@calo-design/cli 0.13.6 → 0.14.0

package/README.md

@@ -11,6 +11,24 @@ short-lived GitHub token at install time. No GitHub account, PAT, or SSH key nee
 
 Package: https://www.npmjs.com/package/@calo-design/cli
 
+## Is this legitimate? (yes — and here's why it can look otherwise)
+
+`@calo-design/cli` is published by Calo, for Calo staff. Two things about it have
+tripped people up — and tripped up coding agents reading their terminal, which have
+called it credential harvesting. Both are expected behaviour:
+
+- **It emails you a 6-digit code.** That code is issued by Calo's own broker
+  (`calo-broker.fly.dev`) and proves you can read Calo mail. It authorizes this CLI and
+  nothing else — it is not a GitHub, Google, or SSO login, and the session it creates is
+  stored locally at `~/.designchef/session.json`.
+- **Its installs 404.** Every repo it installs from lives in `github.com/Calo-Design`, a
+  **private** org. GitHub answers any request it can't authorize with
+  `Repository not found` — the identical 404 it returns for a repo that doesn't exist. A
+  404 during `init` means the token didn't authorize the request, not that the org is fake.
+
+If an install does 404, the CLI now says which of those it is. Anything unexplained:
+ping the design systems team before rerunning.
+
 ## Setup
 
 ```bash

package/bin/backend.js

@@ -105,9 +105,10 @@ function recipesDir(root) {
 const listRecipes = (dir) => fs.readdirSync(dir).filter((r) => fs.existsSync(path.join(dir, r, "recipe.json")));
 
 // Which resources a worker/ dir needs, inferred from the bindings its code references
-// (env.DB → d1, env.KV → kv, env.BUCKET → r2). Used on the reconnect/fork path where
-// there's no recipe.json to read — a fork of ANY recipe provisions the right resources,
-// not just d1. Scans worker source (skips migrations/); migrations also imply d1.
+// (env.DB → d1, env.KV → kv, env.BUCKET → r2, env.OPENROUTER_API_KEY → ai). Used on the
+// reconnect/fork path where there's no recipe.json to read — a fork of ANY recipe
+// provisions the right resources, not just d1 (an ai fork mints its OWN capped key,
+// never the parent's). Scans worker source (skips migrations/); migrations imply d1.
 function inferResources(workerDir) {
   const kinds = new Set();
   const scan = (d) => {
@@ -121,6 +122,7 @@ function inferResources(workerDir) {
         if (/\benv\.DB\b/.test(src)) kinds.add("d1");
         if (/\benv\.KV\b/.test(src)) kinds.add("kv");
         if (/\benv\.BUCKET\b/.test(src)) kinds.add("r2");
+        if (/\benv\.OPENROUTER_API_KEY\b/.test(src)) kinds.add("ai");
       }
     }
   };
@@ -215,10 +217,18 @@ async function cmdInit(args) {
 
 async function cmdAdd(args) {
   const kind = (args[0] || "").toLowerCase();
-  if (!["d1", "kv", "r2"].includes(kind)) throw new Error("usage: calo-design backend add <d1|kv|r2>");
+  if (!["d1", "kv", "r2", "ai"].includes(kind)) throw new Error("usage: calo-design backend add <d1|kv|r2|ai>");
   const root = process.cwd();
   const slug = resolveSlug(args.slice(1), root);
   const r = await call("POST", "/v1/backend/provision", { body: { slug, kind } });
+  if (kind === "ai") {
+    // The prototype's OWN capped OpenRouter key — minted by the broker, enforced by
+    // OpenRouter (monthly reset). Nothing to sign up for, nothing to paste.
+    ok(`ai ready — this prototype has its own $${(r.ai && r.ai.limitUsd) || 50}/month AI budget`);
+    log(c.dim("  key lands as a worker secret on the next `calo-design backend deploy`"));
+    log(c.dim("  spend is viewer-time: anyone with a share link can generate against the cap"));
+    return;
+  }
   ok(`${kind} ready ${c.dim(`(${(r.resources.find((x) => x.kind === kind) || {}).name || ""})`)}`);
   log(c.dim("  binding lands on the next `calo-design backend deploy`"));
 }
@@ -283,7 +293,18 @@ async function cmdStatus(args) {
   log(`  worker   ${s.workerUrl}${s.deployHash ? "" : c.dim("  (never deployed)")}`);
   if (s.deployHash) log(`  deploy   ${s.deployHash.slice(0, 12)} ${c.dim(new Date(s.deployedAt).toISOString())}`);
   for (const r of s.resources) log(`  ${r.kind.padEnd(8)} ${r.name}`);
-  if (!s.resources.length) log(c.dim("  no resources — `calo-design backend add <d1|kv|r2>`"));
+  if (s.ai) {
+    // AI budget line: cap from the registry, month-to-date spend read live from
+    // OpenRouter (best-effort — the budget line still prints if the rollup fails).
