@nimbus-sh/cli 0.1.7 → 0.1.10

package/README.md

@@ -1,7 +1,7 @@
 # @nimbus-sh/cli
 
-CLI for Nimbus: scaffolding, token mint/verify, session helpers, and runtime
-cache operations.
+Scaffold a Nimbus Worker, mint and verify tokens, open sessions, and sync the
+runtime cache.
 
 ## Install
 
@@ -24,9 +24,16 @@ bun packages/cli/src/scaffold-bin.ts my-app
 ### `nimbus init [directory]`
 
 Scaffolds a Nimbus-powered Workers project. `.` uses the current directory.
+
 The generated app embeds the interactive Nimbus UI and enables the
-authenticated remote sandbox API. Add application-specific auth routes in
-`src/index.ts` when you are ready to mint user tokens from your backend.
+authenticated remote sandbox API. Add your own auth routes in `src/index.ts`
+before you mint user tokens from the backend.
+
+The app also carries the session agent UI. To configure Cloudflare OAuth and
+Workers AI, add the non-secret `NIMBUS_CF_OAUTH_CLIENT_ID`,
+`NIMBUS_CF_OAUTH_SCOPES`, `NIMBUS_AGENT_MODEL`, and
+`NIMBUS_AGENT_GATEWAY_ID` vars. Then store `NIMBUS_AGENT_COOKIE_SECRET` with
+`wrangler secret put`.
 
 ```bash
 nimbus init my-nimbus
@@ -111,9 +118,8 @@ Exit codes: 0 success, 65 token-validation failure, 78 env missing.
 
 ### `nimbus runtime sync`
 
-Uploads runtime blobs/manifests and updates the runtime catalog through the
-public CLI wrapper. This is the user-facing path for Python, Ruby, and clang
-runtime cache operations.
+Uploads runtime blobs and manifests, then updates the runtime catalog. This
+is the user-facing path for the Python, Ruby, and clang runtime caches.
 
 ```bash
 CLOUDFLARE_ACCOUNT_ID=<id> nimbus runtime sync --bucket nimbus-runtime-cache-public clang
@@ -139,6 +145,21 @@ NIMBUS_ENDPOINT=https://my-nimbus.workers.dev nimbus session new
 # {"sessionId":"pretty-otter-1234","url":"https://.../s/pretty-otter-1234/"}
 ```
 
+Authenticated deployments can pass a token with `--token` or `NIMBUS_TOKEN`:
+
+```bash
+NIMBUS_ENDPOINT=https://my-nimbus.workers.dev \
+NIMBUS_TOKEN=<jwt-with-session-create> \
+nimbus session new
+```
+
+The token is sent only as an `Authorization: Bearer` header. It never
+appears in any URL. The printed attach URL is the server's redirect Location
+verbatim. On enforced deployments that URL carries a short-lived (90 s),
+single-use bootstrap token pinned to the new session. Opening it once sets
+the session cookie and redirects to the clean `/s/<id>/` URL. Reusing it
+returns 401.
+
 ## Programmatic use
 
 Every verb is also exported as a function:
@@ -147,8 +168,8 @@ Every verb is also exported as a function:
 import { mintToken, syncRuntimes, scaffold } from '@nimbus-sh/cli';
 ```
 
-`mintToken(argv)` and friends return a Promise<number> (process exit
-code). Stdout / stderr write directly via `process.stdout`/`process.stderr`.
+`mintToken(argv)` and its siblings return a Promise<number>, the process exit
+code. They write to `process.stdout` and `process.stderr` directly.
 
 ## Engines
 

package/dist/bin.js

@@ -67,7 +67,7 @@ Usage:
   nimbus token verify <token>
   nimbus runtime sync [--bucket <name>] [runtime[@version]...]
   nimbus runtime list
-  nimbus session new [--endpoint <url>]
+  nimbus session new [--endpoint <url>] [--token <jwt>]
   nimbus setup cloudflare --name <worker-name>
   nimbus init [directory]
 
