nolo-cli 0.108.0-alpha.1 → 0.108.0

package/{chunk-JEDZAO7L.js → chunk-YBNHPX4S.js}

@@ -1,9 +1,3 @@
-import {
-  loadProfileConfig
-} from "./chunk-BYMV6QZG.js";
-import {
-  resolveDefaultSpawn
-} from "./chunk-X7HHHIOZ.js";
 import {
   isCompiledBinary
 } from "./chunk-A7GB5UGH.js";
@@ -13,6 +7,12 @@ import {
 import {
   normalizeServerOrigin
 } from "./chunk-CF7PE763.js";
+import {
+  loadProfileConfig
+} from "./chunk-TNIX77YM.js";
+import {
+  resolveDefaultSpawn
+} from "./chunk-Y6ROFCZO.js";
 
 // packages/cli/updateCommands.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, accessSync, constants } from "node:fs";
@@ -30,6 +30,7 @@ import {
   readFileSync,
   renameSync,
   rmSync,
+  statSync,
   writeSync,
   writeFileSync
 } from "node:fs";
@@ -38,6 +39,7 @@ import { dirname, isAbsolute, join, normalize } from "node:path";
 import { randomUUID } from "node:crypto";
 var UPDATE_STATE_FILE = "update-result.json";
 var UPDATE_STALE_MS = 15 * 60 * 1e3;
+var UPDATE_CORRUPT_MAX_AGE_MS = 30 * 60 * 1e3;
 var UPDATE_LOCK_FILE = "update.lock";
 function resolveNoloHome(env, homeDir = homedir()) {
   return env.NOLO_HOME?.trim() || join(homeDir, ".nolo");
@@ -101,6 +103,39 @@ function readWindowsUpdateState(env = process.env, homeDir = homedir()) {
     return null;
   }
 }
+function assessWindowsUpdatePending(state, now, statePath) {
+  const startedAtMs = Date.parse(state.startedAt);
+  const MAX_CLOCK_SKEW_MS = 5 * 60 * 1e3;
+  if (Number.isFinite(startedAtMs) && startedAtMs - now <= MAX_CLOCK_SKEW_MS) {
+    const ageMs = now - startedAtMs;
+    const stale = ageMs >= UPDATE_STALE_MS;
+    return {
+      classification: stale ? "stale" : "active",
+      ageMs,
+      startedAtUsable: true,
+      blocksStartup: !stale
+    };
+  }
+  let mtimeAge = Number.NaN;
+  try {
+    mtimeAge = now - statSync(statePath).mtimeMs;
+  } catch {
+  }
+  if (!Number.isFinite(mtimeAge) || mtimeAge < UPDATE_CORRUPT_MAX_AGE_MS) {
+    return {
+      classification: "corrupt-unageable",
+      ageMs: mtimeAge,
+      startedAtUsable: false,
+      blocksStartup: true
+    };
+  }
+  return {
+    classification: "stale",
+    ageMs: mtimeAge,
+    startedAtUsable: false,
+    blocksStartup: false
+  };
+}
 function consumeWindowsUpdateStartupNotice(env = process.env, options = {}) {
   const homeDir = options.homeDir ?? homedir();
   const statePath = resolveWindowsUpdateStatePath(env, homeDir);
@@ -110,26 +145,35 @@ function consumeWindowsUpdateStartupNotice(env = process.env, options = {}) {
     if (options.ownerUpdateId && state.updateId && options.ownerUpdateId === state.updateId) {
       return null;
     }
-    const startedAt = Date.parse(state.startedAt);
-    const age = (options.now ?? Date.now()) - startedAt;
-    if (!Number.isFinite(age) || age < UPDATE_STALE_MS) {
+    const now = options.now ?? Date.now();
+    const assessment = assessWindowsUpdatePending(state, now, statePath);
+    if (assessment.blocksStartup) {
       return {
         blocking: true,
-        text: `Nolo update is still running. Try again shortly.
+        text: `A Nolo update may still be in progress (${describeUpdatePhase(state)}). Run "nolo update status" for details, or retry shortly.
 Log: ${state.logPath}`
       };
     }
     if (state.lockPath && state.updateId) {
       removeOwnedLock(state.lockPath, state.updateId);
     }
-    rmSync(statePath, { force: true });
     return {
       blocking: false,
