octwin-cli 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -5,6 +5,27 @@ Format: [Keep a Changelog](https://keepachangelog.com/) — newest first, bucket
 **Added · Changed · Deprecated · Removed · Fixed · Security**. The platform-wide view lives in the
 repo root [`CHANGELOG.md`](../../CHANGELOG.md); this file is the CLI-only cut that ships with the package.
 
+## [0.8.1] - 2026-08-27
+
+### Fixed
+- **Logging in made `platform-kb pull` WORSE.** The command preferred the tenant-scoped route
+  whenever a token was saved, and that route is guarded by `pack:deploy` — so a developer holding a
+  token without that scope got a **403 on a pull that succeeds with no token at all**. It is the
+  likeliest token a new developer holds: no console preset could even reach `pack:deploy` before
+  2026-08-26. `platform-kb` now always uses the anonymous route and never sends a credential.
+  `--token` is accepted and ignored so existing scripts keep working.
+
+  The platform serves the *same* bundle from all three of its views — its route file states the
+  payload is identical and tenant-independent — so the authed route returned nothing extra and the
+  credential could only ever subtract. The two reasons the old code gave did not survive checking:
+  "keeps the author's own instance the source of truth" is vacuous (both routes are the same
+  instance), and "works against platforms that predate the public rung" is a backward-compatibility
+  shim this codebase does not carry.
+- **The drift nudge now works without a token.** It polled through the same authed route, so an
+  author inspecting data with a narrow token was told, every time, that it *could not* check —
+  advice in place of the signal. Both the poll and the apology are gone: the poll is anonymous, so
+  it simply works.
+
 ## [0.8.0] - 2026-08-27
 
