@alook/cli 0.1.31 → 0.1.33

package/dist/index.js

@@ -15960,6 +15960,7 @@ __export(exports_schema, {
   user: () => user,
   taskMessage: () => taskMessage,
   session: () => session,
+  nativeOauthAttempt: () => nativeOauthAttempt,
   messageFlag: () => messageFlag,
   message: () => message,
   member: () => member,
@@ -15986,7 +15987,11 @@ __export(exports_schema, {
   agentEmailAccount: () => agentEmailAccount,
   agentAccess: () => agentAccess,
   agent: () => agent,
-  account: () => account
+  account: () => account,
+  NATIVE_OAUTH_STATUSES: () => NATIVE_OAUTH_STATUSES,
+  NATIVE_OAUTH_PROVIDERS: () => NATIVE_OAUTH_PROVIDERS,
+  NATIVE_OAUTH_PLATFORMS: () => NATIVE_OAUTH_PLATFORMS,
+  NATIVE_OAUTH_FAILURE_CODES: () => NATIVE_OAUTH_FAILURE_CODES
 });
 init_nanoid();
 
@@ -16051,6 +16056,7 @@ var TERMINAL_MEETING_STATUSES = [
   MeetingStatus.COMPLETED,
   MeetingStatus.FAILED
 ];
+var COMMUNITY_BOT_LIMIT_PER_OWNER = 20;
 var COMMUNITY_BOT_NAME_MIN = 1;
 var COMMUNITY_BOT_NAME_MAX = 32;
 var COMMUNITY_BOT_DESCRIPTION_MAX = 1024;
@@ -16120,6 +16126,119 @@ var verification = sqliteTable("verification", {
   createdAt: text("createdAt").notNull().$defaultFn(() => new Date().toISOString()),
   updatedAt: text("updatedAt").notNull().$defaultFn(() => new Date().toISOString())
 });
+var NATIVE_OAUTH_PROVIDERS = ["github", "google"];
+var NATIVE_OAUTH_PLATFORMS = [
+  "macos",
+  "windows",
+  "linux",
+  "ios",
+  "android"
+];
+var NATIVE_OAUTH_STATUSES = [
+  "pending",
+  "opened",
+  "ready",
+  "exchanging",
+  "consumed",
+  "failed",
+  "cancelled",
+  "replaced"
+];
+var NATIVE_OAUTH_FAILURE_CODES = [
+  "access_denied",
+  "provider_error",
+  "oauth_callback_failed",
+  "start_failed",
+  "invalid_handoff"
+];
+var nativeOauthAttempt = sqliteTable("native_oauth_attempt", {
+  id: text("id").primaryKey(),
+  instanceKeyHash: text("instance_key_hash").notNull(),
+  stateHash: text("state_hash").notNull(),
+  pkceChallenge: text("pkce_challenge").notNull(),
+  provider: text("provider").$type().notNull(),
+  platform: text("platform").$type().notNull(),
+  redirectPath: text("redirect_path").notNull(),
+  status: text("status").$type().notNull().default("pending"),
+  handoffCodeHash: text("handoff_code_hash"),
+  handoffExpiresAt: integer2("handoff_expires_at"),
+  authKind: text("auth_kind").$type(),
+  failureCode: text("failure_code").$type(),
+  attemptExpiresAt: integer2("attempt_expires_at").notNull(),
+  createdAt: integer2("created_at").notNull(),
+  updatedAt: integer2("updated_at").notNull(),
+  openedAt: integer2("opened_at"),
+  readyAt: integer2("ready_at"),
+  consumedAt: integer2("consumed_at"),
+  failedAt: integer2("failed_at"),
+  cancelledAt: integer2("cancelled_at"),
+  replacedAt: integer2("replaced_at")
+}, (t) => [
+  index("idx_native_oauth_attempt_instance_status").on(t.instanceKeyHash, t.status),
+  index("idx_native_oauth_attempt_id_status_expiry").on(t.id, t.status, t.attemptExpiresAt),
+  index("idx_native_oauth_attempt_terminal_cleanup").on(t.status, t.updatedAt),
+  uniqueIndex("uq_native_oauth_attempt_instance_live").on(t.instanceKeyHash).where(sql`status IN ('pending', 'opened', 'ready', 'exchanging')`),
+  uniqueIndex("uq_native_oauth_attempt_handoff_hash").on(t.handoffCodeHash).where(sql`handoff_code_hash IS NOT NULL`),
