nolo-cli 0.108.0-alpha.1 → 0.108.0

package/{authCommand-YW42YZA4.js → authCommand-GUIREPHK.js}

@@ -1,12 +1,13 @@
-import {
-  defaultOpenBrowser
-} from "./chunk-6D6VBVEW.js";
 import {
   generateCloudflareEmailRoutingToken,
   parseFlagWithOptionalValue,
   runCloudflareOAuthLogin,
   upsertEnvVariable
-} from "./chunk-GPCZ7UXG.js";
+} from "./chunk-ALKCVCA5.js";
+import {
+  defaultOpenBrowser
+} from "./chunk-YVTZMLXZ.js";
+import "./chunk-TY3TIUJK.js";
 import "./chunk-ESHYE7WU.js";
 import {
   ANTHROPIC_OAUTH_AUTHORIZE_URL,
@@ -40,60 +41,73 @@ import {
   generatePkcePair,
   normalizeAnthropicTokenPayload,
   readJsonBody,
+  refreshAntigravityOAuthToken,
   renderDeviceCodeDisplay,
+  resolveServerSyncConfig,
   runAntigravityOAuthLogin,
   runOpenAiCodexBrowserPkce,
   runOpenAiCodexDeviceCode,
   startCallbackServer,
   validateXAIEndpoint,
   xaiOAuthDiscovery
-} from "./chunk-53HEEOTT.js";
+} from "./chunk-OYBAT7RT.js";
+import {
+  t
+} from "./chunk-6CCAXGFK.js";
 import "./chunk-JBTJAPUF.js";
-import "./chunk-2F7RJC6L.js";
-import "./chunk-GLKOYSRU.js";
+import {
+  extractGoogleValidationLink
+} from "./chunk-BMQ2MJUK.js";
+import "./chunk-OW765XBU.js";
 import {
   buildDevinAuthUrl,
   buildDevinOAuthCredential,
   detectLocalDevinCredentials,
-  extractDevinToken
-} from "./chunk-Q5FJJ6XI.js";
+  extractDevinToken,
+  fetchAntigravityCloudCodeCompletion
+} from "./chunk-3SK3J3IF.js";
+import "./chunk-GMZLP5DV.js";
 import "./chunk-5ZUL4CUO.js";
-import "./chunk-UZGQNTVW.js";
-import "./chunk-6OZ36FXI.js";
-import "./chunk-GQBOR3G6.js";
-import "./chunk-OIVSQH2O.js";
-import {
-  createOAuthTokenStore
-} from "./chunk-ONXOABJR.js";
-import "./chunk-W7XHHYWM.js";
-import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
-import {
-  buildEnvFromProfile,
-  getProfileOAuthSync,
-  loadProfileConfig,
-  saveProfileOAuthSync
-} from "./chunk-BYMV6QZG.js";
-import "./chunk-A7GB5UGH.js";
-import "./chunk-OLZBQWZU.js";
-import "./chunk-Q67DOFOO.js";
-import "./chunk-VMFTFOWF.js";
+import "./chunk-RLRYVSCD.js";
+import "./chunk-I42VC5KR.js";
+import "./chunk-U6VC4MU4.js";
+import "./chunk-TSBCYK5F.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
-import "./chunk-QSJ3HFEF.js";
+import "./chunk-KY6GPQ7O.js";
+import "./chunk-NN4UUYGB.js";
+import "./chunk-CGEK73JN.js";
+import "./chunk-W7XHHYWM.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
-import "./chunk-U6VC4MU4.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+import "./chunk-2C47W7IJ.js";
+import "./chunk-GLKOYSRU.js";
+import {
+  parseUserIdFromAuthToken
+} from "./chunk-A7GB5UGH.js";
+import "./chunk-OLZBQWZU.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import "./chunk-CF7PE763.js";
 import "./chunk-G3SUCT4W.js";
+import {
+  getProfileOAuthSync,
+  saveProfileOAuthSync
+} from "./chunk-TNIX77YM.js";
+import "./chunk-SZC4REES.js";
+import "./chunk-QSJ3HFEF.js";
+import {
+  createOAuthTokenStore,
+  resolveFreshAccessToken
+} from "./chunk-ZWQUWF6W.js";
 import "./chunk-4VNS5WPM.js";
 
 // packages/cli/oauth/flows/xai.ts
@@ -759,7 +773,7 @@ This authorizes model API access only. It does NOT log you into the Nolo platfor
 To manage agents, docs, spaces, and other Nolo resources, run "nolo login" first.
 
