octwin-cli 0.8.9 → 0.8.11

package/CHANGELOG.md

@@ -5,6 +5,35 @@ Format: [Keep a Changelog](https://keepachangelog.com/) — newest first, bucket
 **Added · Changed · Deprecated · Removed · Fixed · Security**. The platform-wide view lives in the
 repo root [`CHANGELOG.md`](../../CHANGELOG.md); this file is the CLI-only cut that ships with the package.
 
+## [0.8.11] - 2026-09-07
+
+### Fixed
+- **`octwin login` erased your own tooling report — the CLI was blanking what it had just
+  told the platform.** Two calls built their `authorization` header by hand instead of going
+  through `authHeaders`: `login`'s post-save "here's what your token reaches" echo, and
+  `chat`'s tenant/project derivation. Both authenticate, so both stamp the token's client
+  report (added in 0.8.9) — and a hand-built header stamps **NULL**, wiping the CLI version
+  and reference hash the platform had recorded.
+
+  Caught within an hour of 0.8.9 reaching staging: a workspace reported `0.8.9 · reference
+  current` at 12:16 and read `not reported` at 12:34. That looked exactly like the documented
+  "the column holds what ran LAST" behaviour and was really the CLI erasing its own row.
+  `cli-routes.test.ts` now fails on any hand-built bearer header, with a non-vacuity floor —
+  this package sits outside the repo's eslint scope, so a text guard is the only rung available.
+
+## [0.8.10] - 2026-09-07
+
+### Fixed
+- **`octwin memos` failed with `400 project required` for a tenant-wide token — the exact
+  command the nudge tells you to run.** Every networked command can end with
+  *"✉ N memos from the platform — read them: `octwin memos`"*, and running precisely that with
+  an unpinned token answered a 400. Measured on staging: the nudge fired during a
+  `deploy --project …` (which supplied a project) and then named a command that could not run.
+
+  A memo has no project dimension to scope by — neither `pack_memos` nor `pack_memo_reads`
+  carries a `project_id`, and the read ledger is keyed by tenant — so the three call sites now
+  use `/api/self/t/memos`. Passing `--project` still works and is no longer needed.
+
 ## [0.8.9] - 2026-09-07
 
 ### Added

package/dist/index.js

@@ -776,7 +776,7 @@ async function memosWaitingNotice(flags) {
         // on a network failure. An observer that can terminate the CLI is not an observer: with an
         // unreachable platform this nudge would have failed the command it was only meant to annotate,
         // and now that the polls run BEFORE the command it would have failed it before it even ran.
-        const res = await fetch(`${t.url}/api/self/p/memos?meta=1`, {
+        const res = await fetch(`${t.url}/api/self/t/memos?meta=1`, {
             headers: authHeaders(t), signal: AbortSignal.timeout(2_000),
         });
         const status = res.status;
@@ -1297,7 +1297,11 @@ async function saveLogin(url, token) {
     // so a fresh token self-identifies without a second `octwin whoami`. A network
     // failure never fails the save — the token is stored regardless.
     try {
-        const res = await fetch(`${url}/api/self/t/whoami`, { headers: { authorization: `Bearer ${token}` } });
+        // `authHeaders`, not a hand-built `authorization` — this call authenticates, so it
+        // STAMPS the token's client report (migration 055), and a hand-built header stamps
+        // NULL. Measured 2026-09-07: that blanked a caller who was on a reporting CLI, so
+        // `octwin login` erased the author's own tooling row. Guarded in `cli-routes.test.ts`.
+        const res = await fetch(`${url}/api/self/t/whoami`, { headers: authHeaders({ url, token }) });
         if (res.ok) {
             const j = await res.json();
             const scopes = Array.isArray(j.scopes) && j.scopes.length ? ` · scopes: ${j.scopes.join(', ')}` : '';
@@ -2681,7 +2685,7 @@ async function cmdFeedback(flags) {
 async function cmdMemos(flags) {
     const t = resolveTarget(flags);
     const all = flags.all === true;
-    const { status, json } = await apiGet(`${t.url}/api/self/p/memos${all ? '?all=1' : ''}`, t);
+    const { status, json } = await apiGet(`${t.url}/api/self/t/memos${all ? '?all=1' : ''}`, t);
     if (status !== 200) {
         die(`could not read memos (HTTP ${status})${errDetail(json)}${authFailureDetail(status, t.url)}`);
     }
@@ -2711,7 +2715,7 @@ async function cmdMemos(flags) {
     if (!all) {
         const ids = rows.filter(m => !m.read_at).map(m => m.id);
         if (ids.length > 0) {
-            const res = await apiSend('POST', `${t.url}/api/self/p/memos/read`, { ids }, t);
+            const res = await apiSend('POST', `${t.url}/api/self/t/memos/read`, { ids }, t);
             // A failed ack is not a failed command — the author HAS read them. Say so rather
             // than dying after printing everything, and the nudge simply fires again.
             if (res.status !== 200)
@@ -3053,8 +3057,11 @@ async function cmdChat(flags) {
         const token = raw.token;
         if (token) {
             try {
+                // `authHeaders` carries the tenant override itself, and — the reason this is not
+                // hand-built — it carries the client report. An authenticating call that skips it
+                // stamps NULL over the token's reported CLI + reference. See `cli-routes.test.ts`.
                 const who = await fetch(`${url}/api/self/t/whoami`, {
-                    headers: { authorization: `Bearer ${token}`, ...(tenant ? { 'x-octwin-tenant': tenant } : {}) },
+                    headers: authHeaders({ url, token, ...(tenant ? { tenant } : {}) }),
                 });
                 if (who.ok) {
                     const j = await who.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "octwin-cli",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "Octwin external-pack developer CLI (by CEQUENS) — scaffold, validate, deploy, and check pure-YAML packs on your tenant.",
   "type": "module",
   "bin": {