@nurix/nustack 0.10.0-dev.8 → 0.11.0

package/dist/index.js

@@ -9,21 +9,22 @@ import { runSync } from "./commands/sync.js";
 import { runDescribe } from "./commands/describe.js";
 import { runValidate } from "./commands/validate.js";
 import { runGraph } from "./commands/graph.js";
+import { runLogscope } from "./commands/logscope.js";
 import { runDoctor } from "./commands/doctor.js";
+import { runTokenCreate, runTokenList, runTokenRevoke } from "./commands/token.js";
 import { runOpen } from "./commands/open.js";
 import { runBootstrap } from "./commands/bootstrap.js";
 import { runLogout } from "./commands/logout.js";
 import { runTelemetry } from "./commands/telemetry.js";
 import { runSearch, runSearchServices } from "./commands/search.js";
 import { runDeviceList, runDeviceRevoke, runDeviceStatus } from "./commands/device.js";
-import { registerWorkspaceSyncCommands } from "./commands/workspace-sync.js";
-import { registerWorkspaceCommands } from "./commands/workspace.js";
+import { registerProjectSyncCommands } from "./commands/project-sync.js";
+import { registerProjectCommands } from "./commands/project.js";
 import { runOrganizationList, runOrganizationCreate, runOrganizationUse } from "./commands/organization.js";
 import { runDocsList, runDocsShow, runDocsStatus } from "./commands/docs.js";
 import { runHandoffList, runHandoffShow } from "./commands/handoff.js";
 import { runToolkitStatus, runToolkitReconcile } from "./commands/toolkit.js";
-import { runLaneServe } from "./commands/lane.js";
-import { runSessionsRecord } from "./commands/sessions.js";
+import { runSessionsList, runSessionsPrune, runSessionsRecord, runSessionsServe, } from "./commands/sessions.js";
 import { registerReviewCommands } from "./commands/review.js";
 import { runAgentContext, runAgentHookInstall, runAgentHookRemove } from "./commands/agent.js";
 import { printJsonError } from "./lib/json_output.js";
@@ -52,8 +53,8 @@ program
     .action(async (options) => runLogout(program.opts(), { forgetDevice: options.forgetDevice }));
 program
     .command("init")
-    .description("Onboard this folder: sign in, then bind it to a Workspace (the onboarding router)")
-    .option("--organization <id>", "the Organization to create or select the Workspace in")
+    .description("Onboard this folder: sign in, then bind it to a Project (the onboarding router)")
+    .option("--organization <id>", "the Organization to create or select the Project in")
     .option("--yes", "pre-confirm the populated-folder onboarding guard")
     .action(async (options) => runInit({ ...program.opts(), ...options }));
 program
@@ -69,8 +70,8 @@ program
     .action(async (options) => runList(options, program.opts()));
 program
     .command("sync")
-    .description("Project this Workspace's Service credentials into the managed .env block (not Documents or Git)")
-    .option("--workspace <id>", "the Workspace to act as (defaults to nustack.service.json / NUSTACK_WORKSPACE_ID)")
+    .description("Project this Project's Service credentials into the managed .env block (not Documents or Git)")
+    .option("--project <id>", "the Project to act as (defaults to nustack.service.json / NUSTACK_WORKSPACE_ID)")
     .option("--json", "emit the versioned machine envelope instead of interactive output")
     .action(async (options) => runSync({ ...program.opts(), ...options }));
 program
@@ -95,10 +96,29 @@ program
     .allowUnknownOption()
     .allowExcessArguments()
     .action(async (_fn, _args, options) => runGraph(process.argv, options));
+program
+    .command("logscope [fn] [args...]")
+    .description("Log tracking: ask this machine's log corpus a question, or `index` / `corpora` / `allow` / `prune`")
+    .option("--root <dir>", "the project this command is about (default: the working tree's root)")
+    .option("--corpus <ref>", "a corpus id, or a path belonging to one")
+    .option("--budget <n>", "token ceiling for the answer; 0 means unbounded")
+    .option("--limit <n>", "rows requested — beats a default budget, never an explicit one")
