[marcinobel]

Summary

• CLAUDE.md:9,102–126 – align the Node.js requirement, macOS stdin/hex keychain write mechanism, global-option descriptions, and folder API wording with the implementation.
• CONTRIBUTING.md:20 – require Node.js 22.22+ to match package.json.
• SECURITY.md:52 – distinguish optional macOS keychain storage from environment-provided credentials.
• docs/community-vs-enterprise.md:11,70–105 – record the observed Community source-control licence refusal for both supported commands.
• docs/guides/ai-agents.md:54 – describe licensed command failures without the obsolete not found claim.
• docs/guides/folders.md:15 – state the implemented internal-API mechanism without claiming an unavailable public endpoint.
• docs/guides/workflow-lifecycle.md:147 – document preservation of n8n-accepted workflow settings during publish.
• docs/reference/auth.md:15 – document macOS security -i stdin writes with -X <hex> and no secret process argument.
• docs/reference/folder.md:6 – align internal-API folder authentication wording with the client implementation.
• docs/reference/source-control.md:6,28–36 – correct the Community response and example to the licence refusal.
• docs/reference/workflow.md:186 – document accepted workflow settings and dropped unknown fields precisely.
• docs/runbooks/local-n8n.md:10,45 – align the Node.js requirement and local-n8n environment-file-store limitation.
• docs/security.md:18,70 – document safe macOS keychain writes and accurate folder API use.
• docs/troubleshooting.md:125 – remove the obsolete source-control not found troubleshooting case.

Evidence

• Head: 0716eae60e1ff2ed3fd64aa0dfe8f0ea667d7a0d
• Base: develop at b5a94be707696a0654b1138a791ef197b247a86a
• Canonical gate attempt 0001-1790324906118-4434 passed: typecheck, lint, format check, unit tests (148 passed), build, SPDX headers, and repository checks.
• Security stage: not applicable – 14 documentation files changed; source and dependency capabilities did not apply. Credential-shaped literal and credential-file scans passed.
• CI: not yet started at this head.

QA and design

• skip-qa – documentation-only change; no product behaviour changed.
• skip-design – no command names, flags, help text, JSON shapes, errors, exit codes, UI, or design assets changed.

Known follow-up (not in this PR)

• scripts/local-n8n/lib.ts:57: the ERR_STORE_DISABLED message still says the keychain store is disabled "until the keychain backend keeps secrets out of process arguments". 0.2.1 already does that (the secret goes to security -i on stdin), so the message is stale. docs/runbooks/local-n8n.md quotes the message as the helper prints it today; changing the message is a follow-up code change outside this docs-only PR.

Proposed removals (owner decides)

• None.

Status content found

• None in CLAUDE.md or AGENTS.md.

Evidence – repair round 1 (appended; the section above is left as sealed)

• Head: 3d3a96da7592d94fc13bd2d304b3f1623f9c0bfa (six docs-only commits over 0716eae, one per review finding – mapping in the "Review response – round 1" comment).
• CI at this head: run 36114795952 (pull_request, head 3d3a96d) – check, e2e, e2e-macos all passed. Nothing pending.
• Canonical gate: the workflow's gate attempt 0001-1790326093833-60589 ran on the review-response task's own unchanged tree (1324ca3), not on this head; format:check, lint, check:headers and repository checks were run on a checkout of 3d3a96d, and CI above covers the pushed content.
• Remaining: re-review of the six commits. Draft PR – not business completion.

[marcinobel]

Code review

Reviewed head: 0716eae (base develop)
Verdict: REQUEST CHANGES
Independence: confirmed. The launch text names the author as codex/gpt-5.6-terra (run 6c1ba637). The reviewer is claude/opus.

What I checked

All 14 changed files, line by line, against the code at the head; only documentation changed. The following match the code: Node 22.22+ matches package.json engines. The keychain text matches src/keychain/macos.ts (security -i with add-generic-password -U -X hex on stdin, never -w in argv). The sc licence refusals match test/e2e/source-control.e2e.ts, so removing the not-found troubleshooting case is correct after #39. The publish settings text matches stripForPublish. The global options table matches src/cli.ts. The folder wording is backed by validation row 4. Style: no emojis, sentence case, no hyphen used as a dash.