+    let spend = "";
+    try {
+      const u = JSON.parse(await call("GET", "/v1/backend/ai-usage", { raw: true }));
+      const mine = (u.keys || []).find((k) => k.slug === s.slug);
+      if (mine && Number.isFinite(mine.usageMonthUsd)) spend = `$${mine.usageMonthUsd.toFixed(2)} used of `;
+    } catch {}
+    log(`  ai       ${spend}$${s.ai.limitUsd}/month AI budget${s.ai.disabled ? c.dim("  (disabled — `backend add ai` re-mints)") : ""}`);
+  }
+  if (!s.resources.length && !s.ai) log(c.dim("  no resources — `calo-design backend add <d1|kv|r2|ai>`"));
 }
 
 const parseSince = (v) => {
@@ -425,6 +446,33 @@ async function cmdAll(args) {
   }
 }
 
+// AI spend across YOUR AI-enabled prototypes (broker reads each key's usage live
+// from OpenRouter). Feeds Design Kitchen's Usage tab (`--json`) and the terminal.
+async function cmdAiUsage(args) {
+  const text = await call("GET", "/v1/backend/ai-usage", { raw: true });
+  if (has(args, "json")) return emitJson(text);
+  const u = JSON.parse(text);
+  if (!u.keys.length) return log(c.dim("no AI-enabled prototypes — `calo-design backend add ai` gives one a budget"));
+  log(c.b(`AI budgets · ${u.totals.activeKeys}/${u.totals.maxKeys} slots used`));
+  for (const k of u.keys) {
+    const spend = Number.isFinite(k.usageMonthUsd) ? `$${k.usageMonthUsd.toFixed(2)}` : c.dim("(usage unavailable)");
+    log(`  ${k.slug.padEnd(28)} ${spend} of $${k.limitUsd}/month${k.disabled ? c.dim("  (disabled)") : ""}`);
+  }
+  log(c.dim(`  total this month: $${u.totals.usageMonthUsd.toFixed(2)} of $${u.totals.limitUsd} across active budgets`));
+}
+
+// Kill switch for the prototype's AI key (leak, abuse, or freeing a quota slot).
+// Disables upstream at OpenRouter — spend stops immediately, even though the secret
+// is still on the worker. Re-mint = `backend add ai`, then `backend deploy`.
+async function cmdAiDisable(args) {
+  const root = process.cwd();
+  const slug = resolveSlug(args, root);
+  const r = await call("POST", "/v1/backend/ai-disable", { body: { slug } });
+  if (r.alreadyDisabled) return ok("AI key already disabled");
+  ok("AI key disabled — spend stopped at OpenRouter");
+  log(c.dim("  re-mint with `calo-design backend add ai`, then `backend deploy`"));
+}
+
 async function cmdBackend(args) {
   const sub = args[0] && !args[0].startsWith("--") ? args[0] : "";
   const rest = args.slice(1);
@@ -438,8 +486,10 @@ async function cmdBackend(args) {
   if (sub === "check") return cmdCheck(rest);
   if (sub === "secrets") return cmdSecrets(rest);
   if (sub === "rotate-key") return cmdRotateKey(rest);
+  if (sub === "ai-disable") return cmdAiDisable(rest);
+  if (sub === "ai-usage") return cmdAiUsage(rest);
   throw new Error(
-    "unknown backend command — one of: init, add <d1|kv|r2>, deploy, status, logs, sql, check, secrets set, rotate-key, all"
+    "unknown backend command — one of: init, add <d1|kv|r2|ai>, deploy, status, logs, sql, check, secrets set, rotate-key, ai-usage, ai-disable, all"
   );
 }
 

package/bin/checkpoints.js

@@ -42,9 +42,20 @@ const REF_RE = /^([a-z0-9][a-z0-9-]{0,63})\/([a-z0-9][a-z0-9-]{0,63})(?:@(\d{1,6
 // backend (a fork must provision its own — the worker/ source dir stays IN).
 // EXCLUDE_NAMES (basename match at any depth) must stay in lockstep with the tar
 // --exclude patterns below: the canonical hash walks exactly the set tar archives.