+  check2("ck_native_oauth_attempt_id", sql`length(${t.id}) BETWEEN 22 AND 64 AND ${t.id} NOT GLOB '*[^A-Za-z0-9_-]*'`),
+  check2("ck_native_oauth_attempt_hashes", sql`length(${t.instanceKeyHash}) = 64 AND ${t.instanceKeyHash} NOT GLOB '*[^0-9a-f]*'
+        AND length(${t.stateHash}) = 64 AND ${t.stateHash} NOT GLOB '*[^0-9a-f]*'
+        AND length(${t.pkceChallenge}) = 43 AND ${t.pkceChallenge} NOT GLOB '*[^A-Za-z0-9_-]*'
+        AND (${t.handoffCodeHash} IS NULL OR (length(${t.handoffCodeHash}) = 64 AND ${t.handoffCodeHash} NOT GLOB '*[^0-9a-f]*'))`),
+  check2("ck_native_oauth_attempt_enums", sql`${t.provider} IN ('github', 'google')
+        AND ${t.platform} IN ('macos', 'windows', 'linux', 'ios', 'android')
+        AND ${t.status} IN ('pending', 'opened', 'ready', 'exchanging', 'consumed', 'failed', 'cancelled', 'replaced')
+        AND (${t.authKind} IS NULL OR ${t.authKind} IN ('signin', 'signup'))
+        AND (${t.failureCode} IS NULL OR ${t.failureCode} IN ('access_denied', 'provider_error', 'oauth_callback_failed', 'start_failed', 'invalid_handoff'))`),
+  check2("ck_native_oauth_attempt_redirect", sql`length(${t.redirectPath}) BETWEEN 1 AND 2048
+        AND substr(${t.redirectPath}, 1, 1) = '/'
+        AND substr(${t.redirectPath}, 1, 2) <> '//'
+        AND instr(${t.redirectPath}, char(92)) = 0`),
+  check2("ck_native_oauth_attempt_epochs", sql`typeof(${t.createdAt}) = 'integer' AND ${t.createdAt} BETWEEN 0 AND 9007199254740991
+        AND typeof(${t.updatedAt}) = 'integer' AND ${t.updatedAt} BETWEEN ${t.createdAt} AND 9007199254740991
+        AND typeof(${t.attemptExpiresAt}) = 'integer' AND ${t.attemptExpiresAt} = ${t.createdAt} + 600000
+        AND (${t.handoffExpiresAt} IS NULL OR (typeof(${t.handoffExpiresAt}) = 'integer' AND ${t.handoffExpiresAt} <= ${t.attemptExpiresAt}))`),
+  check2("ck_native_oauth_attempt_state", sql`(
+          ${t.status} = 'pending'
+          AND ${t.openedAt} IS NULL AND ${t.readyAt} IS NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NULL AND ${t.handoffExpiresAt} IS NULL
+          AND ${t.authKind} IS NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'opened'
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NULL AND ${t.handoffExpiresAt} IS NULL
+          AND ${t.authKind} IS NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} IN ('ready', 'exchanging')
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NOT NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NOT NULL AND ${t.handoffExpiresAt} IS NOT NULL
+          AND ${t.handoffExpiresAt} = ${t.readyAt} + 120000
+          AND ${t.authKind} IS NOT NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'consumed'
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NOT NULL AND ${t.consumedAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NOT NULL AND ${t.handoffExpiresAt} IS NOT NULL
+          AND ${t.authKind} IS NOT NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'failed'
+          AND ${t.consumedAt} IS NULL AND ${t.failedAt} IS NOT NULL
+          AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.failureCode} IS NOT NULL
+        ) OR (
+          ${t.status} = 'cancelled'
+          AND ${t.consumedAt} IS NULL AND ${t.cancelledAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'replaced'
