nolo-cli 0.98.0-alpha.3 → 0.98.0

package/{authCommand-F4EFRRX6.js → authCommand-NHDLY3IB.js}

@@ -1,12 +1,12 @@
-import {
-  defaultOpenBrowser
-} from "./chunk-6D6VBVEW.js";
 import {
   generateCloudflareEmailRoutingToken,
   parseFlagWithOptionalValue,
   runCloudflareOAuthLogin,
   upsertEnvVariable
-} from "./chunk-GPCZ7UXG.js";
+} from "./chunk-K6U4NKFJ.js";
+import {
+  defaultOpenBrowser
+} from "./chunk-SNMQMOD2.js";
 import {
   ANTHROPIC_OAUTH_AUTHORIZE_URL,
   ANTHROPIC_OAUTH_CALLBACK_PORT,
@@ -39,6 +39,7 @@ import {
   generatePkcePair,
   normalizeAnthropicTokenPayload,
   readJsonBody,
+  refreshAntigravityOAuthToken,
   renderDeviceCodeDisplay,
   runAntigravityOAuthLogin,
   runOpenAiCodexBrowserPkce,
@@ -46,50 +47,58 @@ import {
   startCallbackServer,
   validateXAIEndpoint,
   xaiOAuthDiscovery
-} from "./chunk-53HEEOTT.js";
+} from "./chunk-2WJ57RJA.js";
+import "./chunk-TY3TIUJK.js";
 import "./chunk-ESHYE7WU.js";
 import "./chunk-JBTJAPUF.js";
-import "./chunk-2F7RJC6L.js";
+import {
+  extractGoogleValidationLink
+} from "./chunk-BMQ2MJUK.js";
+import "./chunk-FOXQ7BAB.js";
 import "./chunk-GLKOYSRU.js";
 import {
   buildDevinAuthUrl,
   buildDevinOAuthCredential,
   detectLocalDevinCredentials,
-  extractDevinToken
-} from "./chunk-Q5FJJ6XI.js";
+  extractDevinToken,
+  fetchAntigravityCloudCodeCompletion
+} from "./chunk-OW4APERY.js";
+import "./chunk-GMZLP5DV.js";
 import "./chunk-5ZUL4CUO.js";
-import "./chunk-UZGQNTVW.js";
-import "./chunk-6OZ36FXI.js";
-import "./chunk-GQBOR3G6.js";
-import "./chunk-OIVSQH2O.js";
 import {
-  createOAuthTokenStore
-} from "./chunk-ONXOABJR.js";
+  createOAuthTokenStore,
+  resolveFreshAccessToken
+} from "./chunk-HNGRBWYF.js";
+import "./chunk-UA324D4O.js";
+import "./chunk-27ONFIEY.js";
+import "./chunk-7KVZ5LDQ.js";
+import "./chunk-3BXNTXYI.js";
 import "./chunk-W7XHHYWM.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
+import "./chunk-A7GB5UGH.js";
+import "./chunk-OLZBQWZU.js";
 import {
   buildEnvFromProfile,
   getProfileOAuthSync,
   loadProfileConfig,
   saveProfileOAuthSync
-} from "./chunk-BYMV6QZG.js";
-import "./chunk-A7GB5UGH.js";
-import "./chunk-OLZBQWZU.js";
-import "./chunk-Q67DOFOO.js";
-import "./chunk-VMFTFOWF.js";
-import {
-  asOptionalFiniteNumber
-} from "./chunk-WWC7I6TA.js";
+} from "./chunk-TNIX77YM.js";
+import "./chunk-Y3PMXGLH.js";
 import "./chunk-QSJ3HFEF.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import "./chunk-3AH7LNUB.js";
+import {
+  asOptionalFiniteNumber
+} from "./chunk-WWC7I6TA.js";
+import "./chunk-OW765XBU.js";
+import "./chunk-U6VC4MU4.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
-import "./chunk-U6VC4MU4.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import "./chunk-CF7PE763.js";
@@ -759,7 +768,7 @@ This authorizes model API access only. It does NOT log you into the Nolo platfor
 To manage agents, docs, spaces, and other Nolo resources, run "nolo login" first.
 
 Usage:
-  nolo auth antigravity [--browser] [--no-browser] [--sync-to-server] [--help]
+  nolo auth antigravity [--browser] [--no-browser] [--verify] [--sync-to-server] [--help]
 
 Opens a browser to https://accounts.google.com (OIDC PKCE loopback on 127.0.0.1:51121).