+    .option("--retain <days>", "retention for `index`; 0 keeps the corpus until it is forgotten")
+    .option("--examples", "keep up to three exemplar log lines per template (off by default)")
+    .option("--no-redact", "store exemplars unredacted (loud, recorded on the corpus)")
+    .option("--since <ts>", "window start for container sources")
+    .option("--until <ts>", "window end for container sources")
+    .option("--revision <sha>", "the source revision these logs were written by")
+    .option("--note <text>", "a note recorded with an `allow` grant")
+    .option("--dry-run", "for `prune`: report what would be dropped and delete nothing")
+    .option("--json", "emit the versioned machine envelope with the answer as data")
+    .allowUnknownOption()
+    .allowExcessArguments()
+    .action(async (_fn, _args, options) => runLogscope(process.argv, options));
 program
     .command("doctor")
     .description("Run the full local diagnostics matrix (identity, repository, manifests, toolkit, telemetry, credentials)")
-    .option("--workspace <id>", "the Workspace to diagnose (defaults to the bound repository)")
+    .option("--project <id>", "the Project to diagnose (defaults to the bound repository)")
     .option("--json", "emit the versioned machine envelope (secrets and absolute paths redacted)")
     .option("--local-verbose", "include Device-local absolute paths in the output")
     .action(async (options) => runDoctor({ ...program.opts(), ...options }));
@@ -108,6 +128,24 @@ program
     .option("--env <name>", "pick a specific endpoint environment (default: dev)")
     .option("--json", "print the resolved URL as the machine envelope instead of launching")
     .action(async (service, options) => runOpen(service, options, program.opts()));
+const token = program.command("token").description("Mint, list and revoke your personal access tokens (the NUSTACK_TOKEN a pipeline or agent uses)");
+token
+    .command("create")
+    .description("Mint a personal access token; the secret is printed once, on stdout alone")
+    .requiredOption("--label <label>", "a name for the token, unique among your live ones")
+    .option("--expires <days>", "days until the token expires (1–365); no expiry when omitted")
+    .option("--json", "emit the versioned machine envelope")
+    .action(async (options) => runTokenCreate(options, program.opts()));
+token
+    .command("list")
+    .description("List your personal access tokens (never a secret)")
+    .option("--json", "emit the versioned machine envelope")
+    .action(async (options) => runTokenList(options, program.opts()));
+token
+    .command("revoke <token-id>")
+    .description("Revoke a personal access token; it stops working on the next request")
+    .option("--json", "emit the versioned machine envelope")
+    .action(async (tokenId, options) => runTokenRevoke(tokenId, options, program.opts()));
 const device = program.command("device").description("Inspect your signed-in devices and end this machine's access");
 device
     .command("list")
@@ -144,9 +182,9 @@ program
 const toLimit = (value) => Number.parseInt(value, 10);
 const search = program
     .command("search [keywords...]")
-    .description("Search the NuStack Directory for workspaces by keyword")
+    .description("Search the NuStack Directory for projects by keyword")
     .option("--json", "emit the raw results array as JSON")
-    .option("--category <cat>", "filter workspaces by category")
+    .option("--category <cat>", "filter projects by category")
     .option("--limit <n>", "max results (default 20)", toLimit)
     .action(async (keywords, options) => runSearch(keywords, options, program.opts()));
 search
@@ -156,8 +194,8 @@ search
     .option("--type <type>", "filter services by type")
     .option("--limit <n>", "max results (default 20)", toLimit)
     .action(async (keywords, options) => runSearchServices(keywords, { ...search.opts(), ...options }, program.opts()));
-search.addHelpText("after", '\n`services` is a reserved subcommand. To search workspaces for the literal word "services", use the\n' +
-    "explicit separator: `nustack search -- services` (everything after `--` is an workspaces query).");
+search.addHelpText("after", '\n`services` is a reserved subcommand. To search projects for the literal word "services", use the\n' +
+    "explicit separator: `nustack search -- services` (everything after `--` is an projects query).");
 const organization = program.command("organization").description("Work with your NuStack Organizations");
 organization
     .command("list")
@@ -174,66 +212,80 @@ organization
     .description("Set the active Organization context for this device")
     .option("--json", "emit the versioned machine envelope")
     .action(async (target, options) => runOrganizationUse(target, options, program.opts()));
-const workspace = program.command("workspace").description("Work with NuStack Workspaces");
-registerWorkspaceCommands(workspace, () => program.opts());
-registerWorkspaceSyncCommands(workspace, () => program.opts());
+const project = program.command("project").description("Work with NuStack Projects");
+registerProjectCommands(project, () => program.opts());
+registerProjectSyncCommands(project, () => program.opts());
 registerReviewCommands(program.command("review").description("Read and mirror NuStack Review items"), () => program.opts());
-const docs = program.command("docs").description("Work with a Workspace's Documents");
+const docs = program.command("docs").description("Work with a Project's Documents");
 docs
     .command("list")
-    .description("List the Workspace's Documents")
-    .option("--workspace <id>", "the Workspace to act as (defaults to the bound repository)")
+    .description("List the Project's Documents")
+    .option("--project <id>", "the Project to act as (defaults to the bound repository)")
     .option("--json", "emit the versioned machine envelope")
     .action(async (options) => runDocsList(options, program.opts()));
 docs
     .command("show <slug-or-id>")
     .description("Show a Document: a bounded inline body or its content URL")
-    .option("--workspace <id>", "the Workspace to act as (defaults to the bound repository)")
+    .option("--project <id>", "the Project to act as (defaults to the bound repository)")
     .option("--json", "emit the versioned machine envelope")
     .action(async (target, options) => runDocsShow(target, options, program.opts()));
 docs
     .command("status")
     .description("Report per-path local/cloud Document convergence for the bound repository")
-    .option("--workspace <id>", "the Workspace to act as (defaults to the bound repository)")
+    .option("--project <id>", "the Project to act as (defaults to the bound repository)")
     .option("--json", "emit the versioned machine envelope")
     .action(async (options) => runDocsStatus(options, program.opts()));
-const handoff = program.command("handoff").description("Work with a Workspace's Handoffs");
+const handoff = program.command("handoff").description("Work with a Project's Handoffs");
 handoff
     .command("list")
-    .description("List the Workspace's Handoffs")
-    .option("--workspace <id>", "the Workspace to act as (defaults to the bound repository)")
+    .description("List the Project's Handoffs")
+    .option("--project <id>", "the Project to act as (defaults to the bound repository)")
     .option("--json", "emit the versioned machine envelope")
     .action(async (options) => runHandoffList(options, program.opts()));
 handoff
     .command("show <id>")
     .description("Show a Handoff (add --targets for the binding-scoped per-target manifest)")
-    .option("--workspace <id>", "the Workspace to act as (defaults to the bound repository)")
+    .option("--project <id>", "the Project to act as (defaults to the bound repository)")
     .option("--targets", "list each target's path, operation, and base semantics")
     .option("--json", "emit the versioned machine envelope")
     .action(async (id, options) => runHandoffShow(id, options, program.opts()));
-const lane = program.command("lane").description("The desktop build room's lane engine");
-lane
+const sessions = program
+    .command("sessions")
+    .description("Sessions on this machine — the engine the desktop drives, and the record of what ran");
+sessions
     .command("serve")
-    .description("Run the long-lived lane supervisor: JSONL frames on stdin/stdout (used by the NuStack desktop)")
-    .action(async () => runLaneServe(version));
-const sessions = program.command("sessions").description("The session record over this machine's agent work");
+    .description("Run the long-lived session supervisor: JSONL frames on stdin/stdout (used by the NuStack desktop)")
+    .action(async () => runSessionsServe(version));
 sessions
     .command("record")
     .description("Record the sessions one desktop scan found in a bound folder (used by the NuStack desktop)")
     .option("--scan <json>", "the scan payload as JSON, or @<path> to read it from a file")
     .option("--json", "emit the versioned machine envelope")
     .action(async (options) => runSessionsRecord(options, program.opts()));
-const toolkit = program.command("toolkit").description("Inspect and reconcile the Workspace's toolkit pin");
+sessions
+    .command("list")
+    .description("List the sessions this machine's engine opened, and what each one's worktree and branch still hold")
+    .option("--json", "emit the versioned machine envelope")
+    .action(async (options) => runSessionsList(options));
+sessions
+    .command("prune")
+    .description("Reclaim the worktree and branch of a session that has ended (preview unless --yes)")
+    .option("--session <id>", "reclaim one session instead of every reclaimable one")
+    .option("--yes", "apply the preview without prompting")
+    .option("--force", "also reclaim an unmerged or dirty session — never one whose engine is running")
+    .option("--json", "emit the versioned machine envelope")
+    .action(async (options) => runSessionsPrune(options));
+const toolkit = program.command("toolkit").description("Inspect and reconcile the Project's toolkit pin");
 toolkit
     .command("status")
     .description("Compare the cloud pin against .nustack/workspace.json and nustack.service.json (F-026)")
-    .option("--workspace <id>", "the Workspace to act as (defaults to the bound repository)")
+    .option("--project <id>", "the Project to act as (defaults to the bound repository)")
     .option("--json", "emit the versioned machine envelope")
     .action(async (options) => runToolkitStatus(options, program.opts()));
 toolkit
     .command("reconcile")
     .description("Preview and apply the deterministic toolkit repair (no User content is touched)")
-    .option("--workspace <id>", "the Workspace to act as (defaults to the bound repository)")
+    .option("--project <id>", "the Project to act as (defaults to the bound repository)")
     .option("--yes", "apply the deterministic preview without prompting")
     .option("--json", "emit the versioned machine envelope")
     .action(async (options) => runToolkitReconcile(options, program.opts()));
@@ -253,14 +305,14 @@ agentHook
     .action(async () => runAgentHookRemove());
 function describeError(error) {
     const directCode = error?.code;
-    if (directCode === "WORKSPACE_CONTEXT_MISSING") {
-        return "no Workspace in context — run inside a bound repository (`.nustack/workspace.json`) or pass `--workspace <id>`.";
+    if (directCode === "PROJECT_CONTEXT_MISSING") {
+        return "no Project in context — run inside a bound repository (`.nustack/workspace.json`) or pass `--project <id>`.";
     }
     if (directCode === "ORGANIZATION_CONTEXT_MISSING") {
         return "no Organization in context — run `nustack organization use <id>` or pass `--organization <id>`.";
     }
     if (directCode === "TOOLKIT_INCOMPATIBLE") {
-        return "the installed toolkit is incompatible with the Workspace's cloud pin — run `nustack toolkit reconcile`.";
+        return "the installed toolkit is incompatible with the Project's cloud pin — run `nustack toolkit reconcile`.";
     }
     const cause = error?.cause;
     const code = cause?.code;

