Changelog

August 10, 2026 · View on GitHub

All notable changes to morning-cli will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

0.2.0 — 2026-08-11

Migration to morning API v2 — the completely rewritten official docs at developers.morning.co (OpenAPI 2.0.0, replacing the old Apiary blueprint at greeninvoice.co.il/api-docs, which now redirects).

Added

  • OAuth 2.0 authentication (API v2): tokens are acquired via POST /idp/v1/oauth/token with client_credentials grant. The IDP lives on dedicated hosts — api.morning.co (production) and api.sandbox.morning.dev (sandbox) — and issues 1-hour tokens. Both camelCase (accessToken/expiresAt) and snake_case (access_token/expires_in) response shapes are parsed.
  • Automatic legacy fallback: if the IDP returns 404 or the host is unreachable (DNS/connection — TLS errors are surfaced, never downgraded), the CLI transparently falls back to the legacy POST /account/token. auth whoami reports which method produced the cached token (auth_method: oauth | legacy).
  • expense upload FILE [--id EXPENSE_ID] — the new API v2 presigned-S3 file-upload flow (Step 1: GET /file-upload/v1/url on the upload host, Step 2: multipart POST to S3 with the file field last, inside the 60-second presign window). Creates a new expense draft or attaches to an existing expense; parsing is asynchronous.
  • MORNING_GATEWAY_URL env var (and gateway_url in credentials.json) to override the OAuth IDP + file-upload hosts for proxies/custom deploys.
  • MORNING_AUTH_MODE env var — auto (default), oauth (never fall back), legacy (skip the IDP entirely; escape hatch if the IDP rejects keys the legacy endpoint still accepts).
  • OAuth failures carry the RFC 6749 error string as the envelope code (invalid_client, invalid_grant, unauthorized_client) so agents can branch without parsing prose; the wizard shows targeted hints for each.
  • expense draft-delete DRAFT_ID — removes an expense draft (the only way to undo a test expense upload; uses the still-served DELETE /expenses/drafts/{id}, absent from the v2 docs).
  • MORNING_E2E_ENV for the test suite — run the live E2E suite against production instead of sandbox (preview-only / self-cleaning by design, including async draft cleanup after the upload test).
  • auth init reads MORNING_API_KEY_ID / MORNING_API_KEY_SECRET (and in --non-interactive mode also MORNING_ENV) as documented — the CI path now actually works without flags.
  • One-line --help text on every command (endpoint + purpose) and --file support on all payload-taking commands.

Fixed

  • REPL could not execute any command (a make_context duplicate-argument crash on every line) — fixed and covered by an offline REPL smoke test. Per-line --json / --env flags inside the REPL are now honoured, and a flag-only line shows help instead of nesting a second REPL.
  • Exit-code contract: network failures (DNS, refused, timeouts, retry exhaustion) now exit 3 as documented, instead of leaking as 1/2.
  • Destructive commands that lacked a confirmation prompt now have one (payment charge, client merge, supplier merge, business file-delete) — pass --yes in scripts.
  • --json auth init prints nothing but the JSON envelope (wizard UI used to pollute stdout); in agent environments it exits with a proper envelope.
  • The REPL help table is generated from the live command tree, so it can no longer drift from the real command set.
  • Tests are no longer shipped inside the wheel; PyPI-facing links in the README/SKILL are absolute so they don't 404 off-GitHub.
  • OAuth error envelope support (RFC 6749 error/error_description) alongside the classic errorCode/errorMessage shape.
  • spec/openapi-v2.bundled.json — the official OpenAPI 2.0.0 spec fetched from developers.morning.co, now the source of truth.

Changed

  • Reference endpoints (tools group: occupations, countries, cities, currencies) stay on the shared cache.greeninvoice.co.il host, which the v2 spec confirms is the documented server for all environments. Their docs moved under the new Reference tag; paths and no-auth behaviour unchanged.
  • Partners endpoints now authenticate with HTTP Basic (Authorization: Basic base64(id:secret)) per the v2 docs, instead of the Bearer token.
  • business group marked legacy — the /businesses/* endpoints were removed from the v2 docs but are still served; the wizard and whoami no longer hard-depend on GET /businesses/me (verification succeeds even if it disappears).
  • E2E sandbox credentials: MORNING_SANDBOX_ID/MORNING_SANDBOX_SECRET are now read first (legacy GREENINVOICE_SANDBOX_* still honoured) — fixes a docs/fixture mismatch.