 After approval, the flow provisions a Cloud Code Assist project and stores the
@@ -771,6 +780,8 @@ oh-my-pi; Google does not publish a public Cloud Code Assist client registration
 Options:
   --browser         Use the browser PKCE flow (default for antigravity).
   --no-browser      Print the authorization URL only.
+  --verify          Check the current Google one-time verification challenge
+                    and open the validation link in a browser (no re-auth).
 ${SYNC_HELP_LINE}
   --help, -h        Show this help and exit.
 
@@ -975,6 +986,7 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
   const useBrowser = args.includes("--browser");
   const noBrowser = args.includes("--no-browser") || deps.noBrowserByDefault;
   const syncOnly = args.includes("--sync-only");
+  const verify = args.includes("--verify");
   const generateToken = args.includes("--generate-token");
   const writeToEnvRaw = parseFlagWithOptionalValue(args, "--write-to-env");
   const writeToEnvPath = typeof writeToEnvRaw === "string" ? writeToEnvRaw : writeToEnvRaw === true ? ".env" : void 0;
@@ -990,6 +1002,88 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
     await syncCredentialToServer(provider, credential, deps);
     return 0;
   }
+  if (verify) {
+    if (provider !== "antigravity") {
+      error.error(`[nolo] --verify is only supported for "nolo auth antigravity".`);
+      return 1;
+    }
+    const credential = tokenStore.read(provider);
+    if (!credential?.accessToken) {
+      error.error(
+        `[nolo] No local antigravity credential. Run: nolo auth antigravity`
+      );
+      return 1;
+    }
+    output.log(
+      `[nolo] Checking the current verification challenge (one lightweight request)...`
+    );
+    let accessToken = null;
+    let refreshError;
+    try {
+      accessToken = await resolveFreshAccessToken({
+        provider,
+        store: tokenStore,
+        refresh: deps.refreshAntigravityToken ?? refreshAntigravityOAuthToken
+      });
+    } catch (err) {
+      refreshError = toErrorMessage(err);
+      if (/invalid_grant|unauthorized_client|revoked|invalid_token|refresh[_ ]token[^.]*(expired|invalid|revoked)|expired[^.]*refresh/i.test(
+        refreshError
+      )) {
+        error.error(
+          `[nolo] The antigravity refresh token is no longer valid (${refreshError}). Re-run \`nolo auth antigravity\` to re-authorize this account.`
+        );
+        return 1;
+      }
+    }
+    let result;
+    try {
+      result = await fetchAntigravityCloudCodeCompletion({
+        agentConfig: { model: "gemini-3.1-pro" },
+        accessToken: accessToken ?? credential.accessToken,
+        metadata: credential.metadata ?? null,
+        openAiBody: { messages: [{ role: "user", content: "hi" }] },
+        fetchImpl: deps.fetchImpl ?? fetch
+      });
+    } catch (err) {
+      const msg = toErrorMessage(err);
+      if (/projectId|metadata\.projectId|Re-run `nolo auth/i.test(msg)) {
+        error.error(
+          `[nolo] The stored antigravity credential is incomplete (${msg}). Re-run \`nolo auth antigravity\` to re-authorize.`
+        );
+      } else {
+        error.error(
+          `[nolo] Could not reach the antigravity provider: ${msg}. Check your network and retry.`
+        );
+      }
+      return 1;
+    }
+    if (result.status >= 200 && result.status < 300) {
+      output.log(
+        `[nolo] \u2713 The credential is working \u2014 no verification is required right now. You can retry your agent.`
+      );
+      return 0;
+    }
+    const { url: validationUrl } = extractGoogleValidationLink(
+      JSON.stringify(result.body ?? {})
+    );
+    if (result.status === 403 && validationUrl) {
+      output.log(
+        `[nolo] Google requires a one-time account verification for ${credential.accountId ?? "this account"}.`
+      );
+      output.log(`[nolo]   ${validationUrl}`);
+      const opener = noBrowser ? void 0 : deps.openBrowser ?? defaultOpenBrowser;
