fix(cli): installer keeps a shared binary readable, and the keyring hint names --server

- install-cli.sh stages the binary as 0755, as install-r2.sh does: under
  umask 077 `chmod +x` left 0700 and locked other users out.
- The locked-keychain hint suggests `login --server <url> --no-keyring`;
  login refuses without --server.
- Skill: a fail-branch node keeps its usual success handles and adds
  `fail-branch`; turning the Service API off waits until after the smoke
  test, which needs it on.

Author: GareArc

cli/scripts/install-cli.sh

@@ -41,7 +41,7 @@ bin_dir_for() {
 # running difyctl keeps its old file and DEST is never half written.
 install_binary() {
     _stage="$(dirname "$2")/.difyctl.install.$$"
-    if cp "$1" "$_stage" && chmod +x "$_stage" && mv -f "$_stage" "$2"; then
+    if cp "$1" "$_stage" && chmod 0755 "$_stage" && mv -f "$_stage" "$2"; then
         return 0
     fi
     rm -f "$_stage"

cli/scripts/install-cli.test.ts

@@ -1,5 +1,5 @@
 import { execFileSync, spawnSync } from 'node:child_process'
-import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { chmodSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -447,6 +447,24 @@ describe('install-cli.sh install_binary', () => {
     }
   })
 
+  // A shared install must stay readable by other users, whatever the installer's umask.
+  it.skipIf(process.platform === 'win32')(
+    'installs a 0600 source as mode 0755 under umask 077',
+    () => {
+      const dir = mkdtempSync(join(tmpdir(), 'difyctl-install-'))
+      try {
+        const src = join(dir, 'new')
+        const dest = join(dir, 'bin-difyctl')
+        writeFileSync(src, 'new build', { mode: 0o600 })
+        const r = runLib(`umask 077; install_binary "${src}" "${dest}"`)
+        expect(r.code).toBe(0)
+        expect(statSync(dest).mode & 0o777).toBe(0o755)
+      } finally {
+        rmSync(dir, { recursive: true, force: true })
+      }
+    },
+  )
+
   it('dies without touching the old binary when the folder is not writable', () => {
     const r = runLib('install_binary /nonexistent/src /nonexistent-dir/difyctl')
     expect(r.code).not.toBe(0)

cli/src/store/keychain-token-store.test.ts

@@ -136,6 +136,6 @@ it('a locked keychain points at login --no-keyring', async () => {
   getPasswordError = new Error('keyring locked')
   await expect(new KeychainTokenStore(SERVICE).read('h', 'e')).rejects.toMatchObject({
     code: ErrorCode.KeyringUnavailable,
-    hint: expect.stringContaining('login --no-keyring'),
+    hint: expect.stringContaining('login --server <url> --no-keyring'),
   })
 })

cli/src/store/token-store.ts

@@ -104,7 +104,7 @@ function keyringUnavailableError(cause: unknown): BaseError {
   return new BaseError({
     code: ErrorCode.KeyringUnavailable,
     message: 'OS keychain is unreachable',
-    hint: `unlock the keychain (or the login session) and retry, or run ${BINARY} login --no-keyring to keep the token in a file`,
+    hint: `unlock the keychain (or the login session) and retry, or run ${BINARY} login --server <url> --no-keyring to keep the token in a file`,
     cause,
   })
 }

skills/difyctl/references/build-workflow/dsl.md

@@ -10,7 +10,7 @@ Start from an export of the app's draft. A new Workflow app's export is empty. A
   - if-else: each case's `case_id`, plus `false` for else;
   - question classifier: each class's `id`;
   - human input: each `user_actions` id, plus `__timeout`;
-  - `error_strategy: fail-branch`: `source` for success, `fail-branch` for failure.
+  - `error_strategy: fail-branch` adds a `fail-branch` handle for failure. Success still leaves by the node's usual handles: `source`, or the branch handles above.
 - Give every branch an edge, including `false` and `__timeout`.
 - End node output names must be unique across all End nodes.
 - A node id is any unique string. Never change the id of an existing node.

skills/difyctl/references/build-workflow/handover.md

@@ -26,7 +26,7 @@ Start when every slice in `plan.md` is ticked. `<mode>` is `workflow` or `advanc
      difyctl set webapp <mode> --app-id <app_id> --enabled --json
      ```
 
-   - Service API (needs an admin). Warn the human first what turning it off costs (see Limits in `build-workflow.md`), and note the app id.
+   - Service API (needs an admin). Warn the human first what turning it off costs (see Limits in `build-workflow.md`), and note the app id. If the human wants it off, record that and turn it off after the smoke test in step 6: `difyctl run` fails with `service_api_disabled` while it is off.
 
      ```bash
      difyctl set service_api --app-id <app_id> --enabled --json
@@ -44,4 +44,6 @@ Start when every slice in `plan.md` is ticked. `<mode>` is `workflow` or `advanc
    difyctl run console_app <mode> --app-id <app_id> --inputs '{"<var>": "<value>"}' --json
    ```
 
+   Then, if the human chose to turn the Service API off in step 5, turn it off now with `--enabled=false`.
+
 7. Close. Mark `plan.md` as published with the `version_id`, the date and the url. Give the human a short summary that lists every change from the spec and plan, and when the human approved it.