+          AND ${t.consumedAt} IS NULL AND ${t.replacedAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL
+          AND ${t.failureCode} IS NULL
+        )`)
+]);
 var workspace = sqliteTable("workspace", {
   id: text("id").primaryKey().$defaultFn(() => "sp_" + nanoid3()),
   name: text("name").notNull(),
@@ -17676,6 +17795,10 @@ var CommunityBotPatchRequestSchema = exports_external.object({
 var CommunityBotAddToServerRequestSchema = exports_external.object({
   botId: exports_external.string().min(1)
 });
+var CommunityServerOnboardRequestSchema = exports_external.strictObject({
+  botIds: exports_external.array(exports_external.string().min(1).max(128)).min(1).max(COMMUNITY_BOT_LIMIT_PER_OWNER).refine((ids) => new Set(ids).size === ids.length, "botIds must be unique"),
+  wakePrompt: exports_external.string().max(32768).refine((value) => value.trim().length > 0, "wakePrompt is required")
+});
 var CommunityAgentMessageContentSchema = exports_external.object({ text: exports_external.string().max(MAX_MESSAGE_CONTENT_LENGTH).default("") }).catchall(exports_external.unknown());
 var CommunityAgentSeqSchema = exports_external.number().int().min(0);
 var CommunityAgentPositiveSeqSchema = exports_external.number().int().min(1);
@@ -17873,6 +17996,13 @@ var HostCommandSchema = exports_external.discriminatedUnion("type", [
     launchId: exports_external.string().min(1),
     unreadNotice: exports_external.unknown()
   }),
+  exports_external.object({
+    type: exports_external.literal("agent:event"),
+    agentId: exports_external.string().min(1),
+    config: exports_external.unknown(),
+    launchId: exports_external.string().min(1),
+    prompt: exports_external.string().min(1).max(32768)
+  }),
   exports_external.object({
     type: exports_external.literal("agent:stop"),
     agentId: exports_external.string().min(1)
@@ -18325,6 +18455,15 @@ function createLogger(opts) {
 
 // ../shared/src/db/queries/_chunk.ts
 var D1_MAX_BIND_PARAMS = 100;
+function maxInParams(fixedParams) {
+  if (!Number.isInteger(fixedParams) || fixedParams < 0) {
+    throw new Error("fixed params must be a non-negative integer");
+  }
+  if (fixedParams >= D1_MAX_BIND_PARAMS) {
+    throw new Error("fixed params must leave room for at least one IN parameter");
+  }
+  return D1_MAX_BIND_PARAMS - fixedParams;
+}
 function maxRowsPerInsert(paramsPerRow) {
   if (paramsPerRow < 1)
     throw new Error("paramsPerRow must be >= 1");
@@ -18416,6 +18555,7 @@ var AGENT_MESSAGE_COLUMNS = {
   replyToId: communityMessage.replyToId
 };
 var channelJoinBaselineGuard = sql`${communityMessage.createdAt} > COALESCE(${communityChannelMember.addedAt}, ${communityServerMember.joinedAt}, '')`;
+var AGENT_UNREAD_CHANNEL_CHUNK_SIZE = maxInParams(13);
 
 // ../shared/src/db/queries/community/mention.ts
 var MENTION_INSERT_MAX_ROWS = maxRowsPerInsert(5);
@@ -19028,6 +19168,10 @@ var serverRailCommandSchema = exports_external.discriminatedUnion("kind", [
 var serverRailCommitRequestSchema = exports_external.strictObject({
   commands: exports_external.array(serverRailCommandSchema).min(1).max(MAX_SERVER_RAIL_COMMANDS)
 });
+// ../shared/src/db/queries/native-oauth.ts
+var ATTEMPT_TTL_MS = 10 * 60 * 1000;
+var HANDOFF_TTL_MS = 2 * 60 * 1000;
+var RETENTION_MS = 24 * 60 * 60 * 1000;
