nolo-cli 0.108.0-alpha.2 → 0.108.0

package/{authCommand-HGP2XTKC.js → authCommand-GUIREPHK.js}

@@ -1,12 +1,13 @@
-import {
-  defaultOpenBrowser
-} from "./chunk-6D6VBVEW.js";
 import {
   generateCloudflareEmailRoutingToken,
   parseFlagWithOptionalValue,
   runCloudflareOAuthLogin,
   upsertEnvVariable
-} from "./chunk-LJ5VW2UJ.js";
+} from "./chunk-ALKCVCA5.js";
+import {
+  defaultOpenBrowser
+} from "./chunk-YVTZMLXZ.js";
+import "./chunk-TY3TIUJK.js";
 import "./chunk-ESHYE7WU.js";
 import {
   ANTHROPIC_OAUTH_AUTHORIZE_URL,
@@ -42,65 +43,71 @@ import {
   readJsonBody,
   refreshAntigravityOAuthToken,
   renderDeviceCodeDisplay,
+  resolveServerSyncConfig,
   runAntigravityOAuthLogin,
   runOpenAiCodexBrowserPkce,
   runOpenAiCodexDeviceCode,
   startCallbackServer,
   validateXAIEndpoint,
   xaiOAuthDiscovery
-} from "./chunk-Z5625XML.js";
+} from "./chunk-OYBAT7RT.js";
+import {
+  t
+} from "./chunk-6CCAXGFK.js";
 import "./chunk-JBTJAPUF.js";
 import {
   extractGoogleValidationLink
 } from "./chunk-BMQ2MJUK.js";
-import "./chunk-2F7RJC6L.js";
-import "./chunk-GLKOYSRU.js";
+import "./chunk-OW765XBU.js";
 import {
   buildDevinAuthUrl,
   buildDevinOAuthCredential,
   detectLocalDevinCredentials,
   extractDevinToken,
   fetchAntigravityCloudCodeCompletion
-} from "./chunk-FV3JEYR3.js";
+} from "./chunk-3SK3J3IF.js";
 import "./chunk-GMZLP5DV.js";
 import "./chunk-5ZUL4CUO.js";
-import "./chunk-GNCCNNZD.js";
-import "./chunk-6OZ36FXI.js";
-import "./chunk-GQBOR3G6.js";
-import "./chunk-OIVSQH2O.js";
-import {
-  createOAuthTokenStore,
-  resolveFreshAccessToken
-} from "./chunk-ONXOABJR.js";
-import "./chunk-W7XHHYWM.js";
-import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
-import {
-  buildEnvFromProfile,
-  getProfileOAuthSync,
-  loadProfileConfig,
-  saveProfileOAuthSync
-} from "./chunk-BYMV6QZG.js";
-import "./chunk-A7GB5UGH.js";
-import "./chunk-OLZBQWZU.js";
-import "./chunk-Q67DOFOO.js";
-import "./chunk-VMFTFOWF.js";
+import "./chunk-RLRYVSCD.js";
+import "./chunk-I42VC5KR.js";
+import "./chunk-U6VC4MU4.js";
+import "./chunk-TSBCYK5F.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
-import "./chunk-QSJ3HFEF.js";
+import "./chunk-KY6GPQ7O.js";
+import "./chunk-NN4UUYGB.js";
+import "./chunk-CGEK73JN.js";
+import "./chunk-W7XHHYWM.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
-import "./chunk-U6VC4MU4.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+import "./chunk-2C47W7IJ.js";
+import "./chunk-GLKOYSRU.js";
+import {
+  parseUserIdFromAuthToken
+} from "./chunk-A7GB5UGH.js";
+import "./chunk-OLZBQWZU.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import "./chunk-CF7PE763.js";
 import "./chunk-G3SUCT4W.js";
+import {
+  getProfileOAuthSync,
+  saveProfileOAuthSync
+} from "./chunk-TNIX77YM.js";
+import "./chunk-SZC4REES.js";
+import "./chunk-QSJ3HFEF.js";
+import {
+  createOAuthTokenStore,
+  resolveFreshAccessToken
+} from "./chunk-ZWQUWF6W.js";
 import "./chunk-4VNS5WPM.js";
 
 // packages/cli/oauth/flows/xai.ts
@@ -898,27 +905,34 @@ var HELP_BY_PROVIDER = {
   cursor: CURSOR_HELP_TEXT,
   devin: DEVIN_HELP_TEXT
 };
-function resolveServerSyncConfig() {
-  const envServer = process.env.NOLO_SERVER?.trim() || process.env.NOLO_SERVER_URL?.trim() || process.env.BASE_URL?.trim() || "";
-  const envToken = process.env.AUTH_TOKEN?.trim() || process.env.NOLO_AUTH_TOKEN?.trim() || "";
-  if (envServer && envToken) {
-    return { serverOrigin: envServer.replace(/\/+$/, ""), authToken: envToken };
-  }
-  let profileServer = "";
-  let profileToken = "";
+function markCredentialServerManaged(provider, credential, syncConfig, deps) {
+  const output = deps.output ?? console;
+  const userId = parseUserIdFromAuthToken(syncConfig.authToken) || "local-user";
   try {
-    const config = loadProfileConfig();
-    const profileEnv = buildEnvFromProfile(config);
