learn-cli 0.5.1__tar.gz → 0.5.3__tar.gz

{learn_cli-0.5.1 → learn_cli-0.5.3}/.gitignore

@@ -232,3 +232,6 @@ skills.local.yaml
 # devague working state (not committed by default)
 .devague/reviews/
 .claude/settings.json
+
+# wrangler local state (created by `wrangler pages deploy` at repo root)
+.wrangler/

{learn_cli-0.5.1 → learn_cli-0.5.3}/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/). This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.3] - 2026-07-11
+
+### Added
+
+- Phase-2 signed-in tier provisioned + deployed: KV namespace SESSIONS + D1 learn-ledger (schema applied), GITHUB_CLIENT_ID wired, SESSION_SECRET + GITHUB_CLIENT_SECRET set as worker secrets. learn-api now serves the full stack (sessions, ledger, tutoring broker) on the same agentculture.org/learn/* route.
+
+### Fixed
+
+- Worker OAuth login built `redirect_uri` from the bare origin (`https://agentculture.org/api/auth/callback`), dropping the `/learn` zone-mount prefix — GitHub would reject the web flow on redirect_uri mismatch and the bare callback would miss the worker route entirely. `handleLogin` now derives the callback from `APP_URL` via `callbackUrl()`; regression test asserts the `/learn` prefix.
+
+## [0.5.2] - 2026-07-11
+
+### Added
+
+- Phase-1 (signed-out) production deploy of agentculture.org/learn: Cloudflare Pages project agentculture-learn + proxy Worker owning the agentculture.org/learn/* zone route. Signed-out tour, all subject/story pages, and the 401 resource-gate are live; verified 38/38 by the LIVE_ORIGIN launch gate.
+- workers/learn-api/wrangler.signedout.toml — the committed Phase-1 config (proxy-only: route + PAGES_ORIGIN, no KV/D1/secrets).
+
+### Changed
+
+- workers/learn-api/README.md: document the two-phase go-live (signed-out live vs signed-in pending) and the exact token permissions each phase needs (Pages+Workers Scripts for Phase 1; +KV+D1 for Phase 2).
+
+### Fixed
+
+- wrangler.toml: moved the routes array above the [vars] table. Under [vars], TOML scoped it as vars.routes and wrangler silently bound no route (No targets deployed).
+
 ## [0.5.1] - 2026-07-11
 
 ### Fixed

{learn_cli-0.5.1 → learn_cli-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: learn-cli
-Version: 0.5.1
+Version: 0.5.3
 Summary: A CLI, MCP server, and web front for learning — a hosted site where humans and agents learn a subject step by step. Fronts the french-cli and spanish-cli language tutors, and generalizes to other learnable domains such as leading teams of agents. The learn command is the local operator surface and how agents drive it.
 Project-URL: Homepage, https://github.com/agentculture/learn-cli
 Project-URL: Issues, https://github.com/agentculture/learn-cli/issues

{learn_cli-0.5.1 → learn_cli-0.5.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "learn-cli"
-version = "0.5.1"
+version = "0.5.3"
 description = "A CLI, MCP server, and web front for learning — a hosted site where humans and agents learn a subject step by step. Fronts the french-cli and spanish-cli language tutors, and generalizes to other learnable domains such as leading teams of agents. The learn command is the local operator surface and how agents drive it."
 readme = "README.md"
 license = "Apache-2.0"

{learn_cli-0.5.1 → learn_cli-0.5.3}/uv.lock

@@ -474,7 +474,7 @@ wheels = [
 
 [[package]]
 name = "learn-cli"
-version = "0.5.1"
+version = "0.5.3"
 source = { editable = "." }
 dependencies = [
     { name = "agentfront", extra = ["mcp"] },

{learn_cli-0.5.1 → learn_cli-0.5.3}/workers/learn-api/README.md

@@ -64,18 +64,43 @@ wrangler dev         # serves http://localhost:8787
 For `wrangler dev`, put non-secret vars in `wrangler.toml` and provide dev
 secrets in a git-ignored `.dev.vars` file (see below).
 
