busa-cli 0.97.0 → 0.98.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as checkForUpdate, n as pkgVersion, r as runCli } from "./run-C7tO-SDN.js";
+import { i as checkForUpdate, n as pkgVersion, r as runCli } from "./run-BVOkW2wU.js";
 //#region src/flush-stdio.ts
 /**
 * Wait for stdout/stderr to reach the other side before the process is torn down.

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as render, i as checkForUpdate, n as pkgVersion, r as runCli, t as HELP } from "./run-C7tO-SDN.js";
+import { a as render, i as checkForUpdate, n as pkgVersion, r as runCli, t as HELP } from "./run-BVOkW2wU.js";
 import { DEFAULT_BASE_URL, createBusabaseClient, normalizeBaseUrl } from "busabase-sdk";
 export { DEFAULT_BASE_URL, HELP, checkForUpdate, createBusabaseClient, normalizeBaseUrl, pkgVersion, render, runCli };

package/dist/{run-C7tO-SDN.js → run-BVOkW2wU.js}

@@ -18,7 +18,8 @@ import { checkAirApp } from "busabase-sdk/airapp-check";
 import { fileURLToPath } from "node:url";
 import { Uint8ArrayReader, ZipReader } from "@zip.js/zip.js";
 import QRCode from "qrcode";
-const LocaleSchema = z.enum({
+//#region ../../packages/openlib/i18n/i18n.ts
+const i18n = {
 	defaultLocale: "en",
 	locales: [
 		"en",
@@ -46,7 +47,8 @@ const LocaleSchema = z.enum({
 		"vi",
 		"pt"
 	]
-}.locales);
+};
+const LocaleSchema = z.enum(i18n.locales);
 //#endregion
 //#region ../../packages/openlib/i18n/i-string.ts
 /**
@@ -1598,7 +1600,7 @@ const driveNodeType = makeFileTreeNodeType({
 	routeBase: "drives",
 	tag: "Drives",
 	entryFile: "README.md",
-	publicAccess: "no"
+	publicAccess: "detail"
 });
 //#endregion
 //#region ../../packages/busabase-contract/src/domains/file-node/definition.ts
@@ -1697,7 +1699,7 @@ const htmlNodeType = {
 	capabilities: {
 		hasDetail: true,
 		creatable: true,
-		publicAccess: "no"
+		publicAccess: "detail"
 	},
 	operations: [{
 		kind: "html_document_update",
@@ -1715,7 +1717,7 @@ const skillNodeType = makeFileTreeNodeType({
 	routeBase: "skills",
 	tag: "Skills",
 	entryFile: "SKILL.md",
-	publicAccess: "no"
+	publicAccess: "detail"
 });
 //#endregion
 //#region ../../packages/busabase-contract/src/domains/whiteboard/definition.ts
@@ -2817,6 +2819,162 @@ const TASK_SUPERSEDED_MCP_TOOLS = [
 	"bases_list_deleted_fields"
 ];
 //#endregion
+//#region ../../packages/busabase-contract/src/contract/agent-client.ts
+/**
+* Agent client attribution — "which agent program made this change".
+*
+* The API key says WHO is accountable (its name, its owner). On one machine,
+* several agents often share one key (`~/.busabase/.env`), so the key alone
+* cannot tell "Claude Code added this" from "Codex added this". A caller names
+* its agent client with ONE request header; busabase-cli detects it from the
+* environment and sends it on every request.
+*
+* It is SELF-REPORTED: a label for people reading the history, never identity,
+* authorization or anything security relevant. The server normalizes it with
+* `normalizeAgentClient` and stores only the normalized `{ id, name }`.
+*/
+const BUSABASE_AGENT_HEADER = "x-busabase-agent";
+const AgentClientVOSchema = z.object({
+	/** Normalized, lowercase `[a-z0-9-]`, at most 40 characters (e.g. `codex`). */
+	id: z.string(),
+	/** Display name: a known agent's product name, otherwise derived from the id. */
+	name: z.string()
+});
+const MAX_AGENT_ID_CHARS = 40;
+/** Longer raw values are not an agent name; don't spend work on them. */
+const MAX_RAW_CHARS = 256;
+/**
+* Agents whose names we know, keyed by every id they are commonly reported
+* as. Only agents whose environment markers were verified (see busabase-cli
+* `agent-client.ts`) get a canonical entry; anything else still works through
+* the generic path below.