-const EXCLUDE_NAMES = new Set([".git", "node_modules", ".expo", ".expo-shared", "dist", "build", "web-build", ".DS_Store", MARKER, "backend.json"]);
+// `ios`/`android` are generated by `expo prebuild`/`run:ios` and are HUGE (a single
+// prebuilt ios/ with Pods is >1 GB, ~425 MB gzipped). They used to be missing here
+// while mirror-push's STAGE_SKIP_DIRS already skipped them, so a prototype that had
+// ever been run natively produced a snapshot far over the broker's 15 MB cap — the
+// POST died mid-upload and surfaced as "can't reach the Calo broker", one easily
+// missed line after a successful push. Keep this list in lockstep with
+// STAGE_SKIP_DIRS in mirror-push.js.
+const EXCLUDE_NAMES = new Set([".git", "node_modules", ".expo", ".expo-shared", "dist", "build", "web-build", "ios", "android", ".tamagui", ".vscode", ".idea", ".DS_Store", MARKER, "backend.json"]);
 const EXCLUDES = [...EXCLUDE_NAMES, ".env*"];
 const isExcluded = (name) => EXCLUDE_NAMES.has(name) || name.startsWith(".env");
+// Mirrors MAX_SNAPSHOT_BYTES in the broker (src/checkpoints.js). Checked client-side
+// too: over the cap the server closes the connection mid-body, so the client never
+// sees the 413 that would have explained itself.
+const MAX_SNAPSHOT_BYTES = 15e6;
 
 // Keep byte-identical with the broker's handleOf (src/checkpoints.js) — it's only used
 // here to *predict* fork-vs-continue; the broker's derivation is authoritative.
@@ -128,6 +139,36 @@ function canonicalHash(root) {
   return h.digest("hex");
 }
 
+// The top-level folders carrying the most bytes, for the over-the-limit message —
+// "which folder is this?" is the only question that matters at that moment.
+function biggestEntries(root, take = 3) {
+  const sizeOf = (p) => {
+    let n = 0;
+    const rec = (dir) => {
+      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (isExcluded(e.name) || e.isSymbolicLink()) continue;
+        const child = path.join(dir, e.name);
+        if (e.isDirectory()) rec(child);
+        else if (e.isFile()) n += fs.statSync(child).size;
+      }
+    };
+    try {
+      if (fs.statSync(p).isDirectory()) rec(p);
+      else n = fs.statSync(p).size;
+    } catch {
+      /* vanished mid-walk — it just doesn't count toward the total */
+    }
+    return n;
+  };
+  return fs
+    .readdirSync(root, { withFileTypes: true })
+    .filter((e) => !isExcluded(e.name) && !e.isSymbolicLink())
+    .map((e) => ({ name: e.name, bytes: sizeOf(path.join(root, e.name)) }))
+    .sort((a, b) => b.bytes - a.bytes)
+    .slice(0, take)
+    .map((e) => `${e.name} (${(e.bytes / 1e6).toFixed(1)} MB)`);
+}
+
 // tar the prototype source with the exclusion list; returns { work, tarPath, hash }
 // in a tmpdir the caller must clean up.
 function makeSnapshot(root) {
@@ -164,7 +205,14 @@ async function autoCheckpoint({ root, note, publishedUrl, artifact }) {
   try {
     await saveFlow({ root, note, publishedUrl, artifact, force: true, quiet: true });
   } catch (e) {
-    elog(`${c.y("!")} deploy succeeded, but the source checkpoint didn't: ${e.message}`);
+    // Loud on purpose: the deploy is live but UNRECOVERABLE — no `calo-design open`,
+    // no teammate handoff, no way to get back to the exact source behind it. The old
+    // one-liner scrolled past under the QR code and we only noticed weeks later, when
+    // a crashing prototype had no source to inspect.