-## Provisioning (operator steps still owed)
+## Deploy status: two phases
 
-These steps are done once, by the operator, before the first deploy. Nothing
-here is committed.
+The go-live is staged. **Phase 1 (signed-out) is LIVE** at
+<https://agentculture.org/learn/> (deployed 2026-07-11); **Phase 2 (signed-in)
+is pending** two operator-held credentials.
+
+| | Phase 1 — signed-out (LIVE) | Phase 2 — signed-in (pending) |
+| --- | --- | --- |
+| Config | [`wrangler.signedout.toml`](wrangler.signedout.toml) | [`wrangler.toml`](wrangler.toml) |
+| Serves | Static `/learn/*` proxied to Pages; `/api/*` returns 401 | + sessions, ledger, tutoring |
+| KV / D1 | none | KV `SESSIONS` + D1 `learn-ledger` |
+| Secrets | none | `SESSION_SECRET`, `GITHUB_CLIENT_SECRET`, `INFERENCE_TOKEN` |
+| Token perms | Cloudflare Pages: Edit **+** Workers Scripts: Edit | **+** Workers KV Storage: Edit **+** D1: Edit |
+| Deploy | `wrangler deploy -c wrangler.signedout.toml` | `wrangler deploy` |
+
+The signed-out tier touches no storage and spends no inference — `/api/me` and
+`POST /api/tutor` return `401` *before* any KV/D1 access (proven live by the
+launch gate's "signed-out fires ONLY GET /api/me" walk). That is why Phase 1
+deploys with a Pages+Workers token and nothing else.
+
+**Phase 1 was deployed with the repo's `.env` token, which carries Pages: Edit
+and Workers Scripts: Edit but NOT KV/D1.** To do Phase 2 self-serve, that token
+needs **Workers KV Storage: Edit** and **D1: Edit** added (or swap in a token
+that has them).
+
+## Provisioning Phase 2 (signed-in)
+
+These steps are done once, by the operator, before the signed-in deploy.
+Nothing here is committed.
 
 ### 1. Create the GitHub OAuth app
 
 Create an OAuth app at
 `https://github.com/settings/developers` (or in the AgentCulture org):
 
-- **Authorization callback URL:** `https://<worker-host>/api/auth/callback`
-  (e.g. the route mounted under `agentculture.org/learn`).
+- **Authorization callback URL:**
+  `https://agentculture.org/learn/api/auth/callback` (the live zone route).
 - **Enable Device Flow** — required for the CLI/MCP device sign-in (t12).
 - Requested scope is `read:user` only. Do **not** request `user:email`; the API
   never reads or stores email.
@@ -93,7 +118,16 @@ wrangler d1 execute learn-ledger --file schema.sql
 
 Copy the returned ids into `wrangler.toml` (replace the `REPLACE_ME_*`
 placeholders for `id`, `preview_id`, and `database_id`), and set
-`GITHUB_CLIENT_ID` there too (it is public).
+`GITHUB_CLIENT_ID` there too (it is public). The route + `PUBLIC_URL` /
+`APP_URL` / `CORS_ORIGIN` / `PAGES_ORIGIN` vars are already filled in
+`wrangler.toml` from the live Phase-1 deploy.
+
+Apply the schema to the **remote** D1 (the `--local` form only touches the
+`wrangler dev` SQLite):
+
+```bash
+wrangler d1 execute learn-ledger --remote --file schema.sql
+```
 
 ### 3. Set secrets
 
@@ -128,12 +162,14 @@ INFERENCE_TOKEN = "..."
 ### 4. Deploy
 
 ```bash
-wrangler deploy
+wrangler deploy   # uses wrangler.toml — full stack, same /learn/* route
 ```
 
-Then mount the Worker under the `agentculture.org/learn` zone via the
-operator-owned Cloudflare routing (coordinated with the `org` / cultureflare
-path — the same route that fronts the Pages site).
+The `agentculture.org/learn/*` zone route is already live (Phase 1) and is
+declared in `wrangler.toml`, so this deploy upgrades the *same* worker in place
+— the route does not move. Confirm the signed-in path end-to-end afterward
+(`GET /learn/api/me` with a real session cookie should `200`), then merge org's
+Learn-nav link to open public discovery.
 
 ## Endpoint shapes for downstream waves
 

{learn_cli-0.5.1 → learn_cli-0.5.3}/workers/learn-api/src/index.js

@@ -125,7 +125,7 @@ function handleHealth(env) {
 function handleLogin(request, env) {
   requireConfig(env, "GITHUB_CLIENT_ID");
   const url = new URL(request.url);
-  const redirectUri = `${publicOrigin(env, url)}/api/auth/callback`;
+  const redirectUri = callbackUrl(env, url);
   const state = crypto.randomUUID();
   return redirect(authorizeUrl(env, redirectUri, state), {
     "Set-Cookie": cookie("oauth_state", state, { maxAge: 600, sameSite: "Lax" }),
@@ -311,6 +311,16 @@ function publicOrigin(env, url) {
   return env.PUBLIC_URL ? env.PUBLIC_URL.replace(/\/+$/, "") : url.origin;
 }
 