+      const opened = opener ? await opener(validationUrl) : false;
+      output.log(
+        opened ? `[nolo] \u2713 Opened it in your browser \u2014 complete the verification there (sign in with the same Google account), then retry your agent.` : `[nolo] Copy the URL above into a browser signed into ${credential.accountId ?? "that account"}, complete the verification, then retry your agent.`
+      );
+      return 0;
+    }
+    error.error(
+      `[nolo] The provider returned HTTP ${result.status} without a verification link \u2014 this is not the one-time-verification case --verify handles.` + (refreshError ? ` (token refresh also failed earlier: ${refreshError})` : "") + ` Response detail: ${JSON.stringify(result.body ?? {}).slice(0, 400)}`
+    );
+    return 1;
+  }
   const flowDeps = {
     ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
     ...deps.sleep ? { sleep: deps.sleep } : {},

package/{authCommands-RGOGCPP6.js → authCommands-UDBJVSZU.js}

@@ -7,18 +7,20 @@ import {
   runLogoutCommand,
   runWhoamiCommand,
   saveTokenLogin
-} from "./chunk-6D6VBVEW.js";
+} from "./chunk-SNMQMOD2.js";
+import "./chunk-TY3TIUJK.js";
 import "./chunk-ESHYE7WU.js";
 import "./chunk-JBTJAPUF.js";
-import "./chunk-2F7RJC6L.js";
+import "./chunk-FOXQ7BAB.js";
 import "./chunk-GLKOYSRU.js";
-import "./chunk-BYMV6QZG.js";
 import "./chunk-A7GB5UGH.js";
 import "./chunk-OLZBQWZU.js";
-import "./chunk-VMFTFOWF.js";
+import "./chunk-TNIX77YM.js";
+import "./chunk-3AH7LNUB.js";
 import "./chunk-WWC7I6TA.js";
-import "./chunk-3EUW3WEO.js";
+import "./chunk-OW765XBU.js";
 import "./chunk-U6VC4MU4.js";
+import "./chunk-3EUW3WEO.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import "./chunk-CF7PE763.js";

package/{builtinSkillRegistry-FUAVTRVZ.js → builtinSkillRegistry-MAR5LPAC.js}

@@ -7,18 +7,20 @@ import {
   resolveBuiltinSkillEntry,
   resolveBuiltinSkillPage,
   resolveBuiltinSkillSlug
-} from "./chunk-JRQFUXY7.js";
-import "./chunk-DHDMC6FO.js";
-import "./chunk-Q554LLSI.js";
+} from "./chunk-VEYL5MO5.js";
+import "./chunk-WCGC6S77.js";
+import "./chunk-WJ3B6FX6.js";
+import "./chunk-AUDNYVRC.js";
+import "./chunk-A4SQRTZ6.js";
 import "./chunk-KHCLMKZZ.js";
-import "./chunk-O6OSWFZQ.js";
-import "./chunk-QDSINZM3.js";
-import "./chunk-VMFTFOWF.js";
-import "./chunk-WWC7I6TA.js";
+import "./chunk-XUWRURDF.js";
+import "./chunk-5J3PYNUP.js";
 import "./chunk-BNGW5ASC.js";
 import "./chunk-M2EJHDJP.js";
-import "./chunk-3EUW3WEO.js";
+import "./chunk-3AH7LNUB.js";
+import "./chunk-WWC7I6TA.js";
 import "./chunk-U6VC4MU4.js";
+import "./chunk-3EUW3WEO.js";
 import "./chunk-G3SUCT4W.js";
 import "./chunk-4VNS5WPM.js";
 export {

package/{chromeCommands-FZYAU75D.js → chromeCommands-K27J4OVZ.js}

@@ -1,9 +1,11 @@
 import {
   NOLO_CHROME_CONNECTOR_EXTENSION_ID,
   NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION,
+  NOLO_CONNECTOR_EXTENSION_IDS,
+  NOLO_FIREFOX_CONNECTOR_EXTENSION_ID,
   REQUIRED_CHROME_CONNECTOR_FEATURES,
   createChromeConnectorClient
-} from "./chunk-SH43IESU.js";
+} from "./chunk-YUNJN43V.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -21,6 +23,7 @@ import { dirname, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 var DEFAULT_CONNECTOR_ROOT = dirname(fileURLToPath(import.meta.url));
+var FIREFOX_EXTENSION_ID = "nolo-browser-connector@nolo.chat";
 function extensionIdFromPublicKey(publicKeyBase64) {
   const digest = createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest();
   return Array.from(
@@ -40,8 +43,23 @@ function resolveNodePath() {
 }
 function nativeMessagingHostsDir({
   home = process.env.HOME || "",
-  platform = process.platform
+  platform = process.platform,
+  browser = "chrome"
 } = {}) {
+  if (browser === "firefox") {
+    if (platform === "darwin") {
+      return resolve(home, "Library/Application Support/Mozilla/NativeMessagingHosts");
+    }
+    if (platform === "linux") {
+      return resolve(home, ".mozilla/native-messaging-hosts");
