octwin-cli 0.8.6 → 0.8.8

package/CHANGELOG.md

@@ -5,6 +5,80 @@ Format: [Keep a Changelog](https://keepachangelog.com/) — newest first, bucket
 **Added · Changed · Deprecated · Removed · Fixed · Security**. The platform-wide view lives in the
 repo root [`CHANGELOG.md`](../../CHANGELOG.md); this file is the CLI-only cut that ships with the package.
 
+## [0.8.8] - 2026-09-06
+
+### Added
+- **`octwin login` can sign you in through a browser — no token is pasted anywhere.** Run it with
+  no `--token` and it prints an approval link:
+
+  ```
+    Open this link to approve:  https://app.octwin.ai/cli-login?code=WDJB-MJHT
+    Code shown on that page:    WDJB-MJHT
+  ```
+
+  A workspace admin opens it, checks which machine is asking, and clicks Approve; the CLI collects a
+  30-day token by itself and saves it exactly where `--token` would have. `octwin login --token oct_…`
+  is unchanged, and CI should still skip login entirely and set `PACK_PLATFORM_URL` + `PACK_TOKEN`.
+
+  **The wait is bounded and resumable, because this CLI is mostly driven by an agent.** An agent's
+  shell call is killed after about two minutes, and a wait that outlives its caller is worse than a
+  short one — the process dies mid-handshake and the code the human is still typing belongs to
+  nothing. So `login` waits 90 seconds, then exits **75** (`EX_TEMPFAIL`) with the handshake kept in
+  `~/.octwin/pending-login.json`; running it again resumes the **same** code, which the platform
+  keeps alive for ten minutes. `0` still means signed in and `1` still means failed, so an agent
+  branches on the exit code instead of parsing prose. `--wait <seconds>` overrides the 90 (`--wait 0`
+  prints the code and returns at once), and `--json` prints the same facts as an object.
+
+  **Approve only a link you opened because you ran the command.** The link carries the code
+  (RFC 8628 `verification_uri_complete`), so the click *is* the consent: approving a link somebody
+  sent you would connect their machine to your workspace. The console says so on the page. The code
+  is printed here too, and shown there, so you can always tell one request from another.
+
+  The pending handshake gets its own file rather than a new key in `credentials.json`: every value
+  in that file is a token, and its one reserved key (`default_url`) is collision-free only because a
+  platform url always contains `://`. A second value shape there would end that argument.
+
+- **A 401 now points at `octwin login`, not at the console.** With a 30-day browser token, renewing is
+  one command; the old hint sent people to mint a replacement by hand. Mint a token yourself if you
+  want a different lifetime — the console offers 30 / 90 days / a year / never.
+
+## [0.8.7] - 2026-09-06
+
+### Added
+- **`validate` now reads a map's KEYS, not only its values.** The declaration walker reported four
+  things — an unknown key, a missing `required` key, a wrong scalar type, a value outside a closed
+  `enum` — and every one of them is about a VALUE. But a map's keys carry meaning in several
+  declarations (`roles.yaml` grant resources and verbs, `xrm.yaml` entity names), and those keys had
+  no check at all. Rule 5 replays `propertyNames` — both the `enum` and the `pattern` form.
+
+  This is why publishing the RBAC vocabulary was worth doing. A pack author wrote `case:` where the
+  grant key is `record.case`, passed offline `validate` clean, and learned the truth one bad guess at
+  a time from `--remote` round-trips. They gave up on custom RBAC over it. The check now says
+  `not a valid key here — must be one of "record.case", …` before a deploy is attempted.
+
+  It stays inside the file's false-positive rule because it is a **faithful replay**: the same `enum`
+  membership and the same JS regex engine Zod itself runs, over a pattern the platform generated. A
+  pattern this engine cannot compile is treated like a combinator — walk away, do not guess.
+
+  Verified 2026-09-06 against the shipped binary: across all 23 marketplace packs rule 5 reports
+  **nothing**, with 10 of the 12 pulled declaration schemas carrying `propertyNames` (so the silence
+  is a result, not an unexercised branch). A deliberately broken key is caught on both branches — a
+  role named `Regional-Agent` against `^[a-z][a-z0-9_]*$`, and a grant key `case:` against an enum
+  vocabulary — each naming the file, the path and the rule it broke.
+
+### Fixed
+- **`deploy` had stopped printing its seed counts entirely.** `printDeploySuccess` read
+  `r.summary.records` / `.updated` / `.images` / `.rules` / `.failed`, but the deploy route's
+  `summary` is a run-log **string** (`"clinic v1.2.0 — {…}"`), not an object. So every field was
+  `undefined`, `parts` stayed empty, and the `if (parts.length)` guard turned *"I am reading the
+  wrong field"* into *"there was nothing to say"* — the block printed nothing and looked like a
+  deploy that simply seeded no rows. The counts have been on `r.seeded`, keyed by seed kind, and
+  `printSeedCounts` already renders them (filtering zeros, which is what makes a partial seed
+  legible). The dead block is gone and `printSeedCounts` is called instead.
+
+  Same shape as the bug 0.8.6 fixed in `validate`: *no data* and *no problem* rendering identically.
+  Two independent places in this CLI reached it within one week.
+
 ## [0.8.6] - 2026-09-04
 
 ### Changed

package/README.md

@@ -46,9 +46,10 @@ git init && git add -A && git commit -m "init pack"
 # 2. Author it — edit manifest.yaml, flows/tools/main.flow.yaml (+ its locale),
 #    and prompts/identity.md. Everything is pure YAML.
 