+*/
+const KNOWN_AGENTS = {
+	"claude-code": {
+		id: "claude-code",
+		name: "Claude Code"
+	},
+	claudecode: {
+		id: "claude-code",
+		name: "Claude Code"
+	},
+	codex: {
+		id: "codex",
+		name: "Codex"
+	},
+	"codex-cli": {
+		id: "codex",
+		name: "Codex"
+	},
+	"openai-codex": {
+		id: "codex",
+		name: "Codex"
+	},
+	opencode: {
+		id: "opencode",
+		name: "OpenCode"
+	},
+	"gemini-cli": {
+		id: "gemini-cli",
+		name: "Gemini CLI"
+	},
+	gemini: {
+		id: "gemini-cli",
+		name: "Gemini CLI"
+	},
+	pi: {
+		id: "pi",
+		name: "Pi"
+	},
+	"pi-coding-agent": {
+		id: "pi",
+		name: "Pi"
+	}
+};
+/**
+* `AI_AGENT` is a cross-tool convention shaped `<tool>_<version>_agent`
+* (Claude Code: `claude-code_2-1-304_agent`); some tools set just `<tool>`
+* (OpenCode: `opencode`). Keep the tool part.
+*/
+const stripAiAgentConvention = (value) => {
+	return /^([^_]+)_[^_]*_agent$/.exec(value)?.[1] ?? value;
+};
+const toDisplayName = (id) => id.split("-").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+/**
+* Normalize a self-reported agent client (the `x-busabase-agent` header, or a
+* raw `AI_AGENT` value) to `{ id, name }`, or null when there is nothing
+* usable. Known agents map to their product name; anything else is reduced to
+* a lowercase `[a-z0-9-]` id of at most 40 characters with a name derived from
+* it — so the output never carries markup, whitespace or control characters.
+*/
+const normalizeAgentClient = (raw) => {
+	const trimmed = raw?.trim();
+	if (!trimmed || trimmed.length > MAX_RAW_CHARS) return null;
+	const id = stripAiAgentConvention(trimmed.toLowerCase()).replace(/[^a-z0-9]+/g, "-").slice(0, MAX_AGENT_ID_CHARS).replace(/^-+|-+$/g, "");
+	if (!id) return null;
+	return KNOWN_AGENTS[id] ?? {
+		id,
+		name: toDisplayName(id)
+	};
+};
+//#endregion
+//#region src/agent-client.ts
+const isSet = (value) => {
+	const trimmed = value?.trim().toLowerCase();
+	return Boolean(trimmed) && trimmed !== "0" && trimmed !== "false";
+};
+/**
+* Environment markers each agent puts on the commands it runs. Checked in
+* order; only markers backed by evidence are listed:
+* - Claude Code: `CLAUDECODE=1` (measured in a command Claude Code ran).
+* - Codex CLI: `CODEX_SESSION_ID` / `CODEX_THREAD_ID` (measured, Codex 0.163).
+* - OpenCode: `OPENCODE=1` (its shell tool sets it — packages/core/src/tool/plugin/shell.ts).
+* - Gemini CLI: `GEMINI_CLI=1` (ShellExecutionService, @google/gemini-cli-core 0.65).
+* - Pi: `PI_CODING_AGENT=true` (set in its own process, inherited by its bash
+*   tool; @mariozechner/pi-coding-agent 0.73).
+* Anything else is left to the generic `AI_AGENT` or the `BUSABASE_AGENT` override.
+*/
+const AGENT_MARKERS = [
+	{
+		id: "claude-code",
+		vars: ["CLAUDECODE"]
+	},
+	{
+		id: "codex",
+		vars: ["CODEX_SESSION_ID", "CODEX_THREAD_ID"]
+	},
+	{
+		id: "opencode",
+		vars: ["OPENCODE"]
+	},
+	{
+		id: "gemini-cli",
+		vars: ["GEMINI_CLI"]
+	},
+	{
+		id: "pi",
+		vars: ["PI_CODING_AGENT"]
+	}
+];
+const normalizedId = (value) => normalizeAgentClient(value)?.id;
+/**
+* Which agent client is running this CLI, as the id sent in `x-busabase-agent`.
+* Precedence: an explicit `BUSABASE_AGENT` → a specific agent's marker → the
+* cross-tool `AI_AGENT` convention (`<tool>_<version>_agent`) → none.
+* Self-reported attribution only — it labels the change, it grants nothing.