@@ -77,6 +77,7 @@ For embedder scaffolding:
 Env:
   JWT_SECRET        Shared secret for HS256 (required for token mint/verify).
   NIMBUS_ENDPOINT   Base URL for session new. Defaults to localhost:8787.
+  NIMBUS_TOKEN      Bearer token for authenticated session new.
   CLOUDFLARE_ACCOUNT_ID  Required for runtime sync.
 `);
 }

package/dist/commands/scaffold.js

@@ -125,9 +125,9 @@ function renderPackageJson(name) {
             typecheck: 'tsc --noEmit',
         },
         dependencies: {
-            '@nimbus-sh/config': '^0.1.3',
-            '@nimbus-sh/worker': '^0.1.4',
-            '@nimbus-sh/sdk': '^0.1.4',
+            '@nimbus-sh/config': '^0.1.4',
+            '@nimbus-sh/worker': '^0.2.0',
+            '@nimbus-sh/sdk': '^0.2.0',
         },
         devDependencies: {
             '@cloudflare/workers-types': '^4.20250327.0',
@@ -144,6 +144,10 @@ function renderWranglerJsonc(name) {
   "compatibility_date": "2026-04-01",
   "compatibility_flags": ["nodejs_compat"],
   "placement": { "mode": "smart" },
+  "vars": {
+    "NIMBUS_AGENT_MODEL": "@cf/moonshotai/kimi-k2.6",
+    "NIMBUS_AGENT_GATEWAY_ID": "default"
+  },
 
   "assets": {
     "directory": "node_modules/@nimbus-sh/worker/public",
@@ -155,7 +159,6 @@ function renderWranglerJsonc(name) {
   // not omit any of these — \`git clone\` will fail at runtime if any
   // are missing.
   "alias": {
-    "@lifo-sh/ui": "./node_modules/@nimbus-sh/worker/dist/stubs/lifo-ui.js",
     "clean-git-ref": "clean-git-ref/lib/index.js",
     "is-git-ref-name-valid": "is-git-ref-name-valid/index.js",
     "crc-32": "crc-32",
@@ -171,10 +174,14 @@ function renderWranglerJsonc(name) {
   },
 
   "durable_objects": {
-    "bindings": [{ "name": "NIMBUS_SESSION", "class_name": "NimbusSession" }]
+    "bindings": [
+      { "name": "NIMBUS_SESSION", "class_name": "NimbusSession" },
+      { "name": "NIMBUS_PUBLIC_DIRECTORY", "class_name": "NimbusPublicDirectory" }
+    ]
   },
   "migrations": [
-    { "tag": "nimbus-v1", "new_sqlite_classes": ["NimbusSession"] }
+    { "tag": "nimbus-v1", "new_sqlite_classes": ["NimbusSession"] },
+    { "tag": "nimbus-v2", "new_sqlite_classes": ["NimbusPublicDirectory"] }
   ],
 
   "worker_loaders": [{ "binding": "LOADER" }],
@@ -207,6 +214,7 @@ import { defineNimbusConfig } from '@nimbus-sh/config';
 // auto-populate loopback bindings (env.SUPERVISOR, etc.).
 export {
   NimbusSession,
+  NimbusPublicDirectory,
   SupervisorRPC,
   NimbusAssetsRPC,
   NimbusLoaderRPC,
@@ -273,6 +281,48 @@ Then visit the URL wrangler prints.
 If setup reports Cloudflare R2 error 10042, enable R2 in the Cloudflare
 Dashboard once for this account, then rerun the setup command.
 
+## Session Agent
+
+The session UI includes an Agent surface inside the editor workspace. It can
+use the same sandbox tools as the terminal: shell exec, files, runtime
+installs, processes, logs, and preview ports.
+
+For user-owned Cloudflare Workers AI quota, create a Cloudflare OAuth client:
+
+- Client Name: Nimbus Agent
+- Response Type: Code
+- Grant type: Authorization Code
+- Token Authentication Method: None
+
+Use this redirect URL:
+
+\`\`\`
+https://${wranglerName}.your-account.workers.dev/api/nimbus/oauth/callback
+\`\`\`
+
+Set the non-secret values in \`wrangler.jsonc\`:
+
+\`\`\`jsonc
+"vars": {
+  "NIMBUS_CF_OAUTH_CLIENT_ID": "<oauth-client-id>",
+  "NIMBUS_CF_OAUTH_SCOPES": "<scope-id-1> <scope-id-2>",
+  "NIMBUS_AGENT_MODEL": "@cf/moonshotai/kimi-k2.6",
+  "NIMBUS_AGENT_GATEWAY_ID": "default"
+}
+\`\`\`
+
+Then store a 32+ character cookie encryption secret. Nimbus uses this to keep
+Cloudflare OAuth tokens in encrypted HttpOnly browser cookies instead of
+Durable Object storage:
+
+\`\`\`bash
+npx wrangler secret put NIMBUS_AGENT_COOKIE_SECRET
+\`\`\`
+
+For owner-token fallback, set \`NIMBUS_CLOUDFLARE_ACCOUNT_ID\` in
+\`wrangler.jsonc\` and store \`NIMBUS_CLOUDFLARE_API_TOKEN\` with
+\`wrangler secret put\`.
+
 ## Tokens
 
