@nurix/nustack 0.10.0-dev.9 → 0.11.0

package/README.md

@@ -74,4 +74,5 @@ nustack telemetry [status|enable|disable|reinstall]
 
 - **`--json` almost everywhere** — most commands emit the `nustackJsonVersion: 1` machine envelope with `--json`; errors are typed (`{ error: { code, message } }`), never a bare HTTP status. Four surfaces break the pattern by design — `describe`, `search`, `search services`, and the `workspace sync` family emit a bare array/object instead, because the desktop and the agents pin those exact shapes.
 - **Base URL** — `--nustack-url` flag → `NUSTACK_URL` env → the hosted default (`https://apps.nustack.ai`).
+- **Credential** — `NUSTACK_TOKEN` (a personal access token from `nustack token create`, for pipelines and agents; wins over every store, never refreshes, never opens a browser) → the OS store (macOS Keychain, libsecret on Linux) → `~/.nustack/credentials.json` (`0600`) where no OS store exists. `NUSTACK_CREDENTIAL_STORE=auto|keychain|libsecret|file` overrides the probe.
 - **Organization context** — `nustack organization use` persists the selection locally; commands send it as a header the server re-proves against your memberships on every request.

package/dist/commands/bootstrap.js

@@ -22,7 +22,7 @@ export async function runBootstrap(options) {
         return;
     await ensureDeviceTelemetry({ baseUrl, log: (message) => p.log.info(message) });
     const state = classifyFolder(cwd);
-    const bound = state.class === "git_worktree" && state.repository && state.git?.markerWorkspaceId
+    const bound = state.class === "git_worktree" && state.repository && state.git?.markerProjectId
         ? await printBoundStatus(state.repository.repositoryRoot)
         : false;
     if (bound)
@@ -42,10 +42,10 @@ async function printBoundStatus(root) {
             "decision_required",
             "approved",
         ]);
-        p.log.success(`This repository is bound to Workspace ${binding.workspaceId} on branch ${binding.boundBranch}.`);
-        p.log.info(`Binding ${binding.id} · ${binding.status} · applied Workspace sequence ${binding.lastAppliedWorkspaceSequence}` +
+        p.log.success(`This repository is bound to Project ${binding.projectId} on branch ${binding.boundBranch}.`);
+        p.log.info(`Binding ${binding.id} · ${binding.status} · applied Project sequence ${binding.lastAppliedProjectSequence}` +
             (pending.length > 0 ? ` · ${pending.length} pending inbound` : ""));
-        p.outro("Up to date locally — `nustack workspace status` for the cloud view, `nustack workspace sync now` to reconcile.");
+        p.outro("Up to date locally — `nustack project status` for the cloud view, `nustack project sync now` to reconcile.");
         return true;
     }
     finally {

package/dist/commands/docs.js

@@ -1,13 +1,13 @@
 import { getDocument, listDocuments, resolveNuStackUrl, } from "../lib/nustack_client.js";
 import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
-import { resolveWorkspaceId } from "../lib/workspace_context.js";
+import { resolveProjectId } from "../lib/project_context.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
 const INLINE_BODY_LIMIT = 16 * 1024;
 async function resolveContext(command, json, options, globals) {
     const baseUrl = resolveNuStackUrl(globals);
-    const workspace = await resolveWorkspaceId(process.cwd(), options);
-    if (!workspace.ok) {
-        emitFail(command, json, "WORKSPACE_CONTEXT_MISSING", workspace.message);
+    const project = await resolveProjectId(process.cwd(), options);
+    if (!project.ok) {
+        emitFail(command, json, "PROJECT_CONTEXT_MISSING", project.message);
         return null;
     }
     const deviceAuth = await ensureAuthWithRecovery(baseUrl, json);
@@ -16,7 +16,7 @@ async function resolveContext(command, json, options, globals) {
         emitFail(command, json, failure.code, failure.message);
         return null;
     }
-    return { baseUrl, accessToken: deviceAuth.accessToken, workspaceId: workspace.workspaceId };
+    return { baseUrl, accessToken: deviceAuth.accessToken, projectId: project.projectId };
 }
 function emitFail(command, json, code, message) {
     if (json)
@@ -31,13 +31,13 @@ export async function runDocsList(options, globals) {
     const ctx = await resolveContext("docs list", json, options, globals);
     if (!ctx)
         return;
-    const documents = await listDocuments(ctx.baseUrl, ctx.accessToken, ctx.workspaceId);
+    const documents = await listDocuments(ctx.baseUrl, ctx.accessToken, ctx.projectId);
     if (json) {
-        printJsonSuccess("docs list", { workspaceId: ctx.workspaceId, documents });
+        printJsonSuccess("docs list", { projectId: ctx.projectId, documents });
         return;
     }
     if (documents.length === 0) {
-        console.log("This Workspace has no Documents yet.");
+        console.log("This Project has no Documents yet.");
         return;
     }
     for (const doc of documents) {
@@ -50,10 +50,10 @@ export async function runDocsShow(target, options, globals) {
     const ctx = await resolveContext("docs show", json, options, globals);
     if (!ctx)
         return;
-    const documents = await listDocuments(ctx.baseUrl, ctx.accessToken, ctx.workspaceId);
+    const documents = await listDocuments(ctx.baseUrl, ctx.accessToken, ctx.projectId);
     const match = documents.find((d) => d.id === target || d.slug === target);
     if (!match) {
-        emitFail("docs show", json, "DOCUMENT_NOT_FOUND", `No Document "${target}" in this Workspace.`);
+        emitFail("docs show", json, "DOCUMENT_NOT_FOUND", `No Document "${target}" in this Project.`);
         return;
     }
     const payload = await getDocument(ctx.baseUrl, ctx.accessToken, match.id);
@@ -97,7 +97,7 @@ export async function runDocsStatus(options, globals) {
     const ctx = await resolveContext("docs status", json, options, globals);
     if (!ctx)
         return;
-    const documents = await listDocuments(ctx.baseUrl, ctx.accessToken, ctx.workspaceId);
+    const documents = await listDocuments(ctx.baseUrl, ctx.accessToken, ctx.projectId);
     const rows = documents.map((doc) => ({
         slug: doc.slug,
         documentId: doc.id,
@@ -106,11 +106,11 @@ export async function runDocsStatus(options, globals) {
         convergence: "unmapped",
     }));
     if (json) {
-        printJsonSuccess("docs status", { workspaceId: ctx.workspaceId, paths: rows });
+        printJsonSuccess("docs status", { projectId: ctx.projectId, paths: rows });
         return;
     }
     if (rows.length === 0) {
-        console.log("This Workspace has no Documents to converge.");
+        console.log("This Project has no Documents to converge.");
         return;
     }
     for (const row of rows) {

package/dist/commands/doctor.js

@@ -1,10 +1,11 @@
 import path from "node:path";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
-import { ensureAccessToken } from "../lib/auth_grant.js";
-import { isKeychainAvailable } from "../lib/device_keychain.js";
-import { resolveWorkspaceId } from "../lib/workspace_context.js";
+import { stat } from "node:fs/promises";
+import { ensureAccessToken, ENV_TOKEN_VARIABLE, envToken } from "../lib/auth_grant.js";
+import { credentialsFilePath, selectCredentialStore } from "../lib/credential_store.js";
+import { resolveProjectId } from "../lib/project_context.js";
 import { readManagedValues } from "../lib/env_file.js";
-import { readWorkspaceManifests, diagnoseManifests } from "../lib/onboarding/manifest_writer.js";
+import { readProjectManifests, diagnoseManifests } from "../lib/onboarding/manifest_writer.js";
 import { fetchToolkitProfile, ToolkitProfileUnavailableError } from "../lib/etna/profile.js";
 import { toolkitCompatibility } from "../lib/etna/reconcile.js";
 import { openLocalStore } from "../lib/local_store/database.js";
@@ -19,6 +20,33 @@ import { NotARepositoryError } from "../lib/git-sync/core/git_runner.js";
 import { listBundles, sweepExpiredBundles } from "../lib/git-sync/recovery/store.js";
 import { inspectRecoveryKey } from "../lib/git-sync/recovery/crypto.js";
 import { NUSTACK_JSON_VERSION } from "../lib/json_output.js";
+async function credentialStoreRows(environmentInUse) {
+    if (environmentInUse)
+        return [{ check: "Credential source", status: "ok", detail: "environment — no store is read" }];
+    let store;
+    try {
+        store = selectCredentialStore();
+    }
+    catch (error) {
+        return [{ check: "Credential source", status: "error", detail: error instanceof Error ? error.message : String(error) }];
+    }
+    const rows = [
+        { check: "Credential source", status: "ok", detail: store.name === "file" ? "file — no OS keychain on this machine" : store.name },
+    ];
+    if (store.name === "file") {
+        const filePath = credentialsFilePath();
+        try {
+            const mode = (await stat(filePath)).mode & 0o777;
+            rows.push(mode === 0o600
+                ? { check: "Credential file mode", status: "ok", detail: "0600" }
+                : { check: "Credential file mode", status: "warn", detail: `0${mode.toString(8)} — expected 0600; run \`chmod 600 ~/.nustack/credentials.json\`` });
+        }
+        catch {
+            rows.push({ check: "Credential file mode", status: "info", detail: "no credential file yet — sign in to create it" });
+        }
+    }
+    return rows;
+}
 export async function runDoctor(options) {
     const cwd = process.cwd();
     const baseUrl = resolveNuStackUrl(options);
@@ -28,12 +56,18 @@ export async function runDoctor(options) {
     const add = (area, check, status, detail = "") => {
         rows.push({ area, check, status, detail });
     };
+    const fromEnv = envToken();
     const deviceAuth = await ensureAccessToken(baseUrl).catch(() => null);
-    if (deviceAuth)
+    if (fromEnv?.kind === "malformed")
+        add("identity", "Device sign-in", "error", fromEnv.message);
+    else if (fromEnv)
+        add("identity", "Device sign-in", "ok", `${ENV_TOKEN_VARIABLE} is set — the environment's token is used`);
+    else if (deviceAuth)
         add("identity", "Device sign-in", "ok", `signed in as ${deviceAuth.userEmail}`);
     else
         add("identity", "Device sign-in", "error", "signed out — run `nustack login`");
-    add("identity", "OS keychain", isKeychainAvailable() ? "ok" : "warn", isKeychainAvailable() ? "available" : "unavailable — sign-in relies on the 24h approval window");
+    for (const row of await credentialStoreRows(fromEnv !== null))
+        add("identity", row.check, row.status, row.detail);
     add("api", "NuStack reachability", ...(await probeReachability(baseUrl)));
     let store = null;
     try {
@@ -62,9 +96,9 @@ export async function runDoctor(options) {
         addRepositoryRows(add, repository);
     }
     const contextRoot = repository?.repositoryRoot ?? cwd;
-    const workspaceResolution = await resolveWorkspaceId(contextRoot, { workspace: options.workspace });
-    const workspaceId = workspaceResolution.ok ? workspaceResolution.workspaceId : null;
-    const cloudProfile = deviceAuth && workspaceId ? await fetchCloudProfile(baseUrl, deviceAuth.accessToken, workspaceId) : null;
+    const projectResolution = await resolveProjectId(contextRoot, { project: options.project });
+    const projectId = projectResolution.ok ? projectResolution.projectId : null;
+    const cloudProfile = deviceAuth && projectId ? await fetchCloudProfile(baseUrl, deviceAuth.accessToken, projectId) : null;
     const binding = store && repository ? getBindingByRepositoryRoot(store, repository.repositoryRoot) : null;
     await addManifestRows(add, contextRoot, cloudProfile);
     addBindingRows(add, store, binding, cloudProfile);
@@ -127,9 +161,9 @@ function addRepositoryRows(add, repository) {
     else
         add("repository", "HEAD", "info", "unborn branch — no commits yet");
 }
-async function fetchCloudProfile(baseUrl, accessToken, workspaceId) {
+async function fetchCloudProfile(baseUrl, accessToken, projectId) {
     try {
-        return await fetchToolkitProfile(baseUrl, accessToken, workspaceId);
+        return await fetchToolkitProfile(baseUrl, accessToken, projectId);
     }
     catch (error) {
         if (error instanceof ToolkitProfileUnavailableError)
@@ -138,12 +172,12 @@ async function fetchCloudProfile(baseUrl, accessToken, workspaceId) {
     }
 }
 async function addManifestRows(add, root, cloud) {
-    const manifests = await readWorkspaceManifests(root);
-    if (!manifests.workspaceManifest && !manifests.serviceToolkit) {
-        add("manifests", "Workspace binding markers", "info", "no `.nustack/app.json` or Service toolkit block — repository not attached");
+    const manifests = await readProjectManifests(root);
+    if (!manifests.projectManifest && !manifests.serviceToolkit) {
+        add("manifests", "Project binding markers", "info", "no `.nustack/app.json` or Service toolkit block — repository not attached");
         return;
     }
-    const diagnosis = diagnoseManifests(cloud ? { name: cloud.name, version: cloud.version } : null, manifests.workspaceManifest?.toolkit ?? null, manifests.serviceToolkit);
+    const diagnosis = diagnoseManifests(cloud ? { name: cloud.name, version: cloud.version } : null, manifests.projectManifest?.toolkit ?? null, manifests.serviceToolkit);
     const status = diagnosis === "aligned" ? "ok" : diagnosis === "missing" ? "warn" : "warn";
     const suffix = diagnosis === "aligned" || diagnosis === "missing" ? "" : " — run `nustack toolkit reconcile`";
     add("manifests", "Marker / Service agreement", status, `${diagnosis}${cloud ? "" : " (no cloud pin reachable)"}${suffix}`);
@@ -154,7 +188,7 @@ function addBindingRows(add, store, binding, cloud) {
         return;
     }
     add("sync", "Sync Whitelist cache", binding.whitelistManifestSha256 ? "ok" : "info", binding.whitelistManifestSha256 ? "cached" : "not cached yet");
-    add("sync", "Workspace cursor", "ok", `applied Workspace sequence ${binding.lastAppliedWorkspaceSequence}`);
+    add("sync", "Project cursor", "ok", `applied Project sequence ${binding.lastAppliedProjectSequence}`);
     if (store) {
         const pending = listApplicationsForBinding(store, binding.id, [
             "received",
@@ -208,7 +242,7 @@ function addTelemetryRows(add, store) {
 async function addRecoveryRows(add, store) {
     await sweepExpiredBundles(store).catch(() => { });
     const active = listBundles(store).filter((bundle) => bundle.state === "active");
-    add("recovery", "Recovery bundles", active.length > 0 ? "info" : "ok", active.length > 0 ? `${active.length} active — \`nustack workspace sync recovery list\`` : "none");
+    add("recovery", "Recovery bundles", active.length > 0 ? "info" : "ok", active.length > 0 ? `${active.length} active — \`nustack project sync recovery list\`` : "none");
     const deviceRef = readDeviceState(store)?.deviceRef ?? null;
     if (!deviceRef)
         return;

package/dist/commands/handoff.js

@@ -1,15 +1,15 @@
 import { fetchHandoffManifest, getHandoff, listHandoffs, resolveNuStackUrl, } from "../lib/nustack_client.js";
 import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
-import { resolveWorkspaceId } from "../lib/workspace_context.js";
+import { resolveProjectId } from "../lib/project_context.js";
 import { openLocalStore } from "../lib/local_store/database.js";
 import { getBindingByRepositoryRoot } from "../lib/local_store/bindings.js";
 import { resolveRepository } from "../lib/git-sync/core/repository.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
 async function resolveContext(command, json, options, globals) {
     const baseUrl = resolveNuStackUrl(globals);
-    const workspace = await resolveWorkspaceId(process.cwd(), options);
-    if (!workspace.ok) {
-        emitFail(command, json, "WORKSPACE_CONTEXT_MISSING", workspace.message);
+    const project = await resolveProjectId(process.cwd(), options);
+    if (!project.ok) {
+        emitFail(command, json, "PROJECT_CONTEXT_MISSING", project.message);
         return null;
     }
     const deviceAuth = await ensureAuthWithRecovery(baseUrl, json);
@@ -18,7 +18,7 @@ async function resolveContext(command, json, options, globals) {
         emitFail(command, json, failure.code, failure.message);
         return null;
     }
-    return { baseUrl, accessToken: deviceAuth.accessToken, workspaceId: workspace.workspaceId };
+    return { baseUrl, accessToken: deviceAuth.accessToken, projectId: project.projectId };
 }
 function emitFail(command, json, code, message) {
     if (json)
@@ -33,13 +33,13 @@ export async function runHandoffList(options, globals) {
     const ctx = await resolveContext("handoff list", json, options, globals);
     if (!ctx)
         return;
-    const handoffs = await listHandoffs(ctx.baseUrl, ctx.accessToken, ctx.workspaceId);
+    const handoffs = await listHandoffs(ctx.baseUrl, ctx.accessToken, ctx.projectId);
     if (json) {
-        printJsonSuccess("handoff list", { workspaceId: ctx.workspaceId, handoffs });
+        printJsonSuccess("handoff list", { projectId: ctx.projectId, handoffs });
         return;
     }
     if (handoffs.length === 0) {
-        console.log("This Workspace has no Handoffs yet.");
+        console.log("This Project has no Handoffs yet.");
         return;
     }
     for (const h of handoffs) {

package/dist/commands/init.js

@@ -1,15 +1,15 @@
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 import * as p from "@clack/prompts";
-import { createWorkspaceViaAsk, createOrganization, getWorkspace, listWorkspaces, listOrganizations, resolveNuStackUrl, } from "../lib/nustack_client.js";
+import { createProjectViaAsk, createOrganization, getProject, listProjects, listOrganizations, resolveNuStackUrl, } from "../lib/nustack_client.js";
 import { ensureAccessToken } from "../lib/auth_grant.js";
 import { getOrCreateDeviceId } from "../lib/device_identity.js";
 import { isInteractive } from "../lib/interactive.js";
-import { resolveOrganizationId } from "../lib/workspace_context.js";
+import { resolveOrganizationId } from "../lib/project_context.js";
 import { openLocalStore } from "../lib/local_store/database.js";
 import { readDeviceState, upsertDeviceState } from "../lib/local_store/device_state.js";
 import { hasManifest, scaffoldManifest } from "../lib/manifest.js";
-import { readWorkspaceManifests } from "../lib/onboarding/manifest_writer.js";
+import { readProjectManifests } from "../lib/onboarding/manifest_writer.js";
 import { attachRejection, classifyFolder } from "../lib/onboarding/folder_state.js";
 import { attachExistingGit } from "../lib/onboarding/attach_existing_git.js";
 import { initFreshFolder } from "../lib/onboarding/init_fresh_folder.js";
@@ -30,7 +30,7 @@ export async function runInit(options) {
         return;
     await runOnboardingFlow(baseUrl, accessToken, {
         yes: options.yes,
-        workspace: options.workspace,
+        project: options.project,
         organization: options.organization,
     });
 }
@@ -75,18 +75,18 @@ export async function runOnboardingFlow(baseUrl, accessToken, options) {
     }
 }
 async function routeOnboarding(ctx, options) {
-    if (options.workspaceId) {
-        await routeWebFirst(ctx, options, options.workspaceId);
+    if (options.projectId) {
+        await routeWebFirst(ctx, options, options.projectId);
         return;
     }
     const state = classifyFolder(ctx.cwd);
     if (state.class === "git_worktree" && state.repository && state.git) {
-        await routeExistingGit(ctx, options, state.repository.repositoryRoot, state.git.markerWorkspaceId);
+        await routeExistingGit(ctx, options, state.repository.repositoryRoot, state.git.markerProjectId);
         return;
     }
     await routeFreshFolder(ctx, options, state.class === "populated_non_git");
 }
-async function routeExistingGit(ctx, options, root, markerWorkspaceId) {
+async function routeExistingGit(ctx, options, root, markerProjectId) {
     const state = classifyFolder(ctx.cwd);
     const rejection = state.git ? attachRejection(state.git) : null;
     if (rejection) {
@@ -96,12 +96,12 @@ async function routeExistingGit(ctx, options, root, markerWorkspaceId) {
     if (!hasManifest(root)) {
         await scaffoldManifest(root, deriveRepoName(path.basename(root)));
     }
-    let workspaceId;
+    let projectId;
     let organizationId;
-    if (markerWorkspaceId) {
-        workspaceId = markerWorkspaceId;
-        const manifests = await readWorkspaceManifests(root);
-        const recorded = manifests.workspaceManifest?.organizationId ?? manifests.serviceWorkspaceBinding?.organizationId ?? null;
+    if (markerProjectId) {
+        projectId = markerProjectId;
+        const manifests = await readProjectManifests(root);
+        const recorded = manifests.projectManifest?.organizationId ?? manifests.serviceProjectBinding?.organizationId ?? null;
         const resolved = recorded ?? (await resolveOrganizationInteractive(ctx, options));
         if (!resolved)
             return;
@@ -112,14 +112,14 @@ async function routeExistingGit(ctx, options, root, markerWorkspaceId) {
         if (!resolved)
             return;
         organizationId = resolved;
-        const chosen = await chooseOrCreateWorkspace(ctx, organizationId, root, "existing_local");
+        const chosen = await chooseOrCreateProject(ctx, organizationId, root, "existing_local");
         if (!chosen)
             return;
-        workspaceId = chosen;
+        projectId = chosen;
     }
     const spinner = p.spinner();
     spinner.start("Attaching this repository");
-    const outcome = await attachExistingGit(ctx, { workspaceId, organizationId, confirmRebind: true });
+    const outcome = await attachExistingGit(ctx, { projectId, organizationId, confirmRebind: true });
     spinner.stop(outcome.ok ? "Attached" : "Attach failed", outcome.ok ? 0 : 1);
     if (outcome.ok)
         reportSuccess(outcome.result);
@@ -130,7 +130,7 @@ async function routeFreshFolder(ctx, options, populated) {
     const organizationId = await resolveOrganizationInteractive(ctx, options);
     if (!organizationId)
         return;
-    const identity = await promptWorkspaceIdentity(ctx);
+    const identity = await promptProjectIdentity(ctx);
     if (!identity)
         return;
     const input = { organizationId, name: identity.name, slug: identity.slug, hasUi: true };
@@ -148,26 +148,26 @@ async function routeFreshFolder(ctx, options, populated) {
     else
         reportFailure(outcome);
 }
-async function routeWebFirst(ctx, options, workspaceId) {
+async function routeWebFirst(ctx, options, projectId) {
     const organizationId = await resolveOrganizationInteractive(ctx, options);
     if (!organizationId)
         return;
-    let outcome = await webFirstAttach(ctx, { workspaceId, organizationId, confirmPopulated: ctx.yes || undefined });
+    let outcome = await webFirstAttach(ctx, { projectId, organizationId, confirmPopulated: ctx.yes || undefined });
     if (!outcome.ok && outcome.code === "CONFIRMATION_REQUIRED") {
         const confirmed = ctx.yes || (ctx.interactive && (await confirm(outcome.message)));
         if (!confirmed) {
             p.outro("No changes made — the folder was left untouched.");
             return;
         }
-        outcome = await webFirstAttach(ctx, { workspaceId, organizationId, confirmPopulated: true });
+        outcome = await webFirstAttach(ctx, { projectId, organizationId, confirmPopulated: true });
     }
     if (!outcome.ok) {
         reportFailure(outcome);
         return;
     }
     if (outcome.result.overwriteRequired) {