 // ../shared/src/db/queries/task.ts
 var DEFAULT_STALE_SECONDS = Number(process.env.ALOOK_STALE_DISPATCH_TIMEOUT_S) || 20;
 var DEFAULT_STALE_RUNNING_SECONDS = Number(process.env.ALOOK_STALE_RUNNING_TIMEOUT_S) || 3600;
@@ -19059,6 +19203,80 @@ var FTS_KEYWORDS = new Set(["and", "or", "not", "near"]);
 var FOLDER_ITEM_INSERT_MAX_ROWS = maxRowsPerInsert(3);
 // ../shared/src/db/queries/community/diagnostic-report.ts
 var diagnosticOwner = alias(user, "diagnostic_owner");
+// ../shared/src/lib/safe-redirect.ts
+var MAX_REDIRECT_BYTES = 2048;
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+function isSafeCandidate(value) {
+  return value.startsWith("/") && !value.startsWith("//") && !value.includes("\\") && !value.includes("#") && !CONTROL_CHARACTERS.test(value);
+}
+function isSafeRedirectPath(value) {
+  if (new TextEncoder().encode(value).byteLength > MAX_REDIRECT_BYTES)
+    return false;
+  if (!isSafeCandidate(value))
+    return false;
+  let decoded = value;
+  for (let depth = 0;depth < 8; depth += 1) {
+    let next;
+    try {
+      next = decodeURIComponent(decoded);
+    } catch {
+      return depth > 0;
+    }
+    if (next === decoded)
+      break;
+    if (!isSafeCandidate(next))
+      return false;
+    decoded = next;
+    if (depth === 7)
+      return false;
+  }
+  try {
+    const base = new URL("https://alook.invalid");
+    const resolved = new URL(value, base);
+    return resolved.origin === base.origin;
+  } catch {
+    return false;
+  }
+}
+
+// ../shared/src/lib/native-oauth-contract.ts
+var ATTEMPT_ID = /^[A-Za-z0-9_-]{22,64}$/;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var BASE64URL_32_BYTES = /^[A-Za-z0-9_-]{43}$/;
+var HANDOFF_CODE = /^[A-Za-z0-9_-]{32,128}$/;
+var nativeOauthProviderSchema = exports_external.enum(["github", "google"]);
+var nativeOauthPlatformSchema = exports_external.enum([
+  "macos",
+  "windows",
+  "linux",
+  "ios",
+  "android"
+]);
+var nativeOauthAttemptIdSchema = exports_external.string().regex(ATTEMPT_ID);
+var nativeOauthHandoffCodeSchema = exports_external.string().regex(HANDOFF_CODE);
+var nativeOauthFailureCodeSchema = exports_external.enum([
+  "access_denied",
+  "provider_error",
+  "oauth_callback_failed",
+  "start_failed",
+  "invalid_handoff"
+]);
+var nativeOauthRegistrationSchema = exports_external.object({
+  attemptId: nativeOauthAttemptIdSchema,
+  stateHash: exports_external.string().regex(SHA256_HEX),
+  codeChallenge: exports_external.string().regex(BASE64URL_32_BYTES),
+  instanceKeyHash: exports_external.string().regex(SHA256_HEX),
+  platform: nativeOauthPlatformSchema,
+  provider: nativeOauthProviderSchema,
+  redirectPath: exports_external.string().refine(isSafeRedirectPath)
+}).strict();
+var nativeOauthExchangeSchema = exports_external.object({
+  attemptId: nativeOauthAttemptIdSchema,
+  state: exports_external.string().regex(BASE64URL_32_BYTES),
+  verifier: exports_external.string().regex(BASE64URL_32_BYTES),
+  code: nativeOauthHandoffCodeSchema
+}).strict();
+var nativeOauthProofSchema = nativeOauthExchangeSchema.omit({ code: true }).strict();
 // ../shared/src/semver.ts
 function semverGte(a, b) {
   const pa = a.split(".").map(Number);

package/dist/session-runner.js

@@ -15869,6 +15869,7 @@ __export(exports_schema, {
   user: () => user,
