octwin-cli 0.7.3 → 0.8.1

package/CHANGELOG.md

@@ -5,6 +5,71 @@ Format: [Keep a Changelog](https://keepachangelog.com/) — newest first, bucket
 **Added · Changed · Deprecated · Removed · Fixed · Security**. The platform-wide view lives in the
 repo root [`CHANGELOG.md`](../../CHANGELOG.md); this file is the CLI-only cut that ships with the package.
 
+## [0.8.1] - 2026-08-27
+
+### Fixed
+- **Logging in made `platform-kb pull` WORSE.** The command preferred the tenant-scoped route
+  whenever a token was saved, and that route is guarded by `pack:deploy` — so a developer holding a
+  token without that scope got a **403 on a pull that succeeds with no token at all**. It is the
+  likeliest token a new developer holds: no console preset could even reach `pack:deploy` before
+  2026-08-26. `platform-kb` now always uses the anonymous route and never sends a credential.
+  `--token` is accepted and ignored so existing scripts keep working.
+
+  The platform serves the *same* bundle from all three of its views — its route file states the
+  payload is identical and tenant-independent — so the authed route returned nothing extra and the
+  credential could only ever subtract. The two reasons the old code gave did not survive checking:
+  "keeps the author's own instance the source of truth" is vacuous (both routes are the same
+  instance), and "works against platforms that predate the public rung" is a backward-compatibility
+  shim this codebase does not carry.
+- **The drift nudge now works without a token.** It polled through the same authed route, so an
+  author inspecting data with a narrow token was told, every time, that it *could not* check —
+  advice in place of the signal. Both the poll and the apology are gone: the poll is anonymous, so
+  it simply works.
+
+## [0.8.0] - 2026-08-27
+
+### Added
+- **Five new command families, closing the gap between what a token reaches and what the CLI can
+  ask.** A **Full CLI access** token spans the whole scope registry, and four of those domains had
+  no command at all — so the reach existed and there was nothing to type.
+  - `octwin automation [campaigns]` — every job the pack's declaration produced, with status,
+    interval and last result (matched / acted / errors), under a health line whose counts come from
+    SQL rather than from filtering the page (the job list is capped server-side, so a client-side
+    count would depend on the cap). Writes: `run` · `pause` · `resume` · `send <campaignId>`.
+  - `octwin integrations` — what the pack **declares** beside what is actually **configured**, in
+    one view, because a connection declared and never configured is the commonest reason an
+    integration silently never fires and neither list alone can show it. Plus
+    `preflight <key>` (diagnosis, no outbound call, `integrations:read`), `test <key>` (a live call,
+    `integrations:write`, exits 1 on failure), `deliveries [id]`, `retry|cancel|send-now <id>`,
+    and `events` for what arrived inbound.
+  - `octwin journeys [id] [--funnel|--overview|--goals|--trends|--cost|--definition] [--stage <id>]`
+    — the declared journeys, measured. Same flag grammar as `octwin analytics` on purpose: a journey
+    funnel and an entity funnel are the same question about different subjects. `--definition` is
+    the one view that works with no traffic.
+  - `octwin performance [--detail]` — the project's business indicators, each with its delta against
+    the previous window and the `why` naming the declaration it came from. Needs `records:read`, not
+    a `performance:*` scope (there is none), so a read-only token already reaches it.
+  - `octwin usage` — model calls, tokens and cost, by model / kind / agent / channel; project when
+    one is pinned, workspace otherwise. Needs no particular scope. **Model spend only** —
+    WhatsApp/Meta message billing is operator-only and outside the token scope registry, which the
+    output says rather than leaving as an absence.
+- **`octwin automation run|pause|resume|send` accept the declaration KEY.** The routes take a UUID
+  and answer a bare *"Malformed identifier in the URL"* 400 for anything else — but the key
+  (`cart_recovery_nudge`) is what the list prints and what the author wrote in their own YAML. The
+  key is now resolved against the list route, and an unknown one fails naming the keys that exist.
+
+### Fixed
+- **A body-less write sent `content-type: application/json` and no body, so Fastify answered a bare
+  `400 Bad Request`.** `apiSend` set the header unconditionally; every caller until now passed an
+  object, so the branch was dead and the bug latent. The first body-less POST (`automation run`) hit
+  it immediately. The header is now omitted when there is no body — rather than each caller learning
+  to pass `{}`, which is the per-site divergence that helper exists to prevent.
+- **Four URLs were exempt from the route guard.** `cli-routes.test.ts` reads a template literal in
+  the first argument position, so `apiGet(base, t)` — a bare identifier — was never checked. That
+  covered the `scheduling` engine-state and `agents` roster calls, and would have covered the new
+  `journeys`, `performance` and `usage` ones. All now spelled as literals: the guard checks **62**
+  URLs, up from 45.
+
 ## [0.7.3] - 2026-08-26
 