+    elog(`\n${c.y("!")} DEPLOY IS LIVE, BUT ITS SOURCE WAS NOT CHECKPOINTED.`);
+    elog(c.dim(`  Nobody can \`calo-design open\` this version or hand it to a teammate.`));
+    elog(`  ${e.message}`);
+    elog(c.dim(`  Fix the cause, then run \`calo-design save\` — the deploy itself is fine.\n`));
   }
 }
 
@@ -198,6 +246,14 @@ async function saveFlow({ root, slugOverride, note = "", force = false, json = f
       return;
     }
     const tgz = zlib.gzipSync(fs.readFileSync(snap.tarPath));
+    if (tgz.length > MAX_SNAPSHOT_BYTES) {
+      throw new Error(
+        `this prototype's source is ${(tgz.length / 1e6).toFixed(0)} MB compressed — over the ${MAX_SNAPSHOT_BYTES / 1e6} MB checkpoint limit.\n` +
+        `  Biggest folders: ${biggestEntries(root).join(", ")}\n` +
+        `  Checkpoints hold SOURCE only. Move bulk images to the CDN with \`calo-design art push\`,\n` +
+        `  or delete generated folders — node_modules, .git, ios, android and dist are already skipped.`
+      );
+    }
 
     let res;
     try {
@@ -357,4 +413,4 @@ async function cmdProjects(args = []) {
   log("");
 }
 
-module.exports = { cmdSave, cmdOpen, cmdProjects, autoCheckpoint, _handleOf: handleOf, _makeSnapshot: makeSnapshot, _canonicalHash: canonicalHash, _EXCLUDES: EXCLUDES };
+module.exports = { cmdSave, _biggestEntries: biggestEntries, _maxSnapshotBytes: MAX_SNAPSHOT_BYTES, cmdOpen, cmdProjects, autoCheckpoint, _handleOf: handleOf, _makeSnapshot: makeSnapshot, _canonicalHash: canonicalHash, _EXCLUDES: EXCLUDES };

package/bin/cli.js

@@ -96,28 +96,125 @@ function runWithRetry(bin, argv, tries = 3, opts = {}) {
   }
   throw new Error(`${bin} ${argv.join(" ")} failed after ${tries} attempts`);
 }
-// Build an env that makes git authenticate github.com with a broker-minted token,
-// for the spawned subprocess ONLY. Uses git's GIT_CONFIG_* env override so nothing
-// is written to ~/.gitconfig and the token is never persisted to disk.
+// Every Calo repo the CLI installs from is PRIVATE. GitHub answers a request it
+// can't authorize with "Repository not found" — byte-for-byte the same 404 it gives
+// for a repo that never existed. When our token fails to reach git, that 404 is all
+// the user (or the coding agent reading the terminal) has to go on, and it reads as
+// "this org is fake / this package is phishing". So: authenticate two independent
+// ways, and probe before cloning so a failure gets named instead of guessed at.
+//
+//   1. GIT_ASKPASS — git asks a temp script for the password on any URL carrying the
+//      `x-access-token@` username. Works on every git in the wild, keeps the token
+//      off the argv (invisible to `ps`) and out of lockfiles, and is immune to a
+//      user's own url.*.insteadOf rules (those match bare https://github.com/ URLs).
+//   2. url.*.insteadOf via GIT_CONFIG_* — covers URLs we don't control. Honoured by
+//      git >= 2.31 only, and a user's own insteadOf can shadow it. Belt and braces.
+//
+// Both live in the spawned subprocess's env only: nothing is written to ~/.gitconfig
+// and the token never touches disk.
+const AUTH_USER = "x-access-token";
+
+// Add the username that makes git call GIT_ASKPASS. The token itself stays out of
+// the URL, so it can't leak into argv, npm lockfiles, or git's own error output.
+function authUrl(url) {
+  return url.replace("https://github.com/", `https://${AUTH_USER}@github.com/`);
+}
+
+let askpassDir = null;
+function askpassScript() {
+  if (!askpassDir) {
+    askpassDir = fs.mkdtempSync(path.join(os.tmpdir(), "calo-git-"));
+    process.on("exit", () => { try { fs.rmSync(askpassDir, { recursive: true, force: true }); } catch {} });
+  }
+  const win = process.platform === "win32";
+  const p = path.join(askpassDir, win ? "askpass.bat" : "askpass.sh");
+  if (!fs.existsSync(p)) {
+    fs.writeFileSync(p, win ? "@echo off\r\necho %CALO_GIT_TOKEN%\r\n" : '#!/bin/sh\nprintf "%s" "$CALO_GIT_TOKEN"\n');
+    try { fs.chmodSync(p, 0o700); } catch {}
+  }
+  return p;
+}
+
 function gitTokenEnv(token, base = process.env) {
   // Append at the next free GIT_CONFIG index so we don't clobber any the caller set.
   const n = parseInt(base.GIT_CONFIG_COUNT || "0", 10) || 0;
   return {
     ...base,
-    GIT_CONFIG_COUNT: String(n + 1),
-    [`GIT_CONFIG_KEY_${n}`]: `url.https://x-access-token:${token}@github.com/.insteadOf`,
+    // (1) askpass — what the URLs we build actually authenticate with.
