nolo-cli 0.92.0-alpha.1 → 0.92.1

package/{chromeCommands-FZYAU75D.js → chromeCommands-K27J4OVZ.js}

@@ -1,9 +1,11 @@
 import {
   NOLO_CHROME_CONNECTOR_EXTENSION_ID,
   NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION,
+  NOLO_CONNECTOR_EXTENSION_IDS,
+  NOLO_FIREFOX_CONNECTOR_EXTENSION_ID,
   REQUIRED_CHROME_CONNECTOR_FEATURES,
   createChromeConnectorClient
-} from "./chunk-SH43IESU.js";
+} from "./chunk-YUNJN43V.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -21,6 +23,7 @@ import { dirname, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 var DEFAULT_CONNECTOR_ROOT = dirname(fileURLToPath(import.meta.url));
+var FIREFOX_EXTENSION_ID = "nolo-browser-connector@nolo.chat";
 function extensionIdFromPublicKey(publicKeyBase64) {
   const digest = createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest();
   return Array.from(
@@ -40,8 +43,23 @@ function resolveNodePath() {
 }
 function nativeMessagingHostsDir({
   home = process.env.HOME || "",
-  platform = process.platform
+  platform = process.platform,
+  browser = "chrome"
 } = {}) {
+  if (browser === "firefox") {
+    if (platform === "darwin") {
+      return resolve(home, "Library/Application Support/Mozilla/NativeMessagingHosts");
+    }
+    if (platform === "linux") {
+      return resolve(home, ".mozilla/native-messaging-hosts");
+    }
+    throw new Error(
+      `Firefox native host installation is not implemented for platform "${platform}". Windows needs a registry value under HKCU\\Software\\Mozilla\\NativeMessagingHosts pointing at the manifest file.`
+    );
+  }
+  if (browser !== "chrome") {
+    throw new Error(`Unknown native messaging browser target: "${browser}".`);
+  }
   if (platform === "darwin") {
     return resolve(home, "Library/Application Support/Google/Chrome/NativeMessagingHosts");
   }
@@ -55,16 +73,18 @@ function nativeMessagingHostsDir({
 function resolveNativeHostInstallPaths({
   home = process.env.HOME || "",
   connectorRoot = DEFAULT_CONNECTOR_ROOT,
-  platform = process.platform
+  platform = process.platform,
+  browser = "chrome"
 } = {}) {
   const supportDir = resolve(home, "Library/Application Support/Nolo/ChromeConnector");
   return {
     connectorRoot,
+    browser,
     extensionManifestPath: resolve(connectorRoot, "extension", "manifest.json"),
     hostPath: resolve(connectorRoot, "native-host", "nolo-chrome-native-host.mjs"),
     templatePath: resolve(connectorRoot, "native-host", "com.nolo.chrome_connector.json"),
     nativeManifestPath: resolve(
-      nativeMessagingHostsDir({ home, platform }),
+      nativeMessagingHostsDir({ home, platform, browser }),
       "com.nolo.chrome_connector.json"
     ),
     supportDir,
@@ -77,12 +97,13 @@ function installNativeHostManifest({
   connectorRoot = DEFAULT_CONNECTOR_ROOT,
   platform = process.platform,
   extensionId,
-  nodePath
+  nodePath,
+  browser = "chrome"
 } = {}) {
-  const paths = resolveNativeHostInstallPaths({ home, connectorRoot, platform });
+  const paths = resolveNativeHostInstallPaths({ home, connectorRoot, platform, browser });
   const manifest = JSON.parse(readFileSync(paths.templatePath, "utf8"));
   const extensionManifest = JSON.parse(readFileSync(paths.extensionManifestPath, "utf8"));
-  const resolvedExtensionId = extensionId || extensionIdFromPublicKey(extensionManifest.key);
+  const resolvedExtensionId = extensionId || (browser === "firefox" ? FIREFOX_EXTENSION_ID : extensionIdFromPublicKey(extensionManifest.key));
   const resolvedNodePath = nodePath || resolveNodePath();
   mkdirSync(paths.supportDir, { recursive: true });
   const existingToken = existsSync(paths.tokenPath) ? readFileSync(paths.tokenPath, "utf8").trim() : "";