+    }
+    throw new Error(
+      `Firefox native host installation is not implemented for platform "${platform}". Windows needs a registry value under HKCU\\Software\\Mozilla\\NativeMessagingHosts pointing at the manifest file.`
+    );
+  }
+  if (browser !== "chrome") {
+    throw new Error(`Unknown native messaging browser target: "${browser}".`);
+  }
   if (platform === "darwin") {
     return resolve(home, "Library/Application Support/Google/Chrome/NativeMessagingHosts");
   }
@@ -55,16 +73,18 @@ function nativeMessagingHostsDir({
 function resolveNativeHostInstallPaths({
   home = process.env.HOME || "",
   connectorRoot = DEFAULT_CONNECTOR_ROOT,
-  platform = process.platform
+  platform = process.platform,
+  browser = "chrome"
 } = {}) {
   const supportDir = resolve(home, "Library/Application Support/Nolo/ChromeConnector");
   return {
     connectorRoot,
+    browser,
     extensionManifestPath: resolve(connectorRoot, "extension", "manifest.json"),
     hostPath: resolve(connectorRoot, "native-host", "nolo-chrome-native-host.mjs"),
     templatePath: resolve(connectorRoot, "native-host", "com.nolo.chrome_connector.json"),
     nativeManifestPath: resolve(
-      nativeMessagingHostsDir({ home, platform }),
+      nativeMessagingHostsDir({ home, platform, browser }),
       "com.nolo.chrome_connector.json"
     ),
     supportDir,
@@ -77,12 +97,13 @@ function installNativeHostManifest({
   connectorRoot = DEFAULT_CONNECTOR_ROOT,
   platform = process.platform,
   extensionId,
-  nodePath
+  nodePath,
+  browser = "chrome"
 } = {}) {
-  const paths = resolveNativeHostInstallPaths({ home, connectorRoot, platform });
+  const paths = resolveNativeHostInstallPaths({ home, connectorRoot, platform, browser });
   const manifest = JSON.parse(readFileSync(paths.templatePath, "utf8"));
   const extensionManifest = JSON.parse(readFileSync(paths.extensionManifestPath, "utf8"));
-  const resolvedExtensionId = extensionId || extensionIdFromPublicKey(extensionManifest.key);
+  const resolvedExtensionId = extensionId || (browser === "firefox" ? FIREFOX_EXTENSION_ID : extensionIdFromPublicKey(extensionManifest.key));
   const resolvedNodePath = nodePath || resolveNodePath();
   mkdirSync(paths.supportDir, { recursive: true });
   const existingToken = existsSync(paths.tokenPath) ? readFileSync(paths.tokenPath, "utf8").trim() : "";
@@ -97,12 +118,18 @@ NOLO_CHROME_CONNECTOR_TOKEN=${JSON.stringify(token)} exec ${JSON.stringify(resol
   );
   chmodSync(paths.wrapperPath, 493);
   manifest.path = paths.wrapperPath;
-  manifest.allowed_origins = [`chrome-extension://${resolvedExtensionId}/`];
+  if (browser === "firefox") {
+    delete manifest.allowed_origins;
+    manifest.allowed_extensions = [FIREFOX_EXTENSION_ID];
+  } else {
+    manifest.allowed_origins = [`chrome-extension://${resolvedExtensionId}/`];
+  }
   mkdirSync(dirname(paths.nativeManifestPath), { recursive: true });
   writeFileSync(paths.nativeManifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
     extensionId: resolvedExtensionId,
+    browser,
     nodePath: resolvedNodePath,
     tokenPath: paths.tokenPath,
     ...paths
@@ -119,6 +146,21 @@ var CLI_CONNECTOR_ROOT_CANDIDATES = [
 var FULL_SUPPORT_CHROME_FEATURES = [
   ...new Set(Object.values(REQUIRED_CHROME_CONNECTOR_FEATURES).flat())
 ].sort();
+var FIREFOX_UNAVAILABLE_FEATURES = ["browser_debug", "file_upload"];
+function resolveConnectorBrowser(extensionId) {
+  if (!extensionId) return null;
+  if (extensionId === NOLO_FIREFOX_CONNECTOR_EXTENSION_ID) return "firefox";
+  if (NOLO_CONNECTOR_EXTENSION_IDS.includes(extensionId)) return "chrome";
+  return null;
+}
+function expectedFeaturesForBrowser(browser) {
+  return browser === "firefox" ? FULL_SUPPORT_CHROME_FEATURES.filter(
+    (feature) => !FIREFOX_UNAVAILABLE_FEATURES.includes(feature)
+  ) : FULL_SUPPORT_CHROME_FEATURES;
+}
+function browserLabel(browser) {
+  return browser === "firefox" ? "Firefox" : browser === "chrome" ? "Chrome" : "browser";