package/dist/lib/auth_grant.js

@@ -279,6 +279,28 @@ export async function revokeGrant(input) {
         return "unreachable";
     }
 }
+export const ENV_TOKEN_VARIABLE = "NUSTACK_TOKEN";
+export const PERSONAL_TOKEN_PREFIX = "nst_pat_";
+export function envToken() {
+    const raw = process.env[ENV_TOKEN_VARIABLE]?.trim();
+    if (!raw)
+        return null;
+    const halves = raw.startsWith(PERSONAL_TOKEN_PREFIX) ? raw.slice(PERSONAL_TOKEN_PREFIX.length).split("_") : [];
+    if (halves.length !== 2 || !halves[0] || !halves[1]) {
+        return {
+            kind: "malformed",
+            message: `${ENV_TOKEN_VARIABLE} is not a NuStack personal access token — expected \`${PERSONAL_TOKEN_PREFIX}<id>_<secret>\`, as \`nustack token create\` prints it.`,
+        };
+    }
+    return { kind: "ok", token: raw };
+}
+export class TokenRefusedError extends Error {
+    code = "TOKEN_REFUSED";
+    constructor() {
+        super(`${ENV_TOKEN_VARIABLE} was refused by NuStack — it is revoked, expired, or was minted for another NuStack. Mint a new one with \`nustack token create\`.`);
+        this.name = "TokenRefusedError";
+    }
+}
 async function readStoredGrant() {
     const deviceId = await getOrCreateDeviceId();
     resolvedDeviceId = deviceId;
@@ -332,6 +354,14 @@ async function refreshAndPersist(grant, audience, nustackBaseUrl) {
     return refreshed;
 }
 export async function resolveAccessToken(nustackBaseUrl, resource) {
+    const fromEnv = envToken();
+    if (fromEnv) {
+        if (fromEnv.kind === "malformed")
+            return { kind: "malformed_token", message: fromEnv.message };
+        const deviceId = resolvedDeviceId ?? (await getOrCreateDeviceId());
+        resolvedDeviceId = deviceId;
+        return { kind: "ok", session: { accessToken: fromEnv.token, userEmail: "", deviceId, authBaseUrl: "" } };
+    }
     const { deviceId, grant, failure } = await readStoredGrant();
     if (!grant) {
         if (failure)
@@ -363,6 +393,8 @@ export async function ensureAccessToken(nustackBaseUrl, resource) {
     return outcome.kind === "ok" ? { accessToken: outcome.session.accessToken, userEmail: outcome.session.userEmail } : null;
 }
 export async function refreshAccessTokenAfterRefusal(staleToken, nustackBaseUrl, resource) {
+    if (envToken())
+        return null;
     const { deviceId, grant } = await readStoredGrant();
     if (!grant)
         return null;

package/dist/lib/auth_recovery.js

@@ -13,6 +13,8 @@ function describeFailure(outcome) {
     if (outcome.kind === "needs_reauthorization") {
         return { code: "REAUTHORIZATION_REQUIRED", message: `This machine isn't approved for ${outcome.resource} yet — run \`nustack login\` to approve it.`, retryable: false };
     }
+    if (outcome.kind === "malformed_token")
+        return { code: "TOKEN_MALFORMED", message: outcome.message, retryable: false };
     return { code: "SIGNED_OUT", message: deadCredentialCopy(outcome.reason), retryable: false };
 }
 function reconnectingCopy(outcome) {
@@ -36,7 +38,7 @@ export async function ensureAuthWithRecovery(baseUrl, json) {
     if (outcome.kind === "ok")
         return { accessToken: outcome.session.accessToken, userEmail: outcome.session.userEmail };
     lastFailure = describeFailure(outcome);
-    if (json || !isInteractive())
+    if (json || !isInteractive() || outcome.kind === "malformed_token")
         return null;
     p.log.warn(reconnectingCopy(outcome));
     const didLogin = await performDeviceLogin(baseUrl, process.cwd(), { reauthorize: true });

