kasy-cli 1.20.0 → 1.21.0-beta.0

package/lib/scaffold/shared/post-build.js

@@ -13,13 +13,17 @@ const { exec } = require('node:child_process');
 const { promisify } = require('node:util');
 const path = require('node:path');
 const fs = require('fs-extra');
+const { augmentedEnv, pubCacheBin } = require('../../utils/env-tools');
 
 const execAsync = promisify(exec);
 const MAX_BUFFER = 100 * 1024 * 1024; // 100 MB — build_runner can be verbose
 
 async function run(cmd, cwd, timeout) {
   try {
-    const opts = { cwd, maxBuffer: MAX_BUFFER };
+    // Run with the augmented PATH so tools installed earlier in this same
+    // session (flutterfire via pub global, etc.) are found without the user
+    // having to reopen the terminal — see utils/env-tools.
+    const opts = { cwd, maxBuffer: MAX_BUFFER, env: augmentedEnv() };
     if (timeout) opts.timeout = timeout;
     const { stdout, stderr } = await execAsync(cmd, opts);
     return { ok: true, stdout, stderr };
@@ -62,12 +66,13 @@ async function flutterfireConfigure(projectDir, firebaseProjectId, options = {})
     '--yes',
   ].join(' ');
 
-  // Prefer the binary on PATH; fall back to the pub-cache absolute path for
-  // environments where ~/.pub-cache/bin isn't exported to child processes.
+  // Prefer the binary on PATH (the augmented PATH in run() already exposes the
+  // pub-cache bin dir); fall back to the absolute pub-cache path for shells
+  // that still don't see it. pubCacheBin() is cross-platform — it resolves the
+  // right place on Windows (%LOCALAPPDATA%\Pub\Cache\bin) vs ~/.pub-cache/bin.
   const result = await run(`flutterfire configure ${args}`, projectDir, 300_000);
-  if (!result.ok && (result.error?.includes('ENOENT') || result.error?.includes('not found'))) {
-    const pubCacheBin = `${process.env.HOME}/.pub-cache/bin/flutterfire`;
-    return run(`${pubCacheBin} configure ${args}`, projectDir, 300_000);
+  if (!result.ok && (result.error?.includes('ENOENT') || result.error?.includes('not found') || result.error?.includes('not recognized'))) {
+    return run(`${pubCacheBin('flutterfire')} configure ${args}`, projectDir, 300_000);
   }
   return result;
 }
@@ -864,6 +869,16 @@ async function getGoogleClientSecretViaGcloud(firebaseProjectId) {
   }
 }
 
+// Deploys only Firestore security rules so the generated app works immediately
+// without needing `kasy deploy`. Fast (<30s) and billing-free.
+async function deployFirestoreRules(projectDir, firebaseProjectId) {
+  return run(
+    `firebase deploy --only firestore:rules --project ${firebaseProjectId}`,
+    projectDir,
+    120_000, // 2 min
+  );
+}
+
 module.exports = {
   pubGet,
   slangGenerate,
@@ -880,6 +895,7 @@ module.exports = {
   validateFacebookAndroidStrings,
   validateRevenueCat,
   patchFirebaseServiceWorker,
+  deployFirestoreRules,
   readSupabaseGoogleCredentials,
   getGoogleClientSecretViaGcloud,
   // Exported for focused unit tests; not part of the public CLI surface.

package/lib/utils/apple-release.js

@@ -5,6 +5,7 @@ const fs = require('fs-extra');
 const os = require('node:os');
 const kleur = require('kleur');
 const ui = require('./ui');
+const { openUrl } = require('./browser');
 const { exec, spawn } = require('node:child_process');
 const { promisify } = require('node:util');
 
@@ -144,16 +145,6 @@ async function installPrivateKey(sourcePath, keyId) {
   return destPath;
 }
 