   taskMessage: () => taskMessage,
   session: () => session,
+  nativeOauthAttempt: () => nativeOauthAttempt,
   messageFlag: () => messageFlag,
   message: () => message,
   member: () => member,
@@ -15895,7 +15896,11 @@ __export(exports_schema, {
   agentEmailAccount: () => agentEmailAccount,
   agentAccess: () => agentAccess,
   agent: () => agent,
-  account: () => account
+  account: () => account,
+  NATIVE_OAUTH_STATUSES: () => NATIVE_OAUTH_STATUSES,
+  NATIVE_OAUTH_PROVIDERS: () => NATIVE_OAUTH_PROVIDERS,
+  NATIVE_OAUTH_PLATFORMS: () => NATIVE_OAUTH_PLATFORMS,
+  NATIVE_OAUTH_FAILURE_CODES: () => NATIVE_OAUTH_FAILURE_CODES
 });
 init_nanoid();
 
@@ -15960,6 +15965,7 @@ var TERMINAL_MEETING_STATUSES = [
   MeetingStatus.COMPLETED,
   MeetingStatus.FAILED
 ];
+var COMMUNITY_BOT_LIMIT_PER_OWNER = 20;
 var COMMUNITY_BOT_NAME_MIN = 1;
 var COMMUNITY_BOT_NAME_MAX = 32;
 var COMMUNITY_BOT_DESCRIPTION_MAX = 1024;
@@ -16025,6 +16031,119 @@ var verification = sqliteTable("verification", {
   createdAt: text("createdAt").notNull().$defaultFn(() => new Date().toISOString()),
   updatedAt: text("updatedAt").notNull().$defaultFn(() => new Date().toISOString())
 });
+var NATIVE_OAUTH_PROVIDERS = ["github", "google"];
+var NATIVE_OAUTH_PLATFORMS = [
+  "macos",
+  "windows",
+  "linux",
+  "ios",
+  "android"
+];
+var NATIVE_OAUTH_STATUSES = [
+  "pending",
+  "opened",
+  "ready",
+  "exchanging",
+  "consumed",
+  "failed",
+  "cancelled",
+  "replaced"
+];
+var NATIVE_OAUTH_FAILURE_CODES = [
+  "access_denied",
+  "provider_error",
+  "oauth_callback_failed",
+  "start_failed",
+  "invalid_handoff"
+];
+var nativeOauthAttempt = sqliteTable("native_oauth_attempt", {
+  id: text("id").primaryKey(),
+  instanceKeyHash: text("instance_key_hash").notNull(),
+  stateHash: text("state_hash").notNull(),
+  pkceChallenge: text("pkce_challenge").notNull(),
+  provider: text("provider").$type().notNull(),
+  platform: text("platform").$type().notNull(),
+  redirectPath: text("redirect_path").notNull(),
+  status: text("status").$type().notNull().default("pending"),
+  handoffCodeHash: text("handoff_code_hash"),
+  handoffExpiresAt: integer2("handoff_expires_at"),
+  authKind: text("auth_kind").$type(),
+  failureCode: text("failure_code").$type(),
+  attemptExpiresAt: integer2("attempt_expires_at").notNull(),
+  createdAt: integer2("created_at").notNull(),
+  updatedAt: integer2("updated_at").notNull(),
+  openedAt: integer2("opened_at"),
+  readyAt: integer2("ready_at"),
+  consumedAt: integer2("consumed_at"),
+  failedAt: integer2("failed_at"),
+  cancelledAt: integer2("cancelled_at"),
+  replacedAt: integer2("replaced_at")
+}, (t) => [
+  index("idx_native_oauth_attempt_instance_status").on(t.instanceKeyHash, t.status),
+  index("idx_native_oauth_attempt_id_status_expiry").on(t.id, t.status, t.attemptExpiresAt),
+  index("idx_native_oauth_attempt_terminal_cleanup").on(t.status, t.updatedAt),
+  uniqueIndex("uq_native_oauth_attempt_instance_live").on(t.instanceKeyHash).where(sql`status IN ('pending', 'opened', 'ready', 'exchanging')`),
+  uniqueIndex("uq_native_oauth_attempt_handoff_hash").on(t.handoffCodeHash).where(sql`handoff_code_hash IS NOT NULL`),
+  check2("ck_native_oauth_attempt_id", sql`length(${t.id}) BETWEEN 22 AND 64 AND ${t.id} NOT GLOB '*[^A-Za-z0-9_-]*'`),
