kasy-cli 1.26.0 → 1.28.0

package/lib/commands/new.js

@@ -154,6 +154,11 @@ async function confirmIdentities(backend, gcloudAccount, tr, cancel) {
     const doLogin = await ui.confirm({ message: tr('new.accounts.loginPrompt', { name }), initialValue: true, onCancel: cancel });
     if (!doLogin) return;
     ui.log.message(tr('new.accounts.loggingIn', { name }));
+    // Firebase's first run interrupts the login with two unrelated yes/no
+    // prompts (Gemini in Firebase, anonymous usage data). For a non-technical
+    // user mid-setup that's just noise that can derail them. Opt out silently so
+    // `firebase login` goes straight to the browser.
+    if (name === 'Firebase') silenceFirebaseFirstRunPrompts();
     const { spawnSync } = require('node:child_process');
     spawnSync(cmd, { stdio: 'inherit', shell: true });
     await revalidate();
@@ -195,6 +200,47 @@ async function confirmIdentities(backend, gcloudAccount, tr, cancel) {
   }
 }
 
+/**
+ * Opt out of Firebase CLI's first-run questions before we shell into
+ * `firebase login`. On a fresh machine the CLI otherwise stops to ask, one at a
+ * time, whether to enable Gemini in Firebase and whether to share anonymous
+ * usage data — both irrelevant to creating a project and confusing for a
+ * first-time user who just wants to log in. firebase-tools reads these from a
+ * configstore JSON (~/.config/configstore/firebase-tools.json on every OS); we
+ * only write keys that aren't already set, so a user who answered them before
+ * keeps their choice. Best-effort: any failure is ignored, the prompts just
+ * reappear. Never throws.
+ */
+function silenceFirebaseFirstRunPrompts() {
+  try {
+    const fs = require('node:fs');
+    const os = require('node:os');
+    const path = require('node:path');
+    // firebase-tools honors XDG_CONFIG_HOME, falling back to ~/.config.
+    const cfgHome =
+      process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+    const dir = path.join(cfgHome, 'configstore');
+    const file = path.join(dir, 'firebase-tools.json');
+    let data = {};
+    if (fs.existsSync(file)) {
+      try {
+        data = JSON.parse(fs.readFileSync(file, 'utf8')) || {};
+      } catch {
+        data = {};
+      }
+    }
+    let changed = false;
+    if (!('usage' in data)) { data.usage = false; changed = true; }
+    if (!('gemini' in data)) { data.gemini = false; changed = true; }
+    if (changed) {
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(file, JSON.stringify(data, null, 2));
+    }
+  } catch {
+    // Best-effort: if we can't write the config, the prompts just show up.
+  }
+}
+
 /**
  * Try to get gcloud ready (installed + logged in) without making the user leave
  * the flow. Mirrors the machine-prep we do for Node/Flutter/Firebase: offer to
@@ -205,33 +251,40 @@ async function confirmIdentities(backend, gcloudAccount, tr, cancel) {
  * id elsewhere). Never throws.
  */
 async function ensureGcloudReady(tr) {
-  const { spawnSync } = require('node:child_process');
+  const { spawnSync, exec } = require('node:child_process');
   const { augmentedEnv } = require('../utils/env-tools');
 
   let check = await checkGcloudAuth();
   if (check.ok) return check;
 
