@datalabrotterdam/nova-ai-cli 1.0.1-alpha.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,148 @@
+<div align="center">
+
+<img src="./assets/logo.png" width="96" height="96" alt="Nova logo" />
+
+# @datalabrotterdam/nova-ai-cli
+
+**CLI for DataLab Rotterdam's Nova AI — also speaks Agent Client Protocol**
+
+[![npm version](https://img.shields.io/npm/v/@datalabrotterdam/nova-ai-cli?style=flat-square&color=f96743)](https://www.npmjs.com/package/@datalabrotterdam/nova-ai-cli)
+[![npm downloads](https://img.shields.io/npm/dm/@datalabrotterdam/nova-ai-cli?style=flat-square)](https://www.npmjs.com/package/@datalabrotterdam/nova-ai-cli)
+[![license](https://img.shields.io/npm/l/@datalabrotterdam/nova-ai-cli?style=flat-square)](./LICENSE)
+[![ACP](https://img.shields.io/badge/ACP-agent-blue?style=flat-square)](https://agentclientprotocol.com)
+[![issues](https://img.shields.io/github/issues/Datalab-Rotterdam/nova-ai-cli?style=flat-square)](https://github.com/Datalab-Rotterdam/nova-ai-cli/issues)
+
+Talk to DataLab Rotterdam's Nova AI from your terminal, or point your editor/IDE at it via [Agent Client Protocol](https://agentclientprotocol.com) — both modes share the same auth and run on [`@datalabrotterdam/nova-sdk`](https://www.npmjs.com/package/@datalabrotterdam/nova-sdk).
+
+[npm](https://www.npmjs.com/package/@datalabrotterdam/nova-ai-cli) · [Issues](https://github.com/Datalab-Rotterdam/nova-ai-cli/issues) · [ACP docs](https://agentclientprotocol.com)
+
+</div>
+
+> **⚠️ Work in progress.** ACP mode (`--acp`) is the only fully implemented mode today — agentic tool use, permissions, and session persistence all work there. Interactive terminal chat (no flags) and the standalone browser UI (`--web`) are stubs that print a "not built yet" message. Expect breaking changes before a 1.0.
+
+---
+
+## Installation
+
+No install needed — run directly with `npx`:
+
+```sh
+npx @datalabrotterdam/nova-ai-cli --setup   # store your Nova API key
+npx @datalabrotterdam/nova-ai-cli           # interactive chat (WIP, stub)
+npx @datalabrotterdam/nova-ai-cli --acp     # speak ACP over stdio (editors/IDEs) — fully working
+npx @datalabrotterdam/nova-ai-cli --web     # standalone browser UI (WIP, stub)
+```
+
+Or install globally / as a project dependency:
+
+```sh
+npm install -g @datalabrotterdam/nova-ai-cli
+```
+
+**Requires:** Node.js >= 18, a [Nova AI](https://api.nova.datalabrotterdam.nl) API key.
+
+---
+
+## Overview
+
+`nova-ai-cli` is a terminal client for Nova AI, in the same spirit as `claude`/`codex`. Pass `--acp` to run it in Agent Client Protocol mode, where it reads JSON-RPC requests from stdin and writes responses/notifications to stdout so any ACP-aware editor/IDE can drive it like any other coding agent — with tool calling, permission prompts, and persisted session history. Bare/`--web` modes are placeholders for now. All modes share the same stored credentials.
+
+```sh
+# 1. one-time setup — opens a browser page to verify the key against Nova AI and store it locally
+npx @datalabrotterdam/nova-ai-cli --setup
+
+# 2. point your ACP client at this binary
+npx @datalabrotterdam/nova-ai-cli --acp
+```
+
+Most editors invoke `--acp` for you once configured as an agent — `--setup` is the one command you run by hand first.
+
+**Status:** `--setup` and `--acp` (including tool calling and session persistence) are fully implemented. Interactive terminal chat (no flags) and `--web` are stubs — see the WIP note above.
+
+---
+
+## Auth
+
+This agent advertises **Agent Auth** (per [`AUTHENTICATION.md`](https://github.com/agentclientprotocol/registry/blob/main/AUTHENTICATION.md)): when the client calls `authenticate`, the agent itself spins up a local HTTP server, opens your browser to it, and resolves once you've connected your account.
+
+```json
+{
+  "id": "nova-api-key",
+  "name": "Nova API Key"
+}
+```
+
+Today the page served at that local URL is a small Svelte form that:
+1. Collects your Nova API key.
+2. Validates it against `client.models.list()`.
+3. Picks a default model (first enabled model) and stores `{ apiKey, defaultModel }` in `~/.nova-ai/credentials.json`.
+
+You can also trigger this manually:
+
+```sh
+npx @datalabrotterdam/nova-ai-cli --setup
+```
+
+Overrides, no browser flow required:
+
+| Env var | Purpose |
+|---|---|
+| `NOVA_API_KEY` | Skip stored credentials, use this key |
+| `NOVA_MODEL` | Skip stored default model, use this model id |
+
+A future version will swap this for real OAuth once DataLab Rotterdam ships an OAuth provider for Nova AI — same local server (`src/acp/auth-server.ts`), same lifecycle, just a different page/flow. Credential handling stays isolated in `src/acp/credentials.ts` either way.
+
+---
+
+## What it implements
+
+| ACP method | Behavior |
+|---|---|
+| `initialize` | Returns protocol version + the `nova-api-key` agent auth method |
+| `session/new` | Allocates a session id with in-memory history |
+| `session/load` | Restores a previously-persisted session and replays its turns as `*_message_chunk` notifications |
+| `session/list` | Lists stored sessions, optionally filtered by `cwd` |
+| `authenticate` | Runs the local browser auth flow (`src/acp/auth-server.ts`) and resolves once a valid key is stored |
+| `session/prompt` | Streams a `chat.completions.stream()` call, forwarding `agent_message_chunk` updates as text arrives; drives the tool-calling loop below |
+| `session/cancel` | Aborts the in-flight Nova AI request via `AbortController` |
+
+Only `text` and `resource_link` content blocks are read from prompts today — images/audio/embeddings supported by `nova-sdk` aren't wired up yet.
+
+Sessions are persisted to disk (`src/acp/sessions.ts`) so `session/load` can rehydrate history, and a title is auto-derived from the conversation.
+
+### Tool calling
+
+While streaming a response, the agent watches for a fenced tool-call marker in the model's output (`src/acp/tools/marker.ts`). When one appears, it stops streaming text and instead:
+
+1. Reports the pending call via `session/update` (`tool_call` with status `pending`).
+2. Requests permission from the client for any **mutating** tool (`allow_once` / `reject_once`), via `session/request_permission`.
+3. Executes the tool and reports the result/error via a `tool_call_update`.
+4. Feeds the tool result back into the conversation and loops (up to 10 rounds per prompt) until the model produces a plain answer.
+
+Built-in tools (`src/acp/tools/registry.ts`):
+
+| Tool | Mutating | Behavior |
+|---|---|---|
+| `read_file` | No | Reads a file's contents, gated by client `fs.readTextFile` capability |
+| `write_file` | Yes | Writes/overwrites a file, gated by client `fs.writeTextFile` capability — requires permission |
+| `run_command` | Yes | Runs a shell command in the session's `cwd` — requires permission |
+
+Tools are filtered per-session by the client's advertised `clientCapabilities`, so a client without filesystem support never sees `read_file`/`write_file` offered.
+
+---
+
+## Development
+
+```sh
+npm install
+npm test      # tsc --noEmit + node --test on tests/
+npm run build # builds the Svelte setup page, then tsc -> dist/
+```
+
+Releases are automated via `semantic-release` on push to `main` (see `.github/workflows/ci.yml`); commit messages drive version bumps.
+
+---
+
+## License
+
+[Apache-2.0](./LICENSE) © DataLab Rotterdam

package/dist/acp/agent.d.ts

@@ -0,0 +1,12 @@
+import * as acp from "@agentclientprotocol/sdk";
+export declare class NovaAgent {
+    private readonly sessions;
+    private clientCapabilities;
+    initialize(params: acp.InitializeRequest): acp.InitializeResponse;
+    newSession(params: acp.NewSessionRequest): acp.NewSessionResponse;
+    loadSession(params: acp.LoadSessionRequest, client: acp.AgentContext): Promise<acp.LoadSessionResponse>;
+    listSessions(params: acp.ListSessionsRequest): acp.ListSessionsResponse;
+    authenticate(params: acp.AuthenticateRequest): Promise<acp.AuthenticateResponse>;
+    prompt(params: acp.PromptRequest, client: acp.AgentContext): Promise<acp.PromptResponse>;
+    cancel(params: acp.CancelNotification): void;
+}

package/dist/acp/agent.js

@@ -0,0 +1,206 @@
+import * as acp from "@agentclientprotocol/sdk";
+import { NovaAI, NovaAIError } from "@datalabrotterdam/nova-sdk";
+import { runBrowserAuth } from "./auth-server.js";
+import { readCredentials } from "./credentials.js";
+import { appendSessionTurn, deriveTitle, listStoredSessions, loadStoredSession } from "./sessions.js";
+import { availableTools, buildToolsSystemPrompt, extractToolCall, findTool, hasPendingFence, requestPermissionIfNeeded, sendToolCallPending, sendToolCallUpdate, } from "./tools/index.js";
+const AUTH_METHOD_ID = "nova-api-key";
+const MAX_TOOL_ROUNDS = 10;
+export class NovaAgent {
+    sessions = new Map();
+    clientCapabilities;
+    initialize(params) {
+        this.clientCapabilities = params.clientCapabilities;
+        return {
+            protocolVersion: acp.PROTOCOL_VERSION,
+            agentCapabilities: {
+                loadSession: true,
+                sessionCapabilities: {
+                    list: {},
+                },
+            },
+            authMethods: [
+                {
+                    id: AUTH_METHOD_ID,
+                    name: "Nova API Key",
+                    description: "Opens a local page in your browser to connect your DataLab Rotterdam Nova AI account.",
+                },
+            ],
+        };
+    }
+    newSession(params) {
+        const sessionId = crypto.randomUUID();
+        this.sessions.set(sessionId, { pendingPrompt: null, cwd: params.cwd, history: [], title: null });
+        return { sessionId };
+    }
+    async loadSession(params, client) {
+        const stored = loadStoredSession(params.sessionId);
+        if (!stored) {
+            throw acp.RequestError.internalError(undefined, `Session ${params.sessionId} not found`);
+        }
+        this.sessions.set(params.sessionId, {
+            pendingPrompt: null,
+            cwd: params.cwd,
+            history: stored.messages,
+            title: stored.title,
+        });
+        for (const message of stored.messages) {
+            if (typeof message.content !== "string" || !message.content)
+                continue;
+            if (message.role === "user") {
+                await client.notify("session/update", {
+                    sessionId: params.sessionId,
+                    update: { sessionUpdate: "user_message_chunk", content: { type: "text", text: message.content } },
+                });
+            }
+            else if (message.role === "assistant") {
+                await client.notify("session/update", {
+                    sessionId: params.sessionId,
+                    update: { sessionUpdate: "agent_message_chunk", content: { type: "text", text: message.content } },
+                });
+            }
+        }
+        return {};
+    }
+    listSessions(params) {
+        const sessions = listStoredSessions(params.cwd ?? undefined).map((s) => ({
+            sessionId: s.sessionId,
+            cwd: s.cwd,
+            title: s.title,
+            updatedAt: s.updatedAt,
+        }));
+        return { sessions };
+    }
+    async authenticate(params) {
+        if (params.methodId !== AUTH_METHOD_ID) {
+            throw new Error(`Unknown auth method: ${params.methodId}`);
+        }
+        await runBrowserAuth();
+        return {};
+    }
+    async prompt(params, client) {
+        const session = this.sessions.get(params.sessionId);
+        if (!session) {
+            throw new Error(`Session ${params.sessionId} not found`);
+        }
+        const credentials = readCredentials();
+        if (!credentials) {
+            throw acp.RequestError.authRequired();
+        }
+        session.pendingPrompt?.abort();
+        const abortController = new AbortController();
+        session.pendingPrompt = abortController;
+        const novaClient = new NovaAI({ apiKey: credentials.apiKey });
+        const model = credentials.defaultModel ?? process.env.NOVA_MODEL;
+        if (!model) {
+            throw new Error("No Nova model configured. Re-run authentication or set NOVA_MODEL.");
+        }
+        const tools = availableTools(this.clientCapabilities);
+        const systemPrompt = buildToolsSystemPrompt(tools, session.cwd);
+        const userMessage = { role: "user", content: contentBlocksToText(params.prompt) };
+        session.history.push(userMessage);
+        const turnMessages = [userMessage];
+        const messages = [
+            ...(systemPrompt ? [{ role: "system", content: systemPrompt }] : []),
+            ...session.history,
+        ];
+        const pushTurn = (message) => {
+            session.history.push(message);
+            messages.push(message);
+            turnMessages.push(message);
+        };
+        try {
+            for (let round = 0; round < MAX_TOOL_ROUNDS; round++) {
+                if (abortController.signal.aborted) {
+                    return { stopReason: "cancelled" };
+                }
+                let buffer = "";
+                let flushed = 0;
+                for await (const event of novaClient.chat.completions.stream({ model, messages }, { signal: abortController.signal })) {
+                    if (event.type !== "chunk")
+                        continue;
+                    const text = event.data.choices?.[0]?.delta?.content;
+                    if (typeof text !== "string" || text.length === 0)
+                        continue;
+                    buffer += text;
+                    if (!hasPendingFence(buffer)) {
+                        const toFlush = buffer.slice(flushed);
+                        if (toFlush) {
+                            await client.notify("session/update", {
+                                sessionId: params.sessionId,
+                                update: { sessionUpdate: "agent_message_chunk", content: { type: "text", text: toFlush } },
+                            });
+                            flushed = buffer.length;
+                        }
+                    }
+                }
+                const toolCall = extractToolCall(buffer);
+                if (!toolCall) {
+                    const remaining = buffer.slice(flushed);
+                    if (remaining) {
+                        await client.notify("session/update", {
+                            sessionId: params.sessionId,
+                            update: { sessionUpdate: "agent_message_chunk", content: { type: "text", text: remaining } },
+                        });
+                    }
+                    pushTurn({ role: "assistant", content: buffer });
+                    return { stopReason: "end_turn" };
+                }
+                const tool = findTool(toolCall.name);
+                const toolCallId = crypto.randomUUID();
+                const toolCtx = { client, sessionId: params.sessionId, signal: abortController.signal };
+                pushTurn({ role: "assistant", content: buffer });
+                if (!tool) {
+                    pushTurn({ role: "user", content: `Tool "${toolCall.name}" is not available.` });
+                    continue;
+                }
+                await sendToolCallPending(toolCtx, toolCallId, tool, toolCall.args);
+                const allowed = await requestPermissionIfNeeded(toolCtx, toolCallId, tool, toolCall.args);
+                if (!allowed) {
+                    await sendToolCallUpdate(toolCtx, toolCallId, "failed", "Permission denied by user.");
+                    pushTurn({ role: "user", content: "Tool call rejected by user." });
+                    continue;
+                }
+                const result = await tool.execute(toolCtx, toolCall.args);
+                if ("error" in result) {
+                    await sendToolCallUpdate(toolCtx, toolCallId, "failed", result.error);
+                    pushTurn({ role: "user", content: `Tool error: ${result.error}` });
+                }
+                else {
+                    await sendToolCallUpdate(toolCtx, toolCallId, "completed", result.output);
+                    pushTurn({ role: "user", content: `Tool result: ${result.output}` });
+                }
+            }
+            return { stopReason: "max_turn_requests" };
+        }
+        catch (err) {
+            if (abortController.signal.aborted) {
+                return { stopReason: "cancelled" };
+            }
+            if (err instanceof NovaAIError) {
+                throw new Error(`Nova AI request failed (status ${err.status}, requestId ${err.requestId}): ${err.message}`);
+            }
+            throw err;
+        }
+        finally {
+            session.pendingPrompt = null;
+            session.title ??= deriveTitle(session.history);
+            appendSessionTurn(params.sessionId, { cwd: session.cwd, title: session.title }, turnMessages);
+        }
+    }
+    cancel(params) {
+        this.sessions.get(params.sessionId)?.pendingPrompt?.abort();
+    }
+}
+function contentBlocksToText(prompt) {
+    return prompt
+        .map((block) => {
+        if (block.type === "text")
+            return block.text;
+        if (block.type === "resource_link")
+            return block.uri;
+        return "";
+    })
+        .filter(Boolean)
+        .join("\n");
+}

package/dist/acp/auth-server.d.ts

@@ -0,0 +1,10 @@
+import { credentialsPath } from "./credentials.js";
+/**
+ * Agent Auth flow (AUTHENTICATION.md, type "agent"): the agent itself runs a
+ * local HTTP server and opens the browser. Today the page just collects a
+ * Nova API key; swapping to real OAuth later means changing what this page
+ * does (redirect to the provider's authorize URL, exchange the callback code)
+ * without touching the server lifecycle or the rest of the agent.
+ */
+export declare function runBrowserAuth(): Promise<void>;
+export { credentialsPath };

package/dist/acp/auth-server.js

@@ -0,0 +1,67 @@
+import { exec } from "node:child_process";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { NovaAI, NovaAIError } from "@datalabrotterdam/nova-sdk";
+import { dir, json, WebServer } from "@sourceregistry/node-webserver";
+import { credentialsPath, writeCredentials } from "./credentials.js";
+const AUTH_TIMEOUT_MS = 5 * 60 * 1000;
+const UI_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "src", "acp", "web", "dist");
+function openBrowser(url) {
+    const cmd = process.platform === "darwin"
+        ? `open "${url}"`
+        : process.platform === "win32"
+            ? `start "" "${url}"`
+            : `xdg-open "${url}"`;
+    exec(cmd, () => {
+        // best-effort; the URL is always printed as a fallback
+    });
+}
+/**
+ * Agent Auth flow (AUTHENTICATION.md, type "agent"): the agent itself runs a
+ * local HTTP server and opens the browser. Today the page just collects a
+ * Nova API key; swapping to real OAuth later means changing what this page
+ * does (redirect to the provider's authorize URL, exchange the callback code)
+ * without touching the server lifecycle or the rest of the agent.
+ */
+export function runBrowserAuth() {
+    return new Promise((resolve, reject) => {
+        const app = new WebServer();
+        app.POST("/api/authenticate", async (event) => {
+            const body = await event.request.json().catch(() => null);
+            const apiKey = typeof body?.apiKey === "string" ? body.apiKey.trim() : "";
+            if (!apiKey) {
+                return json({ message: "API key is required." }, { status: 400 });
+            }
+            try {
+                const client = new NovaAI({ apiKey });
+                const { data: models } = await client.models.list();
+                const defaultModel = (models.find((m) => m.enabled !== false) ?? models[0])?.id;
+                writeCredentials({ apiKey, defaultModel });
+                clearTimeout(timeout);
+                const response = json({ ok: true });
+                void app.shutdown().then(resolve);
+                return response;
+            }
+            catch (err) {
+                const message = err instanceof NovaAIError
+                    ? `Nova AI rejected this key (status ${err.status}): ${err.message}`
+                    : "Unexpected error validating the key.";
+                return json({ message }, { status: 401 });
+            }
+        });
+        app.GET("/", dir(UI_DIR, { spa: true }));
+        app.GET("/[...path]", dir(UI_DIR, { spa: true }));
+        const timeout = setTimeout(() => {
+            void app.shutdown();
+            reject(new Error("Nova AI authentication timed out after 5 minutes."));
+        }, AUTH_TIMEOUT_MS);
+        app.listen(0, "127.0.0.1", () => {
+            const address = app.address();
+            const port = typeof address === "object" && address ? address.port : 0;
+            const url = `http://127.0.0.1:${port}`;
+            console.error(`Opening browser to authenticate with Nova AI: ${url}`);
+            openBrowser(url);
+        });
+    });
+}
+export { credentialsPath };

package/dist/acp/credentials.d.ts

@@ -0,0 +1,11 @@
+export type StoredCredentials = {
+    apiKey: string;
+    defaultModel?: string;
+};
+/**
+ * Single place that owns "how we get the Nova API key", so swapping this for
+ * an OAuth-based Agent Auth flow later only touches this file.
+ */
+export declare function readCredentials(): StoredCredentials | null;
+export declare function writeCredentials(credentials: StoredCredentials): void;
+export declare function credentialsPath(): string;