+  check2("ck_native_oauth_attempt_hashes", sql`length(${t.instanceKeyHash}) = 64 AND ${t.instanceKeyHash} NOT GLOB '*[^0-9a-f]*'
+        AND length(${t.stateHash}) = 64 AND ${t.stateHash} NOT GLOB '*[^0-9a-f]*'
+        AND length(${t.pkceChallenge}) = 43 AND ${t.pkceChallenge} NOT GLOB '*[^A-Za-z0-9_-]*'
+        AND (${t.handoffCodeHash} IS NULL OR (length(${t.handoffCodeHash}) = 64 AND ${t.handoffCodeHash} NOT GLOB '*[^0-9a-f]*'))`),
+  check2("ck_native_oauth_attempt_enums", sql`${t.provider} IN ('github', 'google')
+        AND ${t.platform} IN ('macos', 'windows', 'linux', 'ios', 'android')
+        AND ${t.status} IN ('pending', 'opened', 'ready', 'exchanging', 'consumed', 'failed', 'cancelled', 'replaced')
+        AND (${t.authKind} IS NULL OR ${t.authKind} IN ('signin', 'signup'))
+        AND (${t.failureCode} IS NULL OR ${t.failureCode} IN ('access_denied', 'provider_error', 'oauth_callback_failed', 'start_failed', 'invalid_handoff'))`),
+  check2("ck_native_oauth_attempt_redirect", sql`length(${t.redirectPath}) BETWEEN 1 AND 2048
+        AND substr(${t.redirectPath}, 1, 1) = '/'
+        AND substr(${t.redirectPath}, 1, 2) <> '//'
+        AND instr(${t.redirectPath}, char(92)) = 0`),
+  check2("ck_native_oauth_attempt_epochs", sql`typeof(${t.createdAt}) = 'integer' AND ${t.createdAt} BETWEEN 0 AND 9007199254740991
+        AND typeof(${t.updatedAt}) = 'integer' AND ${t.updatedAt} BETWEEN ${t.createdAt} AND 9007199254740991
+        AND typeof(${t.attemptExpiresAt}) = 'integer' AND ${t.attemptExpiresAt} = ${t.createdAt} + 600000
+        AND (${t.handoffExpiresAt} IS NULL OR (typeof(${t.handoffExpiresAt}) = 'integer' AND ${t.handoffExpiresAt} <= ${t.attemptExpiresAt}))`),
+  check2("ck_native_oauth_attempt_state", sql`(
+          ${t.status} = 'pending'
+          AND ${t.openedAt} IS NULL AND ${t.readyAt} IS NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NULL AND ${t.handoffExpiresAt} IS NULL
+          AND ${t.authKind} IS NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'opened'
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NULL AND ${t.handoffExpiresAt} IS NULL
+          AND ${t.authKind} IS NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} IN ('ready', 'exchanging')
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NOT NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NOT NULL AND ${t.handoffExpiresAt} IS NOT NULL
+          AND ${t.handoffExpiresAt} = ${t.readyAt} + 120000
+          AND ${t.authKind} IS NOT NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'consumed'
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NOT NULL AND ${t.consumedAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NOT NULL AND ${t.handoffExpiresAt} IS NOT NULL
+          AND ${t.authKind} IS NOT NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'failed'
+          AND ${t.consumedAt} IS NULL AND ${t.failedAt} IS NOT NULL
+          AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.failureCode} IS NOT NULL
+        ) OR (
+          ${t.status} = 'cancelled'
+          AND ${t.consumedAt} IS NULL AND ${t.cancelledAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'replaced'
+          AND ${t.consumedAt} IS NULL AND ${t.replacedAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL
+          AND ${t.failureCode} IS NULL
+        )`)
+]);
 var workspace = sqliteTable("workspace", {
   id: text("id").primaryKey().$defaultFn(() => "sp_" + nanoid3()),
   name: text("name").notNull(),
@@ -17580,6 +17699,10 @@ var CommunityBotPatchRequestSchema = exports_external.object({
 var CommunityBotAddToServerRequestSchema = exports_external.object({
   botId: exports_external.string().min(1)
 });
+var CommunityServerOnboardRequestSchema = exports_external.strictObject({
+  botIds: exports_external.array(exports_external.string().min(1).max(128)).min(1).max(COMMUNITY_BOT_LIMIT_PER_OWNER).refine((ids) => new Set(ids).size === ids.length, "botIds must be unique"),
+  wakePrompt: exports_external.string().max(32768).refine((value) => value.trim().length > 0, "wakePrompt is required")
+});
 var CommunityAgentMessageContentSchema = exports_external.object({ text: exports_external.string().max(MAX_MESSAGE_CONTENT_LENGTH).default("") }).catchall(exports_external.unknown());
 var CommunityAgentSeqSchema = exports_external.number().int().min(0);
 var CommunityAgentPositiveSeqSchema = exports_external.number().int().min(1);
@@ -17777,6 +17900,13 @@ var HostCommandSchema = exports_external.discriminatedUnion("type", [
     launchId: exports_external.string().min(1),
     unreadNotice: exports_external.unknown()
   }),
+  exports_external.object({
+    type: exports_external.literal("agent:event"),
+    agentId: exports_external.string().min(1),
+    config: exports_external.unknown(),
+    launchId: exports_external.string().min(1),
+    prompt: exports_external.string().min(1).max(32768)
+  }),
   exports_external.object({
     type: exports_external.literal("agent:stop"),
     agentId: exports_external.string().min(1)
@@ -18229,6 +18359,15 @@ function createLogger(opts) {
 
 // ../shared/src/db/queries/_chunk.ts
 var D1_MAX_BIND_PARAMS = 100;
+function maxInParams(fixedParams) {
+  if (!Number.isInteger(fixedParams) || fixedParams < 0) {
+    throw new Error("fixed params must be a non-negative integer");
+  }
+  if (fixedParams >= D1_MAX_BIND_PARAMS) {
+    throw new Error("fixed params must leave room for at least one IN parameter");
+  }
+  return D1_MAX_BIND_PARAMS - fixedParams;
+}
 function maxRowsPerInsert(paramsPerRow) {
   if (paramsPerRow < 1)
     throw new Error("paramsPerRow must be >= 1");
@@ -18320,6 +18459,7 @@ var AGENT_MESSAGE_COLUMNS = {
   replyToId: communityMessage.replyToId
 };
 var channelJoinBaselineGuard = sql`${communityMessage.createdAt} > COALESCE(${communityChannelMember.addedAt}, ${communityServerMember.joinedAt}, '')`;
+var AGENT_UNREAD_CHANNEL_CHUNK_SIZE = maxInParams(13);
 
 // ../shared/src/db/queries/community/mention.ts
 var MENTION_INSERT_MAX_ROWS = maxRowsPerInsert(5);
@@ -18932,6 +19072,10 @@ var serverRailCommandSchema = exports_external.discriminatedUnion("kind", [
 var serverRailCommitRequestSchema = exports_external.strictObject({
   commands: exports_external.array(serverRailCommandSchema).min(1).max(MAX_SERVER_RAIL_COMMANDS)
 });
+// ../shared/src/db/queries/native-oauth.ts
+var ATTEMPT_TTL_MS = 10 * 60 * 1000;
+var HANDOFF_TTL_MS = 2 * 60 * 1000;
+var RETENTION_MS = 24 * 60 * 60 * 1000;
 // ../shared/src/db/queries/task.ts
 var DEFAULT_STALE_SECONDS = Number(process.env.ALOOK_STALE_DISPATCH_TIMEOUT_S) || 20;