-function openUrl(url) {
-  const platform = process.platform;
-  const cmd =
-    platform === 'darwin'
-      ? `open "${url}"`
-      : platform === 'win32'
-        ? `start "" "${url}"`
-        : `xdg-open "${url}"`;
-  exec(cmd, () => {});
-}
 
 function iosReleaseDocPath() {
   return 'docs/ios-release.md';

package/lib/utils/browser.js

@@ -0,0 +1,61 @@
+/**
+ * Browser helpers. Centralizes the platform-specific "open a URL" command that
+ * was duplicated across new.js / docs.js / apple-release.js, and adds the
+ * standard interaction the CLI uses for any external link:
+ *
+ *   1. always PRINT the URL (so it works over SSH / headless / no GUI), then
+ *   2. let the user press Enter to OPEN it in the default browser.
+ *
+ * This beats auto-opening (intrusive, fires at the wrong moment) and beats
+ * printing a bare URL (the user has to copy-paste). Press Enter and it opens.
+ *
+ * @module utils/browser
+ */
+
+const { exec } = require('node:child_process');
+const kleur = require('kleur');
+const ui = require('./ui');
+
+/**
+ * Open a URL in the default browser. Best-effort: never throws, and async
+ * failures are swallowed because the URL is always printed alongside.
+ *
+ * @returns {boolean} true if the open command was dispatched
+ */
+function openUrl(url) {
+  try {
+    const cmd = process.platform === 'darwin'
+      ? `open "${url}"`
+      : process.platform === 'win32'
+        ? `start "" "${url}"`
+        : `xdg-open "${url}"`;
+    exec(cmd, () => {}); // swallow async errors — opening a browser is best-effort
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+/**
+ * Print a link and offer to open it in the browser on Enter.
+ *
+ * @param {object}   opts
+ * @param {string}   opts.url             the link to show/open
+ * @param {string}  [opts.label]          line shown above the URL
+ * @param {string}  [opts.confirmMessage] the yes/no prompt (Enter = yes)
+ * @param {Function}[opts.t]              translator; falls back to English-ish keys
+ * @returns {Promise<boolean>} whether the user chose to open it
+ */
+async function promptOpenBrowser({ url, label, confirmMessage, t }) {
+  const tr = typeof t === 'function' ? t : null;
+  const intro = label || (tr ? tr('browser.open.intro') : 'Open this link in your browser:');
+  ui.log.message(`${intro}\n${kleur.cyan(url)}`);
+  const open = await ui.confirm({
+    message: confirmMessage || (tr ? tr('browser.open.confirm') : 'Open it in the browser now?'),
+    initialValue: true,
+  });
+  if (open) openUrl(url);
+  return open;
+}
+
+module.exports = { openUrl, promptOpenBrowser };

package/lib/utils/checks.js

@@ -3,6 +3,8 @@ const { promisify } = require('node:util');
 const kleur = require('kleur');
 const ui = require('./ui');
 const { createTranslator, detectDefaultLanguage } = require('./i18n');
+const { augmentedEnv, pubCacheBin } = require('./env-tools');
+const { promptOpenBrowser } = require('./browser');
 
 const execAsync = promisify(exec);
 
@@ -10,12 +12,41 @@ const execAsync = promisify(exec);
 const TOOL_CHECK_TIMEOUT = 15_000;
 // Timeout para instalação automática de ferramentas (5 min)
 const INSTALL_TIMEOUT = 300_000;
+const MAX_BUFFER = 50 * 1024 * 1024;
 
 // Minimum supported versions for Kasy projects
 const MIN_NODE_VERSION = '18.0.0';
 const MIN_FLUTTER_VERSION = '3.24.0';
 const MIN_DART_VERSION = '3.5.0';
 
