docs(skill): cover Chatflow starter LLM, draft_changed and domain 403 codes

skills/difyctl/references/build-workflow/build.md

@@ -41,7 +41,7 @@ Build this one app; never make copies.
    - `completed-with-warnings`: stop and read `warnings`.
    - `pending`: the DSL version differs from the server's. Show the human both versions. On a yes, run `difyctl confirm console_app dsl_import --import-id <id> --json`.
    - `dsl_invalid`: fix the issues in `details` by `loc`.
-   - The draft changed since your export: someone else edited it. Export again, show the human the difference, and never overwrite it.
+   - `draft_changed` (409, also on `confirm`): someone else edited the draft since your export. Export again, show the human the difference, and never overwrite it.
    - Any other failure: stop and show the human the message.
 
 5. Test each new node alone. It reuses the last full run's values; override them with `--inputs`, keyed `#<node_id>.<var>#`. Give a file variable a local file with `--files '{"<variable>": "<path>"}'`.

skills/difyctl/references/build-workflow/dsl.md

@@ -1,6 +1,6 @@
 # App DSL
 
-Start from an export of the app's draft: a new app's export is a valid empty skeleton. Keep its `version`, `kind`, `features`, `environment_variables` and `conversation_variables`.
+Start from an export of the app's draft. A new Workflow app's export is empty. A new Chatflow's is `start` → `llm` (no model, so `resource_unavailable`) → `answer` (`{{#llm.text#}}`). Keep the export's `version`, `kind`, `features`, `environment_variables` and `conversation_variables`.
 
 ## Where things go
 

skills/difyctl/references/build-workflow/handover.md

@@ -32,7 +32,7 @@ Start when every slice in `plan.md` is ticked. `<mode>` is `workflow` or `advanc
      difyctl set service_api --app-id <app_id> --enabled --json
      ```
 
-   - Who may open the web app (Enterprise): `public`, `private_all` or `sso_verified`. Picking members or groups (`private`) is done in the Dify console. `difyctl run` obeys this too, so the logged-in account must be allowed for the smoke test.
+   - Who may open the web app (Enterprise): `public`, `private_all` or `sso_verified`. Picking members or groups (`private`) is done in the Dify console. `difyctl run` obeys this too, so the logged-in account must be allowed for the smoke test. `public` exits 4 with `webapp_public_access_disabled` when the server disables public web apps; offer the human `private_all` or `sso_verified`.
 
      ```bash
      difyctl set webapp_access --app-id <app_id> --access-mode <access_mode> --json

skills/difyctl/references/build-workflow/plan.md

@@ -13,7 +13,7 @@ Start only when the human has approved `spec.md`. The plan phase ends when the h
    - Code: the code itself.
    - Variable references, written as `{{#node_id.var#}}`.
 3. Draw the node-level Mermaid graph with real node ids, every edge, and a label on every branch.
-4. Cut the build into slices. Each slice is small and connected, and imports and runs on its own. Slice 1 is the skeleton: start → end (Chatflow: start → answer) with the final inputs and outputs.
+4. Cut the build into slices. Each slice is small and connected, and imports and runs on its own. Slice 1 is the skeleton: start → end (Chatflow: start → answer; set the starter `llm` node's model or remove it and rewrite `answer`) with the final inputs and outputs.
 5. Map the tests: a `difyctl test node <mode>` call with inputs for each new node, and a full draft run (`difyctl test console_app <mode>`) at the end of each slice on the cases it can pass. `<mode>` is `workflow` or `advanced_chat`.
 6. Check coverage. Every requirement maps to a node and a test. Every resource is confirmed, and each chosen plugin is installed and configured. An open resource blocks approval.
 7. Ask the human to review the plan, and to choose how to build:

skills/difyctl/references/operations.md

@@ -12,7 +12,7 @@ Run an app with the op for its mode: `run console_app workflow`, `run console_ap
 
 ## Reading results
 
-Streaming ops fold to `{status, text, outputs?, total_tokens?, message_id?, conversation_id?, run_id?, error?, hints}`. `text.answer` is the reply; `text.by_source` appears only while `status` is `incomplete`. `status` is `ended`, `failed` (exit 1), `suspended` (a form is waiting; follow `hints`) or `incomplete` (stream broke early; exit 0, so check `status`). Any response may carry `hints: [{summary, op, input, form?}]`, the server's next steps: next page, confirm step, reply op, form submit. Fill any `null` in `input` and pass it back with `difyctl <op, dots as spaces> --input '<input>'`.
+Streaming ops fold to `{status, text, outputs?, total_tokens?, message_id?, conversation_id?, run_id?, error?, hints}`. `text.answer` is the reply; `text.by_source` appears only while `status` is `incomplete`. `status` is `ended`, `failed` (exit 1), `suspended` (a form is waiting; follow `hints`) or `incomplete` (stream broke early; exit 0, so check `status`). Any response may carry `hints: [{summary, op, input, form?}]`, the server's next steps: next page, confirm step, reply op, form submit. Errors can carry them too, at `error.server.hints`. Fill any `null` in `input` and pass it back with `difyctl <op, dots as spaces> --input '<input>'`.
 
 After `submit.run.form`, run its `get.run.event` hint to follow the run; repeat if it suspends again.
 
@@ -20,6 +20,6 @@ After `submit.run.form`, run its `get.run.event` hint to follow the run; repeat
 
 Stderr envelope: `{"error":{"code","message","hint"?,"details"?,"schema"?,"http_status"?,"server"?}}`. `code` is difyctl's (`server_error` for server rejections); the server's code is `error.server.code` (e.g. `dsl_invalid`). `details`: `[{loc,msg}]`.
 
-Exit: 2 bad input caught locally (incl. near-miss command); 1 server rejection or other failure; 4 not logged in (incl. unknown word while logged out), 401, 403; 6 catalog unavailable or `unknown_op`; 7 rate limited.
+Exit: 2 bad input caught locally (incl. near-miss command); 1 server rejection or other failure; 4 not logged in (incl. unknown word while logged out), 401, 403 (a domain `error.server.code` such as `webapp_public_access_disabled`, `service_api_disabled` or `plugin_install_forbidden` is not a login problem: read the code and its hint); 6 catalog unavailable or `unknown_op`; 7 rate limited.
 
 PowerShell: use `--input @file.json`, and `$env:VAR='v'; difyctl ...`.

skills/difyctl/references/plugins.md

@@ -28,10 +28,10 @@
 2. Ask the human for each form value. Never invent one, never print it, never write it into the working folder.
 3. Pass the values on stdin: `difyctl create model_provider credential --provider <id> --credentials @-` (for tools, `difyctl create tool_provider credential --provider <id> --credentials @-`), then write the JSON object to stdin.
 4. Rejected (model 422, tool 400): nothing saved; show the message, ask again.
-5. Model providers only: if a credential is already active, the hint offers `set` to replace it.
+5. Model providers only: if a credential is already active, the hint offers `set` to replace it. `active: false` with no hint means the model has saved credentials but none in use: ask the human to pick one in the console.
 6. A tool provider whose `credential_types` lacks `api-key` uses OAuth. Ask the human to authorize it in the console.
 
-Self-hosted or OpenAI-compatible models: `create model credential` with `--model`, `--model-type` and `--credentials @-`.
+Self-hosted or OpenAI-compatible models: `create model credential` with `--provider <id>`, `--model`, `--model-type` and `--credentials @-`.
 
 ## Remove