 var DEFAULT_STALE_RUNNING_SECONDS = Number(process.env.ALOOK_STALE_RUNNING_TIMEOUT_S) || 3600;
@@ -18963,6 +19107,80 @@ var FTS_KEYWORDS = new Set(["and", "or", "not", "near"]);
 var FOLDER_ITEM_INSERT_MAX_ROWS = maxRowsPerInsert(3);
 // ../shared/src/db/queries/community/diagnostic-report.ts
 var diagnosticOwner = alias(user, "diagnostic_owner");
+// ../shared/src/lib/safe-redirect.ts
+var MAX_REDIRECT_BYTES = 2048;
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+function isSafeCandidate(value) {
+  return value.startsWith("/") && !value.startsWith("//") && !value.includes("\\") && !value.includes("#") && !CONTROL_CHARACTERS.test(value);
+}
+function isSafeRedirectPath(value) {
+  if (new TextEncoder().encode(value).byteLength > MAX_REDIRECT_BYTES)
+    return false;
+  if (!isSafeCandidate(value))
+    return false;
+  let decoded = value;
+  for (let depth = 0;depth < 8; depth += 1) {
+    let next;
+    try {
+      next = decodeURIComponent(decoded);
+    } catch {
+      return depth > 0;
+    }
+    if (next === decoded)
+      break;
+    if (!isSafeCandidate(next))
+      return false;
+    decoded = next;
+    if (depth === 7)
+      return false;
+  }
+  try {
+    const base = new URL("https://alook.invalid");
+    const resolved = new URL(value, base);
+    return resolved.origin === base.origin;
+  } catch {
+    return false;
+  }
+}
+
+// ../shared/src/lib/native-oauth-contract.ts
+var ATTEMPT_ID = /^[A-Za-z0-9_-]{22,64}$/;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var BASE64URL_32_BYTES = /^[A-Za-z0-9_-]{43}$/;
+var HANDOFF_CODE = /^[A-Za-z0-9_-]{32,128}$/;
+var nativeOauthProviderSchema = exports_external.enum(["github", "google"]);
+var nativeOauthPlatformSchema = exports_external.enum([
+  "macos",
+  "windows",
+  "linux",
+  "ios",
+  "android"
+]);
+var nativeOauthAttemptIdSchema = exports_external.string().regex(ATTEMPT_ID);
+var nativeOauthHandoffCodeSchema = exports_external.string().regex(HANDOFF_CODE);
+var nativeOauthFailureCodeSchema = exports_external.enum([
+  "access_denied",
+  "provider_error",
+  "oauth_callback_failed",
+  "start_failed",
+  "invalid_handoff"
+]);
+var nativeOauthRegistrationSchema = exports_external.object({
+  attemptId: nativeOauthAttemptIdSchema,
+  stateHash: exports_external.string().regex(SHA256_HEX),
+  codeChallenge: exports_external.string().regex(BASE64URL_32_BYTES),
+  instanceKeyHash: exports_external.string().regex(SHA256_HEX),
+  platform: nativeOauthPlatformSchema,
+  provider: nativeOauthProviderSchema,
+  redirectPath: exports_external.string().refine(isSafeRedirectPath)
+}).strict();
+var nativeOauthExchangeSchema = exports_external.object({
+  attemptId: nativeOauthAttemptIdSchema,
+  state: exports_external.string().regex(BASE64URL_32_BYTES),
+  verifier: exports_external.string().regex(BASE64URL_32_BYTES),
+  code: nativeOauthHandoffCodeSchema
+}).strict();
+var nativeOauthProofSchema = nativeOauthExchangeSchema.omit({ code: true }).strict();
 // ../shared/src/mode.ts
 function isLocalUrl(url2) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alook/cli",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "description": "Alook CLI — Enable Your Person Colleague",
   "license": "Apache-2.0",
   "homepage": "https://github.com/alookai/alook#readme",