-  // 1) Not installed → offer to install it for them.
+  // 1) Not installed → install it automatically. gcloud is mandatory to create a
+  //    Firebase project from scratch, so a yes/no here just adds a dead end the
+  //    user can fall into; we install it the same way we do Node/Flutter/Firebase
+  //    (auto, with visible progress) and only tell them what's happening.
   if (check.missing === 'gcloud') {
     const guide = getGcloudInstallInstructions();
     if (guide.install) {
-      const doInstall = await ui.confirm({
-        message: tr('new.firebase.create.gcloudInstallConfirm'),
-        initialValue: true,
+      ui.log.info(tr('new.firebase.create.gcloudMissing'));
+      const spinner = ui.timedSpinner();
+      spinner.start(tr('new.firebase.create.gcloudInstalling'));
+      // Run async (NOT spawnSync): a synchronous child blocks the event loop,
+      // which freezes the spinner — the user stares at a dead screen for
+      // minutes. exec keeps the clock ticking so it's clear it's working.
+      await new Promise((resolve) => {
+        exec(
+          guide.install,
+          { env: augmentedEnv(), timeout: 600_000, windowsHide: true, maxBuffer: 50 * 1024 * 1024 },
+          () => resolve()
+        );
       });
-      if (doInstall) {
-        const spinner = ui.timedSpinner();
-        spinner.start(tr('new.firebase.create.gcloudInstalling'));
-        spawnSync(guide.install, { stdio: 'pipe', shell: true });
-        spinner.stop(tr('new.firebase.create.gcloudInstalling'));
-        // checkGcloudAuth / the later billing+project calls run with the plain
-        // process PATH, which doesn't see a tool winget just dropped on the
-        // machine PATH. Inject the known gcloud dir so the rest of the flow works.
-        const env = augmentedEnv();
-        if (env.PATH) process.env.PATH = env.PATH;
-        if (process.platform === 'win32' && env.Path) process.env.Path = env.Path;
-        check = await checkGcloudAuth();
-      }
+      spinner.stop(tr('new.firebase.create.gcloudInstalling'));
+      // checkGcloudAuth and the later billing/project calls use the plain
+      // process PATH, which doesn't see a tool winget just put on the machine
+      // PATH. Inject the known gcloud dir so the rest of the flow works.
+      const env = augmentedEnv();
+      if (env.PATH) process.env.PATH = env.PATH;
+      if (process.platform === 'win32' && env.Path) process.env.Path = env.Path;
+      check = await checkGcloudAuth();
     }
   }
 

package/lib/scaffold/backends/firebase/deploy.js

@@ -14,6 +14,7 @@ const { promisify } = require('node:util');
 const path = require('node:path');
 const os = require('node:os');
 const fs = require('fs-extra');
+const { augmentedEnv } = require('../../../utils/env-tools');
 
 const execAsync = promisify(exec);
 
@@ -160,6 +161,10 @@ async function run(cmd, cwd) {
     const { stdout, stderr } = await execAsync(cmd, {
       cwd,
       maxBuffer: 50 * 1024 * 1024,
+      // Same reason as setup-from-scratch: find tools (gcloud, firebase, npm)
+      // that may have been installed earlier in this run but aren't on the
+      // default Windows process PATH yet.
+      env: augmentedEnv(),
     });
     return { ok: true, stdout, stderr };
   } catch (err) {

package/lib/scaffold/backends/firebase/enable-auth-via-cli.js

@@ -15,12 +15,18 @@ const path = require('node:path');
 const { promisify } = require('node:util');
 const execAsync = promisify(require('node:child_process').exec);
 const fs = require('fs-extra');
+const { augmentedEnv } = require('../../../utils/env-tools');
 
 const DEPLOY_TIMEOUT_MS = 5 * 60 * 1000; // 5 min — auth deploys are fast but allow slack
 
 async function getGcloudAccountEmail() {
+  // No shell-specific redirect here: `2>/dev/null` is a Unix-ism that cmd.exe
+  // does NOT understand, so on Windows it made the whole command fail and we
+  // wrongly reported "no gcloud account" even when the user was logged in.
+  // gcloud prints the account to stdout; any "(unset)" note goes to stderr,
+  // which exec already keeps separate, so we don't need to silence it.
   try {
-    const { stdout } = await execAsync('gcloud config get-value account 2>/dev/null');
+    const { stdout } = await execAsync('gcloud config get-value account', { env: augmentedEnv() });
     const email = (stdout || '').trim();
     return email && email !== '(unset)' ? email : null;
   } catch {
@@ -98,7 +104,7 @@ async function enableAuthViaFirebaseCli({ projectDir, projectId, appName, suppor
   // 3. Deploy. --non-interactive prevents the CLI from prompting on edge cases.
   const cmd = `firebase deploy --only auth --project ${projectId} --non-interactive`;
   try {
-    await execAsync(cmd, { cwd: projectDir, timeout: DEPLOY_TIMEOUT_MS, maxBuffer: 10 * 1024 * 1024 });
+    await execAsync(cmd, { cwd: projectDir, timeout: DEPLOY_TIMEOUT_MS, maxBuffer: 10 * 1024 * 1024, env: augmentedEnv() });
     return { ok: true, supportEmail: email };
   } catch (err) {
     const stderr = (err.stderr || '').toString();