+}
 function pickCliConnectorRoot(candidates) {
   for (const candidate of candidates) {
     if (existsSync2(resolve2(candidate, "extension", "manifest.json"))) return candidate;
@@ -233,9 +275,13 @@ async function probeConnectorRpc(requestChrome) {
   }
 }
 function resolveStatusNextStep(report) {
+  const targetBrowser = report.rpc.browser ?? report.nativeHost.browser;
+  const installCmd = targetBrowser === "firefox" ? "nolo chrome install --browser firefox" : "nolo chrome install";
+  const connectedLabel = browserLabel(targetBrowser);
+  const browserText = connectedLabel === "browser" ? "the browser" : connectedLabel;
   if (!report.connectorRoot) {
     if (report.rpc.online && report.rpc.protocolVersion === report.rpc.expectedProtocolVersion) {
-      return "Chrome connector is online, but this CLI cannot see a connector checkout, so `nolo chrome install` / manifest checks are unavailable here. Set NOLO_CHROME_CONNECTOR_ROOT (or run the CLI from a repo checkout) to enable them.";
+      return "The Nolo Browser Connector is online, but this CLI cannot see a connector checkout, so `nolo chrome install` / manifest checks are unavailable here. Set NOLO_CHROME_CONNECTOR_ROOT (or run the CLI from a repo checkout) to enable them.";
     }
     return "Run the CLI from a repo checkout that contains packages/desktop-chrome-connector, or set NOLO_CHROME_CONNECTOR_ROOT to one, then rerun `nolo chrome status`.";
   }
@@ -243,20 +289,20 @@ function resolveStatusNextStep(report) {
     return `This platform has no supported native messaging host install (Chrome looks the host up through a registry value on Windows), so non-interactive install is not available: ${report.nativeHost.platformError ?? "unsupported platform"}`;
   }
   if (!report.nativeHost.installed || !report.token.present) {
-    return "nolo chrome install";
+    return installCmd;
   }
   if (!report.nativeHost.wrapperPathMatches || !report.nativeHost.allowedOriginMatches) {
     const installedWrapperPath = report.nativeHost.installedWrapperPath;
     if (!report.nativeHost.wrapperPathMatches && installedWrapperPath && installedWrapperPath !== report.nativeHost.wrapperPath && existsSync2(installedWrapperPath)) {
-      return `Native host is installed for a different checkout (${installedWrapperPath}); this CLI is looking at ${report.connectorRoot}. Run \`nolo chrome status\` from the checkout that installed it, or run \`nolo chrome install\` from here only if Chrome should switch to this one.`;
+      return `Native host is installed for a different checkout (${installedWrapperPath}); this CLI is looking at ${report.connectorRoot}. Run \`nolo chrome status\` from the checkout that installed it, or run \`${installCmd}\` from here only if ${browserText} should switch to this one.`;
     }
-    return "nolo chrome install (the installed manifest does not point at this checkout's wrapper / extension id, which Chrome silently ignores)";
+    return `${installCmd} (the installed manifest does not point at this checkout's wrapper / extension id, which ${browserText} silently ignores)`;
   }
   if (!report.rpc.online) {
-    return `Load the unpacked extension from ${report.extension.path} in chrome://extensions (Developer mode) or install it from the Chrome Web Store, then rerun \`nolo chrome status\`.`;
+    return `Load the unpacked extension from ${report.extension.path} in chrome://extensions (Chrome) or about:debugging#/runtime/this-firefox (Firefox), or install the Nolo Browser Connector from https://nolo.chat/downloads, then rerun \`nolo chrome status\`.`;
   }
-  if (report.rpc.extensionId && report.rpc.extensionId !== report.extension.expectedId) {
-    return `The connected extension (${report.rpc.extensionId}) is not the connector at ${report.extension.path}; remove the other copy and rerun \`nolo chrome status\`.`;
+  if (report.rpc.extensionId && report.rpc.browser === null) {