 Usage:
-  nolo auth antigravity [--browser] [--no-browser] [--sync-to-server] [--help]
+  nolo auth antigravity [--browser] [--no-browser] [--verify] [--sync-to-server] [--help]
 
 Opens a browser to https://accounts.google.com (OIDC PKCE loopback on 127.0.0.1:51121).
 After approval, the flow provisions a Cloud Code Assist project and stores the
@@ -771,6 +785,8 @@ oh-my-pi; Google does not publish a public Cloud Code Assist client registration
 Options:
   --browser         Use the browser PKCE flow (default for antigravity).
   --no-browser      Print the authorization URL only.
+  --verify          Check the current Google one-time verification challenge
+                    and open the validation link in a browser (no re-auth).
 ${SYNC_HELP_LINE}
   --help, -h        Show this help and exit.
 
@@ -889,27 +905,34 @@ var HELP_BY_PROVIDER = {
   cursor: CURSOR_HELP_TEXT,
   devin: DEVIN_HELP_TEXT
 };
-function resolveServerSyncConfig() {
-  const envServer = process.env.NOLO_SERVER?.trim() || process.env.NOLO_SERVER_URL?.trim() || process.env.BASE_URL?.trim() || "";
-  const envToken = process.env.AUTH_TOKEN?.trim() || process.env.NOLO_AUTH_TOKEN?.trim() || "";
-  if (envServer && envToken) {
-    return { serverOrigin: envServer.replace(/\/+$/, ""), authToken: envToken };
-  }
-  let profileServer = "";
-  let profileToken = "";
+function markCredentialServerManaged(provider, credential, syncConfig, deps) {
+  const output = deps.output ?? console;
+  const userId = parseUserIdFromAuthToken(syncConfig.authToken) || "local-user";
   try {
-    const config = loadProfileConfig();
-    const profileEnv = buildEnvFromProfile(config);
-    profileServer = profileEnv.NOLO_SERVER?.trim() || "";
-    profileToken = profileEnv.AUTH_TOKEN?.trim() || "";
-  } catch {
-  }
-  const serverOrigin = (envServer || profileServer).replace(/\/+$/, "");
-  const authToken = envToken || profileToken;
-  if (serverOrigin && authToken) {
-    return { serverOrigin, authToken };
+    const { refreshToken: _dropped, ...rest } = credential;
+    const tokenStore = deps.tokenStore ?? createOAuthTokenStore(
+      void 0,
+      deps.credentialMigration ?? { enableLegacyMigration: true }
+    );
+    tokenStore.write(provider, {
+      ...rest,
+      obtainedAt: credential.obtainedAt ?? Date.now(),
+      serverManaged: {
+        origin: syncConfig.serverOrigin,
+        userId,
+        syncedAt: Date.now()
+      }
+    });
+    output.log(
+      t("auth.localRefreshTokenDropped", provider, syncConfig.serverOrigin)
+    );
+    return true;
+  } catch (err) {
+    output.log(
+      t("auth.localStateUpdateFailed", toErrorMessage(err))
+    );
+    return false;
   }
-  return null;
 }
 async function syncCredentialToServer(provider, credential, deps) {
   const output = deps.output ?? console;
@@ -917,9 +940,9 @@ async function syncCredentialToServer(provider, credential, deps) {
   const syncConfig = (deps.resolveServerSyncConfig ?? resolveServerSyncConfig)();
   if (!syncConfig) {
     output.log(
-      `[nolo] Warning: server sync requires NOLO_SERVER and AUTH_TOKEN env vars, or a configured profile. Skipping server sync.`
+      t("auth.syncMissingConfig")
     );
-    return;
+    return "sync_failed";
   }
   const { serverOrigin, authToken } = syncConfig;
   const url = `${serverOrigin}/api/oauth/${provider}/sync`;
@@ -942,8 +965,13 @@ async function syncCredentialToServer(provider, credential, deps) {
       })
     });
     if (res.ok) {
-      output.log(`[nolo] Synced to ${serverOrigin}`);
-      output.log(`[nolo] \u7F51\u9875\u7AEF\u73B0\u5728\u53EF\u4EE5\u4F7F\u7528\u8BE5\u8BA2\u9605\u4E86\u3002`);
+      const marked = markCredentialServerManaged(provider, credential, syncConfig, deps);
+      if (marked) {
+        output.log(t("auth.syncedTo", serverOrigin));
+        output.log(t("auth.syncDoneWebUsable"));
+        return "ok";
+      }
+      return "mark_failed";
     } else {
       let errorDetail = "";
       try {
@@ -952,13 +980,15 @@ async function syncCredentialToServer(provider, credential, deps) {
       } catch {
       }
       output.log(
