octwin-cli 0.8.10 → 0.8.11

package/CHANGELOG.md

@@ -5,6 +5,22 @@ Format: [Keep a Changelog](https://keepachangelog.com/) — newest first, bucket
 **Added · Changed · Deprecated · Removed · Fixed · Security**. The platform-wide view lives in the
 repo root [`CHANGELOG.md`](../../CHANGELOG.md); this file is the CLI-only cut that ships with the package.
 
+## [0.8.11] - 2026-09-07
+
+### Fixed
+- **`octwin login` erased your own tooling report — the CLI was blanking what it had just
+  told the platform.** Two calls built their `authorization` header by hand instead of going
+  through `authHeaders`: `login`'s post-save "here's what your token reaches" echo, and
+  `chat`'s tenant/project derivation. Both authenticate, so both stamp the token's client
+  report (added in 0.8.9) — and a hand-built header stamps **NULL**, wiping the CLI version
+  and reference hash the platform had recorded.
+
+  Caught within an hour of 0.8.9 reaching staging: a workspace reported `0.8.9 · reference
+  current` at 12:16 and read `not reported` at 12:34. That looked exactly like the documented
+  "the column holds what ran LAST" behaviour and was really the CLI erasing its own row.
+  `cli-routes.test.ts` now fails on any hand-built bearer header, with a non-vacuity floor —
+  this package sits outside the repo's eslint scope, so a text guard is the only rung available.
+
 ## [0.8.10] - 2026-09-07
 
 ### Fixed

package/dist/index.js

@@ -1297,7 +1297,11 @@ async function saveLogin(url, token) {
     // so a fresh token self-identifies without a second `octwin whoami`. A network
     // failure never fails the save — the token is stored regardless.
     try {
-        const res = await fetch(`${url}/api/self/t/whoami`, { headers: { authorization: `Bearer ${token}` } });
+        // `authHeaders`, not a hand-built `authorization` — this call authenticates, so it
+        // STAMPS the token's client report (migration 055), and a hand-built header stamps
+        // NULL. Measured 2026-09-07: that blanked a caller who was on a reporting CLI, so
+        // `octwin login` erased the author's own tooling row. Guarded in `cli-routes.test.ts`.
+        const res = await fetch(`${url}/api/self/t/whoami`, { headers: authHeaders({ url, token }) });
         if (res.ok) {
             const j = await res.json();
             const scopes = Array.isArray(j.scopes) && j.scopes.length ? ` · scopes: ${j.scopes.join(', ')}` : '';
@@ -3053,8 +3057,11 @@ async function cmdChat(flags) {
         const token = raw.token;
         if (token) {
             try {
+                // `authHeaders` carries the tenant override itself, and — the reason this is not
+                // hand-built — it carries the client report. An authenticating call that skips it
+                // stamps NULL over the token's reported CLI + reference. See `cli-routes.test.ts`.
                 const who = await fetch(`${url}/api/self/t/whoami`, {
-                    headers: { authorization: `Bearer ${token}`, ...(tenant ? { 'x-octwin-tenant': tenant } : {}) },
+                    headers: authHeaders({ url, token, ...(tenant ? { tenant } : {}) }),
                 });
                 if (who.ok) {
                     const j = await who.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "octwin-cli",
-  "version": "0.8.10",
+  "version": "0.8.11",
   "description": "Octwin external-pack developer CLI (by CEQUENS) — scaffold, validate, deploy, and check pure-YAML packs on your tenant.",
   "type": "module",
   "bin": {