-      text: `The previous Nolo update helper stopped unexpectedly. Verify with "nolo -v"; a manual npm repair may be required.
+      text: `The previous Nolo update helper stopped unexpectedly and its lock was released. Verify with "nolo -v" / "nolo update status"; a manual npm repair may be required.
 Log: ${state.logPath}`
     };
   }
-  rmSync(statePath, { force: true });
+  if (state.noticeAcknowledgedAt) {
+    return null;
+  }
+  const acknowledged = {
+    ...state,
+    noticeAcknowledgedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  try {
+    writeJsonAtomic(statePath, acknowledged);
+  } catch {
+  }
   if (state.status === "success") {
     return {
       blocking: false,
@@ -144,6 +188,82 @@ ${state.message}` : ""}
 Log: ${state.logPath}`
   };
 }
+function describeUpdatePhase(state) {
+  if (state.phase) {
+    return `phase: ${state.phase}`;
+  }
+  return "helper running";
+}
+function getWindowsUpdateStatus(env = process.env, options = {}) {
+  const homeDir = options.homeDir ?? homedir();
+  const state = readWindowsUpdateState(env, homeDir);
+  const now = options.now ?? Date.now();
+  const version = options.currentVersion ?? "unknown";
+  if (!state) {
+    return {
+      status: "none",
+      alive: false,
+      text: `No recorded Nolo update.
+Installed version: ${version}`
+    };
+  }
+  const lines = [];
+  lines.push(`Update status: ${state.status}`);
+  lines.push(`Installed version: ${version}`);
+  lines.push(`Channel: ${state.channel}`);
+  lines.push(`From version: ${state.currentVersion}`);
+  if (state.targetVersion) lines.push(`Target version: ${state.targetVersion}`);
+  if (state.phase) lines.push(`Phase: ${state.phase}`);
+  lines.push(`Started: ${state.startedAt}`);
+  if (state.phaseStartedAt) lines.push(`Phase started: ${state.phaseStartedAt}`);
+  if (state.phaseDeadline) lines.push(`Phase deadline: ${state.phaseDeadline}`);
+  if (state.finishedAt) lines.push(`Finished: ${state.finishedAt}`);
+  if (state.helperPid) lines.push(`Helper pid: ${state.helperPid}`);
+  if (state.message) lines.push(`Message: ${state.message}`);
+  lines.push(`Log: ${state.logPath}`);
+  if (state.status === "pending") {
+    const statePath = resolveWindowsUpdateStatePath(env, homeDir);
+    const assessment = assessWindowsUpdatePending(state, now, statePath);
+    const deadline = state.phaseDeadline ? Date.parse(state.phaseDeadline) : NaN;
+    const pastDeadline = Number.isFinite(deadline) && now > deadline;
+    if (pastDeadline) {
+      lines.push(
+        `Phase deadline elapsed: the recorded phase has run past its soft ceiling. This can be a hung helper, but it can also be a slow install \u2014 the lock is NOT auto-released on this evidence alone.`
+      );
+    }
+    switch (assessment.classification) {
+      case "active":
+        lines.push(
+          `Diagnosis: update record is fresh (${describeUpdatePhase(state)}). The helper process has not been verified alive; the record simply has not outlived its bound, so startup is still blocked.`
+        );
+        break;
+      case "corrupt-unageable":
+        lines.push(
+          `Diagnosis: update record has an unreadable start time and cannot be aged reliably. Startup stays conservatively blocked until the record outlives its hard bound; inspect the log to tell a hung helper from a live one.`
+        );
+        break;
+      case "stale":
+        lines.push(