Removed

  • expense draft-from-file / expense update-file and the old 3-step /expenses/file + /expenses/example flow — replaced by expense upload.
  • partner get --email — GET /partners/users?email= is not part of the v2 API surface.

Verified live (2026-08-11)

  • 23 live E2E tests (plus the offline suite) passed against production (real business account): OAuth login via the IDP, all read-only smokes, paginated searches, item/supplier CRUD round-trips, invoice lifecycle, proforma preview with Hebrew content, and the presigned-S3 expense upload (draft created, then cleaned up via expense draft-delete) ✓
  • OAuth token acquisition against api.morning.co (production) ✓; the sandbox IDP at api.sandbox.morning.dev responds ✓; new tokens are accepted by the classic api.greeninvoice.co.il/api/v1 endpoints ✓
  • Reference endpoints on the shared cache host ✓; MORNING_AUTH_MODE=legacy escape hatch verified live ✓
  • Legacy /account/token, /businesses/me, and /accounting/classifications/map still served (kept as fallback/legacy) ✓

0.1.3 — 2026-04-20

Fixed

  • Version metadata alignment for the PyPI release.

0.1.2 — 2026-04-20

Added

  • Redesigned auth init wizard with rich panels and a 4-step progress bar.
  • Agent-safe auth init — detects Claude Code / Cursor / Codex environments and refuses interactive secret entry that would leak into chat logs.

0.1.1 — 2026-04-11

Fixed

  • Pre-release code-review fixes; CI version test no longer hardcodes 0.1.0.

Added

  • GitHub Actions CI workflow.

0.1.0 — 2026-04-10

Added

  • 66 API endpoints across 10 resource groups: businesses, clients, suppliers, items, documents, expenses, payments, partners, tools, plus local auth/session
  • Interactive onboarding wizard (morning-cli auth init) — walks first-time users through environment selection, API key creation deep-link, credential entry (hidden input), live verification against the real API, and 0600-mode credential persistence
  • REPL as the default mode (morning-cli with no args) with ReplSkin-powered banner, prompt, history, and styled output
  • --json envelopes on every command for agent consumption: {ok, op, data} on success, {ok, op, error: {code, message, http_status}} on failure
  • Automatic JWT refresh — on 401 the CLI re-acquires the token and retries once
  • Sandbox-first defaults — MORNING_ENV defaults to sandbox so accidents don't touch production
  • Locked session file at ~/.greeninvoice/session.json (mode 0600) with fcntl.flock exclusive locking per the cli-anything HARNESS methodology
  • Tools endpoints served from cache.greeninvoice.co.il (separate host, no JWT, locale format xx_XX) — occupations, countries, cities, currencies
  • Dual console scripts: morning-cli (primary) + cli-anything-greeninvoice (alias for cli-anything methodology compat)
  • Dual env var prefix: MORNING_* (preferred) + GREENINVOICE_* (legacy fallback)
  • Hebrew error messages preserved end-to-end (errorCode + errorMessage)
  • 55 tests: 27 unit (mock httpx) + 4 offline E2E + 24 live sandbox E2E, covering all 10 resource groups, item CRUD round-trip, supplier create/delete, proforma invoice preview with Hebrew content, and the full invoice lifecycle flow
  • SKILL.md for AI-agent discovery (auto-detected by ReplSkin banner)
  • Documentation: README (English), README.he.md (Hebrew), GREENINVOICE.md (SOP), TEST.md (plan + results), SKILL.md, .env.example, LICENSE (MIT)

Discovered during development

  • morning (Green Invoice) Tools endpoints use a separate host (https://cache.greeninvoice.co.il) and do not require JWT — the Apiary spec mentions this only in prose, not in the endpoint definitions
  • Locale parameters on the Tools host must be in xx_XX form (he_IL, en_US), not two-letter codes — passing en returns HTTP 400
  • type 305 (tax invoice) cannot be issued by an עוסק פטור (exempt dealer) business — the test suite now uses type 10 (price quote) and type 300 (proforma) which work for all business types