-        `[nolo] Warning: server sync failed (${res.status}${errorDetail ? `: ${errorDetail}` : ""}). Token saved locally.`
+        t("auth.syncFailed", `${res.status}${errorDetail ? `: ${errorDetail}` : ""}`)
       );
+      return "sync_failed";
     }
   } catch (err) {
     output.log(
-      `[nolo] Warning: server sync failed (${err?.message ?? "network error"}). Token saved locally.`
+      t("auth.syncFailed", err?.message ?? "network error")
     );
+    return "sync_failed";
   }
 }
 async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
@@ -975,6 +1005,7 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
   const useBrowser = args.includes("--browser");
   const noBrowser = args.includes("--no-browser") || deps.noBrowserByDefault;
   const syncOnly = args.includes("--sync-only");
+  const verify = args.includes("--verify");
   const generateToken = args.includes("--generate-token");
   const writeToEnvRaw = parseFlagWithOptionalValue(args, "--write-to-env");
   const writeToEnvPath = typeof writeToEnvRaw === "string" ? writeToEnvRaw : writeToEnvRaw === true ? ".env" : void 0;
@@ -983,12 +1014,108 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
     const credential = tokenStore.read(provider);
     if (!credential) {
       error.error(
-        `[nolo] No local ${provider} credential. Run: nolo auth ${provider}`
+        t("auth.noLocalCredential", provider)
       );
       return 1;
     }
-    await syncCredentialToServer(provider, credential, deps);
-    return 0;
+    if (credential.serverManaged) {
+      error.error(
+        t(
+          "auth.credentialServerManaged",
+          provider,
+          credential.serverManaged.origin
+        )
+      );
+      return 1;
+    }
+    const synced = await syncCredentialToServer(provider, credential, deps);
+    return synced === "ok" ? 0 : 1;
+  }
+  if (verify) {
+    if (provider !== "antigravity") {
+      error.error(t("auth.verifyUnsupported"));
+      return 1;
+    }
+    const credential = tokenStore.read(provider);
+    if (!credential?.accessToken) {
+      error.error(t("auth.noLocalCredential", provider));
+      return 1;
+    }
+    output.log(
+      t("auth.checkingVerificationChallenge")
+    );
+    let accessToken = null;
+    let refreshError;
+    try {
+      accessToken = await resolveFreshAccessToken({
+        provider,
+        store: tokenStore,
+        refresh: deps.refreshAntigravityToken ?? refreshAntigravityOAuthToken
+      });
+    } catch (err) {
+      refreshError = toErrorMessage(err);
+      if (/invalid_grant|unauthorized_client|revoked|invalid_token|refresh[_ ]token[^.]*(expired|invalid|revoked)|expired[^.]*refresh/i.test(
+        refreshError
+      )) {
+        error.error(
+          t("auth.refreshTokenInvalid", refreshError)
+        );
+        return 1;
+      }
+    }
+    let result;
+    try {
+      result = await fetchAntigravityCloudCodeCompletion({
+        agentConfig: { model: "gemini-3.1-pro" },
+        accessToken: accessToken ?? credential.accessToken,
+        metadata: credential.metadata ?? null,
+        openAiBody: { messages: [{ role: "user", content: "hi" }] },
+        fetchImpl: deps.fetchImpl ?? fetch
+      });
+    } catch (err) {
+      const msg = toErrorMessage(err);
+      if (/projectId|metadata\.projectId|Re-run `nolo auth/i.test(msg)) {
+        error.error(
+          t("auth.credentialIncomplete", msg)
+        );
+      } else {
+        error.error(
+          t("auth.providerUnreachable", msg)
+        );
+      }
+      return 1;
+    }
+    if (result.status >= 200 && result.status < 300) {
+      output.log(
+        t("auth.credentialWorking")
+      );
+      return 0;
+    }
+    const { url: validationUrl } = extractGoogleValidationLink(
+      JSON.stringify(result.body ?? {})
+    );
+    if (result.status === 403 && validationUrl) {
+      output.log(
+        t("auth.googleVerificationRequired", credential.accountId ?? "this account")
+      );
+      output.log(`[nolo]   ${validationUrl}`);
+      const opener = noBrowser ? void 0 : deps.openBrowser ?? defaultOpenBrowser;
+      const opened = opener ? await opener(validationUrl) : false;
+      output.log(