+          `Diagnosis: update record has outlived its bound; the helper is presumed stopped. The startup guard releases the stale lock on next start, then this record remains here for diagnosis.`
+        );
+        break;
+    }
+    return {
+      status: "pending",
+      alive: assessment.blocksStartup,
+      pendingClassification: assessment.classification,
+      text: lines.join("\n")
+    };
+  }
+  if (state.status === "success") {
+    lines.push(
+      state.noticeAcknowledgedAt ? `Diagnosis: update applied and already acknowledged.` : `Diagnosis: update applied; notice pending on next start.`
+    );
+  } else {
+    lines.push(`Diagnosis: update failed; see the log above.`);
+  }
+  return { status: state.status, alive: false, text: lines.join("\n") };
+}
 function defaultLaunchWindowsUpdateHelper(input) {
   const child = spawn(input.execPath, [input.helperPath, input.payload], {
     detached: true,
@@ -172,6 +292,19 @@ const writeState = (next) => {
   writeFileSync(temp, JSON.stringify(next, null, 2) + "\n", "utf8");
   renameSync(temp, payload.statePath);
 };
+// Record the current helper step with a bounded wall-clock deadline so the
+// startup guard can tell a live phase from a hung one. Deadline is a soft
+// ceiling: a phase that overruns it is reported stale, not killed.
+const setPhase = (base, phase, budgetMs) => {
+  const phaseStartedAt = new Date().toISOString();
+  const phaseDeadline = new Date(Date.now() + budgetMs).toISOString();
+  try {
+    writeState({ ...base, status: "pending", phase, phaseStartedAt, phaseDeadline });
+  } catch (error) {
+    log("Could not persist phase " + phase + ": " + (error && error.message ? error.message : String(error)));
+  }
+  return { ...base, status: "pending", phase, phaseStartedAt, phaseDeadline };
+};
 const runNpm = (args) => {
   const command = [payload.nodePath, payload.npmCliPath, ...args].join(" ");
   log("> " + command);
@@ -229,6 +362,27 @@ const isWithin = (root, candidate) => {
 const quoteCmd = (value) => '"' + String(value).replace(/"/g, '""') + '"';
 const quotePowerShell = (value) => "'" + String(value).replace(/'/g, "''") + "'";
 const quoteSh = (value) => "'" + String(value).replace(/'/g, "'\\''") + "'";
+
+let stagedDirReferenced = false;
+let lockOwnershipLost = false;
+let shimLeftUnrestored = false;
+
+const assertLockOwnership = () => {
+  try {
+    if (!existsSync(payload.lockPath)) {
+      throw new Error("Update lock was released or removed; aborting to avoid racing another process");
+    }
+    const raw = readFileSync(payload.lockPath, "utf8").trim();
+    const owner = raw.startsWith("{") ? JSON.parse(raw).updateId : raw;
+    if (owner !== payload.updateId) {
+      throw new Error("Update lock was reclaimed by " + owner + "; aborting to avoid racing another updater");
+    }
+  } catch (e) {
+    lockOwnershipLost = true;
+    throw new Error("Lock ownership check failed: " + (e && e.message ? e.message : String(e)));
+  }
+};
+
 const switchWindowsShims = (shimDir, entrypoint) => {
   const shims = [
     { path: join(shimDir, "nolo.cmd"), content: "@ECHO off\r\n" + quoteCmd(payload.nodePath) + " " + quoteCmd(entrypoint) + " %*\r\n" },
@@ -243,14 +397,45 @@ const switchWindowsShims = (shimDir, entrypoint) => {
     return { ...shim, temp, backup, existed: existsSync(shim.path) };
   });
   const activated = [];
+  const attemptRollback = () => {
+    let allRestored = true;
+    for (const shim of [...activated].reverse()) {
