@akon-labs/nexus-cli 0.1.3 → 0.1.5

package/README.md

@@ -6,8 +6,6 @@ Nexus is a minimal terminal coding harness that ships connected to your GitNexus
 
 Nexus runs in four modes: interactive, print or JSON, RPC for process integration, and an SDK for embedding in your own apps.
 
-Built on a vendored fork of [pi](https://pi.dev) (`earendil-works/pi`, MIT). Packages published for pi work here unchanged.
-
 ## Table of Contents
 
 - [Quick Start](#quick-start)
@@ -42,20 +40,21 @@ npm install -g --ignore-scripts @akon-labs/nexus-cli
 
 `--ignore-scripts` disables dependency lifecycle scripts during install. Nexus does not require install scripts for normal npm installs.
 
-Authenticate with an API key:
+Start Nexus. The first interactive launch opens the GitNexus browser sign-in flow:
 
 ```bash
-export ANTHROPIC_API_KEY=sk-ant-...
 nexus
 ```
 
-Or use your existing subscription:
+Inside a session, `/login` signs in to GitNexus again. Configure the model provider separately:
 
-```bash
-nexus
-/login  # Then select provider
+```text
+/byok
+/model
 ```
 
+For headless GitNexus authentication, set `GITNEXUS_TOKEN`. Model API keys can still be set through provider environment variables such as `ANTHROPIC_API_KEY`.
+
 Then just talk to nexus. By default, nexus gives the model four tools: `read`, `write`, `edit`, and `bash`. The model uses these to fulfill your requests. Add capabilities via [skills](#skills), [prompt templates](#prompt-templates), [extensions](#extensions), or [nexus packages](#nexus-packages).
 
 **Platform notes:** [Windows](docs/windows.md) | [Termux (Android)](docs/termux.md) | [tmux](docs/tmux.md) | [Terminal setup](docs/terminal-setup.md) | [Shell aliases](docs/shell-aliases.md)
@@ -64,7 +63,7 @@ Then just talk to nexus. By default, nexus gives the model four tools: `read`, `
 
 ## Providers & Models
 
-For each built-in provider, nexus maintains a list of tool-capable models. Configured provider catalogs refresh automatically; run `nexus update --models` to force an immediate refresh. Authenticate via subscription (`/login`) or API key, then select any model from that provider via `/model` (or Ctrl+L).
+For each built-in provider, nexus maintains a list of tool-capable models. Configured provider catalogs refresh automatically; run `nexus update --models` to force an immediate refresh. Use `/byok` to configure a subscription, API key, or local Ollama model, then select a model via `/model` (or Ctrl+L).
 
 **Subscriptions:**
 - Anthropic Claude Pro/Max
@@ -104,7 +103,7 @@ For each built-in provider, nexus maintains a list of tool-capable models. Confi
 - Xiaomi MiMo Token Plan (Amsterdam)
 - Xiaomi MiMo Token Plan (Singapore)
 
-Nexus also supports the llama.cpp router server. Configure it with `/login llama.cpp`, manage downloads and loaded models with `/llama`, then select a loaded model with `/model`. See [docs/llama-cpp.md](docs/llama-cpp.md) for setup and usage.
+Nexus also supports the llama.cpp router server. Configure it with `/byok llama.cpp`, manage downloads and loaded models with `/llama`, then select a loaded model with `/model`. See [docs/llama-cpp.md](docs/llama-cpp.md) for setup and usage.
 
 See [docs/providers.md](docs/providers.md) for other provider setup instructions.
 
@@ -144,7 +143,10 @@ Type `/` in the editor to trigger commands. [Extensions](#extensions) can regist
 
 | Command | Description |
 |---------|-------------|
-| `/login`, `/logout` | Manage provider credentials |
+| `/login` | Sign in to GitNexus |
+| `/byok [provider\|ollama]` | Configure a cloud provider, API key, or local Ollama model |
+| `/logout` | Remove stored model-provider credentials |
+| `/gitnexus-status` | Show the GitNexus connection status |
 | [`/llama`](docs/llama-cpp.md) | Download, load, and unload llama.cpp router models |
 | `/model` | Switch models |
 | `/scoped-models` | Enable/disable models for Ctrl+P cycling |
@@ -164,7 +166,6 @@ Type `/` in the editor to trigger commands. [Extensions](#extensions) can regist
 | `/share` | Upload as private GitHub gist with shareable HTML link |
 | `/reload` | Reload keybindings, extensions, skills, prompts, themes, and context files |
 | `/hotkeys` | Show all keyboard shortcuts |
-| `/changelog` | Display version history |
 | `/quit` | Quit nexus |
 
 ### Keyboard Shortcuts
@@ -278,7 +279,7 @@ Use `/trust` in interactive mode to save a project trust decision for future ses
 
 Nexus has two separate startup features:
 
-- **Update check:** fetches `https://pi.dev/api/latest-version` to check whether a newer version exists. Disable it with `NEXUS_SKIP_VERSION_CHECK=1`. This still points at the upstream endpoint and is pending replacement.
+- **Update check:** disabled until a Nexus release feed is configured with `NEXUS_LATEST_VERSION_URL`. Disable a configured feed with `NEXUS_SKIP_VERSION_CHECK=1`.
 - **Provider attribution headers:** optional headers sent with OpenRouter, Cloudflare, and direct NVIDIA NIM requests. Controlled by `enableInstallTelemetry` in `settings.json` or `NEXUS_TELEMETRY=0`.