+/**
+ * Single source of truth for "how do I install tool X on this OS". Returns the
+ * package-manager command we can run (with the user's consent) plus a docs URL
+ * and any follow-up command. Used both for the auto-install offer and for the
+ * manual guidance fallback, so the two can never drift apart again.
+ *
+ * @param {'gcloud'|'flutter'} tool
+ * @returns {{ cmd: string|null, after: string|null, url: string }}
+ */
+function getInstallGuide(tool) {
+  const guides = {
+    gcloud: {
+      darwin: { cmd: 'brew install --cask google-cloud-sdk', after: 'gcloud auth login', url: 'https://cloud.google.com/sdk/docs/install' },
+      win32: { cmd: 'winget install --id Google.CloudSDK -e', after: 'gcloud auth login', url: 'https://cloud.google.com/sdk/docs/install-sdk#windows' },
+      linux: { cmd: 'curl https://sdk.cloud.google.com | bash', after: 'gcloud auth login', url: 'https://cloud.google.com/sdk/docs/install' },
+    },
+    flutter: {
+      // Flutter installs via brew cask on macOS; on Windows/Linux the supported
+      // path is the SDK archive, so we guide to the docs instead of guessing.
+      darwin: { cmd: 'brew install --cask flutter', after: 'flutter doctor', url: 'https://docs.flutter.dev/get-started/install/macos' },
+      win32: { cmd: null, after: 'flutter doctor', url: 'https://docs.flutter.dev/get-started/install/windows' },
+      linux: { cmd: null, after: 'flutter doctor', url: 'https://docs.flutter.dev/get-started/install/linux' },
+    },
+  };
+  const byTool = guides[tool] || {};
+  return byTool[process.platform] || byTool.linux || { cmd: null, after: null, url: '' };
+}
+
 const BASE_CHECKS = [
   {
     name: 'Node.js',
@@ -29,6 +60,8 @@ const BASE_CHECKS = [
     required: false,
     warnMessageKey: 'checks.flutter.warn',
     minVersion: MIN_FLUTTER_VERSION,
+    installGuide: () => getInstallGuide('flutter'),
+    confirmInstall: true,
   },
   {
     name: 'Dart SDK',
@@ -55,19 +88,6 @@ const PLATFORM_CHECKS = {
   linux: []
 };
 
-function getGcloudInstallHint() {
-  switch (process.platform) {
-    case 'darwin':
-      return 'brew install --cask google-cloud-sdk';
-    case 'linux':
-      return 'curl https://sdk.cloud.google.com | bash && source ~/.bashrc';
-    case 'win32':
-      return 'winget install Google.CloudSDK\n    ou baixe o instalador: https://cloud.google.com/sdk/docs/install-sdk#windows';
-    default:
-      return 'https://cloud.google.com/sdk/docs/install';
-  }
-}
-
 /** Firebase CLI + FlutterFire — required for push notifications (FCM) on all backends */
 const FIREBASE_CHECKS = [
   {
@@ -82,14 +102,19 @@ const FIREBASE_CHECKS = [
     command: 'flutterfire --version',
     required: true,
     tryInstall: 'dart pub global activate flutterfire_cli',
-    retryCommand: `${process.env.HOME}/.pub-cache/bin/flutterfire --version`,
+    // After activation the binary lives in the pub-cache bin dir, which is NOT
+    // on the current process PATH (and is in a different place on Windows). We
+    // re-check via the augmented PATH first and the absolute pub-cache path as
+    // a fallback — see env-tools.pubCacheBin.
+    pubGlobalBin: 'flutterfire',
     tryInstallMessageKey: 'setup.flutterfire.installing',
   },
   {
     name: 'gcloud CLI (create-from-scratch)',
     command: 'gcloud --version',
     required: false,
-    failHint: getGcloudInstallHint(),
+    installGuide: () => getInstallGuide('gcloud'),
+    confirmInstall: true,
     waitPromptKey: 'checks.waitPrompt.gcloud.install',
   },
   {
@@ -159,61 +184,171 @@ function extractVersion(stdout, checkName) {
   return m ? m[0] : raw.slice(0, 20);
 }
 