-# 3. Point it at your platform — one command, no config file
-#    (Octwin console → your workspace → API tokens → Generate)
-octwin login --url https://your-octwin.example.com --token oct_…
+# 3. Point it at your platform — one command, no config file.
+#    It prints a link; approve it in the console and it saves a 30-day token
+#    by itself. (Already have a token? add --token oct_…)
+octwin login --url https://your-octwin.example.com
 
 # 4. Validate → deploy → confirm it's live
 octwin validate
@@ -65,7 +66,7 @@ octwin status               # "✓ live and current" once it's warm
 | --- | --- |
 | `octwin init <dir>` | Scaffold a new pure-YAML pack into `<dir>` (writes a starter `manifest.yaml`, flow, prompt, `.gitignore` and `README.md` — pack content only). Options: `--id`, `--description`, `--display-name`. |
 | `octwin validate` | Check the pack locally (structure + pure-YAML rules). `--remote` runs **the same validation the platform runs to load your pack** — every declaration file (`xrm.yaml`, `scheduling.yaml`, `worklist.yaml`, `roles.yaml`, `automation.yaml`, `integrations.yaml`, `surveys.yaml`, `taps.yaml`, `commands.yaml`, `journeys/`, `messages.<lang>.yaml`), the cross-file checks between them, and the **flow lint** — conventions the schema can't express, like an `assign:` whose value is a quoted literal or a `$t()` key with no namespace. These need template expansion and the platform's own schemas, which only the server has, so a local ✓ does not cover them. A `--remote` ✓ and a successful deploy are now the same answer by construction, not by convention. |
-| `octwin login` | Save a deploy token for a platform URL **and make that URL the default target** (both stored in `~/.octwin/credentials.json`). `--url`, `--token`. |
+| `octwin login` | Sign in to a platform URL **and make it the default target** (both stored in `~/.octwin/credentials.json`). With no `--token` it prints a link to approve in the console, then collects a 30-day token itself — nothing is pasted. The wait is bounded and resumable: run it again to keep waiting on the same request. `--url`, `--token`, `--wait <seconds>`, `--json`. |
 | `octwin whoami` | Verify the saved/passed token is valid for a tenant. `--url`, `--tenant`. |
 | `octwin deploy` | Upload + install the pack onto your tenant's project. `--seed` also runs the pack's demo seed. Says **nothing** about the public marketplace unless asked: `--request-listing` submits the pack for operator review (needs `listing.public: true` in the manifest too), `--withdraw-listing` retracts. Reports the **listing verdict** whenever one exists. |
 | `octwin status` | Report what the platform has live for this pack — installed version, the **content sha** the instance loaded vs. the one the catalog holds (a redeploy of the *same* version changes it), its flows, and whether it is live on the public marketplace. |
@@ -164,10 +165,12 @@ Three things worth knowing when you read the output:
 holds pack content and nothing else, so the same repo deploys from any machine:
 
 ```bash
-octwin login --url https://your-octwin.example.com --token oct_…
+octwin login --url https://your-octwin.example.com              # approve in a browser
+octwin login --url https://your-octwin.example.com --token oct_…  # or bring your own token
 ```
 
-That stores the token *and* makes the URL your default target, in `~/.octwin/credentials.json`:
+Either way it stores the token *and* makes the URL your default target, in
+`~/.octwin/credentials.json`:
 
 ```jsonc
 {
@@ -176,6 +179,9 @@ That stores the token *and* makes the URL your default target, in `~/.octwin/cre
 }
 ```
 
+A browser sign-in in progress is held separately, in `~/.octwin/pending-login.json`, and is deleted
+as soon as the token arrives — the credentials file holds tokens only.
+
 Tenant and project need no setting at all — the **token carries its own tenant**, plus an optional
 project pin. `--tenant` / `--project` exist only as overrides (a multi-workspace human, or an
 unpinned token that must name a project).
@@ -195,9 +201,24 @@ variables (add `PACK_PROJECT` only if the token isn't pinned).
 ## Authentication
 
 You authenticate with a tenant-scoped **deploy token** (prefixed `oct_…`) — not a password and not
-an operator token. Generate it in the Octwin console (**your workspace → API tokens → Generate**).
-It is **least-privilege** (scope `pack:deploy`): it can deploy packs to your tenant but cannot
-manage members, billing, or other tenants, and it is revocable at any time.
+an operator token. It is **least-privilege** (scope `pack:deploy`): it can deploy packs to your
+tenant but cannot manage members, billing, or other tenants, and it is revocable at any time. A
+token can never mint another token, which is why approving a browser sign-in needs a *human*
+workspace admin.
+
+Two ways to get one:
+
+- **`octwin login` with no `--token`** prints an approval link. A workspace admin opens it, sees
+  which machine is asking, and clicks Approve; the CLI collects a 30-day token by polling. Nothing is
+  copied by hand, so no live credential passes through a chat window or an email. The wait is
+  bounded (90s) and **resumable** — run the command again to keep waiting on the same request, which
+  lives ten minutes. Exit code `75` means *still waiting*; `0` means signed in.
+  **Approve only a link you opened because you ran the command.** The link carries the code, so
+  clicking Approve on a link someone sent you would connect *their* machine to your workspace. The
+  code is printed too, and the page shows it, so you can always tell one request from another.
+- **Generate one yourself** in the Octwin console (**your workspace → API tokens → Generate**) and
+  pass it with `--token`. This is the way to pick narrower scopes or a different expiry, and the
+  way to get a token for CI.
 
 Add the optional **`media:generate`** scope to let a `--seed` deploy AI-generate seed images
 (for a demo record field like `photo: "generate:<prompt>"`); without it, such fields are seeded as