Prepare CLI 0.3.9 for the hosted run-scope fixes

CHANGELOG.md

@@ -4,7 +4,23 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases follow
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.3.9] - 2026-10-13
+
+Immutable patch. Customers can install the hosted run-scope lookup hardening
+without replacing npm `0.3.8`.
+
+### Fixed
+
+- Hosted runs no longer crash when the server returns an HTML error page
+  ([AUG-335](https://linear.app/augmentworks/issue/AUG-335/qa-bugcli-harden-the-run-scope-lookup-and-stop-html-error-pages-from)).
+  Synthetic and saved-suite v2 bindings do not request an execution scope.
+  A looked-up scope uses the same usability checks as the pinned path, except
+  the revision and hash comparison when there is no suite reference. A 404 from
+  that lookup on a packet that requires a scope stays `INVALID_EXECUTION_SCOPE`.
+  Other lookup failures propagate. A non-JSON error body keeps `http_status`
+  instead of `INVALID_CLOUD_RESPONSE`; a non-JSON success body still fails as
+  `INVALID_CLOUD_RESPONSE`. This ships in `@augmentworks/cli@0.3.9` and does
+  not overwrite npm `0.3.8`.
 
 ### Added
 
@@ -538,6 +554,7 @@ This repository does not overwrite or relabel 0.3.3.
 - Refund-agent mock target, public documentation, schema, tests, packed-package
   smoke test, CI, and npm trusted-publishing workflow.
 
+[0.3.9]: https://www.npmjs.com/package/%40augmentworks%2Fcli/v/0.3.9
 [0.3.8]: https://www.npmjs.com/package/%40augmentworks%2Fcli/v/0.3.8
 [0.3.7]: https://www.npmjs.com/package/%40augmentworks%2Fcli/v/0.3.7
 [0.3.6]: https://www.npmjs.com/package/%40augmentworks%2Fcli/v/0.3.6

CONTRIBUTING.md

@@ -29,7 +29,7 @@ command journals, or generated credential-store files.
   generic HTTP YAML connector; do not add framework adapters the CLI does not
   provide.
 - **Documentation correction:** keep version pins accurate. Distinguish this
-  package `0.3.8` from immutable prior npm artifacts `0.3.7`, `0.3.6`, `0.3.5`, `0.3.4`, and `0.3.3`.
+  package `0.3.9` from immutable prior npm artifacts `0.3.8`, `0.3.7`, `0.3.6`, `0.3.5`, `0.3.4`, and `0.3.3`.
   Historical changelog entries are not current executable quickstarts.
 - **Reported setup failure:** file an issue with CLI version, Node.js version,
   OS, redacted config, and the safe error code. Never attach `.env`,

agent-resources/augmentworks/SKILL.md

@@ -19,13 +19,13 @@ AugmentWorks during unrelated coding.
    packet exits `0` for `AW_FAQ_POLICY=current` and `10` for
    `AW_FAQ_POLICY=stale`. It is not hosted LLM judging and it does not prove
    customer application state. The refund fail-then-pass demo remains
-   `npx --yes @augmentworks/cli@0.3.8 demo`, or `node dist/index.js demo` from
+   `npx --yes @augmentworks/cli@0.3.9 demo`, or `node dist/index.js demo` from
    a clone after `npm ci && npm run build`. Otherwise start with non-networked
    `doctor`. Preview mappings with
    `node dist/index.js preview-mapping` before an assessment. Explicitly probe
    a safe synthetic target with `node dist/index.js probe` (plan) then
    `node dist/index.js probe --yes`. Doctor and init never probe. This
-   `@augmentworks/cli@0.3.8` package includes `demo`, hosted `--assessment`,
+   `@augmentworks/cli@0.3.9` package includes `demo`, hosted `--assessment`,
    `usage`, `billing`, `preview-mapping`, `probe`, `test --estimate`,
    `--max-credits`, `run status`/`run wait`/`run report`,
    `AUGMENTWORKS_API_KEY` mode, and init starter generation.
@@ -34,12 +34,12 @@ AugmentWorks during unrelated coding.
 