+/** execAsync that never throws and always runs with the augmented PATH. */
+async function execTool(cmd, timeout = TOOL_CHECK_TIMEOUT) {
+  try {
+    const { stdout, stderr } = await execAsync(cmd, {
+      encoding: 'utf8',
+      timeout,
+      env: augmentedEnv(),
+      maxBuffer: MAX_BUFFER,
+    });
+    return { ok: true, stdout, stderr };
+  } catch (err) {
+    return { ok: false, error: err.message, stderr: err.stderr || '', stdout: err.stdout || '' };
+  }
+}
+
+/**
+ * Verify a tool responds after an install. Tries the plain command first (now
+ * that PATH is augmented) and, for pub-global tools, the absolute pub-cache
+ * path as a fallback for shells that don't pick up the new PATH.
+ */
+async function verifyTool(check) {
+  const attempts = [check.command];
+  if (check.pubGlobalBin) attempts.push(`${pubCacheBin(check.pubGlobalBin)} --version`);
+  else if (check.retryCommand) attempts.push(check.retryCommand);
+
+  for (const cmd of attempts) {
+    const res = await execTool(cmd);
+    if (res.ok) return { ok: true, stdout: res.stdout };
+  }
+  return { ok: false };
+}
+
 async function runSingleCheck(check, options = {}) {
   const showVersion = check.showVersion !== undefined ? check.showVersion : (options.showVersion !== undefined ? options.showVersion : true);
   let autoInstallFailed = false;
 
-  try {
-    const { stdout } = await execAsync(check.command, { encoding: 'utf8', timeout: TOOL_CHECK_TIMEOUT });
-    const version = showVersion ? extractVersion(stdout, check.name) : null;
+  const first = await execTool(check.command);
+  if (first.ok) {
+    const version = showVersion ? extractVersion(first.stdout, check.name) : null;
     return { ...check, ok: true, version: version || null };
-  } catch (err) {
-    const diagnosis = diagnoseFailure(err);
-    if (check.tryInstall) {
-      try {
-        await execAsync(check.tryInstall, { encoding: 'utf8', timeout: INSTALL_TIMEOUT });
-        const { stdout: retryOut } = await execAsync(check.retryCommand || check.command, { encoding: 'utf8', timeout: TOOL_CHECK_TIMEOUT });
-        const version = showVersion ? extractVersion(retryOut, check.name) : null;
+  }
+
+  const diagnosis = diagnoseFailure({ message: first.error, stderr: first.stderr, stdout: first.stdout });
+
+  // Lightweight auto-install (npm / pub global). Heavy tools (gcloud, flutter)
+  // use confirmInstall and are handled interactively after the spinner.
+  if (check.tryInstall) {
+    const installed = await execTool(check.tryInstall, INSTALL_TIMEOUT);
+    if (installed.ok) {
+      const verified = await verifyTool(check);
+      if (verified.ok) {
+        const version = showVersion ? extractVersion(verified.stdout, check.name) : null;
         return { ...check, ok: true, version: version || null };
-      } catch {
-        autoInstallFailed = true;
       }
     }
-    return { ...check, ok: false, autoInstallFailed, diagnosis };
+    autoInstallFailed = true;
+  }
+
+  return { ...check, ok: false, autoInstallFailed, diagnosis };
+}
+
+/** Re-run a check's command (with augmented PATH) and report the result inline. */
+async function revalidate(check, t) {
+  const verified = await verifyTool(check);
+  if (verified.ok) {
+    const version = check.showVersion === false ? null : extractVersion(verified.stdout, check.name);
+    ui.log.success(version ? `${check.name} — ${version}` : check.name);
+    return true;
   }
+  ui.log.error(`${check.name} ${t('checks.stillMissing') || 'still missing'}`);
+  return false;
 }
 