@@ -97,12 +118,18 @@ NOLO_CHROME_CONNECTOR_TOKEN=${JSON.stringify(token)} exec ${JSON.stringify(resol
   );
   chmodSync(paths.wrapperPath, 493);
   manifest.path = paths.wrapperPath;
-  manifest.allowed_origins = [`chrome-extension://${resolvedExtensionId}/`];
+  if (browser === "firefox") {
+    delete manifest.allowed_origins;
+    manifest.allowed_extensions = [FIREFOX_EXTENSION_ID];
+  } else {
+    manifest.allowed_origins = [`chrome-extension://${resolvedExtensionId}/`];
+  }
   mkdirSync(dirname(paths.nativeManifestPath), { recursive: true });
   writeFileSync(paths.nativeManifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
     extensionId: resolvedExtensionId,
+    browser,
     nodePath: resolvedNodePath,
     tokenPath: paths.tokenPath,
     ...paths
@@ -119,6 +146,21 @@ var CLI_CONNECTOR_ROOT_CANDIDATES = [
 var FULL_SUPPORT_CHROME_FEATURES = [
   ...new Set(Object.values(REQUIRED_CHROME_CONNECTOR_FEATURES).flat())
 ].sort();
+var FIREFOX_UNAVAILABLE_FEATURES = ["browser_debug", "file_upload"];
+function resolveConnectorBrowser(extensionId) {
+  if (!extensionId) return null;
+  if (extensionId === NOLO_FIREFOX_CONNECTOR_EXTENSION_ID) return "firefox";
+  if (NOLO_CONNECTOR_EXTENSION_IDS.includes(extensionId)) return "chrome";
+  return null;
+}
+function expectedFeaturesForBrowser(browser) {
+  return browser === "firefox" ? FULL_SUPPORT_CHROME_FEATURES.filter(
+    (feature) => !FIREFOX_UNAVAILABLE_FEATURES.includes(feature)
+  ) : FULL_SUPPORT_CHROME_FEATURES;
+}
+function browserLabel(browser) {
+  return browser === "firefox" ? "Firefox" : browser === "chrome" ? "Chrome" : "browser";
+}
 function pickCliConnectorRoot(candidates) {
   for (const candidate of candidates) {
     if (existsSync2(resolve2(candidate, "extension", "manifest.json"))) return candidate;
@@ -233,9 +275,13 @@ async function probeConnectorRpc(requestChrome) {
   }
 }
 function resolveStatusNextStep(report) {
+  const targetBrowser = report.rpc.browser ?? report.nativeHost.browser;
+  const installCmd = targetBrowser === "firefox" ? "nolo chrome install --browser firefox" : "nolo chrome install";
+  const connectedLabel = browserLabel(targetBrowser);
+  const browserText = connectedLabel === "browser" ? "the browser" : connectedLabel;
   if (!report.connectorRoot) {
     if (report.rpc.online && report.rpc.protocolVersion === report.rpc.expectedProtocolVersion) {
-      return "Chrome connector is online, but this CLI cannot see a connector checkout, so `nolo chrome install` / manifest checks are unavailable here. Set NOLO_CHROME_CONNECTOR_ROOT (or run the CLI from a repo checkout) to enable them.";
+      return "The Nolo Browser Connector is online, but this CLI cannot see a connector checkout, so `nolo chrome install` / manifest checks are unavailable here. Set NOLO_CHROME_CONNECTOR_ROOT (or run the CLI from a repo checkout) to enable them.";
     }
     return "Run the CLI from a repo checkout that contains packages/desktop-chrome-connector, or set NOLO_CHROME_CONNECTOR_ROOT to one, then rerun `nolo chrome status`.";
   }
@@ -243,20 +289,20 @@ function resolveStatusNextStep(report) {
     return `This platform has no supported native messaging host install (Chrome looks the host up through a registry value on Windows), so non-interactive install is not available: ${report.nativeHost.platformError ?? "unsupported platform"}`;
   }
   if (!report.nativeHost.installed || !report.token.present) {
-    return "nolo chrome install";
+    return installCmd;
   }
   if (!report.nativeHost.wrapperPathMatches || !report.nativeHost.allowedOriginMatches) {
     const installedWrapperPath = report.nativeHost.installedWrapperPath;