-    profileServer = profileEnv.NOLO_SERVER?.trim() || "";
-    profileToken = profileEnv.AUTH_TOKEN?.trim() || "";
-  } catch {
-  }
-  const serverOrigin = (envServer || profileServer).replace(/\/+$/, "");
-  const authToken = envToken || profileToken;
-  if (serverOrigin && authToken) {
-    return { serverOrigin, authToken };
+    const { refreshToken: _dropped, ...rest } = credential;
+    const tokenStore = deps.tokenStore ?? createOAuthTokenStore(
+      void 0,
+      deps.credentialMigration ?? { enableLegacyMigration: true }
+    );
+    tokenStore.write(provider, {
+      ...rest,
+      obtainedAt: credential.obtainedAt ?? Date.now(),
+      serverManaged: {
+        origin: syncConfig.serverOrigin,
+        userId,
+        syncedAt: Date.now()
+      }
+    });
+    output.log(
+      t("auth.localRefreshTokenDropped", provider, syncConfig.serverOrigin)
+    );
+    return true;
+  } catch (err) {
+    output.log(
+      t("auth.localStateUpdateFailed", toErrorMessage(err))
+    );
+    return false;
   }
-  return null;
 }
 async function syncCredentialToServer(provider, credential, deps) {
   const output = deps.output ?? console;
@@ -926,9 +940,9 @@ async function syncCredentialToServer(provider, credential, deps) {
   const syncConfig = (deps.resolveServerSyncConfig ?? resolveServerSyncConfig)();
   if (!syncConfig) {
     output.log(
-      `[nolo] Warning: server sync requires NOLO_SERVER and AUTH_TOKEN env vars, or a configured profile. Skipping server sync.`
+      t("auth.syncMissingConfig")
     );
-    return;
+    return "sync_failed";
   }
   const { serverOrigin, authToken } = syncConfig;
   const url = `${serverOrigin}/api/oauth/${provider}/sync`;
@@ -951,8 +965,13 @@ async function syncCredentialToServer(provider, credential, deps) {
       })
     });
     if (res.ok) {
-      output.log(`[nolo] Synced to ${serverOrigin}`);
-      output.log(`[nolo] \u7F51\u9875\u7AEF\u73B0\u5728\u53EF\u4EE5\u4F7F\u7528\u8BE5\u8BA2\u9605\u4E86\u3002`);
+      const marked = markCredentialServerManaged(provider, credential, syncConfig, deps);
+      if (marked) {
+        output.log(t("auth.syncedTo", serverOrigin));
+        output.log(t("auth.syncDoneWebUsable"));
+        return "ok";
+      }
+      return "mark_failed";
     } else {
       let errorDetail = "";
       try {
@@ -961,13 +980,15 @@ async function syncCredentialToServer(provider, credential, deps) {
       } catch {
       }
       output.log(
-        `[nolo] Warning: server sync failed (${res.status}${errorDetail ? `: ${errorDetail}` : ""}). Token saved locally.`
+        t("auth.syncFailed", `${res.status}${errorDetail ? `: ${errorDetail}` : ""}`)
       );
+      return "sync_failed";
     }
   } catch (err) {
     output.log(
-      `[nolo] Warning: server sync failed (${err?.message ?? "network error"}). Token saved locally.`
+      t("auth.syncFailed", err?.message ?? "network error")
     );
+    return "sync_failed";
   }
 }
 async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
@@ -993,27 +1014,35 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
     const credential = tokenStore.read(provider);
     if (!credential) {
       error.error(
-        `[nolo] No local ${provider} credential. Run: nolo auth ${provider}`
+        t("auth.noLocalCredential", provider)
       );
       return 1;
     }
-    await syncCredentialToServer(provider, credential, deps);
-    return 0;
+    if (credential.serverManaged) {
+      error.error(
+        t(
+          "auth.credentialServerManaged",
+          provider,
+          credential.serverManaged.origin
+        )
+      );
+      return 1;
+    }
+    const synced = await syncCredentialToServer(provider, credential, deps);
+    return synced === "ok" ? 0 : 1;
   }
   if (verify) {
     if (provider !== "antigravity") {