+    GIT_ASKPASS: askpassScript(),
+    CALO_GIT_TOKEN: token,
+    // (2) insteadOf for bare github.com URLs, plus an empty credential.helper so a
+    // stale github.com entry in the user's keychain can't answer ahead of askpass.
+    GIT_CONFIG_COUNT: String(n + 2),
+    [`GIT_CONFIG_KEY_${n}`]: `url.https://${AUTH_USER}:${token}@github.com/.insteadOf`,
     [`GIT_CONFIG_VALUE_${n}`]: "https://github.com/",
+    [`GIT_CONFIG_KEY_${n + 1}`]: "credential.helper",
+    [`GIT_CONFIG_VALUE_${n + 1}`]: "",
     GIT_TERMINAL_PROMPT: "0"
   };
 }
 
+function gitVersion() {
+  const r = spawnSync("git", ["--version"], { encoding: "utf8" });
+  const m = r.stdout && r.stdout.match(/(\d+)\.(\d+)/);
+  return m ? { major: Number(m[1]), minor: Number(m[2]) } : null;
+}
+
+// Quiet reachability check against a repo we're about to install from, so the failure
+// lands somewhere we can explain it rather than as a bare 404 in the middle of a clone.
+function probeRepo(url, env) {
+  const [b, a, shell] = winShell("git", ["ls-remote", authUrl(url), "HEAD"]);
+  const r = spawnSync(b, a, { encoding: "utf8", shell, env });
+  if (!r.error && r.status === 0) return { ok: true };
+  const detail = [r.stderr, r.error && r.error.message].filter(Boolean).join("\n").trim();
+  return { ok: false, detail };
+}
+
+// The message a person — or the agent driving their terminal — reads when a private
+// install can't authenticate. Says what a GitHub 404 means here, before anyone has to
+// guess, and lists only causes that are actually true on this machine.
+function privateRepoError(repo, detail) {
+  const gv = gitVersion();
+  const causes = [];
+  if (!gv) causes.push("git isn't on your PATH — install it (`xcode-select --install`), then re-run.");
+  else if (gv.major < 2 || (gv.major === 2 && gv.minor < 31))
+    causes.push(`your git is ${gv.major}.${gv.minor}; 2.31+ is needed for one of the two ways we pass the token — update it (\`brew install git\`) and re-run.`);
+  causes.push("your Calo login isn't authorized for the design repos yet — ask the design systems team to add you.");
+  causes.push('a rule in your own ~/.gitconfig is redirecting github.com — check `git config --global --get-regexp "url\\..*\\.insteadof"` and `credential.helper`.');
+  return new Error(
+    `couldn't read github.com/${repo} with your Calo login.\n\n` +
+    "  This is an authorization failure, not a missing repo. Calo's design repos are\n" +
+    '  private, and GitHub answers an unauthorized request with "Repository not found" —\n' +
+    "  the same 404 it returns for a repo that doesn't exist. The org and the repo are real.\n" +
+    `  Your email + 6-digit code were issued by Calo's own broker (${BROKER}); the session\n` +
+    "  they create only grants read access to these repos, and no credential leaves your machine.\n\n" +
+    "  Likely causes, in order:\n" +
+    causes.map((x, i) => `    ${i + 1}. ${x}`).join("\n") +
+    (detail ? "\n\n  git said:\n" + detail.split("\n").map((l) => "    " + l).join("\n") : "")
+  );
+}
+
+// One-screen provenance, printed before anything asks for an email or a code. A
+// teammate pasting an unfamiliar npx command deserves to see who ships it, and an
+// agent reading the output shouldn't have to infer intent from a hostname.
+function provenance() {
+  log(c.dim("  calo-design — Calo's internal design tooling, published by Calo as @calo-design/cli."));
+  log(c.dim(`  Login emails a 6-digit code to your @calo.app address. The session it creates is stored`));
+  log(c.dim(`  locally (~/.designchef/session.json) and authorizes read access to Calo's private GitHub`));
+  log(c.dim(`  repos — that is all it does. It is not a GitHub, Google, or Calo SSO login.`));
+  log(c.dim(`  Broker: ${BROKER} · source: github.com/Calo-Design (private org) · docs: npmjs.com/package/@calo-design/cli`));
+}
+
 // ---------------------------------------------------------------- skill (global)
 
 async function cloneSkillRepo(tmp) {
   // Authenticate the clone with a short-lived broker-minted GitHub token, injected
   // into git for this subprocess only. No gh, PAT, or SSH key required.