-        p.log.warn(`Local content diverges from the Workspace on ${outcome.result.divergent.map((d) => d.path).join(", ")}. ` +
-            "Nothing was changed — review and approve with `nustack workspace sync approve` (a recovery bundle is kept).");
+        p.log.warn(`Local content diverges from the Project on ${outcome.result.divergent.map((d) => d.path).join(", ")}. ` +
+            "Nothing was changed — review and approve with `nustack project sync approve` (a recovery bundle is kept).");
     }
     reportSuccess(outcome.result);
 }
@@ -192,7 +192,7 @@ async function resolveOrganizationInteractive(ctx, options) {
         return organization.id;
     }
     const pick = await p.select({
-        message: "Which Organization should this Workspace live in?",
+        message: "Which Organization should this Project live in?",
         options: memberships.map((m) => ({ value: m.organization.id, label: `${m.organization.label} (${m.organization.slug})` })),
     });
     if (p.isCancel(pick))
@@ -200,15 +200,15 @@ async function resolveOrganizationInteractive(ctx, options) {
     upsertDeviceState(ctx.store, { activeOrganizationId: String(pick) });
     return String(pick);
 }
-async function chooseOrCreateWorkspace(ctx, organizationId, root, entryMode) {
+async function chooseOrCreateProject(ctx, organizationId, root, entryMode) {
     const CREATE = "__create__";
-    const workspaces = ctx.interactive ? await listWorkspaces(ctx.baseUrl, ctx.accessToken, organizationId) : [];
+    const projects = ctx.interactive ? await listProjects(ctx.baseUrl, ctx.accessToken, organizationId) : [];
     const pick = ctx.interactive
         ? await p.select({
-            message: "Attach this repository to which Workspace?",
+            message: "Attach this repository to which Project?",
             options: [
-                { value: CREATE, label: "Create a new Workspace" },
-                ...workspaces.map((a) => ({ value: a.id, label: `${a.label} (${a.id})` })),
+                { value: CREATE, label: "Create a new Project" },
+                ...projects.map((a) => ({ value: a.id, label: `${a.label} (${a.id})` })),
             ],
         })
         : CREATE;
@@ -216,33 +216,33 @@ async function chooseOrCreateWorkspace(ctx, organizationId, root, entryMode) {
         return null;
     if (pick !== CREATE)
         return String(pick);
-    const identity = await promptWorkspaceIdentity(ctx, deriveRepoName(path.basename(root)));
+    const identity = await promptProjectIdentity(ctx, deriveRepoName(path.basename(root)));
     if (!identity)
         return null;
-    return createAndAwaitWorkspace(ctx, organizationId, identity, entryMode);
+    return createAndAwaitProject(ctx, organizationId, identity, entryMode);
 }
-async function createAndAwaitWorkspace(ctx, organizationId, identity, entryMode) {
+async function createAndAwaitProject(ctx, organizationId, identity, entryMode) {
     void entryMode;
     const spinner = p.spinner();
-    spinner.start(`Creating Workspace "${identity.name}"`);
+    spinner.start(`Creating Project "${identity.name}"`);
     try {
-        const outcome = await createWorkspaceViaAsk(ctx.baseUrl, ctx.accessToken, organizationId, `Create a workspace named "${identity.name}".`);
-        const final = await getWorkspace(ctx.baseUrl, ctx.accessToken, outcome.workspaceId);
+        const outcome = await createProjectViaAsk(ctx.baseUrl, ctx.accessToken, organizationId, `Create a project named "${identity.name}".`);
+        const final = await getProject(ctx.baseUrl, ctx.accessToken, outcome.projectId);
         const failed = final.status === "initialization_failed" || final.initStatus === "failed";
-        spinner.stop(failed ? "Workspace initialization failed" : `Workspace ${outcome.workspaceId} ready`, failed ? 1 : 0);
-        return failed ? null : outcome.workspaceId;
+        spinner.stop(failed ? "Project initialization failed" : `Project ${outcome.projectId} ready`, failed ? 1 : 0);
+        return failed ? null : outcome.projectId;
     }
     catch (error) {
-        spinner.stop("Workspace creation failed", 1);
+        spinner.stop("Project creation failed", 1);
         p.log.error(error instanceof Error ? error.message : String(error));
         return null;
     }
 }
-async function promptWorkspaceIdentity(ctx, fallback) {
+async function promptProjectIdentity(ctx, fallback) {
     const defaultName = fallback ?? deriveRepoName(path.basename(ctx.cwd));
     if (!ctx.interactive)
         return { name: defaultName, slug: deriveRepoName(defaultName) };
-    const name = await p.text({ message: "Name this Workspace:", defaultValue: defaultName, placeholder: defaultName });
+    const name = await p.text({ message: "Name this Project:", defaultValue: defaultName, placeholder: defaultName });
     if (p.isCancel(name))
         return null;
     const resolved = String(name).trim() || defaultName;
@@ -253,9 +253,9 @@ async function confirm(message) {
     return !p.isCancel(answer) && answer === true;
 }
 function reportSuccess(result) {
-    p.log.success(`Bound to Workspace ${result.workspaceId} on branch ${result.boundBranch} (binding ${result.bindingId}).`);
+    p.log.success(`Bound to Project ${result.projectId} on branch ${result.boundBranch} (binding ${result.bindingId}).`);
     p.log.info(`Toolkit ${result.toolkit.name}@${result.toolkit.version}. No Git push, pull, or remote was created.`);
-    p.outro("Ready — `nustack workspace status` · `nustack docs list` · `nustack workspace sync now`.");
+    p.outro("Ready — `nustack project status` · `nustack docs list` · `nustack project sync now`.");
 }
 function reportFailure(failure) {
     p.log.error(failure.message);
@@ -264,8 +264,8 @@ function reportFailure(failure) {
 }
 function rejectionMessage(rejection) {
     switch (rejection) {
-        case "nested_workspace":
-            return "This repository is nested inside another NuStack Workspace — one Workspace has one logical repository root (F-014).";
+        case "nested_project":
+            return "This repository is nested inside another NuStack Project — one Project has one logical repository root (F-014).";
         case "operation_in_progress":
             return "A merge, rebase, cherry-pick, or revert is in progress — finish or abort it, then re-run.";
         case "detached_head":