-      error.error(`[nolo] --verify is only supported for "nolo auth antigravity".`);
+      error.error(t("auth.verifyUnsupported"));
       return 1;
     }
     const credential = tokenStore.read(provider);
     if (!credential?.accessToken) {
-      error.error(
-        `[nolo] No local antigravity credential. Run: nolo auth antigravity`
-      );
+      error.error(t("auth.noLocalCredential", provider));
       return 1;
     }
     output.log(
-      `[nolo] Checking the current verification challenge (one lightweight request)...`
+      t("auth.checkingVerificationChallenge")
     );
     let accessToken = null;
     let refreshError;
@@ -1029,7 +1058,7 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
         refreshError
       )) {
         error.error(
-          `[nolo] The antigravity refresh token is no longer valid (${refreshError}). Re-run \`nolo auth antigravity\` to re-authorize this account.`
+          t("auth.refreshTokenInvalid", refreshError)
         );
         return 1;
       }
@@ -1047,18 +1076,18 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
       const msg = toErrorMessage(err);
       if (/projectId|metadata\.projectId|Re-run `nolo auth/i.test(msg)) {
         error.error(
-          `[nolo] The stored antigravity credential is incomplete (${msg}). Re-run \`nolo auth antigravity\` to re-authorize.`
+          t("auth.credentialIncomplete", msg)
         );
       } else {
         error.error(
-          `[nolo] Could not reach the antigravity provider: ${msg}. Check your network and retry.`
+          t("auth.providerUnreachable", msg)
         );
       }
       return 1;
     }
     if (result.status >= 200 && result.status < 300) {
       output.log(
-        `[nolo] \u2713 The credential is working \u2014 no verification is required right now. You can retry your agent.`
+        t("auth.credentialWorking")
       );
       return 0;
     }
@@ -1067,18 +1096,24 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
     );
     if (result.status === 403 && validationUrl) {
       output.log(
-        `[nolo] Google requires a one-time account verification for ${credential.accountId ?? "this account"}.`
+        t("auth.googleVerificationRequired", credential.accountId ?? "this account")
       );
       output.log(`[nolo]   ${validationUrl}`);
       const opener = noBrowser ? void 0 : deps.openBrowser ?? defaultOpenBrowser;
       const opened = opener ? await opener(validationUrl) : false;
       output.log(
-        opened ? `[nolo] \u2713 Opened it in your browser \u2014 complete the verification there (sign in with the same Google account), then retry your agent.` : `[nolo] Copy the URL above into a browser signed into ${credential.accountId ?? "that account"}, complete the verification, then retry your agent.`
+        opened ? t("auth.verificationOpened") : t("auth.verificationCopyUrl", credential.accountId ?? "that account")
       );
       return 0;
     }
+    const refreshSuffix = refreshError ? t("auth.httpWithoutVerificationLink.refreshSuffix", refreshError) : "";
     error.error(
-      `[nolo] The provider returned HTTP ${result.status} without a verification link \u2014 this is not the one-time-verification case --verify handles.` + (refreshError ? ` (token refresh also failed earlier: ${refreshError})` : "") + ` Response detail: ${JSON.stringify(result.body ?? {}).slice(0, 400)}`
+      t(
+        "auth.httpWithoutVerificationLink",
+        String(result.status),
+        refreshSuffix,
+        JSON.stringify(result.body ?? {}).slice(0, 400)
+      )
     );
     return 1;
   }
@@ -1125,10 +1160,12 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
           fetchImpl: deps.fetchImpl ?? fetch
         });
         output.log(
-          `[nolo] Generated Cloudflare API token for zone ${zoneName} (${zoneId}).
-Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
-  ${token}
-`
+          t(
+            "auth.cloudflareTokenGenerated",
+            zoneName,
+            zoneId,
+            token
+          )
         );
         if (writeToEnvPath) {
           upsertEnvVariable(
@@ -1137,7 +1174,7 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
             token
           );
           output.log(
-            `[nolo] Updated ${writeToEnvPath} with CLOUDFLARE_EMAIL_ROUTING_API_TOKEN.`
+            t("auth.envUpdated", writeToEnvPath)
           );
         }
       }
@@ -1147,7 +1184,11 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
     tokenStore.write(provider, credential);
     const accountLabel = credential.metadata?.email ?? credential.accountId ?? "";
     output.log(
-      `[nolo] ${provider} authorization saved` + (accountLabel ? ` for ${accountLabel}` : "") + `.`
+      t(
+        "auth.authorizationSaved",
+        provider,
+        accountLabel ? t("auth.authorizationSavedForAccount", accountLabel) : ""
+      )
     );
     const hasExplicitNoSync = args.includes("--no-sync-to-server");
     const hasExplicitSync = args.includes("--sync-to-server");
@@ -1176,12 +1217,16 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
         if (!syncConfig) {
           shouldSync = false;
           output.log(
-            `[nolo] \u672A\u914D\u7F6E\u670D\u52A1\u5668\u3002\u5982\u9700\u5728\u7F51\u9875\u7AEF\u4F7F\u7528\uFF0C\u8BF7\u5148\u8FD0\u884C nolo login\uFF0C\u518D\u8FD0\u884C nolo auth ${provider} --sync-only`
+            t("auth.noServerConfigured", provider)
           );
         } else {
           const isTTY = typeof deps.isTTY === "function" ? deps.isTTY() : deps.isTTY ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
           if (isTTY) {
-            const question = `\u540C\u6B65\u5230 ${syncConfig.serverOrigin}\uFF0C\u8BA9\u7F51\u9875\u7AEF\u4E5F\u80FD\u4F7F\u7528\u8FD9\u4E2A ${provider} \u8BA2\u9605\uFF1F\u51ED\u8BC1\u52A0\u5BC6\u5B58\u50A8\uFF0C\u53EF\u968F\u65F6 nolo auth ${provider} --no-sync-to-server \u5173\u95ED [Y/n] `;
+            const question = t(
+              "auth.syncPrompt",
+              syncConfig.serverOrigin,
+              provider
+            );
             let answer;
             if (deps.promptOAuthSync) {
               answer = await deps.promptOAuthSync(question);
@@ -1209,19 +1254,23 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
           } else {
             shouldSync = false;
             output.log(
-              `[nolo] \u672A\u540C\u6B65\u51ED\u636E\u5230\u670D\u52A1\u5668\u3002\u5982\u9700\u7F51\u9875\u7AEF\u4F7F\u7528\uFF0C\u8BF7\u8FD0\u884C: nolo auth ${provider} --sync-to-server\uFF08\u6216 --sync-only\uFF09`