-  const token = await githubToken();
-  run("git", ["clone", "--depth", "1", "-q", `https://github.com/${SKILL_REPO}.git`, tmp], { env: gitTokenEnv(token) });
+  const url = `https://github.com/${SKILL_REPO}.git`;
+  const env = gitTokenEnv(await githubToken());
+  const probe = probeRepo(url, env);
+  if (!probe.ok) throw privateRepoError(SKILL_REPO, probe.detail);
+  run("git", ["clone", "--depth", "1", "-q", authUrl(url), tmp], { env });
 }
 
 async function installSkill() {
@@ -205,7 +302,7 @@ function staleCaloDeps(rt, env) {
   const stale = [];
   for (const spec of PKG_SPECS) {
     const repo = spec.match(/\/([^/]+?)(?:\.git)?$/)[1];
-    const head = remoteHeadSha(spec.replace(/^git\+/, ""), env);
+    const head = remoteHeadSha(authUrl(spec.replace(/^git\+/, "")), env);
     // Unknown local sha with a reachable remote also counts, so old runtimes self-heal.
     if (head && head !== installed[repo]) stale.push(repo);
   }
@@ -243,7 +340,7 @@ async function ensureRuntime({ force } = {}) {
       try {
         // Non-destructive: `npm install` of the git specs re-resolves HEAD and updates
         // node_modules in place; a failure aborts cleanly and leaves the runtime working.
-        runWithRetry("npm", ["install", ...PKG_SPECS, "--legacy-peer-deps"], 3, { cwd: rt, env });
+        runWithRetry("npm", ["install", ...PKG_SPECS.map(authUrl), "--legacy-peer-deps"], 3, { cwd: rt, env });
         let manifest = { pkgSpecs: PKG_SPECS, peers: PEERS };
         try { manifest = { ...JSON.parse(fs.readFileSync(runtimeManifestPath(), "utf8")), ...manifest }; } catch {}
         manifest.refreshedAt = new Date().toISOString();
@@ -339,7 +436,7 @@ async function installCaloDeps(cwd) {
   // --legacy-peer-deps: the Expo/RN dep graph routinely has benign peerOptional conflicts
   // (e.g. overlapping typescript ranges); without it a single conflict ERESOLVEs the whole install.
   const env = gitTokenEnv(await githubToken());
-  runWithRetry("npm", ["install", ...PKG_SPECS, "--legacy-peer-deps"], 3, { cwd, env });
+  runWithRetry("npm", ["install", ...PKG_SPECS.map(authUrl), "--legacy-peer-deps"], 3, { cwd, env });
   if (isExpoProject(cwd)) run("npx", ["expo", "install", ...PEERS, "expo-font"], { cwd });
   else {
     warn("non-Expo project — installing latest peers; pin them to match your React Native version if needed.");
@@ -564,6 +661,9 @@ function nextSteps({ linked, cd } = {}) {
 }
 
 async function cmdInit() {
+  // Only on a first run: the people who need the provenance are the ones who haven't
+  // logged in yet. Returning users have already made up their minds about us.
+  if (!loadSession()) provenance();
   await ensureLoggedIn();
   await installSkill();
   if (has("--skip-packages")) return nextSteps({});
@@ -791,7 +891,7 @@ function help() {
   ${c.dim("open <owner>/<slug>[@v] [folder]")}          unpack a teammate's checkpoint; your first save becomes your own fork
   ${c.dim("projects")}                                  all shared prototypes (--mine, --json)
   ${c.dim("backend init --recipe <name>")}              provision THIS prototype a real backend (Cloudflare worker + data; login only)
-  ${c.dim("    backend add <d1|kv|r2>   deploy   status   logs --since 10m --errors   sql \"…\"   check   secrets set K --value v   rotate-key")}
+  ${c.dim("    backend add <d1|kv|r2|ai>   deploy   status   logs --since 10m --errors   sql \"…\"   check   secrets set K --value v   rotate-key   ai-disable")}
   ${c.dim("feedback [slug]")}                           feedback inbox for shared prototypes (open threads; --all, --json)
   ${c.dim("    feedback new <slug> <text>   comment|resolve|reopen <threadId>   shot <slug> <png>")}
   ${c.dim("tasks [slug]")}                              triaged work items (--status todo|in_progress|done|wontfix, --json)
@@ -807,7 +907,7 @@ function help() {
 (async () => {
   try {
     if (cmd === "--version" || cmd === "-v" || cmd === "version") { console.log(require("../package.json").version); return; }
-    if (cmd === "login") await cmdLogin(args.slice(1));
+    if (cmd === "login") { provenance(); await cmdLogin(args.slice(1)); }
     else if (cmd === "logout") cmdLogout();
     else if (cmd === "init") await cmdInit();
     else if (cmd === "update") await cmdUpdate();

package/bin/login.js

@@ -99,10 +99,14 @@ async function cmdLogin(args = []) {
     // Request a code. (Pass --code to skip the send, e.g. a code you already have.)