+    return `The connected extension (${report.rpc.extensionId}) is not a recognized Nolo Browser Connector build; reload it (\`nolo chrome reload\`) or remove the other copy, then rerun \`nolo chrome status\`.`;
   }
   if (report.rpc.protocolVersion !== report.rpc.expectedProtocolVersion) {
     return `nolo chrome reload (the running extension does not speak protocol ${report.rpc.expectedProtocolVersion}; a reload restarts the worker with the files on disk)`;
@@ -264,7 +310,7 @@ function resolveStatusNextStep(report) {
   if (report.rpc.missingFeatures.length > 0) {
     return `nolo chrome reload (the running extension is missing ${report.rpc.missingFeatures.join(", ")}); if that persists, the checkout's extension is older than the CLI expects.`;
   }
-  return "Chrome connector is online: chrome_* tools execute against this Chrome profile.";
+  return `The Nolo Browser Connector is online (${connectedLabel}): connector tools execute against this ${connectedLabel} profile.`;
 }
 async function buildChromeConnectorStatus(args = {}) {
   const env = args.env ?? process.env;
@@ -295,7 +341,8 @@ async function buildChromeConnectorStatus(args = {}) {
       wrapperPath: null,
       installedWrapperPath: null,
       wrapperPathMatches: false,
-      allowedOriginMatches: false
+      allowedOriginMatches: false,
+      browser: null
     },
     token: { path: null, present: false },
     rpc: {
@@ -303,6 +350,7 @@ async function buildChromeConnectorStatus(args = {}) {
       extensionId: null,
       protocolVersion: null,
       features: [],
+      browser: null,
       missingFeatures: [...FULL_SUPPORT_CHROME_FEATURES],
       expectedProtocolVersion: NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION
     },
@@ -314,19 +362,48 @@ async function buildChromeConnectorStatus(args = {}) {
   report.rpc.extensionId = probe.extensionId;
   report.rpc.protocolVersion = probe.protocolVersion;
   report.rpc.features = probe.features;
-  report.rpc.missingFeatures = FULL_SUPPORT_CHROME_FEATURES.filter(
+  report.rpc.browser = probe.online ? resolveConnectorBrowser(probe.extensionId) ?? (probe.extensionId === expectedId ? "chrome" : null) : null;
+  report.rpc.missingFeatures = expectedFeaturesForBrowser(report.rpc.browser).filter(
     (feature) => !probe.features.includes(feature)
   );
   if (!probe.online) report.rpc.error = probe.error;
   if (!connectorRoot) {
     if (rootError) report.connectorRootError = rootError;
-    report.ok = report.rpc.online && probe.extensionId === expectedId && probe.protocolVersion === NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION && report.rpc.missingFeatures.length === 0;
+    report.nativeHost.browser = report.rpc.browser;
+    report.ok = report.rpc.online && report.rpc.browser !== null && probe.protocolVersion === NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION && report.rpc.missingFeatures.length === 0;
     report.nextStep = resolveStatusNextStep(report);
     return report;
   }
+  let manifestBrowser = report.rpc.browser === "firefox" ? "firefox" : "chrome";
+  if (!report.rpc.browser) {
+    try {
+      const chromeManifestPath = resolveNativeHostInstallPaths({
+        home,
+        connectorRoot,
+        platform,
+        browser: "chrome"
+      }).nativeManifestPath;
+      const firefoxManifestPath = resolveNativeHostInstallPaths({
+        home,
+        connectorRoot,
+        platform,
+        browser: "firefox"
+      }).nativeManifestPath;
+      if (!existsSync2(chromeManifestPath) && existsSync2(firefoxManifestPath)) {
+        manifestBrowser = "firefox";
+      }
+    } catch {
+    }
+  }
+  report.nativeHost.browser = manifestBrowser;
   let paths = null;
   try {
-    paths = resolveNativeHostInstallPaths({ home, connectorRoot, platform });
+    paths = resolveNativeHostInstallPaths({
+      home,
+      connectorRoot,
+      platform,
+      browser: manifestBrowser
+    });
   } catch (error) {
     report.nativeHost.supported = false;
