function isIfFragment(v) {
+    return !!v && typeof v === 'object' && !Array.isArray(v) &&
+        typeof v.if === 'string' &&
+        Object.keys(v).every(k => k === 'if' || k === 'then' || k === 'else');
+}
+/** The `on_select` NODE itself — the one place an if-fragment is not evaluated. */
+function isOnSelectPath(at) {
+    return at === 'on_select' || at.endsWith('.on_select');
+}
 /**
  * Walk parsed YAML for objects carrying `render_intent` and report keys outside
  * that intent's allowed set. Walks the whole document rather than just `render:`
@@ -81,7 +98,50 @@ export function findRenderKeyViolations(doc, file, allowedByIntent, nestedByInte
         if (!value || typeof value !== 'object')
             return;
         const obj = value;
+        // An if-fragment stands in for the value it selects, so check its branches at the SAME
+        // path. Mirrors the platform's `checkNested`: without this the wrapper's own keys were
+        // reported against the slot it wraps, which rejected the one form that actually works.
+        if (isIfFragment(obj) && !isOnSelectPath(at)) {
+            for (const b of ['then', 'else']) {
+                if (obj[b] !== undefined)
+                    walkNested(obj[b], intent, at, sets, [...path, b]);
+            }
+            return;
+        }
+        // …and at an `on_select` node it is the reported bug, because runtime does not evaluate
+        // it there. One sentence naming the two forms that do work.
+        if (isIfFragment(obj) && isOnSelectPath(at)) {
+            findings.push({
+                file, path: [...path], intent, keys: [], allowed: ON_SELECT_VERBS, nestedAt: at,
+                note: `render_intent '${intent}' at '${at}': '{ if, then, else }' is not evaluated inside ` +
+                    `'on_select' — it fails at render time, not at validate. Wrap the WHOLE entry instead ` +
+                    `({ if, then: { title, on_select }, else: {…} }), or give each row its own on_select in ` +
+                    `data and point at it (on_select: '$item.on_select').`,
+            });
+            return;
+        }
         const allowed = sets[at];
+        // A missing verb is an absence, not an unknown key, so the key check below is blind to it —
+        // and the tap compiler throws on it at render. Only judged where the KB declares the slot,
+        // so a KB pulled before on_select was declared simply does not run this.
+        if (allowed && isOnSelectPath(at)) {
+            const present = ON_SELECT_VERBS.filter(v => obj[v] !== undefined);
+            if (present.length === 0) {
+                findings.push({
+                    file, path: [...path], intent, keys: [], allowed: ON_SELECT_VERBS, nestedAt: at,
+                    note: `render_intent '${intent}' at '${at}': 'on_select' needs exactly one of ` +
+                        `${ON_SELECT_VERBS.join(' / ')} — it has none, so the tap has no target and ` +
+                        `fails at render time.`,
+                });
+            }
+            else if (present.length > 1) {
+                findings.push({
+                    file, path: [...path], intent, keys: [], allowed: ON_SELECT_VERBS, nestedAt: at,
+                    note: `render_intent '${intent}' at '${at}': 'on_select' has more than one verb ` +
+                        `(${present.join(', ')}); only '${present[0]}' would run. Keep one.`,
+                });
+            }
+        }
         if (allowed) {
             const bad = Object.keys(obj).filter(k => !allowed.includes(k));
             if (bad.length)
@@ -126,6 +186,10 @@ export function findRenderKeyViolations(doc, file, allowedByIntent, nestedByInte
 /** One-line human message per finding. */
 export function describeRenderFinding(f) {
     const at = f.line != null ? `:${f.line}` : (f.path.length ? ` (${f.path.join('.')})` : '');
+    // A pre-worded finding (absent verb, if-fragment on a tap payload) carries its own sentence;
+    // the key-list template below cannot say either one.
+    if (f.note)
+        return `${f.file}${at}: ${f.note}`;
     if (f.keys.length === 0) {
         return `${f.file}${at}: unknown render_intent '${f.intent}' — known intents: ${f.allowed.join(', ')}`;
     }

package/package.json

@@ -1,37 +1,46 @@
-{
-  "name": "octwin-cli",
-  "version": "0.7.1",
-  "description": "Octwin external-pack developer CLI (by CEQUENS) — scaffold, validate, deploy, and check pure-YAML packs on your tenant.",
-  "type": "module",
-  "bin": {
-    "octwin": "dist/index.js"
-  },
-  "files": [
-    "dist",
-    "templates",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=22"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "yaml": "^2.6.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.7.0"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": ["octwin", "cequens", "cli", "whatsapp", "chatbot", "pack", "conversational-ai", "yaml"],
-  "author": "CEQUENS",
-  "homepage": "https://www.npmjs.com/package/octwin-cli",
-  "license": "MIT"
-}
+{
+  "name": "octwin-cli",
+  "version": "0.7.3",
+  "description": "Octwin external-pack developer CLI (by CEQUENS) — scaffold, validate, deploy, and check pure-YAML packs on your tenant.",
+  "type": "module",
+  "bin": {
+    "octwin": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "templates",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "yaml": "^2.6.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "octwin",
+    "cequens",
+    "cli",
+    "whatsapp",
+    "chatbot",
+    "pack",
+    "conversational-ai",
+    "yaml"
+  ],
+  "author": "CEQUENS",
+  "homepage": "https://www.npmjs.com/package/octwin-cli",
+  "license": "MIT"
+}