package/dist/lib/credential_store.js

@@ -0,0 +1,106 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { ensureNuStackLayout, nustackHomeDir } from "./local_store/paths.js";
+import { libsecretStore, isLibsecretAvailable } from "./libsecret_store.js";
+const runFile = promisify(execFile);
+const DEFAULT_SECURITY_BIN = "/usr/bin/security";
+const SERVICE = "nustack-device";
+const OWNER_ONLY_FILE = 0o600;
+export class CredentialStoreUnavailableError extends Error {
+    constructor(name) {
+        super(`NUSTACK_CREDENTIAL_STORE=${name} names a store this machine does not have — unset it, or use \`file\`.`);
+        this.name = "CredentialStoreUnavailableError";
+    }
+}
+function securityBin() {
+    return process.env.NUSTACK_KEYCHAIN_BIN?.trim() || DEFAULT_SECURITY_BIN;
+}
+export function isKeychainAvailable() {
+    const override = process.env.NUSTACK_KEYCHAIN_BIN?.trim();
+    if (override)
+        return existsSync(override);
+    return process.platform === "darwin" && existsSync(DEFAULT_SECURITY_BIN);
+}
+export const keychainStore = {
+    name: "keychain",
+    async readRaw(account) {
+        try {
+            const { stdout } = await runFile(securityBin(), ["find-generic-password", "-s", SERVICE, "-a", account, "-w"]);
+            return stdout.trim();
+        }
+        catch {
+            return null;
+        }
+    },
+    async writeRaw(account, payload) {
+        await runFile(securityBin(), ["add-generic-password", "-U", "-s", SERVICE, "-a", account, "-w", payload]);
+    },
+    async deleteRaw(account) {
+        try {
+            await runFile(securityBin(), ["delete-generic-password", "-s", SERVICE, "-a", account]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+};
+export function credentialsFilePath() {
+    return path.join(nustackHomeDir(), "credentials.json");
+}
+async function readCredentialsFile(account) {
+    try {
+        const raw = await readFile(credentialsFilePath(), "utf8");
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        if (parsed.device_id !== account)
+            return null;
+        return raw.trim();
+    }
+    catch {
+        return null;
+    }
+}
+export const fileStore = {
+    name: "file",
+    readRaw: readCredentialsFile,
+    async writeRaw(_account, payload) {
+        await ensureNuStackLayout();
+        const target = credentialsFilePath();
+        const staging = `${target}.${process.pid}.tmp`;
+        await writeFile(staging, `${payload}\n`, { encoding: "utf8", mode: OWNER_ONLY_FILE });
+        await rename(staging, target);
+    },
+    async deleteRaw(account) {
+        if (!(await readCredentialsFile(account)))
+            return false;
+        await rm(credentialsFilePath(), { force: true });
+        return true;
+    },
+};
+export function selectCredentialStore() {
+    const requested = (process.env.NUSTACK_CREDENTIAL_STORE ?? "auto").trim().toLowerCase();
+    if (requested === "keychain") {
+        if (!isKeychainAvailable())
+            throw new CredentialStoreUnavailableError(requested);
+        return keychainStore;
+    }
+    if (requested === "libsecret") {
+        if (!isLibsecretAvailable())
+            throw new CredentialStoreUnavailableError(requested);
+        return libsecretStore;
+    }
+    if (requested === "file")
+        return fileStore;
+    if (requested !== "auto")
+        throw new CredentialStoreUnavailableError(requested);
+    if (isKeychainAvailable())
+        return keychainStore;
+    if (isLibsecretAvailable())
+        return libsecretStore;
+    return fileStore;
+}

package/dist/lib/device_identity.js

@@ -1,22 +1,22 @@
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { readFile, rm } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { randomBytes } from "node:crypto";
-import os from "node:os";
 import path from "node:path";
+import { ensureNuStackLayout, nustackHomeDir } from "./local_store/paths.js";
+import { writeFileSecure } from "./secure_file.js";
 function deviceIdFilePath() {
-    return path.join(os.homedir(), ".nustack", "device_id");
+    return path.join(nustackHomeDir(), "device_id");
 }
 export async function getOrCreateDeviceId() {
     const file = deviceIdFilePath();
-    const dir = path.dirname(file);
     if (existsSync(file)) {
         const existing = (await readFile(file, "utf8")).trim();
         if (existing)
             return existing;
     }
     const deviceId = `dev_${randomBytes(16).toString("hex")}`;
-    await mkdir(dir, { recursive: true });
-    await writeFile(file, `${deviceId}\n`, "utf8");
+    await ensureNuStackLayout();
+    await writeFileSecure(file, `${deviceId}\n`);
     return deviceId;
 }
 export async function clearDeviceId() {