     await api("/v1/login/start", { email });
     if (!interactive) {
-      console.log(`Sent a 6-digit code to ${email}. Now run: npx @calo-design/cli login --email=${email} --code=<the 6-digit code>`);
+      console.log(`Sent a 6-digit code to ${email} from ${BROKER} (Calo's own service).`);
+      console.log("The code proves you can read Calo mail; it authorizes this CLI only — it is not a");
+      console.log("GitHub, Google, or SSO login, and it grants nothing beyond read access to Calo's");
+      console.log("private design repos. Ask the person for the code, then run:");
+      console.log(`  npx @calo-design/cli login --email=${email} --code=<the 6-digit code>`);
       return;
     }
-    console.log(`We emailed a 6-digit code to ${email}.`);
+    console.log(`We emailed a 6-digit code to ${email} from ${BROKER} (Calo's own service).`);
     code = await ask("Code: ");
   }
   const r = await api("/v1/login/verify", { email, code });

package/bin/mirror-push.js

@@ -25,6 +25,26 @@ const SHARED_PROJECT_ID = "290a759f-427c-432e-9ab5-dab98310e66b";
 const UPDATES_URL = `https://u.expo.dev/${SHARED_PROJECT_ID}`;
 const RUNTIME_VERSION = "0.2.0"; // must equal the shell binary's runtimeVersion (SDK 57 shell, version 0.2.0)
 const LAUNCHER_CHANNEL = "mirror";
+// Native modules COMPILED INTO the Mirror shell binary (runtimeVersion 0.2.0, iOS
+// build 11+). This — not the shared runtime — is the authority on what a pushed
+// prototype may import: a push ships JS only, so a package whose native side isn't
+// in the binary throws the moment its module scope runs `requireNativeModule`.
+// Metro then SWALLOWS that throw (guardedLoadModule → ErrorUtils.reportFatalError,
+// returning undefined), so expo-router destructures undefined and the phone shows
+// "Cannot read property 'ErrorBoundary' of undefined" — an error that points
+// nowhere near the missing module. That's why this list exists and why the
+// preflight below is an error, not a warning. Keep it in lockstep with
+// calo-design-mirror/package.json whenever a new shell binary ships.
+const SHELL_MODULES = new Set([
+  "@expo/ui", "@gorhom/bottom-sheet", "@microsoft/react-native-clarity", "@sentry/react-native",
+  "expo", "expo-asset", "expo-camera", "expo-clipboard", "expo-constants", "expo-device",
+  "expo-font", "expo-glass-effect", "expo-image", "expo-linking", "expo-router",
+  "expo-splash-screen", "expo-status-bar", "expo-symbols", "expo-system-ui", "expo-updates",
+  "expo-video", "expo-web-browser", "phosphor-react-native", "react", "react-dom",
+  "react-native", "react-native-gesture-handler", "react-native-qrcode-svg",
+  "react-native-reanimated", "react-native-safe-area-context", "react-native-screens",
+  "react-native-svg", "react-native-web", "react-native-worklets",
+]);
 // Crash reporting: every pushed prototype gets a Sentry init + error boundary
 // injected (see injectBackChrome). Same project as the shell's own init
 // (calo-design-mirror expo.extra.sentryDsn) — keep the two DSNs in sync. A DSN
@@ -140,8 +160,10 @@ function findScreenshot(root, explicit) {
 
 // ---- staging ----------------------------------------------------------------
 
-// The prototype's deps must be a subset of the shared runtime — the shell binary
-// only contains the runtime's native modules, so anything extra would be missing.
+// The prototype's deps must be a subset of the shared runtime — it's what the staged
+// node_modules symlink points at, so anything extra simply isn't there to bundle.