 /**
- * Retry a check after the user installs/auths a missing tool. Used when the
- * check definition has `waitPrompt` — we offer the user to run the install
- * step, then re-check on Enter. Returns true if the recheck succeeded.
+ * Interactive recovery for a failed check. The flow, in order:
+ *   1. Heavy tools with a package-manager command (gcloud, flutter): offer to
+ *      install it now via brew/winget after a yes/no confirm.
+ *   2. Manual guidance: print the exact command for this OS, offer to open the
+ *      docs in the browser on Enter.
+ *   3. Wait for the user to fix it, then re-check on Enter (never a dead end).
+ * Returns true if the tool is present by the end.
  */
-async function retryCheckInteractively(check, t) {
+async function recoverCheckInteractively(check, t) {
   ui.log.warn(`${check.name} ${t('checks.notFound.short') || 'not found'}`);
-  if (check.failHint) {
-    ui.log.message(`${t('checks.runHint') || 'Run'}: ${kleur.cyan(check.failHint)}`);
+
+  const guide = typeof check.installGuide === 'function' ? check.installGuide() : null;
+
+  // 1) Offer auto-install for heavy tools that have a package-manager command.
+  if (guide && guide.cmd && check.confirmInstall) {
+    const doInstall = await ui.confirm({
+      message: t('checks.install.confirm', { name: check.name, cmd: guide.cmd }),
+      initialValue: true,
+    });
+    if (doInstall) {
+      const spinner = ui.spinner();
+      spinner.start(t('checks.install.running', { name: check.name }));
+      const installed = await execTool(guide.cmd, INSTALL_TIMEOUT);
+      spinner.stop(t('checks.install.running', { name: check.name }));
+      if (installed.ok && (await revalidate(check, t))) return true;
+      ui.log.warn(t('checks.install.failedManual', { name: check.name }));
+    }
+  }
+
+  // 2) Manual guidance — the exact command for this OS + an Enter-to-open link.
+  // Fall back to the auto-install command (e.g. the `dart pub global activate`
+  // that just failed) so the user always sees *how* to install it by hand,
+  // running it in their own shell where the env may differ.
+  const manualCmd = (guide && guide.cmd) || check.tryInstall || check.failHint;
+  if (manualCmd) {
+    ui.log.message(`${t('checks.runHint') || 'Run'}: ${kleur.cyan(manualCmd)}`);
+  }
+  if (guide && guide.after) {
+    ui.log.message(`${t('checks.thenRun') || 'Then run'}: ${kleur.cyan(guide.after)}`);
   }
-  const proceed = await ui.confirm({
-    message: check.waitPrompt,
-    initialValue: true,
-  });
+  if (guide && guide.url) {
+    await promptOpenBrowser({
+      url: guide.url,
+      t,
+      label: t('checks.install.openDocs', { name: check.name }),
+    });
+  }
+
+  // 3) Wait + re-check on Enter.
+  const waitMessage = check.waitPromptKey
+    ? t(check.waitPromptKey)
+    : (check.waitPrompt || t('checks.recheck', { name: check.name }));
+  const proceed = await ui.confirm({ message: waitMessage, initialValue: true });
   if (!proceed) return false;
-  try {
-    const { stdout } = await execAsync(check.command, { encoding: 'utf8', timeout: TOOL_CHECK_TIMEOUT });
-    const version = extractVersion(stdout, check.name);
-    ui.log.success(version
-      ? `${check.name} — ${version}`
-      : check.name);
-    return true;
-  } catch {
-    ui.log.error(`${check.name} ${t('checks.stillMissing') || 'still missing'}`);
-    return false;
+  return revalidate(check, t);
+}
+
+/** Non-interactive failure reporting (CI, doctor without a TTY, or user opt-out). */
+function printCheckFailure(result, t) {
+  const guide = typeof result.installGuide === 'function' ? result.installGuide() : null;
+  const cmdHint = (guide && guide.cmd) || result.tryInstall || result.failHint;
+  const hint = cmdHint ? `\n${kleur.dim(`→ ${cmdHint}`)}` : '';
+  const urlHint = guide && guide.url ? `\n${kleur.dim(`→ ${guide.url}`)}` : '';
+
+  if (result.required) {
+    const detail = result.autoInstallFailed ? ` — ${t('checks.install.failed')}` : '';
+    const diagSuffix = result.diagnosis ? `\n${kleur.dim(`→ ${t(`checks.diagnostic.${result.diagnosis}`, { name: result.name })}`)}` : '';
+    ui.log.error(`${t('checks.missing', { name: result.name })}${detail}${diagSuffix}${hint}${urlHint}`);
+  } else if (result.diagnosis) {
+    ui.log.warn(t(`checks.diagnostic.${result.diagnosis}`, { name: result.name }));
+  } else if (result.warnMessage) {
+    ui.log.warn(`${result.warnMessage}${hint}`);
+  } else if (result.warnMessageKey) {
+    ui.log.warn(`${t(result.warnMessageKey)}${hint}`);
+  } else {
+    ui.log.warn(`${t('checks.notFound', { name: result.name })}${hint}${urlHint}`);
   }
 }
 