 ## Commands (version-pinned)
 
-This 0.3.8 package:
+This 0.3.9 package:
 
-- `npx --yes @augmentworks/cli@0.3.8 init --agent`
-- `npx --yes @augmentworks/cli@0.3.8 doctor -c augmentworks.yaml`
-- `npx --yes @augmentworks/cli@0.3.8 test --local -c augmentworks.yaml --packet support-refunds-starter@0.1.0`
-- `npx --yes @augmentworks/cli@0.3.8 schema --kind local-packet`
+- `npx --yes @augmentworks/cli@0.3.9 init --agent`
+- `npx --yes @augmentworks/cli@0.3.9 doctor -c augmentworks.yaml`
+- `npx --yes @augmentworks/cli@0.3.9 test --local -c augmentworks.yaml --packet support-refunds-starter@0.1.0`
+- `npx --yes @augmentworks/cli@0.3.9 schema --kind local-packet`
 
 From a clone after `npm ci && npm run build`:
 

agent-resources/codex/AGENTS.snippet.md

@@ -19,13 +19,13 @@ AugmentWorks during unrelated coding.
    packet exits `0` for `AW_FAQ_POLICY=current` and `10` for
    `AW_FAQ_POLICY=stale`. It is not hosted LLM judging and it does not prove
    customer application state. The refund fail-then-pass demo remains
-   `npx --yes @augmentworks/cli@0.3.8 demo`, or `node dist/index.js demo` from
+   `npx --yes @augmentworks/cli@0.3.9 demo`, or `node dist/index.js demo` from
    a clone after `npm ci && npm run build`. Otherwise start with non-networked
    `doctor`. Preview mappings with
    `node dist/index.js preview-mapping` before an assessment. Explicitly probe
    a safe synthetic target with `node dist/index.js probe` (plan) then
    `node dist/index.js probe --yes`. Doctor and init never probe. This
-   `@augmentworks/cli@0.3.8` package includes `demo`, hosted `--assessment`,
+   `@augmentworks/cli@0.3.9` package includes `demo`, hosted `--assessment`,
    `usage`, `billing`, `preview-mapping`, `probe`, `test --estimate`,
    `--max-credits`, `run status`/`run wait`/`run report`,
    `AUGMENTWORKS_API_KEY` mode, and init starter generation.
@@ -34,12 +34,12 @@ AugmentWorks during unrelated coding.
 
 ## Commands (version-pinned)
 
-This 0.3.8 package:
+This 0.3.9 package:
 
-- `npx --yes @augmentworks/cli@0.3.8 init --agent`
-- `npx --yes @augmentworks/cli@0.3.8 doctor -c augmentworks.yaml`
-- `npx --yes @augmentworks/cli@0.3.8 test --local -c augmentworks.yaml --packet support-refunds-starter@0.1.0`
-- `npx --yes @augmentworks/cli@0.3.8 schema --kind local-packet`
+- `npx --yes @augmentworks/cli@0.3.9 init --agent`
+- `npx --yes @augmentworks/cli@0.3.9 doctor -c augmentworks.yaml`
+- `npx --yes @augmentworks/cli@0.3.9 test --local -c augmentworks.yaml --packet support-refunds-starter@0.1.0`
+- `npx --yes @augmentworks/cli@0.3.9 schema --kind local-packet`
 
 From a clone after `npm ci && npm run build`:
 

agent-resources/cursor/augmentworks.mdc

@@ -19,13 +19,13 @@ AugmentWorks during unrelated coding.
    packet exits `0` for `AW_FAQ_POLICY=current` and `10` for
    `AW_FAQ_POLICY=stale`. It is not hosted LLM judging and it does not prove
    customer application state. The refund fail-then-pass demo remains
-   `npx --yes @augmentworks/cli@0.3.8 demo`, or `node dist/index.js demo` from
+   `npx --yes @augmentworks/cli@0.3.9 demo`, or `node dist/index.js demo` from
    a clone after `npm ci && npm run build`. Otherwise start with non-networked
    `doctor`. Preview mappings with
    `node dist/index.js preview-mapping` before an assessment. Explicitly probe
    a safe synthetic target with `node dist/index.js probe` (plan) then
    `node dist/index.js probe --yes`. Doctor and init never probe. This
-   `@augmentworks/cli@0.3.8` package includes `demo`, hosted `--assessment`,
+   `@augmentworks/cli@0.3.9` package includes `demo`, hosted `--assessment`,
    `usage`, `billing`, `preview-mapping`, `probe`, `test --estimate`,
    `--max-credits`, `run status`/`run wait`/`run report`,
    `AUGMENTWORKS_API_KEY` mode, and init starter generation.
@@ -34,12 +34,12 @@ AugmentWorks during unrelated coding.
 