     if (!report.nativeHost.wrapperPathMatches && installedWrapperPath && installedWrapperPath !== report.nativeHost.wrapperPath && existsSync2(installedWrapperPath)) {
-      return `Native host is installed for a different checkout (${installedWrapperPath}); this CLI is looking at ${report.connectorRoot}. Run \`nolo chrome status\` from the checkout that installed it, or run \`nolo chrome install\` from here only if Chrome should switch to this one.`;
+      return `Native host is installed for a different checkout (${installedWrapperPath}); this CLI is looking at ${report.connectorRoot}. Run \`nolo chrome status\` from the checkout that installed it, or run \`${installCmd}\` from here only if ${browserText} should switch to this one.`;
     }
-    return "nolo chrome install (the installed manifest does not point at this checkout's wrapper / extension id, which Chrome silently ignores)";
+    return `${installCmd} (the installed manifest does not point at this checkout's wrapper / extension id, which ${browserText} silently ignores)`;
   }
   if (!report.rpc.online) {
-    return `Load the unpacked extension from ${report.extension.path} in chrome://extensions (Developer mode) or install it from the Chrome Web Store, then rerun \`nolo chrome status\`.`;
+    return `Load the unpacked extension from ${report.extension.path} in chrome://extensions (Chrome) or about:debugging#/runtime/this-firefox (Firefox), or install the Nolo Browser Connector from https://nolo.chat/downloads, then rerun \`nolo chrome status\`.`;
   }
-  if (report.rpc.extensionId && report.rpc.extensionId !== report.extension.expectedId) {
-    return `The connected extension (${report.rpc.extensionId}) is not the connector at ${report.extension.path}; remove the other copy and rerun \`nolo chrome status\`.`;
+  if (report.rpc.extensionId && report.rpc.browser === null) {
+    return `The connected extension (${report.rpc.extensionId}) is not a recognized Nolo Browser Connector build; reload it (\`nolo chrome reload\`) or remove the other copy, then rerun \`nolo chrome status\`.`;
   }
   if (report.rpc.protocolVersion !== report.rpc.expectedProtocolVersion) {
     return `nolo chrome reload (the running extension does not speak protocol ${report.rpc.expectedProtocolVersion}; a reload restarts the worker with the files on disk)`;
@@ -264,7 +310,7 @@ function resolveStatusNextStep(report) {
   if (report.rpc.missingFeatures.length > 0) {
     return `nolo chrome reload (the running extension is missing ${report.rpc.missingFeatures.join(", ")}); if that persists, the checkout's extension is older than the CLI expects.`;
   }
-  return "Chrome connector is online: chrome_* tools execute against this Chrome profile.";
+  return `The Nolo Browser Connector is online (${connectedLabel}): connector tools execute against this ${connectedLabel} profile.`;
 }
 async function buildChromeConnectorStatus(args = {}) {
   const env = args.env ?? process.env;
@@ -295,7 +341,8 @@ async function buildChromeConnectorStatus(args = {}) {
       wrapperPath: null,
       installedWrapperPath: null,
       wrapperPathMatches: false,
-      allowedOriginMatches: false
+      allowedOriginMatches: false,
+      browser: null
     },
     token: { path: null, present: false },
     rpc: {
@@ -303,6 +350,7 @@ async function buildChromeConnectorStatus(args = {}) {
       extensionId: null,
       protocolVersion: null,
       features: [],
+      browser: null,
       missingFeatures: [...FULL_SUPPORT_CHROME_FEATURES],
       expectedProtocolVersion: NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION
     },