+function canRecover(result) {
+  return Boolean(
+    result.installGuide || result.tryInstall || result.waitPromptKey || result.waitPrompt
+  );
+}
+
 async function runChecks(checks, title, options = {}) {
   const t = options.t || createTranslator(options.language || detectDefaultLanguage());
   const { showVersion = true } = options;
+  // Interactive recovery needs a real terminal; disable it in CI/pipes so the
+  // command never blocks waiting for input that will never come.
+  const interactive = options.interactive !== false && Boolean(process.stdout.isTTY);
 
   // Single spinner over all checks, show failures afterwards. The visual
   // sits inside the clack rail (│) opened by the caller's ui.intro().
@@ -243,31 +378,15 @@ async function runChecks(checks, title, options = {}) {
   }
 
   for (const result of failures) {
-    // Interactive recovery for checks with a waitPrompt (e.g. gcloud install).
-    // Lets the user fix the env without restarting the command.
-    const waitPromptText = result.waitPromptKey ? t(result.waitPromptKey) : result.waitPrompt;
-    if (waitPromptText) {
-      const recovered = await retryCheckInteractively({ ...result, waitPrompt: waitPromptText }, t);
+    if (interactive && canRecover(result)) {
+      const recovered = await recoverCheckInteractively({ ...result, t }, t);
       if (recovered) {
         const idx = results.indexOf(result);
-        if (idx >= 0) results[idx] = { ...result, ok: true };
+        if (idx >= 0) results[idx] = { ...result, ok: true, autoInstallFailed: false };
+        continue;
       }
-      continue;
-    }
-    const hint = result.failHint ? `\n${kleur.dim(`→ ${result.failHint}`)}` : '';
-    if (result.required) {
-      const detail = result.autoInstallFailed ? ` — ${t('checks.install.failed')}` : '';
-      const diagSuffix = result.diagnosis ? `\n${kleur.dim(`→ ${t(`checks.diagnostic.${result.diagnosis}`, { name: result.name })}`)}` : '';
-      ui.log.error(`${t('checks.missing', { name: result.name })}${detail}${diagSuffix}${hint}`);
-    } else if (result.diagnosis) {
-      ui.log.warn(t(`checks.diagnostic.${result.diagnosis}`, { name: result.name }));
-    } else if (result.warnMessage) {
-      ui.log.warn(`${result.warnMessage}${hint}`);
-    } else if (result.warnMessageKey) {
-      ui.log.warn(`${t(result.warnMessageKey)}${hint}`);
-    } else {
-      ui.log.warn(`${t('checks.notFound', { name: result.name })}${hint}`);
     }
+    printCheckFailure(result, t);
   }
 
   return results;
@@ -281,6 +400,7 @@ module.exports = {
   getBaseChecks,
   getPlatformChecks,
   getBackendChecks,
+  getInstallGuide,
   runChecks,
   hasRequiredFailures,
 };