 ### Changed

package/README.md

@@ -80,6 +80,11 @@ octwin status               # "✓ live and current" once it's warm
 | `octwin analytics` | Stage-by-stage conversion for **any** entity declared with a `pipeline:` (`--overview` / `--milestones` / `--trends` / `--cost`; `--stage <id>` lists the records currently at a stage). Needs `records:read`. |
 | `octwin catalog` | Commerce products with price / availability / stock, plus the WhatsApp catalog binding. `--readiness` runs the Meta Graph checklist. Needs `catalog:read` + the `catalog` plan feature. |
 | `octwin scheduling` | The scheduling engine's state, or `--slots <resourceRecordId>` for the slots one bookable resource actually computes — how you verify the availability rules `deploy --seed` created. Needs `scheduling:read`. |
+| `octwin automation` | The jobs your pack's automation declaration produced — status, interval and each one's **last result** (matched / acted / errors) — under a health line counted in SQL. `campaigns` lists the campaigns. Jobs are derived from declarations, so there is no `create`. Needs `automation:read`. |
+| `octwin integrations` | What the pack **declares** beside what is actually **configured**, and it flags the gap: a connection declared and never configured is the commonest reason an integration silently never fires, and neither list alone shows it. `preflight <key>` diagnoses without calling out (`integrations:read`); `deliveries [id]` is the outbound log; `events` is what arrived inbound. Needs `integrations:read`. |
+| `octwin journeys` | The customer journeys your pack declares, measured: `--funnel` (default) · `--overview` · `--goals` · `--trends` · `--cost` · `--definition` (what was declared, works with no traffic), plus `--stage <id>` for the runs sitting at a stage now. Same flag grammar as `octwin analytics` — a journey funnel and an entity funnel are the same question about different subjects. Needs `journeys:read`. |
+| `octwin performance` | The project's business indicators — value produced, conversion, duration — each with its delta against the previous window and a `why` naming the declaration it came from. `--detail` adds the breakdown. Needs `records:read`, **not** a `performance:*` scope (there is none). |
+| `octwin usage` | Model calls, tokens and cost, by model / kind / agent / channel. Project when one is pinned, workspace otherwise. Needs no particular scope. **Model spend only** — WhatsApp/Meta message billing is operator-only and no API token can read it. |
 | `octwin media generate "<prompt>"` | AI-generate an image, store it as a public asset, and print its `MEDIA-` handle + serve URL. `--out` downloads the bytes (WhatsApp renders only `.png`/`.jpg`); `--json`. Pairs with `octwin chat --media` to drive media-collect flows. Needs `media:generate`. |
 | `octwin platform-kb pull` | Pull the platform's capability reference into `.octwin/platform-kb/` for the **`octwin-pack`** Claude Code authoring plugin: guides as markdown, plus **one JSON file per capability** (`primitives/record_list.json`, `render-intents/carousel.json`, `declarations/xrm.json`, …) and **three maps** — `INDEX.md` (the corpus, by family and size), `SYMBOLS.md` (every name → its exact file; grep this), `OUTLINE.md` (every heading with its line number). **No token needed** — the reference is served anonymously. `--if-stale` skips the download when your copy is current (cheap enough for every session); `--check` writes nothing and exits 0 current / 2 stale / 1 could-not-tell. |
 | `octwin test` | Alias for `octwin validate --remote` — the platform's full manifest + flow-DSL check. |
@@ -100,6 +105,8 @@ lists the verbs and their exact flags.
 | `octwin catalog` | `availability <sku> --to "in stock"` · `stock <sku> [--set-on-hand n]` |
 | `octwin scheduling` | `rules --resource <id>` · `rule add\|rm` · `exception add\|rm` |
 | `octwin agents` | `set <ref> [--model m] [--enable-tool t] [--disable-tool t]` |
+| `octwin automation` | `run <jobId>` · `pause\|resume <jobId>` · `send <campaignId>` — the id may be the declaration **key** the list prints; the CLI resolves it to the uuid the route wants |
+| `octwin integrations` | `test <key>` (a live call to the connection's `health:` operation) · `retry\|cancel\|send-now <deliveryId>` |
 
 `--set k=v` coerces JSON scalars (`--set rating=4.5` sends a number); `--fields-json` takes anything
 nested. Destructive verbs want `--force` rather than a prompt — the CLI is non-interactive by
@@ -134,6 +141,11 @@ octwin orders                                 # then: octwin orders <reference_i
 octwin analytics                              # then: octwin analytics <entity> [--stage <id>]
 octwin catalog                                # products + stock + the WhatsApp binding
 octwin scheduling --slots <resourceRecordId>  # the slots your availability rules compute
+octwin automation                             # did your declared jobs run, and what did they touch
+octwin integrations                           # declared vs configured — the silent-never-fires check
+octwin journeys                               # then: octwin journeys <id> [--overview|--goals|--cost]
+octwin performance                            # value, conversion and duration, each with its `why`
+octwin usage                                  # what your testing actually cost in model spend
 ```
 
 Three things worth knowing when you read the output: