@kodycodes/cli 1.18.0 → 1.19.1

package/dist/cli.js

@@ -23,7 +23,9 @@ const orgScopedCommands = new Set([
     'whoami',
     'search',
     'api',
+    'package',
     'execute',
+    'dev',
     'auth',
 ]);
 function mcpUrlFrom(values) {
@@ -62,6 +64,12 @@ function parseKnown(args) {
             project: { type: 'boolean' },
             'no-browser': { type: 'boolean' },
             org: { type: 'string' },
+            target: { type: 'string' },
+            'reset-storage': { type: 'boolean' },
+            port: { type: 'string' },
+            'app-base-path': { type: 'string' },
+            method: { type: 'string' },
+            body: { type: 'string' },
             clients: { type: 'string' },
             yes: { type: 'boolean', short: 'y' },
         },
@@ -88,7 +96,9 @@ export function resolveCommand(argv) {
         case 'whoami':
         case 'search':
         case 'api':
+        case 'package':
         case 'execute':
+        case 'dev':
         case 'install':
         case 'skill':
         case 'help':
@@ -106,12 +116,23 @@ export async function runCli(argv = process.argv.slice(2), io = {}) {
     const write = io.stdout ?? ((text) => process.stdout.write(text));
     const writeErr = io.stderr ?? ((text) => process.stderr.write(text));
     // Best-effort: upgrade stale git helper pins (major-only / ephemeral /
-    // outdated exact) before any command, including git-credential. Must not
-    // write to stdout — git reads the helper protocol from stdout only.
+    // outdated exact) before most commands. Must not write to stdout — git
+    // reads the helper protocol from stdout only.
     // Skip under node:test so unit tests never rewrite the developer's
-    // global git config; production / E2E / npx always refresh.
-    if (process.env.NODE_TEST !== '1' &&
-        process.env.KODY_SKIP_GIT_HELPER_REFRESH !== '1') {
+    // global git config; skip git-credential (helper must stay fast / offline
+    // while the stored token is valid); skip version/help (no git touch).
+    const head = argv[0];
+    const skipHelperRefresh = process.env.NODE_TEST === '1' ||
+        process.env.KODY_SKIP_GIT_HELPER_REFRESH === '1' ||
+        head === 'git-credential' ||
+        head === 'version' ||
+        head === '--version' ||
+        head === '-v' ||
+        head === 'help' ||
+        head === '--help' ||
+        head === '-h' ||
+        head === undefined;
+    if (!skipHelperRefresh) {
         try {
             refreshGitCredentialHelperPinIfNeeded({
                 mcpUrl: process.env.KODY_MCP_URL || undefined,
@@ -144,13 +165,28 @@ async function dispatch(parsed, write, writeErr) {
         mcpUrl: typeof parsed.values['mcp-url'] === 'string' ? parsed.values['mcp-url'] : undefined,
     });
     const json = parsed.values.json === true;
-    if (parsed.values['allow-private-network'] === true &&
-        (parsed.command !== 'execute' || parsed.values.local !== true)) {
-        throw new Error('--allow-private-network can only be used with execute --local.');
+    if (parsed.values['allow-private-network'] === true) {
+        const executeAllowsPrivateNetwork = parsed.command === 'execute' &&
+            (parsed.values.local === true ||
+                (await import('./target.js')).resolveTarget({
+                    command: 'execute',
+                    flag: typeof parsed.values.target === 'string'
+                        ? parsed.values.target
+                        : undefined,
+                }) === 'mock');
+        if (parsed.command !== 'dev' && !executeAllowsPrivateNetwork) {
+            throw new Error('--allow-private-network can only be used with execute --local, execute --target mock, or kody dev.');
+        }
+    }
+    if (parsed.values['reset-storage'] === true &&
+        parsed.command !== 'dev' &&
+        parsed.command !== 'execute' &&
+        parsed.command !== 'search') {
+        throw new Error('`--reset-storage` is only used with --target mock on execute, search, or dev.');
     }
     const orgFlag = typeof parsed.values.org === 'string' ? parsed.values.org : undefined;
     if (orgFlag !== undefined && !orgScopedCommands.has(parsed.command)) {
-        throw new Error(`\`--org\` is not used with \`kody ${parsed.command}\`. Use it with login, logout, whoami, search, api, execute, or auth.`);
+        throw new Error(`\`--org\` is not used with \`kody ${parsed.command}\`. Use it with login, logout, whoami, search, api, package, execute, or auth.`);
     }
     // Login/logout honor `--org` only — not KODY_ORG (that env is for one-shot
     // org-scoped commands and must not bind browser login or change logout).
@@ -441,63 +477,110 @@ async function dispatch(parsed, write, writeErr) {
             return 0;
         }
         case 'search': {
+            const { resolveTarget } = await import('./target.js');
+            const target = resolveTarget({
+                command: 'search',
+                flag: typeof parsed.values.target === 'string' ? parsed.values.target : undefined,
+            });
             const query = parsed.positionals.join(' ').trim();
             const tokenValues = tokenFlagValues(parsed.values);
-            const apiUrl = apiUrlFrom({
+            let apiUrl = apiUrlFrom({
                 apiUrl: typeof parsed.values['api-url'] === 'string'
                     ? parsed.values['api-url']
                     : undefined,
             });
-            if (shouldUseApiToken({
-                tokenValues,
-                mcpUrl,
-                apiUrl,
-                allowEnvWithoutLogin: true,
-                ...(org ? { org } : {}),
-            })) {
-                const { searchWithApiToken } = await import('./open-api-client.js');
-                const result = await searchWithApiToken({
-                    token: requireApiToken(tokenValues, process.env, 'search', { apiUrl }),
+            let closeMock;
+            try {
+                if (target === 'mock') {
+                    const { ensureMockTarget } = await import('./mock/mock-server.js');
+                    const mock = await ensureMockTarget({
+                        resetStorage: parsed.values['reset-storage'] === true,
+                    });
+                    apiUrl = mock.apiUrl;
+                    closeMock = mock.started ? () => mock.server.close() : undefined;
+                    const { searchWithApiToken } = await import('./open-api-client.js');
+                    const result = await searchWithApiToken({
+                        token: mock.token,
+                        apiUrl,
+                        query: query || undefined,
+                        entity: typeof parsed.values.entity === 'string'
+                            ? parsed.values.entity
+                            : undefined,
+                        domain: typeof parsed.values.domain === 'string'
+                            ? parsed.values.domain
+                            : undefined,
+                        limit: typeof parsed.values.limit === 'string'
+                            ? Number(parsed.values.limit)
+                            : undefined,
+                    });
+                    write(formatToolResult(result, json));
+                    return result.isError ? 1 : 0;
+                }
+                if (shouldUseApiToken({
+                    tokenValues,
+                    mcpUrl,
                     apiUrl,
+                    allowEnvWithoutLogin: true,
+                    ...(org ? { org } : {}),
+                })) {
+                    const { searchWithApiToken } = await import('./open-api-client.js');
+                    const result = await searchWithApiToken({
+                        token: requireApiToken(tokenValues, process.env, 'search', { apiUrl }),
+                        apiUrl,
+                        ...(org ? { org } : {}),
+                        query: query || undefined,
+                        entity: typeof parsed.values.entity === 'string'
+                            ? parsed.values.entity
+                            : undefined,
+                        domain: typeof parsed.values.domain === 'string'
+                            ? parsed.values.domain
+                            : undefined,
+                        limit: typeof parsed.values.limit === 'string'
+                            ? Number(parsed.values.limit)
+                            : undefined,
+                    });
+                    write(formatToolResult(result, json));
+                    return result.isError ? 1 : 0;
+                }
+                const args = {};
+                if (query)
+                    args.query = query;
+                if (typeof parsed.values.entity === 'string')
+                    args.entity = parsed.values.entity;
+                if (typeof parsed.values.domain === 'string')
+                    args.domain = parsed.values.domain;
+                if (typeof parsed.values.limit === 'string')
+                    args.limit = Number(parsed.values.limit);
+                const { callKodyTool } = await import('./mcp.js');
+                const result = await callKodyTool({
+                    name: 'search',
+                    args,
+                    mcpUrl,
                     ...(org ? { org } : {}),
-                    query: query || undefined,
-                    entity: typeof parsed.values.entity === 'string' ? parsed.values.entity : undefined,
-                    domain: typeof parsed.values.domain === 'string' ? parsed.values.domain : undefined,
-                    limit: typeof parsed.values.limit === 'string'
-                        ? Number(parsed.values.limit)
-                        : undefined,
                 });
                 write(formatToolResult(result, json));
                 return result.isError ? 1 : 0;
             }
-            const args = {};
-            if (query)
-                args.query = query;
-            if (typeof parsed.values.entity === 'string')
-                args.entity = parsed.values.entity;
-            if (typeof parsed.values.domain === 'string')
-                args.domain = parsed.values.domain;
-            if (typeof parsed.values.limit === 'string')
-                args.limit = Number(parsed.values.limit);
-            const { callKodyTool } = await import('./mcp.js');
-            const result = await callKodyTool({
-                name: 'search',
-                args,
-                mcpUrl,
-                ...(org ? { org } : {}),
-            });
-            write(formatToolResult(result, json));
-            return result.isError ? 1 : 0;
+            finally {
+                await closeMock?.();
+            }
         }
         case 'execute': {
+            const { resolveTarget } = await import('./target.js');
+            const target = resolveTarget({
+                command: 'execute',
+                flag: typeof parsed.values.target === 'string' ? parsed.values.target : undefined,
+            });
             const invoke = typeof parsed.values.invoke === 'string' ? parsed.values.invoke : undefined;
             const hasCodeFlag = typeof parsed.values.code === 'string';
             const hasFileFlag = typeof parsed.values.file === 'string';
             const positionalModule = parsed.positionals.join('\n').trim();
-            const local = parsed.values.local === true;
+            // --target mock always runs locally against the CLI mock (no cloud sandbox).
+            const local = parsed.values.local === true || target === 'mock';
             const tokenValues = tokenFlagValues(parsed.values);
-            if (local && invoke !== undefined) {
-                throw new Error('--invoke runs a saved package export in Kody; --local runs a module you provide (--code, --file, or a module string).');
+            const localPackageInvoke = invoke !== undefined ? await tryResolveLocalPackageInvoke(invoke) : null;
+            if (local && invoke !== undefined && !localPackageInvoke) {
+                throw new Error('--invoke runs a saved package export in Kody; --local runs a module you provide (--code, --file, or a module string). To test an unpublished package export, pass an export key from package.json#exports (e.g. `--invoke ./on-user-deleted`) from the package directory, or use --file.');
             }
             if (executeSourcesConflict({ invoke, hasCodeFlag, hasFileFlag, positionalModule })) {
                 throw new Error('--invoke cannot be combined with --code, --file, or a module string.');
@@ -506,23 +589,26 @@ async function dispatch(parsed, write, writeErr) {
                 assertLocalExecuteNodeEngine();
             const fileArg = hasFileFlag ? parsed.values.file : undefined;
             // `--code` wins over `--file`. Only attribute the path when the file is the source.
-            const modulePath = !hasCodeFlag && fileArg !== undefined && fileArg !== '-' ? fileArg : undefined;
-            const code = invoke !== undefined
+            const modulePath = localPackageInvoke?.modulePath ??
+                (!hasCodeFlag && fileArg !== undefined && fileArg !== '-' ? fileArg : undefined);
+            const code = invoke !== undefined && !localPackageInvoke
                 ? undefined
                 : hasCodeFlag
                     ? parsed.values.code
-                    : modulePath !== undefined
+                    : modulePath !== undefined && !localPackageInvoke
                         ? await readFile(modulePath, 'utf8')
-                        : fileArg === '-'
-                            ? await readStdin()
-                            : positionalModule || undefined;
+                        : localPackageInvoke
+                            ? await readFile(localPackageInvoke.modulePath, 'utf8')
+                            : fileArg === '-'
+                                ? await readStdin()
+                                : positionalModule || undefined;
             const credentials = parseCredentialFlags(Array.isArray(parsed.values.credential)
                 ? parsed.values.credential.filter((value) => typeof value === 'string')
                 : typeof parsed.values.credential === 'string'
                     ? [parsed.values.credential]
                     : undefined);
             const args = buildExecuteToolArgs({
-                invoke,
+                invoke: localPackageInvoke ? undefined : invoke,
                 code: typeof code === 'string' ? code : undefined,
                 paramsJson: typeof parsed.values.params === 'string' ? parsed.values.params : undefined,
                 conversationId: typeof parsed.values['conversation-id'] === 'string'
@@ -530,57 +616,225 @@ async function dispatch(parsed, write, writeErr) {
                     : undefined,
                 credentials,
             });
-            const apiUrl = apiUrlFrom({
+            let apiUrl = apiUrlFrom({
                 apiUrl: typeof parsed.values['api-url'] === 'string'
                     ? parsed.values['api-url']
                     : undefined,
             });
-            const useToken = local ||
-                shouldUseApiToken({
-                    tokenValues,
-                    mcpUrl,
-                    apiUrl,
-                    allowEnvWithoutLogin: true,
-                    ...(org ? { org } : {}),
-                });
-            const result = local
-                ? await (await import('./local-execute.js')).runLocalExecute({
-                    code: args.code,
-                    ...(modulePath !== undefined ? { modulePath } : {}),
-                    params: args.params,
-                    conversationId: args.conversationId,
-                    ...(credentials !== undefined ? { credentials } : {}),
-                    token: await resolveLocalExecuteBearer({
+            let closeMock;
+            let mockToken;
+            try {
+                if (target === 'mock') {
+                    const { ensureMockTarget } = await import('./mock/mock-server.js');
+                    const mock = await ensureMockTarget({
+                        resetStorage: parsed.values['reset-storage'] === true,
+                        packageId: localPackageInvoke
+                            ? `local:${localPackageInvoke.kodyId}`
+                            : undefined,
+                    });
+                    apiUrl = mock.apiUrl;
+                    mockToken = mock.token;
+                    closeMock = mock.started ? () => mock.server.close() : undefined;
+                }
+                if (localPackageInvoke) {
+                    const { buildLocalPackageContext, runLocalPackageModule } = await import('./local-package-run.js');
+                    const result = await runLocalPackageModule({
+                        modulePath: localPackageInvoke.modulePath,
+                        params: args.params,
+                        token: mockToken ??
+                            (await resolveLocalExecuteBearer({
+                                tokenValues,
+                                mcpUrl,
+                                apiUrl,
+                                purpose: 'execute local package export',
+                                ...(org ? { org } : {}),
+                            })),
+                        apiUrl,
+                        target,
+                        packageContext: buildLocalPackageContext({
+                            kodyId: localPackageInvoke.kodyId,
+                            hostedUrl: 'http://127.0.0.1:0',
+                        }),
+                        ...(org ? { org } : {}),
+                        allowPrivateNetwork: parsed.values['allow-private-network'] === true,
+                        onStatus: (message) => writeErr(`${message}\n`),
+                    });
+                    write(formatToolResult(result, json));
+                    return result.isError ? 1 : 0;
+                }
+                const useToken = local ||
+                    shouldUseApiToken({
                         tokenValues,
                         mcpUrl,
                         apiUrl,
-                        purpose: 'execute --local',
+                        allowEnvWithoutLogin: true,
                         ...(org ? { org } : {}),
-                    }),
-                    apiUrl,
-                    ...(org ? { org } : {}),
-                    allowPrivateNetwork: parsed.values['allow-private-network'] === true,
-                    onStatus: (message) => writeErr(`${message}\n`),
-                })
-                : useToken
-                    ? await (await import('./remote-execute.js')).runRemoteExecuteWithToken({
-                        code: typeof args.code === 'string' ? args.code : undefined,
-                        invoke,
+                    });
+                const result = local
+                    ? await (await import('./local-execute.js')).runLocalExecute({
+                        code: args.code,
+                        ...(modulePath !== undefined ? { modulePath } : {}),
                         params: args.params,
                         conversationId: args.conversationId,
                         ...(credentials !== undefined ? { credentials } : {}),
-                        token: requireApiToken(tokenValues, process.env, 'execute with an API token', { apiUrl }),
+                        token: mockToken ??
+                            (await resolveLocalExecuteBearer({
+                                tokenValues,
+                                mcpUrl,
+                                apiUrl,
+                                purpose: 'execute --local',
+                                ...(org ? { org } : {}),
+                            })),
                         apiUrl,
                         ...(org ? { org } : {}),
+                        allowPrivateNetwork: parsed.values['allow-private-network'] === true,
+                        onStatus: (message) => writeErr(`${message}\n`),
                     })
-                    : await (await import('./mcp.js')).callKodyTool({
-                        name: 'execute',
-                        args,
-                        mcpUrl,
-                        ...(org ? { org } : {}),
-                    });
-            write(formatToolResult(result, json));
-            return result.isError ? 1 : 0;
+                    : useToken
+                        ? await (await import('./remote-execute.js')).runRemoteExecuteWithToken({
+                            code: typeof args.code === 'string' ? args.code : undefined,
+                            invoke,
+                            params: args.params,
+                            conversationId: args.conversationId,
+                            ...(credentials !== undefined ? { credentials } : {}),
+                            token: requireApiToken(tokenValues, process.env, 'execute with an API token', { apiUrl }),
+                            apiUrl,
+                            ...(org ? { org } : {}),
+                        })
+                        : await (await import('./mcp.js')).callKodyTool({
+                            name: 'execute',
+                            args,
+                            mcpUrl,
+                            ...(org ? { org } : {}),
+                        });
+                write(formatToolResult(result, json));
+                return result.isError ? 1 : 0;
+            }
+            finally {
+                await closeMock?.();
+            }
+        }
+        case 'dev': {
+            const { resolveTarget } = await import('./target.js');
+            const { parseDevSubcommand, resolveDevAuth, runDevCheck, runDevEmit, runDevFetch, runDevJob, runDevServe, runDevWebhook, } = await import('./dev-command.js');
+            const target = resolveTarget({
+                command: 'dev',
+                flag: typeof parsed.values.target === 'string' ? parsed.values.target : undefined,
+            });
+            const { subcommand, rest } = parseDevSubcommand(parsed.positionals);
+            const tokenValues = tokenFlagValues(parsed.values);
+            const prodApiUrl = apiUrlFrom({
+                apiUrl: typeof parsed.values['api-url'] === 'string'
+                    ? parsed.values['api-url']
+                    : undefined,
+            });
+            const io = { stdout: write, stderr: writeErr };
+            const bodyPath = typeof parsed.values.body === 'string' ? parsed.values.body : undefined;
+            // `check` only bundles + validates the package tree; it never talks to
+            // mock/prod, so skip auth (and the mock server) to avoid leaking a listen
+            // handle that would keep the process alive after printing results.
+            if (subcommand === 'check') {
+                return await runDevCheck({ target, json, io });
+            }
+            const token = target === 'prod'
+                ? await resolveLocalExecuteBearer({
+                    tokenValues,
+                    mcpUrl,
+                    apiUrl: prodApiUrl,
+                    purpose: 'kody dev',
+                    ...(org ? { org } : {}),
+                })
+                : 'mock';
+            const auth = await resolveDevAuth({
+                target,
+                token,
+                apiUrl: prodApiUrl,
+                ...(org ? { org } : {}),
+                resetStorage: parsed.values['reset-storage'] === true,
+            });
+            const port = typeof parsed.values.port === 'string' ? Number(parsed.values.port) : undefined;
+            const appBasePath = typeof parsed.values['app-base-path'] === 'string'
+                ? parsed.values['app-base-path']
+                : undefined;
+            try {
+                switch (subcommand) {
+                    case 'serve':
+                        return await runDevServe({
+                            target,
+                            auth,
+                            port,
+                            appBasePath,
+                            allowPrivateNetwork: parsed.values['allow-private-network'] === true,
+                            io,
+                        });
+                    case 'fetch': {
+                        const path = rest[0];
+                        if (!path) {
+                            throw new Error('Usage: kody dev fetch <path> [--method GET] [--body file.json]');
+                        }
+                        let body;
+                        if (bodyPath)
+                            body = await readFile(bodyPath, 'utf8');
+                        return await runDevFetch({
+                            target,
+                            auth,
+                            path,
+                            method: typeof parsed.values.method === 'string'
+                                ? parsed.values.method
+                                : undefined,
+                            body,
+                            port,
+                            appBasePath,
+                            json,
+                            io,
+                        });
+                    }
+                    case 'job': {
+                        const jobName = rest[0];
+                        if (!jobName)
+                            throw new Error('Usage: kody dev job <name>');
+                        return await runDevJob({ target, auth, jobName, json, io });
+                    }
+                    case 'webhook': {
+                        const webhookName = rest[0];
+                        if (!webhookName || !bodyPath) {
+                            throw new Error('Usage: kody dev webhook <name> --body file.json');
+                        }
+                        return await runDevWebhook({
+                            target,
+                            auth,
+                            webhookName,
+                            bodyPath,
+                            json,
+                            io,
+                        });
+                    }
+                    case 'emit': {
+                        const event = rest[0];
+                        if (!event || !bodyPath) {
+                            throw new Error('Usage: kody dev emit <event> --body event.json');
+                        }
+                        return await runDevEmit({
+                            target,
+                            auth,
+                            event,
+                            bodyPath,
+                            json,
+                            io,
+                        });
+                    }
+                    default: {
+                        const exhaustive = subcommand;
+                        throw new Error(`Unhandled kody dev subcommand: ${String(exhaustive)}`);
+                    }
+                }
+            }
+            catch (error) {
+                // Usage / surface errors after the mock started must still close it,
+                // or the listen handle keeps the process alive (same hang as check).
+                await auth.closeMock?.();
+                throw error;
+            }
         }
         case 'api': {
             const operationId = parsed.positionals[0]?.trim() ?? '';
@@ -606,6 +860,34 @@ async function dispatch(parsed, write, writeErr) {
             write(`${JSON.stringify(result, null, 2)}\n`);
             return 0;
         }
+        case 'package': {
+            const action = parsed.positionals[0];
+            if (action !== 'publish') {
+                throw new Error('Usage: kody package publish [<@owner/leaf|package_id>] [--params <json>] [--token <token>] [--api-url <url>] [--org <slug>]');
+            }
+            const apiUrl = apiUrlFrom({
+                apiUrl: typeof parsed.values['api-url'] === 'string'
+                    ? parsed.values['api-url']
+                    : undefined,
+            });
+            const tokenValues = tokenFlagValues(parsed.values);
+            const params = packagePublishParams({
+                positional: parsed.positionals[1],
+                paramsJson: typeof parsed.values.params === 'string' ? parsed.values.params : undefined,
+            });
+            const { callOpenApiOperation } = await import('./open-api-client.js');
+            const result = await callOpenApiOperation({
+                operationId: 'packagePublishExternalPush',
+                params,
+                token: requireApiToken(tokenValues, process.env, 'package publish', {
+                    apiUrl,
+                }),
+                apiUrl,
+                ...(org ? { org } : {}),
+            });
+            write(`${JSON.stringify(result, null, 2)}\n`);
+            return 0;
+        }
         case 'install': {
             const { runInstall } = await import('./install.js');
             const result = await runInstall({
@@ -640,6 +922,20 @@ async function readStdin() {
     }
     return Buffer.concat(chunks).toString('utf8');
 }
+async function tryResolveLocalPackageInvoke(invoke) {
+    const trimmed = invoke.trim();
+    if (!trimmed || trimmed.startsWith('kody:@'))
+        return null;
+    try {
+        const { loadPackageManifest, resolveExportModulePath } = await import('./package-manifest.js');
+        const manifest = await loadPackageManifest(process.cwd());
+        const modulePath = resolveExportModulePath(manifest, trimmed);
+        return { modulePath, kodyId: manifest.kodyId };
+    }
+    catch {
+        return null;
+    }
+}
 /** True when --invoke is set alongside any code source (--code, --file, or positional). */
 export function executeSourcesConflict(input) {
     return (input.invoke !== undefined &&
@@ -822,6 +1118,26 @@ export function parseApiParamsJson(paramsJson) {
     }
     return parsed;
 }
+const packageIdUuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Build `packagePublishExternalPush` params for `kody package publish`.
+ * Optional positional is `package_id` when UUID-shaped, otherwise `kody_id`.
+ * Explicit `--params` keys win over the positional.
+ */
+export function packagePublishParams(input) {
+    const params = parseApiParamsJson(input.paramsJson);
+    const ref = input.positional?.trim();
+    if (!ref)
+        return params;
+    if (packageIdUuidPattern.test(ref)) {
+        if (params.package_id === undefined)
+            params.package_id = ref;
+    }
+    else if (params.kody_id === undefined) {
+        params.kody_id = ref;
+    }
+    return params;
+}
 /**
  * Prefer a scoped API token when the user passed `--token`, or when
  * `KODY_API_TOKEN` / a stored bootstrap token is available and there is no