package/lib/scaffold/backends/firebase/setup-from-scratch.js

@@ -19,7 +19,8 @@ const path = require('node:path');
 const fs = require('fs-extra');
 const os = require('node:os');
 const { getInstallGuide } = require('../../../utils/checks');
-const { keytoolBin } = require('../../../utils/env-tools');
+const { keytoolBin, augmentedEnv } = require('../../../utils/env-tools');
+const { ensureJdkWindows } = require('../../../utils/flutter-install');
 
 const execAsync = promisify(exec);
 
@@ -66,6 +67,11 @@ async function run(cmd, cwd = process.cwd()) {
       cwd,
       maxBuffer: 10 * 1024 * 1024,
       encoding: 'utf8',
+      // augmentedEnv() injects the install dirs of tools we may have just put on
+      // the machine this run (gcloud, Flutter/Dart, Git, the JDK for keytool).
+      // On Windows those aren't on the default process PATH yet, so without this
+      // every gcloud/keytool call here would fail with "not recognized".
+      env: augmentedEnv(),
     });
     return { ok: true, stdout: (stdout || '').trim(), stderr: (stderr || '').trim() };
   } catch (err) {
@@ -533,6 +539,14 @@ async function createWebApp(projectId, appName) {
  * Ensure debug.keystore exists. Creates it if missing (standard Android debug key).
  */
 async function ensureDebugKeystore() {
+  // On Windows a fresh machine has no JDK, so keytool is missing. If we can't
+  // resolve a real keytool path (keytoolBin falls back to the bare name), try
+  // installing Microsoft OpenJDK once so the steps below actually find it. This
+  // covers the case where Flutter was already present (so its installer, which
+  // also installs the JDK, never ran this session). Best-effort.
+  if (process.platform === 'win32' && keytoolBin() === 'keytool') {
+    await ensureJdkWindows();
+  }
   const androidDir = path.dirname(DEBUG_KEYSTORE);
   if (!(await fs.pathExists(DEBUG_KEYSTORE))) {
     await fs.ensureDir(androidDir);

package/lib/utils/checks.js

@@ -275,34 +275,33 @@ async function recoverCheckInteractively(check, t) {
   // The step list already flagged this tool as missing; go straight to fixing it.
   const guide = typeof check.installGuide === 'function' ? check.installGuide() : null;
 
-  // 1) Offer auto-install for heavy tools. Most use a package-manager command
+  // 1) Auto-install heavy tools. Most use a package-manager command
   // (brew/winget); Flutter on Windows uses a custom installer (check.installFn)
-  // because winget ships no stable Flutter package.
+  // because winget ships no stable Flutter package. We don't ask a yes/no here:
+  // for a Flutter project these tools are required to go any further, so a
+  // confirm just adds a dead end the user can fall into. We install
+  // automatically and show what's happening (incl. the size note for big
+  // downloads), matching how the Firebase/FlutterFire CLIs already behave.
   if (check.confirmInstall && (check.installFn || (guide && guide.cmd))) {
     const cmdLabel = check.installFn
       ? (check.installFnDescKey ? t(check.installFnDescKey) : check.name)
       : guide.cmd;
-    const doInstall = await ui.confirm({
-      message: t('checks.install.confirm', { name: check.name, cmd: cmdLabel }),
-      initialValue: true,
-    });
-    if (doInstall) {
-      // Heads-up for the custom installer: it's a big download and may pop a UAC.
-      if (check.installFn && check.installFnNoteKey) ui.log.info(t(check.installFnNoteKey));
-      const spinner = ui.timedSpinner();
-      spinner.start(t('checks.install.running', { name: check.name }));
-      const installed = check.installFn
-        ? await check.installFn({})
-        : await execTool(guide.cmd, INSTALL_TIMEOUT);
-      spinner.stop(t('checks.install.running', { name: check.name }));
-      if (installed.ok && (await revalidate(check, t))) return true;
-      ui.log.warn(t('checks.install.failedManual', { name: check.name }));
-      // Surface the installer's own last line — it usually says WHY (needs admin,
-      // agreement not accepted, package not found), which beats a generic failure.
-      const reason = (installed.stderr || installed.error || '')
-        .split('\n').map((l) => l.trim()).filter(Boolean).pop();
-      if (reason) ui.log.message(kleur.dim(reason.slice(0, 200)));
-    }
+    // Tell the user we're installing it (and why it can take a while / is big).
+    ui.log.info(t('checks.install.autoInstalling', { name: check.name, cmd: cmdLabel }));
+    if (check.installFn && check.installFnNoteKey) ui.log.info(t(check.installFnNoteKey));
+    const spinner = ui.timedSpinner();
+    spinner.start(t('checks.install.running', { name: check.name }));
+    const installed = check.installFn
+      ? await check.installFn({})
+      : await execTool(guide.cmd, INSTALL_TIMEOUT);
+    spinner.stop(t('checks.install.running', { name: check.name }));
+    if (installed.ok && (await revalidate(check, t))) return true;
+    ui.log.warn(t('checks.install.failedManual', { name: check.name }));
+    // Surface the installer's own last line — it usually says WHY (needs admin,
+    // agreement not accepted, package not found), which beats a generic failure.
+    const reason = (installed.stderr || installed.error || '')
+      .split('\n').map((l) => l.trim()).filter(Boolean).pop();
+    if (reason) ui.log.message(kleur.dim(reason.slice(0, 200)));
   }
 