 
 Nexus does not send install or update pings.
@@ -376,7 +377,7 @@ Place in `~/.nexus/agent/themes/`, `.nexus/themes/`, or a [nexus package](#nexus
 
 ### Nexus Packages
 
-Bundle and share extensions, skills, prompts, and themes via npm or git. Find packages on [npmjs.com](https://www.npmjs.com/search?q=keywords%3Api-package).
+Bundle and share extensions, skills, prompts, and themes via npm or git.
 
 > **Security:** Nexus packages run with full system access. Extensions execute arbitrary code, and skills can instruct the model to perform any action including running executables. Review source code before installing third-party packages.
 
@@ -410,8 +411,8 @@ Create a package by adding a `nexus` key to `package.json`:
 
 ```json
 {
-  "name": "my-pi-package",
-  "keywords": ["pi-package"],
+  "name": "my-nexus-package",
+  "keywords": ["nexus-package"],
   "nexus": {
     "extensions": ["./extensions"],
     "skills": ["./skills"],
@@ -432,7 +433,7 @@ See [docs/packages.md](docs/packages.md).
 ### SDK
 
 ```typescript
-import { createAgentSession, ModelRuntime, SessionManager } from "@earendil-works/pi-coding-agent";
+import { createAgentSession, ModelRuntime, SessionManager } from "@akon-labs/nexus-cli";
 
 const modelRuntime = await ModelRuntime.create();
 const { session } = await createAgentSession({
@@ -465,7 +466,7 @@ See [docs/rpc.md](docs/rpc.md) for the protocol.
 
 Nexus is aggressively extensible so it doesn't have to dictate your workflow. Features that other tools bake in can be built with [extensions](#extensions), [skills](#skills), or installed from third-party [nexus packages](#nexus-packages). This keeps the core minimal while letting you shape nexus to fit how you work.
 
-**No MCP.** Build CLI tools with READMEs (see [Skills](#skills)), or build an extension that adds MCP support. [Why?](https://mariozechner.at/posts/2025-11-02-what-if-you-dont-need-mcp/)
+**MCP is built in.** Nexus loads configured MCP servers through its built-in adapter while keeping extensions and skills available for workflows that do not need MCP.
 
 **No sub-agents.** There's many ways to do this. Spawn nexus instances via tmux, or build your own with [extensions](#extensions), or install a package that does it your way.
 
@@ -477,8 +478,6 @@ Nexus is aggressively extensible so it doesn't have to dictate your workflow. Fe
 
 **No background bash.** Use tmux. Full observability, direct interaction.
 
-Read the [blog post](https://mariozechner.at/posts/2025-11-30-pi-coding-agent/) for the full rationale.
-
 ---
 
 ## CLI Reference
@@ -642,8 +641,14 @@ nexus --thinking high "Solve this complex problem"
 | `NEXUS_CODING_AGENT_SESSION_DIR` | Override session storage directory (overridden by `--session-dir`) |
 | `NEXUS_PACKAGE_DIR` | Override package directory (useful for Nix/Guix where store paths tokenize poorly) |
 | `NEXUS_OFFLINE` | Disable startup network operations, including update checks, package update checks, and install/update telemetry |
-| `NEXUS_SKIP_VERSION_CHECK` | Skip the Nexus version update check at startup. This prevents the `pi.dev` latest-version request |
+| `NEXUS_LATEST_VERSION_URL` | Configure the Nexus JSON release-feed URL; no release feed is used by default |
+| `NEXUS_SKIP_VERSION_CHECK` | Skip the Nexus version update check at startup |
+| `NEXUS_SKIP_LOGIN` | Disable the GitNexus startup sign-in gate for CI and automated tests |
+| `NEXUS_RAIL` | Set to `0` to disable the GitNexus side rail in fullscreen mode |
+| `NEXUS_TRACE` | Set to `1` to enable GitNexus and text-mode tool tracing |
 | `NEXUS_TELEMETRY` | Override install/update telemetry and provider attribution headers. Use `1`/`true`/`yes` to enable or `0`/`false`/`no` to disable. This does not disable update checks |
+| `GITNEXUS_TOKEN` | GitNexus Hub token for headless or automated sign-in |
+| `GITNEXUS_HUB_URL` | Override the GitNexus Hub MCP endpoint |
 | `NEXUS_CACHE_RETENTION` | Set to `long` for extended prompt cache (Anthropic: 1h, OpenAI: 24h) |
 | `VISUAL`, `EDITOR` | Fallback external editor for Ctrl+G when `externalEditor` is unset; defaults to Notepad on Windows and `nano` elsewhere |
 
@@ -671,6 +676,6 @@ MIT
 
 ## See Also
 
-- [@earendil-works/pi-ai](https://www.npmjs.com/package/@earendil-works/pi-ai): Core LLM toolkit
-- [@earendil-works/pi-agent-core](https://www.npmjs.com/package/@earendil-works/pi-agent-core): Agent framework
-- [@earendil-works/pi-tui](https://www.npmjs.com/package/@earendil-works/pi-tui): Terminal UI components
+- `@akon-labs/nexus-cli/ai`: Core LLM toolkit
+- `@akon-labs/nexus-cli/agent-core`: Agent framework