 By default tokens are enforced because \`JWT_SECRET\` is set. Mint a token for

package/dist/commands/session.d.ts

@@ -1,5 +1,11 @@
 /**
  * cli/commands/session — `nimbus session new` — mint a session via POST /new.
+ *
+ * `--token` / `NIMBUS_TOKEN` travels ONLY as `Authorization: Bearer`.
+ * The printed attach URL is the server's redirect Location verbatim: on
+ * enforced deployments it carries a short-lived single-use bootstrap
+ * token (never the caller's long-lived token); on unauthenticated
+ * deployments it is the plain `/s/<id>/` URL.
  */
 /** Mint a fresh session and print its attach URL. */
 export declare function newSession(args: string[]): Promise<number>;

package/dist/commands/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qDAAqD;AACrD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BhE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qDAAqD;AACrD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BhE"}

package/dist/commands/session.js

@@ -1,5 +1,11 @@
 /**
  * cli/commands/session — `nimbus session new` — mint a session via POST /new.
+ *
+ * `--token` / `NIMBUS_TOKEN` travels ONLY as `Authorization: Bearer`.
+ * The printed attach URL is the server's redirect Location verbatim: on
+ * enforced deployments it carries a short-lived single-use bootstrap
+ * token (never the caller's long-lived token); on unauthenticated
+ * deployments it is the plain `/s/<id>/` URL.
  */
 /** Mint a fresh session and print its attach URL. */
 export async function newSession(args) {
@@ -7,11 +13,13 @@ export async function newSession(args) {
     const endpoint = parsed['--endpoint']
         ?? process.env.NIMBUS_ENDPOINT
         ?? 'http://127.0.0.1:8787';
+    const token = parsed['--token'] ?? process.env.NIMBUS_TOKEN ?? '';
     try {
         const baseUrl = new URL(endpoint);
         const r = await fetch(new URL('/new', baseUrl), {
             method: 'POST',
             redirect: 'manual',
+            headers: token ? { Authorization: `Bearer ${token}` } : undefined,
         });
         const loc = r.headers.get('Location');
         if (!loc) {
@@ -23,7 +31,7 @@ export async function newSession(args) {
             process.stderr.write(`nimbus session new: unexpected Location: ${loc}\n`);
             return 70;
         }
-        const url = new URL(`/s/${encodeURIComponent(sessionId)}/`, baseUrl).toString();
+        const url = new URL(loc, baseUrl).toString();
         process.stdout.write(JSON.stringify({ sessionId, url }) + '\n');
         return 0;
     }

package/dist/version.d.ts

@@ -3,5 +3,5 @@
  * `require('./package.json')` because that breaks under bun's
  * single-file binary mode.
  */
-export declare const CLI_VERSION = "0.1.7";
+export declare const CLI_VERSION = "0.1.8";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,4 +3,4 @@
  * `require('./package.json')` because that breaks under bun's
  * single-file binary mode.
  */
-export const CLI_VERSION = '0.1.7';
+export const CLI_VERSION = '0.1.8';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/cli",
-  "version": "0.1.7",
+  "version": "0.1.10",
   "description": "Nimbus CLI — `create-nimbus-app` scaffolder + `token mint` + `runtime sync`.",
   "keywords": [
     "cloudflare",
@@ -41,12 +41,12 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json --noCheck --noEmit false --declaration true --declarationMap true --outDir dist --rootDir src && chmod +x dist/bin.js dist/scaffold-bin.js",
-    "prepack": "npm run build",
+    "prepack": "bun run build",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@nimbus-sh/sdk": "^0.1.4",
-    "@nimbus-sh/worker": "^0.1.4"
+    "@nimbus-sh/sdk": "^0.7.0",
+    "@nimbus-sh/worker": "^0.8.0"
   },
   "engines": {
     "node": ">=20"