+              t("auth.notSyncedToServer", provider)
             );
           }
         }
       }
     }
     if (shouldSync) {
-      await syncCredentialToServer(provider, credential, deps);
+      const syncResult = await syncCredentialToServer(provider, credential, deps);
+      if (syncResult === "mark_failed") {
+        error.error(t("auth.markFailed"));
+        return 1;
+      }
     }
     return 0;
   } catch (err) {
     error.error(
-      `nolo auth ${provider} failed: ${toErrorMessage(err)}`
+      t("auth.commandFailed", provider, toErrorMessage(err))
     );
     return 1;
   }

package/{authCommands-RGOGCPP6.js → authCommands-K3BDSTJ4.js}

@@ -7,22 +7,25 @@ import {
   runLogoutCommand,
   runWhoamiCommand,
   saveTokenLogin
-} from "./chunk-6D6VBVEW.js";
+} from "./chunk-YVTZMLXZ.js";
+import "./chunk-TY3TIUJK.js";
 import "./chunk-ESHYE7WU.js";
 import "./chunk-JBTJAPUF.js";
-import "./chunk-2F7RJC6L.js";
+import "./chunk-OW765XBU.js";
+import "./chunk-RLRYVSCD.js";
+import "./chunk-I42VC5KR.js";
+import "./chunk-U6VC4MU4.js";
+import "./chunk-WWC7I6TA.js";
+import "./chunk-3EUW3WEO.js";
+import "./chunk-2C47W7IJ.js";
 import "./chunk-GLKOYSRU.js";
-import "./chunk-BYMV6QZG.js";
 import "./chunk-A7GB5UGH.js";
 import "./chunk-OLZBQWZU.js";
-import "./chunk-VMFTFOWF.js";
-import "./chunk-WWC7I6TA.js";
-import "./chunk-3EUW3WEO.js";
-import "./chunk-U6VC4MU4.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import "./chunk-CF7PE763.js";
 import "./chunk-G3SUCT4W.js";
+import "./chunk-TNIX77YM.js";
 import "./chunk-4VNS5WPM.js";
 export {
   LOGIN_HELP_TEXT,

package/{builtinSkillRegistry-FUAVTRVZ.js → builtinSkillRegistry-MUOUTRNJ.js}

@@ -7,19 +7,22 @@ import {
   resolveBuiltinSkillEntry,
   resolveBuiltinSkillPage,
   resolveBuiltinSkillSlug
-} from "./chunk-JRQFUXY7.js";
-import "./chunk-DHDMC6FO.js";
-import "./chunk-Q554LLSI.js";
-import "./chunk-KHCLMKZZ.js";
-import "./chunk-O6OSWFZQ.js";
-import "./chunk-QDSINZM3.js";
-import "./chunk-VMFTFOWF.js";
-import "./chunk-WWC7I6TA.js";
-import "./chunk-BNGW5ASC.js";
+} from "./chunk-RRQQAG7W.js";
+import "./chunk-3CZM6HGQ.js";
+import "./chunk-IXH3HKY2.js";
+import "./chunk-XETG4RIX.js";
+import "./chunk-OKARGYFT.js";
+import "./chunk-IHPDK6UD.js";
+import "./chunk-LWLNLZC5.js";
+import "./chunk-3LI5UCTU.js";
 import "./chunk-M2EJHDJP.js";
-import "./chunk-3EUW3WEO.js";
+import "./chunk-RLRYVSCD.js";
+import "./chunk-I42VC5KR.js";
 import "./chunk-U6VC4MU4.js";
+import "./chunk-WWC7I6TA.js";
+import "./chunk-3EUW3WEO.js";
 import "./chunk-G3SUCT4W.js";
+import "./chunk-KHCLMKZZ.js";
 import "./chunk-4VNS5WPM.js";
 export {
   CAPABILITY_SLUG_COLLISIONS,