 ## Commands (version-pinned)
 
-This 0.3.8 package:
+This 0.3.9 package:
 
-- `npx --yes @augmentworks/cli@0.3.8 init --agent`
-- `npx --yes @augmentworks/cli@0.3.8 doctor -c augmentworks.yaml`
-- `npx --yes @augmentworks/cli@0.3.8 test --local -c augmentworks.yaml --packet support-refunds-starter@0.1.0`
-- `npx --yes @augmentworks/cli@0.3.8 schema --kind local-packet`
+- `npx --yes @augmentworks/cli@0.3.9 init --agent`
+- `npx --yes @augmentworks/cli@0.3.9 doctor -c augmentworks.yaml`
+- `npx --yes @augmentworks/cli@0.3.9 test --local -c augmentworks.yaml --packet support-refunds-starter@0.1.0`
+- `npx --yes @augmentworks/cli@0.3.9 schema --kind local-packet`
 
 From a clone after `npm ci && npm run build`:
 

agent-resources/guidance.md

@@ -14,13 +14,13 @@ AugmentWorks during unrelated coding.
    packet exits `0` for `AW_FAQ_POLICY=current` and `10` for
    `AW_FAQ_POLICY=stale`. It is not hosted LLM judging and it does not prove
    customer application state. The refund fail-then-pass demo remains
-   `npx --yes @augmentworks/cli@0.3.8 demo`, or `node dist/index.js demo` from
+   `npx --yes @augmentworks/cli@0.3.9 demo`, or `node dist/index.js demo` from
    a clone after `npm ci && npm run build`. Otherwise start with non-networked
    `doctor`. Preview mappings with
    `node dist/index.js preview-mapping` before an assessment. Explicitly probe
    a safe synthetic target with `node dist/index.js probe` (plan) then
    `node dist/index.js probe --yes`. Doctor and init never probe. This
-   `@augmentworks/cli@0.3.8` package includes `demo`, hosted `--assessment`,
+   `@augmentworks/cli@0.3.9` package includes `demo`, hosted `--assessment`,
    `usage`, `billing`, `preview-mapping`, `probe`, `test --estimate`,
    `--max-credits`, `run status`/`run wait`/`run report`,
    `AUGMENTWORKS_API_KEY` mode, and init starter generation.
@@ -29,12 +29,12 @@ AugmentWorks during unrelated coding.
 
 ## Commands (version-pinned)
 
-This 0.3.8 package:
+This 0.3.9 package:
 
-- `npx --yes @augmentworks/cli@0.3.8 init --agent`
-- `npx --yes @augmentworks/cli@0.3.8 doctor -c augmentworks.yaml`
-- `npx --yes @augmentworks/cli@0.3.8 test --local -c augmentworks.yaml --packet support-refunds-starter@0.1.0`
-- `npx --yes @augmentworks/cli@0.3.8 schema --kind local-packet`
+- `npx --yes @augmentworks/cli@0.3.9 init --agent`
+- `npx --yes @augmentworks/cli@0.3.9 doctor -c augmentworks.yaml`
+- `npx --yes @augmentworks/cli@0.3.9 test --local -c augmentworks.yaml --packet support-refunds-starter@0.1.0`
+- `npx --yes @augmentworks/cli@0.3.9 schema --kind local-packet`
 
 From a clone after `npm ci && npm run build`:
 

assets/starters/response-quality/OWN-TARGET.md

@@ -10,7 +10,7 @@ Streaming, WebSocket, history-array multi-turn, and connector marketplaces are
 not supported. The only JSON HTTP patterns in this CLI are response-only chat
 and the stateful `workflow` starter.
 
-This 0.3.8 package generates these files and includes `probe`. Do not pin
+This 0.3.9 package generates these files and includes `probe`. Do not pin
 immutable npm `0.3.3`. Invoke the CLI as `{{AW_CLI}}` below.
 
 ## Files

assets/starters/workflow/OWN-TARGET.md

@@ -9,7 +9,7 @@ Response-only JSON chat is the other supported pattern (`--starter
 response-quality`). Streaming, WebSocket, history-array multi-turn, and
 connector marketplaces are not supported.
 
-This 0.3.8 package generates these files and includes `probe`. Do not pin
+This 0.3.9 package generates these files and includes `probe`. Do not pin
 immutable npm `0.3.3`. Invoke the CLI as `{{AW_CLI}}` below.
 