+- `@akon-labs/nexus-cli/tui`: Terminal UI components

package/dist/cli/require-login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-login.d.ts","sourceRoot":"","sources":["../../src/cli/require-login.ts"],"names":[],"mappings":"AA2BA,wBAAgB,mBAAmB,IAAI,OAAO,CAG7C;AAED,MAAM,MAAM,eAAe,GACxB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,gFAAgF;AAChF,wBAAsB,kBAAkB,CAAC,MAAM,GAAE,WAAyC,GAAG,OAAO,CAAC,eAAe,CAAC,CAepH;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,MAAM,WAAW,WAAW;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oDAAoD;IACpD,KAAK,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,mDAAmD;IACnD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAMD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,EAAE,GAAE,WAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmChF;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAUlE","sourcesContent":["import { APP_NAME, readAppEnv } from \"../config.ts\";\nimport { GitNexusClient, GitNexusClientError } from \"../extensions/gitnexus/client.ts\";\nimport {\n\tDEFAULT_HUB_URL,\n\tgitNexusConfigPath,\n\tresolveGitNexusConfig,\n\tsaveGitNexusConfig,\n} from \"../extensions/gitnexus/config.ts\";\nimport {\n\tdefaultDeviceName,\n\tdeviceFingerprint,\n\tpollDeviceAuth,\n\tstartDeviceAuth,\n} from \"../extensions/gitnexus/device-auth.ts\";\nimport { openBrowser } from \"../utils/open-browser.ts\";\n\n/**\n * Sign-in gate.\n *\n * Nexus is a GitNexus client, so it requires an account. Startup stops here\n * until the hub accepts its credential. Model and session initialization happen\n * only after this check, so a stale token cannot fall through to a local provider.\n */\n\n/** Escape hatch for CI and automated tests, which never have a credential. */\nconst SKIP_ENV_SUFFIX = \"SKIP_LOGIN\";\n\nexport function isLoginGateDisabled(): boolean {\n\tconst value = readAppEnv(SKIP_ENV_SUFFIX);\n\treturn value === \"1\" || value?.toLowerCase() === \"true\";\n}\n\nexport type LoginGateStatus =\n\t| { status: \"signed_in\" }\n\t| { status: \"sign_in_required\"; reason?: string }\n\t| { status: \"unavailable\"; reason: string };\n\n/** Validate configured GitNexus auth against the hub before runtime startup. */\nexport async function getLoginGateStatus(signal: AbortSignal = AbortSignal.timeout(15_000)): Promise<LoginGateStatus> {\n\tif (isLoginGateDisabled()) return { status: \"signed_in\" };\n\tconst config = resolveGitNexusConfig();\n\tif (!config) return { status: \"sign_in_required\" };\n\n\ttry {\n\t\tawait new GitNexusClient(config).callTool(\"list_repos\", {}, signal);\n\t\treturn { status: \"signed_in\" };\n\t} catch (error) {\n\t\tconst reason = error instanceof Error ? error.message : String(error);\n\t\tif (error instanceof GitNexusClientError && error.kind === \"auth\") {\n\t\t\treturn { status: \"sign_in_required\", reason };\n\t\t}\n\t\treturn { status: \"unavailable\", reason };\n\t}\n}\n\nexport function loginUnavailableMessage(reason: string): string {\n\treturn `${APP_NAME}: GitNexus unavailable. Startup stopped.\\n\\n${reason}`;\n}\n\nexport interface LoginGateIo {\n\twrite(text: string): void;\n\t/** Injected in tests so no real waiting happens. */\n\tsleep?(ms: number): Promise<void>;\n\t/** Injected in tests so no browser is launched. */\n\topen?(url: string): void;\n}\n\nconst defaultIo: LoginGateIo = {\n\twrite: (text) => process.stdout.write(text),\n};\n\n/**\n * Run the browser device login and persist the token.\n *\n * Returns true once signed in. Any failure is reported and returns false, so\n * the caller decides whether to exit.\n */\nexport async function runLoginFlow(io: LoginGateIo = defaultIo): Promise<boolean> {\n\tconst hubUrl = process.env.GITNEXUS_HUB_URL ?? resolveGitNexusConfig()?.hubUrl ?? DEFAULT_HUB_URL;\n\n\tio.write(`\\nSign in to GitNexus to use ${APP_NAME}.\\n\\n`);\n\n\ttry {\n\t\tconst deviceName = defaultDeviceName();\n\t\tconst fingerprint = deviceFingerprint();\n\t\tconst start = await startDeviceAuth(hubUrl, { deviceName, deviceFingerprint: fingerprint });\n\t\tconst link = start.verificationUrlComplete ?? start.verificationUrl;\n\t\tio.write(`  Code: ${start.userCode}\\n`);\n\t\tio.write(`  Open: ${link}\\n\\n`);\n\t\t// Best effort: the launcher swallows its own failures, and the link is\n\t\t// printed above regardless, so a headless box still has a way through.