@@ -314,19 +362,48 @@ async function buildChromeConnectorStatus(args = {}) {
   report.rpc.extensionId = probe.extensionId;
   report.rpc.protocolVersion = probe.protocolVersion;
   report.rpc.features = probe.features;
-  report.rpc.missingFeatures = FULL_SUPPORT_CHROME_FEATURES.filter(
+  report.rpc.browser = probe.online ? resolveConnectorBrowser(probe.extensionId) ?? (probe.extensionId === expectedId ? "chrome" : null) : null;
+  report.rpc.missingFeatures = expectedFeaturesForBrowser(report.rpc.browser).filter(
     (feature) => !probe.features.includes(feature)
   );
   if (!probe.online) report.rpc.error = probe.error;
   if (!connectorRoot) {
     if (rootError) report.connectorRootError = rootError;
-    report.ok = report.rpc.online && probe.extensionId === expectedId && probe.protocolVersion === NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION && report.rpc.missingFeatures.length === 0;
+    report.nativeHost.browser = report.rpc.browser;
+    report.ok = report.rpc.online && report.rpc.browser !== null && probe.protocolVersion === NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION && report.rpc.missingFeatures.length === 0;
     report.nextStep = resolveStatusNextStep(report);
     return report;
   }
+  let manifestBrowser = report.rpc.browser === "firefox" ? "firefox" : "chrome";
+  if (!report.rpc.browser) {
+    try {
+      const chromeManifestPath = resolveNativeHostInstallPaths({
+        home,
+        connectorRoot,
+        platform,
+        browser: "chrome"
+      }).nativeManifestPath;
+      const firefoxManifestPath = resolveNativeHostInstallPaths({
+        home,
+        connectorRoot,
+        platform,
+        browser: "firefox"
+      }).nativeManifestPath;
+      if (!existsSync2(chromeManifestPath) && existsSync2(firefoxManifestPath)) {
+        manifestBrowser = "firefox";
+      }
+    } catch {
+    }
+  }
+  report.nativeHost.browser = manifestBrowser;
   let paths = null;
   try {
-    paths = resolveNativeHostInstallPaths({ home, connectorRoot, platform });
+    paths = resolveNativeHostInstallPaths({
+      home,
+      connectorRoot,
+      platform,
+      browser: manifestBrowser
+    });
   } catch (error) {
     report.nativeHost.supported = false;
     report.nativeHost.platformError = toErrorMessage(error);
@@ -340,8 +417,7 @@ async function buildChromeConnectorStatus(args = {}) {
   report.nativeHost.installed = installedManifest !== null;
   report.nativeHost.installedWrapperPath = typeof installedManifest?.path === "string" ? installedManifest.path : null;
   report.nativeHost.wrapperPathMatches = report.nativeHost.installedWrapperPath === paths.wrapperPath;
-  const expectedOrigin = `chrome-extension://${expectedId}/`;
-  report.nativeHost.allowedOriginMatches = Array.isArray(installedManifest?.allowed_origins) && installedManifest.allowed_origins.includes(expectedOrigin);
+  report.nativeHost.allowedOriginMatches = manifestBrowser === "firefox" ? Array.isArray(installedManifest?.allowed_extensions) && installedManifest.allowed_extensions.includes(NOLO_FIREFOX_CONNECTOR_EXTENSION_ID) : Array.isArray(installedManifest?.allowed_origins) && installedManifest.allowed_origins.includes(`chrome-extension://${expectedId}/`);
   if (existsSync2(paths.tokenPath)) {
     try {
       report.token.present = readFileSync2(paths.tokenPath, "utf8").trim().length > 0;
@@ -349,7 +425,7 @@ async function buildChromeConnectorStatus(args = {}) {
       report.token.present = false;
     }
   }
-  report.ok = report.nativeHost.supported && report.nativeHost.installed && report.nativeHost.wrapperPathMatches && report.nativeHost.allowedOriginMatches && report.token.present && probe.online && probe.extensionId === expectedId && probe.protocolVersion === NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION && report.rpc.missingFeatures.length === 0;