+      try { rmSync(shim.path, { force: true }); } catch (e) {
+        log("CRITICAL: Failed to remove new shim " + shim.path + ": " + (e && e.message ? e.message : String(e)));
+      }
+      if (shim.existed) {
+        try {
+          renameSync(shim.backup, shim.path);
+        } catch (e) {
+          allRestored = false;
+          log("CRITICAL: Failed to restore backup shim for " + shim.path + ": " + (e && e.message ? e.message : String(e)));
+        }
+      } else if (existsSync(shim.path)) {
+        // The delete above did not remove this shim (locked file, ACL, ...).
+        // It still points at the staged directory, so the rollback is NOT clean.
+        allRestored = false;
+        log("CRITICAL: New shim still present after rollback attempt: " + shim.path);
+      }
+    }
+    for (const shim of prepared) try { rmSync(shim.temp, { force: true }); } catch {}
+    stagedDirReferenced = !allRestored;
+    return allRestored;
+  };
+
   try {
     for (const shim of prepared) {
       if (shim.existed) renameSync(shim.path, shim.backup);
       try {
         renameSync(shim.temp, shim.path);
+        stagedDirReferenced = true;
       } catch (error) {
         if (shim.existed) {
-          try { renameSync(shim.backup, shim.path); } catch {}
+          try {
+            renameSync(shim.backup, shim.path);
+          } catch (restoreErr) {
+            shimLeftUnrestored = true;
+            log("CRITICAL: Failed to restore backup shim for " + shim.path + ": " + (restoreErr && restoreErr.message ? restoreErr.message : String(restoreErr)));
+          }
         }
         throw error;
       }
@@ -258,22 +443,19 @@ const switchWindowsShims = (shimDir, entrypoint) => {
       activated.push(shim);
     }
   } catch (error) {
-    for (const shim of [...activated].reverse()) {
-      try { rmSync(shim.path, { force: true }); } catch {}
-      if (shim.existed) {
-        try { renameSync(shim.backup, shim.path); } catch {}
+    if (!attemptRollback() || shimLeftUnrestored) {
+      if (error && typeof error === "object") {
+        error.message = (error.message ? error.message : String(error)) + "; rollback incomplete";
       }
+      log("CRITICAL: Rollback incomplete while switching launch shims");
     }
-    for (const shim of prepared) try { rmSync(shim.temp, { force: true }); } catch {}
     throw error;
   }
   return {
     rollback: () => {
-      for (const shim of [...activated].reverse()) {
-        try { rmSync(shim.path, { force: true }); } catch {}
-        if (shim.existed) {
-          try { renameSync(shim.backup, shim.path); } catch {}
-        }
+      const restored = attemptRollback();
+      if (!restored) {
+        throw new Error("Rollback incomplete: one or more launch shims could not be restored or removed");
       }
     },
     commit: () => {
@@ -296,7 +478,9 @@ const switchWindowsShims = (shimDir, entrypoint) => {
     updateId: payload.updateId,
     lockPath: payload.lockPath,
   };
+  let progress = base;
   try {
+    progress = setPhase(base, "wait-parent-exit", 480 * 250 + 60 * 1000);
     log("Waiting for parent process " + payload.parentPid + " to exit");
     let parentExited = false;
     for (let waited = 0; waited < 480; waited++) {
@@ -306,6 +490,7 @@ const switchWindowsShims = (shimDir, entrypoint) => {
     if (!parentExited) throw new Error("Timed out waiting for the current Nolo process to exit");
     await delay(250);
 