\n\t\t(io.open ?? openBrowser)(link);\n\t\tio.write(\"Opening your browser… (ctrl+c to cancel)\\n\");\n\n\t\tconst result = await pollDeviceAuth(hubUrl, start, io.sleep ? { sleep: io.sleep } : {});\n\t\tconst config = {\n\t\t\thubUrl: result.hubUrl,\n\t\t\ttoken: result.token,\n\t\t\tdeviceFingerprint: fingerprint,\n\t\t\tdeviceName,\n\t\t};\n\t\tawait new GitNexusClient(config).callTool(\"list_repos\", {}, AbortSignal.timeout(15_000));\n\t\tconst path = saveGitNexusConfig(config);\n\t\tio.write(`\\nSigned in. Credential saved to ${path}\\n\\n`);\n\t\treturn true;\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tio.write(`\\nSign-in failed: ${message}\\n`);\n\t\tio.write(`Run ${APP_NAME} again to retry, or set GITNEXUS_TOKEN if you already have one.\\n`);\n\t\tio.write(\"Inside a session, /login → GitNexus account does the same thing.\\n\\n\");\n\t\treturn false;\n\t}\n}\n\n/** Message shown when a non-interactive run cannot prompt for sign-in. */\nexport function nonInteractiveLoginMessage(reason?: string): string {\n\treturn [\n\t\t`${APP_NAME}: not signed in.`,\n\t\t...(reason ? [``, reason] : []),\n\t\t\"\",\n\t\t`Run ${APP_NAME} with no arguments once to sign in through your browser,`,\n\t\t\"or set GITNEXUS_TOKEN for non-interactive use.\",\n\t\t\"\",\n\t\t`Credential location: ${gitNexusConfigPath()}`,\n\t].join(\"\\n\");\n}\n"]}
+{"version":3,"file":"require-login.d.ts","sourceRoot":"","sources":["../../src/cli/require-login.ts"],"names":[],"mappings":"AA2BA,wBAAgB,mBAAmB,IAAI,OAAO,CAG7C;AAED,MAAM,MAAM,eAAe,GACxB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,gFAAgF;AAChF,wBAAsB,kBAAkB,CAAC,MAAM,GAAE,WAAyC,GAAG,OAAO,CAAC,eAAe,CAAC,CAepH;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,MAAM,WAAW,WAAW;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oDAAoD;IACpD,KAAK,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,mDAAmD;IACnD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAMD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,EAAE,GAAE,WAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmChF;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAUlE","sourcesContent":["import { APP_NAME, readAppEnv } from \"../config.ts\";\nimport { GitNexusClient, GitNexusClientError } from \"../extensions/gitnexus/client.ts\";\nimport {\n\tDEFAULT_HUB_URL,\n\tgitNexusConfigPath,\n\tresolveGitNexusConfig,\n\tsaveGitNexusConfig,\n} from \"../extensions/gitnexus/config.ts\";\nimport {\n\tdefaultDeviceName,\n\tdeviceFingerprint,\n\tpollDeviceAuth,\n\tstartDeviceAuth,\n} from \"../extensions/gitnexus/device-auth.ts\";\nimport { openBrowser } from \"../utils/open-browser.ts\";\n\n/**\n * Sign-in gate.\n *\n * Nexus is a GitNexus client, so it requires an account. Startup stops here\n * until the hub accepts its credential. Model and session initialization happen\n * only after this check, so a stale token cannot fall through to a local provider.\n */\n\n/** Escape hatch for CI and automated tests, which never have a credential. */\nconst SKIP_ENV_SUFFIX = \"SKIP_LOGIN\";\n\nexport function isLoginGateDisabled(): boolean {\n\tconst value = readAppEnv(SKIP_ENV_SUFFIX);\n\treturn value === \"1\" || value?.toLowerCase() === \"true\";\n}\n\nexport type LoginGateStatus =\n\t| { status: \"signed_in\" }\n\t| { status: \"sign_in_required\"; reason?: string }\n\t| { status: \"unavailable\"; reason: string };\n\n/** Validate configured GitNexus auth against the hub before runtime startup. */\nexport async function getLoginGateStatus(signal: AbortSignal = AbortSignal.timeout(15_000)): Promise<LoginGateStatus> {\n\tif (isLoginGateDisabled()) return { status: \"signed_in\" };\n\tconst config = resolveGitNexusConfig();\n\tif (!config) return { status: \"sign_in_required\" };\n\n\ttry {\n\t\tawait new GitNexusClient(config).callTool(\"list_repos\", {}, signal);\n\t\treturn { status: \"signed_in\" };\n\t} catch (error) {\n\t\tconst reason = error instanceof Error ? error.message : String(error);\n\t\tif (error instanceof GitNexusClientError && error.kind === \"auth\") {\n\t\t\treturn { status: \"sign_in_required\", reason };\n\t\t}\n\t\treturn { status: \"unavailable\", reason };\n\t}\n}\n\nexport function loginUnavailableMessage(reason: string): string {\n\treturn `${APP_NAME}: GitNexus unavailable. Startup stopped.\\n\\n${reason}`;\n}\n\nexport interface LoginGateIo {\n\twrite(text: string): void;\n\t/** Injected in tests so no real waiting happens. */\n\tsleep?(ms: number): Promise<void>;\n\t/** Injected in tests so no browser is launched. */\n\topen?(url: string): void;\n}\n\nconst defaultIo: LoginGateIo = {\n\twrite: (text) => process.stdout.write(text),\n};\n\n/**\n * Run the browser device login and persist the token.\n *\n * Returns true once signed in. Any failure is reported and returns false, so\n * the caller decides whether to exit.