package/dist/commands/login.js

@@ -1,9 +1,9 @@
 import * as p from "@clack/prompts";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { launchBrowser } from "../lib/browser_opener.js";
-import { isKeychainAvailable } from "../lib/device_keychain.js";
+import { selectCredentialStore } from "../lib/credential_store.js";
 import { isInteractive } from "../lib/interactive.js";
-import { ensureAccessToken, loginWithLoopback, loginWithPastedCode, prepareLogin, } from "../lib/auth_grant.js";
+import { ensureAccessToken, ENV_TOKEN_VARIABLE, envToken, loginWithLoopback, loginWithPastedCode, prepareLogin, } from "../lib/auth_grant.js";
 async function readStdinLine() {
     return new Promise((resolve) => {
         let buffered = "";
@@ -79,8 +79,16 @@ async function loopbackFlow(ctx, flags) {
     }
 }
 export async function performDeviceLogin(baseUrl, _cwd = process.cwd(), flags = {}) {
-    if (!isKeychainAvailable()) {
-        p.log.error("No OS keychain on this platform — NuStack keeps a machine's sign-in only in the keychain.");
+    if (envToken()) {
+        p.log.info(`${ENV_TOKEN_VARIABLE} is set — this process authenticates with it, and no sign-in is stored on this machine. Unset it to sign in as a person.`);
+        return true;
+    }
+    let store;
+    try {
+        store = selectCredentialStore();
+    }
+    catch (error) {
+        p.log.error(error instanceof Error ? error.message : String(error));
         return false;
     }
     if (!flags.force && !flags.reauthorize) {
@@ -118,7 +126,12 @@ export async function performDeviceLogin(baseUrl, _cwd = process.cwd(), flags =
         return false;
     }
     p.log.success(`Signed in as ${result.userEmail || "this account"}`);
-    p.log.info("This machine's grant is saved to your keychain — the desktop shares it. Manage it with `nustack device list`.");
+    if (store.name === "file") {
+        p.log.info(`This machine's grant is saved to ~/.nustack/credentials.json, readable only by you — no OS keychain here. Manage it with \`nustack device list\`.`);
+    }
+    else {
+        p.log.info("This machine's grant is saved to your keychain — the desktop shares it. Manage it with `nustack device list`.");
+    }
     return true;
 }
 export async function runLogin(options, flags = {}) {
@@ -130,5 +143,5 @@ export async function runLogin(options, flags = {}) {
         process.exitCode = 1;
         return;
     }
-    p.outro("Signed in on this device.");
+    p.outro(envToken() ? "Nothing was written." : "Signed in on this device.");
 }

package/dist/commands/logout.js

@@ -1,13 +1,20 @@
 import * as p from "@clack/prompts";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { clearDeviceId } from "../lib/device_identity.js";
-import { deleteDeviceCredential, isKeychainAvailable } from "../lib/device_keychain.js";
-import { fetchAuthConfig, readGrant, revokeGrant } from "../lib/auth_grant.js";
+import { deleteDeviceCredential } from "../lib/device_keychain.js";
+import { selectCredentialStore } from "../lib/credential_store.js";
+import { ENV_TOKEN_VARIABLE, envToken, fetchAuthConfig, readGrant, revokeGrant } from "../lib/auth_grant.js";
 const SHARED_SIGNOUT_NOTE = "This signs out both the CLI and the desktop on this machine.";
 export async function runLogout(options, flags = {}) {
     p.intro("nustack logout");
     const baseUrl = resolveNuStackUrl(options);
-    const grant = isKeychainAvailable() ? await readGrant() : null;
+    if (envToken()) {
+        p.log.info(`${ENV_TOKEN_VARIABLE} is set — the environment holds this process's credential, and there is nothing stored on this machine to end. Unset the variable, or revoke the token with \`nustack token revoke\`.`);
+        p.outro("Nothing was changed.");
+        return;
+    }
+    const store = selectCredentialStore();
+    const grant = await readGrant();
     if (grant) {
         const clientId = grant.clientId ?? (await fetchAuthConfig(baseUrl).then((c) => c.clientId).catch(() => null));
         const outcome = clientId ? await revokeGrant({ authBaseUrl: grant.authBaseUrl, refreshToken: grant.grantToken, clientId }) : "unreachable";
@@ -25,12 +32,13 @@ export async function runLogout(options, flags = {}) {
         }
         const cleared = await deleteDeviceCredential(grant.deviceId);
         if (cleared)
-            p.log.success("Cleared the keychain grant.");
+            p.log.success(store.name === "keychain" ? "Cleared the keychain grant." : `Cleared the stored grant (${store.name}).`);
     }
     else {
-        p.log.info("No keychain credential to clear on this machine.");
+        p.log.info(store.name === "keychain" ? "No keychain credential to clear on this machine." : `No stored credential to clear on this machine (${store.name}).`);
     }
-    p.log.info(SHARED_SIGNOUT_NOTE);
+    if (store.name === "keychain")
+        p.log.info(SHARED_SIGNOUT_NOTE);
     if (flags.forgetDevice) {
         const forgot = await clearDeviceId();
         if (forgot) {