Findings

1. Major: docs/reference/source-control.md:23 (also lines 13 and 25). sc status still says No options and describes a preferences-object output. The code has --direction pull|push (default pull) and calls GET /source-control/status. An invalid value gives ERR_USAGE (fix: sc status calls a route the n8n public API does not have #39). --direction is documented nowhere. Add the option row, describe the status output and add ERR_USAGE.
2. Minor: docs/guides/folders.md:87 and docs/reference/folder.md:174. Both still say --to (root) fails with Expected string, received null. 0.2.0 fixed this (fix: folder move --to (root) fails on n8n 2.40.5 Community #53). Remove or rewrite.
3. Minor: docs/runbooks/local-n8n.md:45. The new reason differs from the text the helper prints (scripts/local-n8n/lib.ts:57), and after 0.2.1 that text is itself stale. Align them; fixing the script message is a follow-up code change.
4. Minor: SECURITY.md:52. The rewrite drops the still-true promise that errors go to stderr as JSON. Restore it.
5. Nit: docs/security.md:18. The command on stdin has no security prefix; it starts with add-generic-password.
6. Nit: docs/community-vs-enterprise.md:105 and docs/guides/ai-agents.md:54 add the spelling licence; the rest of docs/ uses license.
7. Nit: docs/reference/source-control.md:6. The full sc status Community text is not proven: e2e asserts only /license/i. Also, both commands is ambiguous when three subcommands are listed; say sc status and sc pull.

Unread boundary: none of the changed lines. Docs outside the diff were only searched for stale claims. Nothing was executed; CI is reported green.

[marcinobel]

Review response – round 1 (code review dc92b451)

Pushed to xez/6c1ba637: 0716eae → 3d3a96d (base develop a39af76). Docs only – no file under src/, scripts/ or test/ changed. No new PR.

#	Severity	Finding	Fix commit	Evidence
1	Major	sc status options, output, errors	ecf9324	Option row --direction <pull|push> (default pull), GET /api/v1/source-control/status, output is the pending-changes list, ERR_USAGE added – checked against src/commands/source-control.ts, src/client/public-api.ts:254, CHANGELOG #39
2	Minor	--to '(root)' described as failing	500499e	docs/guides/folders.md, docs/reference/folder.md now say it works since 0.2.0 (root marker "0", #53). Scoped to what test/e2e/folder.e2e.ts proves: checked on Community with a workflow already at the root; leaving a real folder needs a licensed n8n and is stated as not run
3	Minor	Runbook vs helper message	688089f	docs/runbooks/local-n8n.md quotes the ERR_STORE_DISABLED message scripts/local-n8n/lib.ts:57 prints today. PR body now has a "Known follow-up" note that the script message is stale after 0.2.1 (code change, not in this PR)
4	Minor	SECURITY.md dropped stderr JSON promise	225759f	Restored: "errors go to stderr as structured JSON"
5	Nit	stdin command prefix	e3b3925	docs/security.md now: runs security -i and sends add-generic-password -s 8cli -a <account> -U -X <hex> on stdin – matches src/keychain/macos.ts:51-69
6	Nit	"licence" spelling	3d3a96d	docs/community-vs-enterprise.md, docs/guides/ai-agents.md
7	Nit	Unproven full Community error text; "both commands"	ecf9324, 3d3a96d	docs/reference/source-control.md names sc status and sc pull, says they fail with ERR_SOURCE_CONTROL and a message naming the license (what the e2e asserts: /license/i); both full-text JSON blocks removed

Sibling sites checked (whole class):

• Full feat:sourceControl error text: also removed from docs/community-vs-enterprise.md (two JSON blocks); kept the feat:sourceControl. … prefix, which docs/validation/n8n-2.40.5.md:179 records live for sc pull. Other features' quoted texts (var, proj) left – out of this finding's scope.
• "licence": no other hit in docs/, README.md, SECURITY.md, except the dated validation record docs/validation/n8n-2.40.5.md:212 (historical record, left).
• security add-generic-password: no other hit in docs/, README.md, SECURITY.md.
• (root) failure text: no other hit outside the validation record.

Checks run on 3d3a96d (in a detached checkout of the PR head): npm ci, npm run format:check, npm run lint, npm run check:headers, .xezar/checks/repository-checks.sh – all passed. The workflow's gates step that follows runs against the review-response task's own unchanged tree; it confirms that tree, not the pushed head. CI on the new head is the check of the pushed content.

Revalidation scope: re-review of the six commits above.

🤖 Generated with Claude Code

[marcinobel]

Code review

Reviewed head: 3d3a96d (branch xez/6c1ba637, base develop). Scope: git diff 0716eae..3d3a96d against the seven findings of review run dc92b451.

Verdict: APPROVE

Independence: confirmed. The launch text names the original author as codex/gpt-5.6-terra and repair round 1 as claude/opus (run a9a0b540); this review is claude/sonnet and wrote none of it.

Boundary. Read: the full diff 0716eae..3d3a96d, and at the head the files src/commands/source-control.ts, src/client/public-api.ts, src/client/internal-api.ts, src/commands/folder.ts, src/keychain/macos.ts, scripts/local-n8n/lib.ts, test/e2e/source-control.e2e.ts, test/e2e/folder.e2e.ts, test/e2e/setup/helpers.ts, CHANGELOG.md, docs/community-vs-enterprise.md, docs/reference/source-control.md, docs/reference/folder.md, docs/guides/folders.md, docs/troubleshooting.md and docs/validation/n8n-2.40.5.md. The src, test, bin, scripts, package.json and CHANGELOG.md trees are byte-identical between the worktree and the head (empty git diff), so code claims were checked against them. Not read: the rest of the branch-vs-develop diff (CLAUDE.md, CONTRIBUTING.md, auth.md, workflow.md), which is outside this scope. Nothing was executed; CI green is as reported in the launch text.