+        opened ? t("auth.verificationOpened") : t("auth.verificationCopyUrl", credential.accountId ?? "that account")
+      );
+      return 0;
+    }
+    const refreshSuffix = refreshError ? t("auth.httpWithoutVerificationLink.refreshSuffix", refreshError) : "";
+    error.error(
+      t(
+        "auth.httpWithoutVerificationLink",
+        String(result.status),
+        refreshSuffix,
+        JSON.stringify(result.body ?? {}).slice(0, 400)
+      )
+    );
+    return 1;
   }
   const flowDeps = {
     ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
@@ -1033,10 +1160,12 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
           fetchImpl: deps.fetchImpl ?? fetch
         });
         output.log(
-          `[nolo] Generated Cloudflare API token for zone ${zoneName} (${zoneId}).
-Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
-  ${token}
-`
+          t(
+            "auth.cloudflareTokenGenerated",
+            zoneName,
+            zoneId,
+            token
+          )
         );
         if (writeToEnvPath) {
           upsertEnvVariable(
@@ -1045,7 +1174,7 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
             token
           );
           output.log(
-            `[nolo] Updated ${writeToEnvPath} with CLOUDFLARE_EMAIL_ROUTING_API_TOKEN.`
+            t("auth.envUpdated", writeToEnvPath)
           );
         }
       }
@@ -1055,7 +1184,11 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
     tokenStore.write(provider, credential);
     const accountLabel = credential.metadata?.email ?? credential.accountId ?? "";
     output.log(
-      `[nolo] ${provider} authorization saved` + (accountLabel ? ` for ${accountLabel}` : "") + `.`
+      t(
+        "auth.authorizationSaved",
+        provider,
+        accountLabel ? t("auth.authorizationSavedForAccount", accountLabel) : ""
+      )
     );
     const hasExplicitNoSync = args.includes("--no-sync-to-server");
     const hasExplicitSync = args.includes("--sync-to-server");
@@ -1084,12 +1217,16 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
         if (!syncConfig) {
           shouldSync = false;
           output.log(
-            `[nolo] \u672A\u914D\u7F6E\u670D\u52A1\u5668\u3002\u5982\u9700\u5728\u7F51\u9875\u7AEF\u4F7F\u7528\uFF0C\u8BF7\u5148\u8FD0\u884C nolo login\uFF0C\u518D\u8FD0\u884C nolo auth ${provider} --sync-only`
+            t("auth.noServerConfigured", provider)
           );
         } else {
           const isTTY = typeof deps.isTTY === "function" ? deps.isTTY() : deps.isTTY ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
           if (isTTY) {
-            const question = `\u540C\u6B65\u5230 ${syncConfig.serverOrigin}\uFF0C\u8BA9\u7F51\u9875\u7AEF\u4E5F\u80FD\u4F7F\u7528\u8FD9\u4E2A ${provider} \u8BA2\u9605\uFF1F\u51ED\u8BC1\u52A0\u5BC6\u5B58\u50A8\uFF0C\u53EF\u968F\u65F6 nolo auth ${provider} --no-sync-to-server \u5173\u95ED [Y/n] `;
+            const question = t(
+              "auth.syncPrompt",
+              syncConfig.serverOrigin,
+              provider
+            );
             let answer;
             if (deps.promptOAuthSync) {
               answer = await deps.promptOAuthSync(question);
@@ -1117,19 +1254,23 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
           } else {
             shouldSync = false;
             output.log(
-              `[nolo] \u672A\u540C\u6B65\u51ED\u636E\u5230\u670D\u52A1\u5668\u3002\u5982\u9700\u7F51\u9875\u7AEF\u4F7F\u7528\uFF0C\u8BF7\u8FD0\u884C: nolo auth ${provider} --sync-to-server\uFF08\u6216 --sync-only\uFF09`
+              t("auth.notSyncedToServer", provider)
             );
           }
         }
       }
     }
     if (shouldSync) {
-      await syncCredentialToServer(provider, credential, deps);
+      const syncResult = await syncCredentialToServer(provider, credential, deps);
+      if (syncResult === "mark_failed") {
+        error.error(t("auth.markFailed"));
+        return 1;
+      }
     }
     return 0;
   } catch (err) {
     error.error(
-      `nolo auth ${provider} failed: ${toErrorMessage(err)}`
+      t("auth.commandFailed", provider, toErrorMessage(err))
     );
     return 1;
   }