   // 2) Manual guidance — the exact command for this OS + an Enter-to-open link.

package/lib/utils/env-tools.js

@@ -69,16 +69,52 @@ function pubCacheBin(name) {
   return `"${file}"`;
 }
 
+/**
+ * Find the `bin` dir of a JDK installed on Windows under a versioned folder
+ * (e.g. `C:\Program Files\Microsoft\jdk-17.0.13\bin`). winget's Microsoft
+ * OpenJDK / Eclipse Adoptium packages install there but the exact version is in
+ * the path, so we can't hardcode it — we scan the known vendor roots and pick a
+ * folder that actually contains keytool. Returns null on non-Windows or if none
+ * is found.
+ */
+function findWindowsJdkBin() {
+  if (!isWindows) return null;
+  const pf = process.env.ProgramFiles;
+  if (!pf) return null;
+  const roots = [
+    path.win32.join(pf, 'Microsoft'),        // Microsoft.OpenJDK.*
+    path.win32.join(pf, 'Eclipse Adoptium'), // EclipseAdoptium.Temurin.*
+    path.win32.join(pf, 'Java'),             // Oracle / other
+  ];
+  for (const root of roots) {
+    try {
+      if (!fs.existsSync(root)) continue;
+      // Highest version first (lexical desc is close enough for jdk-NN.x names).
+      const dirs = fs.readdirSync(root).filter((d) => /jdk|jre/i.test(d)).sort().reverse();
+      for (const d of dirs) {
+        const bin = path.win32.join(root, d, 'bin');
+        if (fs.existsSync(path.win32.join(bin, 'keytool.exe'))) return bin;
+      }
+    } catch {
+      // Unreadable root — skip it.
+    }
+  }
+  return null;
+}
+
 /**
  * Quoted path to `keytool` (used for the Android debug SHA-1). It ships with
- * the JDK and is almost never on PATH on Windows, so we look in JAVA_HOME and
- * Android Studio's bundled JBR before falling back to bare `keytool`.
+ * the JDK and is almost never on PATH on Windows, so we look in JAVA_HOME, a
+ * winget-installed JDK, and Android Studio's bundled JBR before falling back to
+ * bare `keytool`.
  */
 function keytoolBin() {
   const exe = isWindows ? 'keytool.exe' : 'keytool';
   const candidates = [];
   if (process.env.JAVA_HOME) candidates.push(path.join(process.env.JAVA_HOME, 'bin', exe));
   if (isWindows) {
+    const jdkBin = findWindowsJdkBin();
+    if (jdkBin) candidates.push(path.win32.join(jdkBin, exe));
     const pf = process.env.ProgramFiles;
     const local = process.env.LOCALAPPDATA;
     if (pf) candidates.push(path.win32.join(pf, 'Android', 'Android Studio', 'jbr', 'bin', exe));
@@ -112,6 +148,9 @@ function extraToolDirs() {
     // Git (a Flutter prerequisite) installed via winget Git.Git — default locations.
     process.env.ProgramFiles && path.win32.join(process.env.ProgramFiles, 'Git', 'cmd'),
     process.env.LOCALAPPDATA && path.win32.join(process.env.LOCALAPPDATA, 'Programs', 'Git', 'cmd'),
+    // JDK auto-installed for keytool (Android SHA-1) and Android builds — its bin
+    // lives under a versioned folder, so resolve it dynamically.
+    findWindowsJdkBin(),
   ].filter(Boolean);
   return candidates.filter((dir) => fs.existsSync(dir));
 }