+*/
+const detectAgentClient = (env) => {
+	const explicit = normalizedId(env.BUSABASE_AGENT);
+	if (explicit) return explicit;
+	for (const marker of AGENT_MARKERS) if (marker.vars.some((name) => isSet(env[name]))) return marker.id;
+	return normalizedId(env.AI_AGENT);
+};
+/** The request header for the detected agent client, or undefined when there is none. */
+const agentClientHeaders = (env) => {
+	const agent = detectAgentClient(env);
+	return agent ? { [BUSABASE_AGENT_HEADER]: agent } : void 0;
+};
+//#endregion
 //#region src/config-file.ts
 /**
 * Credential + settings storage for every Busabase client.
@@ -6223,6 +6381,27 @@ const TemplateSecretSchema = z.object({
 	description: z.string().default(""),
 	required: z.boolean().default(true)
 });
+/**
+* One locale's own gallery media — the value side of `template.locales`.
+*
+* Both fields optional and independent: a locale that only re-recorded the clip
+* declares just `video` and keeps the default screenshots. Paths are
+* package-relative in `busabase.json` and absolute URLs on the catalog card;
+* the shape is the same, which is why the card VO reuses this schema.
+*/
+const TemplateLocaleMediaSchema = z.object({
+	/** Replaces the default list WHOLE for this locale — never merged per index. */
+	screenshots: z.array(z.string()).optional(),
+	video: z.string().optional()
+});
+/**
+* Per-locale media keyed by locale (`"zh-CN"`, `"ja"`).
+*
+* Keys are plain strings on purpose, not the supported-locale enum: a template
+* written for a locale this server does not know yet must still install. The
+* audit warns about such keys; the schema never rejects them.
+*/
+const TemplateLocalesSchema = z.record(z.string(), TemplateLocaleMediaSchema);
 const TemplateManifestSchema = z.object({
 	/** Template Center category, e.g. `"crm"`, `"email"`, `"content"`. */
 	category: z.string().min(1),
@@ -6243,6 +6422,21 @@ const TemplateManifestSchema = z.object({
 	*/
 	video: z.string().optional(),
 	/**
+	* Localized gallery media, the App Store / Google Play rule: a viewer whose
+	* locale has an entry sees that entry's `screenshots` / `video`; anything the
+	* entry leaves out, and every locale without an entry, falls back to the two
+	* fields above. Those stay the English/default set — they are what every
+	* deployed server and CLI already reads, so their meaning cannot change.
+	*
+	* `{ "zh-CN": { "screenshots": ["assets/screenshots/cover-zh-CN.webp"],
+	*               "video": "assets/recordings/busa-rnd-zh-CN.mp4" } }`
+	*
+	* Additive by construction: an older parser strips the key (see the note on
+	* `video`), so an older server simply shows the defaults. Selection lives in
+	* one place — `pickTemplateMedia` in `domains/templates/media`.
+	*/
+	locales: TemplateLocalesSchema.optional(),
+	/**
 	* Ready-made prompts shown after install ("Ask agent" prefills the first).
 	*
 	* They are the difference between a folder of tables and something a user can
@@ -6957,7 +7151,12 @@ const sourceAttributionSchema = z.object({
 	ownerName: z.string().nullable(),
 	channel: sourceChannelSchema.nullable(),
 	/** Present only when the write declared a playbook the server could validate. */
-	playbook: PlaybookAttributionVOSchema.nullable().optional()
+	playbook: PlaybookAttributionVOSchema.nullable().optional(),
+	/**
+	* Present only when the write named its agent client (`x-busabase-agent`;
+	* busabase-cli sends it automatically). Self-reported — a label, not identity.
+	*/
+	agent: AgentClientVOSchema.nullable().optional()
 });
 const commitSchema = z.object({
 	id: z.string(),
@@ -8274,6 +8473,25 @@ const TEXT_EXTENSIONS = /\.(?:js|mjs|cjs|ts|mts|cts|json|ndjson|md|html|css|ya?m
 const IS_ASSERTION_CODE = /(?:^|\/)(?:scripts\/check\.mjs|tests?\/|[^/]*\.test\.[cm]?[jt]s)$/;
 /** Lockfiles carry integrity hashes that are not ours to interpret. */
 const NOT_SOURCE = /(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb)$/;
+/**
+* The locales Busabase renders its interface in — the same list `iStringParse`'s
+* `LocaleSchema` is built from, never a second copy. A `template.locales` key
+* outside it is legal (the schema accepts any string so an install never fails
+* over one) but no viewer is ever served it.