\n */\nexport async function runLoginFlow(io: LoginGateIo = defaultIo): Promise<boolean> {\n\tconst hubUrl = process.env.GITNEXUS_HUB_URL ?? DEFAULT_HUB_URL;\n\n\tio.write(`\\nSign in to GitNexus to use ${APP_NAME}.\\n\\n`);\n\n\ttry {\n\t\tconst deviceName = defaultDeviceName();\n\t\tconst fingerprint = deviceFingerprint();\n\t\tconst start = await startDeviceAuth(hubUrl, { deviceName, deviceFingerprint: fingerprint });\n\t\tconst link = start.verificationUrlComplete ?? start.verificationUrl;\n\t\tio.write(`  Code: ${start.userCode}\\n`);\n\t\tio.write(`  Open: ${link}\\n\\n`);\n\t\t// Best effort: the launcher swallows its own failures, and the link is\n\t\t// printed above regardless, so a headless box still has a way through.\n\t\t(io.open ?? openBrowser)(link);\n\t\tio.write(\"Opening your browser… (ctrl+c to cancel)\\n\");\n\n\t\tconst result = await pollDeviceAuth(hubUrl, start, io.sleep ? { sleep: io.sleep } : {});\n\t\tconst config = {\n\t\t\thubUrl: result.hubUrl,\n\t\t\ttoken: result.token,\n\t\t\tdeviceFingerprint: fingerprint,\n\t\t\tdeviceName,\n\t\t};\n\t\tawait new GitNexusClient(config).callTool(\"list_repos\", {}, AbortSignal.timeout(15_000));\n\t\tconst path = saveGitNexusConfig(config);\n\t\tio.write(`\\nSigned in. Credential saved to ${path}\\n\\n`);\n\t\treturn true;\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tio.write(`\\nSign-in failed: ${message}\\n`);\n\t\tio.write(`Run ${APP_NAME} again to retry, or set GITNEXUS_TOKEN if you already have one.\\n`);\n\t\tio.write(\"Inside a session, /login → GitNexus account does the same thing.\\n\\n\");\n\t\treturn false;\n\t}\n}\n\n/** Message shown when a non-interactive run cannot prompt for sign-in. */\nexport function nonInteractiveLoginMessage(reason?: string): string {\n\treturn [\n\t\t`${APP_NAME}: not signed in.`,\n\t\t...(reason ? [``, reason] : []),\n\t\t\"\",\n\t\t`Run ${APP_NAME} with no arguments once to sign in through your browser,`,\n\t\t\"or set GITNEXUS_TOKEN for non-interactive use.\",\n\t\t\"\",\n\t\t`Credential location: ${gitNexusConfigPath()}`,\n\t].join(\"\\n\");\n}\n"]}

package/dist/cli/require-login.js

@@ -48,7 +48,7 @@ const defaultIo = {
  * the caller decides whether to exit.
  */
 export async function runLoginFlow(io = defaultIo) {
-    const hubUrl = process.env.GITNEXUS_HUB_URL ?? resolveGitNexusConfig()?.hubUrl ?? DEFAULT_HUB_URL;
+    const hubUrl = process.env.GITNEXUS_HUB_URL ?? DEFAULT_HUB_URL;
     io.write(`\nSign in to GitNexus to use ${APP_NAME}.\n\n`);
     try {
         const deviceName = defaultDeviceName();

package/dist/cli/require-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"require-login.js","sourceRoot":"","sources":["../../src/cli/require-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,GACf,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD;;;;;;GAMG;AAEH,8EAA8E;AAC9E,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,MAAM,UAAU,mBAAmB,GAAY;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;AAAA,CACxD;AAOD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAM,GAAgB,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAA4B;IACrH,IAAI,mBAAmB,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAEnD,IAAI,CAAC;QACJ,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;AAAA,CACD;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAU;IAC/D,OAAO,GAAG,QAAQ,+CAA+C,MAAM,EAAE,CAAC;AAAA,CAC1E;AAUD,MAAM,SAAS,GAAgB;IAC9B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAE,GAAgB,SAAS,EAAoB;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,qBAAqB,EAAE,EAAE,MAAM,IAAI,eAAe,CAAC;IAElG,EAAE,CAAC,KAAK,CAAC,gCAAgC,QAAQ,OAAO,CAAC,CAAC;IAE1D,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,uBAAuB,IAAI,KAAK,CAAC,eAAe,CAAC;QACpE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;QAChC,uEAAuE;QACvE,uEAAuE;QACvE,CAAC,EAAE,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,EAAE,CAAC,KAAK,CAAC,8CAA4C,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,iBAAiB,EAAE,WAAW;YAC9B,UAAU;SACV,CAAC;QACF,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,oCAAoC,IAAI,MAAM,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,EAAE,CAAC,KAAK,CAAC,qBAAqB,OAAO,IAAI,CAAC,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,OAAO,QAAQ,mEAAmE,CAAC,CAAC;QAC7F,EAAE,CAAC,KAAK,CAAC,wEAAsE,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CAAC,MAAe,EAAU;IACnE,OAAO;QACN,GAAG,QAAQ,kBAAkB;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,EAAE;QACF,OAAO,QAAQ,0DAA0D;QACzE,gDAAgD;QAChD,EAAE;QACF,wBAAwB,kBAAkB,EAAE,EAAE;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAA,CACb","sourcesContent":["import { APP_NAME, readAppEnv } from \"../config.ts\";\nimport { GitNexusClient, GitNexusClientError } from \"../extensions/gitnexus/client.ts\";\nimport {\n\tDEFAULT_HUB_URL,\n\tgitNexusConfigPath,\n\tresolveGitNexusConfig,\n\tsaveGitNexusConfig,\n} from \"../extensions/gitnexus/config.ts\";\nimport {\n\tdefaultDeviceName,\n\tdeviceFingerprint,\n\tpollDeviceAuth,\n\tstartDeviceAuth,\n} from \"../extensions/gitnexus/device-auth.ts\";\nimport { openBrowser } from \"../utils/open-browser.ts\";\n\n/**\n * Sign-in gate.