package/lib/utils/flutter-install.js

@@ -5,6 +5,8 @@
  * but do it for the user so `kasy new` can prepare a bare machine end to end:
  *
  *   1. Install Git via winget if missing (Flutter refuses to run without it).
+ *   1b. Install Microsoft OpenJDK if `keytool` is missing — needed for the
+ *      Android debug SHA-1 (Google Sign-In) and for Gradle Android builds.
  *   2. Download the current stable Flutter SDK zip and unzip it into
  *      %LOCALAPPDATA%\flutter (a per-user dir that never needs admin rights).
  *   3. Persist %LOCALAPPDATA%\flutter\bin on the User PATH for future terminals.
@@ -62,6 +64,17 @@ if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
   throw 'Git is required for Flutter but is not available. Install Git and run this again.'
 }
 
+# 1b. JDK — provides 'keytool' (used to register the Android debug SHA-1 for
+#     Google Sign-In) and is required by Gradle to build the Android app. A bare
+#     Windows machine has neither, so install Microsoft's OpenJDK 17 (free, no
+#     account). Non-fatal: if it fails, SHA-1 just falls back to a manual step.
+if (-not (Get-Command keytool -ErrorAction SilentlyContinue)) {
+  if (Get-Command winget -ErrorAction SilentlyContinue) {
+    winget install --id Microsoft.OpenJDK.17 -e --source winget --silent --accept-source-agreements --accept-package-agreements --disable-interactivity | Out-Null
+    Sync-Path
+  }
+}
+
 # 2. Flutter SDK — download + unzip, unless it's already there.
 if (-not (Test-Path (Join-Path $bin 'flutter.bat'))) {
   if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }
@@ -136,4 +149,49 @@ function installFlutterWindows({ timeout = 1_800_000 } = {}) {
   });
 }
 
-module.exports = { installFlutterWindows, flutterWinHome };
+// Standalone JDK installer, for the case where Flutter is ALREADY present (so the
+// installer above never runs) but there's still no JDK — e.g. a machine set up
+// before we started shipping the JDK, hitting the Android SHA-1 step. keytool
+// comes with the JDK; without it Google Sign-In on Android can't be wired up.
+const JDK_PS_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+if (Get-Command keytool -ErrorAction SilentlyContinue) { Write-Output 'JDK_PRESENT'; exit 0 }
+if (Get-Command winget -ErrorAction SilentlyContinue) {
+  winget install --id Microsoft.OpenJDK.17 -e --source winget --silent --accept-source-agreements --accept-package-agreements --disable-interactivity | Out-Null
+}
+Write-Output 'JDK_DONE'
+`;
+
+/**
+ * Install Microsoft OpenJDK on Windows if `keytool` isn't available. Best-effort
+ * and never throws — the caller (SHA-1 registration) degrades to a manual step
+ * if it fails. Resolves to the same shape as installFlutterWindows.
+ *
+ * @param {{ timeout?: number }} [opts]
+ * @returns {Promise<{ ok: boolean, stdout: string, stderr: string, error: string|null }>}
+ */
+function ensureJdkWindows({ timeout = 600_000 } = {}) {
+  return new Promise((resolve) => {
+    if (!isWindows) {
+      resolve({ ok: false, stdout: '', stderr: '', error: 'not windows' });
+      return;
+    }
+    const encoded = Buffer.from(JDK_PS_SCRIPT, 'utf16le').toString('base64');
+    const cmd = `powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand ${encoded}`;
+    exec(
+      cmd,
+      { timeout, maxBuffer: 50 * 1024 * 1024, windowsHide: true },
+      (error, stdout, stderr) => {
+        resolve({
+          ok: !error,
+          stdout: stdout || '',
+          stderr: stderr || '',
+          error: error ? error.message : null,
+        });
+      }
+    );
+  });
+}
+
+module.exports = { installFlutterWindows, flutterWinHome, ensureJdkWindows };