+  report.ok = report.nativeHost.supported && report.nativeHost.installed && report.nativeHost.wrapperPathMatches && report.nativeHost.allowedOriginMatches && report.token.present && probe.online && report.rpc.browser !== null && probe.protocolVersion === NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION && report.rpc.missingFeatures.length === 0;
   report.nextStep = resolveStatusNextStep(report);
   return report;
 }
@@ -357,7 +433,7 @@ function yesNo(value) {
   return value ? "ok" : "mismatch";
 }
 function formatChromeConnectorStatus(report) {
-  const lines = ["Nolo Chrome connector"];
+  const lines = ["Nolo Browser Connector"];
   lines.push(
     `  connector source : ${report.connectorRoot ?? "(not found)"}`
   );
@@ -377,7 +453,7 @@ function formatChromeConnectorStatus(report) {
   const rpc = report.rpc;
   if (rpc.online) {
     lines.push(
-      `  RPC              : online  extension ${rpc.extensionId ?? "unknown"}  protocolVersion ${rpc.protocolVersion ?? "unknown"}  features ${rpc.features.length > 0 ? rpc.features.join(", ") : "(none)"}`
+      `  RPC              : online  browser ${rpc.browser ?? "unrecognized"}  extension ${rpc.extensionId ?? "unknown"}  protocolVersion ${rpc.protocolVersion ?? "unknown"}  features ${rpc.features.length > 0 ? rpc.features.join(", ") : "(none)"}`
     );
   } else {
     lines.push(
@@ -406,9 +482,25 @@ async function runChromeStatusCommand(args, deps = {}) {
   }
   return report.ok ? 0 : 1;
 }
+function readBrowserOption(args) {
+  const equalsForm = args.find((arg) => arg.startsWith("--browser="));
+  const index = args.indexOf("--browser");
+  const raw = equalsForm !== void 0 ? equalsForm.slice("--browser=".length) : index >= 0 ? args[index + 1] : void 0;
+  if (raw === void 0) return "chrome";
+  const value = raw.trim();
+  if (value === "chrome" || value === "firefox") return value;
+  return null;
+}
 async function runChromeInstallCommand(args, deps = {}) {
   const env = deps.env ?? process.env;
   const output = deps.output ?? process.stdout;
+  const browser = readBrowserOption(args);
+  if (browser === null) {
+    output.write(
+      '[nolo] Chrome native host install failed: --browser must be "chrome" or "firefox".\n'
+    );
+    return 1;
+  }
   const install = deps.installNativeHost ?? installNativeHostManifest;
   let connectorRoot;
   try {
@@ -432,6 +524,7 @@ async function runChromeInstallCommand(args, deps = {}) {
     result = install({
       home: deps.home ?? env.HOME ?? "",
       connectorRoot,
+      browser,
       ...deps.platform ? { platform: deps.platform } : {},
       ...deps.nodePath ? { nodePath: deps.nodePath } : {}
     });
@@ -446,12 +539,12 @@ async function runChromeInstallCommand(args, deps = {}) {
   } else {
     output.write(
       [
-        "Nolo Chrome connector native host installed.",
+        `Nolo Browser Connector native host installed (${browser}).`,
         `  manifest : ${result.nativeManifestPath}`,
         `  wrapper  : ${result.wrapperPath} -> ${result.nodePath}`,
         `  token    : ${result.tokenPath} (an existing token is kept, so reruns are idempotent)`,
         `  extension: ${result.extensionId}`,
-        `Next step: load the unpacked extension from ${resolve2(connectorRoot, "extension")} in chrome://extensions (Developer mode) or install it from the Chrome Web Store, then run \`nolo chrome status\`.`,
+        `Next step: load the unpacked extension from ${resolve2(connectorRoot, "extension")} in ` + (browser === "firefox" ? "about:debugging#/runtime/this-firefox, or install the signed Nolo Browser Connector add-on from https://nolo.chat/downloads, then run `nolo chrome status`." : "chrome://extensions (Developer mode), or install the Nolo Browser Connector from https://nolo.chat/downloads (Chrome or Firefox), then run `nolo chrome status`."),
         ""
       ].join("\n")
     );
@@ -480,7 +573,7 @@ The connector service worker restarts within ~1s; verify with \`nolo chrome stat
 `);
     if (code === "CHROME_CONNECTOR_UNAVAILABLE") {
       output.write(
-        "The native host is not reachable: load the unpacked connector extension in chrome://extensions (or start Chrome), then rerun `nolo chrome reload`.\n"
+        "The native host is not reachable: open Chrome or Firefox with the Nolo Browser Connector extension enabled, or install it from https://nolo.chat/downloads (or load the unpacked connector extension in chrome://extensions), then rerun `nolo chrome reload`.\n"
       );
     }
     return 1;
@@ -488,11 +581,14 @@ The connector service worker restarts within ~1s; verify with \`nolo chrome stat
 }
 export {
   CLI_CONNECTOR_ROOT_CANDIDATES,
+  FIREFOX_UNAVAILABLE_FEATURES,
   FULL_SUPPORT_CHROME_FEATURES,
   buildChromeConnectorStatus,
   detectWorktreeCheckout,
+  expectedFeaturesForBrowser,
   formatChromeConnectorStatus,
   resolveCliConnectorRoot,
+  resolveConnectorBrowser,
   runChromeInstallCommand,
   runChromeReloadCommand,
   runChromeStatusCommand

package/{chromeOpsCommands-62P2Q2YB.js → chromeOpsCommands-IXRLN57H.js}

@@ -1,6 +1,6 @@
 import {
   createChromeConnectorClient
-} from "./chunk-SH43IESU.js";
+} from "./chunk-YUNJN43V.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -197,8 +197,8 @@ var CHROME_OPS_SUBCOMMANDS = {
 };
 function renderChromeOpsHelp() {
   const lines = [
-    "Operate the user's Chrome through the Nolo Chrome connector (the desktop bridge;",
-    "the same RPC the chrome_* agent tools use).",
+    "Operate the user's browser (Chrome or Firefox) through the Nolo Browser Connector",
+    "(the desktop bridge; the same RPC the browser_* agent tools use \u2014 legacy `chrome_*` names still work).",
     "",
     "Usage:",
     "  nolo chrome <subcommand> [flags]",
@@ -213,6 +213,7 @@ function renderChromeOpsHelp() {
     "    preferred over --selector); --selector takes a CSS selector.",
     "  Actions the connector classifies as irreversible (Submit / Delete / Pay ...)",
     "    are refused with CONFIRMATION_REQUIRED \u2014 ask the user to perform them.",
+    "  read-console / read-network / upload work on Chrome only (Firefox lacks chrome.debugger).",
     "  Every subcommand prints the connector's raw JSON result; failures exit 1.",
     "  Endpoint: NOLO_CHROME_CONNECTOR_RPC_URL or http://127.0.0.1:38947/rpc."
   ];

package/{chunk-UYJKSCJ4.js → chunk-27ONFIEY.js}

@@ -3,7 +3,7 @@ import {
   resolvePlatformChatCompletionsEndpoint,
   resolvePlatformHostedCredentialProvider,
   resolvePlatformResponsesEndpoint
-} from "./chunk-I2MX6JST.js";
+} from "./chunk-7KVZ5LDQ.js";
 import {
   CLI_PROVIDER_VALUES
 } from "./chunk-W7XHHYWM.js";
@@ -11,7 +11,7 @@ import {
   CLIENT_VERSION_TOO_OLD_CODE,
   buildClientVersionGateErrorDetail,
   evaluatePlatformHostedClientVersionGate
-} from "./chunk-Q67DOFOO.js";
+} from "./chunk-Y3PMXGLH.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
@@ -164,10 +164,28 @@ function resolveProviderAuthHeaderName(args) {
   if (/xiaomimimo\.com/i.test(args.endpoint)) return "api-key";
   return "Authorization";
 }
+var OPENCODE_GO_ENDPOINT_RE = /^https?:\/\/opencode\.ai\/zen\/go\//i;
+var OPENCODE_SESSION_HEADER = "x-opencode-session";