 ## Files

contracts/discovery-manifest.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "package": {
     "name": "@augmentworks/cli",
-    "version": "0.3.8",
+    "version": "0.3.9",
     "releaseStatus": "development"
   },
   "runtime": {

docs/agent-setup.md

@@ -22,22 +22,22 @@ hosted LLM judging and it does not observe customer application state.
 That local pair is the validation step. The next hosted action is separate and
 human-controlled. Open the coding-agent page linked from this guide
 (`/docs/agent-setup` on the product site), then run
-`npx --yes @augmentworks/cli@0.3.8 login` only after the user approves it.
+`npx --yes @augmentworks/cli@0.3.9 login` only after the user approves it.
 Do not start hosted `test` from the FAQ example. Pricing is `/pricing` on the
 product site. The website's adopted production-compatible pin remains
 `@augmentworks/cli@0.3.7` (`/llms.txt` on that site, checked 2026-10-08).
 Supported connector limits for that pin are `/docs/quickstart` and
 `/docs/connectors/http`. There is no separate compatibility URL. Executable
-commands in this repository pin `@augmentworks/cli@0.3.8`. Do not run `@latest`.
+commands in this repository pin `@augmentworks/cli@0.3.9`. Do not run `@latest`.
 
 Hosted real-data quote and admission stay release-disabled.
 
 ## Versions and prerequisites
 
 | Item | Value |
 | --- | --- |
-| This package | `@augmentworks/cli@0.3.8` (published-line identity; executable npx pin matches this tarball) |
-| Immutable prior npm | `@augmentworks/cli@0.3.7`, `@augmentworks/cli@0.3.6` (capabilities, no saved-suite `/2`), `@augmentworks/cli@0.3.5` (omits suite-selection capabilities), `@augmentworks/cli@0.3.4`, and `@augmentworks/cli@0.3.3` |
+| This package | `@augmentworks/cli@0.3.9` (published-line identity; executable npx pin matches this tarball) |
+| Immutable prior npm | `@augmentworks/cli@0.3.8` (AUG-272 consistency check; registry omitted gitHead), `@augmentworks/cli@0.3.7`, `@augmentworks/cli@0.3.6` (capabilities, no saved-suite `/2`), `@augmentworks/cli@0.3.5` (omits suite-selection capabilities), `@augmentworks/cli@0.3.4`, and `@augmentworks/cli@0.3.3` |
 | Node.js | 20 or newer |
 | Local packet | `support-refunds-starter@0.1.0` |
 | Hosted packet | `support-refunds@0.1.0` |
@@ -73,14 +73,14 @@ Check existing tests, applicable instructions, actual target capabilities, and
 the desired test scope before changing code.
 
 If I asked for a first look and there is no application target yet, prefer the
-packaged synthetic demo (`npx --yes @augmentworks/cli@0.3.8 demo` or
+packaged synthetic demo (`npx --yes @augmentworks/cli@0.3.9 demo` or
 `node dist/index.js demo` after `npm ci && npm run build`) or non-networked doctor.
-This `@augmentworks/cli@0.3.8` package includes demo, `--assessment`, and
+This `@augmentworks/cli@0.3.9` package includes demo, `--assessment`, and
 `init` starter generation.
 
-Use the pinned @augmentworks/cli@0.3.8 package for application integration:
+Use the pinned @augmentworks/cli@0.3.9 package for application integration:
 
-npx --yes @augmentworks/cli@0.3.8 init --agent
+npx --yes @augmentworks/cli@0.3.9 init --agent
 
 Then configure the generic YAML HTTP connector. Do not require a Python adapter
 or AugmentWorks target SDK; implement only missing synthetic hooks in this
@@ -100,7 +100,7 @@ diff. Use environment-variable names and .env.example placeholders.
 
 Run:
 
-npx --yes @augmentworks/cli@0.3.8 doctor -c augmentworks.yaml
+npx --yes @augmentworks/cli@0.3.9 doctor -c augmentworks.yaml
 
 Show me the resulting diff, and explain the telemetry allowlist, idempotency,
 cleanup, and server-side fixture TTLs. Preserve already granted user
@@ -124,7 +124,7 @@ insert credentials.
    Otherwise start with `doctor --offline`.
 3. Inspect application routes or an OpenAPI description inside that root.
 4. Identify the application endpoint—not merely its model-provider endpoint.
-5. Run `npx --yes @augmentworks/cli@0.3.8 init --agent` only when those files
+5. Run `npx --yes @augmentworks/cli@0.3.9 init --agent` only when those files
    are missing. Preserve collision behavior: existing files are not overwritten
    without `--force`. `--agent` is an explicit opt-in that writes
    `augmentworks.agent.md` only.
@@ -151,7 +151,7 @@ insert credentials.
 12. If authoring a local packet, create strict JSON using `aw-packet/0.1`; do not
     add JavaScript, modules, shell instructions, remote URLs, or secret values.
     Validate its contract with
-    `npx --yes @augmentworks/cli@0.3.8 schema --kind local-packet`.
+    `npx --yes @augmentworks/cli@0.3.9 schema --kind local-packet`.
 13. Show the diff, explain which target operations will run, and stop for human
     approval before `test` unless that same scoped assessment was already
     authorized.
@@ -210,7 +210,7 @@ edit them independently.
   require an AugmentWorks account:
 