package/lib/utils/i18n/messages-en.js

@@ -134,6 +134,7 @@ module.exports = {
     'checks.thenRun': 'Then run',
     'checks.recheck': 'After installing {name}, press Enter to check again',
     'checks.install.confirm': 'Install {name} now? ({cmd})',
+    'checks.install.autoInstalling': '{name} is required and is not installed yet. Installing it automatically now ({cmd}).',
     'checks.install.flutterWinDesc': 'downloads the official Flutter SDK + Git, ~1.8 GB',
     'checks.install.flutterWinNote': 'This can take a few minutes (large download). If a Windows approval popup appears, click Yes.',
     'checks.install.running': 'Installing {name}…',
@@ -238,6 +239,7 @@ module.exports = {
     'new.firebase.create.installAfter': 'Then log in',
     'new.firebase.create.installUrl': 'Or download from',
     'new.firebase.create.authCommand': 'Run: gcloud auth login',
+    'new.firebase.create.gcloudMissing': 'The Google Cloud CLI (gcloud) is required to create the Firebase project from scratch, and it is not installed yet. Installing it automatically now.',
     'new.firebase.create.gcloudInstallConfirm': 'Install the Google Cloud CLI (gcloud) automatically now?',
     'new.firebase.create.gcloudInstalling': 'Installing the Google Cloud CLI…',
     'new.firebase.create.gcloudAuthOpening': 'Opening the Google sign-in in your browser — log in with your account…',

package/lib/utils/i18n/messages-es.js

@@ -134,6 +134,7 @@ module.exports = {
     'checks.thenRun': 'Luego ejecuta',
     'checks.recheck': 'Tras instalar {name}, presiona Enter para verificar de nuevo',
     'checks.install.confirm': '¿Instalar {name} ahora? ({cmd})',
+    'checks.install.autoInstalling': '{name} es necesario y aún no está instalado. Lo instalaré automáticamente ahora ({cmd}).',
     'checks.install.flutterWinDesc': 'descarga el SDK oficial de Flutter + Git, ~1,8 GB',
     'checks.install.flutterWinNote': 'Esto puede tardar unos minutos (descarga grande). Si aparece una ventana de permiso de Windows, haz clic en Sí.',
     'checks.install.running': 'Instalando {name}…',
@@ -238,6 +239,7 @@ module.exports = {
     'new.firebase.create.installAfter': 'Luego inicia sesión',
     'new.firebase.create.installUrl': 'O descarga en',
     'new.firebase.create.authCommand': 'Ejecuta: gcloud auth login',
+    'new.firebase.create.gcloudMissing': 'El Google Cloud CLI (gcloud) es necesario para crear el proyecto Firebase desde cero, y aún no está instalado. Lo instalaré automáticamente ahora.',
     'new.firebase.create.gcloudInstallConfirm': '¿Instalar el Google Cloud CLI (gcloud) automáticamente ahora?',
     'new.firebase.create.gcloudInstalling': 'Instalando el Google Cloud CLI…',
     'new.firebase.create.gcloudAuthOpening': 'Abriendo el inicio de sesión de Google en el navegador — entra con tu cuenta…',