     report.nativeHost.platformError = toErrorMessage(error);
@@ -340,8 +417,7 @@ async function buildChromeConnectorStatus(args = {}) {
   report.nativeHost.installed = installedManifest !== null;
   report.nativeHost.installedWrapperPath = typeof installedManifest?.path === "string" ? installedManifest.path : null;
   report.nativeHost.wrapperPathMatches = report.nativeHost.installedWrapperPath === paths.wrapperPath;
-  const expectedOrigin = `chrome-extension://${expectedId}/`;
-  report.nativeHost.allowedOriginMatches = Array.isArray(installedManifest?.allowed_origins) && installedManifest.allowed_origins.includes(expectedOrigin);
+  report.nativeHost.allowedOriginMatches = manifestBrowser === "firefox" ? Array.isArray(installedManifest?.allowed_extensions) && installedManifest.allowed_extensions.includes(NOLO_FIREFOX_CONNECTOR_EXTENSION_ID) : Array.isArray(installedManifest?.allowed_origins) && installedManifest.allowed_origins.includes(`chrome-extension://${expectedId}/`);
   if (existsSync2(paths.tokenPath)) {
     try {
       report.token.present = readFileSync2(paths.tokenPath, "utf8").trim().length > 0;
@@ -349,7 +425,7 @@ async function buildChromeConnectorStatus(args = {}) {
       report.token.present = false;
     }
   }
-  report.ok = report.nativeHost.supported && report.nativeHost.installed && report.nativeHost.wrapperPathMatches && report.nativeHost.allowedOriginMatches && report.token.present && probe.online && probe.extensionId === expectedId && probe.protocolVersion === NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION && report.rpc.missingFeatures.length === 0;
+  report.ok = report.nativeHost.supported && report.nativeHost.installed && report.nativeHost.wrapperPathMatches && report.nativeHost.allowedOriginMatches && report.token.present && probe.online && report.rpc.browser !== null && probe.protocolVersion === NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION && report.rpc.missingFeatures.length === 0;
   report.nextStep = resolveStatusNextStep(report);
   return report;
 }
@@ -357,7 +433,7 @@ function yesNo(value) {
   return value ? "ok" : "mismatch";
 }
 function formatChromeConnectorStatus(report) {
-  const lines = ["Nolo Chrome connector"];
+  const lines = ["Nolo Browser Connector"];
   lines.push(
     `  connector source : ${report.connectorRoot ?? "(not found)"}`
   );
@@ -377,7 +453,7 @@ function formatChromeConnectorStatus(report) {
   const rpc = report.rpc;
   if (rpc.online) {
     lines.push(
-      `  RPC              : online  extension ${rpc.extensionId ?? "unknown"}  protocolVersion ${rpc.protocolVersion ?? "unknown"}  features ${rpc.features.length > 0 ? rpc.features.join(", ") : "(none)"}`
+      `  RPC              : online  browser ${rpc.browser ?? "unrecognized"}  extension ${rpc.extensionId ?? "unknown"}  protocolVersion ${rpc.protocolVersion ?? "unknown"}  features ${rpc.features.length > 0 ? rpc.features.join(", ") : "(none)"}`
     );
   } else {
     lines.push(
@@ -406,9 +482,25 @@ async function runChromeStatusCommand(args, deps = {}) {
   }
   return report.ok ? 0 : 1;
 }
+function readBrowserOption(args) {
+  const equalsForm = args.find((arg) => arg.startsWith("--browser="));
+  const index = args.indexOf("--browser");
+  const raw = equalsForm !== void 0 ? equalsForm.slice("--browser=".length) : index >= 0 ? args[index + 1] : void 0;
+  if (raw === void 0) return "chrome";
+  const value = raw.trim();
+  if (value === "chrome" || value === "firefox") return value;
+  return null;
+}
 async function runChromeInstallCommand(args, deps = {}) {
   const env = deps.env ?? process.env;
   const output = deps.output ?? process.stdout;
+  const browser = readBrowserOption(args);
+  if (browser === null) {
+    output.write(
+      '[nolo] Chrome native host install failed: --browser must be "chrome" or "firefox".\n'
+    );
+    return 1;
+  }
   const install = deps.installNativeHost ?? installNativeHostManifest;
   let connectorRoot;