+// The GitHub OAuth callback URL. It MUST carry the /learn zone-mount prefix so
+// it (a) matches the GitHub app's registered callback and (b) routes back to
+// THIS worker (agentculture.org/learn/*) rather than org's Pages site at the
+// bare origin. APP_URL is the mount root (".../learn/") and the callback lives
+// under it; fall back to origin + /learn/ when APP_URL is unset (local/dev).
+function callbackUrl(env, url) {
+  const base = (env.APP_URL || `${publicOrigin(env, url)}/learn/`).replace(/\/+$/, "");
+  return `${base}/api/auth/callback`;
+}
+
 async function readJson(request) {
   try {
     return await request.json();

{learn_cli-0.5.1 → learn_cli-0.5.3}/workers/learn-api/test/worker.test.js

@@ -281,6 +281,17 @@ test("GET /api/auth/login redirects to GitHub with a state cookie", async () =>
   assert.ok(res.headers.getSetCookie().some((c) => c.startsWith("oauth_state=")));
 });
 
+test("login redirect_uri carries the /learn mount prefix (matches the GitHub app callback)", async () => {
+  // Regression: the callback must include /learn or GitHub rejects the flow
+  // (redirect_uri mismatch) AND the bare-origin callback would miss this
+  // worker's zone route and hit org's Pages site instead.
+  const env = makeEnv({ APP_URL: "https://agentculture.org/learn/" });
+  const res = await call(env, new Request(`${BASE}/learn/api/auth/login`));
+  assert.equal(res.status, 302);
+  const redirectUri = new URL(res.headers.get("Location")).searchParams.get("redirect_uri");
+  assert.equal(redirectUri, "https://agentculture.org/learn/api/auth/callback");
+});
+
 test("GET /api/auth/callback exchanges code, upserts learner, sets session", async () => {
   const fetchStub = makeFetchStub({
     [GH.token]: () => jsonResp({ access_token: "gho_web", token_type: "bearer" }),

learn_cli-0.5.3/workers/learn-api/wrangler.signedout.toml

@@ -0,0 +1,42 @@
+# wrangler config — PHASE 1 (signed-out) deploy of the learn API Worker.
+#
+# This is the config that is LIVE in production today (deployed 2026-07-11).
+# It stands up the whole SIGNED-OUT experience at agentculture.org/learn:
+# the worker owns the /learn/* zone route and reverse-proxies every non-API
+# path to the Cloudflare Pages origin (PAGES_ORIGIN). The signed-out tour is
+# fully static; the resource-gated API routes (/api/me, /api/tutor, …) return
+# 401 WITHOUT ever touching storage, so this deploy needs NO KV, NO D1, and
+# NO secrets. It requires only two token permissions: Cloudflare Pages: Edit
+# (for the Pages project) and Workers Scripts: Edit (for this worker + route).
+#
+# Deploy with:
+#   wrangler deploy -c wrangler.signedout.toml
+#
+# PHASE 2 (signed-in) uses the full ./wrangler.toml instead — it adds the KV
+# namespace, the D1 ledger, the GitHub OAuth client id, and the secrets. That
+# deploy additionally needs Workers KV Storage: Edit + D1: Edit on the token,
+# and the GitHub OAuth app must exist first. See README.md "Provisioning".
+
+name = "learn-api"
+main = "src/index.js"
+compatibility_date = "2024-11-01"
+workers_dev = false
+
+# Top-level key — MUST precede [vars] (see the gotcha note in wrangler.toml).
+routes = [
+  { pattern = "agentculture.org/learn/*", zone_name = "agentculture.org" },
+  { pattern = "agentculture.org/learn", zone_name = "agentculture.org" },
+]
+
+[vars]
+# Placeholder client id: harmless in phase 1. The sign-in button is only
+# reachable by direct navigation (org's Learn nav link is held until phase 2),
+# so a non-functional OAuth start has no public surface yet.
+GITHUB_CLIENT_ID = "REPLACE_ME_github_oauth_client_id"
+PUBLIC_URL   = "https://agentculture.org"
+APP_URL      = "https://agentculture.org/learn/"
+CORS_ORIGIN  = "https://agentculture.org"
+PAGES_ORIGIN = "https://agentculture-learn.pages.dev"
+
+[observability]
+enabled = true

{learn_cli-0.5.1 → learn_cli-0.5.3}/workers/learn-api/wrangler.toml

@@ -15,27 +15,34 @@ compatibility_date = "2024-11-01"
 # Node-compat is not required — the Worker uses only Web-standard APIs
 # (fetch, Request/Response, crypto.subtle, btoa/atob). Keep the bundle lean.
 