Earlier findings

1. sc status – resolved. docs/reference/source-control.md now documents --direction <pull|push> (default pull), GET /api/v1/source-control/status and ERR_USAGE. It matches src/commands/source-control.ts (option default pull; parseDirection raises ERR_USAGE before config or any request) and src/client/public-api.ts:254. Error list ERR_SOURCE_CONTROL, ERR_USAGE is right.
2. folder move to (root) – resolved. docs/guides/folders.md and docs/reference/folder.md describe the root marker "0" (src/client/internal-api.ts:32 and 291; src/commands/folder.ts:353 skips the folder lookup). The 0.2.0 attribution matches CHANGELOG.md:42. The reference states honestly that Community was checked only with a workflow already at the root, which matches the comment at test/e2e/folder.e2e.ts:112-117. The example output shape matches folder.ts:363-369.
3. local-n8n runbook – resolved. The quoted keychain refusal is character-for-character the ScriptError text in scripts/local-n8n/lib.ts (ERR_STORE_DISABLED).
4. SECURITY.md – resolved. "errors go to stderr as structured JSON" is restored.
5. docs/security.md – resolved. The stdin command now starts with add-generic-password -s 8cli -a <account> -U -X <hex> as in src/keychain/macos.ts; the doc drops the quoting, which is a fair simplification.
6. license spelling – resolved for every file this PR touches (docs/guides/ai-agents.md and community-vs-enterprise.md were the leftovers). One untouched leftover, see f2.
7. Unproven Community error text – resolved. The full duplicated Community error JSON for sc status and sc pull is gone; sc status and sc pull are named, and the text is now asserted only as "names the license", which is what test/e2e/source-control.e2e.ts proves (LICENSE_GATED = /license/i).

docs/community-vs-enterprise.md (-22 lines)

Nothing a user still needs was removed. What went: two byte-identical n8n error JSON blocks and a stray sc pull heading that repeated the first block, all four claiming full text that the e2e suite does not assert. What stays: the per-group table, the var/proj/folder examples, the code-plus-message rule, the jq test (license|Plan lacks still matches every gated message), the licensed-editions caveat, and both commands named. Remaining claims check out: sc pull answers "Your license does not allow for feat:sourceControl. …" on 2.40.5 is recorded as observed in docs/validation/n8n-2.40.5.md:179, and the sc table row (line 24) repeats only that prefix. The folder row and the Plan lacks license for this feature text agree with e2e/setup/helpers.ts:85-90.

New findings (none blocking)

1. nit – docs/reference/folder.md:9 (banner) and docs/community-vs-enterprise.md:23 (folder row, "No"). Both still say n8n refuses every folder request on Community, but the (root) move now succeeds there (folder.md move section, test/e2e/folder.e2e.ts:118). The exception lives only in the move section. Correction: add "except folder move --to (root)" to the banner, or a clause to the table row. Also docs/guides/folders.md:86-88 says (root) "moves a workflow out of every folder" without the caveat that leaving a real folder was not run; one clause pointing at the reference would close it.
2. nit – docs/validation/n8n-2.40.5.md:212, fragment "source-control licence error (401 → 403, new text)". The British spelling survives in a file the PR does not touch. Correction: "license" (or leave it if the validation record is meant to be frozen).

Both are safe to take in a follow-up; neither changes what a user would run or expect.

Approve-label evidence: none requested; the approval label is not something this reviewer grants.

[marcinobel]

Code review

Reviewed head: 3d3a96d (base: develop; repair diff: 0716eae..3d3a96d).
Verdict: APPROVE
Independence: confirmed. The launch text names the repair author as claude/opus; this reviewer is codex/gpt-6-sol and did not author the repair.

Finding

1. Minor — docs/reference/folder.md:11-12 (also docs/community-vs-enterprise.md:23 and docs/guides/folders.md:35-36). The banner says Community refuses every folder request, and the group table says folder is unavailable, but the revised move section says folder move <workflow> --to (root) succeeds on Community. The implementation skips the gated folder lookup and sends root marker 0; test/e2e/folder.e2e.ts proves success for a workflow already at root. A reader may wrongly assume this command always fails on Community. Qualify the broad license statements with the root-move exception, and retain the caveat that removing a workflow from an actual folder was not verified on Community.

Reviewed boundary: all eight repair-diff files, their changed lines and relevant surrounding claims; the named source, helper, keychain and e2e files at the pinned head. The removed source-control JSON examples repeated unproven full error text; the remaining code and license-message claims match the e2e checks and recorded 2.40.5 observation. Other branch changes and licensed happy paths were not reviewed. No local execution; PR checks check, e2e and e2e-macos are green on this head. No labels requested.