   try {
@@ -432,6 +524,7 @@ async function runChromeInstallCommand(args, deps = {}) {
     result = install({
       home: deps.home ?? env.HOME ?? "",
       connectorRoot,
+      browser,
       ...deps.platform ? { platform: deps.platform } : {},
       ...deps.nodePath ? { nodePath: deps.nodePath } : {}
     });
@@ -446,12 +539,12 @@ async function runChromeInstallCommand(args, deps = {}) {
   } else {
     output.write(
       [
-        "Nolo Chrome connector native host installed.",
+        `Nolo Browser Connector native host installed (${browser}).`,
         `  manifest : ${result.nativeManifestPath}`,
         `  wrapper  : ${result.wrapperPath} -> ${result.nodePath}`,
         `  token    : ${result.tokenPath} (an existing token is kept, so reruns are idempotent)`,
         `  extension: ${result.extensionId}`,
-        `Next step: load the unpacked extension from ${resolve2(connectorRoot, "extension")} in chrome://extensions (Developer mode) or install it from the Chrome Web Store, then run \`nolo chrome status\`.`,
+        `Next step: load the unpacked extension from ${resolve2(connectorRoot, "extension")} in ` + (browser === "firefox" ? "about:debugging#/runtime/this-firefox, or install the signed Nolo Browser Connector add-on from https://nolo.chat/downloads, then run `nolo chrome status`." : "chrome://extensions (Developer mode), or install the Nolo Browser Connector from https://nolo.chat/downloads (Chrome or Firefox), then run `nolo chrome status`."),
         ""
       ].join("\n")
     );
@@ -480,7 +573,7 @@ The connector service worker restarts within ~1s; verify with \`nolo chrome stat
 `);
     if (code === "CHROME_CONNECTOR_UNAVAILABLE") {
       output.write(
-        "The native host is not reachable: load the unpacked connector extension in chrome://extensions (or start Chrome), then rerun `nolo chrome reload`.\n"
+        "The native host is not reachable: open Chrome or Firefox with the Nolo Browser Connector extension enabled, or install it from https://nolo.chat/downloads (or load the unpacked connector extension in chrome://extensions), then rerun `nolo chrome reload`.\n"
       );
     }
     return 1;
@@ -488,11 +581,14 @@ The connector service worker restarts within ~1s; verify with \`nolo chrome stat
 }
 export {
   CLI_CONNECTOR_ROOT_CANDIDATES,
+  FIREFOX_UNAVAILABLE_FEATURES,
   FULL_SUPPORT_CHROME_FEATURES,
   buildChromeConnectorStatus,
   detectWorktreeCheckout,
+  expectedFeaturesForBrowser,
   formatChromeConnectorStatus,
   resolveCliConnectorRoot,
+  resolveConnectorBrowser,
   runChromeInstallCommand,
   runChromeReloadCommand,
   runChromeStatusCommand

package/{chromeOpsCommands-62P2Q2YB.js → chromeOpsCommands-IXRLN57H.js}

@@ -1,6 +1,6 @@
 import {
   createChromeConnectorClient
-} from "./chunk-SH43IESU.js";
+} from "./chunk-YUNJN43V.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -197,8 +197,8 @@ var CHROME_OPS_SUBCOMMANDS = {
 };
 function renderChromeOpsHelp() {
   const lines = [
-    "Operate the user's Chrome through the Nolo Chrome connector (the desktop bridge;",
-    "the same RPC the chrome_* agent tools use).",
+    "Operate the user's browser (Chrome or Firefox) through the Nolo Browser Connector",
+    "(the desktop bridge; the same RPC the browser_* agent tools use \u2014 legacy `chrome_*` names still work).",
     "",
     "Usage:",
     "  nolo chrome <subcommand> [flags]",
@@ -213,6 +213,7 @@ function renderChromeOpsHelp() {
     "    preferred over --selector); --selector takes a CSS selector.",
     "  Actions the connector classifies as irreversible (Submit / Delete / Pay ...)",
     "    are refused with CONFIRMATION_REQUIRED \u2014 ask the user to perform them.",
+    "  read-console / read-network / upload work on Chrome only (Firefox lacks chrome.debugger).",
     "  Every subcommand prints the connector's raw JSON result; failures exit 1.",
     "  Endpoint: NOLO_CHROME_CONNECTOR_RPC_URL or http://127.0.0.1:38947/rpc."
   ];