feat!: remove the --user/KB_USER surface from local commands (#165)

The local surfaces (task CLI, TUI, MCP) no longer select a board owner:
--user and the KB_USER environment fallback are gone, and every dispatch
seam passes the literal "default" to the store.

The store API keeps its user parameter and the schema is unchanged, so
kb serve's wire contract and storage keys are untouched. Databases that
still hold tasks under another namespace keep them; local commands print
one warning line naming those namespaces and leave the data alone.

kb mcp parses its flags with ContinueOnError so an unknown flag is a
usage error instead of a process exit, matching kb serve.

Closes #164

Author: aksOps

.claude/skills/kb-issues/SKILL.md

@@ -14,10 +14,8 @@ chosen, where a workflow reaches for `gh issue` or `glab issue`, use the
 
 ## Environment
 
-- `KB_USER` — board owner every command operates on (default `default`).
-  An explicit `--user` flag beats it. Identities are lowercased; stick to
-  `[a-z0-9._@-]`.
-- `KB_DATA` — data directory override.
+- `KB_DATA` — data directory override. Local commands always operate on the
+  single `default` board; there is no per-user selection.
 - `KB_SERVER` + `KB_SERVER_TOKEN` — operate against a running kb server
   over HTTP instead of the local database.
 - MCP-capable agents can run `kb mcp` and use the board tools directly
@@ -43,7 +41,7 @@ chosen, where a workflow reaches for `gh issue` or `glab issue`, use the
 | `gh issue comment N --body B` | `kb comment add <id> "B"` |
 | view comments | `kb comment list <id> [--json]` |
 | delete a comment | `kb comment rm <cid> --yes` (ids are `c1, c2, ...`, stable) |
-| assignees | one board per user: `--user name`; `kb users` lists boards |
+| assignees | not modelled: local kb is one board. `kb users` lists any legacy owners still in the database |
 
 Run `kb help` for every flag (priority, due dates, effort, checklists,
 blocked flag, status moves).

README.md

@@ -49,15 +49,15 @@ kb
 When both stdin and stdout are TTYs, a bare `kb` opens the full-screen TUI.
 When either stream is redirected, it prints root help and exits successfully
 without creating or opening the data directory. `kb tui` remains the explicit
-form and accepts `--data` and `--user`.
+form and accepts `--data`.
 
 ```sh
-kb tui --data ~/.local/share/kb --user default
+kb tui --data ~/.local/share/kb
 kb --help
 ```
 
-The default data directory is `$KB_DATA` or `~/.local/share/kb`. The default
-board owner is `$KB_USER` or `default`.
+The default data directory is `$KB_DATA` or `~/.local/share/kb`. Local modes
+always operate on the `default` board.
 
 ## Terminal UI
 
@@ -67,7 +67,7 @@ The TUI is the primary human interface. It includes:
 - card detail, markdown rendering, comments, and blocker links;
 - create/edit forms with labels, due dates, effort, priority, checklists, and
   blocked state;
-- persistent text and label filters per board owner;
+- persistent text and label filters per board;
 - keyboard lift/drop and mouse drag moves with filtered-order correctness;
 - completion guards, tick-all/force-ship choices, auto-ship, unship, cancel,
   restore, and permanent deletion;
@@ -105,11 +105,14 @@ The data directory contains:
 - `kb.db`, the SQLite database;
 - `secret`, the generated encryption secret when `KB_SECRET` is unset;
 - `skills/`, optional user skill overrides;
-- TUI preference state scoped by database and board owner.
+- TUI preference state scoped by database path.
 
-Board owners are normalized to lowercase and may contain ASCII letters,
-digits, `.`, `_`, `@`, and `-`. Use `--user NAME` or `KB_USER` consistently
-across the TUI, CLI, and MCP server.
+The TUI, task CLI, and MCP server all operate on the single `default` board.
+Board owners still exist in the schema, because `kb serve` serves one board per
+authenticated identity, but they are not selectable from local commands. A
+database written by an older version that holds tasks under another owner keeps
+them; local commands print one warning line naming those namespaces and leave
+the data alone. `kb users` lists them, and `kb serve` still serves them.
 
 Provider API keys and forge tokens are encrypted at rest with AES-256-GCM.
 Keep the `secret` file with the database. Losing it makes stored credentials
@@ -140,9 +143,9 @@ Root server flags are rejected with exit code 2 and point to `kb serve`, so an
 old service fails visibly instead of silently launching the wrong mode.
 
 If an old Entra-backed deployment used the immutable `oid` claim as its board
-owner, pass that value with `--user` or `KB_USER`. Token-mode deployments use
-the former `X-KB-User` value. Browser-only session tokens and display state are
-not database records and are not migrated.
+owner, that board is still served by `kb serve` under the same identity.
+Browser-only session tokens and display state are not database records and are
+not migrated.
 