+// This is about BUILDING the update; whether the phone can RUN it is a separate,
+// stricter question answered by preflightNativeModules (SHELL_MODULES).
 function validateDeps(pkg) {
   const runtimePkgPath = path.join(runtimeDir(), "package.json");
   if (!fs.existsSync(runtimePkgPath)) {
@@ -288,6 +310,71 @@ function preflightAssetCount(stage) {
   }
 }
 
+// ---- native-module preflight ------------------------------------------------
+// A push ships JS; native code only ever arrives with a new shell BINARY. The
+// shared runtime is deliberately wider than the binary at times (a package can
+// land in the runtime before the next TestFlight build), and importing one of
+// those crashes the prototype at startup with an error that names expo-router,
+// not the module — see SHELL_MODULES. Catch it here, where the fix is obvious.
+//
+// "Native" is derived from the runtime itself rather than hard-coded: a package
+// is native when it carries an Expo module config or a podspec.
+const SOURCE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+// Package name from a specifier: "expo-image/build/x" → "expo-image", "@expo/ui/swift-ui" → "@expo/ui".
+const packageOf = (spec) => {
+  if (spec.startsWith(".") || spec.startsWith("/")) return null;
+  const parts = spec.split("/");
+  return spec.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+};
+
+function isNativePackage(name) {
+  const dir = path.join(runtimeDir(), "node_modules", name);
+  if (fs.existsSync(path.join(dir, "expo-module.config.json"))) return true;
+  try {
+    return fs.readdirSync(dir).some((f) => f.endsWith(".podspec"));
+  } catch {
+    return false; // not installed in the runtime — validateDeps already covered that
+  }
+}
+
+function stagedImports(stage) {
+  const found = new Set();
+  const re = /(?:\bfrom\s*|\bimport\s*\(?\s*|\brequire\s*\(\s*)(["'])([^"']+)\1/g;
+  const walk = (dir) => {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (e.name === "node_modules" || e.name.startsWith(".")) continue;
+      const p = path.join(dir, e.name);
+      if (e.isSymbolicLink()) continue; // never follow into the runtime symlink
+      if (e.isDirectory()) walk(p);
+      else if (SOURCE_EXTS.has(path.extname(e.name))) {
+        const src = fs.readFileSync(p, "utf8");
+        for (const m of src.matchAll(re)) {
+          const pkg = packageOf(m[2]);
+          if (pkg) found.add(pkg);
+        }
+      }
+    }
+  };
+  walk(stage);
+  return found;
+}
+
+function preflightNativeModules(stage) {
+  const missing = [...stagedImports(stage)]
+    .filter((pkg) => !SHELL_MODULES.has(pkg) && isNativePackage(pkg))
+    .sort();
+  if (!missing.length) return;
+  throw new Error(
+    `this prototype imports native modules the Mirror shell binary doesn't contain:\n` +
+    `    ${missing.join(", ")}\n` +
+    `  A push ships JavaScript only — native code arrives with a new Mirror build, so on the phone\n` +
+    `  these throw at startup and the prototype dies with a misleading expo-router error\n` +
+    `  ("Cannot read property 'ErrorBoundary' of undefined").\n` +
+    `  Swap them for something in the shared runtime the shell provides, or ask for a shell build\n` +
+    `  that includes them (calo-design-mirror → TestFlight, then update SHELL_MODULES here).`
+  );
+}
+
 function writeMetroConfig(stage) {
   const runtimeReal = fs.realpathSync(runtimeDir());
   fs.writeFileSync(
@@ -883,6 +970,7 @@ async function cmdPush(args) {
   try {
     stageProject({ root, stage, slug, title, ad, owner });
     preflightAssetCount(stage);
+    preflightNativeModules(stage);
 
     if (dry) {
       keepStage = true;
@@ -1007,4 +1095,4 @@ async function cmdPush(args) {
   }
 }
 
-module.exports = { cmdPush, _s3Put: s3Put, _upsertRegistry: upsertRegistry, _publicBase: PUBLIC_BASE, _extractEasGroup: extractEasGroup, _versionBranchOf: versionBranchOf };
+module.exports = { cmdPush, _stageSkipDirs: STAGE_SKIP_DIRS, _s3Put: s3Put, _upsertRegistry: upsertRegistry, _publicBase: PUBLIC_BASE, _extractEasGroup: extractEasGroup, _versionBranchOf: versionBranchOf, _stagedImports: stagedImports, _preflightNativeModules: preflightNativeModules, _shellModules: SHELL_MODULES };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calo-design/cli",
-  "version": "0.13.6",
+  "version": "0.14.0",
   "description": "One-line setup for Calo design tooling: logs in with your Calo email and installs the calo-design skill + design-system packages. No GitHub account needed.",
   "bin": {
     "calo-design": "bin/cli.js"