learn-cli 0.5.2__tar.gz → 0.5.3__tar.gz

{learn_cli-0.5.2 → learn_cli-0.5.3}/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/). This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.3] - 2026-07-11
+
+### Added
+
+- Phase-2 signed-in tier provisioned + deployed: KV namespace SESSIONS + D1 learn-ledger (schema applied), GITHUB_CLIENT_ID wired, SESSION_SECRET + GITHUB_CLIENT_SECRET set as worker secrets. learn-api now serves the full stack (sessions, ledger, tutoring broker) on the same agentculture.org/learn/* route.
+
+### Fixed
+
+- Worker OAuth login built `redirect_uri` from the bare origin (`https://agentculture.org/api/auth/callback`), dropping the `/learn` zone-mount prefix — GitHub would reject the web flow on redirect_uri mismatch and the bare callback would miss the worker route entirely. `handleLogin` now derives the callback from `APP_URL` via `callbackUrl()`; regression test asserts the `/learn` prefix.
+
 ## [0.5.2] - 2026-07-11
 
 ### Added

{learn_cli-0.5.2 → learn_cli-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: learn-cli
-Version: 0.5.2
+Version: 0.5.3
 Summary: A CLI, MCP server, and web front for learning — a hosted site where humans and agents learn a subject step by step. Fronts the french-cli and spanish-cli language tutors, and generalizes to other learnable domains such as leading teams of agents. The learn command is the local operator surface and how agents drive it.
 Project-URL: Homepage, https://github.com/agentculture/learn-cli
 Project-URL: Issues, https://github.com/agentculture/learn-cli/issues

{learn_cli-0.5.2 → learn_cli-0.5.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "learn-cli"
-version = "0.5.2"
+version = "0.5.3"
 description = "A CLI, MCP server, and web front for learning — a hosted site where humans and agents learn a subject step by step. Fronts the french-cli and spanish-cli language tutors, and generalizes to other learnable domains such as leading teams of agents. The learn command is the local operator surface and how agents drive it."
 readme = "README.md"
 license = "Apache-2.0"

{learn_cli-0.5.2 → learn_cli-0.5.3}/uv.lock

@@ -474,7 +474,7 @@ wheels = [
 
 [[package]]
 name = "learn-cli"
-version = "0.5.2"
+version = "0.5.3"
 source = { editable = "." }
 dependencies = [
     { name = "agentfront", extra = ["mcp"] },

{learn_cli-0.5.2 → learn_cli-0.5.3}/workers/learn-api/src/index.js

@@ -125,7 +125,7 @@ function handleHealth(env) {
 function handleLogin(request, env) {
   requireConfig(env, "GITHUB_CLIENT_ID");
   const url = new URL(request.url);
-  const redirectUri = `${publicOrigin(env, url)}/api/auth/callback`;
+  const redirectUri = callbackUrl(env, url);
   const state = crypto.randomUUID();
   return redirect(authorizeUrl(env, redirectUri, state), {
     "Set-Cookie": cookie("oauth_state", state, { maxAge: 600, sameSite: "Lax" }),
@@ -311,6 +311,16 @@ function publicOrigin(env, url) {
   return env.PUBLIC_URL ? env.PUBLIC_URL.replace(/\/+$/, "") : url.origin;
 }
 
+// The GitHub OAuth callback URL. It MUST carry the /learn zone-mount prefix so
+// it (a) matches the GitHub app's registered callback and (b) routes back to
+// THIS worker (agentculture.org/learn/*) rather than org's Pages site at the
+// bare origin. APP_URL is the mount root (".../learn/") and the callback lives
+// under it; fall back to origin + /learn/ when APP_URL is unset (local/dev).
+function callbackUrl(env, url) {
+  const base = (env.APP_URL || `${publicOrigin(env, url)}/learn/`).replace(/\/+$/, "");
+  return `${base}/api/auth/callback`;
+}
+
 async function readJson(request) {
   try {
     return await request.json();

{learn_cli-0.5.2 → learn_cli-0.5.3}/workers/learn-api/test/worker.test.js

@@ -281,6 +281,17 @@ test("GET /api/auth/login redirects to GitHub with a state cookie", async () =>
   assert.ok(res.headers.getSetCookie().some((c) => c.startsWith("oauth_state=")));
 });
 
+test("login redirect_uri carries the /learn mount prefix (matches the GitHub app callback)", async () => {
+  // Regression: the callback must include /learn or GitHub rejects the flow
+  // (redirect_uri mismatch) AND the bare-origin callback would miss this
+  // worker's zone route and hit org's Pages site instead.
+  const env = makeEnv({ APP_URL: "https://agentculture.org/learn/" });
+  const res = await call(env, new Request(`${BASE}/learn/api/auth/login`));
+  assert.equal(res.status, 302);
+  const redirectUri = new URL(res.headers.get("Location")).searchParams.get("redirect_uri");
+  assert.equal(redirectUri, "https://agentculture.org/learn/api/auth/callback");
+});
+
 test("GET /api/auth/callback exchanges code, upserts learner, sets session", async () => {
   const fetchStub = makeFetchStub({
     [GH.token]: () => jsonResp({ access_token: "gho_web", token_type: "bearer" }),

{learn_cli-0.5.2 → learn_cli-0.5.3}/workers/learn-api/wrangler.toml

@@ -35,9 +35,9 @@ routes = [
 # (an OpenAI-shaped HTTP API), NEVER a bespoke provider SDK. The broker only
 # ever POSTs JSON to this URL. Leave it unset to disable tutoring (broker 503s).
 [vars]
-# GITHUB_CLIENT_ID is public; still REPLACE_ME until the GitHub OAuth app exists
-# (needed only for the signed-in tier — see README "Phase 2").
-GITHUB_CLIENT_ID = "REPLACE_ME_github_oauth_client_id"
+# GITHUB_CLIENT_ID is public (the OAuth/GitHub-App client id). The matching
+# GITHUB_CLIENT_SECRET is set via `wrangler secret put`, never committed.
+GITHUB_CLIENT_ID = "Ov23liX8uNduVkEqVeQB"
 PUBLIC_URL   = "https://agentculture.org"          # origin used to build the OAuth callback
 APP_URL      = "https://agentculture.org/learn/"   # where the web callback redirects post-login
 CORS_ORIGIN  = "https://agentculture.org"          # allow the /learn site to call the API with creds
@@ -56,8 +56,8 @@ PAGES_ORIGIN = "https://agentculture-learn.pages.dev"  # static-site origin the
 # codes. Create with: wrangler kv namespace create SESSIONS
 [[kv_namespaces]]
 binding = "SESSIONS"
-id = "REPLACE_ME_kv_namespace_id"
-preview_id = "REPLACE_ME_kv_preview_namespace_id"
+id = "9b32092755154bb5a1a72e1b92102254"
+preview_id = "11ce3873085a4cee89fb791e0be901ab"
 
 # --- D1: learner ledger -----------------------------------------------------
 # learners (id, display_name, state) + records (append-only recorded results).
@@ -66,7 +66,7 @@ preview_id = "REPLACE_ME_kv_preview_namespace_id"
 [[d1_databases]]
 binding = "DB"
 database_name = "learn-ledger"
-database_id = "REPLACE_ME_d1_database_id"
+database_id = "c32b7bf6-b0a8-4c22-86f7-b50b3aa22a2e"
 
 # --- Observability ----------------------------------------------------------
 [observability]