The anonymous /api/v1/here manifest says how to get an account: make one and sign in, each with its route #8468

The anonymous /api/v1/here manifest now tells a stranger how to get an account and sign in, and the see what went live row names the releases tool.

• New rows: For an anonymous viewer, forgeActions in src/actions/here.ts appends {do:"make an account", http:"GET /signup", account:false} and {do:"sign in", http:"GET /signin", account:false}. They come after the existing rows, so nothing moved. A signed-in viewer gets neither.
• Edge-login forges: make an account is left out when edge sign-in is active. sign in is always there.
• releases: The see what went live row now carries mcp: "releases".
• Tests: test/here-manifest.test.ts gains a case for anonymous versus signed-in viewers, including the row order, and a case for an edge-login forge. I updated the changelog assertion for the new mcp field.
• Passing: test/mcp-size.test.ts, test/here-manifest.test.ts, tsc --noEmit and scripts/gate.ts pass. Seven related suites that mention the manifest or the MCP card (such as report-discovery, mcp-card and ssh-tell-discovery) also pass.
• Not run: I did not run the full suite. scripts/fast.ts found 1002 of 1902 test files affected, over the 5-minute budget, so I ran only the related files.

I did not edit llms.txt.

Edge condition differs from the home page: The home page also shows Create an account to an edge stranger, a visitor the edge vouches for who has no local account. The manifest doesn't see the request, so it omits make an account for every viewer on an edge-login forge. Matching the home page exactly would mean passing the request into manifestFor, which I left alone.

To try it, run curl <forge>/api/v1/here with no credentials. The two rows come after use the MCP.

Closes #8461

The anonymous /api/v1/here manifest now tells a stranger how to get an account and sign in, and the see what went live row names the releases tool.

• New rows: For an anonymous viewer, forgeActions in src/actions/here.ts appends {do:"make an account", http:"GET /signup", account:false} and {do:"sign in", http:"GET /signin", account:false}. They come after the existing rows, so nothing moved. A signed-in viewer gets neither.
• Edge-login forges: make an account is left out when edge sign-in is active. sign in is always there.
• releases: The see what went live row now carries mcp: "releases".
• Tests: test/here-manifest.test.ts gains a case for anonymous versus signed-in viewers, including the row order, and a case for an edge-login forge. I updated the changelog assertion for the new mcp field.
• Passing: test/mcp-size.test.ts, test/here-manifest.test.ts, tsc --noEmit and scripts/gate.ts pass. Seven related suites that mention the manifest or the MCP card (such as report-discovery, mcp-card and ssh-tell-discovery) also pass.
• Not run: I did not run the full suite. scripts/fast.ts found 1002 of 1902 test files affected, over the 5-minute budget, so I ran only the related files.

I did not edit llms.txt.

Edge condition differs from the home page: The home page also shows Create an account to an edge stranger, a visitor the edge vouches for who has no local account. The manifest doesn't see the request, so it omits make an account for every viewer on an edge-login forge. Matching the home page exactly would mean passing the request into manifestFor, which I left alone.

To try it, run curl <forge>/api/v1/here with no credentials. The two rows come after use the MCP.

The anonymous /api/v1/here manifest now tells a stranger how to get an account and sign in, and its changelog row names the releases MCP tool.

Why the check failed: my first push gave those two new rows the HTML pages GET /signup and GET /signin. test/openapi.test.ts requires every http: route in the manifest to be in the OpenAPI document, and those two weren't. The fix is to name routes that are already described. "make an account" is now POST /api/v1/users and "sign in" is POST /api/v1/tokens.

What the manifest does now:

• Anonymous viewers: they see both rows, listed after "use the MCP".
• Signed-in viewers: they don't see either row.
• Edge-login forges: they get "sign in" only, because no account is made at sign-up there.
• Changelog row: "see what went live" carries mcp: "releases".

Checks:

• Run before this push: bun scripts/gate.ts, bun x tsc --noEmit, and the openapi, here-manifest, MCP, search and card tests (924 pass).
• Not re-run: the other roughly 150 failures in the check log (backups-live, boots, the sign-in windows and others). I didn't reproduce them or look at their cause, and ran only the tests listed above. Three of the failures in the log's tail were named: "the card and here print exactly that list", the /search repository test, and the openapi test. The last two, and the MCP card tests, pass here. The forge's full check on this push will show whether the rest were fallout from the openapi failure.
• Skipped here: the sandbox skips the unix-socket and cell suites, and the forge's check runs them.

Left out: I didn't add /signup or /signin to the OpenAPI document, since they are web pages rather than API routes.

The anonymous /api/v1/here manifest now says how to get an account and sign in, and its changelog row names the releases MCP tool. The check's last failure was my mistake, now fixed.

What changed

• Account rows: an anonymous viewer sees "make an account" (POST /api/v1/users) and "sign in" (POST /api/v1/tokens) after "use the MCP". A signed-in viewer sees neither. On an edge-login forge only "sign in" shows, since no account is made there. I used these two API routes because the OpenAPI test requires every http: route in the manifest to be described there, and /signup and /signin are HTML pages that aren't.
• Changelog row: "see what went live" carries mcp: "releases".

The last failure: I had marked the changelog row account: false, which the manifest also uses to mean "token-free MCP tool". Only report is token-free, so token-free MCP tools > the card and here print exactly that list failed. I removed account: false from that row and from its assertion in test/here-manifest.test.ts. That test was wrong. Its row now reads like the explore and search rows.

Checks: tsc is clean, and test/token-free-tools.test.ts, test/here-manifest.test.ts and test/openapi.test.ts pass (61 tests). bun scripts/gate.ts and the wider MCP, search and card tests passed on the earlier push, and I did not re-run them on this one. The forge's full check on this push is the real verdict.

Not done: I did not add /signup or /signin to the OpenAPI document.

Left #8461 open: 3 unticked items remain (For an anonymous viewer, forgeActions adds {do:"make an account", http:"GET /signup", account:false} when this forge shows the Create an account button (the same condition src/web/studio/home.ts uses around line 611), and {do:"sign in", http:"GET /signin", account:false} always; a signed-in viewer gets neither.; The see what went live row names mcp: "releases".; test/here-manifest.test.ts gains cases for both viewers and for an edge-login forge that shows no sign-up, each failing without the change; llms.txt's ## What you can do on any page stays true.).