package/dist/lib/device_keychain.js

@@ -1,18 +1,6 @@
-import { execFile } from "node:child_process";
-import { existsSync } from "node:fs";
-import { promisify } from "node:util";
-const runFile = promisify(execFile);
-const DEFAULT_SECURITY_BIN = "/usr/bin/security";
-const SERVICE = "nustack-device";
+import { selectCredentialStore } from "./credential_store.js";
+export { isKeychainAvailable } from "./credential_store.js";
 export const KEYCHAIN_SCHEMA_VERSION = 3;
-function securityBin() {
-    return process.env.NUSTACK_KEYCHAIN_BIN?.trim() || DEFAULT_SECURITY_BIN;
-}
-export function isKeychainAvailable() {
-    if (process.env.NUSTACK_KEYCHAIN_BIN)
-        return true;
-    return process.platform === "darwin" && existsSync(DEFAULT_SECURITY_BIN);
-}
 const REQUIRED_FIELDS = ["refresh_token", "auth_base_url", "issuer", "device_id", "user_email"];
 export function decodeCredential(raw) {
     let parsed;
@@ -51,7 +39,7 @@ export function mergeCredential(existing, update) {
 export async function writeDeviceCredential(input) {
     const stored = await readRawCredential(input.device_id);
     const payload = mergeCredential(stored, input);
-    await runFile(securityBin(), ["add-generic-password", "-U", "-s", SERVICE, "-a", input.device_id, "-w", JSON.stringify(payload)]);
+    await selectCredentialStore().writeRaw(input.device_id, JSON.stringify(payload));
 }
 export async function readDeviceCredential(deviceId) {
     const decoded = await readDecoded(deviceId);
@@ -70,32 +58,23 @@ async function readRawCredential(deviceId) {
     return decoded.reason === "older-schema" || decoded.reason === "future-schema" ? decoded.stored : null;
 }
 async function readDecoded(deviceId) {
+    const raw = await selectCredentialStore().readRaw(deviceId);
+    if (raw === null)
+        return null;
+    const decoded = decodeCredential(raw);
+    if (decoded.ok)
+        return decoded;
+    let stored = null;
     try {
-        const { stdout } = await runFile(securityBin(), ["find-generic-password", "-s", SERVICE, "-a", deviceId, "-w"]);
-        const decoded = decodeCredential(stdout.trim());
-        if (decoded.ok)
-            return decoded;
-        let stored = null;
-        try {
-            const parsed = JSON.parse(stdout.trim());
-            if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
-                stored = parsed;
-        }
-        catch {
-            stored = null;
-        }
-        return { ...decoded, stored };
+        const parsed = JSON.parse(raw.trim());
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+            stored = parsed;
     }
     catch {
-        return null;
+        stored = null;
     }
+    return { ...decoded, stored };
 }
 export async function deleteDeviceCredential(deviceId) {
-    try {
-        await runFile(securityBin(), ["delete-generic-password", "-s", SERVICE, "-a", deviceId]);
-        return true;
-    }
-    catch {
-        return false;
-    }
+    return selectCredentialStore().deleteRaw(deviceId);
 }

package/dist/lib/etna/profile.js

@@ -1,17 +1,17 @@
-import { getWorkspace } from "../nustack_client.js";
+import { getProject } from "../nustack_client.js";
 export class ToolkitProfileUnavailableError extends Error {
-    workspaceId;
-    constructor(workspaceId) {
-        super("The Workspace summary did not project a Toolkit Profile pin — the owning server plan must expose it on GET /api/v2/workspaces/{workspaceId}.");
+    projectId;
+    constructor(projectId) {
+        super("The Project summary did not project a Toolkit Profile pin — the owning server plan must expose it on GET /api/v2/projects/{projectId}.");
         this.name = "ToolkitProfileUnavailableError";
-        this.workspaceId = workspaceId;
+        this.projectId = projectId;
     }
 }
-export async function fetchToolkitProfile(baseUrl, accessToken, workspaceId) {
-    const workspace = await getWorkspace(baseUrl, accessToken, workspaceId);
-    const toolkit = workspace.toolkit;
+export async function fetchToolkitProfile(baseUrl, accessToken, projectId) {
+    const project = await getProject(baseUrl, accessToken, projectId);
+    const toolkit = project.toolkit;
     if (!toolkit || typeof toolkit.name !== "string" || typeof toolkit.version !== "string") {
-        throw new ToolkitProfileUnavailableError(workspaceId);
+        throw new ToolkitProfileUnavailableError(projectId);
     }
     return {
         name: toolkit.name,