 Update service units and container commands before replacing the binary. A
 reverse proxy may continue forwarding `/api/*` for API clients, but there is no
@@ -173,13 +176,12 @@ unique UUID prefix also work. `cancel` is reversible. `rm --yes` permanently
 deletes a Cancelled task. Moving to Done is refused while checklist items or
 blockers remain unless `--force` is explicit.
 
-Every task command accepts `--data`, `--user`, and `--json`. Set `KB_SERVER` to
-use the same verbs against an optional HTTP server:
+Every task command accepts `--data` and `--json`. Set `KB_SERVER` to use the
+same verbs against an optional HTTP server:
 
 ```sh
 export KB_SERVER=http://127.0.0.1:8080
 export KB_SERVER_TOKEN=shared-secret
-export KB_USER=alice
 kb list
 ```
 
@@ -191,7 +193,7 @@ kb list
 HTTP server is required.
 
 ```sh
-kb mcp --data ~/.local/share/kb --user default
+kb mcp --data ~/.local/share/kb
 ```
 
 Example configuration:
@@ -331,7 +333,6 @@ returned in settings responses.
 | Variable | Used by | Meaning |
 | --- | --- | --- |
 | `KB_DATA` | all local modes, serve | Data directory |
-| `KB_USER` | TUI, CLI, MCP | Default board owner |
 | `KB_SECRET` | all store users | Encryption secret override |
 | `KB_SERVER` | task CLI | Optional remote API base URL |
 | `KB_SERVER_TOKEN` | task CLI | Bearer token for remote mode |

dispatch.go

@@ -183,15 +183,26 @@ func versionString(info *debug.BuildInfo, ok bool) string {
 	return out
 }
 
-// runMCP serves the board over MCP stdio: kb mcp [--data DIR] [--user NAME].
+// defaultBoardUser is the single board namespace every local surface (CLI,
+// TUI, MCP) operates on. The --user/KB_USER selection was removed; the store
+// and the HTTP wire API keep their user parameter for kb serve.
+const defaultBoardUser = "default"
+
+// runMCP serves the board over MCP stdio: kb mcp [--data DIR].
 func runMCP(args []string) error {
-	fs := flag.NewFlagSet("kb mcp", flag.ExitOnError)
+	return runMCPWithFlagOutput(args, os.Stderr)
+}
+
+// runMCPWithFlagOutput keeps flag failures returnable (kb serve does the same)
+// so an unknown flag is a testable usage error instead of a process exit.
+func runMCPWithFlagOutput(args []string, output io.Writer) error {
+	fs := flag.NewFlagSet("kb mcp", flag.ContinueOnError)
+	fs.SetOutput(output)
 	dataDir := fs.String("data", defaultDataDir(), "board storage directory (env KB_DATA)")
-	user := fs.String("user", envOr("KB_USER", "default"), "board user the tools operate on (env KB_USER)")
 	if err := fs.Parse(args); err != nil {
-		return err
+		return &webFlagError{err: err}
 	}
-	return mcpRun(*dataDir, *user)
+	return mcpRun(*dataDir, defaultBoardUser)
 }
 
 // defaultDataDir resolves the board storage directory: KB_DATA if set, else

dispatch_test.go

@@ -83,11 +83,19 @@ func TestRunMCPPassesResolvedFlags(t *testing.T) {
 		return nil
 	}
 	wantData := filepath.Join(t.TempDir(), "boards")
-	if err := runMCP([]string{"--data", wantData, "--user", "Alice.Work"}); err != nil {
+	if err := runMCP([]string{"--data", wantData}); err != nil {
 		t.Fatalf("runMCP: %v", err)
 	}
-	if gotData != wantData || gotUser != "Alice.Work" {
-		t.Fatalf("mcp args = %q, %q; want %q, Alice.Work", gotData, gotUser, wantData)
+	if gotData != wantData || gotUser != defaultBoardUser {
+		t.Fatalf("mcp args = %q, %q; want %q, %s", gotData, gotUser, wantData, defaultBoardUser)
+	}
+
+	// The board namespace is no longer selectable from the command line.
+	var flagOutput bytes.Buffer
+	err := runMCPWithFlagOutput([]string{"--user", "alice"}, &flagOutput)
+	var flagErr *webFlagError
+	if !errors.As(err, &flagErr) || !strings.Contains(err.Error(), "flag provided but not defined: -user") {
+		t.Fatalf("--user should be rejected: %v", err)
 	}
 
 	mcpRun = func(string, string) error { return errors.New("serve failed") }