+    progress = setPhase(progress, "wait-other-windows", 120 * 1000 + 30 * 1000);
     const otherProcessDeadline = Date.now() + 120 * 1000;
     let otherPids = listOtherNoloPids();
     let checks = 0;
@@ -319,6 +504,7 @@ const switchWindowsShims = (shimDir, entrypoint) => {
       throw new Error("Other Nolo processes are still running: " + otherPids.join(", "));
     }
 
+    progress = setPhase(progress, "resolve-prefix", 30 * 1000);
     const prefixResult = runNpm(["prefix", "-g"]);
     if (prefixResult.code !== 0 || !prefixResult.stdout) throw new Error("Could not resolve npm global prefix");
     const prefix = prefixResult.stdout.split(/\r?\n/).at(-1).trim();
@@ -329,6 +515,7 @@ const switchWindowsShims = (shimDir, entrypoint) => {
       throw new Error("Refusing to update a different npm prefix. Current entrypoint: " + payload.entrypointPath + "; npm prefix: " + prefix);
     }
 
+    progress = setPhase(progress, "resolve-target-version", 30 * 1000);
     const targetResult = runNpm(["view", "nolo-cli@" + payload.channel, "version"]);
     if (targetResult.code !== 0 || !parseVersion(targetResult.stdout)) {
       throw new Error("Could not resolve nolo-cli@" + payload.channel + " target version");
@@ -339,10 +526,13 @@ const switchWindowsShims = (shimDir, entrypoint) => {
     }
 
     if (compare(targetVersion, payload.currentVersion) > 0) {
+      progress = setPhase(progress, "install-target", 5 * 60 * 1000 + 30 * 1000);
       const versionPrefix = join(payload.managedRoot, targetVersion + "-" + payload.updateId);
       uncommittedVersionPrefix = versionPrefix;
       mkdirSync(versionPrefix, { recursive: true });
-      const install = runNpm(["install", "-g", "--prefix", versionPrefix, "nolo-cli@" + payload.channel, "--force", "--progress"]);
+      // Install the exact version resolved from the dist-tag above — never the
+      // floating channel tag — so the staged package is the verified one.
+      const install = runNpm(["install", "-g", "--prefix", versionPrefix, "nolo-cli@" + targetVersion, "--force", "--progress"]);
       if (install.code !== 0) throw new Error("npm install exited with code " + install.code);
       const stagedPackagePath = join(versionPrefix, "node_modules", "nolo-cli", "package.json");
       const staged = JSON.parse(readFileSync(stagedPackagePath, "utf8"));
@@ -351,6 +541,8 @@ const switchWindowsShims = (shimDir, entrypoint) => {
       }
       const stagedEntrypoint = join(versionPrefix, "node_modules", "nolo-cli", "index.js");
       if (!existsSync(stagedEntrypoint)) throw new Error("Staged nolo entrypoint is missing");
+      assertLockOwnership();
+      progress = setPhase(progress, "switch-shims", 60 * 1000);
       const switchedShims = switchWindowsShims(prefix, stagedEntrypoint);
       const verify = spawnSync(payload.nodePath, [stagedEntrypoint, "-v"], {
         encoding: "utf8",
@@ -360,29 +552,51 @@ const switchWindowsShims = (shimDir, entrypoint) => {
         timeout: 30 * 1000,
       });
       if (verify.error || verify.status !== 0 || !String(verify.stdout || "").includes(targetVersion)) {
-        switchedShims.rollback();
+        let rollbackError = null;
+        try {
+          switchedShims.rollback();
+        } catch (e) {
+          rollbackError = e;
+        }
+        if (rollbackError) {
+          throw new Error(
+            "The staged CLI failed its post-switch version check; " +
+              (rollbackError && rollbackError.message ? rollbackError.message : String(rollbackError)),
+          );
+        }