package/lib/utils/env-tools.js

@@ -0,0 +1,101 @@
+/**
+ * Cross-platform resolution of tool install locations and an "augmented" PATH.
+ *
+ * Why this exists: several places in the CLI used `process.env.HOME` to build
+ * the pub-cache path (e.g. `${HOME}/.pub-cache/bin/flutterfire`). On Windows
+ * `HOME` is undefined (it's `USERPROFILE`) AND the pub-cache lives somewhere
+ * else entirely (`%LOCALAPPDATA%\Pub\Cache\bin`), so the fallback never worked
+ * there — which is why FlutterFire "never installed" on Windows.
+ *
+ * It also exposes `augmentedEnv()`: a copy of the environment with the dirs of
+ * freshly-installed CLIs prepended to PATH. A running process inherits the PATH
+ * of the shell that launched it and never sees changes made afterwards, so a
+ * tool installed mid-`kasy new` (flutterfire, firebase…) is invisible to child
+ * processes until the user opens a new terminal — unless we inject the dir here.
+ *
+ * @module utils/env-tools
+ */
+
+const os = require('node:os');
+const path = require('node:path');
+const fs = require('node:fs');
+
+const isWindows = process.platform === 'win32';
+const PATH_SEP = isWindows ? ';' : ':';
+
+/** Cross-platform home directory (never trust process.env.HOME on Windows). */
+function homeDir() {
+  return os.homedir();
+}
+
+/**
+ * Directory where `dart pub global activate` drops executables.
+ *   - Honors $PUB_CACHE when the user customized it (works on every OS).
+ *   - Windows: %LOCALAPPDATA%\Pub\Cache\bin (modern Dart) with %APPDATA% as a
+ *     legacy fallback. We prefer whichever already exists on disk.
+ *   - macOS/Linux: ~/.pub-cache/bin
+ */
+function pubCacheBinDir() {
+  // Use the platform-specific path flavor explicitly (path.win32 / path.posix)
+  // so separators are correct even when this logic is unit-tested from another
+  // OS — in production isWindows already matches the running platform.
+  const p = isWindows ? path.win32 : path.posix;
+  if (process.env.PUB_CACHE) {
+    return p.join(process.env.PUB_CACHE, 'bin');
+  }
+  if (isWindows) {
+    const candidates = [
+      process.env.LOCALAPPDATA && p.join(process.env.LOCALAPPDATA, 'Pub', 'Cache', 'bin'),
+      process.env.APPDATA && p.join(process.env.APPDATA, 'Pub', 'Cache', 'bin'),
+    ].filter(Boolean);
+    for (const candidate of candidates) {
+      if (fs.existsSync(candidate)) return candidate;
+    }
+    return candidates[0] || p.join(homeDir(), 'AppData', 'Local', 'Pub', 'Cache', 'bin');
+  }
+  return p.join(homeDir(), '.pub-cache', 'bin');
+}
+
+/**
+ * Absolute path to a pub-global executable, quoted and ready to drop into a
+ * shell command. On Windows the activated binary is a `.bat` shim.
+ *
+ * @param {string} name e.g. 'flutterfire'
+ * @returns {string} quoted absolute path, or '' if it can't be located
+ */
+function pubCacheBin(name) {
+  const dir = pubCacheBinDir();
+  const file = isWindows ? path.win32.join(dir, `${name}.bat`) : path.posix.join(dir, name);
+  return `"${file}"`;
+}
+
+/**
+ * A copy of process.env with `extraDirs` (plus the pub-cache bin) prepended to
+ * PATH, so child processes can find tools installed earlier in this same run.
+ * On Windows we set both `PATH` and `Path` because Node reads the original key.
+ *
+ * @param {string[]} [extraDirs] additional directories to expose
+ */
+function augmentedEnv(extraDirs = []) {
+  const dirs = [pubCacheBinDir(), ...extraDirs].filter(Boolean);
+  const env = { ...process.env };
+  // Windows env keys are case-insensitive; find whichever key holds PATH.
+  const pathKey = Object.keys(env).find((k) => k.toLowerCase() === 'path') || 'PATH';
+  const current = env[pathKey] || '';
+  const existing = current.split(PATH_SEP);
+  const additions = dirs.filter((dir) => !existing.includes(dir));
+  if (additions.length > 0) {
+    const next = current ? `${additions.join(PATH_SEP)}${PATH_SEP}${current}` : additions.join(PATH_SEP);
+    env[pathKey] = next;
+    if (isWindows) env.Path = next; // belt-and-suspenders for case-sensitive reads
+  }
+  return env;
+}
+
+module.exports = {
+  isWindows,
+  homeDir,
+  pubCacheBinDir,
+  pubCacheBin,
+  augmentedEnv,
+};