+*/
+const SUPPORTED_LOCALES = i18n.locales;
+/**
+* A file name that marks itself as one non-English locale's media —
+* `cover-zh-CN.webp`, `busa-rnd-ja.mp4` — following the `<name>-<locale>.<ext>`
+* convention. Case-insensitive because file systems and authors disagree on
+* `zh-cn` versus `zh-CN`; the separator may be `-`, `_` or `.`.
+*/
+const LOCALIZED_FILE = new RegExp(`[-_.](${SUPPORTED_LOCALES.filter((locale) => locale !== i18n.defaultLocale).join("|")})\\.[a-z0-9]+$`, "i");
+const localeMarkedIn = (path) => {
+	const match = LOCALIZED_FILE.exec(path);
+	if (!match) return void 0;
+	return SUPPORTED_LOCALES.find((locale) => locale.toLowerCase() === match[1].toLowerCase());
+};
 const relativePaths = (files, root = "") => {
 	const prefix = root ? `${root.replace(/\/+$/, "")}/` : "";
 	const out = [];
@@ -8311,6 +8529,24 @@ const auditPackage = (tree, files, options = {}) => {
 	for (const screenshot of tree.manifest.template?.screenshots ?? []) if (!present.has(screenshot)) error("package/screenshot-missing", `busabase.json declares screenshot "${screenshot}", which is not in the package. The Template Center card would render a broken image.`);
 	const video = tree.manifest.template?.video;
 	if (video && !present.has(video)) error("package/video-missing", `busabase.json declares video "${video}", which is not in the package. The Template Center detail page would show a play button that leads nowhere.`);
+	for (const [locale, media] of Object.entries(tree.manifest.template?.locales ?? {})) {
+		if (!SUPPORTED_LOCALES.includes(locale)) warn("package/locale-unknown", `busabase.json declares media for locale "${locale}", which is not one Busabase shows its interface in (${SUPPORTED_LOCALES.join(", ")}). It still installs, but no viewer is ever served it — check the spelling (keys are exact, e.g. "zh-CN", not "zh").`);
+		else if (locale === i18n.defaultLocale) warn("package/locale-default-language", `busabase.json declares \`template.locales.${locale}\`, but the default \`screenshots\` / \`video\` already are the English set — and they, not \`locales.${locale}\`, are what every language without its own entry falls back to. Put English media in the defaults and drop \`locales.${locale}\`, or the two drift apart.`);
+		for (const screenshot of media.screenshots ?? []) if (!present.has(screenshot)) error("package/screenshot-missing", `busabase.json declares ${locale} screenshot "${screenshot}" (template.locales.${locale}.screenshots), which is not in the package. A ${locale} viewer's Template Center card would render a broken image.`);
+		if (media.video && !present.has(media.video)) error("package/video-missing", `busabase.json declares ${locale} video "${media.video}" (template.locales.${locale}.video), which is not in the package. A ${locale} viewer's detail page would show a play button that leads nowhere.`);
+	}
+	const defaults = [...(tree.manifest.template?.screenshots ?? []).map((path) => ({
+		path,
+		field: "screenshots"
+	})), ...video ? [{
+		path: video,
+		field: "video"
+	}] : []];
+	for (const { path, field } of defaults) {
+		const locale = localeMarkedIn(path);
+		if (!locale) continue;
+		warn("package/localized-default-media", `"${path}" is in the default \`template.${field}\`, but its name marks it ${locale}. The defaults are the English set every language without its own entry falls back to; move it to \`template.locales.${locale}.${field}\`.`);
+	}
 	for (const relative of paths) {
 		const base = relative.slice(relative.lastIndexOf("/") + 1);
 		if (/^\.env(?!\.example$)(?:\.|$)/.test(base)) error("package/dotenv", `${relative} is part of the package. Credentials belong in Vault, never in something people install.`);
@@ -10623,6 +10859,41 @@ const assertSelfContained = (tree, options) => {
 	}
 };
 //#endregion
+//#region ../../packages/busabase-contract/src/domains/templates/media.ts
+const nonEmptyStrings = (value) => {
+	if (!Array.isArray(value)) return void 0;
+	const list = value.filter((item) => typeof item === "string" && item !== "");
+	return list.length > 0 ? list : void 0;
+};
+const nonEmptyString = (value) => typeof value === "string" && value !== "" ? value : void 0;
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* Normalize an untrusted `locales` value, or `undefined` when nothing usable is
+* left.