\n *\n * Nexus is a GitNexus client, so it requires an account. Startup stops here\n * until the hub accepts its credential. Model and session initialization happen\n * only after this check, so a stale token cannot fall through to a local provider.\n */\n\n/** Escape hatch for CI and automated tests, which never have a credential. */\nconst SKIP_ENV_SUFFIX = \"SKIP_LOGIN\";\n\nexport function isLoginGateDisabled(): boolean {\n\tconst value = readAppEnv(SKIP_ENV_SUFFIX);\n\treturn value === \"1\" || value?.toLowerCase() === \"true\";\n}\n\nexport type LoginGateStatus =\n\t| { status: \"signed_in\" }\n\t| { status: \"sign_in_required\"; reason?: string }\n\t| { status: \"unavailable\"; reason: string };\n\n/** Validate configured GitNexus auth against the hub before runtime startup. */\nexport async function getLoginGateStatus(signal: AbortSignal = AbortSignal.timeout(15_000)): Promise<LoginGateStatus> {\n\tif (isLoginGateDisabled()) return { status: \"signed_in\" };\n\tconst config = resolveGitNexusConfig();\n\tif (!config) return { status: \"sign_in_required\" };\n\n\ttry {\n\t\tawait new GitNexusClient(config).callTool(\"list_repos\", {}, signal);\n\t\treturn { status: \"signed_in\" };\n\t} catch (error) {\n\t\tconst reason = error instanceof Error ? error.message : String(error);\n\t\tif (error instanceof GitNexusClientError && error.kind === \"auth\") {\n\t\t\treturn { status: \"sign_in_required\", reason };\n\t\t}\n\t\treturn { status: \"unavailable\", reason };\n\t}\n}\n\nexport function loginUnavailableMessage(reason: string): string {\n\treturn `${APP_NAME}: GitNexus unavailable. Startup stopped.\\n\\n${reason}`;\n}\n\nexport interface LoginGateIo {\n\twrite(text: string): void;\n\t/** Injected in tests so no real waiting happens. */\n\tsleep?(ms: number): Promise<void>;\n\t/** Injected in tests so no browser is launched. */\n\topen?(url: string): void;\n}\n\nconst defaultIo: LoginGateIo = {\n\twrite: (text) => process.stdout.write(text),\n};\n\n/**\n * Run the browser device login and persist the token.\n *\n * Returns true once signed in. Any failure is reported and returns false, so\n * the caller decides whether to exit.\n */\nexport async function runLoginFlow(io: LoginGateIo = defaultIo): Promise<boolean> {\n\tconst hubUrl = process.env.GITNEXUS_HUB_URL ?? resolveGitNexusConfig()?.hubUrl ?? DEFAULT_HUB_URL;\n\n\tio.write(`\\nSign in to GitNexus to use ${APP_NAME}.\\n\\n`);\n\n\ttry {\n\t\tconst deviceName = defaultDeviceName();\n\t\tconst fingerprint = deviceFingerprint();\n\t\tconst start = await startDeviceAuth(hubUrl, { deviceName, deviceFingerprint: fingerprint });\n\t\tconst link = start.verificationUrlComplete ?? start.verificationUrl;\n\t\tio.write(`  Code: ${start.userCode}\\n`);\n\t\tio.write(`  Open: ${link}\\n\\n`);\n\t\t// Best effort: the launcher swallows its own failures, and the link is\n\t\t// printed above regardless, so a headless box still has a way through.\n\t\t(io.open ?? openBrowser)(link);\n\t\tio.write(\"Opening your browser… (ctrl+c to cancel)\\n\");\n\n\t\tconst result = await pollDeviceAuth(hubUrl, start, io.sleep ? { sleep: io.sleep } : {});\n\t\tconst config = {\n\t\t\thubUrl: result.hubUrl,\n\t\t\ttoken: result.token,\n\t\t\tdeviceFingerprint: fingerprint,\n\t\t\tdeviceName,\n\t\t};\n\t\tawait new GitNexusClient(config).callTool(\"list_repos\", {}, AbortSignal.timeout(15_000));\n\t\tconst path = saveGitNexusConfig(config);\n\t\tio.write(`\\nSigned in. Credential saved to ${path}\\n\\n`);\n\t\treturn true;\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tio.write(`\\nSign-in failed: ${message}\\n`);\n\t\tio.write(`Run ${APP_NAME} again to retry, or set GITNEXUS_TOKEN if you already have one.\\n`);\n\t\tio.write(\"Inside a session, /login → GitNexus account does the same thing.\\n\\n\");\n\t\treturn false;\n\t}\n}\n\n/** Message shown when a non-interactive run cannot prompt for sign-in. */\nexport function nonInteractiveLoginMessage(reason?: string): string {\n\treturn [\n\t\t`${APP_NAME}: not signed in.`,\n\t\t...(reason ? [``, reason] : []),\n\t\t\"\",\n\t\t`Run ${APP_NAME} with no arguments once to sign in through your browser,`,\n\t\t\"or set GITNEXUS_TOKEN for non-interactive use.\",\n\t\t\"\",\n\t\t`Credential location: ${gitNexusConfigPath()}`,\n\t].join(\"\\n\");\n}\n"]}