 ### Added

package/dist/index.js

@@ -587,11 +587,12 @@ function diffKbIndex(prev, next) {
 }
 /**
  * Fetch the platform's KB identity (`?meta=1`) — the cheap poll behind both the
- * drift nudge and `--if-stale`. Returns null on anything that is not a clean
+ * drift nudge and `--if-stale`. Returns not-ok on anything that is not a clean
  * answer; the caller decides whether that is worth a word.
  *
- * `notAuthorized` is reported separately because it is the one failure with a
- * fix the author can act on.
+ * There is no `notAuthorized` case any more. `kbEndpoint` is anonymous, so this
+ * poll cannot be refused for lack of a scope — which used to be its most common
+ * failure, and the reason the drift nudge below carried a whole branch of advice.
  */
 async function fetchKbMeta(t, timeoutMs = 2_000) {
     const ep = kbEndpoint(t);
@@ -602,12 +603,12 @@ async function fetchKbMeta(t, timeoutMs = 2_000) {
             // socket checked out of the pool, and this poll runs on the way to a possible `exitNow` —
             // a held socket at exit is a pending libuv handle.
             await res.arrayBuffer().catch(() => undefined);
-            return { ok: false, notAuthorized: res.status === 401 || res.status === 403 };
+            return { ok: false };
         }
         return { ok: true, meta: await res.json() };
     }
     catch {
-        return { ok: false, notAuthorized: false };
+        return { ok: false };
     }
 }
 /** Nudge (to stderr) when the platform's capability KB has changed since the last
@@ -628,24 +629,20 @@ async function kbStaleNotice(flags) {
         const local = readLocalKb(packDir);
         if (!local?.content_hash)
             return []; // never pulled → the skill already says to pull
-        const t = resolveTargetOrNull(flags);
-        if (!t)
+        // URL only, deliberately: the KB poll is anonymous, so requiring a token here would
+        // silence the nudge for exactly the authors who most need it. This used to call
+        // `resolveTargetOrNull` (url AND token) against the tenant-scoped route, which needs
+        // `pack:deploy` — so an author inspecting data with a narrow (`records:read`-only)
+        // token got NO drift signal at all, silently, and a stale reference is precisely what
+        // makes an author invent a primitive from memory. The branch that apologised for that
+        // is gone with the cause; every remaining failure (offline, timeout, a platform
+        // serving no reference) stays silent, because observing must not break a command.
+        const t = readTarget(flags);
+        if (!t.url)
             return [];
         const polled = await fetchKbMeta(t);
-        if (!polled.ok) {
-            // The tenant-scoped meta poll needs `pack:deploy`, but this nudge rides on every
-            // networked command — so an author inspecting data with a narrow (`records:read`-only)
-            // token got NO drift signal at all, silently, and a stale reference is exactly what
-            // makes an author invent a primitive from memory. Say so once; stay silent for every
-            // other failure (offline, timeout, a platform without the route).
-            if (polled.notAuthorized) {
-                return [
-                    '\nⓘ can\'t check whether the platform capability reference drifted — that token lacks `pack:deploy`.',
-                    '  Check it without a token: octwin platform-kb --check   (or refresh: octwin platform-kb --token oct_…)',
-                ];
-            }
+        if (!polled.ok)
             return [];
-        }
         const meta = polled.meta;
         if (meta.content_hash && meta.content_hash !== local.content_hash) {
             // Per-entry summary (now that the index carries per-entry hashes) — the
@@ -1207,20 +1204,32 @@ function resolveTargetOrNull(flags) {
 /**
  * Where to read the platform capability reference from, and how.
  *
- * The KB is tenant-independent platform stdlib, and the platform now serves it
- * anonymously at `/api/public/octwin-platform-kb` precisely so a COLD START does
- * not need a login: `.octwin/` is gitignored, so a fresh clone — or a fresh
- * Claude Code session — has no reference at all, and an authoring agent's first
- * useful question came after a credential round-trip it had no way to satisfy.
+ * ALWAYS the anonymous route. The KB is tenant-independent platform stdlib, and
+ * the platform serves the SAME bundle from all three of its views -- its own
+ * route file says so twice ("THREE views of the SAME `getPlatformKbBundle()`";
+ * "the payload is identical") and forbids tenant data ever entering the reader.
+ * So the authed route returns nothing extra, and asking for a credential to read
+ * it can only ever subtract.
+ *
+ * It subtracted, measurably. This used to prefer the tenant-scoped route
+ * WHENEVER a token was saved, and that route is guarded by `pack:deploy` -- so a
+ * developer holding a token WITHOUT that scope got a 403 on a pull that would
+ * have succeeded with no token at all. Having logged in made the CLI strictly
+ * worse than not having logged in, on the very first command an author runs. No
+ * console preset could even reach `pack:deploy` before 2026-08-26, so that was
+ * the likeliest token a new developer held.
+ *
+ * The two arguments the old comment gave for preferring a token did not survive
+ * being checked: "keeps the author's own instance the source of truth" is
+ * vacuous (both routes are `t.url` -- the same instance), and "works against
+ * platforms that predate the public rung" is a backward-compatibility shim,
+ * which this codebase does not carry.
  *
- * A token still WINS when one is available: the tenant-scoped route is the one
- * that has always existed, it works against platforms that predate the public
- * rung, and using it keeps the author's own instance the source of truth.
+ * `--token` is still ACCEPTED here, and ignored, so a scripted `platform-kb pull
+ * --token …` keeps working instead of turning into an unknown-flag error.
  */
 function kbEndpoint(t) {
-    return t.token
-        ? { url: `${t.url}/api/self/t/octwin-platform-kb`, headers: authHeaders(t), anonymous: false }
-        : { url: `${t.url}/api/public/octwin-platform-kb`, headers: {}, anonymous: true };
+    return { url: `${t.url}/api/public/octwin-platform-kb`, headers: {} };
 }
 /** The raw resolution both wrappers share — may return empty url/token. */
 function readTarget(flags) {
@@ -1756,9 +1765,7 @@ async function cmdPlatformKb(flags) {
         const local = readLocalKb(packDir);
         const polled = await fetchKbMeta(t, 10_000);
         if (!polled.ok) {
-            console.error(polled.notAuthorized
-                ? '✗ cannot check — the platform refused the token, and this instance serves no anonymous reference.'
-                : `✗ cannot check — ${url} did not answer.`);
+            console.error(`✗ cannot check — ${url} did not answer, or serves no capability reference.`);
             exitNow(1);
         }
         const remote = polled.meta.content_hash;
@@ -1787,7 +1794,7 @@ async function cmdPlatformKb(flags) {
             return;
         }
     }
-    console.log(`→ Pulling the platform capability reference from ${url}${ep.anonymous ? ' (anonymous — no token needed for the reference)' : ''} …`);
+    console.log(`→ Pulling the platform capability reference from ${url} (no token needed for the reference) …`);
     const res = await fetchOrDie(ep.url, { headers: ep.headers }, 'platform-kb pull');
     const text = await res.text();
     if (!res.ok) {
@@ -5162,14 +5169,15 @@ octwin projects rm <slug> [--yes]
   INDEX.md (the corpus) · SYMBOLS.md (every name -> its file; grep this) ·
   OUTLINE.md (every heading with its line number).
 
-  NO TOKEN NEEDED — the reference is platform stdlib and is served anonymously.
-  A token is used when you have one (it also works against older platforms).
+  NO TOKEN NEEDED — the reference is platform stdlib and is served anonymously,
+  and this command never sends one. --token is accepted and ignored, so an older
+  script that passes it keeps working.
 
   --if-stale   poll the platform's content_hash first and skip the download when
                nothing changed. Cheap enough to run at the start of every session.
   --check      report only, write nothing. Exit 0 = current, 2 = stale or never
-               pulled, 1 = could not tell (offline / refused). For scripts and
-               agent loops that want to branch without parsing prose.`,
+               pulled, 1 = could not tell (offline / no reference served). For
+               scripts and agent loops that want to branch without parsing prose.`,
     test: `octwin test [--dir .]
   Alias for \`octwin validate --remote\` — the full platform check.`,
     memos: `octwin memos [--all] [--json]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "octwin-cli",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Octwin external-pack developer CLI (by CEQUENS) — scaffold, validate, deploy, and check pure-YAML packs on your tenant.",
   "type": "module",
   "bin": {