package/lib/utils/i18n/messages-pt.js

@@ -134,6 +134,7 @@ module.exports = {
     'checks.thenRun': 'Depois rode',
     'checks.recheck': 'Após instalar {name}, pressione Enter para verificar novamente',
     'checks.install.confirm': 'Instalar {name} agora? ({cmd})',
+    'checks.install.autoInstalling': '{name} é necessário e ainda não está instalado. Vou instalar automaticamente agora ({cmd}).',
     'checks.install.flutterWinDesc': 'baixa o SDK oficial do Flutter + Git, ~1,8 GB',
     'checks.install.flutterWinNote': 'Pode levar alguns minutos (download grande). Se aparecer um popup do Windows pedindo permissão, clique em Sim.',
     'checks.install.running': 'Instalando {name}…',
@@ -238,6 +239,7 @@ module.exports = {
     'new.firebase.create.installAfter': 'Depois faca login',
     'new.firebase.create.installUrl': 'Ou baixe em',
     'new.firebase.create.authCommand': 'Execute: gcloud auth login',
+    'new.firebase.create.gcloudMissing': 'O Google Cloud CLI (gcloud) é necessário para criar o projeto Firebase do zero, e ainda não está instalado. Vou instalar automaticamente agora.',
     'new.firebase.create.gcloudInstallConfirm': 'Instalar o Google Cloud CLI (gcloud) automaticamente agora?',
     'new.firebase.create.gcloudInstalling': 'Instalando o Google Cloud CLI…',
     'new.firebase.create.gcloudAuthOpening': 'Abrindo o login do Google no navegador — entre com a sua conta…',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kasy-cli",
-  "version": "1.26.0",
+  "version": "1.28.0",
   "description": "CLI for scaffolding production-ready Flutter SaaS apps with Firebase, Supabase, or API REST backends.",
   "bin": {
     "kasy": "./bin/kasy.js"

package/templates/firebase/lib/core/bottom_menu/bottom_menu.dart

@@ -227,28 +227,24 @@ class _FocusableSidebarState extends State<_FocusableSidebar> {
 
   @override
   Widget build(BuildContext context) {
-    // Ordered so the first Tab reveals the "skip to content" link (order 0),
-    // then the sidebar (order 1). The header (2) and content (3) come after,
-    // ordered by the scaffold's OrderedTraversalPolicy. The invisible anchor
-    // holds the initial focus so that very first Tab lands on the skip link.
+    // Reading-order group (NOT an ordered policy): this is the exact structure
+    // that made the anchor hold the initial focus. The anchor sits at (0,0) and
+    // is skipped by Tab; the skip link is positioned at the very top, so reading
+    // order makes it the FIRST Tab stop, then the sidebar items, then (via the
+    // scaffold) the header and content. Swapping in an OrderedTraversalPolicy
+    // here broke the anchor, so we keep reading order and rely on position.
     return FocusTraversalGroup(
-      policy: OrderedTraversalPolicy(),
       child: Stack(
         clipBehavior: Clip.none,
         children: [
-          FocusTraversalOrder(
-            order: const NumericFocusOrder(1),
-            child: FocusTraversalGroup(child: widget.child),
-          ),
+          widget.child,
           // Zero-size sibling; only holds the initial keyboard focus.
           Focus(focusNode: _anchor, child: const SizedBox.shrink()),
+          // Topmost on screen, so reading order makes it the first Tab stop.
           Positioned(
             top: KasySpacing.sm,
             left: KasySpacing.sm,
-            child: FocusTraversalOrder(
-              order: const NumericFocusOrder(0),
-              child: _SkipToContentLink(onSkip: _skipToContent),
-            ),
+            child: _SkipToContentLink(onSkip: _skipToContent),
           ),
         ],
       ),

package/templates/firebase/lib/core/web_device_preview/web_device_preview.dart

@@ -104,6 +104,14 @@ class _WebDevicePreviewState extends State<WebDevicePreview>
   late final ValueNotifier<AppLocale> _localeNotifier;
   final _screenshotKey = GlobalKey();
 
+  // Keeps the wrapped app's Element alive across enable/disable. Toggling the
+  // preview moves MaterialApp.router between tree positions (in/out of the
+  // device frame); without a stable GlobalKey the Router would be rebuilt from
+  // scratch and navigation would snap back to the initial route ('/'). The
+  // GlobalKey makes Flutter reparent the same Element, preserving the current
+  // screen.
+  final _appKey = GlobalKey();
+
   static const _textScaleSteps = [1.0, 1.3, 1.5];
 
   List<DeviceInfo> get _devices => switch (_platform) {
@@ -410,7 +418,7 @@ class _WebDevicePreviewState extends State<WebDevicePreview>
             deviceNotifier: _deviceNotifier,
             frameVisibleNotifier: _frameVisibleNotifier,
             landscapeNotifier: _landscapeNotifier,
-            child: widget.child,
+            child: KeyedSubtree(key: _appKey, child: widget.child),
           ),
         ),
       ),