+*
+* Never throws — the catalog is fetched JSON from a repository the server does
+* not control, and one malformed entry must not blank the gallery for every
+* other card. A non-object `locales`, a non-object entry, a non-array
+* `screenshots` or a non-string `video` is ignored, and the viewer gets the
+* defaults. An empty `screenshots: []` or `video: ""` counts as "not declared":
+* a locale that ships no gallery should see the default one, not a placeholder.
+*/
+const parseTemplateLocales = (raw) => {
+	if (!isPlainObject(raw)) return void 0;
+	const locales = {};
+	for (const [locale, entry] of Object.entries(raw)) {
+		if (!locale || !isPlainObject(entry)) continue;
+		const screenshots = nonEmptyStrings(entry.screenshots);
+		const video = nonEmptyString(entry.video);
+		if (!screenshots && !video) continue;
+		locales[locale] = {
+			...screenshots ? { screenshots } : {},
+			...video ? { video } : {}
+		};
+	}
+	return Object.keys(locales).length > 0 ? locales : void 0;
+};
+//#endregion
 //#region ../../packages/busabase-package/src/plan.ts
 /**
 * Install planning: package tree + the target space's current state → a plan, a
@@ -11080,6 +11351,7 @@ const discoverPackages = (files) => {
 		}
 		const validation = validateTemplate(tree);
 		const claimsTemplate = Boolean(tree.rootSkill) || Boolean(tree.manifest.template);
+		const locales = parseTemplateLocales(tree.manifest.template?.locales);
 		found.push({
 			subdir,
 			name: tree.manifest.name,
@@ -11093,6 +11365,7 @@ const discoverPackages = (files) => {
 			...validation.risk ? { risk: validation.risk } : {},
 			screenshots: tree.manifest.template?.screenshots ?? [],
 			...tree.manifest.template?.video ? { video: tree.manifest.template.video } : {},
+			...locales ? { locales } : {},
 			tags: [.../* @__PURE__ */ new Set([...tree.manifest.tags, ...tree.manifest.template?.tags ?? []])],
 			agentPrompts: tree.manifest.template?.agentPrompts ?? [],
 			...tree.manifest.version ? { version: tree.manifest.version } : {},
@@ -11320,6 +11593,7 @@ const toEntry = (found, airapps) => ({
 	tags: found.tags ?? [],
 	screenshots: found.screenshots,
 	...found.video ? { video: found.video } : {},
+	...found.locales ? { locales: found.locales } : {},
 	agentPrompts: found.agentPrompts ?? [],
 	...found.version ? { version: found.version } : {},
 	...found.author ? { author: found.author } : {},
@@ -14364,6 +14638,7 @@ function resolveConfig(opts, { strict = true } = {}) {
 		spaceId: opts.spaceId ?? process.env.BUSABASE_SPACE_ID ?? file.BUSABASE_SPACE_ID,
 		sourceChannel: "cli",
 		playbook: resolvePlaybook(opts.playbook, strict),
+		headers: agentClientHeaders(process.env),
 		output: opts.output ?? configuredOutput() ?? "text",
 		fetch: withRetry(fetch, { retries })
 	};
@@ -14536,7 +14811,8 @@ async function rawFetch(config, method, path, body) {
 			...config.apiKey ? { authorization: `Bearer ${config.apiKey}` } : {},
 			...config.spaceId ? { "x-busabase-space": config.spaceId } : {},
 			"x-busabase-channel": "cli",
-			...config.playbook ? { [BUSABASE_PLAYBOOK_HEADER]: config.playbook } : {}
+			...config.playbook ? { [BUSABASE_PLAYBOOK_HEADER]: config.playbook } : {},
+			...typeof config.headers === "object" ? config.headers : {}
 		},
 		body: body !== void 0 ? JSON.stringify(body) : void 0
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busa-cli",
-  "version": "0.97.0",
+  "version": "0.98.0",
   "description": "Command-line client for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server`. Short-name alias for busabase-cli.",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-cli",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@zip.js/zip.js": "^2.8.20",
     "busabase-package": "workspace:*",
-    "busabase-sdk": "0.97.0",
+    "busabase-sdk": "0.98.0",
     "commander": "^14.0.0",
     "qrcode": "^1.5.4",
     "tar-stream": "^3.1.7",