@nimbus-sh/cli 0.1.7 → 0.1.8

package/README.md

@@ -27,6 +27,11 @@ Scaffolds a Nimbus-powered Workers project. `.` uses the current directory.
 The generated app embeds the interactive Nimbus UI and enables the
 authenticated remote sandbox API. Add application-specific auth routes in
 `src/index.ts` when you are ready to mint user tokens from your backend.
+It also includes the session Agent UI. Configure Cloudflare OAuth and Workers
+AI by adding the non-secret `NIMBUS_CF_OAUTH_CLIENT_ID`,
+`NIMBUS_CF_OAUTH_SCOPES`, `NIMBUS_AGENT_MODEL`, and
+`NIMBUS_AGENT_GATEWAY_ID` vars, then store `NIMBUS_AGENT_COOKIE_SECRET`
+with `wrangler secret put`.
 
 ```bash
 nimbus init my-nimbus
@@ -139,6 +144,21 @@ NIMBUS_ENDPOINT=https://my-nimbus.workers.dev nimbus session new
 # {"sessionId":"pretty-otter-1234","url":"https://.../s/pretty-otter-1234/"}
 ```
 
+Authenticated deployments can pass a token with `--token` or `NIMBUS_TOKEN`:
+
+```bash
+NIMBUS_ENDPOINT=https://my-nimbus.workers.dev \
+NIMBUS_TOKEN=<jwt-with-session-create> \
+nimbus session new
+```
+
+The token is sent only as an `Authorization: Bearer` header — it never
+appears in any URL. The printed attach URL is the server's redirect
+Location verbatim: on enforced deployments it carries a short-lived
+(90 s), single-use bootstrap token pinned to the new session. Opening it
+once sets the session cookie and redirects to the clean `/s/<id>/` URL;
+reusing it returns 401.
+
 ## Programmatic use
 
 Every verb is also exported as a function:

package/dist/bin.js

@@ -67,7 +67,7 @@ Usage:
   nimbus token verify <token>
   nimbus runtime sync [--bucket <name>] [runtime[@version]...]
   nimbus runtime list
-  nimbus session new [--endpoint <url>]
+  nimbus session new [--endpoint <url>] [--token <jwt>]
   nimbus setup cloudflare --name <worker-name>
   nimbus init [directory]
 
@@ -77,6 +77,7 @@ For embedder scaffolding:
 Env:
   JWT_SECRET        Shared secret for HS256 (required for token mint/verify).
   NIMBUS_ENDPOINT   Base URL for session new. Defaults to localhost:8787.
+  NIMBUS_TOKEN      Bearer token for authenticated session new.
   CLOUDFLARE_ACCOUNT_ID  Required for runtime sync.
 `);
 }

package/dist/commands/scaffold.js

@@ -125,9 +125,9 @@ function renderPackageJson(name) {
             typecheck: 'tsc --noEmit',
         },
         dependencies: {
-            '@nimbus-sh/config': '^0.1.3',
-            '@nimbus-sh/worker': '^0.1.4',
-            '@nimbus-sh/sdk': '^0.1.4',
+            '@nimbus-sh/config': '^0.1.4',
+            '@nimbus-sh/worker': '^0.2.0',
+            '@nimbus-sh/sdk': '^0.2.0',
         },
         devDependencies: {
             '@cloudflare/workers-types': '^4.20250327.0',
@@ -144,6 +144,10 @@ function renderWranglerJsonc(name) {
   "compatibility_date": "2026-04-01",
   "compatibility_flags": ["nodejs_compat"],
   "placement": { "mode": "smart" },
+  "vars": {
+    "NIMBUS_AGENT_MODEL": "@cf/moonshotai/kimi-k2.6",
+    "NIMBUS_AGENT_GATEWAY_ID": "default"
+  },
 
   "assets": {
     "directory": "node_modules/@nimbus-sh/worker/public",
@@ -155,7 +159,6 @@ function renderWranglerJsonc(name) {
   // not omit any of these — \`git clone\` will fail at runtime if any
   // are missing.
   "alias": {
-    "@lifo-sh/ui": "./node_modules/@nimbus-sh/worker/dist/stubs/lifo-ui.js",
     "clean-git-ref": "clean-git-ref/lib/index.js",
     "is-git-ref-name-valid": "is-git-ref-name-valid/index.js",
     "crc-32": "crc-32",
@@ -273,6 +276,48 @@ Then visit the URL wrangler prints.
 If setup reports Cloudflare R2 error 10042, enable R2 in the Cloudflare
 Dashboard once for this account, then rerun the setup command.
 