+# --- Zone route (the same-origin /learn mount) -------------------------------
+# Cloudflare Pages cannot be mounted at a path, so this ONE worker owns
+# agentculture.org/learn/*: /learn/api/* is handled here, everything else
+# proxies to PAGES_ORIGIN (which serves the site under /learn/ too).
+#
+# GOTCHA: `routes` is a TOP-LEVEL key and MUST appear ABOVE the [vars] table.
+# Placed after [vars], TOML scopes it as `vars.routes` and wrangler silently
+# ignores it ("No targets deployed") — the worker uploads but binds no route.
+# This block is live in production (deployed 2026-07-11); the signed-out mount
+# is served by exactly these two patterns.
+routes = [
+  { pattern = "agentculture.org/learn/*", zone_name = "agentculture.org" },
+  { pattern = "agentculture.org/learn", zone_name = "agentculture.org" },
+]
+
 # --- Non-secret vars -------------------------------------------------------
 # INFERENCE_URL points at the cloudai-cli / ec2bedrock-cli SERVED endpoint
 # (an OpenAI-shaped HTTP API), NEVER a bespoke provider SDK. The broker only
 # ever POSTs JSON to this URL. Leave it unset to disable tutoring (broker 503s).
 [vars]
-GITHUB_CLIENT_ID = "REPLACE_ME_github_oauth_client_id"
-# PUBLIC_URL   = "https://agentculture.org"          # origin used to build the OAuth callback
-# APP_URL      = "https://agentculture.org/learn/"   # where the web callback redirects post-login
-# CORS_ORIGIN  = "https://agentculture.org"          # allow the /learn site to call the API with creds
-# INFERENCE_URL = "https://<cloudai-or-ec2bedrock-served-endpoint>/v1/messages"
-# PAGES_ORIGIN = "https://agentculture-learn.pages.dev"  # static-site origin the /learn zone mount proxies to
-
-# --- Zone route (the same-origin /learn mount) -------------------------------
-# Cloudflare Pages cannot be mounted at a path, so this ONE worker owns
-# agentculture.org/learn/*: /learn/api/* is handled here, everything else
-# proxies to PAGES_ORIGIN (which serves the site under /learn/ too).
-# Uncomment once the zone is reachable from this account's token:
-# routes = [
-#   { pattern = "agentculture.org/learn/*", zone_name = "agentculture.org" },
-#   { pattern = "agentculture.org/learn", zone_name = "agentculture.org" },
-# ]
+# GITHUB_CLIENT_ID is public (the OAuth/GitHub-App client id). The matching
+# GITHUB_CLIENT_SECRET is set via `wrangler secret put`, never committed.
+GITHUB_CLIENT_ID = "Ov23liX8uNduVkEqVeQB"
+PUBLIC_URL   = "https://agentculture.org"          # origin used to build the OAuth callback
+APP_URL      = "https://agentculture.org/learn/"   # where the web callback redirects post-login
+CORS_ORIGIN  = "https://agentculture.org"          # allow the /learn site to call the API with creds
+PAGES_ORIGIN = "https://agentculture-learn.pages.dev"  # static-site origin the /learn zone mount proxies to
+# INFERENCE_URL = "https://<cloudai-or-ec2bedrock-served-endpoint>/v1/messages"  # unset ⇒ tutoring 503s
 
 # --- Secrets (NEVER committed) ---------------------------------------------
 # Set with: wrangler secret put <NAME>
@@ -49,8 +56,8 @@ GITHUB_CLIENT_ID = "REPLACE_ME_github_oauth_client_id"
 # codes. Create with: wrangler kv namespace create SESSIONS
 [[kv_namespaces]]
 binding = "SESSIONS"
-id = "REPLACE_ME_kv_namespace_id"
-preview_id = "REPLACE_ME_kv_preview_namespace_id"
+id = "9b32092755154bb5a1a72e1b92102254"
+preview_id = "11ce3873085a4cee89fb791e0be901ab"
 
 # --- D1: learner ledger -----------------------------------------------------
 # learners (id, display_name, state) + records (append-only recorded results).
@@ -59,7 +66,7 @@ preview_id = "REPLACE_ME_kv_preview_namespace_id"
 [[d1_databases]]
 binding = "DB"
 database_name = "learn-ledger"
-database_id = "REPLACE_ME_d1_database_id"
+database_id = "c32b7bf6-b0a8-4c22-86f7-b50b3aa22a2e"
 
 # --- Observability ----------------------------------------------------------
 [observability]