package/lib/utils/i18n/messages-en.js

@@ -122,6 +122,14 @@ module.exports = {
     'checks.install.failed': 'auto-install failed — run the command manually',
     'checks.waitPrompt.gcloud.install': 'After installing gcloud, press Enter to check again',
     'checks.waitPrompt.gcloud.auth': 'After running gcloud auth login, press Enter to check again',
+    'checks.thenRun': 'Then run',
+    'checks.recheck': 'After installing {name}, press Enter to check again',
+    'checks.install.confirm': 'Install {name} now? ({cmd})',
+    'checks.install.running': 'Installing {name}…',
+    'checks.install.failedManual': 'Could not install {name} automatically. Do it manually:',
+    'checks.install.openDocs': 'Open the install page in the browser?',
+    'browser.open.intro': 'Open this link in your browser:',
+    'browser.open.confirm': 'Open it in the browser now?',
     'error.hint.notFlutterProject': 'You\'re not inside a Flutter project. Try `kasy new` to create one, or cd into an existing one.',
     'error.hint.flutterMissing': 'Flutter is not installed or not on your PATH. Run `kasy doctor` to diagnose.',
     'error.hint.permission': 'A file or folder is read-only. Check the parent directory permissions or try again from your home folder.',
@@ -524,7 +532,7 @@ module.exports = {
     'new.firebase.module.sentry': '🚨 Crash Reports (Sentry)',
     'new.firebase.module.analytics': '📊 Analytics (Mixpanel)',
     'new.firebase.module.facebook': '👤 Facebook (Login + Ads)',
-    'new.firebase.module.web': '🌐 Web Support (PWA, Firebase only)',
+    'new.firebase.module.web': '🌐 Web Support (PWA)',
     'new.firebase.module.widget': '📱 Home Widget (iOS/Android)',
     'new.firebase.module.llm_chat': '🤖 AI Chat (OpenAI/Gemini)',
     'new.firebase.module.local_notifications': '🔔 Local Reminders (no server)',
@@ -692,6 +700,10 @@ module.exports = {
     'new.google.refreshConfigs': 'Updating google-services.json and GoogleService-Info.plist with Google Client IDs…',
     'new.google.manualHint': 'Google Sign-In: enable manually in the Console (Google provider):',
     'new.google.manualHint.noEmail': 'Google Sign-In: could not detect a support email (gcloud has no account). Enable manually in the Console:',
+    'new.google.supabaseManual': 'Google Sign-In: client created, but the secret was not available yet. Enable it later in the Supabase dashboard (Authentication > Providers > Google).',
+    'new.fcm.ok': 'generated automatically',
+    'new.fcm.failSupabase': 'not generated (GCP permission still propagating); set FIREBASE_SERVICE_ACCOUNT_JSON in your Supabase secrets',
+    'new.fcm.failApi': 'not generated (GCP permission still propagating); run the command again in a few minutes',
     'new.sha1.registering': 'Registering SHA-1 for Google Sign-In (Android)…',
     'new.sha1.failed': 'SHA-1 not added automatically: {error}',
     'new.sha1.manual': 'Add it manually so Google Sign-In works on Android:',