package/dist/lib/etna/reconcile.js

@@ -1,4 +1,4 @@
-import { writeWorkspaceManifests, readWorkspaceManifests, diagnoseManifests, } from "../onboarding/manifest_writer.js";
+import { writeProjectManifests, readProjectManifests, diagnoseManifests, } from "../onboarding/manifest_writer.js";
 import { serializeProfileForBinding } from "./profile.js";
 import { updateBindingEtnaProfile } from "../local_store/bindings.js";
 export function parseRecordedToolkit(binding) {
@@ -35,16 +35,16 @@ export function toolkitCompatibility(binding, cloud) {
     return { compatible: true, blocksWrites: false, reason: null };
 }
 export async function buildReconcilePlan(root, binding, cloud) {
-    const manifests = await readWorkspaceManifests(root);
+    const manifests = await readProjectManifests(root);
     const cloudId = { name: cloud.name, version: cloud.version };
-    const diagnosis = diagnoseManifests(cloudId, manifests.workspaceManifest?.toolkit ?? null, manifests.serviceToolkit);
+    const diagnosis = diagnoseManifests(cloudId, manifests.projectManifest?.toolkit ?? null, manifests.serviceToolkit);
     const changes = [];
-    const workspace = manifests.workspaceManifest?.toolkit;
-    if (workspace) {
-        pushIf(changes, ".nustack/workspace.json", "toolkit.name", workspace.name, cloud.name);
-        pushIf(changes, ".nustack/workspace.json", "toolkit.version", workspace.version, cloud.version);
-        pushIf(changes, ".nustack/workspace.json", "toolkit.rendererVersion", workspace.rendererVersion, cloud.rendererVersion);
-        pushIf(changes, ".nustack/workspace.json", "toolkit.placementMapVersion", workspace.placementMapVersion, cloud.placementMapVersion);
+    const project = manifests.projectManifest?.toolkit;
+    if (project) {
+        pushIf(changes, ".nustack/workspace.json", "toolkit.name", project.name, cloud.name);
+        pushIf(changes, ".nustack/workspace.json", "toolkit.version", project.version, cloud.version);
+        pushIf(changes, ".nustack/workspace.json", "toolkit.rendererVersion", project.rendererVersion, cloud.rendererVersion);
+        pushIf(changes, ".nustack/workspace.json", "toolkit.placementMapVersion", project.placementMapVersion, cloud.placementMapVersion);
     }
     const svc = manifests.serviceToolkit;
     if (svc) {
@@ -63,8 +63,8 @@ function pushIf(changes, file, field, from, to) {
         changes.push({ file, field, from, to });
 }
 export async function applyReconcile(store, bindingId, root, identity, cloud) {
-    await writeWorkspaceManifests(root, {
-        workspaceId: identity.workspaceId,
+    await writeProjectManifests(root, {
+        projectId: identity.projectId,
         organizationId: identity.organizationId,
         toolkit: {
             name: cloud.name,

package/dist/lib/git-sync/core/engine.js

@@ -10,7 +10,7 @@ const DEFAULT_HEARTBEAT_MS = 30_000;
 export function observeBinding(binding) {
     const base = {
         bindingId: binding.id,
-        workspaceId: binding.workspaceId,
+        projectId: binding.projectId,
         boundBranch: binding.boundBranch,
         status: binding.status,
         resolved: false,
@@ -18,7 +18,7 @@ export function observeBinding(binding) {
         operationState: "unknown",
         headCommitId: null,
         lastProcessedCommitId: binding.lastProcessedCommitId,
-        lastAppliedWorkspaceSequence: binding.lastAppliedWorkspaceSequence,
+        lastAppliedProjectSequence: binding.lastAppliedProjectSequence,
         pendingCommitCount: 0,
     };
     let repo;
@@ -209,12 +209,12 @@ export function createSyncEngine(options) {
             safeEmit({
                 event: "binding_status",
                 bindingId: observation.bindingId,
-                workspaceId: observation.workspaceId,
+                projectId: observation.projectId,
                 boundBranch: observation.boundBranch,
                 status: observation.status,
                 headCommitId: observation.headCommitId,
                 lastProcessedCommitId: observation.lastProcessedCommitId,
-                lastAppliedWorkspaceSequence: observation.lastAppliedWorkspaceSequence,
+                lastAppliedProjectSequence: observation.lastAppliedProjectSequence,
                 pendingCommitCount: observation.pendingCommitCount,
             });
         }