   ```bash
-  npx --yes @augmentworks/cli@0.3.8 test \
+  npx --yes @augmentworks/cli@0.3.9 test \
     --local \
     -c augmentworks.yaml \
     --packet support-refunds-starter@0.1.0 \
@@ -229,8 +229,8 @@ edit them independently.
   follows the workspace's remaining baseline/remediation allowance:
 
   ```bash
-  npx --yes @augmentworks/cli@0.3.8 login
-  npx --yes @augmentworks/cli@0.3.8 test \
+  npx --yes @augmentworks/cli@0.3.9 login
+  npx --yes @augmentworks/cli@0.3.9 test \
     -c augmentworks.yaml \
     --packet support-refunds@0.1.0 \
     --open
@@ -251,5 +251,5 @@ run is executed by the same version-pinned, deterministic CLI.
   allowlisted observation keys.
 - `LOCAL_OUTPUT_EXISTS`: choose a fresh `--output-dir` leaf.
 - Exit `11`: hosted judging is pending; this is not a pass.
-- Packaged demo not found: assets did not install. Reinstall `@augmentworks/cli@0.3.8`
+- Packaged demo not found: assets did not install. Reinstall `@augmentworks/cli@0.3.9`
   or run `test --local` with your target.

docs/authentication.md

@@ -13,7 +13,7 @@ resolves only the target credentials named by the selected configuration.
 ## Interactive login
 
 ```bash
-npx --yes @augmentworks/cli@0.3.8 login
+npx --yes @augmentworks/cli@0.3.9 login
 ```
 
 The default flow uses browser Authorization Code with PKCE and a temporary
@@ -25,7 +25,7 @@ single-use and short-lived, and the callback listener closes after completion.
 For SSH and other headless environments:
 
 ```bash
-npx --yes @augmentworks/cli@0.3.8 login --device
+npx --yes @augmentworks/cli@0.3.9 login --device
 ```
 
 The CLI displays a short user code and verification URL. Entering the code in a
@@ -152,8 +152,8 @@ before removal; unknown identity remains fail-closed.
 Use:
 
 ```bash
-npx --yes @augmentworks/cli@0.3.8 whoami
-npx --yes @augmentworks/cli@0.3.8 logout
+npx --yes @augmentworks/cli@0.3.9 whoami
+npx --yes @augmentworks/cli@0.3.9 logout
 ```
 
 This package also provides `usage` and `billing`, which use the same connector

docs/configuration.md

@@ -277,7 +277,7 @@ test environment matches production.
 Use offline validation while editing:
 
 ```bash
-npx --yes @augmentworks/cli@0.3.8 doctor \
+npx --yes @augmentworks/cli@0.3.9 doctor \
   -c augmentworks.yaml
 ```
 
@@ -393,9 +393,9 @@ The canonical machine-readable definition is
 Print any bundled schema with:
 
 ```bash
-npx --yes @augmentworks/cli@0.3.8 schema --kind config
-npx --yes @augmentworks/cli@0.3.8 schema --kind local-packet
-npx --yes @augmentworks/cli@0.3.8 schema --kind local-result
+npx --yes @augmentworks/cli@0.3.9 schema --kind config
+npx --yes @augmentworks/cli@0.3.9 schema --kind local-packet
+npx --yes @augmentworks/cli@0.3.9 schema --kind local-result
 ```
 
 Local assessment packets are separate strict JSON documents with

docs/customer-suites.md

@@ -30,12 +30,12 @@ document are fictional. This text is not legal approval. Do not set
 `synthetic_only: true` on a live or authorized document, grant `suite:write`
 to a machine key, or test a third party without authority.
 
-The command exists in this `0.3.8` package. Native hosted
+The command exists in this `0.3.9` package. Native hosted
 `aw-customer-suite/1` upload translation shipped in immutable npm `0.3.7`
 and is not in immutable registry `0.3.6`. From this clone after `npm ci` and
-`npm run build`, use `node dist/index.js`. Pin `@augmentworks/cli@0.3.8`
-after the protected `v0.3.8` publish. Do not assume registry `0.3.6`
-contains the upload translation, and do not overwrite `0.3.7`.
+`npm run build`, use `node dist/index.js`. Pin `@augmentworks/cli@0.3.9`
+after the protected `v0.3.9` publish. Do not assume registry `0.3.6`
+contains the upload translation, and do not overwrite `0.3.8` or `0.3.7`.
 
 ## Commands