         throw new Error("The staged CLI failed its post-switch version check; the previous launch shims were restored");
       }
+      // The lock could have been reclaimed (stale timeout / competing updater)
+      // during the verify window. Re-check before committing so we never claim
+      // success for an update we no longer own. We deliberately do not roll the
+      // shims back here: a competing updater may be mid-switch, and nothing is
+      // deleted, so leaving our shims in place is recoverable (last writer wins).
+      assertLockOwnership();
       switchedShims.commit();
       uncommittedVersionPrefix = null;
-      for (const entry of readdirSync(payload.managedRoot)) {
-        const candidate = join(payload.managedRoot, entry);
-        if (normalize(candidate) !== normalize(versionPrefix)) {
-          try { rmSync(candidate, { recursive: true, force: true }); } catch {}
-        }
-      }
+      // Previous versions are intentionally retained (unbounded until a
+      // reference-aware cleanup exists) because deleting them risks removing a
+      // directory that a shim or a rolled-back update still references.
       log("Verified nolo-cli " + targetVersion + " at " + stagedEntrypoint);
     } else {
       log("Already current at " + targetVersion);
     }
-    writeState({ ...base, status: "success", targetVersion, finishedAt: new Date().toISOString() });
+    writeState({ ...progress, status: "success", phase: "done", targetVersion, finishedAt: new Date().toISOString() });
   } catch (error) {
     const message = error && error.message ? error.message : String(error);
     log("ERROR: " + message);
     if (uncommittedVersionPrefix) {
-      try { rmSync(uncommittedVersionPrefix, { recursive: true, force: true }); } catch {}
+      if (stagedDirReferenced) {
+        log("PRESERVING staged directory " + uncommittedVersionPrefix + " because launch shims may still reference it; deleting it would cause MODULE_NOT_FOUND");
+      } else {
+        try { rmSync(uncommittedVersionPrefix, { recursive: true, force: true }); } catch {}
+      }
+    }
+    if (lockOwnershipLost) {
+      log("Not writing a failed status record: the update lock belongs to another updater");
+    } else {
+      writeState({ ...progress, status: "failed", finishedAt: new Date().toISOString(), message });
     }
-    writeState({ ...base, status: "failed", finishedAt: new Date().toISOString(), message });
     process.exitCode = 1;
   } finally {
     try {
@@ -679,7 +893,11 @@ async function runShellScript(script, {
   const proc = spawn2({
     cmd: ["sh", "-c", script],
     cwd,
-    stdin: "inherit",
+    // Capture mode (TUI sink): ignore stdin — the TUI's own decoder is
+    // reading the tty, and a child that reads stdin would race it for keys.
+    // The inherit branch is unreachable inside the TUI (useCustomSink is
+    // always true there) and stays the correct choice for `nolo update`.
+    stdin: useCustomSink ? "ignore" : "inherit",
     stdout: useCustomSink ? "pipe" : "inherit",
     stderr: useCustomSink ? "pipe" : "inherit",
     env
@@ -900,7 +1118,8 @@ Nolo Agent CLI Installer & Updater
   const useCustomSink = options.output !== void 0;
   const proc = spawn2({
     cmd: command,
-    stdin: "inherit",
+    // Capture mode (TUI sink): ignore stdin — see runShellScript.
+    stdin: useCustomSink ? "ignore" : "inherit",
     stdout: useCustomSink ? "pipe" : "inherit",
     stderr: useCustomSink ? "pipe" : "inherit",
     env
@@ -936,6 +1155,7 @@ async function runSelfUpdate(outputOrOptions) {
 