+## Session Agent
+
+The session UI includes an Agent surface inside the editor workspace. It can
+use the same sandbox tools as the terminal: shell exec, files, runtime
+installs, processes, logs, and preview ports.
+
+For user-owned Cloudflare Workers AI quota, create a Cloudflare OAuth client:
+
+- Client Name: Nimbus Agent
+- Response Type: Code
+- Grant type: Authorization Code
+- Token Authentication Method: None
+
+Use this redirect URL:
+
+\`\`\`
+https://${wranglerName}.your-account.workers.dev/api/nimbus/oauth/callback
+\`\`\`
+
+Set the non-secret values in \`wrangler.jsonc\`:
+
+\`\`\`jsonc
+"vars": {
+  "NIMBUS_CF_OAUTH_CLIENT_ID": "<oauth-client-id>",
+  "NIMBUS_CF_OAUTH_SCOPES": "<scope-id-1> <scope-id-2>",
+  "NIMBUS_AGENT_MODEL": "@cf/moonshotai/kimi-k2.6",
+  "NIMBUS_AGENT_GATEWAY_ID": "default"
+}
+\`\`\`
+
+Then store a 32+ character cookie encryption secret. Nimbus uses this to keep
+Cloudflare OAuth tokens in encrypted HttpOnly browser cookies instead of
+Durable Object storage:
+
+\`\`\`bash
+npx wrangler secret put NIMBUS_AGENT_COOKIE_SECRET
+\`\`\`
+
+For owner-token fallback, set \`NIMBUS_CLOUDFLARE_ACCOUNT_ID\` in
+\`wrangler.jsonc\` and store \`NIMBUS_CLOUDFLARE_API_TOKEN\` with
+\`wrangler secret put\`.
+
 ## Tokens
 
 By default tokens are enforced because \`JWT_SECRET\` is set. Mint a token for

package/dist/commands/session.d.ts

@@ -1,5 +1,11 @@
 /**
  * cli/commands/session — `nimbus session new` — mint a session via POST /new.
+ *
+ * `--token` / `NIMBUS_TOKEN` travels ONLY as `Authorization: Bearer`.
+ * The printed attach URL is the server's redirect Location verbatim: on
+ * enforced deployments it carries a short-lived single-use bootstrap
+ * token (never the caller's long-lived token); on unauthenticated
+ * deployments it is the plain `/s/<id>/` URL.
  */
 /** Mint a fresh session and print its attach URL. */
 export declare function newSession(args: string[]): Promise<number>;

package/dist/commands/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qDAAqD;AACrD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BhE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qDAAqD;AACrD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BhE"}

package/dist/commands/session.js

@@ -1,5 +1,11 @@
 /**
  * cli/commands/session — `nimbus session new` — mint a session via POST /new.
+ *
+ * `--token` / `NIMBUS_TOKEN` travels ONLY as `Authorization: Bearer`.
+ * The printed attach URL is the server's redirect Location verbatim: on
+ * enforced deployments it carries a short-lived single-use bootstrap
+ * token (never the caller's long-lived token); on unauthenticated
+ * deployments it is the plain `/s/<id>/` URL.
  */
 /** Mint a fresh session and print its attach URL. */
 export async function newSession(args) {
@@ -7,11 +13,13 @@ export async function newSession(args) {
     const endpoint = parsed['--endpoint']
         ?? process.env.NIMBUS_ENDPOINT
         ?? 'http://127.0.0.1:8787';
+    const token = parsed['--token'] ?? process.env.NIMBUS_TOKEN ?? '';
     try {
         const baseUrl = new URL(endpoint);
         const r = await fetch(new URL('/new', baseUrl), {
             method: 'POST',
             redirect: 'manual',
+            headers: token ? { Authorization: `Bearer ${token}` } : undefined,
         });
         const loc = r.headers.get('Location');
         if (!loc) {
@@ -23,7 +31,7 @@ export async function newSession(args) {
             process.stderr.write(`nimbus session new: unexpected Location: ${loc}\n`);
             return 70;
         }
-        const url = new URL(`/s/${encodeURIComponent(sessionId)}/`, baseUrl).toString();
+        const url = new URL(loc, baseUrl).toString();
         process.stdout.write(JSON.stringify({ sessionId, url }) + '\n');
         return 0;
     }

package/dist/version.d.ts

@@ -3,5 +3,5 @@
  * `require('./package.json')` because that breaks under bun's
  * single-file binary mode.
  */
-export declare const CLI_VERSION = "0.1.7";
+export declare const CLI_VERSION = "0.1.8";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,4 +3,4 @@
  * `require('./package.json')` because that breaks under bun's
  * single-file binary mode.
  */
-export const CLI_VERSION = '0.1.7';
+export const CLI_VERSION = '0.1.8';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/cli",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Nimbus CLI — `create-nimbus-app` scaffolder + `token mint` + `runtime sync`.",
   "keywords": [
     "cloudflare",
@@ -45,8 +45,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@nimbus-sh/sdk": "^0.1.4",
-    "@nimbus-sh/worker": "^0.1.4"
+    "@nimbus-sh/sdk": "^0.2.0",
+    "@nimbus-sh/worker": "^0.2.0"
   },
   "engines": {
     "node": ">=20"