+var OPENCODE_USER_AGENT = "nolo-agent/1.0";
+var PROCESS_FALLBACK_SESSION_ID = `nolo-${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
+function isOpenCodeGoEndpoint(endpoint) {
+  return typeof endpoint === "string" && OPENCODE_GO_ENDPOINT_RE.test(endpoint.trim());
+}
+function buildProviderSessionHeaders(args) {
+  if (!isOpenCodeGoEndpoint(args.endpoint)) return {};
+  return {
+    [OPENCODE_SESSION_HEADER]: args.sessionId?.trim() || PROCESS_FALLBACK_SESSION_ID,
+    "User-Agent": OPENCODE_USER_AGENT
+  };
+}
 function buildProviderAuthHeaders(args) {
-  if (!args.apiKey) return {};
+  const sessionHeaders = buildProviderSessionHeaders(args);
+  if (!args.apiKey) return sessionHeaders;
   const headerName = resolveProviderAuthHeaderName(args);
-  return headerName.toLowerCase() === "authorization" ? { Authorization: `Bearer ${args.apiKey}` } : { [headerName]: args.apiKey };
+  return {
+    ...sessionHeaders,
+    ...headerName.toLowerCase() === "authorization" ? { Authorization: `Bearer ${args.apiKey}` } : { [headerName]: args.apiKey }
+  };
 }
 async function buildProviderExecutionPlan(args) {
   const { agentConfig, env } = args;

package/{chunk-2HBFQM4C.js → chunk-2QX2MTNK.js}

@@ -1,9 +1,9 @@
 import {
   clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-7GDFU22A.js";
+} from "./chunk-PHINMJJZ.js";
 import {
   getReadableCliDb
-} from "./chunk-LS2ZANRJ.js";
+} from "./chunk-CTUQJVQM.js";
 import {
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord,
@@ -12,10 +12,10 @@ import {
   resolveAgentRecordFromHybridStore,
   sanitizeAgentRecordForCliOutput,
   writeAgentRecord
-} from "./chunk-TZB6Y4OD.js";
+} from "./chunk-IBQ6NJI4.js";
 import {
   resolveCliAgentKeyInput
-} from "./chunk-SAFZABH7.js";
+} from "./chunk-SV5IJK6K.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -212,7 +212,7 @@ async function runAgentCreateCommand(args, deps = {}) {
     clearCliLocalRuntimePreparedAgentCache();
     let verifyResult;
     if (parsed.verify) {
-      const { verifyCustomProvider } = await import("./agentProviderCommands-I26OTLEQ.js");
+      const { verifyCustomProvider } = await import("./agentProviderCommands-TWB6E5WD.js");
       const rec = built.nextRecord;
       verifyResult = await verifyCustomProvider({
         providerUrl: rec.customProviderUrl,
@@ -222,15 +222,34 @@ async function runAgentCreateCommand(args, deps = {}) {
         fetchImpl
       });
     }
+    const apiKeyRef = String(built.updates?.apiKeyRef || "").trim();
+    let authHint;
+    const OAUTH_REFS = /* @__PURE__ */ new Set(["claude", "chatgpt", "xai", "antigravity", "cloudflare"]);
+    if (apiKeyRef && OAUTH_REFS.has(apiKeyRef)) {
+      try {
+        const { createOAuthTokenStore } = await import("./oauthTokenStore-ITEB663N.js");
+        const store = createOAuthTokenStore();
+        if (!store.read(apiKeyRef)) {
+          authHint = `Subscription "${apiKeyRef}" is not authorized yet. Run \`nolo auth ${apiKeyRef}\` to log in.`;
+        }
+      } catch {
+      }
+    }
     output.write(JSON.stringify({
       ok: true,
       agentKey: built.agentKey,
       baseUrl: built.serverUrl,
       updates: sanitizeAgentRecordForCliOutput(built.updates),
       record: sanitizeAgentRecordForCliOutput(built.nextRecord),
-      ...verifyResult ? { verify: verifyResult } : {}
+      ...verifyResult ? { verify: verifyResult } : {},
+      ...authHint ? { hint: authHint } : {}
     }, null, 2));
     output.write("\n");
+    if (authHint) {
+      const errorOutput = deps.error ?? process.stderr;
+      errorOutput.write(`[nolo] Hint: ${authHint}
+`);
+    }
     return 0;
   } catch (error) {
     output.write(