+{"version":3,"file":"require-login.js","sourceRoot":"","sources":["../../src/cli/require-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,GACf,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD;;;;;;GAMG;AAEH,8EAA8E;AAC9E,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,MAAM,UAAU,mBAAmB,GAAY;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;AAAA,CACxD;AAOD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAM,GAAgB,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAA4B;IACrH,IAAI,mBAAmB,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAEnD,IAAI,CAAC;QACJ,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;AAAA,CACD;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAU;IAC/D,OAAO,GAAG,QAAQ,+CAA+C,MAAM,EAAE,CAAC;AAAA,CAC1E;AAUD,MAAM,SAAS,GAAgB;IAC9B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAE,GAAgB,SAAS,EAAoB;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,eAAe,CAAC;IAE/D,EAAE,CAAC,KAAK,CAAC,gCAAgC,QAAQ,OAAO,CAAC,CAAC;IAE1D,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,uBAAuB,IAAI,KAAK,CAAC,eAAe,CAAC;QACpE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;QAChC,uEAAuE;QACvE,uEAAuE;QACvE,CAAC,EAAE,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,EAAE,CAAC,KAAK,CAAC,8CAA4C,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,iBAAiB,EAAE,WAAW;YAC9B,UAAU;SACV,CAAC;QACF,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,oCAAoC,IAAI,MAAM,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,EAAE,CAAC,KAAK,CAAC,qBAAqB,OAAO,IAAI,CAAC,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,OAAO,QAAQ,mEAAmE,CAAC,CAAC;QAC7F,EAAE,CAAC,KAAK,CAAC,wEAAsE,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CAAC,MAAe,EAAU;IACnE,OAAO;QACN,GAAG,QAAQ,kBAAkB;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,EAAE;QACF,OAAO,QAAQ,0DAA0D;QACzE,gDAAgD;QAChD,EAAE;QACF,wBAAwB,kBAAkB,EAAE,EAAE;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAA,CACb","sourcesContent":["import { APP_NAME, readAppEnv } from \"../config.ts\";\nimport { GitNexusClient, GitNexusClientError } from \"../extensions/gitnexus/client.ts\";\nimport {\n\tDEFAULT_HUB_URL,\n\tgitNexusConfigPath,\n\tresolveGitNexusConfig,\n\tsaveGitNexusConfig,\n} from \"../extensions/gitnexus/config.ts\";\nimport {\n\tdefaultDeviceName,\n\tdeviceFingerprint,\n\tpollDeviceAuth,\n\tstartDeviceAuth,\n} from \"../extensions/gitnexus/device-auth.ts\";\nimport { openBrowser } from \"../utils/open-browser.ts\";\n\n/**\n * Sign-in gate.\n *\n * Nexus is a GitNexus client, so it requires an account. Startup stops here\n * until the hub accepts its credential. Model and session initialization happen\n * only after this check, so a stale token cannot fall through to a local provider.\n */\n\n/** Escape hatch for CI and automated tests, which never have a credential. */\nconst SKIP_ENV_SUFFIX = \"SKIP_LOGIN\";\n\nexport function isLoginGateDisabled(): boolean {\n\tconst value = readAppEnv(SKIP_ENV_SUFFIX);\n\treturn value === \"1\" || value?.toLowerCase() === \"true\";\n}\n\nexport type LoginGateStatus =\n\t| { status: \"signed_in\" }\n\t| { status: \"sign_in_required\"; reason?: string }\n\t| { status: \"unavailable\"; reason: string };\n\n/** Validate configured GitNexus auth against the hub before runtime startup. */\nexport async function getLoginGateStatus(signal: AbortSignal = AbortSignal.timeout(15_000)): Promise<LoginGateStatus> {\n\tif (isLoginGateDisabled()) return { status: \"signed_in\" };\n\tconst config = resolveGitNexusConfig();\n\tif (!config) return { status: \"sign_in_required\" };\n\n\ttry {\n\t\tawait new GitNexusClient(config).callTool(\"list_repos\", {}, signal);\n\t\treturn { status: \"signed_in\" };\n\t} catch (error) {\n\t\tconst reason = error instanceof Error ? error.message : String(error);\n\t\tif (error instanceof GitNexusClientError && error.kind === \"auth\") {\n\t\t\treturn { status: \"sign_in_required\", reason };\n\t\t}\n\t\treturn { status: \"unavailable\", reason };\n\t}\n}\n\nexport function loginUnavailableMessage(reason: string): string {\n\treturn `${APP_NAME}: GitNexus unavailable. Startup stopped.\\n\\n${reason}`;\n}\n\nexport interface LoginGateIo {\n\twrite(text: string): void;\n\t/** Injected in tests so no real waiting happens. */\n\tsleep?(ms: number): Promise<void>;\n\t/** Injected in tests so no browser is launched. */\n\topen?