package/{authCommands-RGOGCPP6.js → authCommands-K3BDSTJ4.js}

@@ -7,22 +7,25 @@ import {
   runLogoutCommand,
   runWhoamiCommand,
   saveTokenLogin
-} from "./chunk-6D6VBVEW.js";
+} from "./chunk-YVTZMLXZ.js";
+import "./chunk-TY3TIUJK.js";
 import "./chunk-ESHYE7WU.js";
 import "./chunk-JBTJAPUF.js";
-import "./chunk-2F7RJC6L.js";
+import "./chunk-OW765XBU.js";
+import "./chunk-RLRYVSCD.js";
+import "./chunk-I42VC5KR.js";
+import "./chunk-U6VC4MU4.js";
+import "./chunk-WWC7I6TA.js";
+import "./chunk-3EUW3WEO.js";
+import "./chunk-2C47W7IJ.js";
 import "./chunk-GLKOYSRU.js";
-import "./chunk-BYMV6QZG.js";
 import "./chunk-A7GB5UGH.js";
 import "./chunk-OLZBQWZU.js";
-import "./chunk-VMFTFOWF.js";
-import "./chunk-WWC7I6TA.js";
-import "./chunk-3EUW3WEO.js";
-import "./chunk-U6VC4MU4.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import "./chunk-CF7PE763.js";
 import "./chunk-G3SUCT4W.js";
+import "./chunk-TNIX77YM.js";
 import "./chunk-4VNS5WPM.js";
 export {
   LOGIN_HELP_TEXT,

package/{builtinSkillRegistry-FUAVTRVZ.js → builtinSkillRegistry-MUOUTRNJ.js}

@@ -7,19 +7,22 @@ import {
   resolveBuiltinSkillEntry,
   resolveBuiltinSkillPage,
   resolveBuiltinSkillSlug
-} from "./chunk-JRQFUXY7.js";
-import "./chunk-DHDMC6FO.js";
-import "./chunk-Q554LLSI.js";
-import "./chunk-KHCLMKZZ.js";
-import "./chunk-O6OSWFZQ.js";
-import "./chunk-QDSINZM3.js";
-import "./chunk-VMFTFOWF.js";
-import "./chunk-WWC7I6TA.js";
-import "./chunk-BNGW5ASC.js";
+} from "./chunk-RRQQAG7W.js";
+import "./chunk-3CZM6HGQ.js";
+import "./chunk-IXH3HKY2.js";
+import "./chunk-XETG4RIX.js";
+import "./chunk-OKARGYFT.js";
+import "./chunk-IHPDK6UD.js";
+import "./chunk-LWLNLZC5.js";
+import "./chunk-3LI5UCTU.js";
 import "./chunk-M2EJHDJP.js";
-import "./chunk-3EUW3WEO.js";
+import "./chunk-RLRYVSCD.js";
+import "./chunk-I42VC5KR.js";
 import "./chunk-U6VC4MU4.js";
+import "./chunk-WWC7I6TA.js";
+import "./chunk-3EUW3WEO.js";
 import "./chunk-G3SUCT4W.js";
+import "./chunk-KHCLMKZZ.js";
 import "./chunk-4VNS5WPM.js";
 export {
   CAPABILITY_SLUG_COLLISIONS,