 export {
   consumeWindowsUpdateStartupNotice,
+  getWindowsUpdateStatus,
   getCliInstallChannel,
   renderProgressBar,
   buildNpmSelfUpdateCommand,

package/{chunk-JPGCXHNM.js → chunk-YLMMECCH.js}

@@ -1,6 +1,6 @@
 import {
   buildSkillDocMarkdown
-} from "./chunk-Q554LLSI.js";
+} from "./chunk-XETG4RIX.js";
 
 // packages/cli/docPageHelpers.ts
 import { readFileSync } from "node:fs";

package/{chunk-CSC3CU4K.js → chunk-YSZQSZR2.js}

@@ -1,21 +1,28 @@
 import {
-  clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-BVGTK7MR.js";
+  refreshSubscriptionQuotas
+} from "./chunk-U4STABYN.js";
 import {
   getReadableCliDb
-} from "./chunk-LS2ZANRJ.js";
+} from "./chunk-V6WXGTUJ.js";
 import {
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord,
   normalizeAgentRecordForOutput,
   parseAgentUpdateArgs,
+  refreshAgentRecordCache,
   resolveAgentRecordFromHybridStore,
   sanitizeAgentRecordForCliOutput,
   writeAgentRecord
-} from "./chunk-AEOE4Z6Q.js";
+} from "./chunk-A337PRRR.js";
+import {
+  clearCliLocalRuntimePreparedAgentCache
+} from "./chunk-QH2QSBGP.js";
+import {
+  readCredentialAvailability
+} from "./chunk-6MXDOUMH.js";
 import {
   resolveCliAgentKeyInput
-} from "./chunk-SV5IJK6K.js";
+} from "./chunk-NBTY7YJF.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -67,8 +74,32 @@ async function runAgentReadCommand(args, deps = {}) {
     if (!result) {
       throw new Error(`agent not found: ${agentKey}`);
     }
+    const rawRecord = result.record;
+    const recordQuota = rawRecord?.quota;
+    const hasSubscriptionCredential = typeof rawRecord?.apiKeyRef === "string" && rawRecord.apiKeyRef.trim() !== "";
+    const fresh = hasSubscriptionCredential ? await refreshSubscriptionQuotas({
+      entries: [{ key: result.agentKey, ...recordQuota ? { quota: recordQuota } : {} }],
+      onlyKeys: [result.agentKey],
+      env,
+      cliArgs: args,
+      fetchImpl
+    }) : {};
+    const quota = fresh[result.agentKey] ?? recordQuota;
+    const rawRecordObj = result.record;
+    const credAvail = await readCredentialAvailability(env).catch(() => ({}));
+    const credGroup = typeof rawRecordObj?.apiKeyRef === "string" ? rawRecordObj.apiKeyRef : void 0;
+    const credDeadline = credGroup ? credAvail[credGroup] : void 0;
+    const recordDeadline = typeof rawRecordObj?.nextAvailableAt === "number" ? rawRecordObj.nextAvailableAt : void 0;
+    const effectiveNextAvailableAt = Math.max(recordDeadline ?? 0, credDeadline ?? 0) || void 0;
+    const isRateLimited = typeof effectiveNextAvailableAt === "number" && effectiveNextAvailableAt > Date.now();
     output.write(JSON.stringify({
       ...normalizeAgentRecordForOutput(result.agentKey, authToken, result.record),
+      ...isRateLimited ? {
+        rateLimited: true,
+        cooldownRemainingSeconds: Math.ceil((effectiveNextAvailableAt - Date.now()) / 1e3),
+        nextAvailableAt: new Date(effectiveNextAvailableAt).toISOString()
+      } : {},
+      ...quota ? { quota } : {},
       source: result.source
     }, null, 2));
     output.write("\n");
@@ -130,10 +161,10 @@ async function runAgentUpdateCommand(args, deps = {}) {
       userId,
       record: built.nextRecord
     });
-    await db.put(built.agentKey, {
-      ...built.nextRecord,
-      dbKey: built.agentKey,
-      key: built.nextRecord?.key || built.agentKey,
+    await refreshAgentRecordCache({
+      db,
+      agentKey: built.agentKey,
+      record: built.nextRecord,
       serverOrigin: built.serverUrl
     });
     clearCliLocalRuntimePreparedAgentCache();
@@ -212,7 +243,7 @@ async function runAgentCreateCommand(args, deps = {}) {
     clearCliLocalRuntimePreparedAgentCache();
     let verifyResult;
     if (parsed.verify) {
-      const { verifyCustomProvider } = await import("./agentProviderCommands-GNPTL5XR.js");
+      const { verifyCustomProvider } = await import("./agentProviderCommands-7PCGR77I.js");
       const rec = built.nextRecord;
       verifyResult = await verifyCustomProvider({
         providerUrl: rec.customProviderUrl,
@@ -222,15 +253,34 @@ async function runAgentCreateCommand(args, deps = {}) {
         fetchImpl
       });
     }
+    const apiKeyRef = String(built.updates?.apiKeyRef || "").trim();
+    let authHint;
+    const OAUTH_REFS = /* @__PURE__ */ new Set(["claude", "chatgpt", "xai", "antigravity", "cloudflare"]);
+    if (apiKeyRef && OAUTH_REFS.has(apiKeyRef)) {
+      try {
+        const { createOAuthTokenStore } = await import("./oauthTokenStore-PADKLNOC.js");
+        const store = createOAuthTokenStore();
+        if (!store.read(apiKeyRef)) {
+          authHint = `Subscription "${apiKeyRef}" is not authorized yet. Run \`nolo auth ${apiKeyRef}\` to log in.`;
+        }
+      } catch {
+      }
+    }
     output.write(JSON.stringify({
       ok: true,
       agentKey: built.agentKey,
       baseUrl: built.serverUrl,
       updates: sanitizeAgentRecordForCliOutput(built.updates),
       record: sanitizeAgentRecordForCliOutput(built.nextRecord),
-      ...verifyResult ? { verify: verifyResult } : {}
+      ...verifyResult ? { verify: verifyResult } : {},
+      ...authHint ? { hint: authHint } : {}
     }, null, 2));
     output.write("\n");
+    if (authHint) {
+      const errorOutput = deps.error ?? process.stderr;
+      errorOutput.write(`[nolo] Hint: ${authHint}
+`);
+    }
     return 0;
   } catch (error) {
     output.write(