(url: string): void;\n}\n\nconst defaultIo: LoginGateIo = {\n\twrite: (text) => process.stdout.write(text),\n};\n\n/**\n * Run the browser device login and persist the token.\n *\n * Returns true once signed in. Any failure is reported and returns false, so\n * the caller decides whether to exit.\n */\nexport async function runLoginFlow(io: LoginGateIo = defaultIo): Promise<boolean> {\n\tconst hubUrl = process.env.GITNEXUS_HUB_URL ?? DEFAULT_HUB_URL;\n\n\tio.write(`\\nSign in to GitNexus to use ${APP_NAME}.\\n\\n`);\n\n\ttry {\n\t\tconst deviceName = defaultDeviceName();\n\t\tconst fingerprint = deviceFingerprint();\n\t\tconst start = await startDeviceAuth(hubUrl, { deviceName, deviceFingerprint: fingerprint });\n\t\tconst link = start.verificationUrlComplete ?? start.verificationUrl;\n\t\tio.write(`  Code: ${start.userCode}\\n`);\n\t\tio.write(`  Open: ${link}\\n\\n`);\n\t\t// Best effort: the launcher swallows its own failures, and the link is\n\t\t// printed above regardless, so a headless box still has a way through.\n\t\t(io.open ?? openBrowser)(link);\n\t\tio.write(\"Opening your browser… (ctrl+c to cancel)\\n\");\n\n\t\tconst result = await pollDeviceAuth(hubUrl, start, io.sleep ? { sleep: io.sleep } : {});\n\t\tconst config = {\n\t\t\thubUrl: result.hubUrl,\n\t\t\ttoken: result.token,\n\t\t\tdeviceFingerprint: fingerprint,\n\t\t\tdeviceName,\n\t\t};\n\t\tawait new GitNexusClient(config).callTool(\"list_repos\", {}, AbortSignal.timeout(15_000));\n\t\tconst path = saveGitNexusConfig(config);\n\t\tio.write(`\\nSigned in. Credential saved to ${path}\\n\\n`);\n\t\treturn true;\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tio.write(`\\nSign-in failed: ${message}\\n`);\n\t\tio.write(`Run ${APP_NAME} again to retry, or set GITNEXUS_TOKEN if you already have one.\\n`);\n\t\tio.write(\"Inside a session, /login → GitNexus account does the same thing.\\n\\n\");\n\t\treturn false;\n\t}\n}\n\n/** Message shown when a non-interactive run cannot prompt for sign-in. */\nexport function nonInteractiveLoginMessage(reason?: string): string {\n\treturn [\n\t\t`${APP_NAME}: not signed in.`,\n\t\t...(reason ? [``, reason] : []),\n\t\t\"\",\n\t\t`Run ${APP_NAME} with no arguments once to sign in through your browser,`,\n\t\t\"or set GITNEXUS_TOKEN for non-interactive use.\",\n\t\t\"\",\n\t\t`Credential location: ${gitNexusConfigPath()}`,\n\t].join(\"\\n\");\n}\n"]}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"","sourcesContent":["#!/usr/bin/env node\n/**\n * CLI entry point for the refactored coding agent.\n * Uses main.ts with AgentSession and new mode modules.\n *\n * Test with: npx tsx src/cli-new.ts [args...]\n */\nimport { APP_NAME, setAppEnv } from \"./config.ts\";\nimport { configureHttpDispatcher } from \"./core/http-dispatcher.ts\";\nimport { main } from \"./main.ts\";\n\nprocess.title = APP_NAME;\nsetAppEnv(\"CODING_AGENT\", \"true\");\nprocess.env.AI_AGENT = APP_NAME;\nprocess.emitWarning = (() => {}) as typeof process.emitWarning;\n\n// Configure undici's global dispatcher before provider SDKs issue requests.\n// Runtime settings are applied once SettingsManager has loaded global/project settings.\nconfigureHttpDispatcher();\n\nmain(process.argv.slice(2));\n"]}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"","sourcesContent":["#!/usr/bin/env node\n/**\n * CLI entry point for the refactored coding agent.\n * Uses main.ts with AgentSession and new mode modules.\n *\n * Test with: npx tsx src/cli-new.ts [args...]\n */\nimport { bedrockProviderModule } from \"@earendil-works/pi-ai/bedrock-provider\";\nimport { registerBunOAuthFlows } from \"@earendil-works/pi-ai/bun-oauth\";\nimport { setBedrockProviderModule } from \"@earendil-works/pi-ai/compat\";\nimport { APP_NAME, setAppEnv } from \"./config.ts\";\nimport { configureHttpDispatcher } from \"./core/http-dispatcher.ts\";\nimport { main } from \"./main.ts\";\n\n// The published entrypoints are single-file bundles, so modules that pi-ai\n// lazy-imports from disk at runtime (OAuth flows, the Bedrock provider) do\n// not exist as files — the same constraint as the standalone Bun binary.\n// Register the statically bundled implementations instead.\nregisterBunOAuthFlows();\nsetBedrockProviderModule(bedrockProviderModule);\n\nprocess.title = APP_NAME;\nsetAppEnv(\"CODING_AGENT\", \"true\");\nprocess.env.AI_AGENT = APP_NAME;\nprocess.emitWarning = (() => {}) as typeof process.emitWarning;\n\n// Configure undici's global dispatcher before provider SDKs issue requests.\n// Runtime settings are applied once SettingsManager has loaded global/project settings.\nconfigureHttpDispatcher();\n\nmain(process.argv.slice(2));\n"]}